Choosing a payment provider for a pharmacy website: the criteria that matter

What is the one-line filter?

The filter functions because it reduces the category's central hazard, being boarded by a provider which never genuinely accepted what the merchant is, to a test any founder may run within the first email. Each of the three qualifiers performs work. Product mix matters because a provider comfortable with P medicines and private prescriptions may not be comfortable with controlled-drug lines or weight-loss subscriptions. Volumes matter because acceptance at £10,000 monthly does not constitute acceptance at £150,000. And in writing matters because the sentence within an account executive's email is the artefact produced when a risk team enquires two years afterwards.

What are the ten criteria?

Three of the ten warrant additional treatment. Criterion 2, relationship type, is the structural one, since aggregators exist to board low-risk commerce instantly and to manage risk by algorithmic policy across a portfolio, and pharmacy is precisely the category those policies exist to identify. An individually underwritten acquiring relationship entails greater friction initially and secures a counterparty which decided, with full knowledge, to bank the merchant.

Criterion 6 is the medicines-specific one, developed in the companion analysis. A treatment plan constitutes a stored-credential subscription, and the difference between a gateway handling merchant-initiated transactions properly and one merely acknowledging the concept is the difference between renewals which run and patients whose treatment is interrupted because an issuer sought authentication from someone asleep.

Criterion 9 is the one seldom asked and universally warranted. A provider's freeze protocol, comprising who reviews, on what timescale, with what communication, and what becomes of scheduled payouts meanwhile, constitutes the disaster-recovery plan for a merchant's cash flow, and a provider which has never been asked will improvise it at the merchant's expense.

How should a pricing quote be read?

High-risk pricing resides within structure, and the structure therefore warrants learning. Quotes fall into two families. Blended pricing presents one headline percentage covering everything, which is simple to compare and opaque as to what is being paid for. Interchange-plus passes the card schemes' wholesale costs through at cost with the provider's margin stated separately, which is harder to read and considerably more honest, since interchange varies by card type whilst the blended model prices every merchant as though paying the worst case.

For a pharmacy the decomposition matters doubly, because the category attracts costs which a generic quote omits, comprising scheme integrity fees, registration renewals and any certification-linked charges. A provider quoting a clean headline figure for a high-risk category has either priced those silently or will invoice them subsequently.

The working method is to disregard headline rates and compute the effective rate across a modelled month. Take realistic transaction count and average order value, apply every line of the quote including percentage, per-transaction charges, gateway fees, monthly and annual charges and authorisation fees on declines, and divide total cost by total volume. Then add the line which quotes never include, being the working-capital cost of the rolling reserve, representing a portion of revenue financed until release. Running the same model across a shortlist converts the comparison from persuasion into arithmetic. Each provider should additionally be asked for a specimen monthly statement for a merchant of comparable profile, since those which supply one are displaying the invoice whilst those which cannot are displaying something else.

What are the platform realities?

Payments and platform constitute one decision presenting as two, and the platform constraints are asymmetric. Shopify, upon which much of UK pharmacy e-commerce operates, restricts pharmaceutical categories from its native payment service, with the consequence that a pharmacy on Shopify plans for a third-party gateway from the outset. That entails an integration requiring proof, a checkout flow which must remain smooth despite operating outside the native rails, and, historically, platform fee consequences for bypassing the in-house processor which belong within the cost model. None of this renders Shopify unworkable for pharmacy, and our Shopify guide weighs the complete position, but it does render the gateway decision prior to the theme, the applications and everything an agency ordinarily wishes to discuss first.

Custom and open-source builds carry no platform gatekeeper, which transfers the entire burden to criterion 8, requiring tokenised hosted fields from the gateway, card data architecturally excluded from the merchant's servers, PMR and logs, and integration tested against the failure modes which matter, comprising declines, 3DS challenges, partial refunds and renewal retries, rather than solely the successful path which a developer demonstrates.

Whichever platform is selected, one rule is absolute and belongs within the build specification in writing. No card number is ever stored, logged or transmitted through systems the merchant operates. It is the one payments decision which rests entirely with the merchant, and it eliminates an entire compliance and breach surface at the cost of no functionality whatever.

How do chargebacks and disputes operate in practice?

Criterion 9 warrants fuller treatment because dispute performance constitutes both a cost line and, within this category, a survival metric. The card schemes operate monitoring programmes with dispute-ratio thresholds, with figures around one per cent commonly cited, beyond which a merchant enters remediation programmes carrying fees and, ultimately, the prospect of termination.

Pharmacy's dispute patterns are predictable, which renders them susceptible to design. Subscriptions renew after a patient intended to cancel, such that cancellation must be as straightforward as signup and confirmed in writing, with renewals preceded by notification. Statement descriptors which do not obviously correspond to the brand generate non-recognition disputes from legitimate customers, such that the descriptor should match the name on the parcel. Household card use, where a partner's treatment is paid on a shared card, produces disputes which no fraud tool anticipates and which order-confirmation and dispatch emails to the account holder quietly defuse. And claims of services not received fail against tracked, signed delivery, which a medicines business should be operating in any event.

