Telemedicine Merchant Accounts: How Telehealth and Pharmacy Businesses Get Approved and Stay Processing

The Drug Enforcement Administration's (DEA) COVID-19 flexibilities for remote prescribing are set to expire on December 31, 2026. Under the fourth temporary extension, DEA-registered practitioners can prescribe Schedule II–V controlled substances without a prior in-person exam if the rule's conditions are met. DEA's final rule on special registrations for remote prescribing has been under review at the White House Office of Management and Budget (OMB) since August 25 and was still pending on October 28.

That deadline matters if you're applying for a telemedicine merchant account, because underwriters weigh regulatory risk before they approve. Marketing is under scrutiny, too. On March 3, 2026, the Food and Drug Administration (FDA) warned 30 telehealth companies about claims for compounded glucagon-like peptide-1 (GLP-1) drugs, and a June 15 FDA reminder page lists five kinds of claims to avoid.

This guide covers the risk drivers, platform rules, compliance checks, and payment setup that keep this vertical processing.

Why Telemedicine Merchant Accounts Are Considered High Risk

"High risk" is an underwriting label, not a verdict on your business. It means the bank sees more ways to lose money, so it asks for more documents and protection.

Four drivers stand out:

• Moving regulation: DEA, FDA, and each state you serve set rules for prescribing, dispensing, and drug marketing, and several changed in 2025 and 2026.
• Card-network scrutiny: Visa treats card-absent pharmacy sales, under merchant category codes (MCCs) 5122 and 5912, as "high-integrity risk," which adds registration and monitoring duties for your bank.
• Recurring charges: Monthly prescription programs bill on a schedule, and a renewal a patient forgot about can turn into a chargeback.
• Claims and reputation: Compounded drugs aren't FDA-approved, and FDA's 2026 warning letters targeted website claims implying they're the same as approved drugs. Banks treat that as legal and brand risk.

How Telemedicine and Pharmacy Merchant Accounts Work

An acquiring bank (acquirer) underwrites your business so you can accept payments and receive settled funds. A payment gateway passes transactions from your checkout, and a processor routes them through the card networks. Each approval comes with a merchant ID (MID), and its processing history follows your business.

High-risk underwriting adds friction:

• Slower reviews: Banks study your website, licenses, and business model first.
• More documents: Expect requests for processing statements, licenses, and certifications.
• Reserves: A rolling reserve holds back a share of sales to cover future disputes.
• Monitoring: Disputes, refunds, and website changes are watched after approval.

What These Accounts Get Called

You'll see the same service sold as a telehealth merchant account, telehealth payment processing, or telemedicine payment processing. Businesses that dispense medication shop for an online pharmacy merchant account or pharmacy credit card processing. The labels differ; what changes the review is whether your checkout sells medication or only consultations.

Telehealth and Pharmacy Platform Restrictions: Stripe, PayPal, Square, Shopify, and More

As of October 2026, every platform below limits remote prescription sales. Check each live policy before relying on this summary.

Getting caught usually starts with a risk review, triggered by your website, a new product, or a spike in disputes. Limitation or closure can follow, and balances can be held for up to 180 days at PayPal or, typically, 120 days at Stripe.

Holds aren't the only cost. These terms make you liable for disputes and network fines, and Stripe lists canceling a remaining balance's payout as a possible outcome.

The lasting damage comes if an acquiring bank terminates you for cause. Your business and its principals can be added to the MATCH list, which other banks check when you apply.

Recent Changes Worth Tracking

• December 2024 and February 2025: FDA declared the tirzepatide and semaglutide shortages resolved; grace periods for compounders ended by May 2025.
• December 2025: DEA and the Department of Health and Human Services (HHS) extended the flexibilities through December 31, 2026.
• March 2026: FDA issued 30 warning letters over compounded GLP-1 marketing.
• April 2026: FDA proposed keeping semaglutide, tirzepatide, and liraglutide off the 503B bulks list — a proposal, not a final decision.
• June 2026: FDA posted marketing reminders listing five kinds of claims to avoid.
• August 2026: Mastercard's August 4 Security Rules edition keeps card-not-present pharmaceutical sellers in its specialty registration program; DEA's final rule went to OMB review on August 25.
• September 2026: Stripe updated its restricted-businesses list on September 22; pharmaceuticals remain restricted.
• October 2026: Visa's October 24 rules edition took effect; card-absent pharmacy registration still applies, and NABP-accredited pharmacies remain exempt.
• December 2026: DEA's flexibilities expire on December 31 unless replaced or extended.

The Compliance Layer: DEA, State Licensing, Card-Network Rules, and HIPAA

Underwriters don't expect you to be a lawyer, but they do expect you to know which rules apply.

