How to Get a Payment Gateway for an Online Pharmacy in 2026

A payment gateway for an online pharmacy lets you take Visa and Mastercard for prescriptions, over-the-counter medicines and telehealth consultations. It authorises each payment, holds the charge until a prescriber approves the order, bills repeat patients for refills and settles the money to your business account in the currency you choose.

Approval takes more work than in most sectors. Visa places online pharmacies in Tier 1 of its integrity risk program, next to gambling, so only acquirers with a separate Visa approval can take them. Mastercard adds its own registration and third-party checks. Mainstream processors need prior approval, and every acquirer reviews your licences, prescription process and product pages before your first payment.

We make this part simple. Through one short intake form, Binderr Chooses, we place you with a regulated partner that accepts online pharmacies. We prepare the file it reviews, from licences and certification to your checkout flow, and run the application with you. Most pharmacies are taking card payments within 5 to 7 business days.

What Is a Payment Gateway for an Online Pharmacy?

A payment gateway for an online pharmacy is the link between your checkout and an acquirer that has agreed to process card payments for medicines. It sends each payment for authorisation, returns the answer to your site and passes approved payments to your merchant account for settlement. Pharmacies often use it in two steps: the card is authorised when the patient orders, and the payment is captured only after a prescriber approves the prescription. Our guide to what a payment gateway is covers the general mechanics. What sets a pharmacy apart is the acquirer behind the gateway and the card scheme approvals it needs before it can take you on.

Why Card Schemes Treat Pharmacies as High Risk

Medicines sold online can hurt people when the rules are skipped. Counterfeit and unapproved drugs, prescription medicines sold without a prescription and controlled substances shipped across borders all pass through online checkouts. Visa's answer is to place card-absent pharmacies in Tier 1 of the Visa Integrity Risk Program. That covers MCC 5912, drug stores and pharmacies, and MCC 5122, wholesale drug distributors. Tier 1 is for business types where illegal activity could harm health or safety, and pharmacies share it with adult content, dating and escort services, and gambling. Mastercard treats non-face-to-face pharmaceutical merchants as a specialty category too. On top of the legal risk, pharmacies carry dispute risk from refill subscriptions, held orders and billing names patients do not recognise.

Pharmacy Payment Gateway vs Mainstream Processors

Stripe lists online pharmacies, card-not-present prescription-only products, prescription delivery services and telemedicine as restricted businesses that need its approval. It also says an approval is specific to the service you described and can be modified or revoked at any time. PayPal's acceptable use policy requires pre-approval for anything that needs a prescription and for telemedicine. A pharmacy payment gateway on a specialist acquirer starts from the other end: your licences, certification, prescription flow and product list are reviewed first, and the acquirer registers you with the card schemes where the rules require it. Our guide to how high risk payment processing works explains that model, and the question of whether Stripe and PayPal allow high risk merchants is covered in its own guide.

Visa and Mastercard Rules for Online Pharmacies

Every payment gateway for an online pharmacy depends on an acquirer that meets the card schemes' rules for this sector. Those rules decide which acquirers can take you on, what you have to prove and how many steps sit between your application and your first payment. The certification exemption below is the rule that saves the most time.

Visa Tier 1 and Merchant Registration

The Visa Integrity Risk Program replaced the Global Brand Protection Program in 2023. Under it, an acquirer must hold High Integrity Risk registration with Visa before it signs any merchant in these categories. Tier 1 needs more: a separate, additional Visa approval for each Tier 1 category, an initial control assessment and an annual control self-assessment. Each pharmacy the acquirer takes on must then pass enhanced due diligence of its controls, and the acquirer must register the merchant with Visa before the first transaction and update the record when details such as website addresses change. Our guide to Visa and Mastercard high risk merchant registration covers the process step by step.

The NABP and LegitScript Exemption

Visa's merchant registration rule has one exception that matters to every pharmacy. It does not apply to merchants under MCC 5122 or 5912 that are accredited by the National Association of Boards of Pharmacy (NABP), through its Healthcare Merchant Accreditation or Drug Distributor Accreditation, or that hold LegitScript Healthcare Merchant Certification. The April 2026 Visa Core Rules keep the same exemption for NABP accreditation or another body Visa recognises. A certified pharmacy therefore skips a registration step, and the acquirer can lean on an independent review of your licences, prescription process and website that has already been done. That is why certification shortens approval.

