MCC 5723: Where the Firearms Merchant Code Is Required, Where It Is Banned, and What the House Bill Changes

For most of the history of card acceptance, a gun store was coded like any other sporting goods or general merchandise retailer. That changed in September 2022, when the International Organization for Standardization approved merchant category code 5723 for firearms and ammunition retailers. Since then the code has been switched on in three states, banned in twenty, vetoed twice in one, and, on July 14, 2026, targeted by a federal bill that passed the House 221 to 201 and would wipe out every state law on the subject. This guide sets out what MCC 5723 is and is not, where it is required and where it is prohibited as of September 21, 2026, how acquirers decide whether to assign it, and what the Protecting Privacy in Purchases Act would do if it becomes law.

What MCC 5723 is, and what it does not record

A merchant category code is a four-digit number the card networks attach to a merchant account to describe the merchant's line of business. It sits on every authorization and settlement record, and issuers, networks and acquirers use it for interchange, reporting and risk monitoring. What it does not carry is the receipt: an MCC identifies the kind of store, not the items in the basket. A transaction coded 5723 tells the issuing bank the cardholder spent a dollar amount at a firearms retailer. It does not say whether the purchase was a rifle, a box of ammunition, a holster or a hat.

MCC 5723 sits in the 5700 to 5999 retail range alongside codes such as 5941 for sporting goods stores and 5999 for miscellaneous retail, which is where firearms retailers have generally been coded. The federal bill discussed below describes its own purpose as stopping codes that distinguish a firearms retailer from a general merchandise or sporting goods retailer, which is the status quo the code replaced.

The code's history is short and contested. ISO approved it on September 9, 2022, a date written into California's statute. The networks published it in February 2023 and then, in March 2023, paused implementation after a wave of state bills moved to prohibit it. In a February 2024 letter to members of Congress, Visa said that given the conflicting state laws its implementation pause remained in effect, while Mastercard said standalone merchants in California primarily engaged in the sale of firearms would be required to use the code. The code exists on every network; whether it lands on your account depends on state law.

Three states require it: California, Colorado and New York

All three mandates share a structure. They put the duty on the payment card networks to make the code available and on merchant acquirers to assign it, they define a firearms merchant by a highest-sales test rather than by whether the business sells any firearms at all, and they give the state attorney general exclusive enforcement with a 30-day cure period and a civil penalty of up to $10,000 per violation. Colorado and New York both define the test by what the business states to its merchant acquirer in the ordinary course of business, which is why the questions land on your application. The merchant is not the regulated party. Your acquirer is.

California: AB 1587

Signed September 26, 2023 and effective January 1, 2024, AB 1587 required payment card networks to make the code available to acquirers by July 1, 2024 and required acquirers to assign it to firearms merchants beginning May 1, 2025. A firearms merchant is a business licensed in California as a firearms dealer or ammunition vendor for which the highest sales value is, or is expected to be, from the combined sale in California of firearms, firearm accessories or ammunition. Violations carry a $10,000 civil penalty per violation, injunctive relief and attorney's fees, and any contractual waiver of the law is void.

Colorado: SB 24-066

Signed May 1, 2024 and effective August 7, 2024, Colorado's law follows the California model. Networks had to make the code available from September 1, 2024, and from May 1, 2025 a merchant acquirer must assign it to each firearms merchant it serves. A firearms merchant is a business physically located in Colorado that sells firearms, firearm accessories and ammunition for profit and has its highest gross revenue, or expected gross revenue, from the combined sale of those goods in Colorado. The attorney general enforces, with the same 30-day cure and up to $10,000 per violation.

New York: General Business Law section 529-a

Signed October 9, 2024, New York's law required networks to make the code available on or before November 1, 2024 and required acquirers to assign it to qualifying dealers on and after May 1, 2025. It reaches gunsmiths and dealers licensed under section 400.00 of the Penal Law whose highest sales are from firearms, accessories or ammunition. Enforcement is by the attorney general with a 30-day cure and a civil penalty of not more than $10,000 per violation.

May 1, 2025 is therefore the date the code went live in all three states, and acquirers have treated it that way. Bank of America's merchant services help page, updated December 17, 2025, states that as of May 1, 2025 only California, Colorado and New York require the code and that it should only be used in those states where it is legally required.

Twenty states prohibit it

The National Shooting Sports Foundation counted 20 states with laws blocking a firearms-specific MCC as of May 16, 2025, when Arkansas signed HB 1509: Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kentucky, Louisiana, Mississippi, Montana, New Hampshire, North Dakota, Ohio, South Dakota, Tennessee, Texas, Utah, West Virginia and Wyoming. These statutes are generally modelled on the same template, typically titled a Second Amendment Financial Privacy Act or Second Amendment Privacy Act. South Carolina's pending version states the pattern plainly: a payment card network shall not require or incentivize the use of a merchant category code in a manner that distinguishes a firearm retailer from other retailers, and a covered entity shall not assign a firearm retailer such a code.

The count has not moved much since. NSSF listed Arizona, Oklahoma, Nebraska, Missouri, Wisconsin, South Carolina, North Carolina and Maine as having pending bills in May 2025. Arizona's legislature passed one, SB 1058, in 2026, but Governor Katie Hobbs vetoed it on May 22, 2026, writing that merchant category codes are vital tools that help law enforcement crack down on illegal gun trafficking to transnational criminal organizations. She had vetoed the previous year's version, SB 1143, as well. Missouri's SB 1128 was eligible for a Senate floor vote in April 2026. We have not found a 2026 enactment in any of the pending states; check your own state's status before relying on this list.

