What is the rule, and where does it originate?
The rule is scheme law rather than statute. Since 2017, Visa has required merchants making card-not-present sales of pharmaceuticals to be certified and monitored on an ongoing basis by an impartial third party. Both Visa and Mastercard require such merchants to be registered as high risk. The certification is recognised within the registration process for the pharmacy merchant category codes: 5912 for drug stores and pharmacies, 5122 for pharmaceutical wholesale.
The obligations sit formally with the acquiring bank. It must register the merchant, evidence its certification and answer to the schemes for its conduct. That is why, as the high-risk analysis established, acquirers either require certification at onboarding or price its absence as risk they decline to hold. The scheme-side framework presently operates within Visa's Integrity Risk Program, the successor architecture for high-integrity-risk categories, with the registration and integrity fees that article priced.
One definitional matter sets the scope. The regime attaches to card-not-present pharmacy — the website, the application and the mail-order operation. It does not attach to the counter terminal in a bricks-and-mortar dispensary, which processes as ordinary face-to-face retail. The moment the same pharmacy opens a checkout online, it enters the category this article addresses.
Which populations require certification?
Four, in practice. Distance-selling and online pharmacies are the core case. Card-not-present POM and P-medicine supply is precisely what the rule was drafted to address. Bricks-and-mortar pharmacies adding online sales often meet the regime mid-project, when the acquirer that has banked their counter for years starts asking unfamiliar questions about the website. Telehealth and online clinic models whose services conclude in medicine supply are certified either alongside or together with their pharmacy partner, depending on structure. And wholesale and supply-chain businesses trading card-not-present under 5122.
The genuinely ambiguous case is the OTC-only webshop. The category codes span prescription and over-the-counter trade, and acquirer expectations vary with mix. The honest answer is this cluster's standing one: ask the acquirer in writing. Two caveats. The advertising gate discussed below applies regardless, and adding POM services later reopens the question at the least convenient moment. Where doubt exists, certification is the safer course. The process is a subset of the compliance work a POM-capable pharmacy should have completed in any event.
Why does it constitute a dual gate?
The certification the card schemes recognise is the same certification the advertising platforms require. LegitScript's healthcare merchant certification is recognised by Visa and Mastercard within high-risk registration. It is also recognised by Google, Microsoft Bing, Meta and TikTok, among others, as the precondition for healthcare advertising — and as a general rule Google does not permit uncertified pharmacies to advertise at all. A single application therefore governs both of an online pharmacy's essential supplies: the capacity to take payment and the capacity to be found. That concentration deserves respect in both directions. It makes the certification unusually valuable, and certification problems unusually expensive — a lapse or revocation disables two systems at once. The advertising side carries its own subsidiary rules on what certified pharmacies may promote, treated separately in our Google Ads guide. The point here is structural. This is not a payments requirement with a marketing footnote. It is the master key.
What do the standards assess?
Reduce the certifier's published standards to their load-bearing themes and you get five assessments. None should concern a lawful UK operator.
Licensure. The pharmacy is registered where it is located and where it ships. For a UK-serving business that means GPhC premises registration, and staying within the jurisdictions its licences actually cover.
Legal and regulatory compliance. The operating model observes the medicines law of every territory served — prescription-only meaning prescription-only. Per the certifier's own published principles, selling prescription drugs without requiring a valid prescription is unlawful in every jurisdiction that matters. Questionnaire theatre does not alter that.
Prescription validation. The mechanism by which prescriptions are genuine, prescribers are real and registered, and the consultation is substantive. Domestically, this is the territory the GPhC's remote prescribing standards govern. Here it is assessed through documented flows.
Privacy and data handling. Health data treated as health data, with the policies and practices to demonstrate it.
Transparency. The business is identifiable, ownership is genuine, and contact routes work. The website states what the operation actually is, without false identities or softened categories. It is the same honesty the acquiring file requires.
An operator who has built to this site's compliance library will recognise each theme. The reassuring conclusion follows. Certification does not impose a new standard. It audits a business against the standard it already answers to, in a format banks and platforms can consume.
What are the process, fees and tiers?
