High-risk merchant accounts

High-risk merchant accounts for businesses in the USA

A high risk merchant account in the USA is open to apply in 26 of the 27 sectors we cover, state-licensed gambling, CBD, kratom, vapes, telehealth and subscription billing among them. An underwriter reads your file within 1 business day, and the written offer fixes every fee, the reserve, the payout schedule and the settlement currency before you sign.

Apply to start processing How it works

At a glance

United States

Sectors open: 26 of 27
Currency: Charge in USD, settle in USD or yours
First answer: Within 1 business day
Go-live: As little as two weeks with a complete file

Sectors

Which US businesses we onboard

For a US company selling online to US customers, checked on October 27, 2026. Many conditions change from one state to the next, and each sector names the states that change the answer. Every file is underwritten: open means open to apply, not approved in advance.

Open to apply

The sector's general rules apply.

Social Casino & SweepstakesSweepstakes casinos banned in nine states; Oklahoma follows on November 1, 2026
Montana, Connecticut, New Jersey, New York, California (since January 1, 2026), Indiana, Tennessee, Maine and Louisiana ban dual-currency sweepstakes casinos by statute, and Oklahoma's ban starts November 1, 2026. New York, California and Louisiana also reach the payment processors that support them. Elsewhere a sweepstakes needs at least a genuine free entry route, and a social casino paying no prize of value stays outside most gambling laws.
California AB 831 (2025)(opens in a new tab)Sector page
CBD & HempTotal THC capped at 0.4 mg per container from December 11, 2026
A November 2025 appropriations law rewrote the federal definition of hemp. From November 12, 2026, products holding cannabinoids the plant cannot produce stop being hemp. From December 11, 2026, after a September delay, a finished product may hold at most 0.4 mg of total THC per container, THCA included, and cannabinoids synthesized outside the plant are excluded. FDA still keeps CBD out of food and supplements.
CRS: changes to the statutory definition of hemp(opens in a new tab)Sector page
Nutraceuticals & SupplementsNo disease claims; structure/function claims notified to FDA within 30 days
Under DSHEA a supplement reaches the market without FDA approval: the seller answers for its safety and labeling, and the label may not claim to treat or prevent disease. A structure/function claim carries the FDA disclaimer and is notified to FDA within 30 days of first marketing. The FTC expects health claims to rest on competent and reliable scientific evidence, generally randomized controlled human trials.
21 CFR 101.93(opens in a new tab)Sector page
KratomNot federally scheduled, banned in ten states; FDA rejects it as a supplement
Kratom leaf is not federally scheduled, but FDA says it cannot be lawfully sold as a supplement or a food, and DEA intends to place concentrated 7-OH in Schedule I from November 13, 2026 at the earliest. Ten states ban kratom: Alabama, Arkansas, Connecticut, Indiana, Kansas, Louisiana, Massachusetts (temporarily), Tennessee, Vermont and Wisconsin. Several other states have Kratom Consumer Protection Acts with age limits and labeling rules.
FDA and kratom(opens in a new tab)Sector page
Coaching & Info ProductsEarnings claims need evidence; fake and undisclosed insider reviews banned since October 2024
Selling courses and coaching needs no license, but the FTC Act requires evidence behind any earnings claim, and since October 21, 2024 the Consumer Review Rule has banned fake reviews, reviews paid for on condition they are positive, and undisclosed insider reviews. A program promising customers or outlets falls under the Business Opportunity Rule's seven-day disclosure. The FTC's proposed Earnings Claim Rule was still a proposal in August 2026.
FTC: Consumer Reviews and Testimonials Rule(opens in a new tab)Sector page
Tech Support & IT ServicesTelemarketing Sales Rule covers inbound calls from ads since January 2025
Remote IT help is legal, but since January 9, 2025 the Telemarketing Sales Rule covers inbound tech support calls that answer an ad, a pop-up or direct mail, so a misleading pitch can bring civil penalties. FTC orders against two payment companies, in 2025 and 2026, bar them from serving tech support sellers that use telemarketing or security pop-ups.
Telemarketing Sales Rule amendment, 89 FR 99069(opens in a new tab)Sector page
MLM & Direct SellingLegal when commissions come from real customer sales, not from recruiting
Direct selling is legal, but the FTC treats a plan whose rewards come from recruiting rather than sales to real customers as a pyramid scheme, judged on how it operates in practice. Earnings claims need reliable evidence and must net out typical expenses. The Business Opportunity Rule reaches an MLM only if it fits the definition, and an MLM earnings rule remains a proposal.
FTC: business guidance on multi-level marketing(opens in a new tab)Sector page
Adult & Creator PlatformsAge checks in about half the states; 48-hour takedowns since May 2026
Adult content is legal for adults, but Texas and at least 21 other states required age verification when the Supreme Court upheld the Texas law in June 2025, and an industry tracker lists 27 states in 2026. Producers keep ID records for every performer under 18 U.S.C. 2257. Since May 19, 2026, user-content platforms must remove nonconsensual intimate images within 48 hours of a valid request.
Supreme Court: Free Speech Coalition v. Paxton(opens in a new tab)Sector page
Online DatingState safety notices; Texas requires telling members if you skip background checks
No license is needed, but several states regulate dating sites. Texas requires a safety notice and, in bold capitals, a statement that the site does not run criminal background checks if it does not; New York requires safety notices at sign-up, with up to $250 per member at stake. In 2025 Match Group agreed to pay $14 million to settle FTC charges over guarantees and chargeback lockouts.
Texas Business and Commerce Code, ch. 106(opens in a new tab)Sector page
Ticket Resale & EventsAll-in prices since May 2025; bots banned; New York licenses resellers
Reselling tickets is legal within limits. The BOTS Act bans bots and other ways around purchase limits, and the FTC sued a broker under it in October 2026. Since May 12, 2025 advertised ticket prices must include mandatory fees. New York licenses resellers, and from July 1, 2026 Vermont caps resale at 110 percent of the original price for events at small independent and some nonprofit venues.
16 CFR 464, Rule on Unfair or Deceptive Fees(opens in a new tab)Sector page
Dropshipping & Cross-BorderDuties on every import since August 2025; ship on time or refund
Dropshipping is legal, but imports no longer enter duty-free: de minimis for parcels of $800 or less has been suspended since August 29, 2025, and Congress ended it by law from July 1, 2027. Since July 8, 2026 regulated consumer products need electronic safety certificates at entry. The FTC requires shipping within the stated time, or 30 days, or an offer to cancel and refund.
CBP: indefinite suspension of de minimis, June 2026(opens in a new tab)Sector page
Subscription & ContinuityROSCA consent and easy cancellation; the federal click-to-cancel rule was vacated
Subscriptions are legal under ROSCA: disclose material terms before taking card details, get express informed consent, and offer a simple way to stop charges. The FTC's click-to-cancel rule was vacated on July 8, 2025, and its new rulemaking was still at the advance notice stage in October 2026. California's rules for contracts from July 1, 2025 add express consent, price-change notices and annual reminders; New York requires renewal reminders.
Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403(opens in a new tab)Sector page

