§ 01 — The state of peptide payment processing in 2026
Stripe, Square, PayPal, and Shopify Payments have all exited compliant peptide processing in the United States over the past 18 months. The reason is not that peptide merchants are uniformly bad customers — many are fully legitimate businesses selling LegitScript-certified products to informed consumers — but that the regulatory burden of safely onboarding the category at scale has shifted faster than generalist processors are willing to follow.
The shift accelerated in June 2025 when Mastercard updated its Business Risk Assessment and Mitigation (BRAM) program under GLB 11691.1, explicitly adding research peptides and unapproved injectables to the high-risk fine list. The practical effect: acquiring banks now pay per-merchant, per-month fines for category violations. Generalist processors decided the per-merchant economics no longer worked.
The result is that specialist processors — PeptideApprove being one of them — are now the only viable path for compliant U.S. peptide brands. The rest of this guide explains what compliance actually means in 2026, what changed, and what to do about it.
§ 02 — LegitScript certification: the table-stakes credential
LegitScript is now functionally required for every U.S. peptide MID. The certification costs $1,075 per year, takes 6–8 weeks under standard review (2–3 weeks if your site is pre-screened), and verifies that your business is not selling unapproved drugs to consumers without a prescription.
The application is procedurally hostile to founders without prior experience. LegitScript publishes multiple certification tiers (consumer peptides, GLP-1, research peptides, etc.), and mis-tiering your application costs six weeks. Common rejection causes include: missing per-batch CoA testing on product pages, age-gating gaps, comparative drug claims, and unsubstantiated therapeutic language.
If you're processing peptide volume today without LegitScript, your MID is on borrowed time. Acquirers under BRAM review their portfolios quarterly. The cost of being caught uncertified is termination, not warning.
§ 03 — Mastercard BRAM in plain language
BRAM is Mastercard's compliance program that holds acquiring banks accountable for the merchants in their portfolios. The June 2025 update (GLB 11691.1) added these categories to the high-risk fine list:
- Research peptides marketed for human use
- Unapproved injectables (compounded GLP-1 without telemedicine + 503A/503B pharmacy chain of custody)
- Merchants with FDA warning letters and no remediation
- Merchants on the MATCH list without acquirer-level review
What this means in practice: an acquirer that onboards a peptide merchant who doesn't meet BRAM expectations pays a fine per merchant, per month. After 12–18 months of those fines, the math on serving the category breaks. This is the underlying reason most generalist high-risk processors quietly stopped accepting peptide applications in 2025.
§ 04 — FDA enforcement: what triggers a warning letter
The FDA does not regulate peptides per se — it regulates claims. The 80-plus warning letters issued across 2025 and 2026 to peptide and GLP-1 sellers all targeted language patterns rather than compounds. The most common triggers:
- "Research use only" claims paired with consumer-facing dosing pages. If your product page says "RUO" but also explains how to dose, the FDA reads the language as inconsistent — and warns.
- Comparative claims against approved drugs. Mentioning Ozempic, Wegovy, Mounjaro, or Zepbound by name in marketing copy triggers automated detection.
- Unsubstantiated therapeutic claims. "Helps you lose weight," "supports muscle growth," "treats X" — without clinical citations — triggers letters.
- Branded compound names that obscure the actual compounder. Selling "BrandedPeptide-7" without disclosing the 503A pharmacy compounding it is a flag.
A warning letter is not itself a fine. It is, however, a public-record document that acquirers monitor continuously. A letter to your brand puts your MID at risk inside 30 days unless you publicly remediate.
§ 05 — The MATCH list and what to do if you're on it
MATCH (Member Alert to Control High-risk merchants) is Mastercard's shared merchant blacklist. Once you're on it, most U.S. acquirers will decline future applications. Records persist for five years.
The reason code on a MATCH listing determines whether recovery is workable:
- Code 04 (excessive chargebacks): Workable with documentation of remediation and a chargeback management plan.
- Code 07 (fraud conviction): Generally not workable.
- Code 11 (Mastercard standards violation): The most common code for peptide merchants. Workable with documented cause and a LegitScript certification path.
If you're on MATCH and don't know why, the first step is pulling your file from the original terminating acquirer. We can help with this as part of underwriting.
§ 06 — The hidden cost of a 180-day rolling reserve
High-risk processors typically hold 10–15% of merchant settlements for 180 days. At $100K/month volume with a 15% reserve, this means $90,000 of working capital locked at any given time. For a brand growing 20% month-over-month, the locked capital compounds rather than stabilizes — because the reserve obligations from this month's higher volume exceed the releases from six months ago.
This is the mechanism by which a "successful" peptide brand can run out of cash. The headline rate looks affordable; the reserve cost is invisible until growth requires capital that's held by the processor.
Shorter reserve schedules and clear settlement timing matter because locked capital can starve a growing merchant. Ask how reserves are calculated, released, and reviewed over time.
§ 07 — What a real statement audit looks like
Most high-risk processor statements contain 30–80 line items. The headline rate ("3.5%") rarely matches the actual effective rate. The gap is in interchange downgrades, scheme fees, processor markup, gateway markup, PCI compliance fees, and reserve withholding.
A real audit takes 24–48 hours and produces:
- Your true effective rate across the last 3 months
- The line-item delta between your current processor and the alternative
- Your working capital locked in reserve (often not shown on the statement itself)
- Estimated annual savings with sources cited per line
If a processor will not tell you the actual all-in cost before you sign, you are comparing guesses instead of pricing.
§ 08 — Eight questions to ask any processor that wants your peptide volume
- What are your sponsor acquiring banks? (Reasonable answer: two named U.S. banks, disclosed under NDA before signing.)
- What is your underwriting cycle for compliant peptide merchants? (Reasonable answer: 5–10 business days with one document checklist.)
- What payout options are available after approval? (Reasonable answer: standard settlement plus faster options such as RTP or Push to Card where approved.)
- What is your reserve schedule and how is it released? (Reasonable answer: published schedule, 90 days or less, calibrated to chargeback profile.)
- What is the all-in rate? (Reasonable answer: a clear number, not a teaser rate.)
- How do you handle BRAM compliance? (Reasonable answer: underwriting screen is built around BRAM, not retrofitted.)
- What is your policy on MATCH-listed applicants? (Reasonable answer: case-by-case, with documented cause and a LegitScript path; not "MATCH OK" categorically.)
- Do I need LegitScript? (Reasonable answer: not for a compliant research-use-only retailer. Clinical, pharmacy, and telehealth models are reviewed separately.)
§ 09 — How PeptideApprove operates
We focus on peptide merchants that need a clear approval path. Pricing is confirmed in writing after underwriting. The program also describes sponsor-bank review, T+1 settlement where approved, and payout options such as RTP, Push to Card, and card issuance.
§ 10 — Next steps
If you're a compliant peptide brand looking for processing, the fastest path is to complete the short PeptideApprove application. We review your fit first, then request the KYB items: legal entity name, EIN, principal representative details, and a recent business bank statement.
If you've been terminated by Stripe, Shopify, Square, or another generalist processor, the path is the same. Bring documentation of the termination and we'll evaluate.
If you're on MATCH, the path is the same but with one extra step: we'll need documentation of the original reason code and a clear LegitScript certification status.
§ peptideapprove.com · 2026