Compounded GLP-1 Telehealth Merchant Accounts: What the FDA, Visa and Mastercard Require in 2026

Two years ago a telehealth weight-loss program could run on a simple model: a short online intake, a prescriber consult, and a monthly subscription for compounded semaglutide or tirzepatide shipped from a partner pharmacy at a fraction of the brand-name price. That model rested on one legal fact, which was that both drugs were on the FDA's shortage list. They are not any more, and in 2026 the FDA, the courts and the card networks have each closed a different part of the gap. On August 27, 2026 the Fifth Circuit upheld the FDA's decision to take tirzepatide off the shortage list. The FDA has proposed to shut the outsourcing-facility route for good. And since March the agency has sent dozens of warning letters to telehealth companies over how they advertise compounded GLP-1s. This guide sets out where the law stands as of September 2026, what Visa and Mastercard require of merchants selling prescription drugs online, and what an underwriter will ask.

Why the shortage list mattered

Compounders are generally not allowed to regularly make copies of FDA-approved drugs that are commercially available. There are two legal routes. State-licensed pharmacies and physicians compound under section 503A of the Federal Food, Drug, and Cosmetic Act, filling prescriptions for individual patients. Outsourcing facilities registered under section 503B can compound in bulk, without patient-specific prescriptions, but only from bulk ingredients on the FDA's 503B bulks list or for drugs that are on the FDA's shortage list at the time of compounding. While semaglutide and tirzepatide were in shortage, both routes were open, and the telehealth weight-loss market was built on them.

The FDA first took tirzepatide off the shortage list in October 2024 and, after re-evaluating that decision, confirmed on December 19, 2024 that the shortage was resolved. It declared the semaglutide injection shortage resolved on February 21, 2025. It then allowed wind-down periods that are now long over. For tirzepatide, 503A compounders had until February 18, 2025 and 503B outsourcing facilities until March 19, 2025. For semaglutide, the dates were April 22 and May 22, 2025.

What is left for 503A pharmacies is narrow. The FDA's guidance, last updated April 1, 2026, treats a compounded drug as essentially a copy of an approved product when it has the same active ingredient in the same, similar or an easily substitutable strength and the same route of administration. That test does not apply if a prescriber determines and documents that the compounded version contains a change that produces a significant difference for an identified individual patient. Separately, the FDA says it does not currently intend to act against a compounder that fills four or fewer prescriptions of such a copy in a calendar month. Neither exception supports a program that ships the same compounded formulation to thousands of subscribers.

The courts and the FDA have closed the remaining doors

The Outsourcing Facilities Association sued over both shortage decisions. On August 27, 2026 a Fifth Circuit panel affirmed the district court in the tirzepatide case. The court held that the FDA did not have to use notice-and-comment rulemaking and that its supply-and-demand analysis was not arbitrary. The opinion notes that removing the drug from the shortage list made it unlawful for physicians, pharmacies and outsourcing facilities to compound tirzepatide injection products. The court decided the companion semaglutide appeal in a separate opinion, and InsideHealthPolicy reported that the same panel rejected that challenge as well.

The FDA is also moving to keep the bulk route closed even if a shortage returns. On April 30, 2026 it proposed not to include semaglutide, tirzepatide or liraglutide on the 503B bulks list, finding no clinical need for outsourcing facilities to compound them from bulk substances. The Federal Register notice was published on May 1, and on June 26 the comment period was extended to July 30, 2026. As of late September 2026 the Federal Register shows no final determination, so this is still a proposal. The proposal concerns only the 503B list and does not change patient-specific 503A compounding, but if finalized it would remove the only large-scale supply route.

Marketing is where enforcement is landing on telehealth companies

On February 6, 2026 the agency said it intended to restrict GLP-1 active ingredients intended for non-FDA-approved compounded drugs that are mass-marketed, and it named Hims & Hers. The statement said companies cannot claim that unapproved compounded products are generic versions of, or the same as, FDA-approved drugs, or that they use the same active ingredient as the approved drugs. On March 9, 2026 Hims & Hers said it would stop advertising compounded GLP-1 offerings, would offer branded semaglutide through a partnership with Novo Nordisk, and would keep offering compounded semaglutide on a limited scale only where a provider determines it is clinically necessary.

On March 3, 2026 the FDA announced warning letters to 30 telehealth companies. It objected to claims implying that compounded drugs are equivalent to FDA-approved ones and to branding that suggests the telehealth company is the compounder. Further letters followed in June, including one dated June 8, 2026, which cited website statements that a compounded semaglutide combined the FDA-approved active ingredient with a vitamin, that it offered the same results as brand names at a fraction of the cost, and that the pharmacies involved were FDA approved. It treated those statements as misbranding under sections 502(a) and 502(bb) of the Act and gave the company 15 business days to respond.

That matters for payments because an underwriter reads the same web pages the FDA does. A checkout page that says a compounded product is the same as a brand-name drug, or that it is FDA approved, reads to an underwriter as a documented regulatory problem.

What Mastercard requires

Mastercard's Security Rules and Procedures, Merchant Edition, dated August 4, 2026, puts non-face-to-face pharmaceutical merchants in its Specialty Merchant Registration Program. Section 9.4.3 defines a non-face-to-face pharmaceutical transaction as a card-not-present purchase of prescription medicines from a merchant whose primary business is selling prescription drugs that way. Before acquiring those transactions, the acquirer must register the merchant with Mastercard, and it must code retail transactions under MCC 5912 (Drug Stores, Pharmacies) and wholesale transactions under MCC 5122. At registration the acquirer must provide every website URL the transactions can come from.

