Payment Processing & Banking
Bottom line for this section
Payment processing is the single hardest operational pillar — Stripe/Square/PayPal/Shopify all prohibit the category through multiple AUP clauses, and even specialized high-risk processors enforce 5-10% rolling reserves with 90-180 day holds plus card-brand monitoring (VAMP 1.5% threshold tightening April 2026) that can trigger account termination on chargeback drift alone.
Research
A telehealth business selling compounded peptides under prescription occupies one of the most aggressively-policed merchant categories in US card acceptance. Stripe's published Restricted Businesses list (last updated 2026-05-13) explicitly enumerates 'Telemedicine and telehealth services,' 'Card-not-present prescription-only products and pharmaceuticals,' and 'Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims' — covering the category through three independent clauses — while Shopify Payments, Square, and PayPal each prohibit through separate clauses. Specialized high-risk processors (Easy Pay Direct, Soar Payments, PaymentCloud, eMerchantBroker, Durango, Corepay, AllayPay, Seamless Chex) underwrite the category at 2.95-6.0% per transaction, 5-10% rolling reserves held 90-180 days, and almost universally require LegitScript Healthcare certification for telehealth Rx workflows. Visa replaced VDMP and VFMP with VAMP effective April 1 2025 (enforcement Oct 1 2025), with merchant 'Excessive' threshold at 2.2% combined fraud + dispute ratio in 2025 tightening to 1.5% on April 1, 2026 in the US/Canada/EU; Mastercard ECM triggers at 100+ monthly chargebacks AND 1.5% ratio for two consecutive months with $1,000/$1,000/$5,000/$5,000/$5,000 fines months 2-6 plus $5 Issuer Recovery Assessment per chargeback after the first 300.
Key facts
Stripe's published Restricted Businesses list (last updated 2026-05-13) names 'Telemedicine and telehealth services' as a restricted category in its own right — every compounded-peptide-telehealth merchant trips at least one of Stripe's prohibitions independent of the drug.
Stripe's same list separately enumerates 'Card-not-present prescription-only products and pharmaceuticals' and 'Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims,' giving Stripe three independent grounds to terminate.
Shopify Payments' eligibility policy lists 'Prescription drugs, medical devices' as regulated/prohibited and 'Pseudo pharmaceuticals' as separately prohibited; third-party analyses note Shopify groups peptides under 'research chemicals, pseudo-pharmaceuticals, and nutraceuticals' for prohibition purposes.
Square's published Payment Terms prohibit 'internet/mail order/telephone order pharmacies or pharmacy referral services (where fulfillment of medication is performed with an internet or telephone consultation, absent a physical visit)' — language directly capturing the telehealth-dispensed compounded-peptide model.
PayPal's Acceptable Use Policy prohibits transactions involving 'narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety,' drug paraphernalia, and 'a product sold as a dietary supplement and promoted on its label or in its labeling as a treatment, prevention, or cure for a specific disease or condition'; industry reporting confirms PayPal routinely terminates GLP-1 / peptide telehealth accounts.
On September 9, 2025 the FDA launched an enforcement initiative issuing ~100 cease-and-desist letters and ~55 warning letters to online sellers of compounded GLP-1 drugs — Hims & Hers Health Inc. (dba Hers) received a named warning letter #716825 citing 'Same active ingredient as Ozempic and Wegovy,' 'Clinically proven ingredients,' and 'GENERIC OZEMPIC/WEGOVY' — and this wave materially elevated acquirer perception of category risk for processor underwriting.
Specialized high-risk processors that actively underwrite compounded peptide / telehealth Rx merchants include Easy Pay Direct, Soar Payments, PaymentCloud, eMerchantBroker (EMB), Durango Merchant Services, Corepay, AllayPay, and Seamless Chex — none publish full rate cards, but industry-published ranges show 2.95-6.0% per transaction with 5-10% rolling reserves held 90-180 days.
LegitScript Healthcare certification is treated as a de facto prerequisite by most high-risk acquirers for telehealth dispensing of GLP-1s and compounded peptides; Soar Payments explicitly requires 'VIPPS Certification or proof of registration with LegitScript' for online medicine sales, and Corepay describes LegitScript as required by acquiring banks.
Seamless Chex publishes peptide-merchant terms: credit card 2.95-5.5%, ACH/eCheck under 2%, 10% rolling reserve held 3-6 months, no contracts, and prohibits specific drug names ('semaglutide/tirzepatide/retatrutide drug names prohibited per FDA guidance') while accepting general 'GLP-1/GLP-2/GLP-3 category labels for research purposes' — illustrating how even high-risk processors police listing language post-May-2025 FDA enforcement.
Visa replaced its legacy VDMP and VFMP with the consolidated Visa Acquirer Monitoring Program (VAMP) effective April 1, 2025; merchant 'Excessive' threshold set at a 2.2% combined fraud + dispute ratio in 2025 and tightens to 1.5% on April 1, 2026 in the US, Canada, and EU, with formal enforcement that began October 1, 2025.
