Payments · Online Pharmacy10 min readUpdated November 2, 2026

Online Pharmacy Payment Processing

Who accepts online pharmacies, what Visa and Mastercard make your acquirer check, LegitScript or NABP, and the payment setups that hold up.

Nick Bonnassies, CMO at Tagada · checked against 19 sources

Article summary

TL;DR

An online pharmacy can take card payments, but not the way a regular store does. Shopify Payments and Square don't support it, PayPal needs pre-approval, and Stripe reviews pharmacies case by case. Most pharmacies use a merchant account from an acquirer that registers them with Visa and Mastercard, backed by state licenses and a certification such as LegitScript or NABP.

Stripe lists "Online pharmacies" as a restricted business, as of its September 22, 2026 update.
Shopify Payments excludes "prescription drugs" from the businesses it supports; Square's US terms exclude internet pharmacies (updated July 30, 2026).
Mastercard requires the acquirer to register a pharmacy before taking non-face-to-face sales, with fines up to $10,000 if it doesn't (rules of August 4, 2026).
Visa exempts pharmacies accredited by NABP "or other regulatory body recognized by Visa" from its high-integrity-risk registration (rules of October 24, 2026).
LegitScript certification costs $975 per website to apply, then $2,150 a year.

Want to go further? Ask

On this page

Tagada Rx: if you want to sell prescription treatment online without building the stack yourself, Tagada Rx brings "storefront, doctors, pharmacy and payments in one stack", with payments and LegitScript included. It is open by application18.

This page is the hub for online pharmacy payments. The general guide, for any business: how to get a high-risk merchant account. The store side is in our guide to the best ecommerce platform for online pharmacies.

Why online pharmacy payments are different

Selling prescription medications online is legal when the pharmacy is licensed and every order has a valid prescription. Processors still treat the category as one of the riskiest they carry.

The FDA reports that of roughly 35,000 active online pharmacies, about 5% comply with US pharmacy laws, according to NABP (FDA figure last updated in 2020)14. Card networks built their rules around that gap: they want proof that you are one of the legal ones before your first sale.

35,000

Active online pharmacies, roughly (NABP, via the FDA)

About 5%

Of them comply with US pharmacy laws

12 months

Longest gap between two checks of your legality (Mastercard)

What makes it different	What it means for you
Visa lists MCC 5912 and 5122 as high-integrity-risk codes for card-absent sales6	Your acquirer needs Visa's approval to carry you
Mastercard requires registration before processing8	Your acquirer registers you and checks your legality every year
Licenses are state by state10	Underwriters ask for a license for each state you ship to
Ads need certification15 16	Google and Meta ask for LegitScript (Google also accepts NABP)

Fig. 1Four steps before a pharmacy takes its first card payment

approved declined or closed routing step

State licensesEvery state you ship to (21 U.S.C. § 831)
thenCertificationLegitScript or NABP
thenAcquirer registrationWith Visa and Mastercard
thenPayment acceptedUnder MCC 5912 or 5122Approved

Each step is a document your acquirer will ask for.

21 U.S.C. § 831(b); Google Ads and Meta policies; Visa Core Rules and Mastercard Security Rules, 2026.

Do mainstream processors accept online pharmacies?

Not by default. Of the four best-known providers, one reviews pharmacies case by case, one needs pre-approval and two don't support them.

Provider	Position	Exact wording
Stripe	RestrictedApproval required, not guaranteed	"Online pharmacies, including SaaS platforms" ; "Card-not-present prescription-only products and pharmaceuticals"1
Shopify Payments	Not eligible	"Products or services that require regulatory approval or compliance, such as [...] prescription drugs"3
PayPal	Pre-approval required	"The sale of any product(s) requiring a prescription or prescription dispensing services"4
Square (US)	Not supported	"internet/mail order/telephone order pharmacies or pharmacy referral services"5

Policies read November 2, 2026.

Stripe says pharmacies "will only be approved for merchants in the US, Canada, the EU, Australia, the UK, and Japan"2. Details by provider: does Stripe allow prescription drugs?, selling prescription drugs on Shopify and PayPal and Square.

