Payments · Online Pharmacy8 min readUpdated November 2, 2026

Online Pharmacy Merchant Account Compliance: The Rules to Follow

The rules an online pharmacy must follow to keep a merchant account: Visa and Mastercard registration, legality, licensing, disputes, health data.

Nick Bonnassies, CMO at Tagada · checked against 13 sources

Article summary

TL;DR

To keep a merchant account, an online pharmacy must be licensed where it ships, dispense only on a valid prescription, and let its acquirer register it with Visa and Mastercard (MCC 5912 or 5122). The acquirer needs proof of legality, usually LegitScript or NABP certification, re-checked yearly. After approval, disputes, refill billing and ads stay under watch.

Visa ranks pharmacies (MCC 5122 and 5912) in Tier 1, its highest integrity-risk level, in its April 2023 program guide.
Visa exempts pharmacies accredited by NABP "or other regulatory body recognized by Visa" from its high-risk registration (rules of October 24, 2026).
Mastercard's August 4, 2026 rules accept "a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party", re-verified at least every 12 months.
The DEA's telemedicine flexibilities for controlled substances run through December 31, 2026.
HIPAA does not apply to payment processing as such, under section 1179 of the Social Security Act.

Want to go further? Ask

On this page

This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: what a high-risk merchant account requires. For brands rather than pharmacies, Tagada Rx bundles storefront, doctors, pharmacy and payments, open by application.

Who sets the rules

Five layers decide whether you can take cards. A gap in any one of them can close your account.

Layer	What it controls	Where it's written
Card networks	Registration of pharmacies, proof of legality, dispute thresholds	Visa Core Rules1, Mastercard Security Rules4
Your acquirer	Underwriting, monitoring, reserves	Your merchant agreement
Federal law	Prescriptions, controlled substances, online disclosures	21 U.S.C. § 829 and § 8315 6
State boards of pharmacy	Licenses where you operate and where you ship	Each state's pharmacy act8
Platforms	Ads, storefront, health data	Google, Meta, TikTok, Shopify policies10

Whether selling is legal in the first place: is it legal to sell prescription drugs online?

Card network rules

Visa and Mastercard don't certify you. They make your acquirer register you and prove you're legal before it takes card-not-present payments.

Rule	Visa	Mastercard
Category	MCC 5912 "Drug Stores and Pharmacies", 5122 for wholesale; both on the list of "high integrity risk MCCs"2	"Non-face-to-face sale of pharmaceuticals (MCC 5122 and MCC 5912)"4
Who registers	The acquirer, approved by Visa for high-integrity risk acquiring1	"An Acquirer first must register the Merchant with Mastercard"4
Exemption	Pharmacies accredited by NABP "or other regulatory body recognized by Visa"1; the program guide names NABP and the LegitScript Healthcare Merchant Certification3	None stated for accredited pharmacies4
Proof of legality	Covered by the registration, or by the accreditation exemption1 3	Legal opinion or "accreditation by a recognized third party", re-verified at least every 12 months4
Monitoring	Acquirer reviews Tier 1 merchants' volume, ticket size, transactions and disputes daily from day 311	BRAM investigates merchants "potentially engaging in illegal or brand-damaging Transactions"4
Penalty for the acquirer	Set in the Visa rules1	Up to $10,000 for an unregistered merchant, then monthly fines4

Day 31

From then, the acquirer reviews a Tier 1 merchant's disputes daily (Visa)

12 months

Longest gap between two checks of your legality (Mastercard)

$10,000

Maximum Mastercard fine to the acquirer for an unregistered merchant

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Watch out

Neither network names LegitScript as a requirement in its rulebook. LegitScript describes its certification as "a necessary part of the approval process"13; that's its wording, not the networks'. In practice, a certification is still the simplest proof to hand your acquirer.

Fig. 1How a pharmacy gets registered with the networks

approved declined or closed routing step

Your pharmacyFile, licenses, proof of legality
sends the file toYour acquirerApproved for high-integrity risk acquiring
registers you withVisa and MastercardRegistered under MCC 5912 or 5122
thenEvery 12 monthsMastercard re-verifies your legality

You never deal with Visa or Mastercard directly: your acquirer does.

Visa Core Rules, October 24, 2026; Mastercard Security Rules, August 4, 2026.

The registration codes in detail: MCC 5912 and MCC 5122.

Licensing and prescriptions

Your acquirer checks the same signals the FDA gives consumers. Each one maps to a document in your file.

State licenses
The FDA's test for a safe online pharmacy: "licensed by the state board of pharmacy in your state and the state where the pharmacy is operating"8. Ship to a state only once you hold what it requires.
Valid prescription
It "Requires a prescription from a licensed healthcare professional"8. Selling without one is the first sign of an illegal pharmacy on the FDA's list8.
US address and pharmacist
It "Provides a physical address in the United States" and "Has a state-licensed pharmacist available to answer your questions"8.
Controlled substances
Federal law bars dispensing them over the internet "without a valid prescription", which in principle requires "at least 1 in-person medical evaluation"6. Temporary DEA flexibilities run until December 31, 20267.
Homepage disclosures
A pharmacy that dispenses controlled substances online must post a compliance statement and its details (DEA registration address, pharmacist in charge, states of licensure) on its homepage5.

Watch out

If you fill orders from a partner pharmacy, your acquirer reviews the partner too. LegitScript says fulfillment partners "are typically required to hold LegitScript certification or equivalent accreditation"13.

