If you run a high-risk business, the usual advice on how to accept credit card payments online — sign up with a well-known payment provider and add a checkout button — can stop working at the first review. Self-service platforms often restrict categories such as iGaming, CBD, supplements, peptides, dating or crypto services, send them for extra approval or decline them.
That does not put card acceptance out of reach, but the route matters. This guide explains how acceptance is arranged behind the checkout, what “without a merchant account” really means, what underwriters check and how customers then pay. Card-network rules are quoted as of November 2026.
Accepting credit card payments online starts with an acquirer
Every online card payment needs an acquirer: a licensed institution that is a member of the card networks and submits merchants’ transactions to them. The transaction then travels through Visa or Mastercard to the customer’s card issuer, which approves or declines it.
The acquirer also carries the risk: if a merchant generates chargebacks it cannot cover, or breaks network rules, the acquirer answers for it. That is why the acquiring side, not the checkout, largely decides whether a high-risk business can take cards.
Gateways, processors and payment service providers sit around that relationship, as our guide to the difference between a payment gateway and a payment processor explains. In the UK, acquiring payment transactions is a regulated payment service under the Payment Services Regulations 2017, which is one reason onboarding involves verification rather than a simple sign-up form.
Three ways a business gets card acceptance
Card acceptance is usually arranged in one of three ways. In the first two you remain the seller; the third is a different selling arrangement altogether. “Payment service provider” (PSP) is a broader commercial term: a PSP may give you access to one of these models, so the label alone does not tell you which one you are in.
| Model | Who you contract with | Who is the seller to the cardholder | Who reviews your business | Typical fit |
|---|---|---|---|---|
| Direct acquiring (often called your own merchant account) | The acquirer, directly or through a reseller | You | The acquirer | Established businesses, higher volumes, specialist categories |
| Sponsored merchant through a payment facilitator | A payment facilitator, which contracts with the acquirer | You | The payment facilitator, under the acquirer’s oversight | Smaller or newer businesses that want faster onboarding |
| Merchant of Record | A business that resells your product in its own name | The Merchant of Record | The Merchant of Record, before agreeing to sell your product | Mainly software and digital products |
With direct acquiring, the card relationship is yours. With a payment facilitator, you still sell in your own name but depend on the facilitator’s risk appetite. A Merchant of Record is different: it acts as the seller to the cardholder, so the customer buys from the MoR rather than from you, and the obligations it takes on depend on its contract. The model may not suit many physical-product or regulated businesses.
“Without a merchant account” usually means under someone else’s agreement
Many guides promise you can accept credit card payments without a merchant account. Usually that means you become a sponsored merchant of a payment facilitator: you skip the direct contract with the acquirer, not the merchant relationship or the underwriting.
The Visa Core Rules and Visa Product and Service Rules (edition of 24 October 2026) make this explicit. They define a Merchant Agreement as a contract “between a Merchant and an Acquirer or between a Sponsored Merchant and a Payment Facilitator”, and state that “a Sponsored Merchant will be treated as a Merchant of its Payment Facilitator’s Acquirer”. You still sign a merchant agreement and are still assessed, just by a different party.
When Visa requires a direct agreement with the acquirer
Visa’s rules (section 5.3.1.4) also set a volume trigger. Once a sponsored merchant exceeds USD 1 million a year in Visa transactions, the acquirer must normally sign a direct Merchant Agreement with it:
- New sponsored merchants above that level need the direct agreement before they start processing.
- Existing sponsored merchants that grow past it have up to two years to put one in place.
This is not a cap on how much you can process, and the facilitator can keep providing its services, including settlement. Visa allows limited exceptions, for example for long-standing facilitator relationships or certain categories, but they come with conditions, do not apply in every region and are narrower for high-integrity-risk merchants. For a growing high-risk business, expect a direct acquiring relationship as volume rises.
Mainstream self-service providers often restrict high-risk categories
Self-service payment platforms are built for fast, low-touch onboarding at scale, and most publish lists of prohibited and restricted categories. Gambling, adult content, dating, trading services, cryptocurrency, certain cannabinoid products and some nutraceuticals commonly appear on them, either excluded or subject to additional approval. Policies differ between providers and change over time.
The reason is largely structural: a facilitator answers to its acquirer for every merchant it signs, so it tends to limit categories with higher dispute, fraud or legal risk.
Why approval at sign-up does not always last
Some self-service providers run lighter checks at sign-up and deeper reviews later, triggered by volume, disputes or a closer look at the website. If a business turns out to sit in a restricted category, the provider may hold funds, add a reserve or close the account. A closure that leads to a MATCH listing makes future applications harder; see our guide to accepting payments while on the MATCH list. The safer approach is to disclose your business model fully at the start.
High-risk merchants need an arrangement that accepts their category
Card networks treat some business types as higher risk and identify them by merchant category code (MCC). Under Visa’s rules, a facilitator considered high-integrity risk must register as a High-Integrity Risk Payment Facilitator, its acquirer takes on extra monitoring and reporting, and Visa can disqualify high-integrity-risk sponsored merchants from a facilitator arrangement.
So not every provider can accept every category. Some acquirers decline whole verticals by policy; others assess each business individually. Being placed under the wrong MCC to pass onboarding breaks network rules rather than solving the problem; our guide to merchant category codes for high-risk businesses explains how codes are assigned.
Card type and jurisdiction matter as well as category
Approval for your category does not mean every card type is available in every market. In Great Britain, for example, Gambling Commission licence condition 6.1.2 states that licensees “must not accept payment for gambling by credit card”. The condition covers specified remote licences and non-remote betting licences, not every gambling business or licence type. Debit-card payments fall outside that condition and are a separate question for the operator and its provider. Other sectors and countries have their own rules, so confirm which card types are permitted before you plan your checkout.
