LegitScript certification: what it is, who actually needs it, and what it does not do

If you sell anything the card networks consider healthcare, there is a good chance you have been told you need LegitScript certification, usually by an acquirer that has just declined you.

It is worth understanding what it actually is before you spend money on it, because merchants routinely buy it expecting the wrong thing, and a smaller number are told they need it when they do not.

What LegitScript actually is

LegitScript is a private certification and monitoring company. It is not a regulator, it has no statutory authority, and it cannot make anything legal.

What it has is recognition. For certain healthcare merchant category codes, the card networks treat LegitScript certification as the accepted way for an acquiring bank to demonstrate it has done its diligence on a merchant. That is the whole of its power, and it is considerable, because it means the question stops being "will this bank take a view on my business" and becomes "does this merchant have the certificate."

That shift is the thing you are buying. Not permission, but a form of proof that an acquirer can put in a file.

LegitScript describes its certification programmes on its own site.

Who actually needs it

The line is drawn by what you sell and how you sell it, not by how you describe yourself.

You are very likely to need it if you operate telehealth with prescribing, if you are a pharmacy or work with one, or if you sell prescription weight-loss products including the GLP-1 class. In these categories a great many acquirers will simply not underwrite an uncertified merchant, and no amount of shopping around changes that.

You may need it for peptides, nutraceuticals and supplement businesses that sit close to a drug claim. Here it varies by acquirer, and it is often the thing that converts a maybe into a yes rather than a hard prerequisite.

You almost certainly do not need it for ordinary supplements with no drug-adjacent positioning, for CBD sold as a consumer product, or for any non-healthcare category. If someone is selling you certification for a vape store or a firearms accessories business, they are selling you something you cannot use.

What it costs, and why nobody will tell you straight

LegitScript does not publish a fee schedule. We looked, because we would rather link you to a number than repeat one.

What can be said accurately is the shape of the pricing rather than the amount. There is a one-off application fee and a recurring annual certification fee. Both are charged per website, so a business running three domains is buying three certifications, and merchants with a main store plus a couple of landing pages are frequently surprised by this. The application fee is not refundable if you fail. Merchants with prior compliance history can be placed on enhanced monitoring at a higher annual rate, and some categories, addiction treatment in particular, are priced above the standard healthcare tier.

Figures circulate in the payments industry, mostly from agencies that resell onboarding help. They cluster in the high hundreds for application and low thousands annually per site. We are not going to state them as fact, because the only authoritative number is the one LegitScript quotes you, and quoting a stale figure from a competitor's marketing page is how merchants end up budgeting wrong.

Ask LegitScript directly, and ask for the per-domain total rather than the headline.

What it does not do

It does not make an unlawful product lawful. Certification is an assessment against LegitScript's standards. A product that cannot lawfully be sold does not become sellable because a certificate exists, and applying with one in your catalogue is a good way to fail and lose the application fee.

It does not guarantee approval. It removes one specific objection. An acquirer can still decline you on your chargeback history, your corporate structure, your volume, your directors or its own appetite. Merchants who treat the certificate as the finish line are the ones most disappointed by the next conversation.

It does not cover categories the networks have not designated. This is the misunderstanding that costs the most money, because it is sold hardest.

It is not permanent. It renews annually and it is monitored in between. A site that changes its claims after certification is a site that can lose it, which matters because the marketing copy that tests well is frequently the copy that breaches the standards.

The sequencing mistake

Most merchants do this in the wrong order.

The common version is: apply to acquirers, collect declines, hear about LegitScript from the fourth one, apply for certification, get certified, go back. That path works, eventually, but every decline in it is recorded, and a merchant with a trail of applications behind them is underwritten more cautiously than one arriving clean.

The better order is to work out whether your category needs certification before you approach anyone, get the site into a state that can pass, apply for certification, then approach acquirers with it in hand. It feels slower because the first move is not an application. It is materially faster in practice, and it is much cheaper than collecting declines.

If you are not sure whether your category is in scope at all, the telehealth and peptides pages set out where the mainstream processors currently stand, quoted from their own policies. And if you want the wider picture of who decides these things, who actually bans what covers the platform side.

The short version

LegitScript is a gate, not a shield. For telehealth, pharmacy and prescription weight loss it is close to mandatory and worth budgeting for properly, per domain, as a recurring cost. For peptides and supplements it is a lever that improves your odds rather than a requirement. For everything else it is a product you do not need, sold by people who benefit from your not knowing that.

Work out which of those three you are in before you spend anything.

---

LegitScript's own description of its certification programmes is linked above. It does not publish fees, and we have deliberately not restated third-party figures as though it did. Processor policies referenced here were read on 3 August 2026. This is not legal advice.

We tell merchants which of the three groups they are in, and we say so even when the answer is that you do not need certification and should stop being sold it. If you want that assessment, tell us what you sell.