Watch out

Amazon, eBay, Etsy and TikTok Shop all prohibit prescription drugs from third-party sellers. Your own site is the channel: can you sell prescription drugs on marketplaces?

What Visa and Mastercard require

The networks don't certify you. They make your acquirer register you and prove you operate legally.

Rule	What it says
Your code	MCC 5912 "Drug Stores and Pharmacies"; 5122 for wholesale distributors of prescription drugs (Visa)6
Visa registration	The acquirer must be approved by Visa to carry high-integrity-risk merchants and register each one (Visa)7
Visa exemption	Registration "does not apply" to MCC 5122 or 5912 merchants "accredited by the National Association of Boards of Pharmacy (NABP) or other regulatory body recognized by Visa" (Visa)7
Mastercard registration	"An Acquirer first must register the Merchant with Mastercard" for non-face-to-face sale of pharmaceuticals (Mastercard)8
Proof of legality	"a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party", re-checked at least every 12 months (Mastercard)8
Penalty	Up to $10,000 for acquiring without registration, then $5,000 a month for three months and $25,000 a month after (Mastercard)8

$10,000

Mastercard fine to the acquirer for an unregistered pharmacy

$5,000

Then a month, for three months

$25,000

A month after that

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

What MCC 5912 covers: MCC 5912, drug stores and pharmacies. The full rule set: online pharmacy merchant account compliance.

LegitScript or NABP: which proof you need

Neither network names a single certification in its merchant rules. In practice, LegitScript or NABP is the simplest proof to hand your acquirer, and the ad platforms ask for them by name.

Who asks	LegitScript	NABP
Visa (registration exemption)	Not named in the Core Rules	Named7
Mastercard (proof of legality)	"Accreditation by a recognized third party"8	Same
Google Ads (US pharmacies)	Accepted15	Accepted15
Meta ads	Required16	Not mentioned16

Fig. 2One certification, four readers

Your certificationLegitScript, NABP, or both

VisaNABP named for the registration exemption
MastercardAccreditation by a recognized third party
Google AdsLegitScript or NABP accepted
MetaLegitScript required

Meta is the only one that names a single program.

Visa Core Rules and Mastercard Security Rules, 2026; Google Ads and Meta ad policies, read November 2, 2026.

LegitScript charges $975 per website to apply and $2,150 a year once approved9. The comparison in full: NABP .pharmacy or LegitScript.

The laws your processor will check

Underwriters don't give legal advice, but they read your licenses and your website against these rules. This is general information, not legal advice.

State licenses
Federal law ties online pharmacies to "the requirements of State law concerning the licensure of pharmacies in each State from which it, and in each State to which it" ships controlled substances10. In practice, expect to show a license for every state you ship to.
A valid prescription
For controlled substances, the Ryan Haight Act requires a valid prescription, which in principle means "at least 1 in-person medical evaluation"11. Telemedicine flexibilities run "January 1, 2026 through December 31, 2026"12. Check their status before 2027.
Health data
HIPAA does not apply to an entity "engaged in authorizing, processing, clearing, settling [...] payments" for those activities13. Your pharmacy system and your store still have to keep health data out of places it doesn't belong.
What regulators flag
The FDA lists pharmacies that "Allow you to buy medicine without a prescription" or "State that the medicine will be shipped from a foreign country" as warning signs14.

The full legal picture: is it legal to sell prescription drugs online?

Your three payment setups

Setup	How it works	Strength	Weakness
Aggregator (Stripe, PayPal)	Shared account, pharmacy approval on request	Familiar tools	Approval not guaranteed and revocable1; not available on Shopify Payments or Square
Dedicated merchant account	An acquirer underwrites you and registers you with Visa and Mastercard	Built for the category	Longer review, reserve likely, one account is a single point of failure
A platform that carries the regulated relationship	Storefront, prescribers, pharmacy and payments run by one provider	You don't build the stack	You work inside the provider's model and eligibility

A licensed pharmacy with its own site usually goes the dedicated route. A brand that sells prescription treatment without running its own pharmacy can look at a platform such as Tagada Rx.

