Why do processors restrict peptide and telehealth businesses?
Because the card networks' own rules single out drugs and pharmacies. This post is part of our peptide advertising compliance guide, and it covers the payment side: what the networks require of the banks that sign merchants (acquirers), and what the major processors say in their own terms.
Visa: products that imply prescription-drug efficacy
The Visa Core Rules (edition of April 18, 2026, section 1.9.2.1) require acquirers to ensure a merchant does not accept Visa cards for "The purchase of products that claim or imply a similar efficacy as prescription drugs, controlled substances, or recreational/street drugs, irrespective of claims of legality." This is the rule a "research peptide" seller runs into when its marketing implies a drug effect. A label does not change what the marketing implies. Our post on why "Research Use Only" does not protect a peptide business shows how the FDA reads the same evidence.
Visa: pharmacies are Tier 1 High-Integrity Risk
Visa's Integrity Risk Program guide (April 2023) classifies card-absent pharmacies, merchant category codes (MCCs) 5122 and 5912, as "High Integrity Risk Merchant – Tier 1." The Core Rules (section 1.9.5.1) require an acquirer to be approved by Visa and to register each such merchant before submitting its transactions. Visa can also permanently prohibit a merchant, or its principals, for "entering illegal or brand-damaging Transaction activity into the Visa payment system" (section 1.9.1.4).
Mastercard: non-face-to-face pharmacy registration
Mastercard's Security Rules and Procedures, Merchant Edition requires the acquirer to register a merchant whose primary business is selling prescription drugs card-not-present (MCC 5122 and 5912) and to verify that its activity complies with applicable law. Mastercard says that verification "may include ... a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party" (section 9.4.3). One caveat on sourcing: Mastercard's current manuals were not accessible to us, so every Mastercard rule in this post comes from the September 2020 edition, republished by the acquirer Moneris. Where Stripe's current documentation restates the same rule, we cite both.
We found no network category named "research peptides" in the rules we read. The rules that apply are the drug-efficacy rule and the pharmacy rules above. LegitScript describes Mastercard's Business Risk Assessment and Mitigation (BRAM) program and Visa's Integrity Risk Program (VIRP) as designed to protect card brands and consumers "from illegal and/or brand-damaging activity."
Do you need LegitScript or NABP accreditation to take card payments?
For a pharmacy, accreditation is the cleanest path. For a telehealth clinic, it depends on the processor.
| Who | What accreditation does |
|---|---|
| Visa | A pharmacy (MCC 5122 or 5912) accredited by NABP "or other regulatory body recognized by Visa" is exempt from High-Integrity Risk registration, per the 2026 Core Rules. Visa's 2023 program guide names NABP's programs and the LegitScript Healthcare Merchant Certification Program.[1][2] |
| Mastercard | Accreditation by a recognized third party is one way an acquirer can verify a pharmacy's legality. The 2020 text does not name LegitScript.[3] |
| Stripe | "Telemedicine businesses don't need certification from LegitScript," but must provide licensing and regulatory items for verification during onboarding (as of October 2026).[6] |
Ad platforms ask the same question from a different angle. As of October 2026, Google requires LegitScript certification for telemedicine ads and Meta requires it for prescription-drug ads, covered in our post on Google, Meta and TikTok ad rules for peptide clinics.
What do Stripe, Square and PayPal allow?
Each processor publishes its own list. These are the positions on the dates shown.
| Processor | Prohibited | Allowed with review or pre-approval |
|---|---|---|
| StripePage last updated 2026-09-22 | "Incorrectly labeled research chemicals." Pseudo-pharmaceuticals or nutraceuticals "that are not safe or make harmful claims." Products not disclosed in the account application.[5] | Telemedicine and telehealth services, online pharmacies, and card-not-present prescription-only products, as restricted businesses needing extra due diligence. Prescription peptides need preapproval.[5][6] |
| SquareTerms last updated July 30, 2026 | Internet, mail or telephone order pharmacies and pharmacy referral services where medication follows an internet or telephone consultation "absent a physical visit." High-risk products and services.[7] | Not covered in the terms cited here |
| PayPalPolicy last updated October 29, 2022 | "Narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety."[8] | Prescription items and prescription dispensing services. Telemedicine services.[8] |
Stripe. "Peptides are banned on Stripe" is false. Stripe's FAQ says it "supports the sale of many different peptides, with some limitations," and that "A large number of peptides are prescription only and are required to be sold by pharmacies, meaning Stripe must preapprove the merchant." It also says: "We will assume that peptides sold where no purpose is specified are sold for human consumption." Stripe's restricted businesses list prohibits using Stripe with "false, manipulated, inaccurate, or misleading information" about the business, or for products "that weren't disclosed in the business's Stripe account application."
