Card Network Rules vs FDA Marketing Claims: How Health Claims Trigger Account Reviews and Shutdowns

A product may be legal to sell, yet the way it is marketed can still trigger regulatory scrutiny or a payment-account review. Health claims on product pages, advertisements, testimonials, blogs, social media posts, emails, and affiliate pages can influence how regulators, card networks, acquiring banks, payment processors, and sponsor banks evaluate a merchant.

That distinction is especially important for CBD and hemp merchants, dietary supplement companies, wellness brands, and other ecommerce sellers operating in categories that receive elevated underwriting attention. 

A merchant may focus on whether its product is lawful while overlooking another question: What does the marketing imply the product will do for a customer’s health?

FDA requirements, Federal Trade Commission advertising standards, card-network rules, sponsor-bank policies, payment processor compliance requirements, and merchant agreements serve different purposes. 

They can nevertheless intersect when a merchant markets a product as treating, preventing, mitigating, or curing a disease, makes unsupported therapeutic claims, republishes problematic testimonials, or creates advertising that communicates an unsubstantiated health benefit.

That does not mean an FDA concern automatically leads to a merchant account shutdown. Nor does acceptance by Visa, Mastercard, an acquiring bank, or a processor mean a product or claim complies with FDA or FTC requirements.

For merchants, the practical lesson is to manage regulatory compliance and payment-processing compliance as related but separate responsibilities.

This guide explains how Card Network Rules vs FDA Marketing Claims differ, where those requirements can overlap operationally, what can trigger a merchant risk review, what a compliance audit may involve, and how merchants can respond without attempting to hide or misrepresent their activity.

This material is general educational information. It is not individualized legal, regulatory, medical, or payment-services advice. Merchants should consult qualified legal or regulatory counsel and their acquiring or processing partners regarding requirements that apply to their particular products, claims, jurisdictions, and merchant agreement.

FDA Rules vs Card Network Rules: Two Different Compliance Systems

FDA and payment networks do not perform the same function.

The U.S. Food and Drug Administration administers federal requirements affecting foods, drugs, dietary supplements, cosmetics, and other regulated products. Depending on the product, intended use, labeling, and claims, FDA law can determine whether particular statements are permissible and whether marketing causes a product to fall into another regulatory category.

For dietary supplements, FDA identifies categories such as health claims, nutrient-content claims, and structure/function claims. Structure/function claims can describe effects on normal body structure or function, but they cannot expressly or implicitly claim to diagnose, mitigate, treat, cure, or prevent disease. 

FDA also imposes specific notification and disclaimer requirements for qualifying dietary supplement structure/function claims. FDA’s guidance on label claims explains these distinctions.

Visa and Mastercard, by contrast, operate payment networks. Their rules govern participation in those networks and place obligations primarily on their financial-institution customers, which in turn oversee merchants through acquiring relationships.

Visa states that its rules prohibit illegal activity on its network and describes its Visa Integrity Risk Program as a framework involving controls, registration, heightened due diligence, and monitoring for certain higher-risk merchant categories. Mastercard’s public materials likewise address illegal or potentially brand-damaging merchant activity and merchant-risk monitoring.

A merchant must therefore consider at least five separate layers:

• FDA requirements: What may legally be claimed about the regulated product?
• FTC requirements: Is advertising truthful, non-misleading, and adequately substantiated?
• Card-network rules: Is activity permitted within the Visa or Mastercard ecosystem?
• Acquirer, sponsor-bank, and processor policies: Is the merchant within that institution’s risk appetite and underwriting criteria?
• Merchant agreement: Has the merchant complied with contractual representations, notification duties, prohibited-activity provisions, and remediation requirements?

A merchant can satisfy one layer without satisfying every other layer. Card network compliance does not substitute for FDA compliance, and FDA compliance does not guarantee that a processor must accept the merchant.

What Counts as a Health Claim?

A health claim is not determined only by whether a marketer uses the words “treat,” “cure,” or “medicine.” Regulators may consider what reasonable consumers are likely to understand from the complete advertisement or presentation.

A statement can therefore create risk through direct wording, implication, imagery, product names, testimonials, comparisons, context, or combinations of otherwise innocuous phrases.

Examples requiring careful regulatory review include statements suggesting that a product:

• treats a disease or medical condition;
• cures a disease;
• prevents illness;
• reduces symptoms of a diagnosed condition;
• replaces prescription or over-the-counter medication;
• has a therapeutic effect associated with treating disease;
• eliminates the need for medical treatment;
• produces a clinically proven health outcome without adequate support; or
• produces a disease-related benefit through an implied claim.

These examples are provided only to identify potential risk. They are not templates for permissible marketing.

FTC guidance emphasizes that advertisers are responsible for both express claims and implied claims. The Commission evaluates advertisements as consumers are likely to understand them, including words, images, demonstrations, endorsements, and context. Health claims generally require a level of substantiation appropriate to the claim being made.

