High-Risk Med Spa Payment Processing Guide August 2026
Your med spa needs a high-risk processor for peptides, semaglutide, and ketamine. Compare the best options available. August 2026
TL;DR
5 key points- 01Stripe, Square, and PayPal actively terminate med spa accounts processing semaglutide, peptides, or ketamine, often mid-cycle with funds held
- 02Four structural factors flag your practice as high-risk: service type, chargeback exposure, recurring billing, and regulatory complexity
- 03Compounded semaglutide lost its shortage-based legal basis when the FDA resolved the shortage in February 2025, with the compounding wind-down complete by May 2025; LegitScript certification is now required for GLP-1 payment processing in 2026
- 04Standalone high-risk processors solve the account freeze problem but leave scheduling, EMR, and membership data to sync manually
- 05Decoda connects high-risk payment processing natively to clinical notes, tiered memberships, inventory, and FSA/HSA billing in one workflow
What Is High-Risk Payment Processing for Med Spas?
High-risk payment processing refers to merchant accounts underwritten for businesses that standard processors consider higher-risk. For med spas, that classification has nothing to do with running a shady operation. It's about what's on your service menu.
General-purpose aggregators like Stripe and Square use automated systems to scan transaction data. When terms like semaglutide, tirzepatide, ketamine, or peptide protocols appear, those systems flag the account. As Corepay notes, general-purpose processors freeze or close med spa accounts when weight loss injections or peptide protocols show up in transaction data, often without warning, with funds held for weeks during review.
A high-risk merchant account is underwritten differently from the start. The processor knows your service menu, codes your account accordingly, and builds reserve requirements and chargeback thresholds around that reality.
Why Med Spas Get Flagged as High Risk
Banks and payment processors look at med spas and see a cluster of financial risk factors stacked on top of each other. Processors classify med spas as high risk because of the structural characteristics of the industry itself, not as a reflection of business quality.
Four factors drive this classification:
- Service type: peptides, semaglutide, ketamine, and hormone protocols trigger automated flags regardless of how legally or clinically sound the practice is
- Chargeback exposure: aesthetic outcomes are subjective, and dissatisfied patients dispute charges at higher rates than most retail categories
- Recurring billing: memberships and multi-session packages create more complex dispute scenarios that processors prefer to avoid
- Regulatory complexity: medical oversight requirements vary by state, and Vector Payments estimates that 70% of spas lack a physician affiliation, which is a major underwriting hurdle
Most med spas carry all four factors simultaneously, which creates real exposure with general-purpose processors.
The Regulatory Environment for Peptides and Semaglutide in 2026
The FDA declared the tirzepatide shortage resolved in December 2024 and the semaglutide shortage resolved in February 2025, and enforcement discretion for compounders wound down in stages through May 2025. That removed the shortage-based legal basis for 503A and 503B pharmacies to produce either drug at scale. A 503A pharmacy can still compound for an individual patient where a documented clinical need supports it, but the bulk-compounded, low-cost supply that many programs were built on is gone.
Any merchant still processing payments for compounded semaglutide or tirzepatide is operating outside FDA authorization, and no acquiring bank will knowingly underwrite that exposure. For GLP-1, weight-loss, and prescription-adjacent telehealth models, LegitScript certification is effectively mandatory in 2026. Without it, high-risk processors won't take the account.
Peptides and ketamine carry their own regulatory layers, varying by state and by how the service is structured medically. None of this disqualifies you from getting a merchant account. It does mean your processor needs to understand what you offer before boarding you.
How We Ranked High-Risk Payment Processing Options
Seven criteria shaped how we ranked every option below:
- Service coverage: Does the processor explicitly support peptides, semaglutide, ketamine, and TRT/HRT without automated account freezes?
- Integration with practice operations: Is payment processing connected to scheduling, memberships, clinical documentation, and inventory, or does it sit as a separate tool requiring manual reconciliation?
