LegitScript Certification: Who Needs It, the Cost and Why Acquirers Ask
Which telehealth and pharmacy models acquirers expect to be certified, what LegitScript publishes on fees and timing, and how to open a merchant file before the certificate arrives.
- By the OpenGate underwriting desk
- Updated
- 11 min read
LegitScript certification is a third-party review confirming that a healthcare merchant, typically an online pharmacy or a telemedicine provider that prescribes, operates lawfully in the places it serves. Acquirers accept it as the verification that card scheme rules ask them to hold before registering a card-not-present pharmacy, and Google requires it for telemedicine advertising in the United States. As of October 2026 LegitScript lists a 975 dollar application fee and a 2,150 dollar annual fee per website.
In this guide
What LegitScript certification is
LegitScript is a private company that reviews healthcare merchants against published standards and monitors them afterward. Its Healthcare Certification program, the one payment underwriters mean when they say LegitScript, has nine standards. Under LegitScript’s own headings they are:
- Licensure and business registration
- Legal compliance
- Prior discipline and history
- Affiliates and partners
- Patient services
- Privacy
- Validity of prescription
- Transparency
- Advertising
Three of them do most of the work in a payments context. Licensure has to cover the jurisdictions where medicines are prescribed or dispensed and where the patient is located. A prescription may be issued only after a licensed professional has provided care. And the standards reach your partners: affiliates must meet them too, and LegitScript says partner pharmacies generally need a certification or accreditation of their own.
The privacy standard has a payments side as well. It asks US applicants that handle protected health information to comply with HIPAA, and keeping diagnoses and drug names out of descriptors, invoices and order fields is what HIPAA compliant payment processing means at the checkout.
LegitScript runs separate programs for addiction treatment and for CBD products and websites. This article covers Healthcare Certification only.
Who needs LegitScript certification: the published scope
You are in scope if your website sells, prescribes, facilitates or takes card-not-present payment for prescription medicines. LegitScript’s Healthcare Certification FAQ, updated in September 2026, draws the line as follows.
| Generally in scope | Generally not eligible |
|---|---|
| Online, mail-order, compounding and veterinary pharmacies | In-person clinics with no telemedicine prescribing and no card-not-present drug payments |
| Telemedicine that may result in a prescription | Businesses selling only dietary supplements |
| Businesses taking card-not-present payment for prescription drugs, medical spas included | Sellers of research-use-only chemicals, peptides included |
| Manufacturers, wholesalers and distributors | Medical device businesses |
| Brokers and facilitators that connect patients with contracted providers or pharmacies | Software platforms, unless they hold healthcare licenses, contract with providers or pharmacies, process drug payments or deal with patients directly |
| Prescription price comparison and discount sites | Health insurers |
For a pharmacy the answer is simple: an online, mail-order or compounding pharmacy that takes card-not-present orders is in scope. For telehealth the answer turns on prescribing, and two consequences follow. Online pharmacy payment processing sets out the full file a pharmacy sends to an acquirer.
A therapy, coaching or primary care practice that bills visits and prescribes nothing is outside the program, and an acquirer has no reason to ask it for a certificate. LegitScript makes the same point about medical spas: payments for consultations, appointments or deposits alone do not make one eligible.
The second consequence concerns sellers of research-use peptides. Certification cannot repair a declined application for that model, because LegitScript does not certify it.
What the card schemes, Stripe and Google each require
Four parties are cited as requiring certification, and their published texts say four different things. As of October 2026: How Visa tiers the categories this certificate is read against is set out in the Visa Integrity Risk Program guide.
| Who | What its published text says |
|---|---|
| Mastercard | The Security Rules and Procedures (Merchant Edition, August 4, 2026, section 9.4.3) require an acquirer to register a merchant whose primary business is non-face-to-face selling of prescription drugs, under MCC 5912 or 5122, to have verified that the activity complies with all applicable laws, and to confirm it again at least every 12 months. Verification “may include, but is not limited to” a written opinion from qualified legal counsel or “accreditation by a recognized third party”. The rule names no certifier. |
| Visa | The Visa Integrity Risk Program guide, published in April 2023, classifies card-absent pharmacies under MCC 5122 and 5912 as Tier 1 high integrity risk. The acquirer needs Visa’s approval for the category, performs enhanced due diligence on each merchant, registers it before any transaction and attests to its compliance every year. Visa’s Core Rules (April 18, 2026) exempt from that merchant registration a pharmacy accredited by the National Association of Boards of Pharmacy or another regulatory body Visa recognizes. |
| Stripe | The support FAQ says telemedicine businesses do not need LegitScript certification to use Stripe, though licensing and regulatory items may be requested. |
| Google Ads | The healthcare and medicines policy allows online pharmacies in the United States when LegitScript or NABP has accredited them, and telemedicine providers when accredited under LegitScript’s Healthcare Merchant Certification program. |
LegitScript itself describes its certification as a necessary part of the approval process for card-not-present transactions with Visa and Mastercard. Read next to the scheme texts, the accurate summary is narrower. The schemes oblige the acquirer to verify and register you. Certification is the form of verification acquirers most often ask for, because it is standardized and monitored. A legal opinion is the alternative Mastercard’s rule names, and accreditation from the National Association of Boards of Pharmacy is the one Visa’s rule names for pharmacies. In practice a merchant rarely gets to choose, since the acquirer decides what it will accept as proof.