Mastercard Registration and Third-Party Verification

Mastercard's Security Rules and Procedures put pharmaceutical merchants selling without the customer present into its Specialty Merchant Registration Program, so the acquirer registers you with Mastercard as well. Mastercard also requires a merchant selling prescription drugs in a card-not-present environment to be verified by a recognised third party. It has recognised NABP's .pharmacy programme for that since 2018, and LegitScript lists Mastercard among the networks that recognise its certification. In 2026 Mastercard raised the cost of this category. Acquirers in the US, Middle East and Africa and parts of Asia Pacific and Latin America now pay USD 1,000 a year per registered specialty merchant, USD 0.02 per transaction and 0.10% of volume on those merchants' sales, plus a USD 50,000 annual licence to acquire specialty merchants at all. Many acquirers pass these costs on.

What Certification Costs and How Long It Takes

LegitScript Healthcare Merchant Certification costs USD 975 per website to apply, non-refundable, and USD 2,150 per website each year once you are certified. Expedited processing costs USD 2,500 per application. NABP's Healthcare Merchant Accreditation costs USD 1,075 per website, paid yearly, and the review only starts once you hold an active .pharmacy domain. US pharmacies can also hold NABP's Digital Pharmacy Accreditation, which includes a policy review and an on-site survey and is recognised or required by more than 20 state boards of pharmacy. Neither body publishes a fixed review time, so apply early. LegitScript certification and NABP's Healthcare Merchant Accreditation are also recognised by Google and Bing for pharmacy advertising.

Merchant Category Codes for Pharmacy and Telehealth

Your merchant category code tells card issuers what you sell. MCC 5912 covers drug stores and pharmacies that sell prescription and proprietary drugs. MCC 5122 covers business-to-business and wholesale drug distributors. A telehealth service that only charges for consultations usually sits under a medical code such as 8011 for doctors or 8099 for other medical services, and neither is on Visa's Tier 1 list. Visa's rules require a separate code for each line of business when one of them is high integrity risk, so a platform that sells consultations and medicines needs the medicine line coded as a pharmacy. Our list of high risk merchant industries and MCC codes shows how the codes are applied.

How to Get a Payment Gateway for Pharmacy Sales

To get a payment gateway for pharmacy sales, you need a licensed pharmacy, a prescription process that cannot be bypassed, a compliant website and a company file the acquirer can verify. An online pharmacy needs a pharmacy merchant account, payment gateway and business bank account, and the acquirer reviews all three together. A complete file on the first submission is what keeps approval inside a week.

Pharmacy Licences in the US, UK and EU

In the US, a pharmacy must be licensed by the board of pharmacy in its home state and licensed or registered in every state it ships to. Acquirers ask for the full list and compare it with your shipping settings. A pharmacy that ships to 30 states and holds 25 licences can expect to be asked to block the other five before approval.

In Great Britain, the pharmacy premises must be registered with the General Pharmaceutical Council (GPhC), and online doctor services based in England register with the Care Quality Commission. Sellers based in Great Britain have not displayed the EU common logo since 1 January 2021. Northern Ireland still requires it, with registration through the MHRA.

In the EU, every legal online pharmacy or retailer has had to show the EU common logo since 1 July 2015, and the logo must link to the national regulator's list of legal online sellers. Each member state sets its own conditions for selling medicines at a distance, and some restrict or ban online sales of prescription medicines. Acquirers ask which countries you ship to and which medicines you sell in each. Our guide to high risk merchant accounts in the UK and Europe covers the account side.

Prescription Checks Before Payment

Selling prescription drugs without a valid prescription is unlawful, and it is the first thing an acquirer checks. Reviewers look at whether a prescription-only product can be bought without a consultation. Build the flow so that a prescription medicine cannot be dispatched until a licensed prescriber has approved it, and keep a record of every consultation.

