LegitScript Certification: Cost, Process and Why Payment Processors Ask for It

LegitScript certification is a background check for healthcare businesses that sell online. We see banks ask for it when we're setting up merchant accounts for our clients, even though Visa and Mastercard's rules don't name it. It's also what Google, Meta, Microsoft and TikTok look for before they let an online pharmacy, a telemedicine provider that promotes prescription drugs, or an addiction treatment center run ads.

Healthcare certification costs $975 to apply and $2,150 a year per website. LegitScript doesn't publish a timeline, and the review is detailed: licenses, ownership, prescribing, partner pharmacies and every claim on your site.

What LegitScript Is

LegitScript is a private company based in Portland, Oregon. It was founded in 2007 to deal with counterfeit drugs sold online. It is not a government regulator, and its own site says it is "a private certification body and not affiliated with any law enforcement agency." Certification is voluntary.

LegitScript does the homework so the platforms and banks don't have to. Ad platforms, card networks and acquiring banks don't want to check every pharmacy license and prescriber themselves, so they rely on LegitScript to check them and keep bad actors out. As of September 2026, LegitScript says more than 10,000 websites are certified, and telemedicine applications doubled over the past year.

LegitScript Certification Programs

There are four programs, and picking the right one is the first step.

• LegitScript healthcare merchant certification: online pharmacies, telemedicine providers, digital health platforms that facilitate prescribing by connecting patients with prescribers, med spas that prescribe through telemedicine or take card-not-present payments for prescription drugs, manufacturers, wholesalers and discount or price-comparison sites.
• Addiction treatment certification: substance use disorder treatment providers in the US and Canada, plus mutual support groups and crisis hotlines. Lead generators and paid referral services are not eligible, and neither are sober-living homes with no clinical services.
• CBD product certification: certified one product at a time. It covers topicals, cosmetics and hemp flower. Ingestibles, tinctures, vapes, pet products and delta-8 are outside the program.
• CBD website certification: for US sites where every CBD product sold is already LegitScript certified.

There is also an enterprise option for organizations with many domains or locations.

Who it isn't for: LegitScript does not certify businesses whose products are only dietary supplements. There's no certification to get, so a supplement merchant account application is judged on your claims, labels and billing instead.

Who Needs LegitScript Certification

If you sell or facilitate prescription drugs online and want to advertise, or you advertise addiction treatment, you need it. In practice that means:

• Online pharmacies, including mail-order and compounding pharmacies with web storefronts.
• Telemedicine providers whose ads promote prescription medications: weight loss, hormone therapy, sexual health, hair loss and dermatology.
• Direct-to-consumer brands that ship prescriptions through remote prescribers and partner pharmacies.
• Addiction treatment providers that advertise on Google, Meta or Microsoft.
• CBD brands selling topicals that want to advertise where platforms allow it.

Who usually doesn't: a telehealth practice that advertises its telehealth services in general terms without promoting prescription drugs doesn't need it for Meta. A practice billing for visits under a medical services MCC isn't covered by any card network rule that names LegitScript. Your bank may still ask for it, which is the next section.

Why Google, Meta and Payment Processors Care About LegitScript

Ad platforms that require LegitScript certification

Google allows CBD ads only for LegitScript-certified topical products, and only in California, Colorado and Puerto Rico. Meta limits pharmacy and prescription telehealth ads to the US, Canada and New Zealand, ages 18 and up.

Certification gets you on the right path. Your ads still get reviewed. LegitScript says it does not guarantee your ads will be approved.

Card networks and acquiring banks

This is where we see the most confusion. Many merchants think Visa and Mastercard require LegitScript, and that's not exactly what the rules say.

• Visa treats card-absent merchants under MCC 5912 (pharmacies) and 5122 (drugs and druggists' sundries) as high-integrity risk, which means the bank has to register them with Visa. The exemption is for merchants accredited by NABP "or other regulatory body recognized by Visa."
• Mastercard requires the acquiring bank to register non-face-to-face pharmacy merchants before processing for them and to confirm the business is legal. That can be a legal opinion or accreditation from a recognized third party, re-confirmed every 12 months.

Neither rule names LegitScript, but LegitScript says Visa and Mastercard recognize LegitScript certification. For MCC 5912 pharmacies, LegitScript certification or NABP accreditation is the most direct way to give the bank what registration asks for. For telehealth billed under MCC 8099 or another medical services code, no network rule requires it, but the banks we work with will usually ask for it, especially for weight loss and other prescription programs.

LegitScript Healthcare Certification Standards

The healthcare program checks nine standards.

Addiction treatment has 16 standards. They add proof of facility lease or ownership, staff qualifications, insurance, accurate photos and addresses, no co-ownership with lead generators, and no patient brokering or incentives like paid travel. CBD products need a Certificate of Analysis and random samples tested at a LegitScript-approved lab. For CBD website certification, officers also go through criminal background checks.

How to Get LegitScript Certified: The Certification Process Step by Step

1. Pick the program. Healthcare, addiction treatment or CBD. Picking the wrong one can cost you the application fee.

2. Gather your documents. Business and professional licenses, registration numbers, your DEA certificate if you have one, your privacy policy, the compliance status of partner pharmacies, and your product, service and ad materials.