The mechanics, as published in the certifier's materials and current industry guides, run as follows. Create an account on the certification portal. Select the healthcare merchant certification and review the documentation requirements before starting. Pay the application fee of around $975 — non-refundable, which is why the requirements deserve reading first. Complete the questionnaire covering business model, products and services, prescribing practices, geographic scope, registration and compliance practices. Submit the supporting documentation. Then pass expert review into certified status, maintained afterwards through an annual monitoring fee and ongoing compliance monitoring. The published guidance is direct: vague answers are the primary cause of delay and denial.
Pricing tiers scale with complexity. Category A covers the simplest models: single facility, minimal footprint. Category B, where most merchants fall, covers multi-facility operations, wholesalers and distributors. Category C covers the most complex models, such as sterile compounding and veterinary pharmacy.
Timelines are not promised, and this guide declines to invent one. The workable planning assumption is one to three months. That is determined almost entirely by the quality of the file, which is the subject of the following sections.
How does UK documentation map onto the process?
| The application requests | The UK artefact which answers it |
|---|---|
| Business registration and ownership | Companies House incorporation, directors and PSC register |
| Pharmacy licensure | GPhC premises registration and the registered pharmacy's entry, together with the superintendent pharmacist's details |
| Prescriber credentials | GMC, GPhC or NMC registrations of the prescribers within the model, with prescribing scope evidenced |
| Prescription practices | The documented consultation and prescribing flow, built to the remote prescribing standards, with sample intake and consultation documentation |
| Products and services | The product list with UK legal classifications stated across GSL, P and POM, with controlled-drug lines flagged |
| Geographic scope | The territories actually served, corresponding to the licences and the shipping rules |
| Privacy and compliance practices | Privacy notice, data protection documentation and the operational procedures supporting them |
| Transparent web presence | The website itself, with ownership visible, registration displayed, terms and policies genuine, and claims within the licence |
The process rests on American foundations, with references to state licensure and DEA registrations where applicable. UK applicants occasionally stall at questions that do not correspond precisely. The working rule is to answer with the UK equivalent, named as such. GPhC premises registration is the pharmacy licence. The superintendent is the accountable pharmacist. The GPhC and GMC registers are credential verification. Where a question genuinely lacks a UK analogue, say so plainly rather than forcing a match. Certifiers assess coherence rather than geography, and a file presenting the UK framework confidently reads better than one apologising for it. Everything in the table is documentation this site's compliance library has already required. Certification consists largely of assembling it in one place.
How should the questionnaire be answered?
Vague answers are the published leading cause of delay and denial. So the highest-return hour of the entire application is spent composing four answers properly.
Business model. One paragraph a reviewer can follow without UK context. It establishes who owns the business, what it sells, to whom, through which site — with the journeys of both the money and the medicine traceable.
Prescribing practices. A description of the actual clinical flow rather than of the operator's regard for regulation. The distinction merits a worked example. Vague, and likely to attract a query, would be "We comply fully with all applicable regulations and ensure prescriptions are appropriately validated by qualified professionals." Specific, and likely to proceed, would be "Independent prescribers registered with the GMC conduct structured online consultations. For high-risk categories including weight-loss medicines, identity and stated measurements are independently verified in line with the GPhC's strengthened 2025 remote prescribing guidance before any prescription is issued. Prescriptions transmit electronically to our GPhC-registered premises, where a pharmacist performs the clinical check, and supply is dispatched by tracked courier with records held on our PMR." The same operation is described in both. Only one shows the mechanism to a reviewer.
Products and services. The complete list with classifications, including the lines an operator is least comfortable naming. The review will examine the website in any event. Any divergence between the answer and the storefront is the finding.
Geographic scope. The territories served and, just as valuably, those refused, together with the shipping rules that enforce the refusal. Scope discipline reads as competence.
What are the common failure modes?
Applications stall and fail in patterns, each of which is avoidable in advance.
The website contradicts the answers. The questionnaire describes a prescriber-led model while the site's checkout observably sells first and consults afterwards. Or the declared product list omits what the shop is visibly selling. Reviewers browse. Coherence between file and storefront is the real test.
Unfinished surfaces. Placeholder terms, a privacy notice drawn from a template still bearing another company's name, or absent ownership details. Each fails the transparency standard on the first page.