Open with your license

Send the license or registration your sector needs.

Casino & SportsbookState license: online casino in seven states, sports betting in 39 and DC
Online casino is licensed and live in seven states: Connecticut, Delaware, Michigan, New Jersey, Pennsylvania, Rhode Island and West Virginia, and Maine authorized it for its tribes in January 2026. Sports betting is live and legal in 39 states and DC, per the American Gaming Association. Under UIGEA and Regulation GG, card systems and their banks must identify and block bets that are unlawful where they are placed or received.
12 CFR 233, Regulation GG(opens in a new tab)Sector page
Fantasy Sports & Skill GamesLicensed or registered state by state; illegal in Washington and, per its AG, California
Federal law keeps qualifying fantasy contests out of UIGEA but leaves their legality to the states. New York, Maine and Connecticut license or register operators. Washington treats paid fantasy sports as illegal gambling, and California's Attorney General concluded in July 2025 that draft and pick'em contests break state law. Skill games follow each state's own test of chance.
California DOJ: legal opinion on daily fantasy sports(opens in a new tab)Sector page
Forex & CFDCFTC-registered dealer with NFA approval for retail forex; no CFDs for retail
Besides banks and other supervised firms, only a CFTC-registered futures commission merchant or retail forex dealer approved by the NFA, with at least $20 million in adjusted net capital, may take the other side of a US retail forex trade. Leverage stops at 50:1 on major pairs, 20:1 on others. CFDs count as swaps, which retail clients may trade only on a designated contract market, so they are off limits.
17 CFR Part 5, off-exchange foreign currency(opens in a new tab)Sector page
Crypto & Web3FinCEN registration, state money transmitter licenses, a BitLicense for New York
An exchange, wallet or on-ramp that moves crypto for customers is a money services business: it registers with FinCEN within 180 days and runs an anti-money laundering program. Many states also require a money transmitter license, and New York a BitLicense. Under the GENIUS Act, enacted July 18, 2025, only permitted issuers may issue payment stablecoins once it takes effect on January 18, 2027.
FinCEN: money services business registration(opens in a new tab)Sector page
Credit Repair & Debt ServicesNo fee until the service is fully performed; state registration and bonds
Under the Credit Repair Organizations Act, a credit repair company may not charge before the service is fully performed, which in practice means billing in arrears. Debt relief sold by telephone may take no fee until at least one debt is settled and the customer has made a payment under it. Several states add registration and a bond: $100,000 in California, $10,000 per location in Texas.
Credit Repair Organizations Act, 15 U.S.C. 1679b(opens in a new tab)Sector page
Telehealth & WellnessPrescribers licensed where the patient is; DEA flexibilities run to December 31, 2026
A clinician generally needs a license, a compact privilege or a telehealth registration in the patient's state. DEA lets registered practitioners prescribe Schedule II to V drugs by video without an in-person visit until December 31, 2026, under a fourth temporary extension. Compounded semaglutide and tirzepatide lost their shortage cover in 2025, and FDA moved in 2026 against mass-marketed copies.
HHS: prescribing controlled substances via telehealth(opens in a new tab)Sector page
E-Liquids & VapesFDA-authorized products only; PACT Act registration, adult signature, no USPS
Only e-cigarettes with an FDA marketing order may be lawfully sold, 48 products as of August 2026. Online sellers register with ATF and each state's tobacco tax administrator under the PACT Act, verify age, deliver against an adult signature and cannot use the Postal Service. California, Massachusetts, New Jersey and Rhode Island ban flavored vapes, and New York bans flavored vapes and shipments to consumers.
