High-risk merchant account requirements: the 2026 checklist

Why do high-risk merchant accounts keep getting declined?

Because the bank carries your risk, and the card networks hold it responsible for you. When a customer disputes a charge and you can't pay, the acquiring bank pays. The OCC says that contingent liability "can span several months of the merchant's sales volume" (OCC Merchant Processing handbook).

The card networks add their own rules:

• For high-integrity-risk categories, Visa makes acquiring banks register the merchants and meet capital requirements (Visa Core Rules §1.9.5.1, Apr 18, 2026). For card-absent sales those categories include MCCs 5122, 5912, 5966, 5967, 5968, 5993, 7273 and 7995 (Visa Merchant Data Standards Manual, Apr 2026, §2).
• For those merchants, the acquiring bank sets an activity baseline, monitors daily from day 31, and must give Visa its records within 7 calendar days on request (Visa Core Rules §10.4.5.2). Your file is written for Visa as much as for the bank.
• Regulators expect banks to make sure they are "not facilitating fraudulent or other illegal activity" (FDIC FIL-43-2013), and using a third party (an ISO or processor) "does not diminish" the bank's responsibility (2023 Interagency Guidance on Third-Party Relationships).

What documents do I need for a high-risk merchant account?

Entity papers, owner IDs, a business bank account, statements, supplier proof and a disclosed history. The full list:

What does my website need before I apply?

Contact details and country at checkout, visible policies, separate recurring terms, and only the products in your application. Underwriters read your site, and industry underwriting guidelines include "Secret Shopping" and "Affiliate/Affiliate Network Marketing Review" (ETA Guidelines, 4th ed., table of contents §5.4, §5.8).

• On the checkout page: customer-service contact and merchant country. Visa: "A link to a separate web page does not meet this requirement" (Visa Core Rules §5.8.4.1).
• Refund, cancellation and shipping policies that are easy to find.
• Recurring billing terms "clearly detailed… separate and distinct from general terms and conditions of sale" (Mastercard Chargeback Guide).
• Products match the application. Every product on the site should be in the file. Unlisted products are the fastest route to termination.
• Every domain registered. For Mastercard's registered categories (such as negative-option merchants under MCC 5968), the acquiring bank must provide each website URL transactions may come from (SPME §9.1).

What extra do peptide, supplement and gaming businesses need?

Proof that the specific risk of your vertical is controlled:

• RUO peptides. Research-use-only site with no human-use content, COAs, supplier agreement, B2B evidence where it exists. FDA letters show what fails (Gram Peptides; Royal Peptides). → Peptide payment processing
• Supplements and subscriptions. Visa requires a simple online cancellation and, for trials or introductory offers, a notice at least 7 days before the trial ends (Visa Core Rules §5.8.11.1, Table 5-21). Mastercard's MCC 5968 covers continuity/subscription merchants (Mastercard Quick Reference Booklet). Stripe, for comparison, prohibits "Negative option marketing" with "unclear or hidden pricing" (Stripe list).
• Online gambling and gaming. A card-absent merchant that conducts online gambling must use MCC 7995 for all transactions, and skilled-game wagering such as daily fantasy sports under MCC 5816 is on Visa's high-integrity list (Visa MDSM, Apr 2026). Online gambling merchants must show Visa's statement that "Internet gambling may be illegal" in some jurisdictions (Visa Core Rules §5.8.4.1). Expect licensing or legal-opinion requests.

What does the bank check that I don't see?

MATCH, Visa's risk-program history, and the owners themselves.

• MATCH. The acquiring bank must run a MATCH inquiry before signing you (SPME §7.1.1). MATCH matches on business details and up to five principal owners (SPME §11.2, §11.6). A listing isn't an automatic no: "an Acquirer may onboard a MATCH Merchant listed in MATCH Pro" (§11.6.4). → MATCH list
• Visa risk programs. Merchants identified in a Visa risk program, or with violations in the prior 3 years, can't use certain payment-facilitator exceptions (Visa Core Rules §5.3.1.4, §1.5.1.1).
• Personal credit and identity of the owners.

How do I apply, step by step?

Fix the site, build the file, and apply only to banks that take your vertical.

1. Fix the website before anyone sees it (contact details at checkout, policies, recurring terms, every product listed).
2. Gather the documents in the checklist into one folder.
3. Write a one-page business summary: what you sell, to whom, how it ships, monthly volume, refund and chargeback rates, any past terminations and why.
4. Apply to banks that underwrite your vertical. A bank that doesn't accept your category will decline no matter how good the file is.
5. Answer underwriter questions fast and in writing.
6. Read the agreement before signing: fees, reserve percentage and release terms, early-termination clauses, MCC, descriptor. → Rolling reserves

I got declined. What do I fix before I reapply?

Find the real reason, fix it, and reapply with the fix documented. As one merchant warned, "Ask each one what triggers a review before you sign, not after" (r/smallbusiness).

What gets applications declined?

• Leaving out a prior closure. It will show up, and the omission becomes the reason for the decline.
• Applying through a new company to hide history. The FTC lists shell companies used to get new merchant accounts as an evasion tactic (FTC v. Paddle order).
• Sending fake or placeholder data. Visa's rules, effective Jul 25, 2026, say "no dummy data" in account and address verification requests (Visa Core Rules, Summary of Changes). Altering data to get around Visa's monitoring programs can cost USD 25,000 a month and permanent disqualification (Visa Core Rules §12.5.3.2).
• Treating a verbal "you're approved" as an approval. Only a signed agreement counts.

How Break Free Finance helps

We don't process payments. We connect high-risk businesses (RUO peptides, supplements, gaming) with banks that underwrite what they actually sell, drawing on decades of relationships with 40+ financial institutions and solution providers, and we help build a file those banks will review. Tell us what you sell. We'll tell you straight whether we know a bank for it. Every account is subject to the bank's underwriting; no approval is guaranteed.

Sources (last checked October 10, 2026)

• Visa Core Rules and Visa Product and Service Rules (Apr 18, 2026)
• Visa Merchant Data Standards Manual (Apr 2026)
• Visa Dispute Management Guidelines for Merchants (2024)
• Mastercard Security Rules and Procedures, Merchant Edition (Feb 11, 2025)
• Mastercard Chargeback Guide, Merchant Edition
• Mastercard Quick Reference Booklet, Merchant Edition
• FDIC FIL-43-2013
• Interagency Guidance on Third-Party Relationships (2023)
• OCC Comptroller's Handbook, Merchant Processing
• FinCEN customer due diligence rule, 31 CFR 1010.230
• FTC Humboldt Merchant Services press release (Sep 8, 2026)
• FTC v. Paddle, stipulated order
• ETA Guidelines on Merchant and ISO Underwriting, 4th ed. (TOC)
• Shopify Payments Terms of Service (US)
• FDA warning letters, Gram Peptides and Royal Peptides
• Visa Acquirer Monitoring Program fact sheet (2025)
• Stripe, Prohibited and Restricted Businesses (updated Sep 22, 2026)
• Merchant quote (language only): Reddit thread linked inline

General information, not legal or compliance advice.