To a payment underwriter, a telehealth brand can resemble several risk categories at once: prescription medication sales, recurring memberships, and a new business without an established payment history. Any of those factors may influence whether the brand needs a high-risk merchant account, even when its clinical operations are legitimate and its patients receive the services they purchase.
Stripe describes a high-risk merchant account as an account for businesses considered more likely to experience chargebacks, fraud, or other payment-related issues. These accounts typically carry higher costs and stricter contract terms than standard merchant arrangements. For founders evaluating payment processing for healthcare, understanding those terms is as important as knowing how payments move from a patient to the business.
Why Telehealth Brands End Up With a High-Risk Merchant Account
A high-risk designation reflects how a payment provider evaluates the business it supports. Telehealth itself is not automatically high risk, but several common business characteristics can influence the decision.
- Medication sales. Stripe's high-risk merchant account guidance, updated May 12, 2026, identifies pharmaceuticals and nutraceuticals as industries exposed to substantial regulatory scrutiny. It includes online pharmacies and supplement sellers as examples. A telehealth company offering prescription treatments may therefore face additional questions about its products, prescribing arrangements, and fulfillment model.
- Recurring memberships. Telehealth companies frequently use subscriptions for ongoing services, repeat consultations, or access to treatment programs. Payment providers view businesses with frequent refunds or disputes as higher risk, and recurring memberships can contribute to that assessment. A cash-pay telehealth model built around monthly billing may therefore receive different underwriting treatment from a business that charges only for individual visits.
- Limited operating history. An established merchant can provide records of transactions, refunds, and disputes. A newly launched telehealth company may have none of that information. Without a processing history, the underwriter has less evidence of how customers behave after making payments.
- Regulatory attention. Healthcare businesses operate in an environment where marketing claims and product rules matter. On March 3, 2026, the FDA announced warning letters to 30 telehealth companies concerning false or misleading claims about compounded GLP-1 products.
That announcement does not mean every company offering compounded GLP-1s violated the law. It illustrates the regulatory scrutiny that payment underwriters may consider when evaluating a business category.
For founders, the high-risk label is therefore a starting point for reading the merchant agreement. The following terms explain what the processor is evaluating and how the resulting contract may affect the business.
The Terms, A to Z
Chargeback
A chargeback occurs when a card issuer reverses a payment following a cardholder dispute.
Unlike a refund the merchant initiates, a chargeback proceeds through the card payment system. The merchant may be asked to provide transaction information or other evidence supporting the original charge.
The Consumer Financial Protection Bureau explains that consumers seeking to protect certain credit card billing-error rights generally must send written notice within 60 calendar days after the disputed charge appears on their statement.
That consumer protection timeline is not a universal deadline for every card-network chargeback.
For telehealth companies, disputes may concern consultations, memberships, or prescription-related transactions. Some are genuine billing disagreements, while others may involve so-called friendly fraud, when a customer disputes a legitimate charge.
Why it matters: Chargebacks can reduce collected revenue and influence how payment providers assess a merchant's ongoing risk.
Chargeback Ratio
A chargeback ratio measures disputed transactions relative to transaction activity over a defined period.
Payment providers use dispute metrics to evaluate the merchant's processing history and the likelihood of future financial exposure.
The exact calculation may differ by processor or payment-network program. Founders should confirm which transactions count, which reporting period applies, and how their provider defines the metric. For a concrete benchmark, Mastercard's MATCH criteria treat monthly chargebacks above 1% of Mastercard sales transactions, totaling at least $5,000, as excessive (see MATCH List below).
A telehealth company processing a relatively small number of transactions may see its reported dispute rate move noticeably after only a few chargebacks.
An underwriter may also examine trends over time rather than relying on a single reporting period.
Why it matters: A rising chargeback ratio can affect account reviews, processing conditions, or the merchant's ability to maintain a payment relationship.
LegitScript Certification
LegitScript certification is a credential used to assess certain healthcare-related merchants against applicable standards.
Telehealth businesses, online pharmacies, and other health-related merchants may encounter certification questions when applying for payment services or entering particular advertising relationships.
