High Risk Merchant Handbook

Businesses Processors Will Not Take

Prohibited and restricted lists come from card network rules and processor policy. Here is what they say and what to check before you apply.

A prohibited business is a type the processor will not serve at all. A restricted business is one it will serve only after extra review. If your industry sits on a list, your application can end before it starts. Knowing how the lists work saves you the trouble.

What prohibited and restricted mean

Stripe, for one, posts a page of the business types it will not take or will review. The words mean two different things. Prohibited means the processor will not open the account. Restricted means the processor wants more information first.

Stripe's page is a clear example. Stripe's policy says restricted businesses need extra review before it can support them. Its prohibited list is flat refusal. Stripe also says both lists are representative and not exhaustive, so a type can be off the list and still get a no.

The card network layer

The card networks set rules too. Visa's standards say an acquirer must not send in sales it knows are illegal. The same goes for sales it should have known were illegal. Visa's standards also say acquirers must set up checks. These checks run during underwriting and after. Their job is to keep illegal sales out of Visa. Visa's standards say acquirer monitoring aims to detect risks such as fraud, credit issues, disputes, anti-money laundering and illegal activities.

Mastercard has its own program. Mastercard's BRAM Program investigates merchants referred to Mastercard as potentially engaging in illegal or brand-damaging transactions. Mastercard's BRAM Program enforces Mastercard Rules sections 3.7 and 5.12.7, which cover integrity of the brand and illegal or brand-damaging transactions. Mastercard's manual says a merchant may be deemed in violation of Rule 5.11.7, the Illegal or Brand-damaging Transactions Rule. Mastercard also urges acquirers to use a tool to watch online merchants.

Visa's guide says an acquirer may deem additional merchant categories as prohibited or restricted. So lists can differ from one acquirer to the next.

The money-laundering layer

Bank regulators add a third layer. FinCEN's advisory says payment processors can be used by criminals to mask illegal or suspicious transactions and launder proceeds of crime. It also says criminals have used processors to move illegal funds into banks. They sent ACH credits from foreign sources.

To learn more, read why banks watch payment processors.

Types that commonly appear

Here is what Stripe's own list says. As Stripe's policy, these are its rules, not every processor's.

Start with what Stripe will not take. Stripe's restricted businesses list prohibits illegal drugs and substances designed to mimic illegal drugs, including kava. Stripe's restricted businesses list prohibits gambling, including games of chance, games of skill with prizes, lotteries, and bidding fee auctions. Stripe's restricted businesses list prohibits illegal weapons, counterfeit goods, and illegally imported or exported products. Stripe's restricted businesses list prohibits pyramid schemes and get rich quick schemes. Stripe's restricted businesses list prohibits sales of music, movies, or software without appropriate authorization. Stripe's restricted businesses list prohibits CBD products with THC levels greater than the local jurisdiction's legal limit. It also prohibits debt settlement, debt negotiation, and debt consolidation. It prohibits cryptocurrency mining and staking, initial coin offerings, and secondary NFT sales.

Now for what Stripe reviews first. Stripe's restricted businesses list includes firearms, including rifles, shotguns, and pistols. Stripe's restricted businesses list includes online pharmacies, including SaaS platforms. Stripe's restricted businesses list includes tobacco products, including e-cigarettes, cigars, and e-liquid sold in accordance with applicable law. Stripe's restricted businesses list includes payment facilitation and aggregation. Stripe's restricted businesses list includes preloaded payment cards, gift cards, and virtual credits that store monetary value. Stripe's restricted businesses list includes travel reservation services and clubs.

The same product, different countries

A product can be legal in one place and illegal in another. Visa's guide says certain goods or services may be legal in one region but illegal in another. Visa's guide says sellers involved in illegal activity pose a severe risk to the payment ecosystem.

Stripe's page shows how country lists differ. Stripe's page lists alcohol as a restricted business in Canada. Stripe's page lists alcohol as prohibited in Thailand. Stripe's page lists mortgage consulting as a restricted business in the United States. Stripe's policy says specific prohibitions apply to online dating and matchmaking services in India, the United Arab Emirates, and Thailand. Stripe's policy says equity crowdfunding is prohibited in all countries except Australia, Germany, France, Singapore, the United Kingdom, and the United States. Stripe's policy says organizations fundraising for a charitable purpose are prohibited in all countries except Australia, Canada, the United Kingdom, and the United States.

Stripe's policy also says that in countries where a firearm or weapon is illegal, it will continue to treat it as prohibited. Stripe's page prohibits dealings with people or products from Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions.

Transaction laundering

Some listed businesses try to hide instead of applying honestly. Visa's guide says illicit businesses commonly use transaction laundering for illegal gambling, illegitimate online pharmacies, illegal drugs, and counterfeit merchandise. The merchant runs one business on paper and another through the account.

Do not do this. Visa's guide says facilitating transactions for illegal pharmacies could expose participants to litigation, prosecution, and financial risk. Visa's guide also says the law forbids selling counterfeit goods without the rights holder's OK.

What to do before you apply

Read the processor's own prohibited and restricted page first. Check the country list too, not just the general one. If your product's legality is unclear where you sell, ask a lawyer and the processor.

Disclose the real business on the application. Stripe's page prohibits using Stripe products with false, manipulated, inaccurate, or misleading information about your identity or business. Visa's standards say a merchant's history of terminations, excessive chargebacks, fraud or illegal activity can affect the underwriting decision.

If you sell by phone, read up on billing authorization on phone sales.

If your category is restricted

Restricted is not a no. It is a longer maybe. Stripe's page says restricted businesses require additional due diligence by Stripe to confirm its ability to support them. Stripe's policy says businesses in restricted categories might not get approval to use its products.

So apply with your paperwork in order and your business described plainly. Expect questions, answer them, and do not stretch the truth anywhere on the form.

Sources