High Risk Merchant Handbook

Online Pharmacy Merchant Account Rules

Visa and Mastercard both supervise card-absent pharmacy sales. Learn the MCCs, the registration step and the risks of a miscoded application.

An online pharmacy merchant account is not a plain store account. Both card networks watch drug sales that are not made in person. Visa lists Pharmacies among its Tier 1 card-absent business types. Mastercard's manual sets additional requirements for pharmaceutical and tobacco product merchants. If you know these rules, you can apply with the right codes instead of the wrong ones.

Why online pharmacies are watched

Visa's Tier 1 card-absent business types include Adult Content, Dating and Escort Services, Gambling and Pharmacies. That is Visa's own list, and it puts pharmacy sales in rare company.

Mastercard's rules say an acquirer must register a merchant with Mastercard before acquiring non-face-to-face pharmaceutical or tobacco transactions. So the network itself has to know your business exists before your account can run.

The two MCCs

Each merchant account gets a code for its type of business, called an MCC. Visa's Merchant Data Standards Manual says MCC 5912 covers drug stores and pharmacies that sell prescription drugs. The same manual says MCC 5122 covers firms that sell prescription drugs and related goods at wholesale.

Retail sales go under 5912. Wholesale sales to other firms go under 5122.

Mastercard's rules say an acquirer must identify non-face-to-face pharmaceutical retail transactions using MCC 5912 and TCC T. Mastercard's rules also say the acquirer must flag wholesale drug sales that are not made in person. It uses MCC 5122 and TCC T. Both codes use the same TCC T.

Mastercard's registration step

Mastercard requires non-face-to-face pharmaceutical merchants with MCCs 5122 and 5912 to register. Your acquirer does this, not you. But your application must state your business clearly. The acquirer needs that to register you the right way.

Visa's Supplemental Requirements

Visa's rules include an appendix with Visa Supplemental Requirements. Visa's Supplemental Requirements are separate documents or websites with requirements beyond the Visa Rules. Ask your processor which ones apply to you.

The merchant name field

Visa's manual says supplemental data in the merchant name field must be static and appear in all transactions. The same manual says the merchant name must not be cut short to make room for extra data. Keep the full name, and keep any extra data the same on every sale.

Products that mimic prescription drugs

Visa's rules cover products that claim or imply effects similar to prescription drugs, controlled substances, or street drugs, even if claimed legal. A product sold as "legal" can still fall under Visa's rules if it makes those claims. Do not assume the label on the bottle settles the question.

What not to do

Visa's guide says payments involving the sale of illegal narcotics, recreational drugs, or designer drugs are strictly prohibited from entering the Visa payment system. The same guide warns about helping illegal drug stores take payments. It says this could bring lawsuits, criminal charges and lost money.

Visa's guide says illicit businesses commonly use transaction laundering for illegal gambling, illegitimate online pharmacies, illegal drugs, and counterfeit merchandise. Counterfeit goods show up in many fields. Visa names drugs and medical devices among them, along with clothes and more.

So do not run pharmacy sales under the wrong MCC. Do not hide the real business in someone else's account. Do not split your volume across accounts to keep each one looking small. Each one hides the real business.

How to prepare

Tell the truth about your business in the application. State what you sell, how you sell it, and whether the sales are retail or wholesale. Expect the right MCC. Expect Mastercard's step to register you as well. Ask your processor early what it needs for both.

Check the legality of what you sell with a lawyer and with the processor. Do not rely on this page for that answer.

See why banks watch payment processors for the bank side. Do you take orders by phone? Then read up on billing authorization for those calls.

Sources