Neither the Mastercard manual nor Visa’s Core Rules use the word telemedicine. The trigger is the card-not-present sale of prescription medicines, which is why what your telehealth model bills for decides whether the requirement reaches you.
What it costs and how long it takes
The fees are published and the timeline is not. LegitScript’s pricing for Healthcare Certification, as of October 2026:
| Item | Amount | When it is due |
|---|---|---|
| Application fee | 975 dollars per website | At submission. LegitScript says it may refund it only if you withdraw before the review begins |
| Annual certification fee | 2,150 dollars per website | Only once the application is approved |
| Expedited processing | 2,500 dollars per application, on top | Optional |
| Annual fee under probationary certification | 3,995 dollars per website | When LegitScript grants probationary certification in place of the standard one |
An illustrative calculation: a telehealth brand with its own pharmacy runs two root domains, one for the clinic and one for the pharmacy. Year one costs two application fees, 1,950 dollars, plus two annual fees, 4,300 dollars: 6,250 dollars in total. From year two the cost is 4,300 dollars a year. Subdomains are covered by the root domain’s certificate, so a shop or support subdomain needs no application of its own. If LegitScript places either site on probationary certification, that site’s annual fee becomes 3,995 dollars.
On timing, LegitScript’s general certification FAQ says every application is different and that it cannot provide an estimated timeline. Expedited processing guarantees only that the review begins within two business days after screening, and LegitScript states that it does not shorten the compliance review. Estimates ranging from several weeks to several months circulate on consultants’ and processors’ sites. LegitScript publishes none of them.
What you control is the completeness of the first submission. The nine standards say what to have ready: licenses for every jurisdiction you serve, any discipline or litigation from the past ten years, every affiliate and partner pharmacy with its own certification or accreditation, all the domains you control, your privacy policy and your advertising.
How an underwriter uses the certificate
The certificate answers one question for the acquirer: has someone qualified checked that this business may lawfully sell prescription medicines where it sells them. It replaces work the acquirer would otherwise commission or do itself, and it gives the acquirer a monitored party to point to when it registers you with the schemes. An underwriter then checks four things about it.
- The domain. Certification attaches to a root domain. The URL in your merchant application and on your checkout has to be the certified one.
- The partners. If your pharmacy or clinic partner changed after certification, the certificate describes a business you no longer run.
- The status. Probationary certification is still certification. LegitScript charges more for it, and an underwriter will ask what led to it.
- The scope of services. LegitScript asks certified merchants to report new services, new jurisdictions and ownership changes. Acquirers want the same notices, for the same reason.
The certificate does not settle the rest of the file. Chargeback history, refund terms, the reserve and the pricing are underwritten separately, the way the underwriting guide describes, and a certified merchant with a 2 percent dispute ratio is still a difficult placement. LegitScript states that certification does not guarantee advertising approval, and the same holds for acquiring.
Applying for a merchant account while certification is pending
Start both applications at once, because neither waits well for the other. The sequence that works:
- Check scope first. If your clinicians prescribe nothing and no medication is sold, confirm with the acquirer that no certificate is expected and stop there.
- File the LegitScript application and keep the confirmation.
- Send the merchant file with that confirmation, your licenses and the prescribing flow. Underwriting can read everything else while LegitScript reviews.
- Answer both reviewers quickly. They ask overlapping questions about licenses, partners and marketing, and inconsistent answers cost you twice.
- Expect activation to follow the certificate. For pharmacy and prescribing models, acquirers commonly hold go-live until the certificate is issued or until they accept another verification.
OpenGate is a payment gateway: we tell you which certification the acquirers on a file expect, and the certification itself is yours to obtain from LegitScript. A pharmacy with no certification, no accreditation and no application in progress gets a list of what to obtain, and no acquirer reads the file until that is fixed. A business that LegitScript’s own scope excludes will not be rescued by a different label on the same products.
For a prescribing platform, the requirements are on the telehealth and wellness page. For a dispensing business, they are on the online pharmacy page. When your licenses, your certification status and your checkout are ready to show, send your healthcare file for review and say where the LegitScript application stands. An underwriter reads it and answers within 1 business day with an offer, a list of gaps or a no with its reason. The review is free.