This guide covers which business types require certification, how the application process works, what documents to prepare, the standards LegitScript evaluates, common rejection reasons, certification costs, ongoing maintenance requirements, and how certification connects to payment processing access.
Which businesses need certification: Online pharmacies, telemedicine providers, addiction treatment centers, mental health platforms, drug testing services, and supplement retailers each face distinct platform advertising restrictions and payment processing scrutiny that certification directly addresses.
How the application works: LegitScript follows a five-step process: eligibility review, documentation gathering, secure-portal submission, expert review, and certification. Review timelines vary based on application complexity and applicant responsiveness; no fixed estimate exists.
What documents you need: Required materials span six categories: business registration, pharmacy and medical licenses, website and policy documents, ownership and personnel records, compliance and accreditation evidence, and financial documentation. DEA certificates, HIPAA-compliant privacy policies, and affiliate disclosures are among the most frequently required items.
Certification standards, rejection risks, costs, and payments: LegitScript evaluates pharmacy practice, prescription validity, patient privacy, and advertising compliance. Application fees start at $975 per website for healthcare merchants and $1,595 per facility for addiction treatment providers. Certification also directly affects merchant account approval, processing terms, and access to card-not-present acquiring relationships.
What Is LegitScript and Why Does It Matter for Your Business?
LegitScript is a third-party certification and monitoring company founded in 2007 to combat dangerous counterfeit pharmaceuticals sold online. It matters for your business because Google, Meta, and LinkedIn rely on LegitScript to vet advertisers and sellers in highly regulated industries, and payment facilitators, ISOs, and acquiring banks use its merchant-risk solutions to approve high-risk accounts.The sections below cover what LegitScript does, which business categories it certifies, and how certification affects advertising access and payment processing.
What Does LegitScript Actually Do?
LegitScript operates as a compliance verification body that evaluates whether healthcare and regulated-industry merchants meet legal and ethical standards. According to LegitScript, its mission is to “help make the internet and payments ecosystems safer and more transparent.” It assigns classification statuses such as “Rogue,” “Unapproved,” “Unverified,” “Legitimate,” and “Certified” to merchants it reviews, giving platforms and processors a trusted signal for onboarding decisions.Why Do Google, Meta, and Payment Processors Require It?
Google, Meta, and payment processors require LegitScript certification because regulated healthcare advertising and high-risk merchant accounts carry significant fraud and compliance risk. Google restricts telemedicine providers, online pharmacies, and addiction treatment services from advertising without certification. Meta explicitly states it requires LegitScript certification before allowing addiction treatment ads targeting U.S. users. From a payments standpoint, acquiring banks and ISOs use LegitScript’s merchant-risk solutions to satisfy card-network and regulatory due-diligence requirements before approving accounts.What Business Types Does LegitScript Certify?
LegitScript certifies a broad range of healthcare and regulated merchants. Its Healthcare Merchant Certification program covers:- Online pharmacies and wholesalers/distributors
- Telemedicine providers and digital health platforms
- Medical spas and pharmaceutical manufacturers
- Veterinary services and prescription eyeglass/contact-lens merchants
- Price-comparison and discount-pharmacy websites or apps
- Addiction treatment facilities and crisis hotlines
- Brokers and facilitators in the healthcare supply chain
What Happens If Your Business Operates Without LegitScript Certification?
Without LegitScript certification, regulated businesses risk ad account suspension, loss of payment processing, and reduced consumer trust. Google may suspend unauthorized pharmacies that offer prescription drugs without prescriptions or operate outside licensed jurisdictions. For addiction treatment providers, operating without certification means Meta will not permit advertising to U.S. audiences at all. From a payments perspective, the absence of certification can block account approval entirely, since processors rely on it to verify merchant legitimacy before extending acquiring relationships.What Types of Businesses Require LegitScript Certification?
The types of businesses that require LegitScript certification span several regulated healthcare and addiction-related industries. The H3s below cover online pharmacies, telemedicine providers, drug testing services, mental health platforms, nutraceutical retailers, and addiction treatment centers.Does an Online Pharmacy Need LegitScript Certification?
Yes, an online pharmacy needs LegitScript certification to advertise on major platforms and demonstrate compliance to payment processors. LegitScript is a private company monitoring online pharmacies, and its pharmacy certification program adheres to NABP-recognized standards, according to the Journal of Medical Internet Research.The scale of the problem explains why certification matters. A study of 347 U.S. pharmacists published in Medicine Access @ Point of Care found that an estimated 95% of all online pharmacies operate unlawfully, with 58% of pharmacists lacking confidence in identifying illegal sites. Without LegitScript certification, a legitimate online pharmacy risks being grouped with rogue operators by ad platforms and acquiring banks alike.
