Glossary
Denylist (blocklist)
A denylist, also called a blocklist, is the business's own list of what it refuses to process: card numbers or their hashes after fraud, e-mails and phone numbers, device fingerprints, IP addresses and ranges, BIN ranges, countries and merchant categories. A payment that matches is declined before any provider is called. It is a business decision, unlike a sanctions list, which is a legal obligation, and it is only as good as the discipline that adds entries and removes stale ones.
Building and keeping it
Entries come from chargebacks, confirmed fraud, abuse reports and manual review; each should carry a reason, a date and an owner. Card numbers are stored as hashes, never in clear. Entries expire or are reviewed, because devices and addresses change hands. A denylist too wide is a quiet drain on approval rates.
Denylist, allowlist and rules
An allowlist does the opposite for trusted payers, letting them skip challenges. Rules generalise both: block a BIN range for a merchant, require authentication for a country. Together they are the first layer of screening, cheap, explainable and under the business’s control.
On the platform
Tranzify’s routing conditions and limits implement a client’s deny rules: a BIN range, a country of the card or the IP, an amount band or a limit can stop a payment before routing, with the reason recorded; lists of individual cards, e-mails and devices live in the client’s own risk tooling, fed by the platform’s data.
Updated: 2026-11-08