Certification
LegitScript Healthcare Certification for the site that takes payment, or proof the application is underway.
Payments High-risk industries Telehealth
HIGH-RISK GUIDE / TELEHEALTH, GLP-1 AND PEPTIDES
Telehealth and GLP-1 payment processing in 2026.
Telehealth businesses can get stable card processing in 2026, but underwriters now look hard at three things: LegitScript Healthcare Certification, marketing claims about compounded drugs, and subscription billing practices. The FDA issued 30 warning letters to telehealth companies marketing compounded GLP-1 products on March 3, 2026, so processors review your site copy and pharmacy relationships before approval.
WHY IT IS HIGH RISK
Why processors flag telehealth businesses.
- Prescription products and compounded drugs carry regulatory and reputational risk for the acquiring bank.
- Subscription programs generate "cancelled recurring" and "not as described" disputes when patients stop treatment.
- High average tickets for multi-month plans increase exposure per chargeback.
- Enforcement shifts quickly: FDA warning letters, state pharmacy rules and ad-platform policies can change your risk overnight.
WHAT UNDERWRITERS REVIEW
What an underwriter will ask you for.
Clinical model
Who prescribes, in which states, and how the provider network is licensed and supervised.
Pharmacy and fulfillment
Your dispensing or compounding pharmacy partners, and that labels accurately identify the compounder.
Marketing and billing
Site copy, ad claims, consent flow, refund policy and how patients cancel.
RULES THAT APPLY NOW
What changed for GLP-1 and compounded drugs.
On March 3, 2026, the FDA announced 30 warning letters to telehealth companies marketing compounded GLP-1 products. The letters concerned false or misleading claims; the agency objected to promotion implying compounded products are the same as FDA-approved drugs, and to branding that obscures which pharmacy actually compounds the product. The FDA has also said certain GLP-1 ingredients, including salt forms of semaglutide, cannot lawfully be used in compounding.
For underwriting, that translates into a simple test: an underwriter should be able to read your site and see who prescribes, who compounds, and what the patient is actually buying, with no claim of equivalence to a branded drug. Research-use-only peptides do not qualify for LegitScript Healthcare Certification on that basis alone.
Subscription programs must meet Visa's rules: express consent at checkout, a confirmation with the recurring terms, a reminder at least seven days before the first paid charge after a trial, and online cancellation. Mastercard's negative-option rules carve out healthcare, but processors usually apply the stricter Visa standard across your whole program.
CARD-NETWORK RULES / CURRENT AS OF OCT 2026
Card-network thresholds every high-risk merchant should track.
Most processors act well before these limits. Track your own ratios weekly.
| Program | What triggers it | What it means for you |
|---|---|---|
| Visa VAMP (merchant "Excessive") | From April 1, 2026 in Asia Pacific, Canada, Europe and the US: a VAMP ratio of 150 basis points (1.5%) or higher AND at least 1,500 fraud plus dispute counts in the month. The VAMP ratio is fraud reports (TC40) plus disputes (TC15) divided by settled card-not-present transactions, by count. It is not a simple chargeback ratio. Other regions and earlier periods differ. | Per-event fees once enforced, a remediation plan, and pressure from your acquirer to fix it or exit. |
| Mastercard ECP: Excessive Chargeback Merchant | Chargeback ratio of 1.5% or higher and at least 100 chargebacks in a month, in two months (not necessarily consecutive). Ratio = this month's chargebacks ÷ last month's transactions. | Monthly fines that escalate from $1,000 in month two to $25,000 by month seven. |
| Mastercard ECP: High Excessive | Chargeback ratio of 3% or higher and at least 300 chargebacks. | Fines that escalate to $50,000 a month by month seven and $200,000 after month 19. |
| MATCH list (Mastercard) | Your acquirer terminates the account for a listed reason, such as excessive chargebacks, fraud or rule violations. | The listing stays for five years and most acquirers will decline a listed business or principal. |
WHAT TO EXPECT
Terms high-risk merchants are commonly offered.
Owner-confirmed Rebar field observations. These ranges are not guaranteed and are not quotes; every offer depends on the provider's underwriting and your file.
| Term | What it usually looks like | How to improve it |
|---|---|---|
| Rolling reserve | A share of each day's volume held for a set period. Owner-confirmed Rebar field observation: new high-risk accounts commonly see 5% to 10% held for 90 to 180 days. Not guaranteed; depends on underwriting. | Ask for a written step-down schedule tied to clean processing history. |
| Pricing | Higher markups than standard merchants. Interchange-plus pricing becomes available as volume and history grow. | Compare effective rate, not headline rate. Use our statement analyzer. |
| Volume caps | A monthly processing limit, often set below your forecast for the first months. | Bring 3 to 6 months of statements to support a higher cap. |
| Contract terms | Early-termination fees and, sometimes, liquidated damages. | Read the termination and reserve-release clauses before you sign. |
AVOID THESE
What gets telehealth accounts frozen or closed.