- Underwriting approach: Dedicated manual underwriting versus automated aggregator risk tools that flag and freeze without notice
- Chargeback protection: Built-in dispute management, not an afterthought
- Recurring billing support: Memberships, packages, and rollovers handled natively
- HIPAA compliance and BAA availability: Required for any processor touching patient transaction data
- Fee structure: Interchange-plus pricing with transparent reserves versus flat-rate aggregator pricing that obscures true cost
General-purpose aggregators score well on fees and ease of setup but fail on nearly everything else for a practice offering high-risk services. The options ranked below were weighted toward processors that understand med spa workflows before they board you.
Best Overall
Decoda is the only option on this list that combines high-risk payment processing with a full clinical and practice management stack purpose-built for elective care. Payment processing is not a bolt-on here. Every transaction connects directly to a patient record, treatment note, membership, and inventory update in a single workflow.
A few things set Decoda apart from standalone processors:
- Built-in high-risk payment processing via Rainforest, supporting peptides, ketamine, semaglutide, and TRT/HRT (does not support medical marijuana or psilocybin due to federal legality constraints)
- Advanced membership configuration with per-item rollover, tiered discounts, and billing cycles including 6-week, 10-week, and 12-week cadences designed for GLP-1 weight loss programs
- FSA/HSA support, Apple Pay for one-time charges, native tip collection, and portable mobile payment processing for off-site appointments
- Calendar-based checkout that ties payment directly to clinical documentation with no manual reconciliation across separate systems
- Automated invoicing with membership billing, package tracking, and deposit management all in one place
For practices offering peptides, ketamine, or semaglutide, Decoda removes the need to stitch together a separate processor, membership tool, and EMR. The payment infrastructure is already underwritten for elective care and wired into every other clinical workflow from day one.
Corepay
Corepay is a specialty processor built for high-risk merchant categories, including med spas, telehealth, and healthcare businesses. Unlike aggregators, it operates with in-house underwriting, so your account is reviewed by a human who understands your service menu before approval.
What They Offer
- GLP-1, peptide, and hormone protocol approval with the MCC coded correctly at boarding
- A recurring billing engine for memberships, prepaid packages, and auto-renew bundles
- Ethoca and Verifi dispute alerts that notify you of incoming chargebacks before they post, giving practices a window to respond before revenue is pulled
- Dedicated account management for aesthetic practices
The limitation is scope. Corepay handles payment processing and nothing else. Scheduling, clinical notes, membership configuration, and inventory all live in separate tools, which means payment data has to be matched manually against everything else. For practices already managing five or six disconnected systems, Corepay adds stability to one piece without reducing the overall fragmentation.
Vector Payments
Vector Payments specializes in high-risk merchant accounts for med spas and wellness practices, using individual underwriting instead of automated aggregator tools. Each account is reviewed for the specific business before approval, which means fewer surprise freezes after boarding.
Here is what they offer:
- Dedicated merchant IDs with manual underwriting, not pooled aggregator accounts
- Dedicated high-risk pricing with rolling reserves required to cover potential chargebacks; rates vary by service mix and chargeback history, so ask for a written quote
- High-risk POS terminal support and mobile payment options for off-site services
This is a reasonable fit for practices that have been declined by standard processors and need a standalone high-risk merchant account set up quickly. The limitation mirrors what you find with Corepay: payment processing is the only thing Vector Payments does. Patient records, membership billing, and clinical documentation all live elsewhere, so transaction data has to be matched manually against the rest of the practice's systems.
Organic Payment Gateways
Organic Payment Gateways is a specialty processor focused on healthcare and wellness businesses, including med spas offering semaglutide, hormone therapy, and aesthetic services. They build tailored payment processing solutions for med spas covering weight loss injections, hormone and testosterone therapies, and medical aesthetic treatments.
What They Offer
- Specialized merchant accounts for GLP-1 and hormone therapy services
- Recurring billing for follow-up treatment schedules and card-on-file management
- US-based account management from application through ongoing support
Good for practices declined by standard processors that need a compliant merchant account for high-risk service categories. Limitation mirrors Corepay and Vector Payments: payments only, no practice management integration.
Stripe / Square / PayPal
Stripe, Square, and PayPal are general-purpose payment aggregators widely used by small businesses across industries. They offer fast account setup with no manual underwriting, broad integrations across e-commerce and scheduling tools, and flat-rate pricing with no rolling reserve requirements. That works for standard retail. For med spas, the picture changes fast.