FDA: e-cigarettes authorized by the FDA(opens in a new tab)Sector page
Online PharmacyState pharmacy licenses where it ships; Mastercard registration before taking cards
An online pharmacy holds a license in its home state and a nonresident pharmacy license in states that require one, California among them. Controlled substances need a valid prescription: the Ryan Haight Act requires an in-person evaluation, set aside for telemedicine until December 31, 2026. Mastercard makes acquirers register non-face-to-face pharmacy merchants and confirm their legal compliance every 12 months.
FDA BeSafeRx: locate a state-licensed online pharmacy(opens in a new tab)Sector page
Travel & Tour OperatorsSeller of travel registration in California, Florida, Washington and Hawaii
California, Florida, Washington and Hawaii require a seller of travel registration before you sell to their residents. California wants every customer payment in a trust account or an adequate bond, Florida a bond of up to $25,000, Washington a trust account or a $10,000 to $50,000 bond when funds are held over 5 business days. On cancelled flights, DOT rules make card refunds due within 7 business days.
Florida FDACS: sellers of travel(opens in a new tab)Sector page
Timeshare & Vacation ClubsPlan filed with the state first; Florida buyers get 10 days to cancel
Timeshare sales are regulated state by state. Florida requires the public offering statement to be filed for approval before any offer and gives buyers 10 calendar days to cancel, with no closing before then, while Nevada allows 5 calendar days. Exit services draw FTC action: in April 2026 a court ordered one timeshare exit operator to pay $140 million.
Florida Statutes, s. 721.10(opens in a new tab)Sector page
Firearms & AccessoriesFederal Firearms License; every gun ships to a dealer in the buyer's state
Selling firearms as a business requires a Federal Firearms License, and a gun sold online ships to a licensed dealer in the buyer's state, who runs Form 4473 and the background check. Since the Supreme Court upheld ATF's rule in March 2025, some unfinished frames and parts kits are regulated as firearms. California and New York also check ammunition buyers; California's regime awaits an en banc ruling.
ATF: FFL quick reference and best practices(opens in a new tab)Sector page
Auto Transport & ExportFMCSA operating authority; brokers keep a $75,000 bond or trust fund
Carrying or brokering cars across state lines for pay requires FMCSA operating authority. A broker must keep a $75,000 surety bond or trust fund, and since January 16, 2026 a broker whose security drops below that faces suspension 7 business days after FMCSA's notice. Exporting a used vehicle means presenting the title and VIN to CBP at least 72 hours before export.
49 CFR 387.307(opens in a new tab)Sector page
Alcohol & Age-Restricted RetailState licenses at each tier; direct shipping allowed state by state
Alcohol moves through three tiers, producer, wholesaler and retailer, each licensed by the state, and producers, importers and wholesalers also need federal TTB permits. Wineries may ship direct to consumers in 48 states and DC, seven with tight limits, per the Wine Institute; Delaware planned its licenses for fall 2026 and Utah bans it. Spirits reach about 10 states and DC, California only until December 31, 2026.
Wine Institute: direct shipping table(opens in a new tab)Sector page
Tobacco & NicotinePACT Act registration, age check at delivery, no USPS; buyers 21 and over
Shipping cigarettes, smokeless tobacco or vapes to consumers requires PACT Act registration with ATF and each destination state's tax administrator, plus an age check at delivery, and USPS has refused vapes since October 21, 2021. Federal law sets the buying age at 21. Nicotine pouches need FDA authorization, and 43 were authorized by August 2026. California bans flavored tobacco sales.
ATF: the PACT Act(opens in a new tab)Sector page

