Do peptide sellers need LegitScript to accept payments?

Peptide sellers need LegitScript to accept payments only where a processor or card program asks for it; no US law we found names LegitScript. LegitScript says its certification is “required by many major credit cards.” Certified businesses may not offer unapproved peptides such as BPC-157, and FDA warning letters reject “research use only” labels when a site shows human use.

Policy checked on November 1, 2026, against LegitScript’s peptide guide and blog, Visa’s public rules (24 October 2026 edition), Stripe’s restricted businesses list, and FDA’s compounding pages and warning letters.

Peptide products by FDA status, LegitScript rule and payment rule

A peptide product’s FDA status decides which LegitScript rule and which payment rule apply to it. Three product types cover most of this question.

What LegitScript says about peptides

LegitScript says many peptides sold online are unapproved drugs, and that certified businesses may not dispense, offer, promote or advertise the ones that aren’t eligible for sale. Its guide for payment processors, Understanding Peptides: A Q&A Guide for Payment Processors and Online Platforms (2025), says unapproved peptides “are not necessarily illegal to possess in research labs for legitimate professional study, but they are illegal to market or sell for human consumption without FDA approval.”

The guide gives these examples of peptides “most commonly sold for unapproved human consumption”:

• Melanotan 2
• Ipamorelin
• Tesamorelin
• CJC-1295
• BPC-157
• Thymosin beta-4 / TB-500
• GHRPs (growth hormone releasing peptides)

It also tells processors to “carefully scrutinize any website offering in-demand peptides, such as semaglutide and tirzepatide,” because “some merchants may be selling these peptides illegally.”

On September 22, 2026, LegitScript published The Peptide Boom: Why So Many Popular Products Are Still Off-Limits. It names retatrutide, BPC-157, TB-500 and cagrilintide as “not currently eligible for compounding, sale, or use” under the US framework, and spells out what that means for certified businesses:

“Violations aren’t limited to actually dispensing or prescribing an impermissible peptide. They also include offering the product, promoting it, or advertising it.”

The same post says partnering with another company that dispenses these substances “doesn’t provide a workaround either.” It treats educational content as generally permitted and content that “encourages the use of an unapproved drug” as a breach of its Transparency Standard.

What LegitScript-certified businesses may and may not do with peptides

How common unapproved peptide ads have become

LegitScript’s data shows a fast rise in peptide marketing. In a December 9, 2025 release, it said: “In 2024, LegitScript observed 308% more ads related to problematic peptides than in 2023, and 678% more compared to 2022.” The same release reported a 276% growth rate in problematic peptide products on e-commerce marketplaces over five years, and named GLP-1 among the most common products, next to Melanotan, BPC-157, TB-500 and PT-141.

What card networks say about drug and pharmacy merchants

Visa’s public rules don’t mention LegitScript. They bar card acceptance for products that imply prescription-drug efficacy, and they require extra registration for high-integrity risk merchants, with an exemption for accredited pharmacies. The Visa Core Rules and Visa Product and Service Rules (24 October 2026 edition) contain two lines that matter here:

1. Section 1.9.2.1 says an acquirer must ensure a merchant does not accept Visa cards for “The purchase of products that claim or imply a similar efficacy as prescription drugs, controlled substances, or recreational/street drugs, irrespective of claims of legality.” Visa marks this rule as last updated October 2026.
2. Section 1.9.5.1 requires acquirers to register High-Integrity Risk Merchants with Visa. A footnote says this “does not apply to Merchants assigned MCC 5122 or 5912 if the Merchant is accredited by the National Association of Boards of Pharmacy (NABP) or other regulatory body recognized by Visa.”

The list of high-integrity risk merchant codes sits in a separate Visa Integrity Risk Program Guide, which the public rules refer to. LegitScript’s June 13, 2023 summary of that program lists “MCC 5122, 5912 (pharmacies)” in Tier 1. LegitScript’s August 19, 2024 post adds that “Visa and Mastercard deem anyone processing payments for merchant category codes (MCC) 5122 and MCC 5912 as high-integrity risk.”

What payment processors publish about peptides and pharmacies

Payment processors publish their own rules, and the large public list we checked, Stripe’s, doesn’t name LegitScript. LegitScript’s own peptide guide says: “Pharmacies, telemedicine companies, and med spas offering prescription drugs through card-not-present transactions are categorized as high-risk merchants by card networks.” Its telemedicine page says certification is “required by many major credit cards and internet platforms.” Neither page names a specific processor rule.

Stripe’s Prohibited and restricted businesses page, read on November 1, 2026:

• Prohibits “Incorrectly labeled research chemicals” and “substances designed to mimic illegal drugs.”
• Lists “Pharmaceuticals, medical devices, and telemedicine” as restricted, a group it describes as “Industries and products that require additional due diligence.” That group includes “Online pharmacies,” “Card-not-present prescription-only products and pharmaceuticals” and “Telemedicine and telehealth services.”

Each processor sets its own terms. For how LegitScript works with ad platforms rather than payments, see who needs LegitScript, platform by platform.

FDA’s position on “research use only” peptides

FDA treats a “research use only” label as no defense when the rest of the website points to human use. In an August 24, 2026 warning letter to an online peptide seller, FDA wrote:

“Despite statements on your product labeling marketing your products for ‘research use only’ and ‘not for human consumption,’ evidence obtained from your website establishes that your products are intended to be drugs for human use.”

