High-Risk Business Rejected: Which Processors Will Accept You

A supplement brand gets terminated by Stripe, boards with Square, then gets shut down by Square six months later. A subscription coaching business runs fine on PayPal for two years, then wakes up one Tuesday to a frozen account. A vape retailer cannot get approved by Shopify Payments, connects a third-party gateway, and processes without incident for a year.

None of this is random. Each major aggregator maintains its own prohibited business list, and those lists do not match. The categories overlap in some places and diverge sharply in others. Understanding exactly where each list draws its lines is the most useful thing a restricted merchant can do before applying to any processor.

This page compares the four lists that affect the most merchants: Stripe, PayPal, Square, and Shopify Payments. All sourced directly from their current published terms.

What All Four Lists Have in Common

Before the differences, the shared ground. Every major aggregator prohibits the same core categories without exception. Gambling in any form, including online casinos, sports betting, lottery sales, and sweepstakes with cash prizes, sits on all four lists. Adult content and sexually explicit material is universally prohibited. Illegal goods and services appear on every list. Counterfeit products and intellectual property infringement are universal prohibitions. Unlicensed weapons and most ammunition sales are refused across all four platforms. Multi-level marketing schemes are refused by Stripe, PayPal, Square, and Shopify Payments, though the exact framing differs slightly across agreements.

If your business falls into any of these categories, the aggregator model is not a viable path. The prohibition is not a policy preference that varies by account manager. It sits in the payment network rules that all aggregators must comply with as a condition of their acquiring relationships.

Where the Lists Diverge

The more commercially significant differences are in the categories that one aggregator prohibits and another allows or restricts with conditions.

Stripe prohibits what its terms call nutraceuticals and pseudo-pharmaceuticals that are not safe or make harmful claims. In practice, Stripe’s automated risk systems flag the broader supplement and nutraceutical industry broadly, including many businesses selling FDA-compliant products. Square takes a narrower approach in its published terms, prohibiting specific business types rather than product categories, which means some supplement businesses that cannot board with Stripe find Square accessible, at least initially. Shopify Payments inherits Stripe’s restrictions for most US merchants because Stripe is its underlying processor. PayPal’s Acceptable Use Policy does not contain an explicit supplement prohibition, though accounts in this vertical frequently face holds and limitations triggered by chargeback ratios rather than category-level policy.

Travel is treated differently across all four. Stripe outright prohibits commercial airlines, cruise lines, and timeshare services. It moved domestic charter air travel from prohibited to restricted in a May 2026 update. PayPal historically requires enhanced verification for travel merchants but does not prohibit the category by default. Square restricts certain travel categories in its terms. Shopify Payments follows Stripe’s treatment for underlying processing.

Telemedicine and telehealth is a category where the lists produce particularly different outcomes. Stripe lists it as a restricted business requiring prior approval. Square does not explicitly prohibit it in its standard Payment Terms. PayPal requires enhanced documentation for healthcare-related accounts. The practical result is that a telemedicine platform might process successfully with Square or PayPal while being unable to obtain approval from Stripe, and therefore unable to use Shopify Payments.

Credit repair and debt services sit in prohibited territory on Stripe and Square. PayPal is more permissive for some financial services businesses but applies enhanced scrutiny. Shopify Payments follows Stripe.

Tobacco and vaping products are prohibited for card-not-present transactions by Square under its Payment Terms. Stripe lists tobacco as a restricted category requiring prior approval rather than an outright prohibition, which gives compliant vape and tobacco merchants a path through direct Stripe application even if Shopify Payments is not available to them. PayPal has historically applied inconsistent enforcement in this category, with some accounts operating successfully for extended periods before being flagged.

Cryptocurrency services require prior approval under Stripe’s restricted businesses framework and are not supported by Square. PayPal has built its own cryptocurrency features and applies its own policies to crypto-adjacent businesses on its platform.

The Aggregator Model and Why Lists Are Not the Whole Story

Reading the prohibited business lists tells you the official policy position. It does not tell you the full enforcement reality.

Every major aggregator uses automated risk monitoring that operates independently of the published list. An account can be in a technically permitted category and still be suspended because its chargeback ratio crossed a threshold, its transaction velocity triggered a fraud flag, or its product descriptions matched internal risk keywords. A supplement business that is not explicitly prohibited by PayPal can still find its account frozen because its rolling dispute rate moved above PayPal’s internal threshold for that category.