1. Card-Network Registration and LegitScript Certification

Visa's Core Rules require acquirers to get Visa's approval and register each high-integrity risk seller first, exempting pharmacies accredited by NABP or another regulatory body Visa recognizes. Acquirers must assign the MCC that "most accurately describes" your business.

LegitScript's Healthcare Certification covers businesses that sell, prescribe, or process card-not-present payments for prescription drugs. It lists a $975 application fee plus $2,150 a year if approved, and says certification is part of approval for card-not-present sales with Visa and Mastercard. Stripe's help center says virtual care businesses don't need it, though Stripe may verify licensing during onboarding. Google Ads requires LegitScript, or NABP for pharmacies, before U.S. pharmacies and virtual care providers can advertise.

2. The Ryan Haight Act and DEA Prescribing Rules

The Ryan Haight Act of 2008 bars dispensing controlled substances over the internet without a valid prescription, which generally requires at least one in-person medical evaluation. The fourth extension lets DEA-registered practitioners skip that evaluation through December 31, 2026, if conditions are met.

With limited exceptions, pharmacies that dispense controlled substances over the internet need a modified DEA registration, must notify DEA and state boards 30 days before starting, and must post required disclosures on their homepage (21 U.S.C. 831).

These rules cover controlled substances only. GLP-1 drugs such as semaglutide aren't on DEA's schedules, so GLP-1 programs answer mainly to FDA, state, and card-network rules.

3. State Licensing for Prescribers and Pharmacies

State rules vary. Florida, for example, has a registration path for out-of-state clinicians treating Florida patients remotely, and requires out-of-state pharmacies that ship drugs into Florida to register as nonresident pharmacies. Federal law also requires internet pharmacies dispensing controlled substances to meet pharmacy licensure rules in every state they ship from and to.

For physicians, the Interstate Medical Licensure Compact offers an expedited path to multistate licensure, with 44 member states plus two U.S. territories as of September 30, 2026.

4. HIPAA and PCI DSS: What Applies to Your Payments

The Health Insurance Portability and Accountability Act (HIPAA) applies to health plans, health care clearinghouses, and health care providers that transmit health information electronically in standard transactions, such as insurance claims, and some of its requirements apply to their business associates (45 CFR 160.102). Whether a cash-pay virtual care business is covered depends on its facts, so confirm your status with counsel.

The payment step itself gets a carve-out. Section 1179 exempts financial institutions, and entities acting for them, when they authorize, process, clear, or settle health care payments, including by credit or debit card. HHS explained in 2000 that a bank processing patients' card payments isn't acting on the provider's behalf.

That carve-out covers the bank's side, not patient data in your own payment systems, customer relationship management (CRM) software, or support tools; there, your status decides. Cardholder data falls under the separate Payment Card Industry Data Security Standard (PCI DSS), so protect patient data and cardholder data on their own terms.

How to Choose a High-Risk Payment Processor for Your Telehealth or Pharmacy Business

The right payment partner understands your model before the first transaction. Use four criteria to compare banks and processors.

1. Look for Genuine Healthcare Experience

Ask how many virtual care or pharmacy businesses the bank or independent sales organization (ISO) already supports and whether its acquirer is registered with Visa for high-integrity risk pharmacies. Then ask which certifications it expects, how it reviews compounded-drug programs, and what happens if DEA or FDA rules change mid-contract.

2. Look Past the Headline Rate

Get every fee in writing: discount rate, per-transaction fee, gateway, statement, and PCI fees, chargeback fees, and early termination terms. For a rolling reserve, confirm the percentage and release schedule.

3. Check Gateway, Integrations, and Recurring Billing

Prescription programs run on stored payment details. Confirm the gateway supports recurring billing and an account updater for expired cards, and ask whether your card-on-file tokens can move if you switch processors. Check how it connects to your telehealth platform, pharmacy partner, and electronic health record (EHR) workflow, and whether it supports offering multiple payment methods, such as credit and debit cards, automated clearing house (ACH) transfers, and Apple Pay.

4. Demand Chargeback Tools and Real Support

Ask about pre-dispute alerts that let you refund before a chargeback, representment support, and reporting by MID. Since April 1, 2026, Visa's Acquirer Monitoring Program (VAMP) has treated a U.S. seller as excessive at a 1.5% ratio of fraud reports plus disputes to settled card-not-present transactions, with at least 1,500 in a month (fact sheet). Our VAMP explainer shows how the ratio works.

Online Pharmacy Fulfillment, Compounded Drugs, and Subscription Programs

What you sell, and who ships it, shapes the review.