In Great Britain, the GPhC guidance for pharmacies providing services at a distance, updated on 4 February 2025, goes further for higher risk medicines such as weight loss drugs. Answers in an online questionnaire must be independently verified through medical records, two-way communication or the patient's GP. For weight loss medicines, the prescriber must independently verify weight, height or body mass index, for example by video or through clinical records. The guidance also stops patients from choosing a prescription-only medicine before the consultation, so a product page with an add to basket button for a prescription drug is a problem.

Controlled Substances and the DEA Rules

Controlled substances bring their own rules. In the US, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 generally requires at least one in-person medical evaluation before a controlled substance is prescribed over the internet, and a pharmacy that dispenses controlled substances online needs its DEA registration modified for that activity. The DEA and HHS have extended the telemedicine flexibilities four times. The current extension runs to 31 December 2026 and lets DEA-registered practitioners prescribe Schedule II to V medicines through audio-video telemedicine without a prior in-person visit. Acquirers ask whether you dispense any scheduled drugs and want the registrations if you do. If your model depends on the flexibilities, show the reviewer how you would meet the in-person rule if they end.

What Acquirers Check on Your Website

Reviewers read the whole site. They look for your licence numbers, the pharmacist in charge, a physical address, a customer service contact, a refund policy, clear terms, a privacy notice and your company's country at checkout, which Visa's rules require from every online merchant. Product pages must not promise cures, and prescription-only products must not be sold as if anyone can buy them. Visa's rules also bar card acceptance for products that claim or imply the same effect as prescription drugs or controlled substances, whatever their legal status. Herbal or research chemical alternatives to prescription medicines are declined for that reason.

Documents Needed for a Pharmacy Payment Gateway

You apply as a company, with registration documents, proof of ownership down to the individuals behind the business, ID and proof of address for directors and owners, and a business bank account for settlement. Acquirers run the business verification checks payment firms are required to run. For the pharmacy itself, have your licences, your certification or its application, the pharmacist in charge, your prescriber arrangements, your wholesaler or supplier licences and a full product list ready. Three to six months of card statements help if you already process. New pharmacies can still be approved, usually with a higher reserve at the start. If you are still forming the business, see how to set up a company, and for the settlement account, how to open a high risk bank account.

Telehealth and Online Pharmacy Payments

Telehealth and online pharmacy often share one checkout: a consultation fee, then the medicine, then repeat supplies. Each is a different kind of charge for the acquirer, and a payment gateway for an online pharmacy that also runs consultations has to handle all three cleanly. Consultation-only platforms are covered in our guide to the payment gateway for telehealth.

Consultation Fees and Prescription Charges

Keep the consultation and the medicine as separate charges with separate descriptions. The consultation pays for the prescriber's time whether or not a prescription is issued, and the patient should know that before paying. Charge the medicine, or capture it from the earlier authorisation, only once the prescription is approved. If the prescriber declines, void or refund the medicine charge the same day. An authorisation only holds for a limited number of days, so a slow prescriber queue means some orders need a fresh charge. A patient billed for a drug they were never prescribed will often dispute the charge.

Weight Loss Programmes and Subscriptions

Monthly weight loss programmes built on GLP-1 medicines are the part of this market acquirers look at hardest. They combine a Tier 1 product, a recurring charge, a high monthly price and heavy advertising. Show the reviewer the full price, the billing cycle, how a patient cancels and what happens if the prescriber stops treatment. If you offer an introductory price, Visa's rules require the terms before payment and a reminder at least 7 days before the first full-price charge, with an easy way to cancel. Our guide to how subscription payment gateways work covers those rules.

Be exact about what you dispense. The FDA declared the semaglutide shortage over on 21 February 2025, and the periods in which compounders could keep making copies ended on 22 April 2025 for 503A pharmacies and 22 May 2025 for 503B outsourcing facilities. The tirzepatide periods ended in February and March 2025. Acquirers ask whether you sell an approved product or a compounded one, and who compounds it.