Does a Telemedicine Provider Need LegitScript Certification?
Yes, a telemedicine provider needs LegitScript certification to run ads on Google and to satisfy platform advertising policies. According to Google Ads Policy Help, telemedicine providers are subject to restrictions on online prescribing, dispensing, and the sale of prescription drugs, and only certified advertisers may run ads in permitted locations.The LegitScript application checklist also reflects telemedicine’s complexity: required documents include practitioner licenses, telemedicine-template information, DEA certificates for controlled substances, a HIPAA-compliant privacy policy, and a test patient account. Partner pharmacies within a telemedicine network must themselves be LegitScript-certified or NABP-accredited.
Does a Drug Testing Service Need LegitScript Certification?
A drug testing service may need LegitScript certification if it operates in a regulated healthcare or addiction-adjacent context and wishes to advertise digitally. SAMHSA classifies workplace drug testing as a prevention and deterrent method within a comprehensive drug-free workplace program, requiring testing to be conducted by an HHS-certified test facility.Because drug testing overlaps with addiction treatment and prescription monitoring, platforms treating it as a restricted health service will require advertisers to demonstrate compliance credentials such as LegitScript certification before approving campaigns.
Does a Mental Health Platform Need LegitScript Certification?
A mental health platform needs LegitScript certification when it prescribes medications, operates as a telemedicine provider, or advertises services that platforms classify as restricted health content. The National Institute of Mental Health notes that most psychotherapy takes place with a licensed mental-health professional, and evidence-based therapies have been shown to reduce symptoms of depression, anxiety, and other mental disorders.Platforms that offer only talk therapy without prescribing may fall outside the core certification requirement. However, those connecting patients with licensed prescribers or dispensing psychiatric medications are squarely within LegitScript’s healthcare merchant scope.
Does a Nutraceutical or Supplement Retailer Need LegitScript Certification?
A nutraceutical or supplement retailer needs LegitScript certification primarily when advertising on platforms that restrict health product claims or when a payment processor requires it as a condition of merchant approval. The FDA does not determine whether dietary supplements are effective before they reach market, according to the National Institutes of Health Office of Dietary Supplements, placing the burden of safety evidence and truthful labeling entirely on the supplement company.Because supplement marketing frequently triggers platform content restrictions, LegitScript certification signals to ad networks and acquiring banks that the retailer meets documented compliance standards, reducing the risk of ad suspension or payment account termination.
Does an Addiction Treatment Center Need LegitScript Certification?
Yes, an addiction treatment center needs LegitScript certification to advertise on both Google and Meta. Meta explicitly states: “Meta requires advertisers who wish to run addiction treatment ads targeting people in the United States to be certified with LegitScript and apply to Meta for permission to advertise,” covering clinical addiction treatment, support groups, crisis hotlines, and online treatment programs.The National Association of Addiction Treatment Providers describes an operational-readiness framework covering facility details, ownership transparency, and liability insurance. Pricing is facility-specific: for 1 to 9 facilities, LegitScript charges a $1,595 one-time application fee and $3,095 annually per facility, with volume discounts available at higher facility counts.
What Are the Steps in the LegitScript Application Process?
The steps in the LegitScript application process are eligibility review, documentation gathering, secure-portal submission, expert review, and certification. The sections below cover what happens at each stage, how long the review takes, and how to handle information requests.What Happens During the Initial Eligibility Review?
The initial eligibility review is LegitScript’s first assessment of whether your business qualifies to apply for certification. LegitScript evaluates your business category, operational scope, and jurisdiction to determine whether you meet baseline requirements before you advance to the documentation phase. Businesses that do not meet eligibility criteria will not proceed further, so verifying your category fit early avoids unnecessary costs.What Happens After You Submit Your Application?
After you submit your application, LegitScript assigns it to an analyst who reviews your documents against its certification standards. The analyst evaluates areas including licensing, legal compliance, prescription practices, privacy policies, advertising claims, and affiliate relationships. If your submission is complete and transparent, the review moves forward without interruption.How Long Does the LegitScript Review and Approval Process Take?