These aggregators board merchants into shared accounts using automated risk tools. When prescription-adjacent or compounded drug products appear in transaction data, those tools flag and freeze. Stripe, Square, and PayPal have terminated GLP-1 merchants this way: a clinic opens an account, processes for weeks or months, then receives a closure notice for "prohibited activity," with funds held and revenue stopped mid-cycle.
For any practice offering peptides, semaglutide, ketamine, or TRT/HRT, that is a real and active risk.
Feature Comparison Table of High-Risk Payment Processing Options
The table below maps the features that matter most for med spas processing payments for peptides, semaglutide, and ketamine. Standard processors like Stripe, Square, and PayPal decline high-risk merchants outright, while dedicated processors handle the account but stop there. Decoda stands apart by connecting payments to the clinical side of your practice.
Feature | Decoda | Corepay | Vector Payments | Organic Payment Gateways | Stripe / Square / PayPal |
|---|---|---|---|---|---|
Supports Peptides / Semaglutide | Yes | Yes | Yes | Yes | No |
Supports Ketamine / TRT / HRT | Yes | Yes | Yes | Yes | No |
Dedicated High-Risk Merchant Account | Yes | Yes | Yes | Yes | No |
Integrated EMR and Clinical Notes | Yes | No | No | No | No |
Membership and Package Billing | Yes | Yes | No | Yes | No |
FSA / HSA Payment Support | Yes | No | No | No | No |
Inventory Connected to Payments | Yes | No | No | No | No |
Chargeback / Dispute Tools | Yes | Yes | No | No | No |
Upfront Manual Underwriting | Yes | Yes | Yes | Yes | No |
All-in-One Practice Management | Yes | No | No | No | No |
Why Decoda Is the Best High-Risk Payment Processing Option for Med Spas
Standalone processors solve exactly one problem. You get a merchant account that won't freeze when semaglutide shows up in your transaction data, but every payment still has to be matched manually against your EMR, your membership tool, and your inventory system. The fragmentation stays intact.
Decoda removes that tradeoff entirely. High-risk payment processing is built in and underwritten for elective care from day one, and every charge connects directly to a clinical note, a membership balance, an inventory deduction, and an automated follow-up. For a practice running peptides, ketamine, or GLP-1 programs, that means one system carries both the financial risk and the administrative complexity, with nothing left to sort out by hand.
Final Thoughts on High-Risk Payment Processing for Med Spas
Your processor choice affects more than just whether your account stays open. It shapes how much manual reconciliation your team does every week, whether your memberships and clinical notes stay in sync, and how cleanly your practice runs day to day. Standalone high-risk processors solve the first problem. Decoda is built to solve all of it. Grab a short intro call if you want to see the full picture.
Frequently Asked Questions
Which high-risk payment processors actually support peptides, semaglutide, and ketamine without freezing your account?
Corepay, Vector Payments, Organic Payment Gateways, and Decoda all use manual underwriting and support peptides, semaglutide, ketamine, and TRT/HRT from the start. Stripe, Square, and PayPal do not. Those processors run automated risk tools that flag and terminate accounts offering these services, often mid-cycle and without warning.
How do I choose between Corepay, Vector Payments, Organic Payment Gateways, and Decoda for my med spa?
If your only need is a stable merchant account that won't get frozen, any of the three standalone processors will serve that purpose. If your practice runs memberships, tracks inventory, or documents treatments, Decoda connects payments directly to those workflows so nothing requires manual reconciliation across separate systems.
Is Decoda a better fit than Corepay or Vector Payments for practices running GLP-1 or structured wellness programs?
For practices running GLP-1 programs, the difference is billing cycle configuration. Corepay and Vector Payments process the transaction; Decoda also handles the 6-week, 10-week, and 12-week membership cadences those programs require, tied to clinical notes and inventory deductions in the same workflow.
Do I need LegitScript certification to get approved for semaglutide payment processing in 2026?