Not processable

Unlawful to sell to customers in this market.

Peptides & LongevityPeptides sold to consumers for human use are unapproved new drugs
FDA treats a peptide sold for human use as an unapproved new drug whatever its research-use label, as its 2025 and 2026 warning letters state. Compounding offers no route yet: BPC-157, TB-500 and most other popular peptides are not on the 503A bulks list, and an FDA advisory committee reviewed several of them in July 2026 without FDA adding any.
FDA warning letter, Gram Peptides, March 2026(opens in a new tab)Sector page

Inside open sectors, a few products cannot be processed either: sweepstakes casinos in the states that ban them, vapes and nicotine products without FDA authorization, flavored vapes where a state bans them, and concentrated 7-OH once DEA's order takes effect. Clinics and pharmacies working on prescription apply as telehealth or online pharmacy.

Payment methods

How your US customers pay

These are the methods we can switch on for a US merchant, one by one, within each brand's rules for your sector. Your written offer lists the ones agreed.

Cards and wallets
Visa, Mastercard, American Express, Discover, Apple Pay, Google Pay
Most US online sales. Credit card interchange is set by the networks, with no federal cap; on debit cards from banks with $10 billion or more in assets, Regulation II caps it at 21 cents plus 0.05%, plus 1 cent for fraud prevention.
ACH direct debit
ACH Direct Debit
Debits from the customer's bank account, for subscriptions, installments and high tickets. Each one needs the customer's authorization, and the customer's bank can return an unauthorized debit for 60 days.
Wallets your customers already hold
Cash App Pay, Amazon Pay, PayPal
Checkout from an account the customer already has, with no card number to type. Each wallet is switched on per merchant, within its own rules for your sector.
Pay over time
Affirm, Sezzle, Klarna
The customer pays in installments while the provider pays you for the sale and collects the installments. Each provider approves your sector under its own merchant terms.

See all payment methods

The process

From your file to your first payout

Send your file
Formation documents, the EIN letter, ID for the owners, the license your sector needs and recent processing statements if you have them.
An underwriter answers
Within 1 business day: the route that fits, the documents still missing, or a plain no.
Your written offer
Every fee, the reserve, the payout schedule and the settlement currency, written down before you sign.
Go live
Integration, test payments, then live traffic under monitoring: as little as two weeks when the file is complete.

The file

The file of a US company

Articles of incorporation or organization, and a certificate of good standing
EIN confirmation: the IRS CP575 notice or Letter 147C
ID for every owner and for the person who controls the company
A business bank account in the company's name
Three to six months of processing statements, if you have them
Your website, with your address, refund policy and any subscription terms
Sales tax registration in the states where you pass the economic nexus threshold
The state or federal license your sector needs, where the list above names one

Local rules

Six US rules behind most account decisions

Card network programs, ACH rules and state laws decide more US files than any license question. Each sector above and each topic below opens on the full rule and its source.

