Peptide merchant underwriting comes down to one question: does this business look like what the application says it is? Underwriters answer it by reading your website, your policies, your checkout and your processing history, in roughly that order, and in our experience the website sinks more peptide applications than the paperwork does.
That’s good news, because the website is the part you control completely. Below is the review the way an underwriter at an acquirer or ISO tends to run it, what they’re looking for at each step, and a checklist you can work through before you submit anything.
One assumption throughout: you’re applying with a processor that knowingly underwrites research peptides. Some won’t. Corepay, for example, says it does “not support research-use-only (RUO) peptide sellers.” Picking the right provider is covered in our posts on high-risk merchant accounts for peptides and how to compare high-risk payment processors.
How peptide merchant underwriting works in practice
You submit an application with entity documents, owner IDs, bank details and usually recent processing statements. An underwriter checks you against the MATCH list, reviews the documents, then spends real time on your site. Many also use outside monitoring data or published guidance; LegitScript’s October 2025 peptides guide for payment processors was written for exactly this reader.
The outcome isn’t just yes or no. It’s yes, no, or yes with conditions: a reserve, a volume cap, a request to change pages before go-live. The cleaner the file, the better those conditions tend to be.
Visa’s Acceptance Risk Standards also require acquirers to keep key identifiers such as registered merchant names and MCC uniform, and to watch for mismatches. That one rule explains a lot of what follows.
What processors check on your site, step by step
This is the part that takes the underwriter the longest, and it’s where you have the most control.
Step 1: Who you are and how to reach you
The underwriter starts by matching names. The legal entity on your formation documents, the name in your site footer and terms, the name on your bank account and the DBA you’ve applied under should all agree, or be explained.
Then they check you’re reachable. A physical business address (not just a PO box), a phone number that’s answered, and an email on your own domain rather than a free mailbox. A contact page with only a form reads as a business that doesn’t want to be found.
Small detail that matters: if your site says you ship from one country and your entity is registered in another, say so somewhere on the site and in the application.
Step 2: Your policies, read for contradictions
Underwriters read refund, shipping, privacy and terms pages more closely than customers do. They’re looking for three things:
- The policies exist and are specific. A refund window in days, what happens to opened items, how to start a return.
- They match the rest of the site. If the shipping page says 2 to 4 business days and the FAQ says “same day,” expect a question.
- The terms of sale reflect what you sell. For an RUO store, that means terms that describe research sale conditions and buyer acknowledgements, consistent with how the products are presented everywhere else.
Copy-pasted policies from another store, sometimes with the other store’s name still in them, are more common than you’d think. Underwriters notice.
Step 3: Product pages and claims
This is where most peptide applications are won or lost. The underwriter reads your product pages the way a regulator would, because their bank carries the risk if a regulator reads them first.
What they look for:
- Dosing tables, protocols or “how to use” sections
- Reconstitution calculators and “peptide guides” aimed at people
- Bacteriostatic water bundled or cross-sold with peptides
- Before-and-after images, testimonials about effects, or benefit language anywhere
- Bodybuilding or tanning imagery, which LegitScript’s guide lists as a red flag
Dosing guidance, reconstitution calculators, “peptide guides” and bacteriostatic water sold alongside were all cited as evidence in FDA’s August 2026 warning letters to peptide sellers, and those letters were based on website review alone.
What they want to see instead: product name, quantity, purity specification, lot number, storage information, and a certificate of analysis tied to the batch. One peptide-focused payments marketplace says it expects a COA for every product and no dosing or health claims. Specs, not effects. Building product pages that way from the start is a core part of how we approach peptide website design.
Step 4: RUO disclaimers, age gate and buyer qualification
Underwriters expect an RUO statement, but they don’t treat it as protection. LegitScript’s guide actually lists a “Not for Human Consumption” disclaimer as a red flag, because it so often sits on sites that are plainly marketing for human use. The disclaimer only helps if the rest of the site agrees with it.
They also look for friction that shows you care who’s buying:
- An age gate on entry or at checkout
- A buyer acknowledgement at checkout that the products are for research use
- A buyer qualification step for some or all products. LegitScript’s guide notes that “Legitimate sellers will often require a buyer to first contact them.”
None of these is magic. Together they show the RUO position is how you operate, not a line in the footer.
Step 5: Checkout, descriptor and a test order
Many underwriters walk the checkout themselves. They check that the product names in the cart and on the order confirmation match the product pages, that the pricing and currency are clear, and that the payment page shows the same business name as the application.
