Payments & peptides: What a compliant peptide merchant looks like

“Peptide” is not just one thing to a payments underwriter. The same word covers an FDA-approved injectable a pharmacy fills against a prescription and a vial sold from a web store with a “not for human consumption” sticker. Those two businesses are underwritten very differently, and a merchant who does not know which one they are running usually finds out the hard way.

This article describes how peptide payment processing is currently underwritten: the categories a peptide product can fall into, the profile that can generally be underwritten, and the profile that generally cannot, based on FDA classifications and the standards card networks and certification bodies currently apply.

What this article is not is advice on how to become compliant, and it is not a prediction that any particular business will be approved.

Where a merchant wants a route, the recognized starting points are LegitScript and a qualified compliance consultant or counsel. As a merchant, you get to decide your path from there.

The four places a peptide product can sit under the law

Most of the confusion in this category comes from treating four different legal situations as one.

1. FDA-approved peptide drugs
Some peptides are approved drugs. The GLP-1 medications — semaglutide, tirzepatide, dulaglutide — are the clearest examples. Sold through legitimate pharmacy channels against a valid prescription, these carry the least regulatory ambiguity of anything in the category, because their status is settled.

2. Compounded peptides
Licensed 503A and 503B compounding pharmacies can prepare certain peptides for an individual patient pursuant to a valid prescription. This is where the ground moved in 2026 (which we cover in more detail down below), but one point does not move: compounding eligibility is not FDA approval, and a compounded peptide still requires a real prescriber relationship behind it.

A compounding pharmacy filling patient-specific prescriptions is a different risk – a more palatable one, we’d argue – to an underwriter than a storefront shipping vials to anyone with a credit card.

3. “Research use only” products
A large part of the market sells peptides in vials labeled “research use only” or “not for human consumption.” The label is doing legal work: it claims the product is not being sold for people to inject. The problem, however, is what sits next to the label. A research disclaimer paired with a consumer checkout, dosing guidance, and marketing for weight loss, recovery, or anti-aging reads as a human-use product disguised as research.

That contradiction is the single most common thing underwriters and monitoring services flag, because it is visible from the outside in about thirty seconds.

4. Dietary supplement claims
Selling a peptide as a dietary supplement does not make it a dietary supplement. Most peptides do not meet the legal definition of a dietary ingredient, and the FDA has flagged specific ones as presenting significant safety risks.

LegitScript points to BPC-157 and a thymosin beta-4 fragment as examples that have shown up in merchant portfolios in supplement form precisely to look more ordinary than they are. A supplement label on an ingredient the FDA has not cleared for human use does not lower the risk. Instead, it adds a misbranding question on top of it.

What underwriters generally look for

There is no single credential that guarantees a peptide business can process, and no honest piece of content will tell a merchant there is. But underwriters who approve peptide-adjacent businesses tend to be looking at the same short list.

A profile that includes the following is far more likely to survive review than one that does not:

1. A lawful product source: an FDA-approved drug, or a peptide compounded through a licensed pharmacy, rather than bulk “research” stock resold to consumers.
2. A prescriber genuinely in the loop: A licensed provider, whether by telemedicine or in person, evaluating the patient and issuing a lawful prescription. A telehealth model set up as a real clinical step, not a checkbox on the way to the cart.
3. LegitScript Healthcare Merchant Certification: This is the certification acquirers, card networks, and the major ad platforms (Google, Meta) look for in this space. A merchant pursues it directly or with a consultant. It is widely treated as the baseline, not a nice-to-have.
4. Marketing that matches the model: No disease or drug-like claims on unapproved ingredients, and no “research only” language sitting on top of a consumer sale.
5. An accurate business description and Merchant Category Code (MCC) at underwriting: Getting boarded by describing the business as something it is not is the fastest route onto a terminated-merchant file (MATCH list) later.

What generally cannot be underwritten right now

The mirror image of the list above. Currently, the profiles that reliably struggle or get declined share a few features:

• A direct-to-consumer checkout for injectable peptides with no prescriber and a “research use only” label.
• Products built on ingredients the FDA has flagged as presenting significant safety risks, marketed for human use anyway.
• Disease, performance, or body-composition claims attached to unapproved peptides.
• No verification that the buyer is a clinician or a research institution, on products sold as “for research.”

Why this keeps moving (2026)

Anyone writing about peptide compliance has to date the page, because the classifications are actively in motion this year.

In February 2026, the United States Department of Health and Human Services announced that most of the peptides on the FDA’s Category 2 restricted list for compounding would be moved back to Category 1. In April 2026, the FDA updated its Category 2 list and moved a number of unapproved peptides, including BPC-157, TB-500, MOTS-c, GHK-Cu, Melanotan II, Semax, and PEG-MGF, to its “nominated but withdrawn” section, which takes them out of Category 2 restrictions.

In July 2026, the FDA’s Pharmacy Compounding Advisory Committee took up specific peptides, and the question of whether any peptide pathway opens up on the dietary-supplement side remains unsettled. The committee recommended six of the seven peptides it reviewed for the 503A Bulks List, but that recommendation does not make them dietary ingredients.

Two things follow from that as a merchant:

First, Category 1 means a peptide may be compounded by a licensed pharmacy against a prescription. It does not mean the peptide is an approved drug, and it does not clear the same product for sale as a supplement or as “research” stock to consumers.

Second, because the rules continue changing inside a single year, a processor’s decision to board a merchant today is not a guarantee for next month. A merchant has to read the current terms of their processor and their certification body themselves, and proceed on that basis, rather than on where the rules stood when they first signed up.

How Bankful fits into peptide payment processing

Bankful is a payments software and orchestration provider. Depending on the arrangement, Bankful may be the direct processor or may orchestrate routing to a third-party processor of record. The merchant declares their business; routing is based on that declaration; the processor of record underwrites and decides whether the merchant can process.

Within that model, Bankful does not tell a merchant how to become compliant and does not coach anyone through underwriting. What this article does is describe how the peptide category is currently structured and point to the recognized standards. Eligibility, holds, freezes, and terminations are set by the processor of record under its own terms.

If a merchant wants tailored guidance on their specific product, LegitScript’s standards and a qualified compliance consultant or attorney are the right places to start.

Disclaimer: Bankful provides payment software and orchestration services under the Bankful Software Agreement. As described in that agreement (§5.11), merchant account services are governed by a separate agreement between the merchant and the applicable processor of record. Depending on the arrangement, Bankful may be the direct processor or may orchestrate routing to a third-party processor. Eligibility to process, including approval, continued processing, holds, freezes, and account termination, is determined by the processor of record under its own terms, which vary by provider and may change. Merchants are responsible for understanding and complying with their processor’s terms of service and acceptable use policy. Merchant onboarding also includes a Hold Harmless agreement under which the merchant acknowledges that Bankful is not responsible for processing decisions made by the processor of record.