Relevance depends on the products sold, the business model, and the requirements of the organizations involved.
A payment provider may ask whether the business holds LegitScript certification or whether certification is relevant to its activities.
Founders should verify the specific requirement rather than assume every telehealth merchant must obtain it.
Certification also should not be confused with a payment account approval. Different organizations evaluate different risks and may impose separate conditions.
Bask Health holds its own LegitScript certification and walks brands through the application process in its documentation, but brands still need their own certification to advertise prescription products. In October 2025, Bask also announced a partnership with LegitScript that gives its telehealth and pharmacy partners access to LegitScript's monitoring and certification tools.
Why it matters: Certification can become part of the documentation a healthcare merchant must provide during underwriting.
MATCH List
The MATCH list (Member Alert to Control High-Risk Merchants) is Mastercard's database of businesses whose acquirers terminated them for reasons such as fraud, serious rule violations, or excessive chargebacks. Visa runs a similar database, the Visa Merchant Screening Service (VMSS).
Acquirers must screen applicants against these files before approval, and listings remain active for five years. Only the acquirer that added the listing can request its removal or correction.
Excessive chargebacks are one of the most common reasons for a listing. According to Stripe's summary of the criteria, a merchant qualifies under that reason code when its monthly Mastercard chargebacks exceed 1% of its monthly Mastercard sales transactions and total $5,000 or more in the same month.
Why it matters: A listing can make it difficult to open a new merchant account with most processors, so the chargeback ratio a telehealth brand carries today can shape its payment options for years.
Negative Option (Recurring Billing)
A negative option is a billing arrangement in which charges continue unless the consumer takes action to stop them.
Recurring subscription payments are a common example.
Under the Restore Online Shoppers' Confidence Act, or ROSCA, online sellers using negative option features must satisfy specific consumer protection requirements.
15 U.S.C. §8403 requires sellers to clearly disclose material transaction terms before obtaining billing information, obtain the consumer's express, informed consent before charging, and provide simple mechanisms to stop recurring charges.
The rules around ROSCA have shifted. The Eighth Circuit vacated the FTC's 2024 "click-to-cancel" amendments to its Negative Option Rule in July 2025. On March 11, 2026, the FTC opened a new rulemaking that considers adopting provisions of the vacated rule. Until that process ends, ROSCA remains the main federal statute for online subscriptions.
For telehealth memberships, those requirements are relevant when patients enroll in recurring services or treatment programs.
A patient payment platform may support recurring transactions, but the business remains responsible for ensuring that its subscription terms and billing practices satisfy applicable requirements.
Why it matters: Underwriters may examine subscription terms and cancellation arrangements because recurring charges create ongoing financial and consumer-protection exposure.
PCI DSS
PCI DSS stands for Payment Card Industry Data Security Standard.
It sets security requirements for organizations that store, process, or transmit payment card data.
For a telehealth brand, the relevant concern is how payment information travels through checkout, payment services, and the company's internal systems.
A healthcare business should understand which systems handle card data and what responsibilities belong to the merchant versus its payment service providers.
PCI DSS relates to payment card security. It differs from HIPAA, which governs protections for health information.
Why it matters: Card-data security responsibilities can affect both the technical setup and documentation reviewed during payment onboarding.
Rolling Reserve
A rolling reserve is a portion of transaction revenue that a payment provider temporarily withholds to cover potential chargebacks or other financial liabilities.
Stripe notes that many high-risk merchant accounts require this type of arrangement.
For example, when a customer completes a payment, the merchant may receive the available proceeds while the agreement retains another portion.
The withheld funds are generally released according to the applicable reserve terms, although the agreement may address adjustments or other circumstances affecting release.
For a telehealth brand paying clinicians, pharmacies, and operational vendors, this arrangement can affect cash flow even when customer payments process successfully.
Founders should understand when funds become available and what events could change the reserve arrangement.
Visibility into payouts helps with that planning. Bask Health's payment processing gives providers real-time payout tracking, transaction history, and automated financial reporting in their dashboard, which makes it easier to see what has already been paid out.
Why it matters: A rolling reserve affects how much collected revenue the business can use for current expenses and when the remaining funds become accessible.
