Telehealth payment processing, MCC codes and why your acquirer asks for certification

The conversation usually starts with a rejection nobody explains properly. The application to a payment processor comes back asking for a certification you do not hold, or an existing account is suddenly under review, and the reason given is a merchant category code you have never looked at.

Understanding the mechanism is worth an hour, because it tells you which of your problems are negotiable and which are not.

The code decides the treatment

Every merchant is assigned a merchant category code that tells the card networks what the business sells. For telehealth businesses that involve medicines, two matter: MCC 5122, which covers drugs, drug proprietaries and druggist sundries, and MCC 5912, which covers drug stores and pharmacies.

Both are classified by the card networks as high integrity risk. That phrase is specific and it is not about chargebacks. It describes categories where the network's concern is that the underlying transaction may be for something unlawful, which is a different risk from a customer disputing a charge.

The consequences attach to your acquiring bank rather than to you. Under the Visa Integrity Risk Program, acquirers must register merchants in these categories, pay a registration fee for doing so, and answer for them. That is why the certification requirement usually arrives from the acquirer rather than from the gateway you signed up with.

Why miscoding is not the workaround it looks like

Every operator eventually meets the suggestion, sometimes from a sales agent, that the account could simply be coded as something less scrutinised. General merchandise. Health and beauty. Professional services.

Do not.

Miscoding a merchant is a violation of the network rules the acquirer is bound by, and the networks run programs specifically to detect it. Being found is not a warning. It is termination, potential placement on the industry termination list, and a subsequent boarding process that starts every conversation with an explanation of why you were terminated.

It is also, practically, a trap in the other direction. A business coded incorrectly and then found is in a much worse position with a certification reviewer than a business that was never coded at all.

What the acquirer is actually underwriting

Three questions, and certification only answers the first cleanly:

Is this merchant legitimate for this category? This is what the certification answers, and why the acquirer wants it before boarding rather than after.

What is the chargeback and refund exposure? Subscription telehealth has structural chargeback risk: recurring billing, a product that arrives late or not at all if a prescriber declines, and customers who do not recognise the descriptor. Your descriptor, your cancellation flow and your refund policy are underwriting material, and they are also certification material, which is convenient.

Who is behind it? Ownership, principals, prior terminations, prior enforcement. The same identity work a certification review does.

Preparing for one of these prepares you substantially for the other. The documents overlap, the disclosures overlap, and the website review is nearly the same review.

Sequencing that does not waste a month

The order that works:

1. Get the website into the state a reviewer would pass. Claims, provider disclosure, terms, cancellation, privacy. This is the long pole and it blocks both processes.
2. Assemble the corporate and clinical documentation once. Entity documents, ownership, licences by state, the pharmacy relationship, the processing history if you have one.
3. File the certification and open the processor conversation in parallel. The acquirer will want to see the certification before going live, but the underwriting questions can be answered while the review runs.
4. Do not launch ads until both are settled. An ad account suspended while you sort out payments is a third problem you do not need.

What that costs in elapsed time is set out in how long certification takes. The part worth noting here is that the two clocks overlap, so running them in sequence rather than in parallel is the most common self-inflicted delay in this whole process.

Multiple domains, multiple problems

If you operate more than one storefront, this is where the arithmetic gets uncomfortable. Certification attaches to a website. Merchant accounts attach to a business and a descriptor. A funnel domain that takes payment and is not certified is a problem for the acquirer as well as for the certifier, and consolidating before you apply is nearly always cheaper than certifying everything.

What actually drives certification cost is worth reading with your domain list in front of you rather than after you have already filed.

The failure mode to plan for

The expensive scenario is not rejection. It is a live business whose processing is suspended pending certification, because at that point every day of the review is a day of revenue that does not happen, and the file is being prepared under time pressure by people who are also fielding customer support.

Expedited processing exists for exactly that situation and buys a review start within two business days of submission, which is worth having when waiting is what is costing you money. It buys nothing at all if the application is not ready, because an incomplete file reaches a reviewer sooner and then stops in the same place it would have stopped anyway.

The underwriting file, assembled once

Your acquirer and your certification reviewer want overlapping evidence, so assemble it once and use it twice.

• Entity documents, ownership and the identity of the principals.
• Processing history where you have it, including chargeback and refund rates by month.
• The provider roster with licences by state, and the dispensing pharmacy with its registration.
• The subscription mechanics: billing interval, renewal disclosure, cancellation path and the descriptor that appears on a statement.
• The complete domain list, with a note against each about whether it transacts.

Two of those are worth a second look before anybody sees them. Your chargeback profile is the number an underwriter reads first, and the cheapest way to improve it is a recognisable descriptor and a cancellation flow that works. Your domain list is the one that changes the arithmetic on everything else.

What to do when processing is already suspended

Triage in this order. Establish what the acquirer actually requires and by when, in writing, because "we need certification" and "we need certification within thirty days" are different problems. Find out whether settlement is being held and how much, because that sets how long you can operate.

Then start on the website rather than on the application, since it is the long pole and it blocks both processes. And be honest with the acquirer about the timeline, because the one thing that reliably makes this worse is a merchant who promises a date that belongs to somebody else's review queue.