GLP-1 Payments and Compliance in 2026: What Clinics Must Know

Payment acceptance for GLP-1 programs in 2026 is decided by the processor, acquirer, or payment facilitator through underwriting—not by FDA approval. Review usually extends beyond checkout to website claims, recurring billing, clinical and pharmacy relationships, privacy practices, refunds, and business-model documentation. The FTC’s Negative Option Rule also matters when enrollment creates recurring charges.

GLP-1 payment processing compliance in 2026 at a glance

What changed recently for GLP-1 payment compliance?

The operating environment changed in several dated steps. On March 3, 2026, the FDA announced warning letters to 30 telehealth companies over allegedly false or misleading marketing of compounded GLP-1 products. The agency identified representations suggesting that compounded products were the same as, generic versions of, or FDA-approved products. It also addressed branding that obscured who compounded the product or implied that a telehealth company was an FDA-approved pharmacy or outsourcing facility.

The FDA’s 2025 compounding update also identified the end of shortage-based enforcement discretion for certain activities: March 19, 2025, for certain 503B tirzepatide activity and May 22, 2025, for certain 503B semaglutide activity. The relevant 503A enforcement-discretion periods had already ended. That does not mean every business model is unlawful; it does mean shortage status should not be presented as a permanent or general authorization.

The FDA separately explains that compounded drugs are not reviewed for safety, effectiveness, or quality before marketing in the way FDA-approved drugs are reviewed. Website copy, sales scripts, billing pages, and partner descriptions should therefore distinguish accurately between FDA-approved and compounded products.

The FTC’s amended Negative Option Rule, 16 C.F.R. Part 425, became effective January 19, 2025, according to the FTC’s announcement. Because the FTC later addressed compliance timing and court-related developments, founders should confirm the currently operative requirements before launch. The memo’s federal sources were reviewed as of September 19, 2026.

Why might an aggregator close a GLP-1 merchant account?

An aggregator may view a GLP-1 telehealth business as elevated risk because one website can combine healthcare claims, prescription-adjacent services, recurring charges, testimonials, advertising technology, and third-party clinical or fulfillment relationships. FDA enforcement attention can increase the perceived risk of complaints, refunds, disputes, and reputational exposure.

No approved federal source establishes that aggregators must close GLP-1 merchants, or that Visa, Mastercard, Stripe, Square, or another provider applies a universal GLP-1 prohibition, reserve, fee, or chargeback threshold. Those details are not established here. Ask the relevant acquirer or payment facilitator for its current written underwriting policy rather than relying on industry rumors.

A dedicated healthcare merchant account generally underwrites the whole model. The review may cover:

• legal entity, ownership, and business history;
• states served and clinical-provider structure;
• whether the business sells services, memberships, medication-related services, or bundled programs;
• pharmacy and fulfillment relationships;
• website, advertising, testimonials, and outcome claims;
• recurring-billing disclosures, refunds, and cancellation;
• payment descriptor and customer-service contacts;
• data flows, tracking tools, vendors, and business-associate arrangements; and
• prior complaints, disputes, and refunds.

For more context on the website portion of this review, see how underwriters evaluate a telehealth website. The brand or platform coordinating the technology is not the treating clinician, pharmacy, or payment decision-maker.

What website claims affect GLP-1 underwriting?

Website claims can affect underwriting because the FDA’s March 2026 warning-letter announcement focused on marketing representations, not merely the act of accepting a card payment. Avoid language that inaccurately suggests a compounded product is FDA-approved, generic to an approved product, identical to an approved product, or evaluated by FDA for safety and effectiveness.

The FTC’s Health Products Compliance Guidance states that health advertising must be truthful and not misleading, and that objective claims need adequate substantiation before dissemination. Health claims generally require competent and reliable scientific evidence. Under the FTC’s Endorsement Guides, testimonials do not replace evidence for the underlying claim. Endorsers should have actually used the service or product, material connections should be disclosed, and testimonials cannot communicate claims the advertiser could not substantiate directly.

Before applying, create a claims file containing the current page URL, claim text, approval date, supporting evidence, testimonial records, connection disclosures, and the person responsible for review. Keep a version history when copy changes. A disclaimer does not automatically cure a headline or testimonial that communicates an unsupported result.

What recurring-billing rules apply to weight-management programs?