Square. Square's payment terms prohibit pharmacies and pharmacy referral services that fulfill medication after an internet or telephone consultation without a physical visit. In our reading, a telehealth model that prescribes after a remote consultation and fulfills the medication fits that wording. Square's terms do not mention peptides.
PayPal. PayPal's Acceptable Use Policy requires pre-approval for "The sale of any product(s) requiring a prescription or prescription dispensing services" and for "Providing medical services and consultations in a remote fashion." It does not mention peptides.
What is the MATCH list?
MATCH is Mastercard's database of merchants that acquirers have terminated. Mastercard's own name for it is the "Mastercard Alert to Control High-risk (Merchants)" system. The 2020 rules describe it as "a mandatory system for Mastercard Acquirers unless excused by Mastercard or prohibited by law," used to review risk "before entering into a Merchant Agreement" (section 11.1).[3] Visa runs a counterpart, VMSS, and the industry calls both "terminated merchant files."[4]
- Who is listed: the business and its principal owners. The 2020 rules let acquirers add up to five principal and associate owners per merchant.[3][4]
- How long: "Merchant records remain on the MATCH system for five years," after which they are purged automatically (section 11.2.6). Stripe's current page agrees: "Listings remain active for 5 years."[3][4]
- Why: an acquirer must add a merchant if, at termination, it "has reason to believe" one of the listed reason conditions exists (section 11.2.2).[3]
Two reason codes are the ones most relevant to a business selling unapproved drugs. Code 13, Illegal Transactions: "The Merchant was engaged in illegal Transactions." Code 10, Violation of Standards, which covers breaches of Mastercard's rules, including prohibited transactions. Stripe's current page lists the same codes.[3][4] Code 03, Laundering, is narrower than its name suggests: Mastercard defines it as presenting transaction records "that were not valid Transactions for sales of goods or services between that Merchant and a bona fide Cardholder." Which code applies is the terminating acquirer's decision.
What does a MATCH listing mean, and what does it not mean?
| A listing means | A listing does not mean |
|---|---|
| An acquirer terminated the merchant and had reason to believe a listed condition existed.[3] | That a court or regulator found wrongdoing, by itself. The trigger is the acquirer's reason to believe a listed condition exists, though one reason code covers a principal's fraud conviction. |
| Most processors will decline the business or its owners. Stripe says "A MATCH listing generally disqualifies a merchant from processing with Stripe."[4] | An automatic network-wide block. MATCH is an inquiry tool, and the next acquirer decides. In Visa's Asia-Pacific, CEMEA and Europe regions, the Core Rules say an acquirer "must not refuse to enter into a Merchant Agreement based solely on information held on the VMSS."[1][3] |
| The record follows the principal owners, not only the business name, for five years.[3][4] | A permanent ban. Records are purged after five years. Visa's separate power to permanently prohibit a merchant and its principals is a different mechanism.[1][3] |
In practice, a listing is severe. Stripe calls a terminated-merchant-file listing "a severe industry-wide restriction, as most processors automatically reject listed businesses or principal owners."[4]
Is it illegal to miscode your MCC or hide what you sell?
It breaks network rules and processor terms, and it has been prosecuted as part of a bank fraud conspiracy.
- Network rules. Visa requires the acquirer to assign "the MCC that most accurately describes" the merchant's business (Core Rules section 1.5.1.11). The merchant's part is to describe its business truthfully in the application.[1]
- Processor terms. Stripe prohibits false or misleading information about the nature of the business and selling products not disclosed in the application.[5]
- Criminal exposure. In March 2021 the US Attorney's Office for the Southern District of New York announced that a jury had convicted two defendants, each of one count of conspiracy to commit bank fraud, in a scheme in which they "worked with and directed others to apply incorrect merchant category codes ("MCCs") to the marijuana transactions in order to disguise the nature of those transactions." The scheme also used shell companies, fake websites and fake merchants.
That case does not show that miscoding alone is bank fraud. It shows that federal prosecutors have charged MCC miscoding, as part of a wider scheme, as conspiracy to commit bank fraud. No card-network document we read calls miscoding "bank fraud." The networks speak of rule violations, termination, MATCH listing and fines.
Do acquirers keep checking your website after approval?
Yes. Approval is not a one-time review.
- Mastercard requires the acquirer of an e-commerce merchant to "regularly ... review and monitor the Merchant's website(s) and business activities" to confirm they are legal and compliant, and recommends, as a best practice, a merchant monitoring solution (2020 rules, section 7.2).[3]
- Visa requires daily transaction monitoring of High-Integrity Risk merchants, starting the 31st day after first deposit (Core Rules section 10.4.5.2). Its 2023 program guide has the acquirer attest that it will keep monitoring and update registrations with changes such as URLs.[1][2]
- LegitScript, in its October 2025 peptide guide for payment processors, tells reviewers to look for "Not for Human Consumption" language, to check what buyer safeguards a merchant's site has in place, and to "carefully scrutinize any website offering in-demand peptides, such as semaglutide and tirzepatide."