VAMP's ratio = count of fraud (TC40) + disputes (TC15) ÷ count of settled transactions (TC05) on card-not-present Visa transactions, with a 1,500-event monthly minimum for merchant-level inclusion; for acquirers, portfolio-level thresholds are 50 basis points (Above Standard) and 70 basis points (Excessive).
Mastercard's Excessive Chargeback Merchant (ECM) program triggers when a merchant has 100+ monthly chargebacks AND a chargeback ratio above 1.5% for two consecutive months; fines are $0 (month 1), $1,000 (months 2-3), and $5,000 each in months 4-6, with a $5 Issuer Recovery Assessment per chargeback after the first 300, plus a separate HECM tier at 300+ chargebacks and 3% ratio with $10,000 monthly fines.
When mainstream processors (Stripe, Square, PayPal) terminate a peptide/telehealth account they typically hold remaining balance and rolling reserve for 90 to 180 days; documented case: a $18k/month research-peptide seller had a Stripe account terminated with no warning and $11,200 in pending payouts frozen for 127 days.
Mercury Bank does not list telehealth, pharmacy, or peptides among its explicitly prohibited industries (which are adult entertainment, marijuana, and internet gambling), but Merchant Maverick documents 'account closures and difficulty accessing funds' complaints and Mercury's 2024-2025 mass closure of accounts tied to compliance/AML triggers — meaning a high-risk telehealth peptide LLC retains real banking-side closure risk on disclosure of activity.
ACH and crypto rails do not escape the underwriting problem: ACH processing for peptide telehealth still passes through processor underwriting (Seamless Chex caps ACH at 'under 2%' but still requires the same documentation), NACHA implemented stricter fraud-monitoring rules for ACH transactions in March 2026, and crypto-only options such as Coinbase Commerce avoid card-network rules but introduce cash-out / on-ramp friction and do not eliminate the bank-side AML closure risk.
Tradeoffs
Mainstream low-risk processor vs specialized high-risk processor at launch
Attempt mainstream (Stripe / Square / Shopify Payments)
Pro: Lowest published rates (~2.9% + $0.30); Best developer integration and subscription tooling; No rolling reserve at modest volume; Fast self-serve onboarding
Con: All four major mainstream processors have explicit AUP clauses covering telehealth/Rx — termination is when not if; Termination typically no warning with 90-180 day reserve hold; Documented freeze: $11,200 frozen for 127 days on $18k/mo seller; Discovery of prohibition usually happens after dependency built
Start on specialized high-risk (Easy Pay Direct / Soar / PaymentCloud / EMB / Durango / Corepay / Seamless Chex)
Pro: Category explicitly underwritten — no termination on activity itself; Acquirer prepared for chargeback profile and product class; Many include chargeback monitoring / dispute defense; Multi-MID failover available day 1
Con: Higher effective rate: 2.95-6.0% per transaction + monthly fees; Mandatory 5-10% rolling reserve 90-180 days (working-capital drag); LegitScript Healthcare certification typically required (cost + 30-60 day timeline); Manual underwriting days-to-weeks vs minutes for Stripe; Some processors police listing language (e.g., ban 'semaglutide/tirzepatide')
Single-processor vs multi-MID failover architecture
Single high-risk MID
Pro: Lower operational complexity; Single integration, single reserve account; Cleaner reporting and reconciliation; Easier dispute handling chain
Con: 100% concentration risk — termination freezes 100% receivables for 90-180 days; Single chargeback-program enrollment takes whole business offline; No A/B routing to optimize approval rates; No leverage with processor
Multi-MID with intelligent routing / hot-failover
Pro: If Processor A terminates, Processor B carries volume with no customer-facing outage; Reserve diversified across two acquirers; Better rate-renegotiation leverage; Can optimize routing by issuer / BIN / amount
Con: 2x onboarding effort and 2x LegitScript documentation; 2x monthly fees and 2x integration maintenance; Risk of triggering 'cycling' suspicion; Reconciliation across two acquirers complicates finance ops
Card-network rails vs ACH / crypto alternatives
Card-network (Visa/Mastercard) via high-risk acquirer
Pro: Highest customer conversion; Subscription billing infrastructure mature; Familiar dispute / refund mechanics; Fraud tooling (3DS, AVS/CVV) well-developed
Con: VAMP and ECM monitoring (1.5% chargeback ceiling looming Apr 2026); 5-10% rolling reserves; Card-brand rule changes can shift thresholds
ACH / eCheck primary
Pro: Lower per-transaction cost (<2%); No Visa/Mastercard monitoring exposure; Lower chargeback frequency vs cards; Can combine with cards as alternate
Con: Underwriting still required at similar level; NACHA tightened fraud-monitoring rules March 2026; Return-rate thresholds carry their own program risk; Customers more reluctant to share routing/account numbers; Slower funding
Crypto checkout (~4% flat)
Pro: No card-brand AUP exposure; Irreversible transactions eliminate chargeback risk; Available immediately without underwriting; Useful as failover
Con: Tiny adoption (<5% of telehealth consumers); Cash-out conversion still passes through banked exchange; Volatility unless instant-fiat-settle; Regulatory uncertainty on token-payment classification for Rx drugs
"Payment processing is the single hardest operational pillar — Stripe/Square/PayPal/Shopify all prohibit the category through multiple AUP clauses, and even specialized high-risk processors enforce 5-10% rolling reserves with 90-180 day holds plus card-brand monitoring (VAMP 1.5% threshold tightening April 2026) that can trigger account termination on chargeback drift alone."