Prescribe-and-Fulfill Models

Some virtual care platforms sell only consultations; others also sell the medication through a partner or owned pharmacy. Visa's MCC manual describes MCC 5912 as businesses that "sell prescription and proprietary drugs." If your checkout charges for medication, expect a pharmacy-level review: licenses for each state you ship to, the dispensing pharmacy's details, and how prescriptions are verified.

Visa also requires a separate MCC for a high-integrity risk line of business, so don't fit drug sales under a medical-services code. Its rules let it fine acquirers and permanently disqualify sellers and their principals for altering a seller's name or data to dodge monitoring.

Why Compounded-Drug Programs Draw Extra Scrutiny

Compounded drugs aren't FDA-approved. Under section 503A, state-licensed pharmacies and physicians compound based on patient-specific prescriptions; 503B outsourcing facilities follow federal manufacturing standards and face FDA inspection. FDA's April 2026 update reminds compounders that 503A limits copies of commercially available drugs, and that semaglutide and tirzepatide aren't on the 503B bulks list or FDA's shortage list.

For underwriters, your website is evidence. FDA's June reminders tell telehealth companies not to imply they're the compounder, call a compounded drug generic or the same as an approved drug, claim FDA approval or clinically proven equivalence, or describe the source as an "FDA-approved" pharmacy. Expect reviewers to check your pages against it.

Subscription Billing, Refunds, and Descriptors

Monthly programs are subscription billing, and the rules follow. The Restore Online Shoppers' Confidence Act (ROSCA) requires clear disclosure of material terms before you collect billing information, express informed consent before charging, and "simple mechanisms" to stop recurring charges.

Visa's rules add billing disclosures before you store payment details, including price, cancellation and refund policies, and any trial or introductory period. You also need a simple cancellation procedure that works online for web sign-ups, plus a reminder at least 7 days before a trial or introductory price ends.

Spell out patient billing terms, including refunds for consultations and shipped medication, before checkout, and use a descriptor patients recognize: Visa requires the statement name to match the one customers know.

Comparing Telemedicine Merchant Account Providers

Providers fall into three broad types:

• High-risk specialists: U.S. banks and ISOs with portfolios of healthcare services businesses. Expect deeper underwriting and reserves; they're often the closest fit for a dedicated account serving U.S. patients.
• Offshore or international acquirers: Banks outside the U.S. that board some U.S. businesses. Expect cross-border fees; U.S. prescription and pharmacy rules still apply to U.S. patients.
• Aggregators and payment facilitators: Shared-account payment solutions such as Stripe, PayPal, and Square onboard quickly, but as of October 2026 they restrict or bar parts of this category and can hold funds under their own terms.

Building a Telehealth Payment Stack That Survives the Next Policy Change

A single MID is a single point of failure. A reliable payment stack uses payment orchestration to connect several gateways and MIDs behind one checkout:

• Failover routing: If a provider is down or returns a technical error, the transaction can move to another approved connection. Issuer declines are different: Visa's rules bar changing data such as the acquiring identifier, country, or category code when a declined authorization is retried, so confirm with each acquirer which declines, if any, can be rerouted.
• MID health monitoring: Track approvals, refunds, and disputes by MID so problems surface early.
• Flexibility: Add or drop a processor without rebuilding checkout or disrupting a seamless patient experience.

Two rules are non-negotiable. Every MID must be disclosed to and approved by its acquirer for the products you actually sell, and orchestration isn't a way to dilute chargeback ratios or route around an acquirer's decision.

How Sticky.io Supports Telehealth and Pharmacy Businesses

Sticky.io doesn't underwrite or issue merchant accounts; acquiring banks do. If you need one, we'll facilitate the application process with the assistance of our trusted ISO partners, and the acquirer makes the decision.

Once you're approved, our platform supports the program you and your counsel design:

• Subscription management: Sticky.io CRM runs the recurring schedules you configure. It doesn't decide whether a program is compliant.
• Redundancy: Sticky.io integrates with 160+ global payment gateways, and Payment Orchestration lets you control routing rules, gateway logic, and decline handling.
• Recovery: Sticky.io Recovery uses smart dunning automation to recover failed payments, and built-in account updater services refresh customer credentials automatically.
• Fraud and dispute tools through partners: Kount-powered scoring, our Equifax partnership, 3D Verify authentication, Ethoca alerts, and an automated chargeback representation service from our partners.
• Payment security: We maintain PCI DSS Level 1 compliance, which covers card data, not health records.

Bottom line: This vertical is workable when your licenses, marketing, and billing match what you sell, and you have a backup plan. A frozen balance mid-refill is far harder to fix than a checkout page. That's where Sticky.io can help.

Book a demo to see how the platform can streamline billing and recovery for your program.

Updated October 2026. This article is general information, not legal advice — your acquirer and counsel can confirm the requirements for your business, and platform policies change, so check each provider's current terms.