The 2026 rules. What changed and how we work with each.

LegitScript Healthcare Merchant Certification is the third-party credential that U.S. acquirers now require to onboard compounded peptide pharmacies, licensed telehealth providers, and longevity clinics dispensing peptide therapy. It verifies that the merchant is a legitimate healthcare provider — licensed where required, dispensing under prescription, sourcing from compliant suppliers.

The application is procedurally hostile to founders without experience. Mis-tier yourself and you'll wait six weeks to be told you need to reapply. Miss a disclaimer on a single product page and your application stalls. Use the wrong category for a GLP-1 vs. a different peptide and the reviewer rejects without explaining which one was wrong.

What we do: we pre-screen your site against the LegitScript matrix before you submit, pay the $1,075 fee at-cost (no markup), and walk you through the disclosure requirements. Approved merchants typically clear in 2–3 weeks instead of 6–8.

Every state has its own pharmacy onboard with its own scope rules for what 503A and 503B pharmacies can compound. The acquirers we work with require evidence that your pharmacy operates within state-onboard scope and holds active DEA registration where applicable (for controlled-substance precursors, certain peptide intermediaries, etc.).

What we do: we verify your state pharmacy license, your DEA registration if relevant, and your 503A/503B compliance posture before submitting your application to underwriting. We catch licensing gaps before the acquirer sees them.

Healthcare-track merchants have unique billing needs: recurring monthly subscriptions tied to active prescriptions, prescription-event-tied one-off charges, refund handling when a patient lapses on telehealth follow-up. Our gateway supports prescription-event-tied billing flows and provides HIPAA-aware logging on payment events.

What we do: we configure your subscription billing engine, set up the prescription-tied transaction events, and walk your team through the HIPAA-aware data flow during onboarding.

Every product page must carry a clear "research use only — not for human consumption" disclaimer. So must every PDP variant, every cart summary, every checkout confirmation, and every order confirmation email. Acquirers and card-brand auditors check every public surface. One product page without the disclaimer is enough to fail the audit.

What we do: we audit every product surface on your site before submitting your application. We supply the disclaimer language, the COA reference structure, and the batch-ID display patterns that the auditors expect to see. We do not approve a merchant whose labeling is inconsistent.

The Business Risk Assessment and Mitigation (BRAM) program is how Mastercard polices its acquirers' portfolios. In June 2025, Mastercard amended BRAM (GLB 11691.1) to explicitly include research peptides and unapproved injectables among the categories that trigger automatic fines and merchant-level review. BRAM specifically targets RUO sellers who use human-use marketing language, even when the product label says "research only."

What we do: we audit your marketing copy — product pages, blog posts, social media, influencer briefs, ad creative, email flows — for human-use language. If a Mastercard auditor would flag it, we flag it before underwriting. We supply rewrites where needed and tell you what to remove.

Every merchant gets a Merchant Category Code that determines how transactions are classified. For RUO peptide brands, the right MCC is the difference between staying open and getting flagged. 5912 (Drug Stores & Pharmacies) is wrong for RUO. 5499 (Miscellaneous Food Stores / Specialty) is sometimes acceptable. 8049 (Medical Practitioners) is wrong for RUO. There is no single right answer — it depends on your product mix, supplier chain, and customer flow.

What we do: we pick the right MCC with the acquirer based on your product mix. We document the rationale so that if the card brands ever audit, the paperwork explains the choice. Wrong MCCs are how RUO brands get retroactively flagged six months after they start processing.

An age-verification gate at checkout is now table stakes for RUO peptide sellers. For higher-risk SKUs (anything that could be misused), an ID-verification step at checkout — name, date of birth, sometimes ID photo upload — is increasingly expected. Acquirers want to see the friction.

What we do: we wire your checkout to a 18+ verification gate at minimum, and we configure ID-verification flows for the SKUs that warrant them. We use third-party identity-verification providers that don't store PII on your servers.

The FDA does not regulate peptides per se — it regulates claims. The 80+ FDA warning letters issued across 2025 and 2026 to peptide sellers were almost uniformly about copy: "research use only" disclaimers paired with consumer-facing dosing pages, comparative claims against approved drugs like Ozempic, and unsubstantiated claims about therapeutic effect. One warning letter to your brand and your MID is at risk inside thirty days regardless of whether you change the copy after.

What we do: we review your product pages, blog content, social media posts, and influencer briefs before underwriting. We are not lawyers, but we have seen what triggers letters. We will not approve a merchant whose copy looks like the last three brands that got hit. This service is free for approved merchants.

We decline RUO-only sellers who make human-use claims anywhere on their site. We decline merchants whose product pages compare their compound directly to FDA-approved drugs by name. We decline merchants without third-party CoA testing visible per batch. We decline merchants whose compounder or supplier chain is undisclosed. We decline compounding pharmacies operating outside their state board's scope. We decline telehealth providers without a real prescribing-physician relationship.

This is not us being picky. These are the merchant categories that have collapsed every prior peptide processor's portfolio. Every approved PeptideApprove merchant benefits from the ones we said no to.