Answer extracted from the B2B Vault: The Biz To Biz Podcast podcast — listen to the full episode below.
What documentation is required from a merchant applying for LegitScript certification?
Applicants must provide their website, a comprehensive list of contracted doctors or telehealth companies, and complete pharmacy information including licenses and accreditation status. Additional requirements include DEA certificates for controlled substances, HIPAA-compliant privacy policies, and country-equivalent registration for international operations. Wireframes or screenshots work if your website is still under development.
LegitScript certification demands a complete picture of your operations. The foundation starts with your digital presence—whether that's a fully launched website or mockups if you're still building. This matters because regulators and payment processors need to see exactly what you're offering before approving your application.
The contracted provider documentation is one of the heaviest lifts in most applications. You'll need names, contact information, and proof of legitimate relationships with every doctor or telehealth company you partner with. This isn't just a courtesy check—LegitScript verifies these contracts to ensure you're working with licensed, credentialed practitioners, not unvetted individuals operating in gray zones.
Pharmacy records and regulatory proof
If pharmacy is part of your model, licensing and accreditation details become non-negotiable. You must document state pharmacy licenses, National Board of Pharmacy accreditation status, or existing LegitScript certification if the pharmacy is already enrolled. This layered verification protects the entire supply chain—from prescribing to dispensing.
For any merchant handling controlled substances, DEA registration certificates are mandatory. This is where Angela Salter explains the stricter requirements for compounds that fall under federal oversight. If you're working with compounded medications, a compounding addendum must accompany your application, documenting exactly what you're manufacturing and under what 503A or 503B licensing framework.
Privacy and compliance documentation rounds out the core submission. A HIPAA-compliant privacy policy is essential if you're handling patient health information. This isn't boilerplate—it must clearly outline how you collect, use, store, and protect sensitive data.
International operations and development flexibility
Operating globally? You'll need to provide country-equivalent registration or licensing if you serve patients outside the U.S. Each jurisdiction has its own rules, and LegitScript requires proof that you're compliant where you operate.
One practical flexibility: if your website isn't live yet, wireframes or detailed screenshots are acceptable. This removes a major barrier for new merchants—you don't need a fully functional platform to start the certification process, just a clear vision of what you're building.
"We certify based on current applicable laws and regulations, not what a committee thinks might be true in a year or two."
Angela Salter — Vice President of Enterprise Certification Sales and Partnerships at LegitScript. Angela oversees enterprise customer onboarding and account management for certified merchants, while managing critical relationships with ad platforms and card brands that require LegitScript certification for telemedicine and pharmacy operations.
Beyond the checklist itself, the full episode covers the review timeline and what happens if key documentation is missing or incomplete—details that can make the difference between a smooth approval and months of back-and-forth requests.
See also
What are the primary reasons LegitScript rejects certification applications?
Applications are rejected for products that fall outside what is legally sellable, such as peptides or impermissible medications like tirzepatide when mixed with other compounds that create compliance conflicts.
What happens to merchants placed on the Visa and MasterCard match list?
Once on the match list, the chance of getting credit card processing again is slim to none, and merchants remain on the list for five years, creating a severe barrier to future payment processing.
How does LegitScript treat websites that claim products are research-only while marketing them for human consumption?
If a website labels a product as research use only on the bottle but the entire page discusses fat loss, recovery, anti-aging, or longevity, the label and marketing message must be consistent and compliant.
Key takeaways
- Submit your website (or wireframes if under development), contracted provider lists, and pharmacy licensing documentation.
- DEA certificates are mandatory for any merchant handling controlled substances or compounded medications.
- HIPAA-compliant privacy policies are required if you collect or store patient health information.
- International merchants must provide country-equivalent registration or licensing proof for each jurisdiction served.