How do you choose a payment provider for a pharmacy website?

What is the one-line filter?

The filter works because it turns the category's central hazard — being boarded by a provider that never genuinely accepted what you are — into a test you can run in the first email. Each of the three qualifiers does work. Product mix matters because a provider comfortable with P medicines and private prescriptions may not be comfortable with controlled-drug lines or weight-loss subscriptions. Volumes matter because acceptance at £10,000 monthly is not acceptance at £150,000. And in writing matters because the sentence in an account executive's email is the artefact you produce when a risk team asks questions two years later.

What are the ten criteria?

Three of the ten deserve a closer look. Criterion 2, relationship type, is the structural one. Aggregators exist to board low-risk commerce instantly and manage risk by algorithmic policy across a portfolio — and pharmacy is precisely the category those policies exist to identify. An individually underwritten acquiring relationship means more friction at the start. It also gives you a counterparty that decided, with full knowledge, to bank you.

Criterion 6 is the medicines-specific one, developed in the companion analysis. A treatment plan is a stored-credential subscription. A gateway that handles merchant-initiated transactions properly gives you renewals that run. One that merely acknowledges the concept gives you patients whose treatment is interrupted because an issuer sought authentication from someone asleep.

Criterion 9 is the one seldom asked and always worth asking. A provider's freeze protocol — who reviews, on what timescale, with what communication, and what happens to scheduled payouts meanwhile — is the disaster-recovery plan for your cash flow. A provider that has never been asked will improvise it at your expense.

How should a pricing quote be read?

High-risk pricing lives in the structure of a quote, so the structure is worth learning. Quotes fall into two families. Blended pricing presents one headline percentage covering everything — simple to compare, opaque about what you are paying for. Interchange-plus passes the card schemes' wholesale costs through at cost, with the provider's margin stated separately. It is harder to read and considerably more honest: interchange varies by card type, while the blended model prices every merchant as though paying the worst case.

For a pharmacy the breakdown matters doubly, because the category attracts costs a generic quote omits: scheme integrity fees, registration renewals and any certification-linked charges. A provider quoting a clean headline figure for a high-risk category has either priced those silently or will invoice them later.

The working method: ignore headline rates and compute the effective rate across a modelled month. Take a realistic transaction count and average order value. Apply every line of the quote — percentage, per-transaction charges, gateway fees, monthly and annual charges, authorisation fees on declines. Divide total cost by total volume. Then add the line quotes never include: the working-capital cost of the rolling reserve, a portion of revenue you finance until release. Run the same model across your shortlist and the comparison turns from persuasion into arithmetic. Ask each provider for a specimen monthly statement for a merchant of comparable profile. Those that supply one are showing you the invoice; those that cannot are showing you something else.

What are the platform realities?

Payments and platform are one decision presenting as two, and the platform constraints are asymmetric. Shopify, which carries much of UK pharmacy e-commerce, restricts pharmaceutical categories from its native payment service. A pharmacy on Shopify therefore plans for a third-party gateway from the outset. That means an integration that needs proving, a checkout that must stay smooth outside the native rails and, historically, platform fee consequences for bypassing the in-house processor — all of which belong in the cost model. None of this makes Shopify unworkable for pharmacy, and our Shopify guide weighs the complete position. But it does put the gateway decision before the theme, the apps and everything an agency usually wants to discuss first.

Custom and open-source builds have no platform gatekeeper, which shifts the entire burden to criterion 8. You need tokenised hosted fields from the gateway, card data architecturally excluded from your servers, PMR and logs, and integration tested against the failure modes that matter — declines, 3DS challenges, partial refunds and renewal retries — not just the successful path a developer demonstrates.

Whichever platform you choose, one rule is absolute and belongs in the build specification in writing. No card number is ever stored, logged or transmitted through systems you operate. It is the one payments decision that rests entirely with you, and it removes an entire compliance and breach surface at the cost of no functionality whatever.

How do chargebacks and disputes operate in practice?

Criterion 9 deserves fuller treatment because dispute performance is both a cost line and, in this category, a survival metric. The card schemes run monitoring programmes with dispute-ratio thresholds; figures around one per cent are commonly cited. Beyond them, a merchant enters remediation programmes that carry fees and, ultimately, the prospect of termination.

Pharmacy's dispute patterns are predictable, which means you can design against them. Subscriptions renew after a patient meant to cancel — so cancellation must be as easy as signup, confirmed in writing, with a notification before each renewal. Statement descriptors that do not obviously match the brand generate non-recognition disputes from legitimate customers — so the descriptor should match the name on the parcel. Household card use, where a partner's treatment is paid on a shared card, produces disputes no fraud tool anticipates; order-confirmation and dispatch emails to the account holder quietly defuse them. And claims of services not received fail against tracked, signed delivery, which a medicines business should run in any event.

