Payments · Online Pharmacy6 min readUpdated November 3, 2026

Switching Payment Processor for Online Pharmacies Without Losing Cards

How an online pharmacy moves saved cards and refills to a new processor: network registration first, what transfers, the steps, after a closure.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

Saved cards can move: the old processor sends an encrypted export to a new processor that is PCI DSS Level 1 certified. Refill subscriptions don't move, so you rebuild them. For an online pharmacy, the new acquirer must first register you with Mastercard, and with Visa unless you hold a recognized accreditation, before processing your payments.

Mastercard requires the acquirer to register a non-face-to-face pharmacy (MCC 5122, 5912) before acquiring its transactions (edition of August 4, 2026).
Stripe sends card data only to "another PCI DSS Level 1-compliant payment processor".
Stripe's export includes card details, emails and attached metadata, but not subscriptions, payment history or Link cards.
"Each PSP issues its own token format": cards are re-tokenized on import.
Cardholders can generally dispute for up to 120 days at Stripe: keep the old account open that long.

Want to go further? Ask

On this page

This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: switching payment processor without losing customers. For brands rather than pharmacies, Tagada Rx bundles storefront, doctors, pharmacy and payments, open by application.

Line up the new acquirer first

Your cards are useless on a processor that can't yet accept your payments. For a pharmacy, acceptance depends on card network registration done by the acquirer.

Network	What the new acquirer must do
Mastercard	Register the pharmacy before acquiring; verify it complies with applicable laws, then re-verify at least every 12 months (§9.4.3)2
Mastercard	Penalty for acquiring without registration: up to $10,000, then monthly assessments (§9.2.1)2
Visa	Be approved for high-integrity risk acquiring and register the merchant, unless the pharmacy is accredited by NABP or another body Visa recognizes (§1.9.5.1)3

$10,000

Mastercard penalty, at most, for acquiring a pharmacy without registration

12 months

Maximum gap between Mastercard legality checks

120 days

Typical Stripe payout pause after a risk action

Mastercard's proof of legality "may include, but is not limited to, a written opinion from independent, reputable, and qualified legal counsel or accreditation by a recognized third party"2. Have your state pharmacy licenses and your LegitScript or NABP accreditation ready on day one. The list: online pharmacy merchant account compliance.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

What moves and what doesn't

Data	Moves?	How
Card numbers and expiry dates	Yes	Encrypted export to a PCI DSS Level 1 processor1
Patient emails and metadata	YesFrom Stripe	In the same export1
Processor tokens	No	Re-created by the new processor4
Cards saved with Link	No	Excluded by Stripe1
Subscriptions and refill schedules	No	Rebuild from your records1
Payment history	No	Pull from the Dashboard or API1

Watch out

The export carries "any attached metadata"1. If clinical details ever ended up in payment metadata, they travel with the file. Audit metadata before you request the export, and keep prescription data in the pharmacy system, not in payment objects.

Fig. 1Old processor to new: what crosses over

Moves in the encrypted export

Card numbers and expiry dates
Patient emails and metadata, from Stripe

Stays behind

Processor tokens, re-created by the new processor
Cards saved with Link
Subscriptions and refill schedules
Payment history

Stripe Docs, Request a payment data export; Gr4vy, December 3, 2025; Mastercard and Visa rules.

The migration, step by step

Get approved by the new processor, including card network registration2 3.
Request the export from the old processor, naming the new one; Stripe asks for its attestation of compliance and PGP key1.
Export your refill schedules yourself: patient, plan, price, next ship date, status.
Match each refill to an active prescription in the pharmacy system; don't rebuild refills that have no prescription behind them.
Rebuild subscriptions on the new system with the same dates and prices.
Test real charges, a void and a refund before renewals run.
Run both processors for one full billing cycle, as one migration guide recommends7.
Keep the old account open for refunds and disputes on past charges6.

In this order: approval first, renewals only after a tested import.

Watch out

A new name on the statement creates "I don't recognize this" disputes. Keep your pharmacy or brand name in the descriptor, and tell patients before the next charge if it changes.

If you're switching after a closure

When	Action
Day 0	Read the notice; request the card export at once1
Days 0 to 2	Export refill schedules and history; apply to a new processor with your licenses and accreditation
Until approval	Pause refills you can't charge yet; tell affected patients
Before renewals	Import, rebuild, test, then restart refills
Ongoing	Answer disputes on the old account while funds are held; Stripe typically pauses payouts for 120 days after a risk action5

Fig. 2Switching after a closure, stage by stage

Day 0Read the notice; request the card export
Days 0 to 2Export refill schedules; apply with licenses and accreditation
Until approvalPause refills you can't charge; tell patients
Before renewalsImport, rebuild, test, then restart refills
OngoingAnswer disputes on the old account while funds are held

Ask for the card export on day 0.

Stripe Docs, payment data export, and Stripe Unacceptable Risk Policy.

After a Stripe closure: why Stripe closed your online pharmacy account.

Avoid the next forced switch

Fig. 3Five habits that make the next switch easy

Know where cards live
And how they would move, before you need it.
Check platform lock-in
Some pharmacy platforms impose their processor; Pharmacy Times suggests asking whether you can choose your own merchant account and what migration limits apply8.
Keep your own records
Of refills, consent and prices.
Keep disputes low
So a closure doesn't happen: chargebacks for online pharmacies.
Plan a backup processor
Behind the same checkout: payment routing for online pharmacies.

How Tagada helps

Data you can export, processors you can change

Tagada Rx is a telehealth stack with storefront, doctors, pharmacy and payments, built to avoid lock-in on data9:

"Your data is yours to export"9.
Two ways to get paid: TagadaPay managed, where you hold no processor credentials, or bring your own processor, where "you keep the acquiring relationship, the settlement and the risk"10.
Card data vaulted once: "Transactions flow to the best processor automatically"11.
Subscriptions with retries, pause and resume, cancellation and processor changes.

Tagada Rx is open by application to a selected group of brands. Details: Tagada Rx.

Apply to Tagada Rx

Data you can export, processors you can change

Updated on November 3, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Can an online pharmacy move saved cards to a new processor?

Usually. The old processor sends an encrypted export to a new processor that is PCI DSS Level 1 certified; Stripe requires its attestation and PGP key. Tokens don't move as-is: the new processor re-tokenizes the cards.

Do refill subscriptions transfer when I change processor?

No. Stripe doesn't export subscriptions or payment history. Export refill schedules yourself, match each to an active prescription, and rebuild them on the new system before the next ship date.

Why does a pharmacy need registration before switching?

Mastercard requires the acquirer to register a non-face-to-face pharmacy before acquiring its transactions, and Visa requires high-integrity risk registration unless you're accredited by NABP or another recognized body. Until that's done, the new account can't process your payments.

Will patients have to re-enter their card?

Not if the export succeeds. Cards saved through Link are excluded, and some cards will have expired, so plan a card update email for those patients.

How long should I keep the old processor account?

At least as long as patients can dispute past charges: generally up to 120 days at Stripe. Refunds on old orders also run from the old account.

Sources

Checked November 3, 2026

Tagada Rx

Switch processor without losing a refill

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review