Research Use Only (RUO) Payment Processing: A Compliance Reference

Three authorities, one test

An RUO business is evaluated by three separate parties, and merchants usually treat them as three unrelated problems. They are not. The FDA determines a product's intended use from the totality of the circumstances — labeling, advertising, and promotional claims taken together. Under the federal analogue provisions, courts assessing whether a substance was intended for human consumption look past disclaimers to marketing, pricing, and packaging. And an acquiring bank underwriting your account reviews the same public surface: your site, your catalog, your claims.

Three authorities, three bodies of law, one shared method. None of them treats your stated intent as decisive, because all three exist precisely to catch businesses whose stated intent differs from their evident one. Once you see that the FDA test and the underwriting review are asking the same question of the same evidence, the payments outcomes stop looking arbitrary.

What the RUO label actually does

The phrase has a specific regulatory home. Under 21 CFR 809.10(c)(2)(i), an in vitro diagnostic product in the laboratory research phase carries the statement: 'For Research Use Only. Not for use in diagnostic procedures.' That labeling supports an exemption from certain requirements that would otherwise attach.

The exemption is conditional, and the condition is the part most sellers miss: it applies only where the product is not represented as an effective diagnostic device. Apply an RUO label to something promoted for clinical or diagnostic use and the label does not save you — it becomes part of the problem, because a product labeled one way and sold another is misbranded. The label is a description that must be true, not a shield that makes other statements safe.

Why 'not for human consumption' is not a shield

The same logic runs through the analogue provisions, and it is where sellers of research chemicals most often go wrong. A substance that is structurally or pharmacologically similar to a Schedule I or II drug is treated as a controlled substance where it is intended for human consumption. Sellers read that as a disclaimer requirement. It is not.

Courts have consistently declined to let a disclaimer settle the question, weighing instead the marketing, the pricing, the advertising, and whether the seller knew or should have known the product would be ingested. A boilerplate line at checkout carries little weight against a catalog that reads like a consumer product.

This is the practical failure mode: the disclaimer is treated as the compliance work rather than as one true statement among many that must all be consistent. What contradicts it is rarely subtle.

FDA enforcement follows the same reasoning and names the same evidence. Warning letters to sellers of research peptides and similar products typically allege that the products are unapproved new drugs under section 505(a) of the Federal Food, Drug, and Cosmetic Act and misbranded under section 502 — and they reach that conclusion by quoting the seller's own public material back at them. The triggers recur often enough to work as a checklist.

• Dosage guidance, reconstitution instructions, or suggested administration protocols of any kind.
• Therapeutic, curative, or physique claims — including in blog posts, FAQs, and meta descriptions.
• Testimonials or reviews describing personal results, including ones you did not write.
• Bundling or cross-selling injection supplies such as bacteriostatic water, syringes, or vials.
• Imagery showing human use, and unit sizes or pricing aligned to personal rather than laboratory quantities.
• Affiliate, influencer, or paid ad copy making claims your own site carefully avoids.

Merchant category codes: who actually assigns them

Laboratory reagents and research chemicals generally fall under MCC 5169, chemicals and allied products. The most commonly misunderstood fact about that code is that the merchant does not choose it. Under the card network rules the acquirer assigns the MCC, and it must be the code that most accurately describes the merchant's primary business. Where a merchant genuinely operates multiple lines, the acquirer either assigns the code matching the highest sales volume or establishes separate codes per line.

This is not a formality, and it explains underwriting behaviour that otherwise reads as excessive caution. Miscoding is an exposure carried by the acquirer, not the merchant: Visa monitors coding accuracy, can assess acquirers that persistently misclassify, and reserves the right to require correction of inaccurate MCC data. An acquirer interrogating how your business is described is protecting its own position.

Two consequences follow. First, a provider offering to code you into a friendlier category to secure an approval is proposing something that puts the account at risk — corrections happen later, and the merchant is the party whose processing stops. Second, if you genuinely sell across different lines, disclosing that early tends to produce a cleaner structure than discovering the mismatch once volume is flowing.

Registration makes your site a standing representation

For categories the networks treat as higher integrity risk, the acquirer's obligations continue past the approval. Registration programs require the acquirer to conduct enhanced due diligence on the merchant's controls before onboarding, register the merchant and its URLs with the network, and attest — annually — that the merchant remains compliant and will cooperate with further validation.

The implication is easy to miss and expensive to learn: the site reviewed at underwriting is not a one-time snapshot, it is a registered, recurring representation. A catalog expansion, a new landing page, an affiliate microsite, or a rewritten product description can move the business away from what was registered without anyone intending it. This is the most common way a compliant account drifts out of compliance.

The reframe that ties all of this together: every piece of consumer-facing copy pulling toward human use is simultaneously an FDA problem, an analogue-provisions problem, and a payments problem. Fixing it once fixes all three — and telling your provider before you publish is far cheaper than explaining it afterward.

The evidence file that supports an approval

Because the review is evidentiary, the work is largely preparation. Assembling this before applying materially changes how an RUO application is received, and it is the same file that serves you in any regulatory inquiry.

• Entity documents whose legal name, address, and ownership match your site and application exactly.
• A product catalog with accurate identifiers, purity and specification data, and no use claims.
• Certificates of analysis and supplier documentation for what you sell.
• A written customer-eligibility policy — who may purchase, and how you verify it.
• Fulfillment, refund, and dispute policies that reflect how you actually operate.
• A site audit confirming no page, meta description, or affiliate asset contradicts your positioning.

Staying inside the monitoring programs

Approval is the start. RUO merchants operate under the same network monitoring as everyone else, and the current Visa Acquirer Monitoring Program measures fraud reports and disputes together against settled transactions, with an excessive threshold of 1.5% in the US and most other regions. It applies once a merchant passes a monthly floor of 1,500 combined events, so smaller sellers have room — but the ratio is what governs, and the floor is not a guarantee.

Disputes in this category cluster around a few recurring causes: shipments delayed or held in transit, buyers disputing quality or specification, and unclear billing descriptors on purchases that customers do not immediately recognize. Each has an operational fix, and none of them require guesswork.

The last principle is redundancy. A specialized category can see conditions shift for reasons outside your control, and a business with a single way to accept payment is one change away from being offline entirely. More than one path to acceptance is what turns a disruption into an inconvenience.