What the FDA Letters Mean for Approval

In September 2025 the FDA announced thousands of letters to drug companies about misleading advertising and about 100 cease-and-desist letters, and telehealth firms selling compounded drugs were among those targeted. On 3 March 2026 it sent warning letters to 30 telehealth companies over compounded GLP-1 marketing. It named two problems: claims implying a compounded product is the same as an FDA-approved one, and products branded with the telehealth firm's name without saying it is not the compounder. Expect an acquirer's website review to look for both. Name the compounding pharmacy, state that compounded products are not FDA-approved, and remove comparisons with branded medicines before you apply.

What an Online Pharmacy Payment Gateway Costs

An online pharmacy payment gateway costs more than a standard one because the acquirer carries Tier 1 risk, registration costs and a heavier monitoring load. Expect a higher percentage per payment, a small fixed fee per transaction and a rolling reserve. These are typical market ranges on the lower side for an approved pharmacy.

Take a pharmacy with 2,000 orders a month at an average of USD 85, so USD 170,000 in card sales, on 4% plus USD 0.25 per transaction, with a gateway at USD 20 a month plus USD 0.10 per transaction. Processing costs USD 6,800 in percentage fees and USD 500 in transaction fees. The gateway adds USD 220 and a USD 30 account fee brings the month to USD 7,550, about 4.4% of sales. Rates usually come down after six to twelve months of clean processing. Our guide to high risk merchant account fees and rates explains each line.

Rolling Reserves and Cash Flow

Most new pharmacies start with a rolling reserve. On the same USD 170,000 a month, a 10% reserve held for 180 days takes USD 17,000 from each month's sales, and the acquirer holds up to USD 102,000 once six months have built up. Each month's share is released when its hold ends. Plan stock, cold-chain shipping and marketing around that figure. A clean dispute record is the quickest way to have the reserve cut.

Certification and Scheme Fees on Top

Budget for certification separately: USD 975 to apply and USD 2,150 a year per website with LegitScript, or USD 1,075 a year per website with NABP plus the .pharmacy domain. Where an acquirer passes Mastercard's specialty fees through in full, USD 100,000 of Mastercard sales at USD 85 an order adds USD 100 in volume fees and about USD 24 in transaction fees.

How Long Setup Takes

Our partners work to the timeline below once the file is complete, and most pharmacies are live within 5 to 7 business days. Each step is covered in our guide to setting up a high risk payment gateway.

Missing state licences, a checkout that lets a prescription drug through or weight loss pages with sameness claims are what push the timeline out. Certification already in place removes a registration step. The account side is covered in how to open a high risk merchant account.

Chargebacks, Refunds and Pharmacy Subscriptions

Disputes decide how long a payment gateway for an online pharmacy stays open. Visa's rules require the acquirer to track a high integrity risk merchant's daily sales, average ticket and disputes, and to start comparing each day against the normal pattern from the 31st day after the first deposit. A sudden change shows up fast.

Why Pharmacy Patients Dispute Payments

The usual causes are a refill charge the patient forgot about, an order held while the prescriber asks for more information, a shipment that is late or damaged, and a billing name the patient does not recognise. The last one is common in pharmacy because many sites use a discreet descriptor for sensitive treatments. A discreet name is fine as long as patients can match it to your site, so keep your brand in it and show a support number patients can find.

Card Scheme Monitoring Thresholds

Under the Visa Acquirer Monitoring Program, an online merchant is flagged once fraud and disputes together reach 1.5% of transactions and at least 1,500 cases in a month, in the US, Canada, Europe and Asia Pacific. Mastercard's excessive chargeback programme begins at 100 chargebacks and a 1.5% ratio in a month. Acquirers step in long before that, usually near 1%. Visa can also disqualify a high integrity risk merchant whose disputes reach a critical level, and a merchant terminated for disputes can be listed on MATCH for 5 years. Our guide to what the Mastercard MATCH list is explains how the listing works.

Refill Reminders and Cancellation

Under Visa's rules, a refill programme billed on a schedule is a recurring transaction. You must state the billing dates or interval, offer a simple online cancellation, and notify the patient at least 7 days before a charge when an introductory price ends. In Europe you must also notify before a charge if more than 6 months have passed since the last one or the terms have changed, which catches patients who restart treatment. In the US, the Restore Online Shoppers' Confidence Act requires clear disclosure, express consent and a simple way to stop a recurring charge online. Visa also lists negative option subscriptions, MCC 5968, in Tier 3 of its integrity risk program, and a reviewer will check that your refills do not work that way.

