This guide covers what LegitScript certification involves, how long the process realistically takes by business type, what documents and steps are required, what causes delays, how much it costs, and how certification connects to high-risk payment processing.
LegitScript certifies a wide range of healthcare-adjacent business types, each with distinct eligibility rules and documentation requirements. Understanding which category applies to your business is the foundation for estimating your timeline accurately.
Realistic timeframes vary significantly by business type, from 4 to 8 weeks for straightforward pharmacies to 6 to 12 weeks for CBD and hemp applicants, with complex multi-facility operations often taking 2 to 4 months. LegitScript itself publishes no official time estimate, so industry benchmarks and preparation quality are the primary planning tools available.
Delays most often trace back to incomplete applications, compliance history issues, and business complexity. Knowing which factors introduce friction lets applicants control what they can before submitting.
Certification also carries direct financial consequences: Visa and Mastercard require it for card-not-present transactions in regulated healthcare categories, and platforms including Meta and Google mandate it before approving ads. For high-risk businesses, certification is the single credential that unlocks both advertising access and merchant account approval.
What Is LegitScript Certification?
LegitScript certification is a recognized compliance credential that allows regulated businesses to advertise on major platforms and accept digital payments. The sections below cover which business types require it and what LegitScript verifies before issuing approval.What Industries or Business Types Require LegitScript Certification?
The industries that require LegitScript certification include online pharmacies, telemedicine providers, medical spas, digital health platforms, pharmaceutical manufacturers, prescription eyewear merchants, veterinary services, wholesalers, distributors, brokers, and facilitators. Addiction treatment centers, mutual-support groups, and crisis hotlines also require it, as do Hemp and CBD product sellers. According to a June 19, 2025 article by L7 Creative, approval can take anywhere from 4 to 8 weeks, depending on business complexity and how quickly required documents are submitted.What Does LegitScript Actually Verify Before Certifying a Business?
LegitScript verifies licenses, business registration details, DEA authorization where applicable, privacy policies, affiliate and partner information, and product or service descriptions. For addiction treatment applicants, it also reviews facility records, ownership documentation, insurance, practitioner credentials, staff information, and domain details. Hemp and CBD applicants may be required to submit product samples for laboratory testing. This multi-layer review ensures that only compliant, transparent businesses receive certification.How Long Does the LegitScript Certification Process Take?
LegitScript does not publish a fixed timeline; review length varies by business type, application complexity, and applicant responsiveness. The sections below break down realistic timeframes for online pharmacies, telemedicine providers, addiction treatment centers, CBD and hemp businesses, and nutraceutical sellers.How Long Does LegitScript Certification Take for Online Pharmacies?
LegitScript certification for online pharmacies takes an indeterminate amount of time because LegitScript states that “each application review is unique” and provides no official time estimates. Industry sources place the typical range at 4 to 8 weeks for straightforward applications, while more complex pharmacies may take 2 to 4 months. Certification is also a hard prerequisite for advertising: Meta requires online pharmacies to hold active LegitScript certification before running prescription-drug ads, and advertisers must target only eligible countries where they are certified and users aged 18 or older.How Long Does LegitScript Certification Take for Telemedicine Providers?
LegitScript certification for telemedicine providers follows the same five-step process as other healthcare merchants: eligibility check, documentation, application submission, expert review, and certification. Documentation requirements include licenses, business-registration details, DEA authorization where applicable, privacy policy, and affiliate information, with a $975 application fee and $2,150 annual fee per website. Visa mandated that all pharmacy merchants and telemedicine providers processing card-not-present transactions be certified by a recognized organization like LegitScript as of June 2017. As Roman Health Founder Zachariah Reitano notes, “I don’t see why anyone would not get LegitScript-certified. It is an important symbol of trust and credibility.”How Long Does LegitScript Certification Take for Addiction Treatment Centers?
LegitScript certification for addiction treatment centers takes an unspecified amount of time; LegitScript officially states it cannot provide time estimates because each review is unique. An expedited option exists that starts review within 2 business days for an additional $2,500 per application. According to a 2024 Behave Health analysis, annual fees run $3,095 for operators with nine or fewer facilities and $1,070 for small practices with no more than three practitioners sharing one website. Delays most commonly occur when applicants respond slowly to reviewer requests. Only in-person addiction treatment, mutual-support groups, and crisis hotlines are eligible; lead generators and sober-living homes are not.How Long Does LegitScript Certification Take for CBD and Hemp Businesses?
