The MATCH List and MCC Codes: What Peptide Merchants Need to Know

Most peptide store operators learn about the MATCH list the same way — by getting rejected for a new merchant account after their last one was terminated.

No warning. No explanation letter. Just a decline from every processor they apply to, sometimes for months.

The MATCH list is the payment industry’s version of a credit blacklist, and it follows your business for 5 years. What makes it especially brutal for peptide merchants is that the most common path onto it isn’t fraud or intentional rule-breaking — it’s a misclassified MCC code assigned on day one, triggering a compliance chain that ends in termination.

This post explains what the MATCH list is, how MCC misclassification puts you on it, and what to do before it becomes your problem.

What Is the MATCH List?

MATCH stands for Member Alert to Control High-Risk Merchants. It’s a database maintained by Mastercard — but used by virtually every acquiring bank and processor in North America — that records merchants whose accounts have been terminated for cause.

The older name for this was the TMF (Terminated Merchant File). Visa has its own parallel database called VMSS (Visa Merchant Screening Service). In practice, “MATCH list” is the term the industry uses for all of them.

Here’s how it works:

1. Your processor terminates your account — for chargebacks, compliance violations, or fraud signals
2. Within 5 days of termination, they’re required to submit your business to the MATCH database with a reason code
3. Every other processor you apply to is required to check MATCH before approving you
4. Most will decline on sight. Some high-risk specialists may work with you — but at worse rates, higher rolling reserves, and stricter terms

Once you’re listed, you stay there for 5 years. There’s no standard removal process. The only way off is if the processor added you in error, or you’re listed under reason code 12 (PCI noncompliance) and can prove remediation.

For a peptide store processing $50K/month, getting MATCHed doesn’t just close one account. It threatens your ability to accept card payments under your business name for years.

The MATCH Reason Codes That Hit Peptide Merchants

The MATCH system uses numbered reason codes. Not all of them are equal — and some are far more damaging than others when applying to new processors.

The codes most commonly triggered in peptide account terminations:

Reason Code 04 — Excessive Chargebacks. This is the most common. Mastercard and Visa both flag merchants above a 1% dispute rate for enhanced monitoring. If you’re in a chargeback monitoring program and don’t resolve it within the program’s timeline, termination follows — and Code 04 goes onto your record. The silver lining: some high-risk processors will still work with Code 04 merchants because it’s operational, not criminal.

Reason Code 08 — Questionable Merchant Audit Program. Triggered when Mastercard’s internal review flags your business as operating in a way that poses ecosystem risk. For peptide merchants, this often means website language that reads as pharmaceutical intent, or product listings that crawlers flag against Mastercard’s BRAM program rules.

Reason Code 11 — Violation of Standards. Catch-all for merchants who’ve broken card network rules — prohibited transactions, non-compliant marketing claims, selling restricted compounds. This code is harder to work around with new processors.

The 2026 BRAM GLB 11691.1 update specifically tightened enforcement on research peptides and nutraceuticals. Processors that were borderline-comfortable with peptide accounts in 2024 are now applying much stricter underwriting — and aggregator terminations (Stripe, PayPal, Square) in 2026 are more likely to trigger MATCH placement than they were previously.

The MCC Problem: How You End Up on MATCH Before You’ve Done Anything Wrong

Here’s the part most payment processors won’t explain upfront.

Every merchant account is assigned a Merchant Category Code (MCC) — a four-digit ISO classification that tells the card networks what kind of business you run. Your acquiring bank assigns it. You don’t choose it. And it determines your risk tier, your chargeback monitoring thresholds, your interchange fees, and whether certain transactions get flagged automatically.

For peptide merchants, MCC misclassification is one of the most common causes of account termination.

THE MCC → MATCH CASCADE Wrong MCC Assigned 5912 or 5122 (pharmacy codes) Wrong Bank Tier Enhanced due diligence required per Visa April 2026 Auto-monitoring Keyword crawlers flag site + chargeback spikes Termination Funds frozen 90–180 days MATCH LIST 5-year blacklist across all processors Funds held · Higher rates · Rolling reserves Some accounts: no card processing at all

The two problematic codes:

MCC 5912 (Drug Stores & Pharmacies) and MCC 5122 (Drugs, Proprietaries & Sundries) are the codes peptide merchants most frequently get assigned — and both are specifically flagged in Visa’s April 2026 Merchant Data Standards Manual as requiring enhanced due diligence for all card-absent (online) transactions. Being classified under either one triggers automatic heightened scrutiny on every transaction your store processes.

What should a peptide store actually be coded as?

The more defensible classifications are MCC 5999 (Miscellaneous & Specialty Retail) or MCC 5047 (Medical/Lab Equipment & Supplies). For nutraceutical-adjacent products, NAICS code 325411 (Medicinal and Botanical Manufacturing) is also used. None of these are a perfect fit — peptide RUO retail is genuinely uncategorized territory — but they don’t trigger Visa’s card-absent enhanced due diligence rules the way 5912 and 5122 do.

