The Visa Integrity Risk Program (VIRP) is a set of card-brand rules that makes acquirers register, oversee and pay extra for merchants Visa classes as high integrity risk. Here’s the uncomfortable bit for peptide sellers: none of the VIRP material we’ve reviewed names peptides at all, which means your exposure depends almost entirely on how your acquirer classifies you, and on whether your site gives them reason to classify you as a drug seller.
VIRP is also the background to a question you’ve probably already been asked: “Are you LegitScript certified?” The program doesn’t require that. But it shapes the costs and risks that make some processors insist on it.
This post covers what VIRP is, how Mastercard’s version works, why it leads to LegitScript requests, and what actually falls on you as the merchant.
What the Visa Integrity Risk Program is
VIRP took effect on 1 May 2023 and replaced Visa’s Global Brand Protection Program (GBPP). With it, the old label “high-brand-risk merchant” became “high-integrity-risk merchant.” Visa’s VIRP guide is dated 6 April 2023.
The short version: Visa defines certain merchant categories as high integrity risk, then puts duties on the acquirers (and the ISOs and payment facilitators working under them) that board those merchants. Most of VIRP is written to acquirers, not to you. You feel it through what your acquirer asks for, charges and monitors.
LegitScript keeps a readable summary of the Visa Integrity Risk Program if you want a second source alongside your processor’s explanation.
VIRP tiers and the merchant category codes in each
VIRP sorts high-integrity-risk merchants into three tiers by merchant category code (MCC). Published lists from LegitScript and processors may not be complete, but they line up on these:
| Tier | MCCs | Category |
|---|---|---|
| Tier 1 | 5967, 7273, 7995 | Adult and inbound teleservices, dating, gambling |
| Tier 1 | 5122, 5912 | Drugs, drug proprietaries and drug stores (“sales of prescription-required drugs”) |
| Tier 2 | 6051, 6012 | Crypto |
| Tier 2 | 4816, 5816 | Cyberlockers, digital games and skill games |
| Tier 3 | 6211, 5966 | Securities, outbound telemarketing |
| Tier 3 | 5968, 5993 | Subscription and negative option, tobacco and vape |
Where peptides fit in VIRP, and where they don’t
We couldn’t find any VIRP source that names peptides, nutraceuticals or supplements. As far as public material shows, a peptide seller falls under VIRP’s highest tier only if it’s coded as a drug seller under MCC 5122 or 5912. A 2026 payments marketplace article frames it the same way: VIRP “places drug sellers and pharmacies, MCC 5122 and 5912, in its highest tier.”
Two practical consequences.
Your website influences your classification. An acquirer looks at what you sell and how you sell it. A store with dosing guides, human-use language and prescription-style marketing looks like a drug seller, whatever the footer says. A store that presents specifications, batch COAs and a consistent research-use position looks like something else. Neither outcome is guaranteed, and the acquirer makes the call.
You don’t get to pick your MCC to dodge the program. One processor reports a $25,000 assessment per merchant when an acquirer alters merchant details to avoid VIRP registration. If a provider offers to “code you as supplements” to keep you out of VIRP, that’s the conversation to walk away from.
What VIRP makes acquirers do
These are the duties public sources describe:
- Register before processing. “An acquirer must register each High-Integrity Risk account with Visa before allowing the merchant to accept payments.” Registration runs through Visa’s High Integrity Risk Registration (HIRR) system.
- Pass a control assessment. New Tier 1 and Tier 2 acquirers must pass a Visa control assessment by a Visa designee.
- Oversee their agents. Acquirers must register and oversee their ISOs and payment facilitators “at least annually.”
- Do extra due diligence. Visa’s Acceptance Risk Standards (October 2024) say high-integrity-risk merchants “may require additional due diligence,” and a high-integrity-risk payment facilitator “must be registered as a High-Risk Internet PayFac.”
And the fees, per processor sources, at the time of writing (late 2026):
- The registration fee rose from $500 to $950, effective 1 April 2024.
- An Integrity Risk Fee of $0.10 per transaction plus 0.10% applies only to MCCs 5967, 7273 and 7995, according to CCBill. Pharmacy MCCs aren’t listed for it.
- Visa may waive the $950 fee for pharmacies that hold NABP or LegitScript Healthcare certification, according to Helcim.
Mastercard’s equivalent: BRAM and specialty merchant registration
Mastercard splits the same territory into two pieces.
BRAM (Business Risk Assessment and Mitigation) is “designed to protect Mastercard and its customers from illegal and brand-damaging transactions.” Its listed examples include transaction laundering, the “Illegal sale of prescription drugs and/or tobacco products,” and synthetic drug sales. LegitScript’s info sheet says Mastercard fines run “well into the six figures per transaction.”
Specialty merchant registration is Mastercard’s registration requirement for certain categories. The headings in its Security Rules and Procedures, Merchant Edition (11 February 2025) include pharmaceutical and tobacco product merchants and negative option billing merchants selling physical products, alongside gambling, adult content, crypto and others. Card-not-present pharmaceutical sellers register under MCC 5122 or 5912, as with Visa.
