by: David Poisson, Senior Consultant Visual Risk IQBetter P-Card monitoring through Merchant Category Codes What is an MCC? A merchant category code (MCC) is a four-digit number assigned to a business that describes the type of goods or services the business provides. The codes are defined by the International Organization for Standardization and periodically amended. Credit card processors manage the assignment of the codes to individual businesses. How do MCCs benefit audit and compliance analytics? Merchant category codes offer powerful information that can be used by audit and compliance professionals to identify risky transactions.
- Certain categories of transactions are typically associated with personal use and are unlikely to be valid business expenses. For instance, purchases to MCC 4411 – Cruise Lines or 5933 – Pawn Shops probably deserve extra attention.
- Other categories may highlight non-compliant purchases specific to your organization. For instance, many government agencies are banned from purchases of alcohol with state or federal funds. To those agencies, purchases from MCC 5813 – Bars, Cocktail Lounges, Discotheques, Nightclubs, and Taverns-Drinking Places (Alcoholic Beverages) would indicate a high-risk and potentially inappropriate transaction.
- MCCs may highlight risks facing organization that deserve more attention. For instance, some payments to Charitable Organizations (i.e. MCC 8398) – Charitable and Social Service Organizations. This may represent valid spending but require certain disclosure or routing within an organization (e.g. Corporate Foundations) to take advantage of US Tax Laws.
- Additionally, certain codes have been found to be associated with higher levels of disputed charges such as 4121 – Taxis and limousines. While using such vendors may be used as part of normal business, it is useful to raise the profile of this spending. This way when other anomalies occur, focus is quickly drawn to transactions that are likely to represent higher risk.
- Finally, monitoring spend by MCC across an organization may provide useful insights into spending behavior and unusual differences between similar groups. Highlighting and investigating these differences can be a powerful step towards controlling waste and identifying and sharing efficiencies across the organization.
Controlling spend based on MCC Merchant Category Codes are only one piece of the puzzle. While most P-Card programs will allow specific MCC codes to be banned from use, this is not always practical. While an MCC code may be riskier, that does not mean it is never valid. Furniture sore purchases by a facilities employee may make sense, while the same spending by someone else may not. Human judgment is often required to determine if spending associated with a risky MCC appears reasonable or not. That’s why Visual Risk IQ believes in maximizing the visibility of an organization’s risks is so important, to inform human judgment, to focus on risk, and to shorten the time to a decision. Appendix – High Risk MCC Codes:
- Monitor for Non-Compliant Purchases (including personal use):
- 4411 – Cruise Lines
- 4814 – Telecom Services & Cable, Satellite, and
- 4899 – Other Pay Television and Radio Services
- 5933 – Pawn Shops
- 5712 – Furniture Stores
- 5813 – Bars, Cocktail Lounges, Discotheques, Nightclubs, and Taverns-Drinking Places (Alcoholic Beverages)
- 5968 – Direct marketing, subscription, continuity / subscription merchants
- 7299 – Misc Personal Services – not elsewhere Classified
- 7997 – Membership clubs, health clubs, country clubs, sports clubs, private golf courses, boating clubs, swimming clubs
- MCCs that may highlight other risks to the organization including reputational, compliance and corruption:
- 4829 – Money transfer, wire transfers
- 8398 – Organizations, Charitable and Social Service
- 6XXX – Merchant codes beginning with 6 are associated with financial institutions. Related transactions may include investments, money orders, etc.
- 9222, 9223, and 9399 – Fines, Bail and bond Payments, and Government Services-Not Elsewhere Classified
Note: The list above is not intended to be a complete listing of the MCCs that should be monitored as part of a travel or P-Card analytic program. Risks are unique to each organization. Visual Risk IQ recommends maintaining a listing of high–risk MCCs tailored for your organization.
For company-specific guidance, please contact David Poisson or Joe Oringel via email at: David dot Poisson @VisualRiskIQ dot com or Joe dot Oringel@VisualRiskIQ dot com.