General Wellness vs Disease Claims

Not all references to health or normal body function are automatically disease claims. The classification depends heavily on the product, wording, context, regulatory category, and overall impression.

For dietary supplements, FDA recognizes qualifying structure/function and general well-being claims, subject to statutory and regulatory conditions. A claim describing a normal function of the body can be materially different from a claim that a product treats the disease responsible for abnormal function.

Claim Type	General Description	Regulatory Risk	Payment Review Risk
General wellness	Broad statements about general well-being without implying treatment or prevention of disease	Usually lower when truthful, properly supported, and appropriate for the product	Usually lower, but context and product category still matter
Structure/function	Describes the role of a nutrient or dietary ingredient in affecting normal structure or function, subject to applicable FDA requirements	Moderate; wording can cross into an implied disease claim	Moderate where reviewers believe wording suggests therapeutic activity
Disease treatment	States or implies that a product treats or mitigates a disease or medical condition	High for products not legally authorized to make such claims	High because the claim may indicate regulatory or deceptive-marketing risk
Cure claim	States or implies that a product eliminates a disease or condition	Very high without applicable drug authorization and adequate substantiation	Very high and likely to attract scrutiny
Prevention claim	States or implies that a product prevents disease	High when not legally authorized and adequately supported	High because it can suggest an unlawful or unsupported medical claim

FDA’s terminology must also be distinguished from casual use of the phrase “health claim.” Under FDA food-labeling rules, “health claim” has a specific meaning involving a relationship between a substance and reduced risk of a disease or health-related condition. It should not be casually treated as synonymous with every health-related marketing statement.

Disease, Treatment, Cure, Prevention, and Drug Claims

The intended use of a product can have major legal significance. Statements that a product diagnoses, mitigates, treats, cures, or prevents disease can indicate an intended drug use under federal law.

For dietary supplements, FDA explains that qualifying structure/function claims cannot claim to diagnose, mitigate, treat, cure, or prevent a specific disease or class of diseases. Certain structure/function claims also require the prescribed disclaimer and notification to FDA no later than 30 days after the product is first marketed with the claim.

Merchants should not assume that replacing a disease name with softer terminology resolves the issue. Product names, nearby images, customer stories, headings, metadata, symptom descriptions, and calls to action may collectively communicate the same disease-treatment message.

For example, a statement about supporting normal sleep may have a different regulatory meaning from a page designed around treating a diagnosed sleep disorder. Similarly, a normal-function claim about maintaining joint health is not automatically interchangeable with a claim that a product treats arthritis.

FDA Marketing Claims and FTC Advertising Standards

FDA and FTC responsibilities can overlap, but merchants should not treat them as interchangeable.

FDA’s authority is particularly important for product labeling, intended use, and regulatory classifications. FTC’s advertising authority focuses heavily on preventing unfair or deceptive practices, including unsupported or misleading health-benefit claims.

For ecommerce businesses, the practical boundary between “labeling” and “advertising” can require legal analysis. Website statements connected to a product can matter to regulators even when they do not appear on the physical bottle or package.

FDA Marketing Claims Across Websites and Digital Content

FDA concerns are not limited to the product label attached to a container. Websites and other materials can provide evidence of a product’s intended use.

Merchants therefore need to review more than ingredient panels and packaging. Product descriptions, FAQ pages, educational articles, condition-specific landing pages, company-created social content, and links between educational materials and commercial products can all require scrutiny.

Statements such as “clinically proven,” “doctor recommended,” or “works for [medical condition]” can also raise additional substantiation or intended-use questions depending on context.

For dietary supplements, FDA distinguishes among authorized or qualified health claims, nutrient-content claims, and qualifying structure/function claims. Structure/function and general well-being claims have their own requirements, including substantiation and, for dietary supplements, specified notification and disclaimer requirements.

Merchants selling CBD products require particularly careful review because the FDA has repeatedly taken positions on the regulatory status of CBD-containing products and has issued warning letters concerning disease-treatment claims and other alleged violations. 

A CBD merchant should never assume that widespread marketplace use of a phrase makes it permissible. The safest process is category-specific regulatory review, not copying competitors.

FTC Health Claims and Substantiation

FTC advertising law requires advertisers to have a reasonable basis for objective product claims before disseminating them. For health claims, the necessary support can be rigorous, and the required evidence depends on what the advertisement communicates.

FTC’s current Health Products Compliance Guidance explains that health-related advertising must be truthful, not misleading, and supported by science. FTC also evaluates implied claims and the advertisement’s net impression rather than relying solely on literal wording.

A study does not automatically substantiate whatever marketing statement a merchant wants to make. Compliance teams should consider factors including:

• whether the research actually studied the marketed product or ingredient;
• whether the population and dosage are relevant;
• whether endpoints match the advertised outcome;
• whether results are statistically and clinically meaningful;
• whether contradictory evidence exists;
• whether material limitations have been omitted; and
• whether the advertisement overstates what the evidence demonstrates.