The LegitScript review and approval process takes a variable amount of time, with no fixed estimate available. According to the LegitScript Help Center, review duration depends on the order applications are received, application complexity, applicant responsiveness, and the sufficiency and transparency of the answers provided. In practice, submitting thorough, well-organized documentation is the single most controllable factor in accelerating your timeline.What Happens If LegitScript Requests Additional Information?
If LegitScript requests additional information, you must respond promptly and completely to avoid delays in your review. Analysts may ask for supplemental documents such as updated licenses, ownership records, or clarifications on advertising content. Slow or incomplete responses directly extend your timeline, so treating every information request as urgent is the most effective approach.What Documents Do You Need to Complete a LegitScript Application?
The documents you need to complete a LegitScript application span six categories: business registration, pharmacy or medical licenses, website and policy materials, ownership and personnel records, compliance and accreditation certificates, and financial or payment processing documentation.What Business Registration Documents Does LegitScript Require?
The business registration documents LegitScript requires include an active business registration and evidence of legal formation in every jurisdiction where you operate. According to LegitScript’s public FAQ, required documents may vary by business nature, and analysts may request additional documentation beyond the standard list. Because each application review is unique, no fixed document set applies universally — applicants should treat the official checklist as a baseline, not a ceiling.What Pharmacy or Medical Licenses Does LegitScript Require?
The pharmacy or medical licenses LegitScript requires include current licenses in every jurisdiction of operation, covering pharmacy, wholesaler, and manufacturer licenses where applicable. Telemedicine providers must also submit practitioner licenses and telemedicine-template information. For controlled substances, DEA certificates or country equivalents are required. If recent disciplinary actions exist, evidence supporting their resolution must accompany the submission.What Website and Policy Documents Does LegitScript Require?
The website and policy documents LegitScript requires include a HIPAA-compliant or country-specific privacy policy and current advertising claims. For incomplete websites, wireframes or screenshots substitute for a live site. Applicants operating telemedicine platforms must provide a test patient account. Any compounding-addendum information applies where relevant to pharmacy operations.What Ownership and Personnel Documents Does LegitScript Require?
The ownership and personnel documents LegitScript requires include information on affiliates, wholesalers, distributors, partner pharmacies, provider networks, and marketing partners. Partner pharmacies must be either LegitScript-certified or NABP-accredited. Ownership transparency is a core standard; incomplete disclosure of affiliated entities is a common source of additional information requests during review.What Compliance and Accreditation Records Does LegitScript Require?
The compliance and accreditation records LegitScript requires vary by business category but typically include evidence that the business meets applicable federal and state regulatory standards. For addiction treatment providers, operational-readiness documentation such as facility details, ownership transparency, and liability insurance supports the certification review. Accreditation from a recognized body strengthens an application but does not automatically satisfy LegitScript’s independent evaluation.What Financial and Payment Processing Documents Does LegitScript Require?
The financial and payment processing documents LegitScript requires relate to demonstrating legitimate, verifiable business operations. According to FDIC guidance, high-risk payment-processor relationships require careful due diligence and verification of merchant identities and business practices, which reflects the scrutiny your financial documentation will face. Applicants should be prepared to provide records that substantiate transaction volumes, payment methods, and processor relationships.With a complete document set assembled, the next step is understanding the certification standards your business must meet to pass review.
What Are the LegitScript Certification Standards You Must Meet?
The LegitScript certification standards you must meet span four core areas: pharmacy practice, prescription validity, patient privacy and data security, and advertising compliance. Each standard mirrors federal regulatory requirements that govern licensed healthcare merchants.What Pharmacy Practice Standards Does LegitScript Enforce?
The pharmacy practice standards LegitScript enforces require that every pharmacy operate with active state-board licensure, verified DEA registration for controlled substances, and documented dispensing protocols. Partner pharmacies must be LegitScript-certified or NABP-accredited. According to the DEA’s Electronic Code of Federal Regulations, a controlled substance prescription must be issued for a legitimate medical purpose by a practitioner acting within the usual course of professional practice, with corresponding responsibility assigned to the dispensing pharmacist.What Prescription Requirements Does LegitScript Evaluate?
The prescription requirements LegitScript evaluates confirm that medications are only dispensed following a valid, patient-specific prescription from a licensed practitioner. LegitScript reviews telemedicine-template information, practitioner licenses, and test patient accounts to verify that no prescriptions are issued without a documented clinical encounter. Dispensing without a valid prescription is a primary disqualifier in the certification review.What Patient Privacy and Data Security Standards Does LegitScript Review?
