LegitScript is a private compliance company that does two jobs payment processors care about: it certifies certain healthcare merchants, and it supplies the monitoring and risk data that banks, processors and platforms use to decide who they’ll accept. If you sell research-use-only peptides and a processor just asked whether you’re LegitScript certified, here’s the part most explainers leave out: you almost certainly can’t be, and LegitScript’s own published guidance treats stores like yours as a warning sign.
That isn’t the end of the road. It changes the question from “how do we get certified?” to “what does this processor actually need to see, and can we honestly show it?”
Below is what LegitScript is, who leans on it, the difference between being certified and being monitored, and what we’d do next in your position.
What LegitScript is and where it came from
LegitScript was founded in 2007 by John Horton and is based in Portland, Oregon. Scott Roth is the CEO. It’s still independent. In October 2025 it was the buyer, not the target, when it acquired Kompliant, a platform banks and payment providers use for KYB, KYC and underwriting. Its press release on that deal describes LegitScript as covering “more than 60 high-risk areas.”
In practice it sells to two audiences:
- Merchants, who apply for certification, pay an annual fee and get reviewed against LegitScript’s standards.
- Payment companies, marketplaces and ad platforms, who use LegitScript’s monitoring, data and published guides to decide which merchants to onboard, watch or cut off.
The second audience is the one that shapes your life as a peptide seller, and it’s the one founders rarely see.
Who asks for LegitScript certification, and why
The question almost always comes from a payment provider, not from Visa or Mastercard directly. Some public examples, as of late 2026:
- Corepay, which publicly advertises peptide accounts, says: “As of April 1, 2024, we are unable to assist peptide platforms that are not LegitScript certified.”
- Easy Pay Direct says “you MUST be Legit Script certified to get a merchant account for Peptides.”
- Meta requires online pharmacies and telehealth advertisers to be “actively LegitScript certified,” according to a 2026 industry guide to health ad restrictions.
- Visa may waive its $950 high-integrity-risk registration fee for pharmacies that hold LegitScript Healthcare certification (or NABP certification), according to Helcim. Mastercard has no equivalent waiver.
Notice what isn’t on that list: a published Visa or Mastercard rule saying peptide sellers must hold LegitScript certification. We couldn’t find one, and at least one peptide-focused payments marketplace says outright that “LegitScript certification is not required by the card networks.” The requirement comes from individual processors and the banks behind them. Certification gives them an outside party’s sign-off on a category that costs them money when it goes wrong, so some simply won’t take the risk without it.
That distinction matters when you shop for processing. “We require LegitScript” is one company’s underwriting policy, not a law of nature, and it tells you that company is probably the wrong fit for an RUO store.
Certified, monitored and flagged are three different things
Founders mix these up constantly, and it leads to bad decisions. Here’s how they differ.
| Status | Who starts it | What it means for you |
|---|---|---|
| Certified | You apply and pay | LegitScript reviewed your business against its standards and certified it for one year. |
| Monitored | Your processor, platform or their bank | Your site and listings are checked against LegitScript data or a similar service, usually without you being told. |
| Flagged | The monitoring | Something on your site matched a risk pattern. The report goes to whoever bought the monitoring, and they decide what happens. |
Monitoring is the default, not the exception. Mastercard runs a program called BRAM that fines acquirers for brand-damaging transactions, and LegitScript’s own info sheet says using a registered monitoring provider such as LegitScript can cut those fines by up to 75 to 100%. That’s a strong reason for an acquirer to pay for monitoring on every merchant in a risky category.
So when a founder tells us they “got flagged by LegitScript,” what usually happened is this: their processor’s monitoring picked something up, and the processor acted on it. LegitScript didn’t shut the account. The processor did, based on what it was shown.
The LegitScript certification programs that exist today
LegitScript currently lists four certification programs:
- Healthcare Certification (often called Healthcare Merchant Certification in its PDFs)
- Enterprise Healthcare Certification
- Addiction Treatment Certification
- CBD Certification (for websites and products)
A Supplement Website Certification launched in 2019, but it no longer appears in the current program list or FAQ. We couldn’t confirm whether it was formally retired, so don’t build a plan around it.
Healthcare Certification is aimed at pharmacies, telemedicine providers, med spas, digital health platforms, pharmaceutical manufacturers and wholesalers. Its eligibility text also notes, in effect, that research-only producers may not need it. There’s no “research peptide supplier” program, and nothing suggests one is coming.
Can a research peptide store get LegitScript certified?
Not as far as any public source shows. We looked hard, because a lot of vendors in this space imply otherwise.
