GLP-1 and Weight-Loss Telehealth Merchant Accounts: What Visa and Mastercard Require in 2026

By Robert Oswald, CEO of FindAProcessor.co - Published October 20, 2026 - Updated October 20, 2026

A plain blue payment card with an arrow pointing to a stack of documents marked with a blue check-mark seal.

The card networks do not ban GLP-1 telehealth merchants. They classify them as high-integrity-risk pharmacy merchants, and the paperwork that follows depends on the network: Visa exempts MCC 5122 and 5912 merchants that hold NABP accreditation or LegitScript Healthcare Merchant Certification from its registration requirement, Mastercard runs its own specialty merchant registration for non-face-to-face pharmacy, and both networks recognize the certification - and it's the FDA's compounding rules, not the networks, that most often sink an application. If your program was dropped by an aggregator or you're reapplying after the shortage-list changes, the fix is documentation and clean marketing, not a different sales pitch.

At a glance

Visa puts MCC 5122 and 5912 in Tier 1 of its Integrity Risk Program; Mastercard runs a separate specialty merchant registration for non-face-to-face pharmacy.
The FDA delisted semaglutide (February 21, 2025) and tirzepatide (December 19, 2024) from its shortage lists, and the Fifth Circuit upheld the tirzepatide delisting on August 27, 2026.
FDA's March 3, 2026 announcement of 30 warning letters to telehealth companies, plus the June 2026 letters, are the documents an underwriter reads before quoting a GLP-1 merchant account.
LegitScript Healthcare Merchant Certification or NABP accreditation is what opens Visa's registration exemption for MCC 5122 and 5912.

Why GLP-1 and weight-loss telehealth programs lose their processor

No one gets terminated for selling weight loss. They get terminated because a risk analyst opened their landing page, read "same as Ozempic, FDA-approved pharmacy," and then looked at the FDA's docket. Three things tend to drive GLP-1 shutdowns.

The FDA shortage list moved, and the calendar is now against compounders

Semaglutide came off the FDA drug shortage list on February 21, 2025. Tirzepatide had already been re-determined as resolved on December 19, 2024. FDA then gave compounders a short window - until April 22, 2025 for 503A pharmacies and May 22, 2025 for 503B outsourcing facilities on semaglutide, with earlier dates for tirzepatide - after which the "shortage" justification for copying a commercially available drug largely evaporated.

On May 1, 2026, FDA published a notice proposing not to include semaglutide, tirzepatide and liraglutide on the 503B Bulks List (91 FR 23431, Docket FDA-2018-N-3240). The notice states plainly that "FDA-approved tirzepatide drug products are not on the FDA drug shortage list," and that shortage or backorder concerns do not count as "clinical need" for compounding from a bulk substance. Comments were originally due June 30, 2026 and FDA extended the deadline to July 30, 2026 (FR Doc. 2026-12937), saying the comments will inform its final determination.

Translate that for a payments file: if you sell compounded semaglutide or tirzepatide, the two questions an underwriter asks are whether the molecule is on the shortage list and whether the pharmacy is 503A or 503B. Whether that sale is lawful at all turns on FDA's framework, and that's a regulatory question - not ours to answer. But the risk team does ask it, every time.

The Fifth Circuit closed the tirzepatide door

Compounding groups spent 2025 arguing FDA moved too fast. On August 27, 2026, a Fifth Circuit panel (Richman, Duncan, Oldham) affirmed the district court in Outsourcing Facilities Association v. FDA, No. 25-10600. The unpublished per curiam opinion went against the association on both points that mattered: assuming FDA should have run notice and comment, "the Compounders have not met their burden to show prejudice," and FDA "did not act arbitrarily in concluding that Eli Lilly's supply would meet or exceed projected demand." The opinion says the delisting "made it unlawful for physicians, pharmacies, and outsourcing facilities to compound tirzepatide-injection products."

If your program leaned on that appeal, the waiting game is over. A tirzepatide telehealth payment processor reviewing your file in 2026 has no pending decision left to point at, and the appellate route is exhausted at the panel level, with the mandate having issued on October 19, 2026.

Enforcement letters are the signal risk teams actually read

On March 3, 2026, FDA announced 30 warning letters to telehealth companies marketing compounded GLP-1s - the second wave after the September 2025 round. The agency named the violation types: claims implying sameness with FDA-approved products, and marketing that obscured where the drug was coming from.

The June letters are more useful to read as an underwriter would. Altru Telehealth LLC received one dated June 8, 2026 and posted June 16, 2026 (MARCS-CMS 728274), citing the FD&C Act's 502(a) and 502(bb) misbranding provisions - 21 U.S.C. 352(a) and 352(bb) - over two lines on its own site: "our compounding pharmacies are all FDA approved," and an offer of "the same results but at a fraction of the cost." Compounding pharmacies aren't FDA-approved, and "same results" is a sameness claim.