The practical effect in a prohibition state is the mirror image of the mandate states: your acquirer is barred from putting 5723 on your account, and if you find it on a statement you have grounds to demand a correction.

How acquirers decide whether you get the code

Because the duty falls on the acquirer, the decision is made in underwriting and at periodic review, and it turns on facts about your business that you supply. Bank of America's published policy is the clearest public statement of how a large acquirer applies the three mandates, and other acquirers work from the same statutory tests.

• Primary business, measured by dollars. You are assigned 5723 only if your highest dollar volume of sales in a mandate state comes from firearms, firearm accessories and ammunition combined. A California sporting goods store whose biggest category is archery and fishing tackle is not coded 5723 even though it sells guns; the same store whose biggest category is firearms and ammunition is.
• Location by location. Merchants with locations in several states are asked to list every state where they operate a permanent or temporary retail location so each location can be evaluated separately. A chain can hold 5723 on its Denver store and a different code on its Phoenix store.
• Gun shows and temporary locations. A dealer whose home location carries 5723 and who sells at a gun show outside California, Colorado or New York needs an additional location on the account with a different MCC for temporary use, because several other states prohibit 5723 for any transaction. The reverse applies to a dealer from a prohibition state selling at a show in a mandate state.
• E-commerce. Online volume is evaluated from your principal place of business, state of incorporation, the states where you have physical retail, office or warehouse locations, and the states where all or most of your sales go. The state where you are physically located generally governs, but an out-of-state merchant whose e-commerce firearms sales go mostly to California, Colorado or New York buyers can expect further evaluation.

Expect these questions on a new application and again at account review, and answer them accurately: your merchant agreement requires you to abide by all laws and network rules, and a misstatement about where you sell is a breach the acquirer can act on. The code you carry today is on your merchant statement as your business category, and your processor can confirm it.

The federal bill that would end the state mandates

H.R. 1181, the Protecting Privacy in Purchases Act, was introduced by Representative Riley Moore of West Virginia on February 11, 2025, reported by the Financial Services Committee on February 25, 2026, and passed the House on July 14, 2026 by a recorded vote of 221 to 201. Roll Call 240 shows 215 Republicans, five Democrats and one independent voting yes, and 200 Democrats and one Republican voting no. The White House issued a Statement of Administration Policy the same day saying the Administration strongly supports the bill and that the President's advisors would recommend he sign it in its current form. The bill was received in the Senate on July 15, 2026 and referred to the Committee on Banking, Housing, and Urban Affairs, where the companion S. 1715, introduced by Senator Bill Hagerty on May 12, 2025, has also sat since introduction.

The House-passed text does four things that matter to a firearms merchant:

1. It bars a payment card network from requiring a firearms retailer to use a merchant category code that is used only or primarily for firearms retailers or that identifies the retailer as selling firearms, ammunition, accessories or components, and bars a covered entity, which is defined to include any processor with a merchant relationship or a relationship with such a processor, from assigning one.
2. It preempts any state or local law regulating the assignment, use or disclosure of such codes. California's, Colorado's and New York's mandates would fall on enactment. The bill preserves a network's or processor's ability to comply with laws on dispute processing, fraud, compliance management and transaction integrity.
3. It gives enforcement to the U.S. Attorney General, who must set up a complaint process within 90 days of enactment, investigate complaints, issue a written notice with a 30-day period to remedy, and may then seek an injunction in federal court. There is no private right of action, so a merchant's remedy is the complaint process, not a lawsuit.
4. It requires an annual report to Congress on investigations and their disposition.

As of September 21, 2026 the bill is not law. It needs Senate passage and the President's signature, and the Senate committee has not acted on either version. Until that happens nothing about the three state mandates changes, and an acquirer in California, Colorado or New York that stopped assigning 5723 on the strength of the House vote would be the one in breach.

What to do now

• If your primary business is firearms, accessories and ammunition and you sell in California, Colorado or New York, expect MCC 5723 on that location and understand that your acquirer has no discretion about it. The code does not change what you may lawfully sell and does not itemize your transactions. None of the three statutes says anything about pricing or approval; whether your acquirer treats the code as an underwriting input is a question to put to your acquirer.
• If you operate only in one of the twenty prohibition states, you should not be carrying 5723. Check your statement and raise it with your processor if you are.
• If you sell in several states, online, or at gun shows across state lines, keep a clear record of where your locations are and where your sales go. That is what your acquirer will ask for, and separate location setups for temporary sales are routine rather than a red flag.
• If you are applying for a new firearms merchant account, apply with a processor that already works through these questions for FFL holders. PayKings underwrites firearms dealers, gunsmiths and manufacturers and handles location, gun show and e-commerce coding at setup rather than after a compliance review finds a problem.
• Watch two things: Senate action on H.R. 1181 or S. 1715, which would remove the state mandates outright, and the 2027 sessions in the pending states, where another prohibition or two would change the map for multi-state dealers.

The code on a gun store's account has become a proxy for a much larger argument, and that argument is not settled. The mechanics are: three states require the code, twenty prohibit it, the acquirer carries the obligation either way, and the tests turn on where you sell and what you sell most of. Get those facts straight with your processor and the code takes care of itself, whichever way Washington goes.