Prohibited, restricted, or not on the list at all: how to read Stripe's restricted businesses page

Stripe's restricted businesses page is the single most consequential document in online commerce for anyone selling something regulated, and almost nobody reads it correctly.

The usual mistake is to read it as a list of banned things, search for your product, fail to find it, and conclude you are fine. That reading is wrong in a specific and expensive way.

There are three states, not two

The page itself is split into two lists. Your product can be in either, or in neither, and the third case is the one that catches people.

Prohibited means no. The category is named and refused. There is no application that changes it and no volume that earns an exception.

Restricted means allowed on conditions. The category is named, and permitted where you meet whatever the entry specifies, which might be a legal condition, a country, or a requirement to be approved in advance. Some restricted entries are marked as having limited availability, which in practice means approval is exceptional rather than routine.

Absent means the document says nothing about you. This is not a third kind of permission. It means nobody has written down an answer for your category, so the answer gets made later, by a person, looking at your site.

Most of the categories merchants actually ask us about are in the third state.

Why absent is the dangerous one

If your product is prohibited, you find out at once, which is unpleasant and cheap.

If your product is absent, you find out late. Nothing at signup asks the question. There is no filter at upload. Onboarding succeeds, processing runs, and the account behaves completely normally for somewhere between a few weeks and a few months. What eventually happens is a review, and the review is a human reading your product pages.

At that point the reviewer needs a clause, and every policy of this kind carries catch-alls written for exactly this purpose. On Stripe's list the one that does most of the work in health-adjacent categories is:

"Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims"

Read what that turns on. Not what you sell, but whether it is safe and whether your own copy makes claims about it. Two judgements, both made after the fact, one of which is entirely within your control and is usually the one that sinks the account.

PayPal's Acceptable Use Policy has the same architecture with wider language, prohibiting transactions involving "narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety". The word "certain" appears throughout that document, and it is doing deliberate work: it preserves discretion rather than describing a boundary.

So the honest translation of "my category is not on the list" is not "I am allowed." It is "the decision has been deferred, and it will be made on the day my balance is largest."

Three worked examples

Adult content is prohibited, and more broadly than people expect. The entry reads "Pornography and other mature audience content (including literature, imagery, and other media)". The parenthesis catches written erotica and illustration, not just video, which surprises a great many merchants who assumed the rule was about film.

CBD is restricted, and the condition is the whole ruling. The entry permits "CBD products containing only negligible amounts of THC, per local limits". That is a real written yes, and it is narrower than it is usually read: it points at whatever the governing legal limit is, which means the permission moves when the law moves. Given the federal hemp definition change landing in November 2026, that is not a hypothetical.

Peptides are absent. They appear nowhere in either list. Every peptide merchant we have met read that as a green light, and every one of them was being judged against the pseudo-pharmaceutical clause the entire time.

The part that catches Shopify merchants

If you are on Shopify Payments, this document governs you.

Shopify Payments publishes no prohibited-business list of its own. Its terms delegate to whichever processor serves your country, and Shopify's own payment processor list names Stripe and PayPal for the United States, linking to their policies rather than to anything Shopify wrote.

So a Shopify merchant asking "does Shopify allow this" is asking a question Shopify does not answer. We went through that delegation across the major platforms in who actually bans what.

How to read it properly, in four steps

Search both lists, then accept that finding nothing is a result. Note which of the three states you are in and write it down. Absent is an answer, and it is the one that needs the most work.

If you are restricted, read the condition as the actual rule. "Sold in accordance with applicable law" is not throat-clearing. For a vape merchant it carries shipping registration and adult-signature delivery, and failing those voids a permission you were granted on the strength of meeting them.

If you are absent, go and find the clause that will be used on you. It is nearly always about safety or claims. Then read your own product pages as though you were the reviewer, because that is the document the decision will actually be made from.

Check the date at the top. Stripe's page states when it was last updated, currently 13 May 2026. A conclusion you reached from a version two years ago is not a conclusion about the policy that governs you now.

We keep a category-by-category version of this, quoted from the policies with the dates we read them, at can I sell this on Stripe, Shopify or PayPal.

The one line worth keeping

A prohibited list tells you what has already been decided. It does not tell you what is allowed. Anything it does not mention is an open question, and open questions in this industry are answered at the worst possible moment, by someone you will never speak to, using a clause you have not read.

---

Stripe's restricted businesses page was read on 3 August 2026 and states it was last updated 13 May 2026. PayPal's Acceptable Use Policy was read on the same date and states it was last updated 29 October 2022. All three sources are linked in place. Policies change, and this is a starting point for your own reading rather than legal advice.

We do this reading for merchants before they apply, and we say so plainly when a category has no mainstream route. If you want to know which of the three states you are actually in, tell us what you sell.