LegitScript certification: what it is, who actually needs it, and what it does not do

If you sell anything the card networks consider healthcare, there's a good chance someone has told you that you need LegitScript certification. Usually it's an acquirer that has just declined you.

Understand what it is before you spend money on it. Merchants routinely buy it expecting the wrong thing, and a smaller number get told they need it when they don't.

What LegitScript is

LegitScript is a private certification and monitoring company. It isn't a regulator. It has no statutory authority, and it can't make anything legal.

What it has is recognition. For certain healthcare merchant category codes, the card networks accept LegitScript certification as the way an acquiring bank shows it has done its diligence on a merchant. That's the full extent of its power, and it's a lot of power. The bank no longer has to form its own view of your business. It only has to check whether you hold the certificate.

That's what you're buying: a form of proof an acquirer can put in a file. It isn't permission.

LegitScript describes its certification programmes on its own site.

Who needs it

What you sell and how you sell it decide this. How you describe yourself doesn't.

You very likely need it if you run telehealth with prescribing, if you're a pharmacy or work with one, or if you sell prescription weight-loss products, including the GLP-1 class. In these categories a lot of acquirers won't underwrite an uncertified merchant at all, and shopping around won't change that.

You may need it for peptides, nutraceuticals and supplement businesses that sit close to a drug claim. Here it varies by acquirer. It's often what turns a maybe into a yes, without being a hard prerequisite.

You almost certainly don't need it for ordinary supplements with no drug-adjacent positioning, for CBD sold as a consumer product, or for any non-healthcare category. If someone's selling you certification for a vape store or a firearms accessories business, they're selling you something you can't use.

What it costs, and why nobody will give you a straight answer

LegitScript doesn't publish a fee schedule. We looked, because we'd rather link you to a number than repeat one.

What we can describe accurately is how the pricing works. There's a one-off application fee and a recurring annual certification fee. Both are charged per website. A business running three domains is buying three certifications, and merchants with a main store plus a couple of landing pages are often caught out by this. You don't get the application fee back if you fail. Merchants with prior compliance history can be put on enhanced monitoring at a higher annual rate, and some categories (addiction treatment in particular) are priced above the standard healthcare tier.

Figures do circulate in the payments industry, mostly from agencies that resell onboarding help. They cluster in the high hundreds for the application and the low thousands a year per site. We won't state them as fact. The only authoritative number is the one LegitScript quotes you, and budgeting off a stale figure from a competitor's marketing page is how merchants get it wrong.

Ask LegitScript directly, and ask for the per-domain total instead of the headline fee.

What it doesn't do

It doesn't make an unlawful product lawful. Certification is an assessment against LegitScript's standards. A product that can't lawfully be sold doesn't become sellable because a certificate exists. Applying with one in your catalogue is a good way to fail and lose the application fee.

It doesn't guarantee approval. It removes one specific objection. An acquirer can still decline you over your chargeback history, your corporate structure, your volume, your directors or its own appetite. The merchants who treat the certificate as the finish line are the ones most disappointed by the next conversation.

It doesn't cover categories the networks haven't designated. This misunderstanding costs merchants the most money, because it's the one sold hardest.

It isn't permanent. It renews every year and it's monitored in between. A site that changes its claims after certification can lose it. That matters, because the marketing copy that tests well is often the copy that breaches the standards.

The sequencing mistake

Most merchants do this in the wrong order.

The usual path goes like this. Apply to acquirers, collect declines, hear about LegitScript from the fourth one, apply for certification, get certified, go back. It works eventually. But every decline along the way is recorded, and a merchant with a trail of applications behind them gets underwritten more cautiously than one arriving clean.

A better order: work out whether your category needs certification before you approach anyone, get the site into a state that can pass, apply for certification, and then approach acquirers with it in hand. It feels slower because your first move isn't an application. In practice it's much faster, and a lot cheaper than collecting declines.

If you're not sure your category is in scope at all, the telehealth and peptides pages show where the mainstream processors currently stand, quoted from their own policies. For the wider picture of who decides these things, who actually bans what covers the platform side.

So, do you need it?

LegitScript can get you past a gatekeeper, but it won't protect you after that. For telehealth, pharmacy and prescription weight loss it's close to mandatory, and you should budget for it properly: per domain, every year. For peptides and supplements it improves your odds without being a requirement. For everything else it's a product you don't need, sold by people who do well out of you not knowing that.

Work out which group you're in before you spend anything.

---

LegitScript's own description of its certification programmes is linked above. It doesn't publish fees, and we've deliberately not restated third-party figures as though it did. We read the processor policies referenced here on 3 August 2026. This isn't legal advice.

We tell merchants which of the three groups they're in, including when the answer is that you don't need certification and should stop letting people sell it to you. If you want that assessment, tell us what you sell.