LegitScript certification for CBD and hemp businesses typically takes 6 to 12 weeks in total. According to Bloom Consulting Agency’s published phase breakdown, the process divides as follows:| Phase | Estimated Duration |
| Pre-assessment | 1–2 weeks |
| Application submission | 1 week |
| Expert review | 2–6 weeks |
| On-site evaluation (select businesses) | 1–2 weeks |
| Certification decision | 1 week |
How Long Does LegitScript Certification Take for Nutraceutical or Supplement Sellers?
LegitScript certification for nutraceutical or supplement sellers follows the same variable-timeline framework as other healthcare merchant categories, with no official time estimate published. The review timeline depends on queue order, application complexity, applicant responsiveness, and the sufficiency and transparency of submitted answers. Industry estimates generally place completion at 6 to 12 weeks for well-prepared applicants. Supplement sellers should note that FDA regulations exclude CBD and THC-derived ingredients from the dietary supplement definition under the FD&C Act, which may affect documentation requirements if products contain those ingredients.What Are the Steps in the LegitScript Certification Process?
The steps in the LegitScript certification process are eligibility confirmation, documentation gathering, application submission, expert review, and certification. Each stage builds on the last, and how thoroughly you complete each one directly affects how quickly you move through the pipeline.What Happens During the LegitScript Application Submission Stage?
The LegitScript application submission stage requires you to open an account, pay the nonrefundable application fee, and upload all required documentation in one organized package. According to LegitScript’s published healthcare program materials, required documents include licenses, business-registration details, DEA authorization where applicable, privacy policy, affiliate and partner information, and product or service descriptions. Submitting a complete, accurate package from the start is the single most controllable factor in keeping your timeline short.What Happens During the LegitScript Document Review Stage?
The LegitScript document review stage is where a compliance expert examines everything submitted against LegitScript’s published Certification Standards. Reviewers assess whether your licenses are current, your business practices are disclosed, and your documentation is sufficiently transparent. LegitScript may issue follow-up information requests during this stage. Responding to those requests promptly is critical because slow applicant responses are a documented cause of delays.What Happens During the LegitScript Compliance Evaluation Stage?
The LegitScript compliance evaluation stage is a deeper assessment of how your business operations, marketing practices, and practitioner credentials align with regulatory requirements. For certain businesses, this stage may include an on-site evaluation. Bloom Consulting’s published timeline breakdown estimates the review phase alone at 2 to 6 weeks, with on-site evaluations adding another 1 to 2 weeks for businesses that require them.What Happens After LegitScript Approves or Denies Your Application?
After LegitScript approves an application, the business accepts certification and pays the first annual fee to activate its certified status. If denied, the application closes and the nonrefundable fee is forfeited. LegitScript’s official materials confirm no approval-rate figures are published, and each outcome depends entirely on whether the submitted documentation met its Certification Standards.What Documents Are Required to Apply for LegitScript Certification?
The documents required to apply for LegitScript certification vary by business type but follow a consistent framework across healthcare, addiction treatment, and CBD programs. Core requirements include business registration details, licenses, privacy policies, affiliate and partner information, and product or service descriptions.Healthcare and Pharmacy Document Requirements
Healthcare and pharmacy applicants must submit licenses, business-registration details, DEA authorization where applicable, a privacy policy, affiliate and partner information, and product or service descriptions. LegitScript’s published five-step process begins with eligibility verification and moves directly into documentation, making thorough document preparation the single most controllable factor in reducing review time.Addiction Treatment Document Requirements
The documents required for addiction treatment certification cover eight distinct categories: facility information, ownership or lease documentation, insurance records, licensure, practitioner credentials, DEA authorization, staff information, and domain details. Given the depth of this checklist, incomplete submissions in any one category are among the most common causes of review delays.CBD and Hemp Document Requirements
CBD certification documents include either a product questionnaire or a website questionnaire, depending on whether the applicant is certifying individual products or an entire site selling 100% LegitScript-certified CBD products. LegitScript may also require product samples for laboratory testing, which adds a physical preparation step that healthcare applicants do not face. With a clear picture of required documents, the next consideration is which factors most commonly cause the process to take longer than expected.What Factors Can Delay LegitScript Certification Approval?
Several factors can delay LegitScript certification approval, including incomplete applications, compliance history issues, and business complexity. The H3s below cover each delay factor in detail.Does an Incomplete Application Delay LegitScript Certification?
Yes, an incomplete application delays LegitScript certification. LegitScript’s review timeline depends on the sufficiency and transparency of answers provided, meaning gaps in documentation require back-and-forth communication that extends the queue. Required materials include licenses, business-registration details, DEA authorization where applicable, a privacy policy, and affiliate and partner information. Missing any of these forces reviewers to pause and request supplemental documentation, adding weeks to the process. Submitting a thorough, complete application from the start is the single most controllable factor in how quickly certification moves forward.Can a History of Compliance Violations Slow Down LegitScript Certification?
