Payment Processing for Peptide Stores: What Actually Works (2026)

Last verified July 2026. Written for B2B research-peptide resellers. Research-use-only (RUO) context — nothing here is legal, medical or financial advice, and payment-network rules change frequently.

Every reseller in this category hits the same wall: the store is built, the catalog is ready, and no mainstream processor will take the account. This guide covers what the published rules actually say, what high-risk processing really costs you, how underwriting decisions get made, and what gets accounts terminated after approval.

1. What the major processors actually prohibit

Here is the finding that surprises most people: not one major processor names “research peptides” or “research chemicals” in its published prohibited list. We checked all five directly. The exposure is interpretive — applied at underwriting and post-approval review — not a named prohibition you can look up and plan around.

Stripe

Stripe’s restricted businesses list (updated May 2026) prohibits “pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims” and “substances designed to mimic illegal drugs.” The words “peptide,” “research chemical,” “supplement” and “investigational” do not appear anywhere on the page. Note the conditional wording — “not safe or make harmful claims” is a judgment Stripe makes, not a bright line.

PayPal

PayPal’s Acceptable Use Policy — last updated October 2022 — prohibits transactions involving “narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety.” Again, no peptide or research-chemical language. That final catch-all is the broadest of the five and entirely discretionary.

Square

Square’s payment terms (effective June 2026) list 31 unsupported industries. None mentions nutraceuticals, supplements, research chemicals or peptides. The items that actually reach this vertical target the business model, not the product: “direct marketing or subscription offers,” “up-sell merchants,” and “high-risk products and services.” If you run autoship or upsell funnels, that is your exposure.

Shopify Payments

This one matters most if you sell on Shopify. Shopify Payments maintains no prohibited-business list of its own. Section B5 of its US terms states that prohibited categories “are provided by each Payment Processor” and then links out to Stripe’s and PayPal’s lists. Shopify’s Acceptable Use Policy contains no product list at all. In practice, a Shopify Payments merchant is governed by Stripe’s and PayPal’s rules.

Braintree

Braintree’s acceptable use policy — last updated November 2017, the oldest primary source in this set — restricts “pseudo pharmaceuticals” and “substances designed to mimic illegal drugs.” “Pseudo pharmaceutical” is not defined anywhere in the document.

What this means in practice

The phrase doing the work across all five policies is “pseudo-pharmaceutical.” No provider defines it. A research peptide marketed with any human-benefit framing falls inside it on a plain reading. Marketed strictly as a laboratory reagent, it arguably does not. That ambiguity is the current state of the published rules — and it is why how you write your product pages matters as much as what you sell.

2. The “research use only” label does not protect you

This is the most important section of this guide, and most articles in this category get it wrong.

An RUO disclaimer is evidence, not a shield. Under 21 CFR 201.128, intended use is determined by the objective intent of whoever is responsible for the labeling — shown through claims, advertising, page design, and the circumstances of distribution. A disclaimer sitting under marketing copy that implies human benefit does not neutralise the copy.

The FDA has said this directly. In a March 2026 warning letter to Gram Peptides: “Despite statements on your product labeling marketing your products for ‘Research Use Only’… evidence obtained from your website establishes that your products are intended to be drugs for human use.” Comparable letters went to USApeptide.com (February 2025), Pinnacle Peptides (December 2025), and Summit Research Peptides and Prime Peptides (December 2024).

One specific trap worth internalising. The same Gram Peptides letter flagged this: “Your firm offers ‘Bacteriostatic Water for Injection’ for sale alongside peptide products… The sale of these products together demonstrates that you intend for your ‘Bacteriostatic Water for Injection’ to be used in combination for injection.” Selling reconstitution supplies next to peptides was itself treated as evidence of human-use intent. Audit your related-products and cross-sell modules for this.

Why this belongs in a payment-processing guide: an FDA warning letter is public, indexed, and constitutes documentary evidence of marketing unapproved drugs. Acquirer agreements permit immediate termination on the acquirer’s “reasonable belief” that termination is necessary to comply with law. A warning letter converts directly into that belief — with no cure period.

3. What high-risk processing actually costs

Two things to know before the numbers. First, no card network publishes pricing — every figure below comes from processors and brokers, i.e. parties selling the service. Second, no peptide-specific rate, reserve or settlement figure exists in any published source. Treat anyone quoting you a category-specific number as quoting their own book, not an industry standard.