When a dispute arises, representment is an evidence exercise, and a pharmacy is unusually rich in evidence: the accepted terms with timestamp, the consultation record, the prescriber's decision, dispatch and delivery proof, and correspondence. A provider's dispute tooling should let you assemble and submit that pack efficiently. Scheme-linked alert services, which surface disputes early enough to refund rather than contest, justify their fees for subscription businesses.

Two operating rules complete the picture. Refund promptly where the customer is right: a refund costs the goods, while a chargeback costs the goods, the fee and the ratio. And review dispute reasons monthly, the way you review near misses. A developing pattern tells you something about a flow, a descriptor or a product page — and the ratio it feeds is the single figure capable of ending the account.

What questions go in writing?

This site's buying guides end vendor conversations the same way: questions in writing, answers in writing. Written answers are commitments; verbal ones are atmosphere. The set for a payment provider runs as follows.

Do you accept GPhC-registered card-not-present pharmacy at this product mix and volume, confirmed in writing? Is this an individually underwritten acquiring relationship or aggregated boarding? What scheme registrations will you hold, and which fees pass through? What is the complete fee schedule, and may we see a specimen statement for a merchant of our profile? What are the reserve percentage, period, release mechanics and review dates? What is standard settlement timing, and what alters it? How precisely are recurring payments handled, covering mandate authentication at setup, MIT flagging and retry logic on failure? Which 3DS version and exemption strategy do you operate, and what conversion data can you share? What is the freeze and review protocol, step by step, with timescales and a named escalation route? And what are the termination terms in both directions, with what consequence for the reserve at exit?

Ten questions in one email, and the character of the reply is a criterion in itself. A provider that answers precisely is showing you what account management will look like. One that answers with an invitation to book a call is showing you the same thing.

Which contract clauses cause difficulty?

Criterion 10 in applied form: six clauses to find, read carefully and negotiate before signature.

Personal guarantees are common in high-risk boarding and occasionally unavoidable for young businesses. Scope remains negotiable, though: cap the amount, limit the term, and tie release to trading history.

Unilateral variation — the right to alter fees or reserve terms on notice — is standard. What you want secured is a defined notice period, plus an explicit right to exit without penalty where terms change against you.

Reserve variation deserves attention because a contracted reserve the provider can increase at discretion is not contracted. Tie increases to defined triggers, such as dispute ratios or volume breaches, not to the provider's comfort.

Termination asymmetry arises because providers routinely take immediate termination rights while binding merchants to notice. Know what you have signed. And remember that after termination the reserve is typically held through the chargeback tail, often measured in months — so read the exit clause and the reserve clause together.

Reporting terms govern when and why a provider may report a termination into the schemes' terminated-merchant systems. That listing follows the business and its directors into every later application.

Token portability is the sleeper clause for subscription pharmacies. Recurring revenue lives in stored credentials held by the gateway. Whether those tokens can migrate to a successor provider, technically and contractually, decides whether leaving means changing suppliers or rebuilding the subscriber base one customer at a time. Ask about migration support before ten thousand mandates depend on the answer.

A payments contract is short compared with a lease and does greater damage when misread. An hour of professional review against this list is among the cheapest insurance a launch can buy.

Which responses end the conversation?

Some answers do not reduce a score. They end the process.

Guaranteed approval — underwriting that cannot fail is underwriting that is not happening, and its costs arrive later. Any suggestion that the business description be softened toward wellness, supplements or general retail — that is the freeze scenario offered as advice. Offshore acquiring or crypto-first settlement for a UK pharmacy serving UK patients — the ecosystem the companion analysis describes, whose defining characteristic is serving the declined. Reserves or fees described but not contracted — an undefined reserve is a blank cheque drawn on your cash flow. And no written category acceptance — the filter failed, at any stage.

One softer indicator deserves respect alongside these. A provider that cannot name other regulated-healthcare merchants it serves, in category terms if not by name, is inviting you to be the experiment. None of these indicators needs payments expertise to spot. That is the point: the market's least suitable propositions give themselves away in their own sales language before any contract is opened.

What sequence works?

Order of operations matters. Founders commonly run this process in reverse and pay for it in weeks.

First, become underwritable: registration current, superintendent named, website compliant and complete enough to be read, the underwriting file from the companion article assembled, and certification in progress. The certification and acquiring processes feed each other, so starting them together compresses the timeline.

Second, run the filter across the market and shortlist only written acceptances. Third, send the questions, model effective rates from the answers, and take two providers rather than one into underwriting. Parallel applications cost little and turn the negotiation from hope into choice.

Fourth, review the contract against the criteria, making sure reserves, exit and freeze protocol are contracted rather than described. Fifth, integrate and test the unsuccessful paths — declines, challenges, renewals and refunds — before launch traffic finds them.

Once stable, consider the second live relationship described in the FAQs. In this category, continuity is stock control applied to money, not paranoia. The sequence typically runs to weeks. That is exactly why it belongs at the start of a launch plan, alongside the premises application and the fit-out, within the timeline the launch guide sets out — not in the final fortnight where payment setup is traditionally discovered.

Key takeaways

FAQs