What no merchant account will take

Some products and practices are refused whatever your licenses.

Look-alike products. Visa bars "The purchase of products that claim or imply a similar efficacy as prescription drugs, controlled substances, or recreational/street drugs, irrespective of claims of legality"1.
Foreign shipping into the US. The FDA flags pharmacies that "State that the medicine will be shipped from a foreign country"8.
No-prescription offers. "Allow you to buy medicine without a prescription from your doctor" is on the FDA's list of red flags8.
Unlicensed sites. "Are not licensed by a state board of pharmacy in the United States"8.

Disputes and refill billing

Once approved, your dispute rate decides how long you keep the account.

Program	Threshold
Visa VAMP, merchant "Excessive" (US)	1.5% of card-not-present transactions since April 1, 2026, with at least 1,500 fraud reports and disputes a month (Visa)11
Mastercard Excessive Chargeback Merchant	1.5% and at least 100 chargebacks a month, as reported (Chargeback Gurus)12
Mastercard High Excessive	3% and at least 300 chargebacks, as reported (Chargeback Gurus)12

Refills billed automatically follow the networks' subscription rules: clear terms, consent, reminders and online cancellation.

The details: how to sell prescription drugs on subscription. Preventing disputes: chargebacks for online pharmacies.

Health data and payments

HIPAA does not apply to an entity "engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments" for those activities, including card payments "for, or related to" health care9.

That exemption covers the payment, not the rest of your stack. Your prescriptions and patient records stay under HIPAA, and some platforms refuse them outright: Shopify says it doesn't support "uploading Protected Health Information subject to HIPAA"10.

Data	Where it belongs	Rule
Card number, amount, billing address	Payment processor	Section 1179 exemption9
Prescription, intake answers, patient record	HIPAA-ready clinical or pharmacy system	HIPAA
Order and shipping status	Checkout or order system, without clinical detail	Keep health data out of product names and descriptors

Keeping health data out of your ad tracking: server-side tracking for online pharmacies.

Compliance checklist

License the pharmacy in its home state and in every state you ship to5 8.
Get certified by LegitScript or accredited by NABP, per website13.
Publish your US address, pharmacist contact and licenses on the site8.
Gate every prescription-only order behind a valid prescription8.
Apply for a merchant account under MCC 5912 (or 5122 if you sell wholesale)2.
Write clear refill terms with consent and online cancellation.
Monitor disputes monthly against the 1.5% lines11 12.
Renew certifications and licenses before they lapse; Mastercard re-checks every 12 months4.
Review ads against each platform's pharmacy policy: advertising rules for online pharmacies.

Fig. 2One month's check, filled in

Compliance check · NovemberOne pharmacy, one website, refills and first orders

State licenses: Home state and every shipping state
LegitScript certification: Active, renewal due
Site disclosures: US address, pharmacist, licenses
Prescription gate: On every prescription-only order
Visa and Mastercard ratios: Under the 1.5% lines
Refill terms and cancellation: Tested online
Ads and landing pages: One page sells a look-alike product

Illustrative record, not real data.

One lapse is enough to reopen the file.

Illustrative example.

Approval itself, step by step: how to get an online pharmacy merchant account approved.

How Tagada helps

Certification and pharmacy routing for prescription brands

If you run a brand that sells prescription treatment online rather than run a licensed pharmacy yourself, Tagada Rx puts storefront, doctors, pharmacy and payments in one stack.

Payments and LegitScript included: your store runs on a Tagada-hosted domain that holds the LegitScript certification
Pharmacy routing to a licensed US pharmacy, and US-licensed clinicians, licensed in the patient's state
Health data kept out: Tagada never persists PHI; it stores routing data only (case IDs, statuses, timestamps), per its Rx documentation
Open by application to a selected group of brands; Tagada reviews every application

Terms are on the Tagada Rx page.

Apply to Tagada Rx

Certification and pharmacy routing for prescription brands

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Do Visa and Mastercard require LegitScript for online pharmacies?

Not by name. Visa exempts pharmacies accredited by NABP or another recognized body from its high-risk registration, and its program guide names LegitScript. Mastercard asks for a legal opinion or "accreditation by a recognized third party". Most acquirers ask for one of the two certifications.

Who registers my pharmacy with Visa and Mastercard?

Your acquirer does. Visa requires the acquirer to be approved for high-integrity risk acquiring and to register each merchant; Mastercard says the acquirer "first must register the Merchant". You supply the documents: licenses, certification, ownership and website.

Does my payment processor need to sign a HIPAA business associate agreement?

Not for processing payments. Section 1179 of the Social Security Act exempts payment activities, including card payments for health care. If a vendor also stores prescriptions or patient records, that part falls under HIPAA.

Can an online pharmacy ship controlled substances?

Only with a valid prescription, which federal law ties in principle to at least one in-person evaluation, plus DEA registration and homepage disclosures. Temporary telemedicine flexibilities run through December 31, 2026. Many processors and platforms exclude these products altogether.

How often is compliance checked?

Continuously. Visa's rules have the acquirer review Tier 1 merchants daily from day 31, Mastercard requires re-verification at least every 12 months, and certifications such as LegitScript renew every year.

Sources

Checked November 2, 2026

Tagada Rx

Keep the pharmacy account you were approved for

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review