That letter named “GLP-3R” (retatrutide), semaglutide, SS-31, PT-141 and tesamorelin as unapproved new drugs, and cited the sale of bacteriostatic water as “providing the means to prepare an injectable drug for human administration.” An earlier letter, dated February 26, 2025, rejected the labels “research use only,” “not for human consumption” and “lab purposes only” on a site FDA said sold “unapproved and misbranded semaglutide and tirzepatide drug products.”

LegitScript’s guide reaches the same view from the payments side. It says sellers that “prominently state that their products are not intended for human consumption are, perhaps counterintuitively, more likely to be engaged in unapproved peptides sales.”

FDA compounding status of BPC-157 and other peptides

Popular wellness peptides such as BPC-157 are not on FDA’s list of bulk substances a 503A pharmacy may compound. FDA’s 503A page (content current as of May 14, 2026) says 503A compounders “may only compound drug products using bulk drug substances” that meet a USP or NF monograph, are components of FDA-approved drugs, or appear on the 503A bulks list.

FDA’s page on safety risks says of BPC-157 that the agency “lacks sufficient information to know whether the drug would cause harm when administered to humans.” The briefing document says FDA “does not intend to issue a final determination” until it has the committee’s input. The 503A bulks list itself, 21 CFR 216.23 as published on eCFR on October 29, 2026, names six substances, none of them peptides. LegitScript notes that if FDA moves forward, “it would typically publish a Notice of Proposed Rulemaking.” A Federal Register search on November 1, 2026 returned one document for BPC-157, the April 16, 2026 notice of the advisory committee meeting, and no proposed rule.

How licensed GLP-1 telehealth brands differ from peptide sellers

A licensed GLP-1 telehealth brand and a research-peptide shop can sell the same molecule class, because semaglutide and tirzepatide are peptides too; LegitScript’s guide calls them “peptide-based GLP-1 drugs.” What differs is each product’s legal path.

• FDA-approved GLP-1 drugs (Wegovy, Zepbound, Mounjaro) are dispensed on a valid prescription. A business seeking LegitScript certification must meet all 9 standards, listed on our LegitScript certification requirements page.
• Compounded semaglutide or tirzepatide is not FDA approved. FDA’s April 1, 2026 statement says 503A compounding needs a prescription for an individual patient and may not be “essentially a copy” of a commercially available drug unless a prescriber documents a significant difference. On April 30, 2026, FDA proposed to exclude semaglutide, tirzepatide and liraglutide from the 503B bulks list. LegitScript’s guide says it “also sees illegally compounded versions of approved drugs, such as semaglutide.” The full timeline is on our compounded GLP-1 explainer.
• Retatrutide is an investigational peptide that LegitScript describes as “still in clinical trials.” FDA’s August 24, 2026 letter treated a “GLP-3R” (retatrutide) product as an unapproved new drug, and LegitScript lists it as off-limits for certified businesses.

What this means for a GLP-1 brand’s payments

For a licensed GLP-1 brand, payments come down to the processor’s review of a card-not-present prescription merchant. Visa’s public rules exempt MCC 5122 and 5912 merchants accredited by NABP “or other regulatory body recognized by Visa” from high-integrity risk registration, and they don’t say which other bodies Visa recognizes.

1. Confirm each product’s legal path: FDA approved and dispensed on a prescription, or compounded within the 503A conditions in FDA’s April 1, 2026 statement.
2. Keep unapproved peptides off every site and ad you control. LegitScript counts offering, promoting or advertising them as a violation, and a partner that dispenses them “doesn’t provide a workaround either.”
3. Check each partner pharmacy. LegitScript’s Standard 4 says a merchant’s “affiliates and partners must comply with all program standards,” and you can check a site’s LegitScript status first.
4. Read your processor’s agreement. Stripe, for example, lists online pharmacies and telemedicine as restricted businesses that “require additional due diligence.”

FAQ

Is LegitScript required by law to accept card payments?

No US law we found names LegitScript. Visa’s public rules name NABP accreditation “or other regulatory body recognized by Visa” for pharmacy merchant codes, and processors set their own terms. LegitScript says many major credit cards require its certification.

Can you sell peptides online legally?

FDA-approved peptide drugs can be sold on a valid prescription. LegitScript’s guide says pharmacies and telemedicine companies prescribing or dispensing peptide drugs “must adhere to the laws of every jurisdiction where they are located and where they operate,” and that unapproved peptides are illegal “to market or sell for human consumption without FDA approval.”

Does a “research use only” label change anything for payments?

No. FDA’s February 2025 and August 2026 warning letters reject that label when a website shows human use. LegitScript lists the “not for human consumption” claim as a red flag, and Stripe prohibits “Incorrectly labeled research chemicals.”

Can a LegitScript-certified clinic offer BPC-157?

No. LegitScript’s September 22, 2026 post says certified businesses may not dispense, offer, promote or advertise BPC-157, TB-500, retatrutide or cagrilintide, directly or through a partner.

Is semaglutide a peptide?

Yes. LegitScript’s peptide guide describes semaglutide as one of the “peptide-based GLP-1 drugs.” Its legal status depends on the product: FDA-approved brands, lawfully compounded versions, or unapproved sellers.