They’ll also ask about your statement descriptor. Stripe’s descriptor rules are a sensible baseline even if you’re not on Stripe: 5 to 22 Latin characters, reflecting your DBA, and more than a single generic word. Stripe notes that “Using clear and accurate statement descriptors can reduce chargebacks and disputes.” A descriptor that doesn’t resemble your store name is a chargeback generator and an underwriting question.
Step 6: Domain age, ownership and your other sites
Expect the underwriter to check who registered the domain, when, and whether that matches your entity. A domain registered last week to a privacy service, applying for meaningful volume, gets a harder look than an established domain registered to the business.
They’ll also ask about other sites you operate. Mirror sites, “clean” front stores and unexplained sister domains look like transaction laundering, which Visa defines as when “an unknown business uses an approved Merchant’s payment credentials.” If you run several brands, disclose all of them. Separate, disclosed merchant agreements per line of business are normal; hidden ones aren’t.
Processing history, chargebacks and MATCH
If you’ve processed before, the underwriter reads your recent statements for volume, average ticket, refunds and chargebacks. They compare that against card-brand monitoring thresholds. As of 2026, Visa’s VAMP flags a US merchant as excessive at a 1.5% combined fraud and dispute ratio (with at least 1,500 fraud reports and disputes a month), and Mastercard’s Excessive Chargeback Program starts at 100 chargebacks and 1.5% in a month.
Then there’s MATCH, Mastercard’s list of terminated high-risk merchants. Acquirers must add a qualifying terminated merchant within 1 business day, and listings stay active for five years. Reason code 04 (excessive chargebacks) applies above 1% of monthly Mastercard sales transactions and at least $5,000 in the same month. Visa’s VMSS works similarly.
If you’re on MATCH, say so up front and explain why. Underwriters find out anyway, and hiding it ends the conversation.
Pre-application checklist for a peptide store
| Area | What the underwriter checks | Ready when |
|---|---|---|
| Identity | Entity, DBA, bank and site names match | One name, used consistently, or the difference explained |
| Contact | Address, phone, domain email | All three visible on the site and working |
| Policies | Refund, shipping, privacy, terms | Specific, consistent with each other, written for your business |
| Product pages | Claims, dosing, bundles, imagery | Specs only, no human-use content, no effect language |
| COAs | Batch documentation | COA per batch, lot number matches the vial label |
| RUO position | Disclaimer and how the site behaves | Statement present and the whole site agrees with it |
| Buyer friction | Age gate, acknowledgement, qualification | At least the first two in place |
| Checkout | Names, pricing, business identity | Cart and confirmation match product pages and application |
| Descriptor | Recognizable, matches DBA | Customers would recognize it on a statement |
| Domains | Age, ownership, other sites | Registered to the business, every other site disclosed |
| History | Statements, chargebacks, MATCH | Ratios explained, any listing disclosed |
How to pass merchant underwriting with a peptide website, honestly
Run the checklist, fix what fails, then apply. Expect typical high-risk terms if approved: reserves are commonly quoted at 5 to 10% of sales held for 90 to 180 days, and one peptide-focused source quotes 5% to 10% held 120 to 180 days with card rates around 3.5 to 5%. These are typical figures, not rules, and some accounts carry no reserve at all.
What doesn’t pass, or passes briefly and then fails: coding peptides as supplements, hiding SKUs during review, running a clean site for underwriting and a different site for customers, or splitting volume across undisclosed accounts. Those are the patterns behind MATCH code 03 (laundering) and VMSS code 23 (transaction laundering). We don’t set any of that up. We work with research suppliers who want to run a clean, defensible business, and with clinics and telehealth brands that can qualify for certification.
If you’re the second kind, certification may change which processors will talk to you. Either way, if you’d rather have someone check your site against an underwriter’s list before you apply, that’s what our compliance review is for.
FAQ
What do underwriters look for on a peptide website?
Consistent business identity, specific policies, product pages with specifications rather than effects or dosing, a COA per batch, an RUO position the whole site supports, and a checkout and descriptor that match the application. They also check domain ownership and any other sites you run.
Does a research use only disclaimer help with underwriting?
Only if the rest of the site agrees with it. LegitScript’s guide for payment processors lists “Not for Human Consumption” disclaimers as a red flag because they often appear on sites marketing for human use.
How long does a peptide store stay on the MATCH list?
MATCH listings remain active for five years. Removal is possible only if the listing was an error, or for PCI non-compliance once the merchant becomes compliant.
Will I need a reserve on a peptide merchant account?
Often, though not always. Sources quote reserves of roughly 5 to 15% of sales held for 90 to 180 days, depending on the provider and your history. Treat those as typical ranges, not promises.