Credential gaps. Prescribers named without registrations evidenced, or prescribing scope which does not cover what the service prescribes.
Jurisdiction overreach. A checkout shipping anywhere while the licences cover Britain. It is the fastest way to convert an application into an examination of the model.
Category surprises. The controlled-drug-adjacent or grey-area line discovered rather than declared. That damages confidence across the entire file.
Where an application is refused or stalls pending remediation, the sequence is unremarkable. Correct the substance rather than the wording. Document the correction. Reapply, addressing the correspondence point by point, and keep the acquirer informed throughout. An acquiring application progressing on the strength of certification in progress needs to hear about difficulty from the merchant, not from the certifier. A refusal handled transparently is a delay. One concealed from an acquirer is the freeze scenario with additional steps.
What does monitoring examine?
Certification is a state, not an event. The annual fee buys ongoing monitoring, and monitoring examines drift between what was certified and what is operating.
The recurring triggers, according to the published guidance and the patterns acquirers report, are four. Product lines added without approval — the weight-loss service introduced during a busy quarter, or the controlled-drug-adjacent line that appeared merely adjacent. Marketing claims exceeding the licence, through before-and-after promises or indication creep — the advertising failures the MHRA polices from its own direction. Website changes that break assessed transparency, where the prescribing-model page is quietly simplified or ownership details are lost within a redesign. And jurisdiction creep, where orders ship to territories the application never claimed.
The maintenance discipline is the one taught throughout the payments cluster: declaring before launch rather than after discovery. Route product, territory and model changes through certification and acquirer approval as a launch gate. Hold the website's compliance surfaces under change control, as the procedures they effectively are. And diarise the renewal alongside the other dates in the compliance calendar. A lapsed certification closes the dual gate from the inside.
How should it be sequenced with acquiring?
The certification and acquiring processes feed one another. Run them in parallel, not in series.
At week zero, assemble the single file both processes consume, per the application-file section of the named comparison, and start the certification application. At the same time, run the one-line filter across the provider shortlist and begin underwriting with written category acceptance. Most pharmacy-knowing providers will progress an application with certification evidenced as in progress — which is precisely what a parallel start provides.
As certification is granted, complete acquiring, submit advertising applications behind it, and surface the certification mark wherever patients and partners verify the business, alongside the registration details. In the market the enforcement article described, a checkable third-party certification is trust that impostors cannot purchase.
Run this way, total elapsed time equals the longer process rather than the sum of both. On the planning assumptions above, that produces a payments-and-advertising-ready pharmacy within the same one-to-three-month window certification alone would have required. Run in series, founders routinely double it. That is the reason this paragraph exists.
Key takeaways
- Since 2017 Visa has required card-not-present pharmacies to be certified and continuously monitored by an impartial third party. Both major schemes enforce the high-risk registration regime through the acquirer.
- The recognised certification is a dual gate. The same certificate the card schemes accept is what Google, Meta and the other platforms require before healthcare advertising runs.
- The standards assess licensure, legal compliance, prescription validation, privacy and transparency. A lawful UK operator already satisfies that framework; certification converts it into a consumable format.
- The published process: portal application, a fee of roughly $975, a questionnaire where vagueness is the leading cause of denial, documentation, review, then annual monitoring. Tiers A to C scale by complexity. Plan for one to three months.
- UK documentation maps cleanly: GPhC premises registration as licensure, the superintendent as accountability, the GMC and GPhC registers as credentials, the documented prescribing flow as validation. Answer American questions with the UK equivalent, named confidently.
- Monitoring examines drift through undeclared products, claims beyond the licence, transparency lost within redesigns and jurisdiction creep. Declare before launch, and diarise the renewal.
- Sequence certification and acquiring in parallel from one shared file. Elapsed time then equals the longer process rather than the sum.
Sources and further reading
FAQs
The file, ready when they ask.
The certification file is the compliance library this site keeps telling you to build: registration, prescribing flows, policies, a website that tells the truth. Our publisher assembles certification-ready documentation packs and builds the compliant sites certifiers and acquirers read. Dataforge PMR evidences the prescription-validation flows underneath. If certification is between you and launch, see how it works.
See Dataforge PMR