Mastercard SMR Program Explained 2026 — Adult Merchant Compliance Guide

Yes — the Visa Integrity Risk Program (VIRP), with different mechanics. Visa runs a parallel registration and monitoring regime for high-risk merchants including adult content. The overall posture is similar to Mastercard SMR — merchants register, comply with content-moderation and verification requirements, pay an annual fee, and stay in monitored status — but the implementation details differ. Adult merchants accepting both card networks (which is everyone, because half-coverage is not viable) must comply with both programs.

VIRP requirements. Performer age and identity verification, content moderation processes, takedown response, transaction-level recordkeeping. The substance overlaps SMR. The auditing posture is different: Visa tends to audit through the acquirer, with sample reviews of merchant records; Mastercard tends to audit more directly. Practical effect on the merchant: a compliance program designed to meet SMR will substantially satisfy VIRP, but expect small differences in documentation format and reporting cadence.

Falling out of either program means real consequences. Loss of Mastercard means roughly half of card volume is gone. Loss of Visa means the other half. You will not survive long-term on alternative-payment methods alone. Operators who let either registration lapse are typically out of business within 60 days unless they can re-register quickly — and re-registration after revocation is significantly harder than first-time registration.

What to do if you receive a non-compliance notice. Engage adult-industry counsel immediately. Do not respond yourself, do not negotiate directly with the acquirer, do not make promises you have not verified you can keep. The acquirer is the messenger; the decision-maker is the card network. A compliance-experienced attorney can usually negotiate a remediation plan if the issues are documentation gaps rather than substantive failures. The worst outcome is silent revocation while the operator believes they are still in good standing — check your registration status with your acquirer quarterly.

Performer verification at a higher bar than 2257. SMR requires verified government identification and age documentation for every performer, plus documented consent for the specific content produced. Mastercard expects you to retain this documentation for at least seven years (longer than 2257's baseline) and produce it to the acquirer on request. The practical effect: a performer release that satisfies 2257 may not satisfy SMR unless it explicitly documents scope of consent for the categories the content will be marketed under.

Content moderation processes. You must operate a documented content-moderation workflow that reviews submitted or uploaded content before publication (for tube-style platforms that accept third-party uploads) and that responds to flagged content within defined windows. Mastercard's policy distinguishes non-consensual intimate imagery (NCII) and CSAM, where the response window is <48 hours, from other complaints, where the window is longer but still bounded. The moderation workflow must be auditable — you need to be able to show how a specific piece of content was reviewed.

Takedown response procedures. Anyone (a performer, a copyright holder, a person depicted, a third party) must be able to submit a complaint through a clearly published channel and get a response within the SMR-defined window. The channel is typically a dedicated complaints email and/or web form linked from every page on the site. The response must include either the content removed or a documented reason it was not removed.

Recordkeeping. Beyond performer records, SMR expects you to keep transaction-level records, chargeback records, content-upload records (who uploaded, when, what verification was performed), and moderation records (who reviewed, when, what was the decision). Most adult CMS platforms now include moderation-record tooling by default because the card-network requirements have made it unavoidable.

Cost. The Mastercard SMR annual fee itself is in the low four figures. The real cost is operational: the moderation workflow, the recordkeeping infrastructure, the verification of every performer, the legal review of contracts, and the ongoing acquirer relationship. Most operators spend $3,000–$15,000 annually on SMR-related compliance work in addition to the fee.

Short version. Mastercard's Specialty Merchant Registration program is a registration regime for high-risk verticals, including adult content. Adult merchants who want to accept Mastercard must register, pay an annual fee, meet ongoing compliance requirements around performer verification and content moderation, and be subject to monitoring. Falling out of compliance triggers registration revocation and loss of Mastercard processing.

Why the program exists. The current SMR framework dates to spring 2022, when Mastercard tightened requirements following the December 2020 New York Times article The Children of Pornhub and the cascade of card-network actions, lawsuits, and platform changes that followed (Pornhub's 2020 Visa/Mastercard suspension and content purge, OnlyFans' August 2021 NSFW reversal-then-reversed, the broader high-risk-processor consolidation through 2024). The card networks responded by shifting more compliance burden onto merchants and processors directly, rather than relying on platforms to self-police.

What the program is not. SMR is not a government regulation. It is a private card-network rule, enforced through your processor relationship. The federal 2257 record-keeping regime is separate, applies to all adult content production regardless of payment method, and is enforced by the U.S. Department of Justice. The 2257 rules and the SMR rules overlap substantially in what they require — both demand verified performer age and identity — but they are independent obligations. Meeting one does not satisfy the other; you have to meet both.

What the program is. SMR is an ongoing registration that every adult merchant who accepts Mastercard must maintain. Registration includes: an application disclosing your business identity, ownership, and the content you produce; an annual fee paid through your acquiring bank or processor (typically passed through to you); documentation of your content moderation processes, takedown response procedures, and performer verification practices; and an ongoing reporting relationship with your acquirer. The acquirer is liable to Mastercard for your compliance, which is why processors have become much pickier about underwriting adult merchants.