Card monitoring
Visa's VAMP threshold is now 1.5% in the US
Since April 1, 2026, a US merchant is excessive under Visa's Acquirer Monitoring Program once card-not-present fraud reports plus disputes reach 1.5% of settled transactions and 1,500 in a month. The acquirer must then put risk controls in place.
Visa: VAMP fact sheet(opens in a new tab)
MATCH
Five years on MATCH after an excessive-chargeback exit
An acquirer that ends an account over Mastercard chargebacks above 1.5% of the number of sales transactions across three months, totaling $5,000 or more, lists the merchant on MATCH. The record stays five years, and acquirers check MATCH before signing a merchant.
Mastercard: Security Rules and Procedures(opens in a new tab)
Subscriptions
No federal click-to-cancel rule, but ROSCA and state laws
The FTC's click-to-cancel rule was vacated on July 8, 2025. ROSCA still requires clear terms, express consent and a simple way to stop charges, California makes online sign-ups cancellable online, and Amazon settled a ROSCA case for $2.5 billion in 2025.
ROSCA, 15 U.S.C. 8403(opens in a new tab)
ACH
Unauthorized returns above 0.5% bring Nacha enforcement
A consumer's bank can return a debit as unauthorized for 60 days. Above 0.5% of your debits, your bank must report the rate and bring it down under Nacha's rules, and since June 2026 every business originating ACH entries must run fraud monitoring.
Nacha: risk and enforcement topics(opens in a new tab)
Gambling
A bet must be legal where it is placed and received
UIGEA and Regulation GG require card systems and their banks to identify and block bets that are unlawful where they are placed or received. An acquirer therefore checks the state license before onboarding and codes gambling sales under their own category.
12 CFR 233, Regulation GG(opens in a new tab)
Interchange
Debit is capped, credit is not, and the cap is in court
Regulation II caps debit interchange at 21 cents plus 0.05%, plus 1 cent for fraud prevention, on cards from banks with $10 billion or more in assets. On October 26, 2026 a federal appeals court upheld the vacatur of the cap, but the 21-cent cap still applies until that ruling takes effect. Credit card interchange has no federal cap.
Eighth Circuit: Corner Post v. Board, No. 25-3000(opens in a new tab)

In detail

US rules in detail

Who regulates what, the debit cap, Visa's and Mastercard's programs, disputes, subscriptions, ACH, the company file and the mistakes that cost US accounts. Open a topic for the rule, its dates and its sources.

Who regulates high-risk sales in the US

Federal agencies set the national floor, the states license most regulated activities, and Visa, Mastercard and Nacha write the rules your acquirer applies every day.

Regulator	What it covers	What it asks of a merchant
Federal Trade Commission (opens in a new tab)	Unfair or deceptive practices, ROSCA, the Telemarketing Sales Rule, the fees and reviews rules	Substantiated claims, clear subscription terms, all-in prices for tickets and short stays, no fake reviews
Consumer Financial Protection Bureau (opens in a new tab)	Regulation Z for credit cards, Regulation E for debit cards and ACH	Nothing to file for most merchants; card and ACH dispute rights run through its rules
Federal Reserve Board (opens in a new tab)	Regulation II, the debit interchange cap and routing	Nothing to file; the cap limits what large banks earn on debit
FinCEN (opens in a new tab)	Money services businesses, crypto exchangers included	Registration within 180 days and an anti-money laundering program
State money transmission regulators (opens in a new tab)	Money transmitter licenses; 31 states have enacted the model law in full or in part	A license in each state where you move customers’ money
State consumer protection laws	Unfair practices and automatic renewal laws, state by state	Consent, reminders and cancellation as each state sets them
CFTC and NFA (opens in a new tab)	Futures and retail forex	Registration and NFA approval for any retail forex counterparty
Food and Drug Administration (opens in a new tab)	Food, supplements, drugs, tobacco and vapes	Lawful claims for supplements, a marketing order for each vape and nicotine product, no unapproved drugs
ATF (opens in a new tab)	Firearms licensing, the PACT Act	A Federal Firearms License; PACT Act registration for tobacco and vape delivery sellers

Visa and Mastercard are not regulators, yet their monitoring programs bind your acquirer as tightly as any law: they have their own topic below, as do the Nacha rules for ACH.