When a dispute arises, representment constitutes an evidence exercise, and a pharmacy is unusually rich in evidence, holding the accepted terms with timestamp, the consultation record, the prescriber's decision, dispatch and delivery proof and correspondence. A provider's dispute tooling should permit that pack to be assembled and submitted efficiently, and scheme-linked alert services, which surface disputes early enough to permit refund in preference to contest, justify their fees for subscription businesses.

Two operating rules complete the position. Refund promptly where the customer is correct, since a refund costs the goods whilst a chargeback costs the goods, the fee and the ratio. And review dispute reasons monthly in the manner applied to near misses, since a developing pattern indicates something about a flow, a descriptor or a product page, and the ratio which it feeds is the single figure capable of ending the account.

What questions go in writing?

This site's buying guides conclude vendor conversations identically, with questions in writing and answers in writing, since written answers constitute commitments whilst verbal ones constitute atmosphere. The set for a payment provider runs as follows.

Do you accept GPhC-registered card-not-present pharmacy at this product mix and volume, confirmed in writing? Is this an individually underwritten acquiring relationship or aggregated boarding? What scheme registrations will you hold, and which fees pass through? What is the complete fee schedule, and may we see a specimen statement for a merchant of our profile? What are the reserve percentage, period, release mechanics and review dates? What is standard settlement timing, and what alters it? How precisely are recurring payments handled, covering mandate authentication at setup, MIT flagging and retry logic on failure? Which 3DS version and exemption strategy do you operate, and what conversion data can you share? What is the freeze and review protocol, step by step, with timescales and a named escalation route? And what are the termination terms in both directions, with what consequence for the reserve at exit?

Ten questions within one email, and the character of the reply constitutes a criterion in itself. A provider answering precisely is demonstrating what account management will resemble, and one answering with an invitation to book a call is demonstrating the same thing.

Which contract clauses cause difficulty?

Criterion 10 in applied form comprises six clauses warranting location, careful reading and negotiation before signature.

Personal guarantees are common within high-risk boarding and occasionally unavoidable for young businesses, though scope remains negotiable, and the amount should be capped, the term limited, and release tied to trading history.

Unilateral variation, being the right to alter fees or reserve terms on notice, is standard. What warrants securing is defined notice periods together with an explicit right to exit without penalty where terms change adversely.

Reserve variation deserves attention because a contracted reserve which the provider may increase at discretion is not contracted. Increases should be tied to defined triggers such as dispute ratios or volume breaches rather than to the provider's comfort.

Termination asymmetry arises because providers routinely take immediate termination rights whilst binding merchants to notice. The merchant should know what has been signed, and should further appreciate that following termination the reserve is typically retained through the chargeback tail, frequently measured in months, such that the exit clause and the reserve clause require reading together.

Reporting terms govern when and why a provider may report a termination into the schemes' terminated-merchant systems, a listing which follows the business and its directors into every subsequent application.

Token portability is the sleeper clause for subscription pharmacies. Recurring revenue resides within stored credentials held by the gateway, and whether those tokens may migrate to a successor provider, both technically and contractually, determines whether departure means changing suppliers or reconstructing the subscriber base individually. Migration support warrants enquiry before ten thousand mandates depend upon the answer.

A payments contract is short by comparison with a lease and does greater damage when misread, such that an hour of professional review against this list constitutes among the least expensive insurance a launch purchases.

Which responses end the conversation?

Certain answers do not reduce a score but conclude the process.

Guaranteed approval, because underwriting incapable of failure is underwriting which is not occurring, and its costs arrive subsequently. Any suggestion that the business description be softened toward wellness, supplements or general retail, which constitutes the freeze scenario offered as advice. Offshore acquiring or crypto-first settlement for a UK pharmacy serving UK patients, being the ecosystem the companion analysis describes, whose defining characteristic is serving the declined. Reserves or fees described but not contracted, since an undefined reserve constitutes a blank cheque drawn upon the merchant's cash flow. And no written category acceptance, being the filter failed at any stage.

A softer indicator warrants respect alongside these. A provider unable to name other regulated-healthcare merchants it serves, in category terms if not by name, is inviting the merchant to be the experiment. None of these indicators requires payments expertise to identify, which is the point, in that the market's least suitable propositions are identifiable from their own sales language before any contract is examined.

What sequence works?

Order of operations matters, since founders commonly run this process in reverse and pay for it in weeks.

First, become underwritable, with registration current, superintendent named, website compliant and sufficiently complete to be read, the underwriting file from the companion article assembled, and certification in progress, since the certification and acquiring processes feed one another and commencing them together compresses the timeline.

Second, run the filter across the market and shortlist only written acceptances. Third, send the questions, model effective rates from the answers, and take two providers rather than one into underwriting, since parallel applications cost little and convert the negotiation from hope into choice.

Fourth, review the contract against the criteria, ensuring reserves, exit and freeze protocol are contracted rather than described. Fifth, integrate and test the unsuccessful paths, comprising declines, challenges, renewals and refunds, before launch traffic encounters them.

Once stable, the second live relationship described in the FAQs warrants consideration, since within this category continuity constitutes stock control applied to money rather than paranoia. The sequence typically runs to weeks, which is precisely why it belongs at the commencement of a launch plan alongside the premises application and the fit-out, within the timeline the launch guide sets out, rather than in the final fortnight where payment setup is traditionally discovered.

Key takeaways

FAQs