That's the real dynamic. Your processor isn't enforcing FDA rules; its risk team is reading enforcement as a predictor of disputes, refunds and network fines. A warning letter isn't a ban - it's a signal that someone at the acquiring bank has to defend your file in a quarterly review.

What the card networks actually require

Two different programs, two different sets of paperwork, and one shared question: who registered you, and with what evidence?

Mastercard: specialty merchant registration for non-face-to-face pharmacy

Mastercard's specialty merchant registration program covers non-face-to-face pharmaceutical merchants operating in MCC 5122 and MCC 5912. Registration sits with the acquirer, not the merchant - you supply the file, and your processor submits it and answers for it. Mastercard's rules also require acquirers to re-verify registered merchants' legal compliance on a recurring basis, at least every 12 months, so the certificate you got two years ago doesn't carry you.

Practically, that re-verification is where stale GLP-1 programs get caught: a pharmacy partner changed, a state license lapsed, or the site started making a claim the certified version didn't have. If a new processor starts quoting registration fees you didn't expect, the questions to ask about Mastercard specialty merchant fees are laid out in that guide.

Visa: the Integrity Risk Program

Visa's Integrity Risk Program (VIRP) sorts card-absent merchants into three tiers by category. MCC 5122 (drugs and proprietary goods) and MCC 5912 (drug stores and pharmacies) are Tier 1 - the highest-scrutiny group, alongside adult content and gambling. Three consequences follow:

A High Integrity Risk merchant must be registered with Visa before submitting transactions.
The acquirer needs separate, additional Visa approval for each Tier 1 category it wants to board, so a processor that's approved for adult content isn't automatically cleared for pharmacy.
There is an exemption from the registration requirement where the merchant holds NABP Healthcare Merchant Accreditation or LegitScript Healthcare Merchant Certification.

Visa's Acceptance Risk Standards push the same obligations into audit language: acquirers must run enhanced due diligence on High Integrity Risk merchants. The thresholds that decide when your file becomes a conversation come from Visa's Acquirer Monitoring Program fact sheet: an acquirer portfolio is "Above Standard" at a VAMP ratio of 50 basis points or more and "Excessive" at 70 basis points or more, while the US Excessive Merchant threshold was reduced to 150 basis points on April 1, 2026 (from 220 basis points), with a minimum of 1,500 fraud and dispute transactions a month. A subscription GLP-1 program with a long-tail refund problem can put a small acquirer over the portfolio number on its own.

MCC 5912 telehealth: which code your program gets

This is the least glamorous decision in your file and one of the most expensive to get wrong. MCC 5912 covers drug stores and pharmacies. MCC 5122 covers drugs and proprietary goods sold by someone who isn't a pharmacy. A weight-loss telehealth program selling a subscription bundle - consultation plus medication, one monthly charge - gets its code from its business model, and the acquirer makes that call, not the merchant.

The code drives everything downstream: which specialty program you register under, what an acquirer has to be approved for, how the merchant is monitored, and how a chargeback gets classified. A telehealth weight loss merchant account that splits consultation fees and medication charges across two MIDs usually ends up with two codes, two registration paths and two disputes profiles. Ask upfront which MCC your processor will submit, and get it in writing - a mismatch between your website and your MCC is a documented reason for a portfolio review.

LegitScript certification

LegitScript Healthcare Merchant Certification is the door most GLP-1 programs walk through. Eligible business models include pharmacies, telemedicine providers, medical spas and digital health platforms - the last only where they have contractual ties to providers and pharmacies.

The standards that bite for weight-loss telehealth:

Licensure where you prescribe or dispense, and where your patients are.
No dispensing of medications lacking regulatory authorization - this is where compounded copies of approved drugs get examined.
Prescriptions only after care by a licensed professional, with compliance to telemedicine rules in each state.
Partner pharmacies generally LegitScript-certified or accredited, which means your 503A or 503B has to survive its own review.

Visa and Mastercard both recognize the certification; it's the cleanest route to Visa's registration exemption. LegitScript's own guidance on weight-loss medications says physicians prescribing compounded GLP-1 need Healthcare Merchant Certification, and notes that certification can be made mandatory by ad-platform policy even where no federal law requires it.

Card-network rules and program manuals change, and the current edition of each network's manual governs your file.

What an underwriter will ask a GLP-1 subscription program

Expect a document request, not an interview. Here's the list, roughly in the order it gets asked.