Interchange and the debit cap

Regulation II caps interchange on debit cards issued by banks with $10 billion or more in assets at 21 cents plus 0.05% of the sale, plus 1 cent when the issuer meets the Federal Reserve’s fraud-prevention standards. On a $50 debit sale that comes to 24.5 cents at most. Smaller issuers are exempt from the cap but not from the routing rules, and credit cards, checks and ACH fall outside the regulation entirely.

Two changes are pending. In October 2023 the Federal Reserve proposed a base of 14.4 cents, 0.04% and a 1.3-cent fraud adjustment, which would bring the $50 example to 17.7 cents; by October 2026 it had not adopted the proposal. Then, on October 26, 2026, the Eighth Circuit affirmed a district court judgment vacating the 21-cent cap, because the Fed counted costs the statute excludes, and sent the rule back to the Fed. The ruling takes effect only when the court issues its mandate, and further review is possible: until then, the 21-cent cap applies.

Credit card interchange has no federal cap; Visa and Mastercard publish their own rates. A settlement between the two networks and a class of merchants, preliminarily approved on June 9, 2026, would let merchants decline premium and commercial credit cards and surcharge by card type; its fairness hearing is set for November 16, 2026. The Credit Card Competition Act of 2026, introduced in both chambers on January 13, 2026, had not left committee by October.

Visa lets a US merchant surcharge credit cards only, never debit or prepaid cards, at 3% at most and after notifying its acquirer 30 days ahead. The interchange plus guide shows how these costs reach a high-risk statement.

Visa VAMP, Mastercard’s program and MATCH

Since June 1, 2025, Visa runs a single Acquirer Monitoring Program in place of its old fraud and dispute programs. The VAMP ratio adds card-not-present fraud reports (TC40) to disputes (TC15) and divides them by settled transactions; disputes resolved through pre-dispute tools and fraud that qualifies for Compelling Evidence 3.0 are left out. A US merchant is excessive at 150 basis points (1.5%) with at least 1,500 fraud reports and disputes in the month, down from 220 basis points on April 1, 2026, and card testing has its own enumeration thresholds. The VAMP guide covers what acquirers do next.

Mastercard’s Excessive Chargeback Program measures a calendar month’s chargebacks against the previous month’s Mastercard transactions, in two tiers. Its thresholds now sit in a Mastercard manual that is not public, so a figure quoted in a sales pitch deserves a source.

MATCH, Mastercard’s list of terminated merchants, is what makes a closure follow you to the next acquirer:

Reason	Code	What the 2026 rules say
Excessive chargebacks	04	Chargebacks over the previous three months above 1.5% of the number of Mastercard sales transactions, totaling $5,000 or more
Excessive fraud	05	A fraud-to-sales ratio of 8% or more over three months, with 10 or more fraudulent transactions totaling $5,000 or more
Transaction laundering	03	Sales put through another merchant’s account
Illegal transactions	13	Sales unlawful where they take place

A record stays five years. The MATCH guide shows how to find out whether you are listed.

Chargebacks and consumer dispute rights

On credit cards, Regulation Z gives a cardholder 60 days from the first statement showing a charge to dispute a billing error in writing, goods or services not delivered as agreed included; the issuer must resolve it within two billing cycles and 90 days at most. Liability for unauthorized use is capped at $50. A cardholder who has tried in good faith to settle with the merchant may also refuse to pay the issuer for a purchase above $50, within limits on where the sale took place.

On debit cards, Regulation E limits a consumer’s liability to $50 when a lost or stolen card is reported within two business days, and to $500 after that. An unauthorized ACH debit made without the card costs the consumer nothing if reported within 60 days of the statement. Either way the bank re-credits the customer, and the loss comes back to you as a chargeback or an ACH return.

Card network chargeback windows are separate from these legal rights and set by Visa’s and Mastercard’s rules. Every dispute counts toward the ratios above, won or lost, and the chargeback ratio playbook shows where to cut them.

