SHORT ANSWER
A merchant category code is a four-digit label the acquiring bank assigns to describe a merchant’s primary business; the merchant does not pick it. Peptide sellers tend to land in codes for drugs, pharmacies, or specialty retail. Visa’s current manual lists card-absent 5122 and 5912 as high integrity risk, and its pharmacy guide requires a High Brand-Risk license before an acquirer boards an internet pharmacy merchant.
This material is general educational information as of the “last reviewed” date. It is not legal advice and may not reflect later developments or facts specific to your business. Links are provided so readers can inspect the primary or official sources.
01 / WHAT AN MCC IS
A four-digit code the acquirer assigns, not the merchant
Visa’s Merchant Data Standards Manual (April 2026 edition, read September 3, 2026) defines the merchant category code as a four-digit number assigned to describe a merchant’s primary business. The codes were derived from Standard Industrial Classification codes and the International Organization for Standardization codes, and Visa notes that its MCCs and SIC codes do not always line up one to one.
The manual is explicit about who does the assigning. It states that it is an important requirement that acquirers and their agents “assign the correct MCC to each of their Merchants,” and that Visa “retains the right to require corrections to MCC assignments and use.” The merchant describes the business on the application; the acquirer chooses the code and answers to the network for it.
Visa also states what the code is used for: “activity tracking, reporting, and risk management.” That last purpose is why the code follows a peptide storefront through every later conversation with a processor.
The manual lists code definitions; the pharmacy guide addresses internet pharmacies and healthcare-product merchants. The codes below are the ones whose official definitions cover what a research-peptide storefront sells. Which one applies to a specific merchant is the acquirer’s call.
02 / THE CANDIDATE CODES
Five codes whose definitions reach a peptide storefront
These are Visa’s own definitions from the April 2026 manual, with the parts most relevant to a peptide seller.
- 5122, Drugs, Drug Proprietaries, and Druggist Sundries: business-to-business or wholesale distributors of prescription drugs, proprietary drugs, druggists’ sundries, pharmaceuticals, and “biological or related products.” The closest literal fit for lyophilized peptides sold to laboratories.
- 5912, Drug Stores and Pharmacies: merchants that “sell prescription and proprietary drugs.” Visa lists 5122 as a similar merchant type, so the two travel together.
- 5499, Miscellaneous Food Stores, Convenience Stores and Specialty Markets: sellers of specialty foods not classified elsewhere, including health food stores. A supplement-style storefront can be coded here; a peptide storefront generally cannot be described this way without misdescribing the product.
- 5999, Miscellaneous and Specialty Retail Shops: sellers of “unique or specialized products that are not classified with a more specific MCC.” The catch-all a retail peptide seller may receive when the acquirer decides no drug code applies.
- 8099, Medical Services and Health Practitioners: medical professionals not classified elsewhere. Reached by clinics and telehealth sellers, not by a storefront shipping vials.
03 / WHY THE CODE MATTERS
The drug codes carry their own network obligations
The manual maintains a list of MCCs it calls “high integrity risk.” For all card-absent transactions, that list currently includes 5122 and 5912, alongside 5966 outbound telemarketing, 5967 adult content, 5993 cigar stores, 7273 dating and escort services, and 7995 betting. An online peptide storefront is card-absent by definition, so a drug code puts it on that list.
Being on the list changes how the acquirer has to handle the account. The manual requires a merchant with multiple lines of business to assign the high integrity risk code to that line and a separate code to the rest, and it requires each distinct e-commerce site to carry the code that most accurately reflects that site’s activity. The code cannot be averaged away by bundling a peptide catalog into a larger store.
Visa’s Online Pharmacy Guide for Acquirers (June 2016, read September 3, 2026) adds the licensing layer. It states that Visa requires acquirers to register for a High Brand-Risk Acquirer license before boarding a card-not-present internet pharmacy merchant. The guide addresses pharmacies rather than peptides, but it explains the posture an acquirer brings to any healthcare-product merchant in a drug code.
The same guide says why a clean dispute record does not settle the question. It warns acquirers that the “absence of an intellectual property violation or chargeback does not establish its legitimacy.” The code triggers review of what is sold and how it is marketed, not only of how often customers complain.
Mastercard publishes a Quick Reference Booklet with its own MCC definitions and registration programs. Its site refused automated retrieval, so this guide cites only the Visa documents. The two networks’ code lists are closely aligned but not identical.
04 / MISCODING
A softer code is the acquirer breaking its own rule
The first general requirement in Visa’s manual is to “select the MCC that most accurately describes the Merchant’s business.” Describing a peptide storefront as a specialty food store or a generic retailer so that it lands in 5499 or 5999 asks the acquirer to set that requirement aside, and the manual reserves Visa’s right to require corrections when it does.
Miscoding also tends to be short-lived. Visa uses MCC data for risk management, and a storefront whose product pages describe pharmaceuticals under a food or general-retail code is a mismatch that monitoring is designed to surface. When it surfaces, the account is corrected or closed on the acquirer’s terms, and the merchant is now a business that was previously miscoded.
This guide does not advise choosing a code to avoid review. It advises making the accurate code defensible.
05 / WHAT A MERCHANT CAN DO
Describe the business accurately, then make the storefront match
A merchant cannot choose the code, but it controls the two inputs the acquirer reads: the application and the storefront. The application should describe what is sold, to whom, and how, in plain terms. The storefront should say the same thing everywhere the acquirer will look.
- Say what the products are on the application. A description that would surprise a reviewer reading the product pages is the start of a correction.
- Expect a card-absent drug code to bring registration, monitoring, and a reserve conversation, and prepare the evidence a reviewer will ask for.
- Remove the content that contradicts the code you are asking for. A specialty-retail description does not survive product pages that describe effects in people.
- Keep each site’s code honest. Visa requires a separate, accurate code per e-commerce site; one site cannot borrow another’s.
- Record what was reviewed and when. Category decisions get revisited, and a dated record of the storefront at boarding is the merchant’s side of that conversation.
QUESTIONS
Related questions
Can I pick my own merchant category code?
No. Visa’s manual places the assignment with the acquirer and its agents and reserves Visa’s right to require corrections. A merchant influences the outcome only by describing the business accurately and keeping the storefront consistent with that description.
If my store is coded 5999 instead of 5122, am I outside the restricted-business rules?
No. Processor policies such as Stripe’s restricted-businesses list apply by product category and marketing, not by MCC. The code affects network registration and monitoring; the policy review looks at what the site sells and says.
Does a low chargeback rate move a peptide store off the high-risk list?
Not on its own. Visa’s pharmacy guide tells acquirers that the absence of chargebacks does not establish a healthcare-product merchant’s legitimacy. The high integrity risk designation in the manual attaches to the code and the card-absent channel, not to a dispute ratio.
SOURCES
Sources cited
Each source is listed with its class so government authority, agency guidance, enforcement examples, and private policy are never blended into one rule.
MCC definitions, assignment rules, the high integrity risk list for card-absent 5122 and 5912, and Visa’s right to require corrections. Read September 3, 2026.
High Brand-Risk Acquirer license requirement for card-not-present internet pharmacy merchants, and the statement that absence of chargebacks does not establish legitimacy. Read September 3, 2026.