Yes, a history of compliance violations can slow down LegitScript certification. Reviewers must scrutinize past violations more carefully against current Certification Standards, which increases the depth of the evaluation required. Visa’s merchant data manual specifically addresses high-integrity risk affiliates linking or forwarding cardholders to other websites, placing such activity within transaction-compliance requirements that LegitScript reviewers must assess. Businesses with prior compliance issues should proactively document remediation steps and current practices before applying to reduce reviewer back-and-forth.Does Business Complexity Affect How Long LegitScript Certification Takes?
Yes, business complexity directly affects how long LegitScript certification takes. Operations with multiple facilities, practitioners, affiliated websites, or complex ownership structures require more documentation and deeper expert review than single-site businesses. According to Corepay, the certification process typically takes 2 to 4 months, influenced by complexity, application completeness, responsiveness, and answer quality, though a partner-assisted path can shorten this to as little as 3 weeks. Simpler, well-documented businesses move through the queue faster; highly complex organizations should plan for the longer end of that range.How Much Does LegitScript Certification Cost?
LegitScript certification costs vary by program type, with separate fees for the application and ongoing annual monitoring. The sections below cover healthcare, addiction treatment, and expedited processing pricing.Healthcare Merchant Certification Fees
Healthcare merchant certification costs $975 per website for the application and $2,150 per website annually, according to LegitScript’s December 2024 fact sheet. The application fee is nonrefundable, regardless of the outcome. These fees apply to pharmacies, telemedicine providers, medical spas, digital health platforms, and similar businesses covered under the healthcare program.Addiction Treatment Certification Fees
Addiction treatment certification fees are $3,095 annually for operators certifying nine or fewer facilities and $1,070 annually for small practices with no more than three practitioners sharing one website, according to Behave Health’s October 2024 breakdown. The process follows five steps: opening an account, paying the application fee, submitting documentation, undergoing review, and paying the first annual fee upon acceptance.Expedited Processing Fees
LegitScript’s expedited processing option costs an additional $2,500 per application. This fee starts review within 2 business days of submission rather than placing the application in standard queue order. For businesses with time-sensitive advertising or payment processing deadlines, expedited processing is often the most practical path to faster certification.Can LegitScript Certification Be Denied or Revoked?
Yes, LegitScript certification can be denied or revoked. Applications fail when businesses do not meet published compliance standards, and existing certifications are revoked when certified merchants violate ongoing requirements.What Reasons Cause LegitScript to Deny a Certification Application?
The reasons LegitScript denies a certification application include failure to meet its published Certification Standards, inability to demonstrate required licensure, insufficient documentation, and lack of transparency in answers during the expert review stage. LegitScript’s official terms and conditions use predicates such as “deny,” “revoke,” and “remediate,” confirming that denial is a formal outcome within its review process. Businesses selling ineligible products or operating in excluded categories, such as lead generators or sober-living homes in the addiction-treatment program, are declined regardless of documentation quality. An incomplete or evasive application is one of the most common causes, making thorough preparation the single most important step an applicant can take before submitting.What Actions Can Cause LegitScript to Revoke an Existing Certification?
The actions that cause LegitScript to revoke an existing certification include non-compliance with ongoing monitoring requirements, changes to licensed status, illegal or deceptive online marketing practices, and failure to renew with current documentation. Renewal reviews examine documentation, staff information, licensure, and online marketing practices, meaning any lapse in these areas after certification is granted can trigger revocation. LegitScript’s published terminology explicitly lists “revoke,” “monitor,” and “remediate” as active functions within its certification framework. Maintaining certification requires the same level of compliance discipline as earning it initially, and businesses that treat certification as a one-time event rather than an ongoing obligation are most vulnerable to losing it.Why Do Payment Processors Require LegitScript Certification?