The heavier requirement is legal verification. At the time of registration, the acquirer must have verified that the merchant's activity complies with all applicable laws. The rule says that verification may include a written opinion from qualified independent legal counsel or accreditation by a recognized third party. By registering, the acquirer warrants that it has done this. It must keep that verification for as long as it processes for the merchant and reconfirm compliance at least every 12 months. For a compounded GLP-1 program, that means your acquirer is personally vouching to Mastercard, every year, that your compounding and prescribing model is lawful.

What Visa requires

Visa's Core Rules and Product and Service Rules, dated April 18, 2026, require an acquirer to register high-integrity risk merchants with Visa before submitting their transactions. Which merchant category codes count is set in Visa's Integrity Risk Program Guide rather than in the public rules. Pharmacy codes 5122 and 5912 are widely treated as high-integrity risk, and the public rules contain an exemption that confirms it: the registration requirement does not apply to merchants using MCC 5122 or 5912 that are accredited by the National Association of Boards of Pharmacy or another regulatory body Visa recognizes. An acquirer that fails to register can be assessed $2,000 per unregistered merchant per month, and Visa can impose larger monthly assessments on the acquirer as well.

One more Visa rule matters to adjacent sellers. Visa prohibits card acceptance for products that claim or imply a similar efficacy as prescription drugs, controlled substances or street drugs, irrespective of claims of legality. That is aimed at products marketed as working like prescription drugs, not only at prescription drugs themselves. A dietary supplement sold as a natural alternative that works like a GLP-1 drug is exactly the kind of claim the rule targets. Violations can lead to termination of the merchant.

Where LegitScript fits

In practice, the third-party accreditation most acquirers ask healthcare merchants for is LegitScript Healthcare Merchant Certification. LegitScript says Visa and Mastercard recognize its certification as part of their MCC 5122 and 5912 high-risk registration process. Its certification scope expressly includes telemedicine and telehealth providers that facilitate the sale of prescription medication, medical spas and weight-loss clinics, and sterile compounding pharmacies. As of September 2026, LegitScript lists a nonrefundable $975 application fee and a $2,150 annual fee per website, with an optional expedited review for another $2,500. Every healthcare website you operate must be disclosed in the application, and each site that offers significantly different products needs its own certification.

What an underwriter will ask a GLP-1 telehealth program

Put the FDA's position and the network rules together and the questions in a 2026 application are predictable:

• Who is selling the drug. If your subscription price includes the medication, you are likely the party selling prescription drugs, and the Mastercard registration and Visa pharmacy rules attach to your account. If the pharmacy charges the patient directly and you charge only for the consultation, the drug sale sits on the pharmacy's account. Be ready to show the money flow.
• Which pharmacy compounds, and under what authority. Expect to name the 503A pharmacy or 503B facility, show its licenses in the states you ship to, and explain how the program fits the FDA's current position, not the shortage-era one.
• How clinical need is documented. After the shortage, a compounded GLP-1 needs a prescriber's documented, patient-specific reason for the change from the approved product, or it must stay within the FDA's four-prescriptions-a-month tolerance. A program that ships one standard formulation to every subscriber will struggle to show either.
• What your website says. Underwriters will check for claims that a compounded drug is generic, the same as a brand, FDA approved, or made by you when it is not. These are the claims the FDA's 2026 warning letters cite.
• Whether you hold LegitScript certification or NABP accreditation, or can supply a legal opinion the acquirer can rely on for its Mastercard registration.
• How you handle subscriptions. Monthly medication programs are recurring billing, and the card networks' subscription rules on disclosure, reminders and cancellation apply in full. Patients who stop treatment and cannot cancel easily file disputes, and those count against your monitoring ratios.

What to do now

1. Audit every page of your site and every ad for sameness, generic and FDA-approval language about compounded products, and remove it. Name the compounding pharmacy where you describe the product.
2. Map your prescribing flow against the FDA's clinical-difference standard. If compounded prescriptions are not individually justified and documented by the prescriber, fix that before you apply, not after a reviewer asks.
3. Decide how the program will carry on if the 503B bulks exclusion becomes final. If your supply depends on an outsourcing facility, you need a plan that does not.
4. Apply for LegitScript certification before you apply for processing, and list every website in the application.
5. Consider offering FDA-approved GLP-1s alongside or instead of compounded ones. Hims & Hers made that shift in March, and a catalogue built on approved products is much easier to underwrite.
6. Clean up subscription billing: clear disclosure at checkout, easy online cancellation, and a descriptor patients recognize.
7. Do not split the program across storefronts to keep a cleaner account open. Running pharmacy sales through a merchant account registered for something else is transaction laundering under card network rules, and it can put you and your principals on the MATCH list.

How PayKings approaches telehealth weight-loss programs

PayKings works with telehealth and telemedicine businesses through acquiring banks that underwrite healthcare merchants deliberately, and prescription weight-loss programs are placed case by case. When you apply, expect to be asked for your pharmacy relationships and licenses, your prescribing and documentation model, your LegitScript status, your full website and marketing copy, and your subscription and cancellation flow. Expect a plain answer about what can be placed. We do not give legal advice, and whether your compounding model is lawful is a question for your healthcare counsel. What we can tell you is what an acquirer will need to see to register you with Visa and Mastercard. If you run a GLP-1 program and want to know where you stand, talk to a PayKings specialist with that file ready.