Subscriptions: ROSCA and the state renewal laws

Under the Restore Online Shoppers’ Confidence Act, an online seller using a free trial, an automatic renewal or a continuity plan must disclose all material terms before taking billing details, obtain express informed consent before charging, and give a simple way to stop the charges. The FTC enforces it directly: in September 2025 Amazon agreed to pay $2.5 billion, a $1 billion civil penalty and $1.5 billion in refunds, over its Prime sign-up and cancellation flows.

The consent and cancellation duties of the FTC’s click-to-cancel rule never became enforceable: the Eighth Circuit vacated the rule on July 8, 2025, days before compliance was due, because the FTC had skipped a required preliminary analysis. The new rulemaking opened with an advance notice on March 13, 2026; no proposed rule had followed by October 2026.

The states fill the gap, and the strictest one you sell into sets your flow:

California, for contracts made from July 1, 2025: express affirmative consent kept on record, an annual reminder on annual plans, notice 7 to 30 days before a price change, notice 3 to 21 days before a trial or promotional price of more than 31 days ends, and cancellation online for anyone who signed up online, with a save offer only beside a click-to-cancel button.
New York: affirmative consent to the renewal terms; for a price increase, consent or a 14-day window to cancel with a pro rata refund, after 5 business days to 30 days’ notice of the change; cancellation through the medium used to sign up; notice 3 to 21 days before the cancellation deadline for the first paid period after a trial of more than a month, and 15 to 45 days before it on terms of a year or more.
The card networks: Visa requires an electronic reminder with a cancellation link at least 7 days before the first charge after a free trial, and Mastercard a reminder 3 to 7 days before billing when a trial lasts more than seven days.

The negative option billing guide lists what an acquirer checks before approving a trial offer.

ACH direct debit and payouts

Regulation E requires an authorization signed or similarly authenticated by the consumer for recurring debits, with a copy to the consumer, and 10 days’ notice of the amount and date when a recurring debit varies. Nacha’s rules add the merchant’s side of the file:

the account number is validated before its first use in an online debit, a rule in force since March 19, 2021;
since March 20, 2026, a consumer debit for an online purchase of goods carries the entry description PURCHASE;
since June 2026, every business that originates ACH entries runs risk-based monitoring for entries that are unauthorized or obtained under false pretenses, reviewed at least once a year (the largest originators started on March 20, 2026);
unauthorized returns (R10, R11) can arrive for 60 days, and three return rates are watched: 0.5% unauthorized, 3% administrative (closed, nonexistent or invalid accounts) and 15% overall.

For payouts, ACH settles four times a day, on the same business day or later, with Same Day ACH limited to $1 million per payment until the limit rises to $10 million on September 17, 2027. Fedwire carries same-day wires that are final once processed, and the Federal Reserve’s FedNow service settles instant payments at any hour where the receiving bank takes part.

The company file: what changed in 2025 and 2026

FinCEN no longer collects beneficial ownership reports from US companies. An interim rule of March 2025 exempted every entity created in the US, and a final rule effective August 14, 2026 made the exemption permanent; only foreign companies registered to do business in a state still report. Banks and acquirers still identify a company’s owners when they open an account, so your file lists them with ID all the same.

The IRS now issues the CP575 EIN notice as a digital document, downloaded from the Business Tax Account, and banks accept it as written confirmation of the number; Letter 147C is still available by calling the IRS business and specialty tax line. Sales tax follows the Supreme Court’s 2018 decision in South Dakota v. Wayfair: each state may require a remote seller to collect once it passes the state’s economic nexus threshold. South Dakota’s law, upheld in that case, used $100,000 of sales or 200 transactions a year; since July 1, 2023 it uses $100,000 only.

Mistakes that cost US merchants their accounts

Letting card-not-present fraud reports plus disputes reach 1.5% of settled Visa transactions. Since April 1, 2026, that is excessive under VAMP for a US merchant with 1,500 or more in a month, and the acquirer has to act.
Running a free trial without the network reminders. A missing reminder turns into “I never agreed to this” disputes, and those feed the same ratio.
Signing customers up online and cancelling them only by phone. ROSCA asks for a simple exit, California for an online one, and the FTC’s Amazon case ended at $2.5 billion.
Raising a subscription price without notice. California requires 7 to 30 days, New York 5 business days to 30 days plus consent or a 14-day cancel-and-refund window, and Regulation E 10 days when a recurring ACH debit changes amount.
Pulling ACH debits on a weak authorization. The customer’s bank can return them for 60 days, and above 0.5% unauthorized returns your bank must step in.
Leaving with excessive chargebacks. Above 1.5% of Mastercard sales transactions over three months, totaling $5,000 or more, the exit becomes a MATCH record for five years.
Putting phone sales through someone else’s merchant account. The Telemarketing Sales Rule calls it credit card laundering, and transaction laundering is a MATCH reason of its own.
Holding or moving customer money without registration. Money transmitters register with FinCEN within 180 days and need state licenses; operating unregistered is a federal crime.

