Prohibited, restricted, or not on the list at all: how to read Stripe's restricted businesses page

If you sell something regulated online, Stripe's restricted businesses page is the most consequential document you'll deal with. Almost nobody reads it correctly.

The usual mistake is to treat it as a list of banned things: search for your product, fail to find it, decide you're fine. That reading is wrong in a specific and expensive way.

There are three states

The page itself is split into two lists. Your product can be on either one, or on neither, and that third case is the one that catches people.

Prohibited means no. The category is named and refused. No application changes that, and no volume earns an exception.

Restricted means allowed on conditions. The category is named and permitted if you meet whatever the entry specifies. That might be a legal condition, a country, or a requirement to be approved in advance. Some restricted entries are marked as having limited availability, which in practice means approval is the exception.

Absent means the document says nothing about you. That isn't a quiet kind of permission. Nobody has written down an answer for your category, so a person makes the call later, by looking at your site.

Most of the categories merchants ask us about are absent.

Why absent is the dangerous one

If your product is prohibited, you find out straight away. That's unpleasant, but cheap.

If your product is absent, you find out late. Nothing at signup asks the question, and nothing filters your uploads. Onboarding succeeds, processing runs, and the account behaves completely normally for anywhere from a few weeks to a few months. Then comes a review, and a review means a human reading your product pages.

At that point the reviewer needs a clause, and every policy like this carries catch-alls written for exactly that moment. On Stripe's list, the one used most in health-adjacent categories is:

"Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims"

Look at what that hangs on. What you sell matters less than whether it's safe and whether your own copy makes claims about it. Those are two judgements, both made after the fact. One of them is entirely in your control, and it's usually the one that sinks the account.

PayPal's Acceptable Use Policy is built the same way with wider language, prohibiting transactions involving "narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety". The word "certain" shows up all through that document, and it's there on purpose. It keeps PayPal's discretion open instead of drawing a line.

So when a merchant says "my category isn't on the list", what that really means is "the decision has been put off, and it'll be made on the day my balance is largest."

Three worked examples

Adult content is prohibited, and more broadly than people expect. The entry reads "Pornography and other mature audience content (including literature, imagery, and other media)". The parenthesis catches written erotica and illustration as well as video, which surprises a lot of merchants who assumed the rule was about film.

CBD is restricted, and the condition decides everything. The entry permits "CBD products containing only negligible amounts of THC, per local limits". That's a real written yes, and it's narrower than most people read it. It points at whatever the governing legal limit is, so the permission moves when the law moves. With the federal hemp definition change landing in November 2026, that's already happening.

Peptides are absent. They don't appear on either list. Every peptide merchant we've met read that as a green light, and every one of them was being judged against the pseudo-pharmaceutical clause the whole time.

The part that catches Shopify merchants

If you're on Shopify Payments, this document governs you.

Shopify Payments' terms delegate to whichever processor serves your country, and Shopify's own payment processor list names Stripe and PayPal for the United States. Shopify's help center also keeps a short list of its own: tobacco, firearms, cannabis and CBD, cryptocurrency, credit repair, adult content and products making unverified health claims are all out. Where that list names your category, it decides, because it's stricter than Stripe's.

So a Shopify merchant asking "does Shopify allow this" has two documents to read. If Shopify's short list doesn't name you, this one decides. We went through that delegation across the major platforms in who actually bans what.

Correction, 4 October 2026: an earlier version said Shopify Payments had no list of its own. It does, and we've added it above.

How to read it properly, in four steps

Search both lists, and treat finding nothing as a result. Work out which of the three states you're in and write it down. Absent is an answer, and it's the one that needs the most work.

If you're restricted, read the condition as the rule. "Sold in accordance with applicable law" means something specific. For a vape merchant it brings shipping registration and adult-signature delivery with it, and if you fail those, you lose a permission you were only granted because you met them.

If you're absent, go and find the clause that'll be used on you. It's nearly always about safety or claims. Then read your own product pages as if you were the reviewer, because those pages are what the decision will be made from.

Check the date at the top. Stripe's page states when it was last updated, currently 22 September 2026. If you reached your conclusion from a version two years old, it doesn't tell you anything about the policy that governs you now.

We keep a category-by-category version of this, quoted from the policies with the dates we read them, at can I sell this on Stripe, Shopify or PayPal.

The one line to remember

A prohibited list tells you what's already been decided. It can't tell you what's allowed. Anything it doesn't mention is an open question, and in this industry open questions get answered at the worst possible moment, by someone you'll never speak to, using a clause you haven't read.

---

We last read Stripe's restricted businesses page on 4 October 2026, and it states it was last updated 22 September 2026. We read PayPal's Acceptable Use Policy on the same date, and it still states it was last updated 29 October 2022. All three sources are linked in place. Policies change, so treat this as a starting point for your own reading. It isn't legal advice.

We do this reading for merchants before they apply, and we'll tell you straight when a category has no mainstream route. If you want to know which of the three states you're in, tell us what you sell.