The patient privacy and data security standards LegitScript reviews require a HIPAA-compliant privacy policy, secure communications infrastructure, and protected data storage. According to HHS, HIPAA protects telehealth appointments, messages, and related health and billing information, with OCR enforcing compliance; additionally, 42 CFR Part 2 imposes written-consent requirements for substance-use-disorder treatment records. LegitScript lists privacy as one of its named core standards alongside licensing, transparency, and advertising.What Advertising and Marketing Compliance Does LegitScript Assess?
The advertising and marketing compliance LegitScript assesses requires that all health claims be substantiated and consistent with applicable law. The FTC states that companies must support their advertising claims with solid proof, particularly businesses marketing drugs, dietary supplements, contact lenses, and other health-related products. LegitScript reviews current advertising materials during the application and monitors them continuously after certification, making unsupported health claims a common source of application delays.Meeting these four standards positions a healthcare merchant as a low-risk, verifiable partner for payment networks and ad platforms.
What Are the Most Common Reasons LegitScript Applications Get Rejected?
The most common reasons LegitScript applications get rejected include incomplete documentation, non-compliant website content, unlicensed personnel or operations, and prior regulatory violations. Each issue prevents LegitScript analysts from verifying that a business meets its core certification standards.Can Incomplete Documentation Cause a LegitScript Denial?
Yes, incomplete documentation can cause a LegitScript denial. LegitScript’s official checklist requires active business registration, current licenses for every jurisdiction of operation, DEA certificates for controlled substances, a HIPAA-compliant privacy policy, and affiliate or partner information. Missing any required item gives analysts insufficient grounds to approve certification. According to LegitScript’s public FAQ, required documents vary by business type and analysts may request additional materials, meaning gaps compound delays and can end in outright rejection. In practice, incomplete submissions are among the most preventable denial reasons, making a thorough pre-submission document audit essential.Can Non-Compliant Website Content Cause a LegitScript Denial?
Yes, non-compliant website content can cause a LegitScript denial. LegitScript evaluates advertising claims, prescription-drug representations, and privacy disclosures directly on the applicant’s website. The FTC requires that companies support health-related advertising claims with solid proof, covering food, over-the-counter drugs, dietary supplements, and contact lenses. Unsubstantiated claims, missing prescription requirements, or an absent privacy policy each signal non-compliance. Applicants should audit every page for accuracy and regulatory alignment before submitting.Can Unlicensed Personnel or Operations Cause a LegitScript Denial?
Yes, unlicensed personnel or operations can cause a LegitScript denial. LegitScript requires current practitioner licenses for telemedicine providers, pharmacy licenses for dispensing operations, and evidence that partner pharmacies are either LegitScript-certified or NABP-accredited. Operating without the required licensure in each jurisdiction where services are offered constitutes a direct violation of LegitScript’s licensing and business-registration standard. Any gap between a provider’s operational scope and its documented licenses will trigger a denial.Can Prior Regulatory Violations Cause a LegitScript Denial?
Yes, prior regulatory violations can cause a LegitScript denial. LegitScript’s standards include explicit evaluation of prior discipline and compliance history. Applicants with unresolved violations must submit evidence supporting resolution of recent discipline. The FTC case against Mercury Marketing illustrates the regulatory exposure LegitScript seeks to screen out: defendants allegedly impersonated addiction treatment clinics in Google search ads, resulting in civil penalties and federal injunctions. Unresolved enforcement actions make certification approval unlikely without documented remediation.How Much Does LegitScript Certification Cost?
LegitScript certification cost varies by business type, with healthcare merchant and addiction treatment certification each following a separate pricing structure. The sections below cover both fee schedules, including application fees, annual renewal costs, and optional expedited processing.What Is the Cost of LegitScript Healthcare Merchant Certification?
The cost of LegitScript Healthcare Merchant Certification is $975 per website for the application fee and $2,150 per website annually for renewal. An optional expedited processing add-on costs $2,500 and guarantees review begins within two business days. According to LegitScript’s Healthcare Certification page, fees apply per website, so businesses operating multiple web properties pay each fee for every site certified.What Is the Cost of LegitScript Addiction Treatment Certification?