Rolling reserves

Typically 5–10% of processing volume, with 10–15% common for newer merchant files, held for 90–180 days. The hold window exists because it mirrors the period in which a chargeback can still be filed. Worked example: at $100,000/month with a 10% reserve on a 180-day hold, roughly $60,000 sits locked on an ongoing basis. Rolling reserves generally have no cap; capped reserves — where the ceiling is around half of monthly volume — are a separate and better arrangement worth asking for. Reserves are negotiable and usually step down after three to six clean months.

Settlement delays

Low-risk merchants settle at T+1 to T+2. High-risk is commonly T+3 to T+7. This stacks with the reserve rather than replacing it: you can be waiting seven days for 93% of gross and 180 days for the remaining 7%. Model your cash flow on both.

Typical fee structure

Discount rates — and why sources disagree

For reference, published low-risk rates sit around 2.9% + 30¢ (Stripe, Shopify Payments) and 3.3% + 30¢ (Square online). Generic high-risk guides quote 3%–6.5%. But published nutraceutical rate cards from specialist providers quote lower — one advertises 1.95%–4.95%, another 2.5%–4.5%. Meanwhile the most editorially independent source we found puts the high-risk premium at only about 0.35% + 15¢.

We are not going to pick a number and pretend the disagreement does not exist. Budget for 3%–6% plus $0.15–$0.50, know that entry rates near 2.5% exist for clean established files, and treat any quote outside that band as a negotiating position.

4. Chargeback thresholds: the rules that actually govern you

These are verifiable from the card networks themselves, unlike pricing.

Visa VAMP

Visa’s Acquirer Monitoring Program consolidated the old dispute and fraud programs in 2025. The ratio is (fraud reports + disputes) ÷ settled transactions, counted by transaction count, card-not-present only. As of 1 April 2026 the merchant “excessive” threshold tightened to 1.50%, and it only applies above 1,500 combined events per month.

Two consequences most guides miss. First, because VAMP counts fraud reports and disputes together, a merchant at 0.8% disputes plus 0.8% fraud reports breaches VAMP while still telling itself it is “under 1% chargebacks.” Second, because VAMP only bites above 1,500 monthly events, most merchants are governed in practice by their acquirer’s own portfolio ratio — 0.50% to 0.70% — which is far tighter than anything Visa applies to you directly. Your acquirer will cut you long before Visa notices.

Mastercard ECM and HECM

Excessive Chargeback Merchant status requires both 100–299 chargebacks in a month and a 1.50%–2.99% ratio. High-Excessive is 300+ and 3.00%+. The ratio uses a month-offset denominator — this month’s chargebacks divided by last month’s sales — which quietly punishes merchants whose volume is growing or seasonal.

Fines escalate brutally on a schedule: nothing in month one, $1,000 in month two, rising through $25,000–$50,000 by months 7–11 and $100,000–$200,000 from month 19. You exit by staying below threshold for three consecutive months.

The 3-D Secure safe harbour

Mastercard’s Excessive Fraud Merchant program requires four conditions simultaneously, one of which is 3DS penetration below 10% of card-not-present volume. Run 3DS on more than 10% of CNP volume and you cannot be enrolled at all. This is the single most actionable and least-discussed item in this guide.

Worth knowing what 3DS does not do. The liability shift applies to fraud-condition disputes only. A cardholder can re-file the same grievance as “merchandise not received” or “cancelled recurring transaction,” where 3DS is irrelevant. And under Visa VAMP, 3DS provides no ratio relief at all — fraud reports are filed independently of whether the dispute succeeds.

5. What underwriters require from your website

A correction first, because nearly every article in this category repeats it: the widely circulated “Visa 11-item website requirements list” is not in the Visa Core Rules. What the rules actually mandate is short — customer service contact, the merchant’s country displayed at checkout (and explicitly not via a link to another page), a correspondence address, and a multiple-shipment delivery policy.

The long list becomes binding through your acquirer’s program guide, which is contractual. Expect to need: a complete description of goods; delivery, privacy, cancellation and return policies; transaction currency; customer service email and phone; full address including country; security disclosure; and any applicable export or legal restrictions.

Refund policy — a mechanical requirement, not a formality

Visa requires refund policy disclosure during the checkout sequence, with a click-to-accept, checkbox or equivalent acknowledgement. The most-violated part: the disclosure must not be solely a link to a separate page. A checkbox containing only a link may be rejected as evidence.

This is not box-ticking. When you fight a dispute over a limited return policy, the remedy is to show that policy was properly disclosed and agreed at the time of sale. How you design the disclosure determines whether you can win the representment. Visa also prohibits requiring cardholders to waive their right to dispute.

