Do Telehealth Brands Need LegitScript for Stripe and Card Payments?

What this means for you

• Stripe: its FAQ says telemedicine businesses don't need LegitScript. Stripe still lists telemedicine, online pharmacies and card-not-present prescription-only products as restricted, so you need its approval and will be asked for license numbers.
• Mastercard: a network rule for the acquirer. Merchants whose primary business is selling prescription drugs remotely must be registered under MCC 5122 or 5912 after the acquirer verifies legal compliance, for example through a legal opinion or accreditation by a recognized third party.
• Visa: card-absent pharmacies are high-integrity risk merchants that acquirers must register, unless the merchant holds NABP accreditation or, under Visa's program guide, LegitScript Healthcare Merchant Certification.
• LegitScript says Visa and Mastercard recognize its certification for that registration. Neither network's rules that we read require LegitScript by name.
• Whether your account falls under the pharmacy codes is your processor's call. Ask it in writing.

MedScale Health, a paid acquisition agency for telehealth brands and clinics, doesn't set up payment processing, but the question reaches the ads side because the same LegitScript certificate gates Google and Meta. As of October 2026, here is what Stripe, Mastercard, Visa and LegitScript each say on their own pages, read on October 12, 2026, and where one ends and the next begins. This page is marketing guidance, not legal or medical advice. Certification, payment and platform rules change, so check the sources listed at the end before acting on a specific rule.

What Stripe says

Stripe's Prohibited and Restricted Businesses list puts pharmaceuticals, medical devices and telemedicine in its restricted group, naming online pharmacies, card-not-present prescription-only products and pharmaceuticals, prescription delivery services, and telemedicine and telehealth services. Restricted businesses get extra due diligence: Stripe says it will ask for information such as proof of licenses or details of your business model, and that because of card network rules, its financial partners' requirements and its own obligations it might not approve the business. Approval can be changed or revoked.

Stripe's FAQ answers the LegitScript question directly: telemedicine businesses don't need certification from LegitScript, but certain licensing and regulatory items must be provided for verification, typically license numbers and information on your processes. Stripe counts synchronous or asynchronous communication involving diagnosis or treatment as telemedicine. On pharmacies it says less: it must abide by card network policies for pharmaceutical merchants and approves pharmacies only in the US, Canada, the EU, Australia, the UK and Japan. Its definition of an internet pharmacy is broad, covering any business that sells, markets or facilitates the sale of a prescription medicine in response to orders placed online.

What Mastercard's rules say

Mastercard's Security Rules and Procedures, Merchant Edition, dated August 4, 2026, define a non-face-to-face pharmaceutical transaction as a card-not-present purchase of prescription medicines from a merchant whose primary business is selling prescription drugs remotely. Before acquiring those transactions, the acquirer must register the merchant through Mastercard's Specialty Merchant Registration program and code them MCC 5122 for wholesale or MCC 5912 for retail. At registration the acquirer must have verified that the merchant's activity complies with all applicable laws, and Mastercard says that verification may include a written opinion from qualified legal counsel or accreditation by a recognized third party. Compliance must be reconfirmed at least every 12 months.

These obligations sit with the acquirer, which passes them to the merchant. Mastercard charges the acquirer an annual registration fee for each registered merchant and can assess up to USD 10,000 for acquiring from one that wasn't registered. The manual we read does not name LegitScript.