Under the FTC’s Negative Option Rule, a business using a negative-option feature must not misrepresent material facts, provide important information before obtaining billing information and charging the consumer, obtain informed affirmative consent, and offer a simple cancellation mechanism. Cancellation should not be more difficult than enrollment.

The checkout should state the price, billing frequency, renewal terms, trial or introductory period, cancellation method, and material limitations before payment. Test the customer path on desktop and mobile, retain evidence of consent, and document how cancellation requests are handled. The telehealth subscription payments and recurring-billing guide can help organize this operational review.

The FTC’s current operative compliance position should be confirmed before launch because the memo identifies later court-related developments. Do not describe a processor’s acceptance decision as proof that the billing flow satisfies every applicable federal or state requirement.

What privacy controls should a telehealth checkout have?

A telehealth business should inventory its pixels, session-recording tools, analytics, chat tools, appointment forms, payment pages, CRM connections, and conversion tracking before sending an application. HHS states that authenticated webpages, patient portals, telehealth platforms, and some mobile apps may involve protected health information.

HIPAA permits uses and disclosures for treatment, payment, and health-care operations under the Privacy Rule, but that payment concept does not authorize unrestricted disclosure of health information to marketing or analytics vendors. HHS also explains that disclosures to tracking-technology vendors may require HIPAA compliance and appropriate assurances, including a business associate agreement where applicable. The FTC Act and FTC Health Breach Notification Rule may apply where HIPAA does not.

Map each data flow, identify the regulated role of each vendor, and document contractual responsibilities. The HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, creates notification obligations after a breach of unsecured protected health information for covered entities and business associates. A processor may request evidence of privacy controls even though the processor does not determine the clinic’s HIPAA status.

Is LegitScript certification required for a GLP-1 clinic?

No approved federal source in this research establishes that LegitScript certification is legally required or universally expected for GLP-1 merchants. Some processors, advertising platforms, or business partners may request third-party certification for particular models or channels. Confirm the current requirement directly with the relevant organization.

LegitScript certification should not be described as FDA approval, federal authorization, pharmacy licensure, or a guarantee of payment acceptance. Include the exact certification status and scope in the underwriting file only if the business has verified it directly.

What do I do before applying for a GLP-1 merchant account?

Complete the review in this order:

1. 1Founder: Define the legal entity, ownership, states served, merchant of record, clinical model, and payment descriptor.
2. 2Clinical and operational leads: Document the separation between the business platform and independently licensed clinicians making clinical decisions.
3. 3Founder and partners: Identify pharmacy, fulfillment, technology, analytics, scheduling, CRM, and payment relationships without overstating any partner’s license or role.
4. 4Marketing lead: Inventory every website, landing-page, testimonial, influencer, email, and paid-ad claim; remove unsupported FDA, equivalence, sourcing, safety, or outcome representations.
5. 5Billing lead: Display price, frequency, renewals, limitations, consent, refund terms, and cancellation before payment; test the cancellation flow.
6. 6Privacy lead or counsel: Map health-data and payment-data flows, tracking technologies, vendor agreements, and breach responsibilities.
7. 7Founder: Assemble formation records, ownership information, provider and partner documentation, claims controls, refund history, and dispute history.
8. 8Acquirer or processor: Review the actual model in writing and confirm any certification, monitoring, reserve, descriptor, advertising, or channel requirements.
9. 9Platform team: Keep approved website and checkout versions aligned with the materials submitted to underwriting.

Request a processing review to evaluate the documentation and payment-model questions before approaching an acquirer. MDLaunchr, the brand behind WhiteLabelClinic.com, is a white-label telehealth infrastructure platform designed to help qualified businesses coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. It is not the processor, treating clinician, regulator, or guarantor of approval.

Questions to ask your processor

Paste these questions into an underwriting email:

1. 1“Do you approve this specific telehealth business model, including its clinical services, recurring billing, and pharmacy or fulfillment relationships?”
2. 2“What current written rules apply to prescription-adjacent telehealth or compounded-product marketing?”
3. 3“Do you require LegitScript or another third-party certification for this model, advertising channel, or jurisdiction?”
4. 4“What website claims, testimonials, disclosures, and partner information must be submitted before review?”
5. 5“What are the current requirements for payment descriptors, refunds, cancellation, customer support, and recurring billing?”
6. 6“Are any reserves, monitoring programs, fees, or transaction limits applicable to this account, and where are they documented?”
7. 7“What changes to the website, clinical model, fulfillment relationship, or advertising require prior written approval?”