“Customers say it works” is not automatically scientific substantiation for an objective therapeutic claim.

A claim that a product has been “clinically proven” can itself communicate a specific level of scientific support. If the actual research does not support that message, the statement may create additional advertising risk.

Why Testimonials, Influencers, Social Media, and AI Copy Can Create Risk

Merchants sometimes assume they are responsible only for sentences written by their own employees. That assumption is unsafe.

A company’s marketing message may include consumer testimonials, influencer posts, affiliate advertising, agency-created pages, before-and-after images, social media reposts, and AI-generated copy. If the merchant adopts, publishes, endorses, compensates for, or otherwise uses those materials to promote products, the claims can create compliance concerns.

Why Testimonials Can Become Merchant Claims

Imagine a customer writes, “This cured my condition.”

If the company simply receives the statement privately, that is different from selecting it, placing it beside a product’s “Buy Now” button, highlighting it in an advertisement, or reposting it through the brand’s social-media account.

Publishing the testimonial can communicate the underlying efficacy claim to consumers. FTC guidance makes clear that advertisers generally cannot use endorsements to communicate claims that they could not substantiate directly.

Testimonials can also mislead when they suggest atypical results without appropriate qualification. Endorsements do not create an exception to substantiation rules.

Merchants should establish a testimonial-approval process covering:

• disease names;
• cure or prevention language;
• medication-replacement claims;
• dramatic efficacy statements;
• quantified outcomes;
• claims about speed of results;
• atypical experiences;
• physician or professional endorsements; and
• material relationships with endorsers.

A disclaimer such as “individual results may vary” does not automatically cure a misleading efficacy message.

Affiliate and Influencer Claims

Affiliates, influencers, commissioned marketers, and advertising agencies can create significant compliance exposure when they are allowed to improvise health claims.

A useful affiliate program should define approved claims, prohibited claims, disclosure obligations, required substantiation, monitoring procedures, and consequences for violations. Merchants should periodically review high-traffic affiliate pages rather than relying solely on contractual promises.

Controls may include:

• an approved-claims library;
• written prohibited-claims examples;
• mandatory disclosure requirements;
• preapproval for health-focused campaigns;
• periodic monitoring;
• screenshot or archive records;
• takedown procedures; and
• termination provisions for repeated violations.

The same principle applies to social media. Removing a problematic statement from the merchant’s primary website while leaving the same claim in a pinned Instagram post, YouTube description, TikTok caption, influencer landing page, or Facebook advertisement may leave the underlying issue unresolved.

AI-Generated Marketing Copy

Using an AI tool does not transfer regulatory responsibility away from the business that publishes the content.

AI systems can generate persuasive copy that sounds authoritative while overstating evidence, blurring structure/function and disease claims, or inventing medical support. A merchant may also prompt a tool to write “SEO-friendly” product copy and inadvertently receive condition-focused phrases that are inappropriate for the product.

Human review should therefore occur before publication.

A useful control process is to prohibit automated publication of health-related product copy until a trained reviewer has checked the actual claims, surrounding context, citations, product classification, substantiation, and processor restrictions.

CBD, Hemp, Supplements, and Wellness Products: Why Reviews Can Be More Intensive

CBD, hemp-derived products, dietary supplements, nutraceuticals, and wellness products are not universally prohibited from payment processing. However, some merchants in these categories face enhanced merchant underwriting or ongoing monitoring because several risk factors can converge.

A processor may consider the legal status of products, ingredient composition, geographic restrictions, marketing claims, fulfillment practices, customer complaints, chargebacks, continuity billing, and regulatory actions.

Merchants should also distinguish hemp legality questions from FDA product-regulation questions. The legal status of hemp under agricultural or controlled-substance law does not automatically resolve whether a particular CBD-containing food, dietary supplement, cosmetic, animal product, or therapeutic claim complies with FDA requirements.

For merchants preparing for underwriting, a detailed explanation of typical documentation and risk considerations can be found in this site’s guide to CBD merchant account underwriting. A related overview of risk management in high-risk CBD payment processing addresses broader operational considerations.

These internal resources should supplement, not replace, authoritative legal guidance.

CBD Health Claims and Supplement Marketing Claims

CBD health claims deserve particular attention because disease-treatment language can create an FDA issue independent of whether the underlying hemp product complies with agricultural requirements.

A CBD merchant should be cautious about content claiming that a consumer product treats pain associated with a diagnosed condition, cures anxiety disorders, prevents cancer, replaces prescription drugs, treats Alzheimer’s disease, or provides comparable therapeutic outcomes. These are examples of risky claim categories, not suggested advertising.

Dietary supplement sellers face similar issues when general wellness or structure/function language drifts into disease claims. 

A statement about supporting normal physiological function must be evaluated in context; it cannot be paired with surrounding material that effectively transforms it into a treatment claim and then be presumed safe because the sentence itself avoided a disease name.