This is the structural problem with the aggregator model. The published list tells you whether you will be allowed to apply. It does not guarantee you will be allowed to process long-term. An acquiring bank with a dedicated merchant account operates differently. The underwriting happens once, upfront, with your specific business model evaluated by a human risk analyst. Your reserve terms, chargeback thresholds, and processing limits are documented in a contract. Category-level policy changes at the platform level do not override your individual account terms.

The full picture of what happens when an aggregator closes your account and what your options look like afterward is covered in the guide to declined, shut down, and terminated merchant accounts.

How MCC Codes Connect to Prohibited Lists

The prohibited business lists maintained by aggregators are a layer above the Merchant Category Code system. When you apply to a dedicated high-risk processor rather than an aggregator, the relevant question shifts from whether your category is on the prohibited list to which MCC your business will be assigned and whether the acquiring bank has a risk appetite for that code.

Some MCC codes carry mandatory card network registration fees. Others trigger enhanced monitoring programs under Visa and Mastercard’s surveillance frameworks. A supplement business may be coded under 5499, 5912, or 5969 depending on the acquirer. A coaching business may sit under 7299, 7372, or another services code. The code assignment affects your interchange cost, your monitoring threshold, and the types of acquirers willing to board you.

The MCC codes reference for restricted businesses covers the specific codes most relevant to high-risk verticals and what each means for underwriting eligibility.

Using the Lists Practically

For a merchant who has been declined by one aggregator, the prohibited business lists are a diagnostic tool. The goal is not to find the aggregator with the shortest list. It is to understand whether the category restriction is universal across all aggregators or specific to one platform’s policy.

If your business sits in a category prohibited by all four lists, an aggregator is not the answer. A dedicated high-risk merchant account through an acquiring bank that underwrites your vertical is the correct structure. The underwriting takes longer. The rates are typically higher. The account durability is significantly better.

If your business sits in a restricted category on one platform and a permitted or restricted-with-approval category on another, there may be a legitimate aggregator path while a dedicated account is being established. That assessment needs to be made against the current published terms of each processor, not industry folklore about which platforms are more lenient.

The industry-specific processing guides on this site cover the specific processor landscape for 24 restricted verticals, including which aggregators have historically boarded each category and which acquiring channels are available for dedicated accounts.

For merchants who need card acceptance while a dedicated account is being underwritten, RiskPay operates on non-custodial rails outside the aggregator model entirely. Because settlement flows directly to a merchant wallet rather than through a pooled platform account, the category-level risk decisions that drive aggregator prohibitions apply differently. Its own prohibited activities list is published on the platform and differs from Stripe’s and Square’s in ways that matter to merchants in supplements, crypto-adjacent services, and several other restricted verticals.

Frequently Asked Questions

Do Stripe, PayPal, Square, and Shopify all use the same prohibited business list?

No. Each platform maintains its own list, sourced from a combination of card network rules, their own financial partners’ requirements, and their own risk policies. The lists share a common core of universally prohibited categories but diverge significantly in how they treat supplements, travel, telemedicine, tobacco, crypto, and financial services.

If my business is prohibited by Stripe, can I use Shopify Payments?

In most cases, no. Shopify Payments uses Stripe as the underlying processor for US merchants. The Stripe restricted and prohibited business list therefore applies to Shopify Payments accounts. A business that cannot obtain Stripe approval generally cannot use Shopify Payments, though it may still be able to operate a Shopify storefront with a third-party gateway.

Why does the same category get approved by one processor and rejected by another?

Aggregator prohibited lists are set by each platform independently, based on their own risk policies and the requirements of their acquiring bank partners. What one platform’s acquiring partner will tolerate, another’s will not. The card network rules set a floor of universally prohibited categories, but everything above that floor is determined by each processor’s individual risk appetite.

Is being on a processor’s prohibited list the same as being on the MATCH list?

No. A prohibited business list is a pre-boarding policy that determines whether a processor will accept your application. The MATCH list is an industry-wide database of merchants whose accounts were terminated for specific violations. Being declined by a processor due to your category does not result in a MATCH listing. Being terminated for fraud, excessive chargebacks, or other violations may.