Tokenization
Tokenization replaces a sensitive payment card number with a substitute value called a token.
The token can be used within an authorized payment workflow without requiring the merchant's systems to retain the original card number.
For businesses handling repeat purchases or subscriptions, tokenization can support payment experiences while reducing unnecessary exposure of card information.
It is a security measure, not a guarantee that a merchant will qualify for lower-risk processing terms.
Bask Health's built-in payment processing includes tokenization, PCI-compliant servers, and fraud detection and prevention features. The platform also supports patient payments through credit cards, debit cards, HSA/FSA, and other payment methods. These capabilities support secure transactions but do not establish the specific underwriting, reserve, or merchant account terms a particular brand may receive.
Why it matters: Tokenization helps reduce the amount of sensitive payment information exposed within the merchant's operational environment.
Underwriting
Underwriting is the review a payment provider conducts before deciding whether to approve a merchant and under what conditions.
The assessment can consider the business's industry, products, financial position, payment history, and exposure to disputes or regulatory issues.
For high-risk applications, Stripe explains that underwriting may include a risk assessment and credit check.
A telehealth brand may be asked for business documentation, financial statements, information about its services, or evidence supporting the legitimacy of its operations.
The underwriter may also assess recurring billing arrangements and the company's prior processing history.
Approval is not simply a yes-or-no decision. It may come with specific conditions governing reserves, settlement timing, fees, or ongoing account reviews.
A newly formed telehealth business should understand those conditions before building its operating budget around expected payment proceeds.
Why it matters: Underwriting determines whether the merchant can process payments under the proposed arrangement and which contractual obligations it must accept.
FAQs
Does Every Telemedicine Business Need a High Risk Merchant Account?
No. Telehealth businesses are not necessarily assigned the same risk classification.
Payment providers assess individual merchants based on factors such as their products, billing methods, business history, and exposure to fraud, disputes, or regulation.
Prescription medication sales and recurring memberships are common reasons a telehealth business may receive additional scrutiny, but they do not automatically establish the outcome of every underwriting review.
What Does High Risk Payment Mean?
High-risk payment processing refers to arrangements in which a payment provider considers a merchant more exposed to chargebacks, fraud, or regulatory complications.
The provider may respond through stricter account terms, additional underwriting requirements, higher processing costs, or reserve arrangements.
The designation describes the provider's assessment of financial and operational risk. It does not necessarily mean the business is acting unlawfully.
Do Supplement Brands Need a High Risk Merchant Account?
Many supplement brands may be evaluated as high risk because payment providers associate the nutraceutical industry with regulatory and dispute-related exposure.
Stripe identifies pharmaceuticals and nutraceuticals among industries commonly treated as high risk.
However, classification depends on the individual merchant, its products, and the payment provider's underwriting criteria. A supplement business should confirm its eligibility and contract terms rather than assume every provider will classify it the same way.
References
- Stripe. (2026, May 12). High-risk merchant accounts explained. https://stripe.com/resources/more/high-risk-merchant-accounts-explained
- Stripe. (n.d.). Terminated merchant files. https://docs.stripe.com/disputes/match
- U.S. Food and Drug Administration. (2026, March 3). FDA warns 30 telehealth companies against illegal marketing of compounded GLP-1s. https://www.fda.gov/news-events/press-announcements/fda-warns-30-telehealth-companies-against-illegal-marketing-compounded-glp-1s
- Consumer Financial Protection Bureau. (n.d.). How do I dispute a charge on my credit card bill? https://www.consumerfinance.gov/ask-cfpb/how-do-i-dispute-a-charge-on-my-credit-card-bill-en-61/
- U.S. Government Publishing Office. (2021). 15 U.S.C. §8403: Negative option marketing on the Internet. https://www.govinfo.gov/content/pkg/USCODE-2021-title15/html/USCODE-2021-title15-chap110-sec8403.htm
- Federal Trade Commission. (2026, March 11). FTC seeks public comment in response to advance notice of proposed rulemaking regarding negative option marketing practices. https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-seeks-public-comment-response-advance-notice-proposed-rulemaking-regarding-negative-option