- Marketing that implies compounded drugs are FDA-approved or identical to a branded product.
- Chargeback spikes when a cohort of patients stops treatment and disputes renewals.
- Processing for a different website, brand or product line than the one approved.
- Losing or never obtaining LegitScript certification when the acquirer requires it.
- Patient complaints routed to card disputes because cancellation is hard to find.
READINESS CHECKLIST
Get underwriting-ready in 7 steps.
- 01
Apply for, or confirm, LegitScript Healthcare Certification for the exact domain that takes payment.
- 02
Audit every page and ad for equivalence or approval claims about compounded products.
- 03
Name your compounding or dispensing pharmacy accurately on labels and in your terms.
- 04
Implement Visa-standard consent, confirmation, 7-day reminders and online cancellation.
- 05
Use a clear billing descriptor and a support phone number patients recognize.
- 06
Keep patient health information out of payment metadata and processor tickets.
- 07
Prepare 3 to 6 months of statements and a dispute history if you are switching providers.
QUESTIONS
Telehealth processing questions, answered.
Do telehealth companies need LegitScript certification to accept cards?
Many acquirers require it for telehealth and pharmacy-related merchants. LegitScript states its Healthcare Certification helps payments companies meet Visa and Mastercard requirements for MCC 5122 and 5912. Even where it is not strictly required, certification makes underwriting faster and is needed for most healthcare advertising on Google and Meta.
Can I process payments for compounded semaglutide or tirzepatide?
Some specialty acquirers support compounded GLP-1 programs, but approval depends on your pharmacy relationships, prescribing model and marketing. After the FDA's March 2026 warning letters, expect underwriters to review your claims closely. Programs that imply equivalence to FDA-approved drugs are the most likely to be declined or closed.
Why was my telehealth merchant account frozen?
The most common triggers are a chargeback spike, processing outside the approved business model, or a compliance concern about marketing or certification. Ask your processor for the specific reason in writing, stop the activity that triggered the review, and document your remediation before applying elsewhere.
Do Mastercard's free-trial rules apply to telehealth subscriptions?
Mastercard's negative-option rules carve out healthcare. Visa's subscription rules have no such carve-out in the summaries we reviewed, and most processors apply the Visa standard: express consent, a confirmation, a reminder seven days before the first paid charge, and online cancellation.
Does Rebar help with LegitScript certification?
Yes. Rebar helps eligible telehealth and peptide businesses access LegitScript certification support through our processing network, at no Rebar advisory fee. See our LegitScript certification page.
NO REBAR ADVISORY FEES
Get a free pre-underwriting review for your telehealth business.
Tell us where you stand. We will flag what an underwriter is likely to question and suggest suitable processing options. Rebar charges no advisory fee; provider fees and terms apply.
SOURCES AND REVIEW
Where these facts come from.
These summaries come from the provided source dataset listed below and have not been independently verified by Rebar. Rules and enforcement change. We review this page at least quarterly and date every update. Confirm current requirements with your acquirer, card network rules and counsel before acting.
- FDA warns 30 telehealth companies against illegal marketing of compounded GLP-1s (FDA press announcement) · Primary source: 30 warning letters on Mar 3, 2026 over false or misleading compounded GLP-1 claims
- FDA's latest GLP-1 crackdown (Venable LLP, Mar 13, 2026) · 30 warning letters announced Mar 3, 2026; equivalence and compounder-identity concerns
- LegitScript Healthcare Certification for payments companies · Visa and Mastercard requirements for MCC 5122 and 5912
- Visa subscription and free-trial rules (Beancount summary, Oct 2026) · Express consent, 7-day reminder, online cancellation, trial descriptor; Mastercard negative-option rules
- Visa Acquirer Monitoring Program fact sheet (Visa, 2025) · Primary source: merchant Excessive threshold of 150 bps from Apr 1, 2026 in AP, Canada, Europe and US, with at least 1,500 monthly fraud plus dispute counts; ratio uses settled card-not-present transactions
- Visa VAMP rules explained 2026 (Easy Pay Direct) · VAMP ratio method; 2.2% merchant threshold through Mar 31, 2026, 1.5% from Apr 1, 2026
- Mastercard Excessive Chargeback Program (Chargeflow) · ECM and HECM thresholds and fine schedule, citing Mastercard's ECP guide