When comparing providers, ask whether they accept your category in your markets, which card types are available, and whether a person reviews your business.
Underwriters review the business before the first payment
Whichever model you use, a high-risk business is normally reviewed before processing starts. Underwriting decides whether an acquirer, or a provider acting under one, will take your transactions. Requirements vary, but expect to be asked for most of the following:
- Company details: registration documents, addresses and the legal entity that will contract.
- Ownership and control: directors and beneficial owners, typically everyone holding 25% or more, with identity documents.
- Website and business model: what you sell and how, your terms, refund policy and support details.
- Products and claims: product information and marketing claims, particularly in regulated categories.
- Markets: where you are registered, where you sell and any countries you exclude.
- Volumes and history: expected monthly volume, average transaction value and previous processing statements.
- Licences: any licence or authorisation your activity requires.
For high-risk models, reviews usually take days rather than minutes, and further documents may be requested. Our high-risk merchant account application checklist explains how to prepare a complete file, and our guide to high-risk merchant accounts covers the wider process. Be cautious of any provider that promises approval before reviewing your business.
Hosted checkout, payment links, plugins and APIs deliver the payment, not the approval
Once approved, the question becomes how customers pay. This layer is separate from eligibility: none of these methods replaces acquiring approval.
Hosted checkout
With a hosted checkout, the customer enters card details on a page operated by the provider, not on your domain. Keeping card data off your systems can reduce the scope of your PCI DSS obligations, but it does not remove them: the PCI Security Standards Council states that outsourcing “does not remove the merchant’s responsibility” to ensure card data is protected, which includes checking the provider’s compliance and validating your own. 3D Secure runs within the same flow when the issuer requires it.
Payment links
A payment link lets you request a payment by email, chat or invoice, and the customer pays on the hosted page. It suits remote sales and individual orders taken outside a website checkout; what else a link supports depends on the provider.
Plugins and APIs
Ecommerce plugins connect card payments to an existing store with minimal development; a REST API with webhooks suits custom platforms. See our guide to adding a payment gateway to an existing website and our WooCommerce guide for high-risk merchants.
Match the card acceptance route to your model, markets and volume
Fit matters more than headline pricing. Before you apply, check:
- Is your category accepted for your specific products and target markets, and which card types are permitted there?
- What volume do you expect? If you could exceed USD 1 million a year in Visa volume, plan for a direct acquiring relationship.
- How do customers pay? Confirm the provider supports your route: hosted checkout, payment links, a plugin or an API.
- Do you need recurring billing, stored cards or particular card brands? Not every provider offers them.
- Would a separate rail help? Some high-risk merchants add crypto or stablecoin acceptance alongside cards. Our comparison of a high-risk merchant account and a crypto payment gateway explains the trade-offs; crypto has its own compliance review and is not a way around card underwriting.
How Niftipay supports high-risk card acceptance
Niftipay Card Payments supports Visa and Mastercard credit, debit and prepaid cards, with Apple Pay and Google Pay available where the device, issuer and merchant setup support them. American Express is not currently supported. The cards and flows available to each merchant depend on its approved setup, its category and the rules of its markets.
Customers pay on a hosted Niftipay checkout, so card details are not entered on your own site. Merchants can start that checkout from payment links, the WooCommerce and PrestaShop plugins, or the REST API and webhooks, and 3D Secure is applied when the issuer requires it. Each payment is an individual transaction: there are no stored cards, card-on-file or recurring billing.
Before any payment can be taken, every merchant goes through qualification: KYB verification and a manual compliance review of the business, owners, products and markets. High-risk models, including iGaming, CBD, peptides and supplements, are assessed individually rather than excluded as a category, and availability depends on the business model, jurisdiction and whether acquiring is available for that model in those markets. Applications are normally reviewed within two to five business days, although complex cases can take longer and approval is not guaranteed.
You can review the full product details, integration routes and commercial terms on the Card Payments page.
Accept credit card payments online: FAQs
Can I accept credit card payments online without a merchant account?
Often, yes. A payment facilitator can let you take cards without a direct acquirer agreement, but you still sign a merchant agreement with the facilitator and are still reviewed. A Merchant of Record works differently, because it sells your product in its own name. Under Visa’s rules, a direct acquirer agreement is normally required above USD 1 million a year in Visa transactions, subject to exceptions.
Is a merchant account the same as a bank account?
No. A business bank account holds your money. A “merchant account” is the common name for an acquiring relationship that lets you accept card payments. Funds from card sales are settled to your bank account under the terms of that relationship.
Why do mainstream payment providers restrict high-risk businesses?
Mainly because the facilitator and its acquirer are responsible for the merchants they sign. Categories with higher chargeback, fraud or legal exposure need closer monitoring than self-service models are usually designed for, and card networks add registration and reporting requirements for them.
How long does approval for high-risk card payments take?
It varies by provider, business model and how complete your application is. For high-risk models, a review often takes several business days, and longer if further documents are requested. Preparing company, ownership, website and processing information in advance helps avoid delays.
Do I need a website to take card payments online?
These are two separate questions. Taking a payment without a full ecommerce checkout is possible: a payment link lets a customer pay on a hosted page, for example against an invoice. Being approved as a merchant is different, because underwriting usually looks at how and where you sell, including your online presence, terms and refund policy. Requirements vary, so check what your provider expects before you apply.