The irony: peptide stores generally have low chargeback rates. Research buyers know what they’re buying and rarely dispute charges. The “high-risk” classification isn’t based on actual dispute data — it’s entirely a function of the MCC code.

How MCC Misclassification Leads Directly to MATCH

Here’s the cascade:

A new peptide store opens. The processor assigns MCC 5912 because it seems like the closest match to “things that look pharmaceutical.” Under that code, every transaction is subject to Visa’s enhanced due diligence requirements. The acquiring bank’s automated systems run website crawlers that scan for terms like “peptide,” “BPC-157,” “semaglutide,” and “research only” — and flag the account.

Meanwhile, the store’s chargeback rate edges up slightly — not to 1%, maybe to 0.7% — because customer confusion about billing descriptors is generating friendly fraud disputes. Under MCC 5912, the bank’s tolerance for any chargeback activity is lower. A dispute rate that would be unremarkable for a sports supplement store is treated as high-risk behavior for a pharmacy-coded merchant.

The processor terminates the account. Funds are held for 90–180 days. The MATCH listing goes in within 5 days.

The store owner applies to 3 other processors. Each one checks MATCH, sees the listing, and declines. One high-risk specialist offers to work with them — at 6% per transaction and a 15% rolling reserve held for 180 days.

This entire sequence started with a four-digit code assigned during account setup.

What You Can Do About It

Before you open an account:

Ask your processor directly what MCC they intend to assign you. If the answer is 5912 or 5122, push back. Request a review for 5999 (Miscellaneous Specialty Retail). You won’t always win this negotiation — some processors have rigid classification policies — but it’s a legitimate ask and worth doing before the account is open.

Processors who specialize in peptide merchant accounts — AllayPay, Corepay, Durango Merchant Services, PayFirmly, ZenPayments — understand this distinction. Part of what you’re paying for with a high-risk specialist is correct underwriting from day one. They know which MCC gives you the most defensible position with their banking partners.

Manage the chargeback signals proactively:

Whatever your MCC, chargeback management matters more for peptide accounts than standard retail. Keep your billing descriptor (what appears on the customer’s card statement) clear and matched to your store name. Confusion-driven chargebacks — where a customer doesn’t recognize the charge — are the single biggest source of friendly fraud disputes in this category.

Use your processor’s chargeback alert system (most specialists offer Ethoca or Verifi integration). Address disputes before they become formal chargebacks. Keep your dispute rate below 0.5% as a target — not 1%, which is the monitoring threshold, but 0.5%, which gives you buffer before processors get nervous.

Build payment redundancy before you need it:

The merchants who handle account disruptions cleanly are the ones who never relied on a single payment rail. A primary credit card processor, a secondary ACH/eCheck option, and a crypto checkout (Coinbase Commerce being the most common in this space) means that if one channel gets disrupted, your store doesn’t go dark. See our full breakdown of peptide payment gateways that won’t shut you down for processor-by-processor details.

On your website:

Consistent RUO framing matters — not just for FDA compliance but because your processor’s website crawlers are evaluating it too. “Research Use Only,” “not for human consumption,” clean COA/HPLC display, no efficacy claims. Processors conduct ongoing website reviews as part of active account monitoring. A site that reads as pharmaceutical at signup but drifts toward consumer health copy over time is a flag.

One More Thing: The April 2026 FDA Gray Area

If you’re operating in this space, you already know the FDA removed 12 peptides from Category 2 of its 503A bulk drug substances list in April 2026. What that means for payment processing is less obvious.

Removal from Category 2 doesn’t place those compounds into Category 1 or on the approved compounding list. They now exist in regulatory limbo until PCAC meetings in July 2026 and early 2027 determine their final status. Bank underwriters cross-reference applicant websites against FDA enforcement actions. “Regulatory gray area” is not what they want to see — it extends review periods, increases reserve requirements, and in some cases triggers outright declines for compounds that were previously being accepted.

If you sell any of the 12 recently removed compounds, be precise in how your site describes their regulatory status. Uncertainty on your site translates directly into uncertainty in your underwriting.

The Technical Side Is One Piece of It

The MATCH list and MCC classification are payment infrastructure problems that have website and compliance architecture solutions. Getting the right MCC requires knowing what to ask for. Keeping your dispute rate below monitoring thresholds requires a store built with trust signals, clear billing descriptors, and friction-reduced checkout.

We build WooCommerce peptide stores with this infrastructure baked in — COA/HPLC display, RUO-compliant copy architecture, payment gateway redundancy, and checkout flows designed to reduce the confusion that generates friendly fraud disputes. It’s a different build spec than a standard ecommerce store.

If you’re planning a new store or inheriting payment problems from a previous build, we’re worth a conversation.