Entity and ownership. Legal name, formation state, ownership chart, who signs on the bank account, and whether any owner has a payments history.
Licenses. The telehealth entity, the professional entity or medical group, and every prescriber licensed in each state you treat patients in.
Pharmacy relationship. 503A or 503B, license number, accreditation, and a signed agreement you can produce - not a name on a website.
LegitScript status. Certification in hand or application in progress, plus the exact URL that was certified.
The molecule and the FDA position. Which drug, compounded or branded, and whether it currently appears on the shortage list. If compounded semaglutide payment processing was one line of revenue and branded medication the other, document both - and say which one the site is selling.
Marketing claims. Landing pages, ad copy, email flows, affiliate funnels. Sameness language and "FDA-approved pharmacy" claims get flagged immediately.
Subscription and negative-option terms. Trial-to-paid mechanics, cancellation method, refund policy, and how consent is captured and stored.
Refund and chargeback history. Your recent history by MID, split by reason code if you have it.
Average order value and cadence. What a subscription bills monthly and how many charges deep a typical patient goes.
Reserve tolerance. Whether you can carry a rolling reserve and for how long - see rolling reserves explained for high-risk merchants.
Prior terminations and MATCH status. Which processor ended the relationship, when, and why. What a MATCH/TMF listing means for your options covers what a TMF entry does to your options.
Fulfillment evidence. Who ships, from where, with what tracking, and what happens when a cold-chain package fails.
The processor's own exposure. How the acquirer monitors your dispute ratio against VAMP and how it's preparing for Visa Compelling Evidence 3.0 requirements.

A document request of this scope is standard for a Tier 1 pharmacy file.

What to fix before you apply

Get certification in hand. LegitScript application or NABP accreditation, matching the URL you actually advertise. Start it before you shop; it's the single item that changes which processors will look at you.
Clean the marketing claims. Remove sameness language, remove "FDA-approved pharmacy," name your pharmacy partner accurately, and make sure every affiliate and ad account gets the same edit.
Document the pharmacy relationship. Agreement, license, accreditation letter, and a named contact who will answer a compliance call.
Write the claims and refund policy you actually follow. Cancellation path, refund window, what happens on a dose change, and how patients reach a human.
Know your numbers. Average order value, monthly cadence, refund rate, dispute rate by reason code, and how much reserve you can fund.

Then compare offers on the same terms - pricing, reserve, contract length and termination rights - using how to compare high-risk processor offers. A GLP-1 merchant account is a compliance file with a rate attached, and the paperwork is the same whether the rate is good or bad.

How Find a Processor helps

Most weight-loss programs don't lose their account because no processor will take them. They lose it because they applied to the wrong one - an acquirer whose underwriting appetite was built for supplements, or one that had never submitted a Tier 1 pharmacy registration.

One conversation introduces your business to a portfolio of processors that want to work with your model, your geography and your checkout. We walk your application with you: what each underwriter will ask, how to present the pharmacy relationship, how to answer the sameness question honestly, what the pricing actually means once fees stack, and which contract clauses to push back on. We also tell you when you're not ready - and what to fix first. The service is free to you: the processors pay us, so our only job is getting your file placed with the right acquirer. If you've been dropped, what to do after a decline or shutdown is the place to start, and the broader telehealth file is at the broader telemedicine merchant account page.

FAQ

Is compounded semaglutide legal to sell? It depends. A pharmacy's ability to compound a copy of an FDA-approved drug turns on the shortage list and on sections 503A and 503B of the FD&C Act, and FDA's position has shifted several times since 2024. Read FDA's own GLP-1 compounding updates and talk to counsel before you build a product around a molecule.

Why did my processor drop my GLP-1 program? Usually one of four things: the shortage-list change made compounded sales a monitoring risk, a network or specialty registration lapsed or was never filed, a marketing claim (sameness, "FDA-approved pharmacy") showed up in a review, or your dispute and refund numbers crossed a threshold. Ask for the specific reason in writing - it determines what you fix.

Do I need LegitScript to get a GLP-1 merchant account? Not by federal law, but in practice yes: a LegitScript GLP-1 merchant account is the standard route, because Visa's registration exemption for MCC 5122 and 5912 runs through LegitScript Healthcare Merchant Certification or NABP accreditation, and most acquirers won't board a Tier 1 pharmacy merchant without one. It's also the fastest way to prove your licensure and pharmacy relationships are real.

What MCC will my weight-loss telehealth program be coded under? The code depends on your business model, and the acquirer sets it - MCC 5912 covers drug stores and pharmacies, while MCC 5122 covers drugs and proprietary goods sold by someone who isn't a pharmacy. Either way it's Tier 1 at Visa, so confirm the code before you sign - the code sets your registration path, fees and monitoring.

Can I keep my existing subscriptions if I switch processors? Often, but the mechanics decide it: the recurring charges move with the MID, and what matters is token migration or a new vault, patient re-consent for the new descriptor, and a lapse-free cutover window. Plan it before you're forced to - what to do if your processor freezes your account covers the emergency version.

Is this legal advice? No. This is a payments and underwriting overview - consult counsel and FDA guidance for regulatory decisions.

Sources

Ready to start? Tell us what you sell and where you're licensed, and we'll show you which processors in our portfolio work with GLP-1 and weight-loss telehealth models - and what your file is missing before it goes in.

About Robert Oswald: Robert has worked in online payments for over 20 years, with companies like Braintree, Worldpay, Recurly, and PayPal. He has worked with companies such as Instacart, Everlane, Live Nation, Grubhub, AMC, Twitch, and Lululemon.