Payment processors require LegitScript certification because Visa and Mastercard recognize it as part of high-risk merchant registration and compliance monitoring, giving processors a verified signal that a business meets regulatory standards before approving card-not-present transactions.Why Visa and Mastercard Mandate LegitScript for High-Risk Merchants
Visa and Mastercard require LegitScript certification for high-risk merchants, particularly those processing card-not-present transactions in regulated healthcare categories. According to LegitScript’s 2018 announcement, in June 2017, Visa required all pharmacy merchants and telemedicine providers processing card-not-present transactions to be certified and monitored by a recognized certification organization such as LegitScript. Relevant transactions fall under MCC 5122 and MCC 5912. Without certification, acquiring banks face liability for onboarding uncompliant merchants, making LegitScript a hard prerequisite rather than a best practice.Why Online Pharmacies and Telemedicine Providers Are Classified as High-Risk
Online pharmacies and telemedicine providers are classified as high-risk merchants because they operate in card-not-present environments where counterfeit products, prescription fraud, and unverified dispensing pose direct financial and regulatory exposure to payment networks. LegitScript certifies that these businesses are licensed, compliant, and monitored, reducing chargeback risk and fraud exposure for processors. This classification is why acquiring banks and payment processors consistently require active certification before approving merchant accounts in these categories.How LegitScript Certification Unlocks Payment Processing Access
LegitScript certification unlocks payment processing access by serving as a compliance credential that processors, card networks, and platforms accept as proof of legitimacy. LegitScript describes its certification as “a recognized seal of approval that enables businesses to showcase their compliance, unlock opportunities to advertise, and accept digital payments.” For high-risk businesses in telemedicine, online pharmacy, and Hemp and CBD, certification is often the single missing requirement blocking merchant account approval. Obtaining it transforms a previously unprocessable business into an approvable one.How Does LegitScript Certification Affect Payment Processing for High-Risk Businesses?
LegitScript certification affects payment processing by signaling verified compliance to card networks and payment processors, making approval significantly more accessible for high-risk merchants. The sections below cover telemedicine and Hemp and CBD merchant account approvals specifically.How Does LegitScript Certification Help Telemedicine Businesses Get Approved for Payment Processing?
LegitScript certification helps telemedicine businesses get approved for payment processing by satisfying the compliance requirements that Visa and Mastercard impose on high-risk merchants. Both card networks recognize LegitScript certification as part of high-risk merchant registration and ongoing compliance monitoring. Telemedicine providers processing card-not-present transactions fall under merchant category codes MCC 5122 and MCC 5912, which require certified status before processors will approve an account. According to LegitScript, certified merchants can showcase compliance, unlock advertising opportunities, and accept digital payments — outcomes that are otherwise blocked for uncertified telemedicine operators. For telemedicine businesses, LegitScript certification is not optional infrastructure; it is the direct gateway to functional payment processing.How Does LegitScript Certification Impact CBD and Hemp Merchant Account Approvals?
LegitScript certification impacts Hemp and CBD merchant account approvals by providing processors with the compliance documentation they need to onboard an otherwise high-risk seller. Without certification, most acquirers will decline Hemp and CBD merchants outright due to the category’s regulatory complexity. Meta requires active LegitScript certification and written authorization for Hemp and CBD advertisers, restricting targeting to the United States and prohibiting health or medical claims. This dual pressure, from both payment networks and advertising platforms, makes certification the central compliance credential Hemp and CBD merchants need to operate and scale digitally.How Does Getting LegitScript Certified Relate to High-Risk Payment Processing Solutions?
LegitScript certification and high-risk payment processing are directly connected. Certification satisfies the compliance requirements that card networks and payment processors impose on regulated healthcare merchants before approving accounts or enabling advertising.Can a High-Risk Payment Processor Like 2Accept Help Businesses Navigate LegitScript Requirements?
Yes, a high-risk payment processor like 2Accept can help businesses navigate LegitScript requirements. According to LegitScript, Visa and Mastercard recognize LegitScript certification as part of high-risk merchant registration and compliance monitoring, and certified merchants under MCC 5122 and MCC 5912 can unlock advertising opportunities and accept digital payments. Processors experienced with regulated industries understand the card-network standards and compliance expectations that apply to pharmacies, telemedicine providers, and Hemp and CBD merchants. 2Accept specializes in serving these high-risk sectors, offering payment solutions with dedicated payment expert support, website marketing screening, and fraud and chargeback management tailored to regulated industries.What Are the Key Takeaways About How Long LegitScript Certification Takes?
The key takeaways about how long LegitScript certification takes are that no guaranteed timeline exists, but preparation directly controls speed. LegitScript does not publish official time estimates because every application is unique. Industry estimates range from 4 to 8 weeks for straightforward businesses to 2 to 4 months for complex ones. The most actionable conclusions from this article are:- Submit a complete application with all licenses, documentation, and disclosures ready before starting.
- Respond to reviewer requests immediately, since slow responses are the single most controllable delay factor.
- Use the expedited option ($2,500) if timeline pressure is critical.
- Pair certification progress with a high-risk payment processor early, so merchant account approval does not create a second bottleneck after certification is complete.