How to Keep Disputes Low

Send a receipt and tracking with every order, and tell patients at once if a prescription is on hold. Refund fair complaints before they turn into disputes. Card network alerts let you refund before a dispute is filed, and fraud screening stops stolen cards being used to buy medicines for resale. Our guide to chargeback management for high risk merchants covers the tools a pharmacy payment gateway can connect to.

Taking Payments on Your Pharmacy Store

A payment gateway for an online pharmacy usually serves two places: an online store for over-the-counter products, and a prescribing or pharmacy platform for prescription orders. The usual setup is a pharmacy merchant account, payment gateway, pharmacy platform and a fraud tool, and each part has to pass the acquirer's review. Our guide to high risk ecommerce merchant accounts covers the account side for online stores.

WooCommerce, Shopify and Custom Checkouts

WooCommerce lets you install the plugin your acquirer provides and keep full control of product pages, which suits a pharmacy that needs a prescription step inside checkout. Shopify also works with an approved third-party gateway, but when you do not use Shopify Payments it adds its own fee of 2%, 1%, 0.6% or 0.2% per order depending on your plan. Larger telehealth brands often build their own checkout and connect it to the prescribing platform through the gateway's API. Set-up guides for both platforms are in high risk payment gateways for WooCommerce and high risk payment processors for Shopify.

Hosted Checkout and Patient Data

A hosted payment page or an embedded payment field keeps card data off your servers, which keeps your PCI DSS work to the shortest self-assessment questionnaire. It also keeps card data apart from health records, which fall under separate privacy rules such as HIPAA in the US and data protection law in the UK and EU. For how card data moves from checkout to the acquirer, see how credit card payment gateways work.

Other Ways Patients Can Pay

Many US patients pay with health spending cards. FSA and HRA cards work at merchants that either run an inventory information approval system, which flags eligible items at checkout, or qualify under the 90% rule, which covers pharmacies where at least 90% of the previous year's gross receipts were eligible medical expenses. Ask your acquirer which route it supports before you advertise it. Outside cards, ACH payments suit repeat orders in the US and bank transfers suit larger orders in Europe. Settling in more than one currency is covered in our guide to international payment gateways.

Common Pharmacy Payment Gateway Mistakes

These are the mistakes that most often close a payment gateway for an online pharmacy. Several of them follow the business into its next application.

Launching on a Mainstream Processor Without Approval

Stripe and PayPal both need approval before you sell prescription products or telemedicine. Starting without it risks a closed account and a held balance, with patients waiting on orders you can no longer charge for.

Coding Medicines as Cosmetics or Supplements

Processing medicines under a general health or cosmetics code to avoid Tier 1 is transaction laundering in the card schemes' eyes. It ends in termination and can put the business on MATCH for 5 years.

Letting a Prescription Drug Through Checkout

One order that buys a prescription-only medicine without a consultation is enough for a decline, and it is the first thing a reviewer tests.

Sameness Claims on Weight Loss Pages

Calling a compounded GLP-1 the same as a branded medicine is the claim the FDA named in March 2026. Remove it before an acquirer reads the page.

Growing Without Telling the Acquirer

A new state, a new country or a jump in volume after a campaign shows up in the acquirer's daily monitoring. Tell them first and send the new licences with the request.

Bottom Line

A payment gateway for an online pharmacy takes more preparation than most, and it is very achievable with the right file. The pharmacies that are approved quickly hold a licence for every market they ship to, have NABP or LegitScript certification or are close to it, never let a prescription medicine through checkout without a prescriber, and keep weight loss and telehealth pages free of sameness claims. Treat the reserve and the scheme costs as part of your cash flow from the first month.

We set it up through one intake form with a regulated partner that accepts pharmacies, and most are live within 5 to 7 business days. If you also sell vitamins or wellness products, the rules for that category are in our guide to payment gateways for supplements and nutraceuticals.