Most of these are fixed before go-live. A business model that depends on breaking one of them is declined, whatever its volume.

FAQ

US high-risk merchant account FAQ

How do I get a high risk merchant account in the USA?

Send your company file with the license or registration your sector needs. An underwriter reads it within 1 business day and answers with a route, a list of missing documents or a no, and go-live takes as little as two weeks once the file is complete. The complete guide explains how acquirers weigh risk.

Which US businesses are considered high risk?

Acquirers call a business high risk when its sector carries more disputes, fraud or regulation than average. In the US that usually means gambling and sweepstakes, adult content, CBD, kratom, vapes, crypto, credit repair, telehealth, travel and subscription billing. The sector list above gives the US position of each of the 27 we cover, with the states that change it.

How much does a high-risk merchant account cost in the US?

Interchange sets the floor. Credit card interchange is set by Visa and Mastercard with no federal cap; on debit cards from large banks it is capped at 21 cents plus 0.05% and 1 cent for fraud prevention, at most 24.5 cents on a $50 sale. Scheme fees, the acquirer's margin and the reserve depend on your sector and history. Pricing shows the indicative ranges.

Can a high-risk business take ACH payments?

Yes, when the sector allows it. Each debit needs the customer's authorization and a copy for the customer, the account number is validated before its first online debit, and online purchases of goods carry the PURCHASE entry description. Keep unauthorized returns under 0.5% of your debits: above that, your bank must act under Nacha's rules.

Which payment methods can US customers use?

Visa, Mastercard, American Express and Discover with Apple Pay and Google Pay; ACH direct debit; Cash App Pay, Amazon Pay and PayPal; and Affirm, Sezzle and Klarna to pay over time. We switch each method on per merchant, within the brand's rules for your sector.

Is there a federal click-to-cancel rule?

No. The Eighth Circuit vacated the FTC's rule on July 8, 2025, and the FTC's new rulemaking was still at the advance notice stage in October 2026. ROSCA applies all the same, and California and New York add their own renewal and cancellation duties. The subscription guide shows a flow that meets them.

Do I need a license in every state I sell to?

It depends on the sector. Online gambling, money transmission, pharmacy licensing, seller of travel registration in California, Florida, Washington and Hawaii, and PACT Act registration for vapes and tobacco all follow the customer's state. Coaching, supplements and dropshipping need no sector license: federal and state conduct rules apply instead.

Can I apply if my business is on the MATCH list?

Yes. A MATCH record stays five years and every acquirer sees it, but we read listed files instead of declining them on sight: the reason code, what has changed since and the rest of the file decide. Send the termination letter with your application. The MATCH removal guide explains how a listing can end early.

Can I charge US customers in dollars and be paid in another currency?

Yes. Your prices show in USD, and you settle in USD or in the currency agreed in your offer. US payouts run by ACH or wire, and the payout schedule and any conversion fee appear in the offer before you sign.

Stripe or PayPal closed my account. Can I still apply?

Yes. Mainstream processors close many high-risk sectors as a matter of policy, so a closure on its own does not decide your file. Send the closure notice with your application, and read the account closure guide for what to do with the funds still held.

United States

Open your US gate.

Send your file with the license your sector needs. An underwriter reads it within 1 business day and comes back with an offer, the documents still missing, or a straight no.

Apply to start processing Talk to an underwriter

Free to apply. A human answer within 1 business day.

Facts checked on 27 October 2026 · 23 sources

This page describes the rules as we read them on that date. It is not legal advice: confirm them with counsel for your business and your products.

High-risk merchant accounts for businesses in the USA

Which US businesses we onboard

Open to apply

Open with your license

Not processable

How your US customers pay

Cards and wallets

ACH direct debit

Wallets your customers already hold

Pay over time