FDA warning letters provide useful compliance lessons because they show how the agency assesses actual commercial marketing. Merchants reviewing past letters should focus on the underlying legal reasoning rather than mechanically copying wording from companies that have not received enforcement attention.

Chargebacks and Consumer Expectations

Health marketing also has a payment-performance dimension.

Aggressive claims can establish expectations that the product may not satisfy. A consumer who buys a supplement after seeing an implied promise of rapid relief or dramatic therapeutic results may request a refund or file a dispute when the expected outcome does not occur.

That can lead to complaints such as:

• merchandise not as described;
• misleading advertising;
• promised results not delivered;
• refund denied;
• recurring billing disagreement; or
• dissatisfaction with product efficacy.

Chargebacks are not proof that a health claim violated law. Nevertheless, dispute patterns can become risk signals for acquiring institutions.

Merchants can review additional operational practices in the site’s discussion of minimizing chargebacks in CBD payment processing.

What Card Networks Actually Care About

Card networks are not a substitute for health regulators. Their primary role is running payment ecosystems and establishing rules for network participants.

Those rules can nevertheless require acquirers to control merchants associated with unlawful, fraudulent, deceptive, or otherwise prohibited activity. Networks also operate programs addressing fraud, disputes, merchant risk, integrity concerns, and specific higher-risk categories.

A merchant’s processor or acquiring bank typically sits between the merchant and the card network. As a result, a merchant may receive a compliance request from its processor even when the underlying concern originated with an acquirer, sponsor bank, network program, monitoring vendor, or regulatory development.

Potential payment concerns include:

• transactions involving unlawful goods or services;
• deceptive marketing;
• merchant misrepresentation;
• undisclosed changes in product category;
• high fraud or dispute levels;
• regulatory enforcement;
• prohibited activity;
• transaction laundering;
• misleading fulfillment or billing practices; and
• failure to comply with the merchant agreement.

There is no single universal “card network health claims rule” that makes every questionable health statement automatically equivalent to a shutdown. Card network rules health claims issues usually arise through the broader interaction among lawfulness, merchant integrity, deceptive practices, underwriting, sponsor-bank policy, and network compliance.

What Is BRAM Compliance?

BRAM stands for Mastercard’s Business Risk Assessment and Mitigation program.

Mastercard’s public Anti-Piracy Policy states that the policy operates in conjunction with BRAM and describes BRAM as prohibiting merchants from submitting, and acquirers from accepting for submission, transactions that are illegal or that Mastercard considers damaging or potentially damaging to Mastercard’s goodwill or brand.

That description supports an important but limited conclusion: BRAM is a Mastercard risk and compliance framework relevant to certain illegal or brand-damaging merchant activity.

Merchants should avoid unsupported internet claims about universal BRAM fine schedules, investigation deadlines, violation categories, or automatic termination procedures. Exact obligations can depend on Mastercard standards, program materials, geography, acquiring relationships, facts, and documentation that may not all be publicly available.

Mastercard also publicly describes broader merchant-risk services that use network and external signals to assist with onboarding, monitoring, investigation, and remediation.

Therefore, BRAM compliance should not be reduced to a list of banned marketing words. For FDA claims merchant processing concerns, the more useful question is whether a merchant’s activity could cause the acquiring institution to view transactions as illegal, deceptive, misrepresented, outside approved underwriting, or otherwise inconsistent with Mastercard standards.

Visa and Merchant Compliance Monitoring

Visa uses different terminology and programs, so merchants should not describe Visa’s system as “Visa BRAM.”

Visa publicly describes its Visa Integrity Risk Program (VIRP) as a multi-layered framework intended to help keep illegal activity off its network, including registration and heightened due diligence requirements for certain higher-risk merchant categories. 

Visa also says it uses monitoring capabilities and requires acquirers to oversee merchants covered by applicable requirements.

Separately, the Visa Acquirer Monitoring Program (VAMP) addresses fraud, disputes, and enumeration. Visa’s current public fact sheet explains that VAMP consolidates several prior monitoring mechanisms and that Visa measures fraud and dispute performance while acquirers handle operational engagement and remediation with merchants.

These programs should not be conflated.

VIRP focuses on integrity risks and designated higher-risk merchant activity. VAMP is a performance-monitoring framework involving fraud, disputes, and enumeration. A merchant might conceivably face concerns in one context, the other, both, or neither depending on its business.

How Health Claims Can Trigger a Merchant Account Review

A problematic health claim does not guarantee a payment processing shutdown. It can, however, become one data point in a merchant risk review.

Processors and sponsor banks routinely reassess risk after onboarding. Ecommerce websites can change rapidly, and the company approved six months ago may not resemble the company operating today.

Possible triggers include:

• an FDA warning letter;
• an FTC enforcement action;
• a state regulatory complaint;
• a processor website scan;
• manual merchant underwriting;
• sponsor-bank review;
• customer complaints;
• elevated chargebacks;
• adverse media;
• significant changes in products;
• prohibited marketing phrases;
• unauthorized continuity billing;
• changes in fulfillment;
• new affiliate campaigns; or
• discrepancies between the approved business model and current website.

