GLP-1 Payment Processing Compliance 2026: Merchant Account Rules

Payment acceptance for GLP-1 programs in 2026 is decided by the processor, acquirer, or payment facilitator through underwriting—not by FDA approval. Review commonly considers website claims, recurring billing, clinical and fulfillment relationships, privacy practices, disputes, and business-model documentation. The FDA’s 2026 compounded-GLP-1 warning letters make accurate marketing especially important.

Glp-1 payment processing compliance 2026 at a glance

What changed recently for GLP-1 payment compliance?

Several dated developments changed the risk picture. FDA determined that the semaglutide injection shortage was resolved on February 21, 2025. FDA described transition periods for certain shortage-dependent activities: through April 22, 2025, for certain section 503A pharmacies or physicians, and through May 22, 2025, for certain section 503B outsourcing facilities, subject to the qualifications in FDA’s notice. FDA had already determined, on December 19, 2024, that the tirzepatide injection shortage was resolved.

Those dates do not create a blanket authorization for compounding. FDA stated that other statutory or regulatory violations, including safety or quality issues, could still prompt action. A clinic should not present shortage status as continuing authorization or rely on old shortage-based language in its website or underwriting materials.

On March 3, 2026, FDA announced warning letters to 30 telehealth companies concerning allegedly false or misleading marketing of compounded GLP-1 products. FDA identified representations that suggested a compounded product was the same as, generic to, or FDA-approved like an approved product. It also addressed branding that obscured the actual compounder or implied that a telehealth company was an FDA-approved or FDA-licensed pharmacy or outsourcing facility. Each of those actions, with what the letters cited, is listed in our FDA GLP-1 enforcement tracker.

On April 30, 2026, FDA proposed excluding semaglutide, tirzepatide, and liraglutide from the 503B bulk-drug list, with comments invited through June 29, 2026. The memo treats that action as a proposal, not a final determination. Do not describe the proposal as automatically prohibiting every form of compounding.

The FTC’s amended 2024 Negative Option Rule has also had changing compliance status. The FTC later deferred its compliance deadline, stated that the amended rule was vacated, and began a new rulemaking process in 2026. Confirm the current Federal Register and FTC position for the actual launch date rather than presenting every 2024 amendment as unquestionably operative.

Why might an aggregator close a GLP-1 merchant account?

An aggregator may treat a GLP-1 business as elevated underwriting risk because the model can combine prescription-adjacent services, recurring charges, health-information collection, advertising claims, testimonials, third-party clinical or fulfillment relationships, and changing compounding conditions. That is operational underwriting rationale, not a universal federal requirement.

No approved source establishes that aggregators must close GLP-1 businesses or that Visa, Mastercard, Stripe, Square, or another provider applies a universal GLP-1 prohibition, reserve percentage, fee, or chargeback threshold. Ask the relevant acquirer or payment facilitator for its current written policy.

A dedicated healthcare merchant account generally examines whether the advertised service, billing descriptor, clinical model, and fulfillment path are consistent and explainable. An underwriter may request:

• legal-entity and beneficial-ownership records;
• clinician licensure and states served;
• telehealth and patient-consent workflows;
• pharmacy, compounder, or fulfillment documentation;
• website, advertising, and testimonial records;
• recurring-billing, refund, and cancellation terms;
• complaint, refund, and dispute history;
• privacy and security controls;
• customer-support procedures; and
• continuity and reserve information.

For the website portion of this review, see how underwriters evaluate a telehealth website. MDLaunchr is one platform in this category; MDLaunchr and WhiteLabelClinic.com can help qualified businesses coordinate infrastructure and operational relationships, but they are not processors, clinicians, regulators, or guarantors of approval.

What website claims affect GLP-1 underwriting?

Website claims can affect underwriting because FDA’s March 2026 warning-letter announcement focused on marketing representations as well as the underlying business model. Avoid suggesting that a compounded product is FDA-approved, generic to an approved product, identical to an approved product, or reviewed by FDA for safety and effectiveness.

Review claims that use “same as,” “generic,” “equivalent,” “clinically proven,” or “FDA-approved pharmacy” language. Make the roles of the prescribing clinician, dispensing pharmacy, compounder, and platform clear. Testimonials should not imply guaranteed or uniform outcomes, and sourcing descriptions should not falsely suggest that FDA approves or licenses facilities in the way the claim states.

Under Section 5 of the FTC Act, advertising must not be false or misleading. The FTC’s Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, effective October 21, 2024, addresses fake, false, or deceptive reviews and testimonials and allows civil penalties for knowing violations. Do not buy or create fake reviews, hide material connections, or use testimonials to communicate claims the business cannot substantiate directly.

A practical claims file should include the page URL, exact claim, approval date, supporting evidence, testimonial record, connection disclosure, reviewer, and version history. Recheck it whenever the clinical, pharmacy, compounding, or fulfillment arrangement changes.