Nutraceuticals have their own history here. Mastercard first applied its negative-option (free-trial) registration to the “nutraceutical” industry, requiring MCC 5968 for registered accounts from 12 April 2019. Whether nutraceuticals sold without a free trial need registration isn’t something we could confirm.
A secondary source (PaymentCloud, May 2026) reports a 2026 Mastercard fee overhaul, all billed to acquirers. We haven’t verified it against a Mastercard bulletin, so treat it as reported:
- Specialty merchant registration rising from $500 to $1,000 per merchant per year, from 1 May 2026
- A new $50,000 annual High-Risk Acquirer License Fee
- A $0.02 per-transaction fee and a 10 bps volume fee, from 3 June 2026
| Visa | Mastercard | |
|---|---|---|
| Program | VIRP (since 1 May 2023) | BRAM plus specialty merchant registration |
| Pharma MCCs | 5122, 5912 (Tier 1) | 5122, 5912 (registration category) |
| Registration fee | $950 (since 1 April 2024) | Reported $1,000 from 1 May 2026 |
| Monitoring discount | No mitigation program, per LegitScript | Registered monitoring provider can cut BRAM fines up to 75 to 100%, per LegitScript |
Why VIRP and BRAM are why processors ask for LegitScript
Put yourself in the acquirer’s seat. Every high-integrity-risk merchant means registration fees, extra due diligence, oversight of the ISO that brought the account in, and on the Mastercard side, exposure to fines that can run to six figures per transaction.
LegitScript sits in the middle of that in two ways. On the Mastercard side, its info sheet says using a registered Merchant Monitoring Service Provider such as LegitScript can cut BRAM fines by up to 75 to 100%, while Visa has no equivalent mitigation program. On the Visa side, LegitScript Healthcare certification can get the $950 registration fee waived for pharmacies.
So some processors simply make certification a condition. Corepay says: “As of April 1, 2024, we are unable to assist peptide platforms that are not LegitScript certified,” and ties that to VIRP. That’s Corepay’s own policy, not Visa rule text. Other providers underwrite peptide merchants without it.
If you’re wondering whether certification is even open to your business, start with what LegitScript is and who it certifies, then what certification costs and how long it takes. Short version: it’s built for pharmacies, telehealth and clinics, and no public source says research-use-only sellers can get it.
What a merchant actually has to do
Most VIRP and BRAM duties sit with your acquirer. Yours are simpler, but they’re the ones that decide whether the account lasts.
- Ask your acquirer, in writing, which MCC you’re being boarded under and whether you’re being registered under VIRP or Mastercard’s specialty registration.
- Ask which network fees are passed through to you and how they’ll appear on your statement.
- Describe your products exactly as they are on the application. No category games.
- Keep your identifiers consistent. Visa requires acquirers to keep registered merchant names and MCC uniform and to watch for mismatches. Your legal name, DBA, descriptor and site should agree.
- Make your site match what you registered. If you’re boarded as a research supplier, your product pages, emails and social accounts should read like one. If you’re a pharmacy or telehealth brand, look seriously at certification.
- Disclose every site and brand that will process on the account. Undisclosed sites are what transaction laundering looks like from the outside.
- Watch your dispute ratios. VIRP is about who you are; Visa’s separate VAMP program watches how your disputes behave, and it can end an account just as fast.
Card-brand rules overlap with FDA and FTC rules here, so confirm your position with a lawyer who knows both before you settle on how you describe your business.
What we’d do this week
Get the MCC answer from your acquirer in writing. Then read your own site as if you were their risk team deciding which tier you belong in. If the answer is uncomfortable, fix the site before the next review, not after. And if a processor is asking you for LegitScript, run our LegitScript eligibility checker first, because research-use-only suppliers can’t be certified and it’s better to know that before you plan around it.
We work with research suppliers who want to run a clean, defensible business, and with clinics and telehealth brands that can qualify for certification. If you’re in the second group and want help deciding whether certification is worth it for your processing setup, our LegitScript certification support starts there.
FAQ
What did the Visa Integrity Risk Program replace?
VIRP replaced the Global Brand Protection Program (GBPP) on 1 May 2023. The “high-brand-risk merchant” label became “high-integrity-risk merchant,” and the registration and oversight duties now sit with acquirers under VIRP.
Does VIRP require LegitScript certification?
No. Visa’s VIRP materials don’t require LegitScript for peptide sellers. Some processors require it as their own policy, partly because of VIRP and BRAM costs, and Visa may waive the $950 registration fee for pharmacies with LegitScript Healthcare certification.
Are peptides a high-integrity-risk category under VIRP?
We found no VIRP source that names peptides. They appear to fall under VIRP’s Tier 1 only when the merchant is coded as a drug seller under MCC 5122 or 5912, which is the acquirer’s decision based on what and how you sell.
Is VIRP the same as VAMP?
No. VIRP decides which merchants acquirers must register and oversee as high integrity risk. VAMP is Visa’s monitoring program for fraud and dispute ratios, which applies to merchants across categories.
What is Mastercard BRAM?
BRAM is Mastercard’s Business Risk Assessment and Mitigation program, aimed at illegal and brand-damaging transactions such as transaction laundering and illegal prescription drug sales. It can fine acquirers heavily, which is why many acquirers pay for merchant monitoring.
