LegitScript Certification: Do You Need It to Take Cards for Telehealth?
When LegitScript certification is required to take cards for telehealth or online pharmacy, what drives cost and timeline, and why applications fail.
Photo: Pixabay
On this page 7 sections
- What LegitScript Certification Is and Who Requires It
- How Card Network Rules Shape Online Pharmacy Requirements
- LegitScript Certification for Telehealth vs. Pharmacies: Which Path Applies
- LegitScript Pharmacy Certification Cost and Timeline
- Why the LegitScript Certification Process Stalls or Fails
- Keeping Certification When You Add Products or States
- How Certification Changes Processor Approval and Ad Accounts
Key takeaways
- LegitScript is generally a requirement set by acquiring banks and ad platforms, not by statute. Card network rules hold acquirers responsible for the merchants they board, so banks ask for proof.
- If you dispense or sell prescription drugs online, expect a mainstream processor to want certification before it boards you. Processors decide visit-only telehealth case by case.
- Most delays and rejections come from licensing gaps, partner pharmacies or website claims. You can fix all three before you apply.
- Certification reflects the business LegitScript reviewed. Before you add a drug, a domain or a state, check LegitScript's current material-change rules and tell your processor.
If your business sells or dispenses prescription drugs online, expect to need LegitScript certification before a mainstream processor will let you take cards. Many ad platforms will also want it before they run your ads. Telehealth companies that offer only virtual visits sit in a grayer zone. Some acquirers require certification, and others ask for it only once prescriptions or medication shipping enter the picture.
Many owners are surprised that LegitScript certification is generally a requirement set by banks and ad platforms, not by statute. That fact decides who asks for it, why they ask, and what happens if your certification lapses.
What LegitScript Certification Is and Who Requires It
LegitScript is a private company that reviews healthcare and pharmacy businesses against legal and regulatory standards. A review typically looks at licenses, prescribing practices, website content, ownership and regulatory history. Businesses that pass are certified, and processors and ad platforms can check that status with LegitScript.
Three groups commonly ask for it:
- Acquiring banks and processors. The bank that boards you is answerable to the card networks for the merchants it accepts, and an independent certification is a common way to document that it checked.
- Ad platforms. Major search and social platforms restrict ads for online pharmacies and many telehealth services. Some accept or require third-party certification such as LegitScript for those categories. The covered categories and accepted certifications change, so read each platform's current healthcare ad policy before you build a campaign.
- Business partners. Some pharmacies, payment facilitators and marketplaces want to see certification before they'll work with you.
How Card Network Rules Shape Online Pharmacy Requirements
This is the most misunderstood part of the category. Many merchants assume Visa and Mastercard require LegitScript by name. In practice, the requirement usually reaches you through your acquirer. Card network rules make acquirers responsible for the merchants they board, and processors treat card-not-present prescription sales as high risk. A bank that processes for an illegal pharmacy takes on network compliance exposure on top of its legal exposure.
So the bank needs evidence that it did its homework, and an independent certification is the kind of evidence that holds up if someone asks questions later. That's why a processor may insist on LegitScript even when you can't find a network rule that names it. It also explains why a processor can still turn you away after you're certified. Certification covers one due diligence step. It doesn't change the bank's overall appetite for risk.
Classification matters too. Pharmacies and prescription sellers are assigned a merchant category code (MCC) that flags them for extra scrutiny. If you're unsure which code fits your model, our explainer on online pharmacy fees, reserves and the pharmacy MCC walks through it. Never ask a processor to code you as something you're not so you can skip this review. Miscoding a pharmacy breaks network rules and can quickly lead to termination and a MATCH listing.
LegitScript Certification for Telehealth vs. Pharmacies: Which Path Applies
LegitScript offers different certifications for different types of business. The question that matters most is whether you prescribe, dispense, or both. A clinic or platform that connects patients with prescribers is reviewed differently from a pharmacy that fills and ships medication. Check LegitScript's site for its current program names and definitions, and confirm which one fits your model before you apply. Choosing the wrong one wastes weeks.
The table shows how the requirement usually plays out by business model. These are common patterns, not guarantees. Your acquirer and each ad platform have the final say.
| Business model | Who usually needs certifying | Card processing | Search and social ads |
|---|---|---|---|
| Visit-only telehealth (no prescriptions or meds sold) | Often no one; sometimes the telehealth business | Case by case | Depends on the service category |
| Telehealth that prescribes, with patients filling at any pharmacy | The prescribing business | Frequently required | Frequently required; check current policy |
| Telehealth bundling the visit with shipped medication through a partner pharmacy | The prescribing business and its partner pharmacy | Usually required | Usually required; check current policy |
| Licensed pharmacy selling or dispensing online | The pharmacy | Usually required | Often required on major platforms; check current policy |
The third row causes the most trouble. If you sell a subscription that includes medication, reviewers will look at the pharmacy that fills it. A clinic with clean licensing can still stall if its partner pharmacy isn't licensed in the states you ship to or isn't certified itself. Brands built around compounded drugs face more questions, and our piece on why processors drop compounded GLP-1 clinics covers that side.