What recurring-billing rules apply to weight-management programs?

The Restore Online Shoppers’ Confidence Act requires online sellers of recurring plans to clearly disclose material terms before collecting billing information, obtain express informed consent before charging, and provide a simple way to stop recurring charges. The FTC’s 2024 “click-to-cancel” amendments to its Negative Option Rule are not in force: the U.S. Court of Appeals for the Eighth Circuit vacated them on July 8, 2025, and the FTC’s March 11, 2026 advance notice of proposed rulemaking is a proposal, not a current requirement.

At checkout, state the price, billing frequency, renewal terms, trial or introductory period, cancellation method, and material limitations before obtaining billing information or charging the customer. Retain consent records and test cancellation on desktop and mobile. Do not treat processor approval as proof that the billing flow meets every applicable federal or state requirement.

What privacy controls should a telehealth checkout have?

A telehealth business should map its payment pages, patient forms, portals, pixels, analytics, chat tools, CRM connections, appointment systems, and conversion tracking before applying. HIPAA obligations depend on whether the business is a covered entity, business associate, or another type of health-data provider.

Under the HIPAA Privacy Rule, including 45 C.F.R. §§ 164.501, 164.502, and 164.508(a)(3), marketing generally involves communications encouraging a recipient to purchase or use a product or service. Covered entities generally need authorization before using or disclosing protected health information for marketing, subject to exceptions. A payment authorization does not automatically authorize unrelated marketing or analytics uses.

The HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, generally requires notice after a breach of unsecured protected health information. Individual notice must generally be provided without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more individuals require notice to HHS without unreasonable delay and no later than 60 days.

The FTC Health Breach Notification Rule, 16 C.F.R. Part 318, may also apply to health apps, personal health-record providers, and related entities outside HIPAA. Its 2024 amendments became effective July 29, 2024. “Not covered by HIPAA” does not automatically mean that a business has no health-data breach obligations.

Is LegitScript certification required for a GLP-1 clinic?

No approved federal source establishes that LegitScript certification is legally required or universally expected for GLP-1 merchants. A processor, advertising platform, acquiring bank, or commercial partner may request private certification for a particular model or channel.

Confirm the current requirement directly with the organization imposing it. Do not describe LegitScript certification as FDA approval, federal authorization, pharmacy licensure, or a guarantee of payment acceptance.

What do I do before applying for a GLP-1 merchant account?

Complete the review in this order:

1. 1Founder: Define the legal entity, ownership, states served, merchant of record, clinical model, and payment descriptor.
2. 2Clinical and operations leads: Document the separation between the platform and licensed clinicians who make clinical decisions.
3. 3Founder and partners: Identify pharmacy, fulfillment, technology, analytics, scheduling, CRM, and payment relationships accurately.
4. 4Marketing lead: Inventory website, landing-page, testimonial, influencer, email, and paid-ad claims; remove unsupported FDA, equivalence, sourcing, safety, or outcome representations.
5. 5Billing lead: Display price, frequency, renewal terms, limitations, consent, refund terms, and cancellation before payment; test the cancellation path.
6. 6Privacy lead or counsel: Map health-data and payment-data flows, tracking technologies, vendor agreements, and breach responsibilities.
7. 7Founder: Assemble formation records, ownership information, provider and partner documentation, claims controls, refund history, and dispute history.
8. 8Acquirer or processor: Review the actual model in writing and confirm certification, monitoring, reserve, descriptor, advertising, and channel requirements.
9. 9Platform team: Keep the approved website and checkout versions aligned with the materials submitted for underwriting.

Request a processing review before approaching an acquirer. MDLaunchr, the brand behind WhiteLabelClinic.com, is designed to help qualified businesses evaluate and coordinate the technology, operational, compliance, clinical-network, and fulfillment relationships involved in a telehealth launch. If processing is one part of a broader launch, the white-label GLP-1 program page covers the clinical and fulfillment side.

Questions to ask your processor

1. 1“Do you approve this specific telehealth business model, including its clinical services, recurring billing, and pharmacy or fulfillment relationships?”
2. 2“What current written rules apply to prescription-adjacent telehealth or compounded-product marketing?”
3. 3“Do you require LegitScript or another third-party certification for this model, advertising channel, or jurisdiction?”
4. 4“What website claims, testimonials, disclosures, and partner information must be submitted before review?”
5. 5“What are the current requirements for payment descriptors, refunds, cancellation, customer support, and recurring billing?”
6. 6“Are any reserves, monitoring programs, fees, or transaction limits applicable to this account, and where are they documented?”
7. 7“What changes to the website, clinical model, fulfillment relationship, or advertising require prior written approval?”

This article is educational business information, not legal, medical, regulatory, or payment-processing advice. Federal and state requirements can change. Obtain qualified legal, clinical, privacy, and processor review for the specific model and states served.

Related reading: the full guide this article belongs to.