What is the rule, and where does it originate?
The rule is scheme law rather than statute. Visa has required, since 2017, that merchants making card-not-present sales of pharmaceuticals be certified and monitored on an ongoing basis by an impartial third party, and both Visa and Mastercard require such merchants to be registered as high risk, with the certification recognised within the registration process for the pharmacy merchant category codes, being 5912 for drug stores and pharmacies and 5122 for pharmaceutical wholesale.
The obligations sit formally with the acquiring bank, which must register the merchant, evidence its certification and answer to the schemes for its conduct, which is why, as the high-risk analysis established, acquirers either require certification at onboarding or price its absence as risk they decline to hold. The scheme-side framework presently operates within Visa's Integrity Risk Program, being the successor architecture for high-integrity-risk categories, with the registration and integrity fees which that article priced.
One definitional matter preserves the scope. The regime attaches to card-not-present pharmacy, comprising the website, the application and the mail-order operation, rather than to the counter terminal within a bricks-and-mortar dispensary, which processes as ordinary face-to-face retail. At the moment the same pharmacy opens a checkout online, it enters the category this article addresses.
Which populations require certification?
Four, in practice. Distance-selling and online pharmacies constitute the core case, since card-not-present POM and P-medicine supply is precisely what the rule was drafted to address. Bricks-and-mortar pharmacies adding online sales frequently encounter the regime mid-project, when the acquirer which has banked their counter for years poses unfamiliar questions concerning the website. Telehealth and online clinic models whose services conclude in medicine supply are certified either alongside or together with their pharmacy partner depending upon structure. And wholesale and supply-chain businesses trading card-not-present under 5122.
The genuinely ambiguous case is the OTC-only webshop. The category codes span prescription and over-the-counter trade, acquirer expectations vary with mix, and the honest answer is this cluster's standing one, namely that the acquirer should be asked in writing, subject to the caveat that the advertising gate discussed below applies regardless and that adding POM services subsequently reopens the question at the least convenient moment. Where doubt exists, certification is the safer course, since the process constitutes a subset of the compliance work which a POM-capable pharmacy should have completed in any event.
Why does it constitute a dual gate?
The certification which the card schemes recognise is the same certification which the advertising platforms require. LegitScript's healthcare merchant certification is recognised by Visa and Mastercard within high-risk registration, and by Google, Microsoft Bing, Meta and TikTok among others as the precondition for healthcare advertising, with Google as a general rule not permitting uncertified pharmacies to advertise at all. A single application therefore governs both of an online pharmacy's essential supplies, being the capacity to take payment and the capacity to be found. That concentration warrants respect in both directions, since it renders the certification unusually valuable whilst rendering certification problems unusually expensive, in that a lapse or revocation disables two systems simultaneously. The advertising side carries its own subsidiary rules governing what certified pharmacies may promote, treated separately in our Google Ads guide. The point here is structural, in that this is not a payments requirement with a marketing footnote but the master key.
What do the standards assess?
Reducing the certifier's published standards to their load-bearing themes produces five assessments, none of which should concern a lawful UK operator.
Licensure. The pharmacy is registered where it is located and where it ships, which for a UK-serving business means GPhC premises registration together with remaining within the jurisdictions its licences actually cover.
Legal and regulatory compliance. The operating model observes the medicines law of every territory served, prescription-only meaning prescription-only, and, per the certifier's own published principles, selling prescription drugs without requiring a valid prescription is unlawful in every jurisdiction which matters, a position which questionnaire theatre does not alter.
Prescription validation. The mechanism by which prescriptions are genuine, prescribers are real and registered, and the consultation is substantive, being the territory which the GPhC's remote prescribing standards govern domestically and which is assessed here through documented flows.
Privacy and data handling. Health data treated as health data, with the policies and practices to demonstrate it.
Transparency. The business is identifiable, ownership is genuine, contactability functions, and the website states what the operation actually is, without false identities or softened categories, being the same honesty which the acquiring file requires.
An operator who has built to this site's compliance library will recognise each theme, which supports the reassuring conclusion that certification does not impose a new standard but audits a business against the standard to which it already answers, in a format which banks and platforms can consume.
What are the process, fees and tiers?