Recommendation
Skip mainstream processors entirely from day 1 — attempting Stripe means deferred termination plus 90-180 day reserve freeze on receivables. Start with two high-risk processors pre-underwritten and warm-routed: one primary (Easy Pay Direct or Soar Payments via Authorize.net/NMI integration, LegitScript Healthcare Merchant Certification required), one backup (Seamless Chex or PaymentCloud, secondary integration). Use LegitScript Healthcare Merchant Certification before any payment activity (also gates Meta/Google ads per §7). Model effective payment cost at ~4.5% transaction + 10% rolling reserve held 6 months at 12% annualized opportunity cost (per the section's CostEstimator) — not the Stripe 2.9% mental model. Implement chargeback prevention (pre-purchase consent, anti-friendly-fraud controls, AVS/CVV, 3DS, explicit subscription-renewal notification) to stay below VAMP 1.5% threshold.
Steel-manned counter
The strongest counter is that smaller-scale operators (sub-$50K/month) may be able to operate on Stripe for 6-18 months before category-level detection happens, capturing early growth + customer-acquisition cohorts before the inevitable termination. The cost of that approach is the 90-180 day reserve freeze on whatever balance is in flight at termination, plus the 30-90 day underwriting gap to a high-risk replacement. Founders who can absorb $50-200K in frozen funds for a quarter while replacement underwriting completes may rationally accept this tradeoff. The failed-operator side: documented freeze cases (the $18k/month research-peptide seller cited in InclusivePay) show even small operators get hit.
| Feature | Stripe | Square | PayPal | Shopify Payments | Easy Pay Direct | Soar Payments | PaymentCloud | Seamless Chex |
|---|---|---|---|---|---|---|---|---|
| Accepts compounded peptide telehealth? | No — prohibited under 3 AUP clauses | No — prohibits mail-order pharmacy without physical visit | No — prohibits narcotics/steroids + unapproved supplement claims | No — prescription drugs + pseudo-pharmaceuticals prohibited | Yes — LegitScript required | Yes — VIPPS or LegitScript required | Yes — telemedicine practice area; case-by-case | Yes — research category accepted; named drug listings prohibited |
| Transaction fee | 2.9% + $0.30 (irrelevant if terminated) | 2.6% + $0.10 (irrelevant) | 2.99% + $0.49 (irrelevant) | 2.9% + $0.30 (irrelevant) | Not public (industry 2.95-6.0%) | Not public (industry 2.95-6.0%) | Not public — varies | Credit card 2.95-5.5%; ACH under 2% |
| Rolling reserve | Discretionary on termination (100% / 90-180 days) | Discretionary on termination | Discretionary on termination | Discretionary on termination | 5-10% / 90-180 days | 5-10% / 90-180 days | 5-10% / 90-180 days | 10% / 3-6 months |
| Monthly minimum / fees | None (until terminated) | None (until terminated) | None (until terminated) | None (until terminated) | Not public | Not public | Not public | No contracts / no hidden fees |
| Contract term | Month-to-month TOS | Month-to-month TOS | Month-to-month TOS | Month-to-month TOS | Typically multi-year with ETF | Typically multi-year | Typically multi-year | No contract per published terms |
| LegitScript Healthcare required? | N/A — won't underwrite category | N/A | N/A | N/A | Yes (partner discount available) | Yes — VIPPS or LegitScript | Likely yes for telehealth Rx | Optional for research-only; available for telehealth GLP-1 |
| Integration / gateway | Native API + Stripe Checkout | Native API + Square Checkout | Native API + Braintree | Native Shopify only | Authorize.net / NMI | Authorize.net / NMI typical | 100+ third-party integrations | Native + Authorize.net / NMI; MOTO, ACH/eCheck |
Likelihood → / Impact ↑
Open questions
Things this report could not resolve. Send these to your specific advisor.
PayPal's verbatim Acceptable Use Policy text for prescription drugs, telehealth, and compounded pharmaceuticals could not be retrieved directly.
Email this question to your lawyerAdyen's Acceptable Use Policy URL returned 404 on 2026-05-21; Adyen's current public restricted-business list is not pinned.
Email this question to your lawyerPublished rate sheets for Easy Pay Direct, Soar, PaymentCloud, EMB, Durango, Corepay, and AllayPay are not public — named-processor quotes require direct contact.
Email this question to your lawyerWhether any specific telehealth-peptide merchant has been formally placed into Visa VAMP enforcement at the new April 2026 1.5% threshold.
Email this question to your lawyerLegitScript Healthcare certification annual fee for telehealth dispensing of compounded peptides is not published; direct quote request needed.
Email this question to your lawyer