The cost of LegitScript Addiction Treatment Certification is tiered by facility count, with both a one-time application fee and an annual renewal fee per unique facility. According to the LegitScript Help Center, certification applies facility-by-facility even under common ownership, and volume discounts may be available.| Facility Count | Application Fee | Annual Fee |
| 1–9 | $1,595 | $3,095 |
| 10–24 | $1,495 | $2,775 |
| 25–49 | $1,395 | $2,550 |
| 50–99 | $1,195 | $2,350 |
| 100+ | $1,075 | $2,125 |
How Do You Maintain LegitScript Certification After Approval?
Maintaining LegitScript certification requires ongoing compliance after initial approval. The three areas this section covers are annual renewal fees and requirements, continuous monitoring practices LegitScript conducts, and reportable business changes that can affect your certified status.What Annual Renewal Requirements Does LegitScript Have?
The annual renewal requirements LegitScript has include paying a recurring fee and demonstrating continued compliance with its certification standards. For healthcare merchants, LegitScript publishes an annual fee of $2,150 per website. Addiction treatment providers pay annual fees on a per-facility basis, ranging from $3,095 for single-facility operators down to $2,125 for those with 100 or more facilities, according to LegitScript’s published pricing. Beyond payment, certified businesses must continue meeting all original standards covering licensing, legal compliance, privacy, advertising, and prescription validity. Renewal is not a formality; any lapse in documented compliance can jeopardize your certified status.What Ongoing Monitoring Does LegitScript Conduct After Certification?
Ongoing monitoring LegitScript conducts after certification includes continuous review of your website, advertising, and business practices. LegitScript uses the designation “LegitScript Monitored” to indicate active post-certification surveillance, and its classification system can reclassify a previously certified business as “Unapproved” or “Rogue” if violations are identified. This monitoring covers advertising claims, website content, and adherence to licensing requirements across all operating jurisdictions. Ongoing surveillance is one of the reasons Google, Meta, and payment partners treat LegitScript certification as a credible, living signal of compliance rather than a one-time credential.What Changes to Your Business Must You Report to LegitScript?
The changes to your business that you must report to LegitScript include any modifications that affect the accuracy of your original application. Reportable changes typically include new locations or facilities, new or lapsed licenses, changes in ownership or key personnel, new affiliate or marketing-partner relationships, and updates to your website or advertising. LegitScript’s official checklist requires transparency around affiliates, wholesalers, distributors, partner pharmacies, provider networks, and marketing partners, meaning material changes in any of these relationships require disclosure. Proactively reporting changes reduces the risk of a compliance violation being flagged during routine monitoring.How Does LegitScript Certification Affect Your Ability to Accept Payments?
LegitScript certification affects your ability to accept payments by signaling to acquiring banks, payment processors, and card networks that your business meets verified compliance standards. Without it, healthcare and addiction treatment merchants are routinely declined or terminated by mainstream processors.How Does Certification Influence Merchant Account Approval?
LegitScript certification influences merchant account approval by reducing the compliance friction that causes banks to reject high-risk healthcare merchants. The National Association of Boards of Pharmacy confirms that card brands updated their requirements for pharmacy merchants accepting card-not-present transactions, and that banks or payment processors may require accreditation to comply with those card-brand policies.Visa reports a 5x increase in acquirer remediation and terminations for merchant noncompliance between 2020 and 2024, which illustrates how seriously networks now enforce these standards. Certification transforms your application from an unverifiable risk into a documented, reviewable compliance record.
How Do Card Networks Treat Uncertified Healthcare Merchants?
Card networks treat uncertified healthcare merchants as elevated-risk entities subject to enhanced scrutiny, performance monitoring, and potential termination. Visa requires acquirers to conduct compliance checks before any merchant can accept Visa payments, with higher-risk merchants facing enhanced registration requirements.The FFIEC notes that higher-risk merchants routinely rely on third-party processors because they lack a direct bank relationship, and that processors pose greater fraud risk when they cannot verify merchant identities and business practices. Certification provides exactly the identity and compliance verification that acquiring banks need to open accounts.
How Does LegitScript Certification Affect Payment Processing Fees and Terms?
LegitScript certification affects payment processing fees and terms by improving the risk profile underwriters use to set rates and reserves. FDIC guidance directs financial institutions to conduct careful due diligence and close monitoring for high-risk processor relationships, including verification of merchant business practices and chargeback history.A verified compliance record can reduce reserve requirements, lower assessed risk tiers, and open access to processors that refuse uncertified merchants entirely. For most healthcare merchants, the certification cost is modest relative to the improved account terms it can unlock.