Our own advice, not a network rule: assume your ads, landing pages, social posts and checkout are read together, by the acquirer, the ad platforms and the FDA. If the ad copy implies an outcome the application never mentioned, that gap is what a reviewer finds. Our post on what a peptide or GLP-1 clinic can and cannot say in ads covers the claim side.
What does an underwriter want to see from a prescriber-led clinic?
This is our working checklist, drawn from the rules above. It does not guarantee approval by any processor.
- A licensed prescriber evaluates each patient before any prescription product is sold.
- A partner pharmacy that is licensed and, ideally, NABP-accredited or LegitScript-certified, since Visa's 2023 program guide names both for its pharmacy exemption.
- An application that names every product and service you sell, under the business model you actually run.
- A checkout that cannot sell a prescription product to a visitor without a prescription.
- Licensing documents ready for the processor's review. Stripe asks telemedicine businesses for them during onboarding.
- Marketing that makes no drug-efficacy claim a reviewer would read as a prescription-drug promise.
Software can enforce item 4. In LUKE, a product the clinic flags as requiring a prescription cannot be bought without an active, verified prescription, and the rule is enforced at checkout and in the database.
Prescription-gated checkout for prescriber-led clinics
LUKE gives clinics prescription-gated checkout for flagged products, intake links and a lead pipeline, and Stripe billing in one platform. Products the clinic flags as prescription-only cannot be bought without an active, verified prescription.
Advertising and marketing services are provided by Ernesto Cullari Media LLC, LUKE's agency partner, under a separate agreement. They are not part of a LUKE software subscription.
Frequently Asked Questions
Does Stripe allow peptide sales?
With limits. As of October 2026, Stripe says it supports the sale of many peptides, requires preapproval for prescription peptides sold by pharmacies, and assumes any peptide sold without a stated purpose is for human consumption. Stripe prohibits incorrectly labeled research chemicals and treats telemedicine, online pharmacies and card-not-present prescription products as restricted businesses that need extra due diligence.
Can a telehealth clinic use Square to take payments?
Square's payment terms, last updated July 30, 2026, prohibit pharmacies and pharmacy referral services that fulfill medication after an internet or telephone consultation without a physical visit. In our reading, a telehealth model that prescribes after a remote consultation and fulfills the medication fits that wording. Check the current terms and ask Square directly before applying.
What is the Mastercard MATCH list?
MATCH, the Mastercard Alert to Control High-risk (Merchants) system, is a database of merchants that acquirers have terminated, including their principal owners. Mastercard acquirers use it to review risk before signing a merchant. An acquirer must add a merchant it terminates when it has reason to believe a listed condition exists, such as illegal transactions or violation of Mastercard's standards.
How long does a business stay on the MATCH list?
Five years. Mastercard's rules say merchant records remain on MATCH for five years and are then purged automatically, and Stripe's current documentation says the same. During that time most processors decline listed businesses and owners, and Stripe says a listing generally disqualifies a merchant from processing with Stripe.
Is miscoding a merchant category code bank fraud?
Miscoding breaks card-network rules and processor terms, and it has been prosecuted as part of a bank fraud conspiracy. In 2021 a federal jury in the Southern District of New York convicted two defendants of conspiracy to commit bank fraud in a scheme that applied incorrect MCCs to disguise marijuana transactions, alongside shell companies and fake websites. No card-network rule calls miscoding bank fraud by itself.
Do payment processors monitor my website after approval?
Yes. Under Mastercard's 2020 rules edition (the latest we could read), Mastercard requires acquirers to regularly review their e-commerce merchants' websites and recommends automated monitoring tools. Visa requires daily transaction monitoring of High-Integrity Risk merchants, such as card-absent pharmacies. LegitScript's guide for payment processors tells reviewers to look for not-for-human-consumption language and to scrutinize sites offering semaglutide and tirzepatide.
Sources
- Visa Core Rules and Visa Product and Service Rules (April 18, 2026)
- Visa Integrity Risk Program guide (April 6, 2023)
- Mastercard Security Rules and Procedures, Merchant Edition (September 22, 2020), as republished by Moneris
- Stripe, MATCH and terminated merchant files
- Stripe, Prohibited and restricted businesses (last updated September 22, 2026)
- Stripe, Prohibited and restricted businesses FAQ
- Square, Payment Terms (last updated July 30, 2026)
- PayPal, Acceptable Use Policy (last updated October 29, 2022)
- US Attorney's Office, Southern District of New York, press release (March 24, 2021)
- LegitScript, Peptides for Payment Processors guide (October 2025)
- LegitScript, BRAM and VIRP