Step by step: how to get an online pharmacy merchant account approved. No processing history yet? Merchant accounts for new online pharmacies.

Fees and reserves the market publishes

Few processors publish pharmacy pricing. These are their figures, not Tagada's.

Term	Published figure	Published by
Rate, above $1 million a month	"generally pay between 4-5%"	Instabill17
Rate, under $50,000 a month	"generally receive rates between 6-7%"	Instabill17
LegitScript	$975 per site, then $2,150 a year	LegitScript9
Mastercard registration	"Annual registration fee" per merchant, amount not published in 2026	Mastercard8

Ask every processor, in writing, for the rate, the reserve, the payout delay and what happens to your balance when you leave. More: online pharmacy processing fees and reserves.

Guides for online pharmacies

Theme	Guides
Providers	Stripe · Shopify · PayPal and Square · Amazon, eBay, Etsy, TikTok Shop
Getting started	Is it legal? · Start an online pharmacy · Licenses · New pharmacies · Get approved
Certification and rules	Compliance · Visa pharmacy certification · NABP or LegitScript · Advertising
Money	Fees and reserves · Payouts · International payments · Payment methods
Checkout and refills	Prescription-gated checkout · Subscriptions · Trial offers
Disputes and fraud	Chargebacks · Chargeback alerts · Fraud and 3D Secure · Declined payments
When things go wrong	Stripe closed your account · Switch payment processor

Running a care brand rather than a pharmacy? See telehealth payment processing.

How Tagada helps

Payments and LegitScript included, for prescription brands

Tagada Rx is a telehealth stack with storefront, doctors, pharmacy and payments, for brands that sell prescription treatment online. You bring the brand and the ads18.

Need	What Tagada Rx provides
Payments and certification	"Payments and LegitScript included"; the store runs on a Tagada-hosted, LegitScript-certified domain18 19
Charge only what is prescribed	"The card is only captured once a doctor approves"; if the doctor declines, the hold is released18
Refills	Recurring orders rebill the day the pharmacy ships19
Fulfillment	Routing to a licensed US pharmacy18
Health data	"PHI never touches Tagada storage"19

Tagada Rx serves US patients and is open by application to a selected group of brands; Tagada reviews every application. Terms are on the Tagada Rx page.

Apply to Tagada Rx

Payments and LegitScript included, for prescription brands

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Can an online pharmacy use Stripe?

Possibly. Stripe lists online pharmacies as restricted, so it asks for licenses and details before approving, and says approval "may be modified or revoked" at any time. Its FAQ answers "Maybe" and limits pharmacies to the US, Canada, the EU, Australia, the UK and Japan.

Why are online pharmacies considered high risk?

Card networks see a category where most sites operate outside the law: the FDA cites NABP's estimate that about 5% of online pharmacies comply with US rules. Visa lists pharmacy codes as high integrity risk, and Mastercard requires registration and yearly proof of legality.

Do I need LegitScript to accept cards?

Not by name. Mastercard accepts a legal opinion or "accreditation by a recognized third party", and Visa exempts NABP-accredited pharmacies from registration. LegitScript or NABP is the simplest proof to provide, and Meta requires LegitScript for ads.

Which MCC does an online pharmacy use?

MCC 5912, "Drug Stores and Pharmacies", for pharmacies that sell prescription and proprietary drugs. Wholesale distributors use 5122. Both codes trigger Visa's and Mastercard's registration rules for card-not-present sales.

Does HIPAA apply to my payment processor?

Not for payment processing itself. Section 1179 of the Social Security Act excludes entities "engaged in authorizing, processing, clearing, settling, billing" payments from HIPAA for those activities. Keep prescription details out of payment descriptions and order metadata all the same.

Sources

Checked November 2, 2026

Tagada Rx

Prove you're a legal pharmacy before your first sale

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review