LegitScript published a guide for payment processors on peptides in October 2025. It names BPC-157, TB-500, CJC-1295, Ipamorelin, Tesamorelin, Melanotan 2 and GHRPs as unapproved peptides that are “illegal to market or sell for human consumption without FDA approval.” Then it lists the red flags processors should look for:
- a “Not for Human Consumption” disclaimer
- no step that qualifies the buyer
- a catalog made up mostly of commonly misused peptides
- lab-style branding with injectable vials
- bodybuilding or tanning marketing
Read that list and picture a typical RUO peptide store. Most tick three or four boxes without trying. The guide also says “Legitimate sellers will often require a buyer to first contact them,” which tells you the kind of business LegitScript considers credible.
It has only gotten firmer since. In a December 2025 press release, LegitScript said problematic peptide ads were up 308% in 2024 compared with 2023, and named “Research Use Only” language as a tactic used to “blur the line.” In a September 2026 post on the peptide boom, it said BPC-157, TB-500, retatrutide and cagrilintide are “not currently eligible for compounding, sale, or use,” and that certification follows current law, not rules people expect to change. On the 2026 FDA advisory votes, it was blunt: “Only a final rule actually changes the regulatory status.”
So we won’t tell you we can get an RUO store certified, and we’d be wary of anyone who does. Regulation in this area is moving, so confirm your own position with a lawyer who knows FDA and FTC rules before you commit money to an application.
What LegitScript’s view of peptides means for your merchant account
Processors read the same guide you just read about. Corepay, for example, says plainly: “We do not support research-use-only (RUO) peptide sellers.”
That leaves you with two groups of processors. The first requires LegitScript certification, which in practice closes the door to RUO stores. The second underwrites RUO merchants directly, on its own terms. One peptide-focused marketplace says it expects a certificate of analysis for every product and no dosing or health claims anywhere on the site.
Either way, your website gets reviewed, and often against the same red-flag list LegitScript published. The store that gets approved and stays approved is the one that already looks like what it says it is. Most of the work in a peptide payment processing setup is making the website and the application tell the same story.
What to do next, depending on what you are
If you’re a clinic, pharmacy or telehealth brand
Certification is a real option for you, and it can open doors with processors and ad platforms. It’s a paid annual program, fees are charged per root domain, and the review looks at every domain you control, your licensure, your partners and your promotional activity. Two cautions: offering peptides LegitScript currently treats as off-limits will sink an application, and so will routing them through an outside dispenser. Check eligibility honestly before anyone pays a nonrefundable application fee.
If you’re a research-use-only supplier
Stop chasing certification and focus on running a business that holds up when an underwriter, a monitoring service or the FDA reads your site:
- Remove dosing content, reconstitution calculators, “guides” written for human use, before-and-after images and testimonials about effects.
- Publish batch-level COAs and make sure the lot number on the vial matches.
- Consider a buyer qualification step. LegitScript itself treats this as a sign of a legitimate seller.
- Apply only to processors that knowingly underwrite RUO, and describe exactly what you sell.
What we won’t do
We don’t build “LegitScript-proof” sites, hide SKUs from underwriters, code peptide stores as supplements, or run clean front sites for a different real store. Those tactics are transaction laundering by another name, and the downside isn’t a lost account: Mastercard’s MATCH list keeps terminated merchants listed for five years. We work with research suppliers who want to run a clean, defensible business, and with clinics and telehealth brands that can qualify for certification. We don’t help anyone dress up human-use sales as research.
If you’d like someone to tell you honestly which side of that line your business sits on before you spend money on applications, that’s where our LegitScript and compliance review starts.
FAQ
Is LegitScript a government agency?
No. LegitScript is a private company founded in 2007 and based in Portland, Oregon. It has no legal authority over your business. Its influence comes from the processors, banks and platforms that use its certification and monitoring to make their own decisions.
Do Visa and Mastercard require LegitScript certification for peptides?
We couldn’t find any published card-network rule that requires it for peptide sellers. The requirement comes from individual processors and their acquiring banks, such as Corepay and Easy Pay Direct, which say so publicly. Other providers underwrite peptide merchants without it.
How do I know if LegitScript is monitoring my store?
Usually you don’t. Monitoring is bought by your processor, platform or their bank, and you typically find out only when they act on something it found. Assume any peptide store with a card account is being checked and build the site accordingly.
Can a research-use-only peptide store get LegitScript certified?
No public source says it can, and LegitScript’s own October 2025 guidance lists common RUO store features, including “Not for Human Consumption” disclaimers, as red flags. Certification is built for pharmacies, telehealth, clinics and other healthcare merchants that can show licensure.