3. Create an account and complete the enrollment form.

4. Pay the application fee. It's a nonrefundable application fee unless you withdraw before review starts.

5. Submit the questionnaire. List every website, landing page and funnel you use. A domain you leave out is a domain you can't advertise.

6. Answer the analyst. Expect questions during the application process and requests to change website copy, disclosures or partner details. Our advice to merchants is simple: fast, complete answers are the biggest thing you control.

7. Pay the annual certification fee and add the seal. The annual fee is due only once you're approved. The seal goes on your site and links to your public verification page.

Organizing licenses and paperwork for a LegitScript application

Credit: Adaptiv Payments

How Long LegitScript Certification Takes

LegitScript doesn't give an estimate, because it depends on your application. In materials for payment companies, it says 70 to 80% of applicants with a complete application are certified in under four weeks, and about half in two weeks or less. The applications that drag on are usually the ones that are incomplete or messy.

What slows it down: licensing gaps (a license in the wrong entity's name, or a state you serve without one), complex ownership, lots of domains or facilities, and controlled substances. Slow replies are the big one. Every day you take to answer is a day added.

Expedited review costs $2,500 per application. The expedited option starts review within two business days after screening, but it doesn't shorten the review itself.

New telehealth or addiction treatment brand? Apply first, build ads second.

LegitScript Certification Costs and Fees

All fees are paid to LegitScript and were current as of October 2026. Check LegitScript's site before you apply, as pricing can change.

Healthcare certification

First-year cost for one site is $3,125. There's no nonprofit discount on healthcare certification.

Addiction treatment certification (per facility)

Nonprofits can apply for a hardship waiver.

CBD certification

Application fees can be refunded only if you withdraw before review begins. Annual fees renew automatically.

Costs outside LegitScript

• Legal review of your site copy, consent forms and ads
• Rewriting pages and funnels that don't meet the advertising standard
• New state licenses if you serve patients in states you aren't licensed in
• Lab testing for CBD products

What LegitScript Checks on Your Website

Analysts review your site the way a regulator would. Before you apply:

• Remove guarantee language. "Guaranteed weight loss," "no side effects" and "risk-free" will get flagged.
• Don't call compounded drugs a replacement. LegitScript has said compounded GLP-1s may not be marketed as replacements for the branded drugs. Our GLP-1 merchant account guide covers the other wording banks look for.
• Show prices, refunds and subscription terms. They should match what you actually charge. A mismatch is a problem for LegitScript and for your bank, since it drives chargebacks.
• List who provides care. Prescriber names, credentials and the states they're licensed in.
• Name your pharmacy partners. And make sure they're certified or accredited.
• Match your privacy policy to your real setup. Including tracking pixels and intake forms. Our page on HIPAA and payment processing covers where payments fit.

LegitScript also checks what you submit against corporate registries, license databases and public complaints. Anything that doesn't match triggers more questions.

Staying Certified: Monitoring and Renewal

Certification comes with ongoing monitoring the whole year. Analysts can ask for updated documents at any time.

• Report changes within 30 days. New licenses, changes to DEA status and any disciplinary action.
• Renew yearly. About a year after approval, LegitScript sends a short questionnaire and the renewal fee.
• Know what gets certification pulled. Nonpayment, ignoring requests, ads that break a platform's rules, card network violations, reputational risk, or LegitScript's own discretion. Cancellation is immediate, with no prorated refund.

Probationary certification is for businesses that meet the standards but need closer monitoring, for example because of past disciplinary action or a risky partnership. It costs more and can be revoked at any time.

How to Check Whether a Business Is LegitScript Certified

Search the site's domain on LegitScript's certification status lookup. Every certified site has a public page, and a real seal links to it. A seal that doesn't click through to legitscript.com is a warning sign. Certified CBD products don't get a seal. They appear in LegitScript's list of certified products instead.

LegitScript vs. Licensing, Accreditation and PCI

You need all of them. A certified telehealth brand still needs its state licenses, and a licensed pharmacy still needs LegitScript or NABP to advertise on the major platforms.

Reviewing a compliance checklist on a tablet

Credit: Adaptiv Payments

FAQs About LegitScript Certification

Where Adaptiv Payments Fits

LegitScript certifies. Adaptiv sets up the payments. We open high-risk merchant accounts for healthcare merchants: telehealth providers, online pharmacies, CBD brands and addiction treatment providers, whether you're certified already or still applying.

• Merchant accounts under the right MCC for your model, including MCC 5912 and MCC 8099.
• A payment gateway that connects to your telehealth platform, cart or intake flow.
• Recurring billing for memberships and refill programs, set up to follow automatic renewal laws.
• ACH as a second way to get paid.
• Chargeback and fraud detection tools built for card-not-present healthcare sales.

We usually tell merchants to apply with us while LegitScript is still reviewing, so both are done around the same time.

Nothing in this article is legal advice. Check LegitScript's site for current fees and standards, and talk to your own counsel.

Apply today. It's free.