A public regulatory action can be especially relevant because it may present specific allegations about the merchant’s products or claims. The processor may then evaluate whether the activity remains within the approved risk parameters.

An FDA warning letter does not automatically require every processor to terminate the merchant. Depending on the circumstances, an acquirer or processor might seek an explanation, request remediation, change reserves or processing conditions, impose restrictions, or terminate the relationship pursuant to its contract and risk policy.

What Happens During a Merchant Compliance Audit?

The term “merchant compliance audit” can describe several different review processes. It may be an automated website review followed by questions, a processor’s periodic underwriting refresh, a sponsor-bank investigation, or a response to an external complaint.

The reviewer may examine:

• products and ingredients;
• website URLs and domains;
• product labels;
• marketing claims;
• checkout flow;
• refund and cancellation policies;
• shipping policies;
• legal business name;
• beneficial ownership;
• fulfillment procedures;
• customer-support information;
• chargeback history;
• regulatory status;
• licensing;
• processing history;
• supplier documentation;
• sales channels; and
• previous compliance correspondence.

A merchant may be asked to provide screenshots, invoices, labels, laboratory reports, certificates of analysis where relevant, product lists, supplier agreements, corporate documents, regulatory correspondence, or written explanations.

The goal may simply be to verify that the merchant’s current activity matches what was underwritten.

Website Pages That May Be Reviewed

Merchant risk review does not necessarily stop at the homepage.

Reviewers may inspect:

• homepage copy;
• product descriptions;
• collection pages;
• blog posts;
• FAQ pages;
• testimonials;
• condition-focused articles;
• search-result snippets;
• metadata;
• structured data;
• social-media accounts;
• advertisements;
• email screenshots;
• affiliate pages;
• external landing pages; and
• archived material that remains publicly accessible.

Old content matters because a five-year-old blog post can still rank in search, refer customers to a product, and communicate a disease-treatment claim.

SEO teams should therefore include compliance in content-maintenance workflows. Removing a claim from a new product page while leaving older articles, metadata, image alt text, FAQ schema, or affiliate posts untouched is incomplete website remediation.

Merchant Account Review vs Shutdown

A merchant account review and a merchant account shutdown are not synonymous.

A risk review can end without any processing interruption. It can also result in remediation requirements, revised processing limits, reserves, product restrictions, or termination depending on the facts, contract, risk appetite, and unresolved concerns.

A useful way to think about the possible outcomes is as separate actions rather than a guaranteed escalation ladder.

Routine Review

A routine merchant account review usually involves information gathering.

The processor may request updated financial statements, product lists, website URLs, supplier records, fulfillment information, processing history, licenses, or an explanation of recently added products.

Merchants should respond accurately and promptly. If a reviewer identifies health-related wording, the business should determine exactly what content is being questioned and obtain appropriate regulatory advice.

A routine review does not necessarily mean the processor believes a violation occurred. Many institutions periodically refresh underwriting information or investigate automated risk signals.

Keeping product documentation and marketing approvals organized can make these reviews substantially easier.

Remediation, Restriction, and Termination

During remediation, a processor may ask the merchant to change particular practices, remove unsupported or prohibited claims, provide substantiation, update refund disclosures, modify sales pages, discontinue an unapproved product, or address affiliate content.

Restrictions can take several forms depending on the processing agreement. Examples may include processing limits, delayed settlement, reserves, geographic limitations, or restrictions on specific products.

Termination means the acquiring or processing relationship is closed. Reasons can include unresolved compliance concerns, unacceptable risk, contract breaches, prohibited activity, misrepresentation, excessive disputes, or changes in a bank’s risk appetite.

These are not mandatory sequential stages. A serious issue might lead directly to restriction or termination under applicable contractual rights, while another issue may be resolved after a straightforward documentation update.

Why a Processor Can Restrict a Product That Is Legal

A common merchant question is: “If my product is legal, why can my processor refuse it?”

Because legality and processor acceptance are different standards.

An acquiring bank assumes financial, regulatory, operational, and reputational risk when it sponsors merchant activity onto a card network. It can establish underwriting policies narrower than the outer boundary of what the law permits.

For example, a processor may decide not to support certain industries, ingredients, continuity-billing models, fulfillment structures, jurisdictions, or marketing practices even if some businesses within those categories operate lawfully.

The merchant agreement may also require advance notice before changing products or business models.

A processor’s approval means only that it agreed to provide processing under specified conditions. It is not an FDA determination, an FTC safe harbor, or a legal opinion.

Likewise, being legally permitted to sell a product does not entitle a business to a particular merchant account.

Compliance Audit and Website Remediation Checklists

Strong ecommerce website compliance starts with repeatable review processes rather than emergency cleanup after an account is flagged.