As published in the certifier's materials and current industry guides, the mechanics comprise creating an account on the certification portal, selecting the healthcare merchant certification and reviewing the documentation requirements before commencing, paying the application fee of around $975, which is non-refundable and accordingly warrants reading the requirements first, completing the questionnaire covering business model, products and services, prescribing practices, geographic scope, registration and compliance practices, submitting the supporting documentation, and passing expert review into certified status, thereafter maintained through an annual monitoring fee and ongoing compliance monitoring. The published guidance is direct in stating that vague answers constitute the primary cause of delay and denial.
Pricing tiers scale with complexity. Category A covers the simplest models, being single facility with minimal footprint. Category B, where most merchants fall, covers multi-facility operations, wholesalers and distributors. Category C covers the most complex models such as sterile compounding and veterinary pharmacy.
Timelines are not promised and this guide declines to invent one. The workable planning assumption is one to three months, determined almost entirely by the quality of the file, which is the subject of the following sections.
How does UK documentation map onto the process?
| The application requests | The UK artefact which answers it |
|---|---|
| Business registration and ownership | Companies House incorporation, directors and PSC register |
| Pharmacy licensure | GPhC premises registration and the registered pharmacy's entry, together with the superintendent pharmacist's details |
| Prescriber credentials | GMC, GPhC or NMC registrations of the prescribers within the model, with prescribing scope evidenced |
| Prescription practices | The documented consultation and prescribing flow, built to the remote prescribing standards, with sample intake and consultation documentation |
| Products and services | The product list with UK legal classifications stated across GSL, P and POM, with controlled-drug lines flagged |
| Geographic scope | The territories actually served, corresponding to the licences and the shipping rules |
| Privacy and compliance practices | Privacy notice, data protection documentation and the operational procedures supporting them |
| Transparent web presence | The website itself, with ownership visible, registration displayed, terms and policies genuine, and claims within the licence |
The process rests upon American foundations, with references to state licensure and DEA registrations where applicable, and UK applicants occasionally stall at questions which do not correspond precisely. The working rule is to answer with the UK equivalent, named as such. GPhC premises registration constitutes the pharmacy licence, the superintendent constitutes the accountable pharmacist, and the GPhC and GMC registers constitute credential verification. Where a question genuinely lacks a UK analogue, that should be stated plainly rather than forced into correspondence. Certifiers assess coherence rather than geography, and a file presenting the UK framework confidently reads better than one apologising for it. Everything within the table constitutes documentation which this site's compliance library has already required, such that certification consists largely of assembling it in one place.
How should the questionnaire be answered?
Since vague answers constitute the published leading cause of delay and denial, the highest-return hour of the entire application is spent composing four answers properly.
Business model. One paragraph which a reviewer may follow without UK context, establishing who owns the business, what it sells, to whom, through which site, with the journeys of both the money and the medicine traceable.
Prescribing practices. A description of the actual clinical flow rather than of the operator's regard for regulation. The distinction merits a worked example. Vague, and likely to attract a query, would be "We comply fully with all applicable regulations and ensure prescriptions are appropriately validated by qualified professionals." Specific, and likely to proceed, would be "Independent prescribers registered with the GMC conduct structured online consultations. For high-risk categories including weight-loss medicines, identity and stated measurements are independently verified in line with the GPhC's strengthened 2025 remote prescribing guidance before any prescription is issued. Prescriptions transmit electronically to our GPhC-registered premises, where a pharmacist performs the clinical check, and supply is dispatched by tracked courier with records held on our PMR." The same operation is described in both, whilst only one displays the mechanism to a reviewer.
Products and services. The complete list with classifications, including the lines an operator is least comfortable naming, since the review will examine the website in any event and the divergence between the answer and the storefront constitutes the finding.
Geographic scope. The territories served and, equally valuably, those refused, together with the shipping rules which enforce the refusal, since scope discipline reads as competence.
What are the common failure modes?
Applications stall and fail in patterns, each of which is avoidable in advance.
The website contradicts the answers. The questionnaire describes a prescriber-led model whilst the site's checkout observably sells first and consults afterwards, or the declared product list omits what the shop is visibly selling. Reviewers browse, and coherence between file and storefront constitutes the real test.
Unfinished surfaces. Placeholder terms, a privacy notice drawn from a template bearing another company's name, or absent ownership details, each of which fails the transparency standard on the first page.