Supplement labeling

If any product is positioned as a dietary supplement, 21 CFR 101.93 requires the DSHEA disclaimer in boldface at minimum 1/16 inch, adjacent to the claim or symbol-linked, with FDA notification within 30 days of first marketing. Note that FTC guidance is explicit that the disclaimer “won’t cure an otherwise deceptive ad.”

Age gating

Another correction: no card network requires age or professional gating for research chemicals or supplements. Visa mandates age statements only for online gambling. Articles claiming a network requirement are wrong.

There is a real obligation, though it is state law. New York General Business Law § 391-oo bans sale of weight-loss and muscle-building supplements to under-18s and requires online sellers to use adult-signature shipping with government photo ID, at up to $500 per violation. The Second Circuit declined to enjoin it in November 2025, so it is in force.

Documentation to have ready

Three to six months of processing statements, one to two years of financials, refund and chargeback reports, supplier invoices matching bank statements (this is the anti-transaction-laundering check), and — often overlooked — your paid advertising and affiliate agreements, which is where claims review actually happens.

Why the acquirer pool is so small

It is not merchant preference. Visa’s High-Integrity Risk provisions require acquirers to be separately registered and approved by Visa, with financial review and capital tests, before submitting transactions for high-integrity-risk merchants. The gate is on the acquirer, not on you. That structural constraint is why your options feel narrow and why pricing stays high.

6. What gets accounts terminated after approval

Approval is not the finish line. The documented termination triggers, straight from Visa’s rules, include excessive unauthorised transactions, disputes arising from your business practices, transaction laundering, and identification under Visa’s monitoring or integrity programs.

MCC miscoding

You must be coded under the category that most accurately describes the business, with multiple codes assigned where a high-integrity-risk line exists. A supplement-coded merchant ID selling injectable-format peptides violates this directly — and misrepresentation at underwriting is punished far harder than poor chargeback performance, because it is an integrity failure rather than a performance one and it exposes the acquirer retroactively.

MATCH

MATCH — Mastercard Alert To Control High-risk Merchants — is the industry termination database. Key facts: your acquirer lists you, not Mastercard, typically within one business day of termination. The listing lasts five years. It captures principals, not just the entity, so reincorporating under a new name does not clear it — and Visa separately prohibits entering a new merchant agreement under a new name to circumvent its rules.

Of the 13 usable reason codes, the ones that bite in this vertical are 03 (laundering), 10 (violation of standards) and 13 (illegal transactions) — none of which are chargeback-related. You can have a pristine chargeback ratio and still be MATCHed on a claims or coding violation.

Removal is close to impossible by design: a processor can only remove an entry added in error, or a PCI-related entry once compliance is confirmed. Entries that legitimately met the criteria cannot be removed even after the underlying issue is fixed. Your merchant agreement almost certainly contains your advance consent to be listed.

The reserve death spiral

Worth understanding as a single mechanism, because it is how most terminations actually play out. Reserve amounts are set at the acquirer’s sole discretion and can be modified with immediate effect and no notice. Failure to fund a reserve demand is independent grounds for immediate termination. So: risk event → reserve demand → inability to fund → default → termination → MATCH listing. Each step is contractually permitted and the whole sequence can run in days.

One underrated trigger: acquirers may freeze funding simply for failing to respond adequately to a request for information. Non-response to a compliance enquiry is itself sufficient.

Frequently asked questions

Can I use Stripe or PayPal for a peptide store?

Neither names research peptides in its prohibited list, but both contain catch-all clauses broad enough to cover them, and both apply those clauses at their discretion. Accounts in this category are commonly closed after review rather than declined at signup. Assume you will need a specialist high-risk acquirer.

Does labeling products “research use only” solve the problem?

No. FDA determines intended use from your total presentation — claims, imagery, adjacent products and distribution context — not from a disclaimer. Multiple 2024–2026 warning letters address exactly this.

What chargeback rate is safe?

Aim well below 0.50%. Your acquirer’s portfolio threshold, not the card networks’ merchant thresholds, is the constraint that will actually cost you the account.

How long do funds stay in a rolling reserve?

Commonly 90–180 days, at 5–10% of volume. It is negotiable and typically steps down after three to six months of clean processing.

What happens if my account is terminated?

Expect a MATCH listing lasting five years, attached to the business and its principals, which makes obtaining a new merchant account substantially harder.

Related reading

The complete 2026 peptide dropshipping guide · Reseller margin math · Fulfillment and compliance checklist · All resources

Research use only. This guide is not legal, financial or medical advice. Payment-network rules, processor policies and FDA enforcement positions change frequently — verify current terms directly before relying on anything here. Sources verified July 2026.