A merchant should be able to show what it sells, what claims it makes, who approved those claims, what evidence supports them, and how changes are monitored.

Area	What to Review	Evidence to Keep
Product claims	Express and implied health, disease, therapeutic, prevention, and cure claims	Approved copy and claim-review records
Testimonials	Customer efficacy statements, medical claims, atypical outcomes	Approval records and source copies
Social media	Captions, videos, comments reused in ads, bios, pinned posts	Screenshots and campaign approvals
Affiliate content	Claims made by paid partners and commissioned marketers	Contracts, monitoring records, takedowns
Regulatory notices	FDA, FTC, state, or other government correspondence	Original notice, counsel response, remediation evidence
Refund policy	Visibility, time limits, eligibility, exclusions	Published versions and revision history
Chargebacks	Ratios, reason patterns, complaints, refunds	Monthly reports and corrective-action plans
Product documentation	Ingredients, labels, COAs where relevant, suppliers	Current controlled files
Processor approvals	Approved categories, domains, products, restrictions	Emails, underwriting records, amendments
Website changes	New products, claims, domains, checkout modifications	Change logs and approvals

How to Review Marketing Claims Before Publication

A lawful prepublication workflow can reduce both regulatory and payment processor compliance risk:

1. Identify the proposed claim: Capture the exact wording and surrounding images, testimonial, headline, or video.
2. Classify the claim: Determine whether it concerns general wellness, normal structure/function, disease treatment, prevention, cure, or another therapeutic outcome.
3. Identify the product category: Rules vary among dietary supplements, conventional foods, drugs, cosmetics, devices, and other products.
4. Determine required substantiation: Ask what objective message consumers will reasonably take from the claim and what evidence supports it.
5. Review FDA and FTC guidance: Apply rules relevant to the actual product and communication.
6. Obtain qualified review where appropriate: Higher-risk health claims should receive regulatory or legal review.
7. Document the support: Preserve evidence considered and the final approved version.
8. Approve all channels consistently: Ensure affiliates, metadata, ads, social media, and product pages use authorized language.
9. Re-audit periodically: Scientific evidence, regulatory expectations, product formulations, and payment policies can change.

This workflow creates a record showing that compliance was integrated into marketing operations rather than addressed only after a complaint.

Merchant Website Remediation Checklist

When performing website remediation, review the full commercial footprint:

• product titles and descriptions;
• homepage messaging;
• category pages;
• headings;
• meta titles and descriptions;
• structured data and schema;
• blogs;
• FAQs;
• testimonials;
• before-and-after images;
• image captions;
• alt text;
• downloadable guides;
• social-media links and profiles;
• affiliate landing pages;
• paid advertisements;
• email sequences;
• abandoned-cart messages;
• influencer scripts;
• product feeds; and
• old URLs that remain indexed.

Do not remove evidence requested as part of an investigation. Website remediation means correcting public-facing content where appropriate while preserving records required for compliance, legal, and processor purposes.

Account Review Mitigation: How to Respond Lawfully

A merchant receiving a processor compliance notice should treat it as an operational priority.

Rushing to delete material without understanding the request can be as unhelpful as ignoring the review. The merchant needs to preserve relevant records, identify the issue, correct appropriate content, and communicate accurately with the processor.

A sound account review mitigation workflow is:

1. Respond promptly: Acknowledge the request and identify the responsible internal contact.
2. Preserve requested records: Do not destroy documents, correspondence, or historical evidence relevant to the review.
3. Identify the questioned claims or products: Ask for specificity when the concern is unclear.
4. Evaluate the content: Determine whether regulatory, contractual, or marketing review is necessary.
5. Remove or correct unsupported content where appropriate: Make lawful corrections without concealing what previously occurred.
6. Review related channels: Check affiliates, social media, advertisements, blogs, metadata, and email campaigns.
7. Document remediation: Keep before-and-after evidence and an accurate change log.
8. Provide requested support: Submit substantiation, labels, COAs, invoices, or other materials when legitimately required.
9. Confirm completion: Tell the compliance team exactly what was changed.
10. Monitor future marketing: Fix the process that permitted the issue, not only the individual webpage.

What Not to Do During a Compliance Review

Certain actions can transform a fixable compliance issue into a much more serious integrity concern.

Do not:

• ignore processor requests;
• cloak website content from reviewers;
• create a hidden duplicate website;
• move prohibited products to another domain merely to evade monitoring;
• misrepresent the nature of the business;
• deceptively change merchant category information;
• route transactions through another merchant ID to conceal the true seller;
• use shell companies to disguise activity;
• falsify certificates of analysis or regulatory records;
• delete evidence requested in an investigation;
• suppress relevant compliance records;
• lie about product categories;
• hide affiliate marketing controlled by the business; or
• process one merchant’s transactions through another merchant’s account.

Transaction laundering, processor deception, and merchant misrepresentation are not legitimate remediation strategies.