Yes, for any GLP-1 or prescription-adjacent service. The FDA declared the tirzepatide shortage resolved in December 2024 and the semaglutide shortage resolved in February 2025, and enforcement discretion for compounders wound down in stages through May 2025, removing the shortage-based legal basis for mass-compounded versions. Any processor willing to board a GLP-1 account today will require LegitScript certification before approval.
Can FSA and HSA cards be used for med spa services processed through these payment options?
FSA and HSA payment support is available through Decoda at checkout. The standalone processors on this list (Corepay, Vector Payments, and Organic Payment Gateways) do not list FSA/HSA acceptance as a supported feature, so practices whose patients want to use health spending accounts should verify that capability directly before selecting a processor.
How does Rainforest payment processing differ from Stripe or Square for wellness and elective care practices?
Rainforest uses dedicated manual underwriting, so your account is coded for high-risk services like peptides, ketamine, and semaglutide before your first transaction runs. Stripe and Square use automated aggregator tools that scan transaction data after boarding and terminate accounts offering these services, often mid-cycle with funds held during review.
What happens to my revenue if Stripe or Square freezes my med spa account?
When a general-purpose aggregator flags your account, they typically close it and hold your funds for weeks while their review process runs. That means mid-cycle revenue stops, recurring membership charges fail, and your team has no merchant account to fall back on until the review resolves or you're boarded elsewhere.
Can I take card payments at off-site events or mobile appointments through a high-risk med spa payment processor?
Decoda supports portable mobile payment processing, so providers can collect card payments outside the clinic at events and off-site appointments. Standalone processors like Corepay and Vector Payments offer mobile payment terminals, but those transactions sit separate from your clinical records and membership balances.
How does mandatory payment processing through a practice management platform work, and should I be concerned about losing my existing merchant relationship?
When a platform requires you to use its integrated processor, your existing merchant relationship ends and all transactions route through the platform's underwriting. For practices offering high-risk services like peptides or semaglutide, this is often an advantage because the integrated processor is already coded for those services, whereas your current processor may not be.
What's the best way to handle chargeback disputes for aesthetic services where outcomes are subjective?
Processors with built-in dispute alert tools like Ethoca and Verifi notify you before a chargeback posts, giving you a window to respond with documentation before revenue is pulled. Clinical documentation connected to the payment record, like a treatment note tied directly to the transaction, strengthens your dispute response compared to searching across separate systems.
Does a high-risk med spa merchant account require a rolling reserve, and how does that affect cash flow?
Most dedicated high-risk processors require a rolling reserve, typically a percentage of processing volume held back to cover potential chargebacks. The reserve percentage and hold period vary by processor and your chargeback history, so practices should model the impact on cash flow before committing to a processor, especially if recurring membership billing represents a large share of monthly volume.
What med spa services are still off-limits even with a high-risk payment processor?
Medical marijuana and psilocybin remain prohibited under federal law, so no acquiring bank will underwrite those transactions regardless of which processor you use. Peptides, ketamine, semaglutide (with LegitScript certification), TRT, and HRT are supportable through dedicated high-risk processors like Decoda and the standalone options listed in this guide.
How granular can role-based permissions get in a med spa payment and EMR system?
In Decoda, role-based permissions extend to payment-adjacent actions including deposit waiving, overbooking controls on the scheduling calendar, and access to revenue and performance dashboards. Front desk staff, providers, and administrators can each carry distinct permission sets so sensitive financial data and clinical records are only accessible to the roles that need them.
Should I use a standalone high-risk processor or an integrated med spa platform for peptide and semaglutide billing?
A standalone processor solves the account freeze problem but leaves you matching payment records manually against your EMR, membership tool, and inventory system. An integrated option like Decoda connects the transaction directly to the clinical note, membership balance, and inventory deduction in a single workflow, removing the reconciliation step entirely.
What does electronic prescribing support look like in a platform that also handles high-risk payment processing?
Decoda supports electronic prescribing for controlled substances (EPCS) within the same platform that processes high-risk payments, so prescription workflows and billing stay connected inside a single patient record. Provider activation for EPCS is handled with support from Decoda's engineering team rather than requiring a separate credentialing tool.