Credential gaps. Prescribers named without registrations evidenced, or prescribing scope which does not cover what the service prescribes.
Jurisdiction overreach. A checkout shipping anywhere whilst the licences cover Britain, which is the most rapid available means of converting an application into an examination of the model.
Category surprises. The controlled-drug-adjacent or grey-area line discovered rather than declared, which damages confidence across the entire file.
Where an application is refused or stalls pending remediation, the sequence is unremarkable. Correct the substance rather than the wording, document the correction, and reapply addressing the correspondence point by point, keeping the acquirer informed throughout, since an acquiring application progressing on the strength of certification in progress requires notice of difficulty from the merchant rather than from the certifier. A refusal handled transparently constitutes a delay, whilst one concealed from an acquirer constitutes the freeze scenario with additional steps.
What does monitoring examine?
Certification constitutes a state rather than an event, in that the annual fee purchases ongoing monitoring, and monitoring examines drift between what was certified and what is operating.
The recurring triggers, according to the published guidance and the patterns acquirers report, comprise product lines added without approval, whether the weight-loss service introduced during a busy quarter or the controlled-drug-adjacent line which appeared merely adjacent, marketing claims exceeding the licence through before-and-after promises or indication creep, being the advertising failures which the MHRA polices from its own direction, website changes which break assessed transparency where the prescribing-model page is quietly simplified or ownership details are lost within a redesign, and jurisdiction creep where orders ship to territories the application never claimed.
The maintenance discipline is the one taught throughout the payments cluster, namely declaring before launch rather than after discovery. Product, territory and model changes should be routed through certification and acquirer approval as a launch gate, the website's compliance surfaces should be held under change control as the procedures they effectively constitute, and the renewal should be diarised alongside the other dates within the compliance calendar, since a lapsed certification closes the dual gate from the inside.
How should it be sequenced with acquiring?
The certification and acquiring processes feed one another and should accordingly run in parallel rather than in series.
At week zero, assemble the single file which both consume, per the application-file section of the named comparison, and commence the certification application. Simultaneously, run the one-line filter across the provider shortlist and begin underwriting with written category acceptance, since most pharmacy-knowing providers will progress an application with certification evidenced as in progress, which is precisely what a parallel start provides.
As certification is granted, complete acquiring, submit advertising applications behind it, and surface the certification mark wherever patients and partners verify the business, alongside the registration details, since within the market which the enforcement article described, a checkable third-party certification constitutes trust which impostors cannot purchase.
Total elapsed time run in this manner equals the length of the longer process rather than the sum of both, which on the planning assumptions above produces a payments-and-advertising-ready pharmacy within the same one-to-three-month window which certification alone would have required. Run in series, founders routinely double it, which is the reason this paragraph exists.
Key takeaways
- Since 2017 Visa has required card-not-present pharmacies to be certified and continuously monitored by an impartial third party, within a high-risk registration regime which both major schemes enforce through the acquirer.
- The recognised certification constitutes a dual gate, in that the same certificate which the card schemes accept is what Google, Meta and the other platforms require before healthcare advertising runs.
- The standards assess licensure, legal compliance, prescription validation, privacy and transparency, being the framework a lawful UK operator already satisfies, with certification converting it into a consumable format.
- The published process comprises portal application, a fee of roughly $975, a questionnaire in which vagueness constitutes the leading cause of denial, documentation, review and thereafter annual monitoring, with tiers A to C scaling by complexity and a planning assumption of one to three months.
- UK documentation maps cleanly, with GPhC premises registration as licensure, the superintendent as accountability, the GMC and GPhC registers as credentials, and the documented prescribing flow as validation. American questions should be answered with the UK equivalent, named confidently.
- Monitoring examines drift through undeclared products, claims beyond the licence, transparency lost within redesigns and jurisdiction creep. Declare before launch, and diarise the renewal.
- Sequence certification and acquiring in parallel from one shared file, such that elapsed time equals the longer process rather than the sum.
FAQs
The file, ready when they ask.
The certification file is the compliance library this site keeps telling you to build: registration, prescribing flows, policies, a website that tells the truth. Our publisher assembles certification-ready documentation packs and builds the compliant sites certifiers and acquirers read, with Dataforge PMR evidencing the prescription-validation flows underneath. If certification is between you and launch, see how it works.
See Dataforge PMR