LegitScript Pharmacy Certification Cost and Timeline
Check LegitScript for its current fee structure, which may include an application fee and recurring fees once you're certified. The total can depend on the program you apply for and on the scope of what's reviewed, such as how many websites or entities you operate. Get a written quote from LegitScript before you set your launch budget, and plan for certification as an ongoing cost, not a one-time purchase. We don't publish figures because we can't confirm the current schedule, and it can change.
The timeline depends mostly on how ready you are. A review moves faster when your licenses, pharmacy agreements and website are in order on the day you apply. It slows down every time a reviewer sends questions and waits for answers. A well-prepared applicant can reasonably plan in weeks. An unprepared one can run to months. Slow replies to reviewer questions are the delay you control most directly.
Don't commit to a long ad contract or a launch date that assumes certification. Many acquirers won't finish underwriting until they see certification or proof that an application is pending. Ad platforms that require certification typically won't approve pharmacy ads until it's active.
Why the LegitScript Certification Process Stalls or Fails
Most rejections and long delays follow a handful of patterns. You can fix nearly all of them before you apply.
- Licensing gaps. Prescribers generally need to be licensed where patients are located, and pharmacies generally need licensure or registration in the states they ship to. Requirements vary by state, and some states have telehealth or interstate exceptions. If your site accepts patients from a state you don't cover, expect questions. Geofencing at intake and checkout helps, and our guide to blocking patients in unlicensed states at checkout explains how.
- Thin prescriber-patient relationships. Reviewers look hard at flows where a patient fills out a form and medication ships with no meaningful clinician review. Document how your clinicians evaluate patients and when they decline to prescribe.
- Website claims. Reviewers stop on "no prescription needed," guaranteed results, comparisons that present a compounded drug as identical to a branded one, and unsupported efficacy claims. Clean up affiliate and influencer pages as well, because reviewers and processors read them. Our guide to affiliate and influencer ads that get accounts closed lists the usual problems.
- Product issues. Unapproved drugs, foreign-sourced medication shipped to U.S. patients and controlled substances all bring heavier review. Controlled substances also carry federal telehealth prescribing rules that are separate from LegitScript.
- Ownership and disclosure gaps. Missing business addresses, undisclosed owners, domains registered to unrelated parties and undisclosed regulatory history all slow a review. Disclose your history up front, because reviewers tend to find it anyway.
Keeping Certification When You Add Products or States
Treat your certification as tied to the business LegitScript reviewed. Launching a new medication line, adding a domain, switching partner pharmacies or expanding into new states may require an update or a new review. LegitScript sets those rules and can change them, so check its current guidance on material changes before you launch anything new.
Your processor cares about the same changes. A merchant account is approved for a specific business model, and a new drug category can push you outside what your bank approved even if LegitScript has no objection. Moving from hair loss treatment into weight loss medication is a common example. Tell your processor before you change your product mix. If your certification lapses, expect your acquirer to take it seriously. Frozen funds or account closure are real possibilities, because the bank's obligations to the networks don't pause while you sort it out.
How Certification Changes Processor Approval and Ad Accounts
Certification doesn't guarantee approval, and it doesn't get you low-risk pricing. Telehealth and pharmacy merchants are still underwritten as high risk, and reserves, chargeback scrutiny and volume limits are common in the first months. What certification decides is whether you get past the first gate. Many acquirers won't review a pharmacy application without it. Some accept a pending application for visit-only telehealth, then require full certification before they lift volume caps or approve new products.
Certification can also shorten underwriting, because an independent reviewer has already done part of the legal review. Send one complete package: certification documents, your state license list, pharmacy agreements and a walkthrough of your patient flow. For more on why underwriters treat this category the way they do, see our guide to telehealth merchant accounts and getting approved.
Problems on the ad side surface faster. An ad account flagged for unapproved pharmacy promotion can be suspended, and reinstatement can be slow if you can't show active certification. Treat certification status as a dependency for both payments and marketing.
This is general information, not legal advice. Telehealth prescribing and pharmacy licensing rules vary under state and federal law, so confirm your obligations with a healthcare attorney.
If you're preparing an application now, get your licenses, pharmacy agreements and website copy in order first, then talk to a processor that underwrites this category. MannyPay works with telehealth and online pharmacy merchants through its high-risk merchant accounts. You can request a free quote, and a MannyPay specialist will respond within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