If a processor will not support a product or marketing model, the appropriate response is to discuss lawful options with the processor, modify the business where appropriate, or obtain independent professional guidance about legitimately available services. Concealment is not a compliance solution.

Product Documentation, Substantiation, Disclaimers, and Before-and-After Claims

Documentation becomes particularly valuable when several teams share responsibility for products and marketing.

A growing ecommerce company may have one group sourcing ingredients, another designing labels, an SEO agency writing content, influencers creating social campaigns, and a payments team answering underwriting requests. Without centralized records, compliance gaps are easy to miss.

Useful records may include:

• ingredient specifications;
• final labels;
• formulation records;
• certificates of analysis where relevant;
• supplier invoices;
• supplier qualifications;
• licenses;
• product testing;
• marketing approvals;
• substantiation files;
• affiliate agreements;
• advertising approvals;
• regulatory correspondence;
• processor correspondence; and
• website change records.

Claim Substantiation Is More Than Customer Satisfaction

A merchant may have hundreds of five-star reviews and still lack appropriate scientific substantiation for an objective health claim.

FTC’s framework focuses on evidence supporting what the advertisement communicates to consumers. Anecdotes do not automatically demonstrate causation, rule out placebo effects, establish safety, or prove that a result is typical.

Evidence should therefore be matched to the claim.

A study of one ingredient is not necessarily evidence that the merchant’s differently formulated finished product produces the same result. A study in a different population or at a different dosage may not support a broad advertising conclusion.

Marketing teams should also distinguish between evidence supporting a modest claim and evidence needed for an absolute one. “May support” does not automatically make an unsupported message acceptable if the surrounding presentation still communicates guaranteed treatment.

Qualified counsel or regulatory specialists should review higher-risk claims before publication rather than trying to reverse-engineer legal conclusions from competitor websites.

Disclaimer Limitations

The familiar dietary supplement disclaimer stating that FDA has not evaluated certain statements and that the product is not intended to diagnose, treat, cure, or prevent disease has a legitimate role under the statutory framework for qualifying dietary supplement claims. FDA specifies when that disclaimer is required.

It is not a universal shield.

A merchant cannot ordinarily make a disease-treatment claim, place a disclaimer underneath it, and assume the problematic claim has disappeared. The surrounding marketing and overall consumer impression still matter.

FTC likewise considers qualifications and disclosures in the context of the entire advertisement. A disclaimer that contradicts the principal message may be ineffective.

Compliance teams should therefore ask two questions separately:

1. Is a particular disclaimer legally required for this type of claim?
2. Is the underlying claim itself permissible and adequately substantiated?

Satisfying the first question does not automatically answer the second.

Before-and-After Claims

Before-and-after imagery can communicate powerful express or implied efficacy claims even when very little text appears.

A photograph suggesting dramatic weight loss, skin improvement, mobility improvement, hair restoration, pain relief, or another health-related transformation may cause consumers to infer that the advertised product produced the result.

The accompanying caption, timeframe, testimonial, product positioning, and disclosure all influence that message.

Before-and-after material should therefore undergo the same substantiation review as written advertising.

Businesses should also verify that images are authentic, authorized for commercial use, representative where required, and not digitally manipulated in ways that create misleading product-performance impressions.

SEO Content, Ongoing Monitoring, and Common Compliance Mistakes

Search optimization and compliance should operate together.

SEO teams often find high-volume searches involving disease names, symptoms, “best treatment,” “cure,” “remedy,” or drug comparisons. Those phrases can be attractive from a traffic perspective but risky when a commercial page uses them to imply that an unapproved product treats disease.

A content strategy should not deliberately create prohibited health claims simply because those phrases have search volume.

Educational discussion of a disease is not automatically prohibited. The risk depends on the product category, relationship between the educational content and product promotion, claims conveyed, intended use, and overall context.

Ongoing Merchant Monitoring

Compliance is not finished after underwriting.

Merchants should periodically monitor:

• current product catalog;
• newly introduced ingredients;
• newly published health claims;
• website changes;
• affiliate content;
• influencer campaigns;
• social media;
• FDA regulatory developments;
• FDA warning letters relevant to the category;
• FTC advertising guidance;
• state-law changes;
• chargeback levels;
• refund trends;
• consumer complaints;
• processor policy changes; and
• merchant agreement amendments.

Visa, Mastercard, acquiring banks, and processors can also update risk programs and operational requirements. Merchants should rely on current official documentation and communications rather than outdated blog posts or screenshots of old rules.

Payment-performance monitoring matters as well. Visa’s current public materials, for example, describe VAMP as a framework monitoring fraud, disputes, and enumeration, with operational responsibilities placed on acquirers.

Common Merchant Compliance Mistakes

Recurring mistakes include:

• assuming a legal product must be accepted by every processor;
• assuming processor approval means FDA compliance;
• copying competitors’ health claims without regulatory review;
• relying entirely on disclaimers;
• publishing uncontrolled testimonials;
• forgetting old blog posts;
• neglecting metadata and schema;
• failing to monitor affiliates;
• allowing influencers to invent therapeutic claims;
• adding materially different products without notifying the processor when required;
• ignoring warning letters;
• ignoring processor compliance requests;
• failing to preserve supporting records;
• hiding product categories;
• misrepresenting business activity; and
• treating regulatory compliance and sponsor bank compliance as identical.

One of the most dangerous errors is assuming that silence equals approval. The fact that FDA, FTC, a card network, or a processor has not contacted a business does not prove that every claim is compliant.

Practical Health-Claim and Merchant-Risk Matrix

Risk matrices are useful screening tools, but they are not substitutes for case-specific regulatory analysis.

The same sentence can carry different implications depending on the product category and surrounding advertisement. Likewise, processors can have different underwriting policies.

Marketing Practice or Event	Regulatory Risk	Processor Risk	Recommended Action
Carefully reviewed general wellness language	Lower, depending on product and context	Usually lower	Confirm support, product fit, and processor policy
Qualifying structure/function claim	Moderate	Moderate	Verify FDA requirements, substantiation, disclaimer, and context
Disease-treatment claim on an unauthorized product	High	High	Obtain regulatory review and correct problematic content
Cure or prevention claim without appropriate authorization/support	Very high	Very high	Stop relying on the claim and seek qualified review
Unsupported testimonial	High when it communicates an efficacy claim	High	Remove or revise appropriately; establish testimonial controls
Dramatic before-and-after promotion	Moderate to high depending on implied message	Moderate to high	Evaluate the implied claim and substantiation
FDA warning letter	Potentially high	Potentially high	Respond lawfully and prepare for processor questions
Undisclosed product-category change	Varies	High	Notify processor as required by agreement
High chargebacks	Not necessarily a regulatory violation	High	Investigate causes and implement corrective controls
Misrepresentation to processor	May create additional legal issues	Very high	Correct disclosures immediately; never conceal activity

A useful internal rule is to escalate any content combining a commercial product with a disease name, medication comparison, cure/prevention language, quantified medical result, or dramatic testimonial before publication.

Questions Merchants Should Ask Their Processor

Many merchant account shutdown disputes begin with unclear expectations at underwriting.

Merchants should ask specific questions and keep the answers in writing where possible:

• Which of our product categories are approved?
• Are any ingredients or formulations excluded?
• Which health or therapeutic claims create underwriting concerns?
• Do you conduct periodic website monitoring?
• Must newly introduced products receive approval?
• Must new domains or sales channels be reported?
• How are merchant compliance reviews handled?
• What product documentation should we retain?
• Are affiliate and influencer claims considered part of our merchant activity?
• Are social-media pages reviewed?
• How quickly must remediation requests be completed?
• What should we do after receiving a regulatory warning letter?
• Can repeated compliance violations lead to payment account termination?
• How should significant website changes be reported?
• Are there specific refund, shipping, fulfillment, or disclosure requirements?
• Which provisions of our merchant agreement address business-model changes?

These questions help separate network requirements from processor-specific risk policy.

A processor may have stricter policies than Visa or Mastercard requires. A sponsor bank can also impose requirements beyond the minimum network standard.

Documenting the approved business model reduces ambiguity if the merchant later adds new products or changes marketing strategy.

Frequently Asked Questions

Conclusion

Health-related marketing creates a compliance challenge because the same webpage can be evaluated through several different systems.

FDA may examine what claims communicate about a regulated product and its intended use. FTC may examine whether express and implied advertising claims are truthful, non-misleading, and adequately substantiated. 

Visa and Mastercard establish rules intended to protect their payment networks. Acquirers and sponsor banks apply those requirements alongside their own risk policies. Processors then enforce underwriting standards and merchant contracts in the direct processing relationship.

Those systems interact, but they should never be treated as interchangeable.

A legal product can still be marketed unlawfully. A legally compliant product can still fall outside a processor’s risk appetite. A processor can approve a merchant without validating every FDA or FTC issue. An FDA warning letter can contribute to a merchant risk review without automatically requiring account termination.

For CBD, hemp, supplement, wellness, and ecommerce merchants, the most durable strategy is disciplined compliance: review claims before publication, understand the difference between general wellness and disease claims, substantiate objective statements, control testimonials and affiliates, monitor social media and AI-generated copy, keep processing disclosures accurate, reduce chargebacks, and preserve documentation.

If a merchant account review occurs, accurate disclosure and documented website remediation are far safer than concealment. Cloaking sites, routing sales through undisclosed merchant IDs, falsifying documentation, hiding products, changing business identities deceptively, or otherwise attempting to evade payment monitoring can create much more serious problems than the original marketing issue.

The central principle behind Card Network Rules vs FDA Marketing Claims is therefore straightforward: regulatory legality, advertising compliance, card network compliance, sponsor bank compliance, processor underwriting, and contractual acceptance are separate tests. A responsible merchant plans for all of them.