Website Requirements for Accepting Credit Cards: The Approval Checklist

Visa publishes its rules for merchants twice a year. In the edition dated April 18, 2026, section 5.8.4.1 says an e-commerce website or app must contain all of the following:

That's the complete general list. Visa adds extra rules for online gambling, marketplaces and merchants selling cryptocurrency or NFTs. Two other Visa rules also shape your site:

• Refund and cancellation disclosure (section 5.4.2.5). If you restrict returns, refunds or cancellations, you must disclose the policy at checkout with a "click to accept" step. More on that below.
• No full card numbers on screen (section 5.8.4.2). An e-commerce merchant must not display the full card number to the customer online. Order pages and receipts should show the last four digits at most.

Notice what's not on Visa's list: a privacy policy, terms and conditions, or "128-bit SSL." Older checklists called those card network rules. Underwriters still look for them, but they aren't in Visa's website section.

The bank behind your merchant account takes the financial risk if your customers dispute charges. So its underwriters (the people who review your application) check that your site looks like a real business that will deliver what it sells. Expectations vary by bank and industry, but they usually look for:

• A finished, live site. Real products or services, not "coming soon" pages or template placeholder text.
• Clear descriptions and prices. What each item is, what it costs in U.S. dollars, and any extra charges such as shipping, taxes or fees.
• A refund, return and cancellation policy that is easy to find and matches how you actually handle returns.
• Shipping and delivery terms. How long orders take, which carriers you use, what shipping costs and whether you ship outside the U.S.
• A privacy policy explaining what customer data you collect and how you use it.
• Terms and conditions for using your site and buying from you.
• Contact details on every page: phone, email, business hours and a mailing address, usually in the footer.
• A matching business name. The name on your site should match your application, and ideally the name customers will see on their card statements. Our chargeback prevention guide explains why an unrecognized name leads to disputes.
• A secure checkout that works end to end, on HTTPS. See the security section below.
• Products that match your application. If you apply as a clothing store and the site also sells supplements, expect questions.

A site is only one part of the review. Our guide on how to get a merchant account covers the documents and steps, and the ecommerce merchant account guide explains how the site, gateway and account fit together.

Visa lets you set your own refund policy (section 1.5.4.14). You can offer store credit only, exchanges only, or no refunds at all. What you can't do is keep a restrictive policy hidden.

Under section 5.4.2.5 (last updated October 2025), a merchant that restricts returns, refunds or cancellations must disclose the policy. For online sales, that disclosure must:

• Appear during the pages before final checkout
• Include a "click to accept" button, checkbox or other acknowledgement
• Be either the policy itself or a link to it, as long as the link is part of the click-to-accept step and names the return, refund or cancellation policy

A simple way to meet it: an unchecked box above the Place Order button that reads "I have read and accept the Return and Cancellation Policy," with the underlined words linking to the policy. The order can't go through until the box is checked.

The same section also says you can't ask customers to give up their right to dispute a charge with their bank.

Some states also have their own rules on posting refund policies. Check yours, or ask a lawyer, before you rely on a no-refund policy.

Vague policies cause disputes. "Returns accepted" leaves the customer to fill in the details, and the customer's version is the one their bank hears first. The examples below are starting points. Adapt each one to how your business actually works, and have a lawyer review your final policies, since consumer protection laws vary by state and by what you sell.

Refund and exchange policy (example)

We offer a 30-day money-back guarantee on most products. To return an item, contact customer service at [PHONE] or [EMAIL] within 30 days of your purchase date to get a return authorization (RMA) number. Send the item with the RMA number to: [RETURN ADDRESS]. Returns sent without an RMA number will be sent back to you. Refunds go back to the card you paid with within [X] business days of receiving the return.

Order cancellation policy (example)

To cancel an order, email [EMAIL] or call [PHONE] with your first and last name, order number and the email address you used to order. We'll cancel any order that hasn't shipped yet and refund you in full. If your order shipped before we received your request, we'll refund the full amount, including shipping, once it's returned. If you ask to cancel after it ships, we'll refund the merchandise total less shipping once it's returned.

Warranty policy (example)

90-day warranty: Products are covered for 90 days from delivery against defects in manufacturing. The warranty doesn't cover misuse or use outside the product's intended purpose.

One-year parts warranty: Parts (except refurbished items) are covered against manufacturer defects for one year from purchase. We'll repair or replace the part, depending on availability.

Shipping: You pay to ship the item to us; we pay to ship the repaired or replacement item back. Replacements ship by ground unless you request faster shipping at your own cost.

Out-of-stock and pre-order policy (example)

Stock levels change during the day. If an item you ordered is out of stock, we'll email you within [X] business days with the expected ship date and give you the choice to wait or cancel for a full refund. If we don't hear back within 3 days, we'll call you. Items that haven't been released yet can be pre-ordered; they ship first come, first served.

Post your policies where customers see them before they pay, repeat them in the order confirmation email, and put a printed copy in physical shipments.

If you bill customers on a schedule, Visa asks for more. Under section 5.8.11.1 of the April 2026 rules, a merchant with recurring charges must, among other things:

• Get the customer's express, informed consent to terms that include the price, billing timing and frequency, and the length of any trial or introductory offer
• Show those terms when the customer agrees, separately from your general terms and conditions
• Offer a simple way to cancel, and an online way to cancel if the customer signed up online
• Notify the customer at least 7 days before a charge when a trial, introductory offer or promotional period is ending

Mastercard has its own subscription rules. Our guide to the recurring billing rules for subscriptions covers both networks, and the Authorize.Net recurring billing guide shows how to set up the billing itself.

"128-bit SSL" is out-of-date wording. Card data security rules come from PCI DSS, the Payment Card Industry Data Security Standard. Version 4.0.1 is the only active version, and its Requirement 4 covers protecting card data with strong cryptography when it travels over public networks.

The PCI Security Standards Council's FAQ 1491 (updated July 2026) is clear that PCI DSS does not consider SSL or "early TLS" (TLS 1.0 and 1.1) to be strong cryptography. In plain terms:

• Your whole site, and certainly checkout, should load over HTTPS with a valid certificate.
• Your host, shopping cart and payment gateway should use current TLS versions and settings.
• The easiest way to limit your PCI work is to let the gateway collect card details, through a hosted payment page or form, so card numbers never touch your server.

Which PCI questionnaire you file depends on how your checkout collects cards. Our PCI compliance guide explains the options, and the Authorize.Net integration guide shows which method puts you in which scope.

Most website problems don't lead to a decline. They lead to questions, and questions add days. The usual culprits:

1. The site isn't finished. Empty product pages, "lorem ipsum" text, or a policy page that still says [YOUR COMPANY].
2. Missing or copied policies. No refund policy, or one copied from another store that names the wrong company or describes a process you don't use.
3. No way to reach you. A contact form only, with no phone number or email address.
4. A name mismatch. The site, the application and the business registration all show different names.
5. Products the application didn't mention. Some categories need extra review. Our guide to what makes a business high risk lists them.
6. Health or earnings claims that promise results the product can't guarantee.
7. A checkout that doesn't work, or one that isn't on HTTPS.

Fix these before you apply, and keep the site current once you're live. For the order-level risks that come after approval, read our guide to card-not-present fraud warning signs.

START Merchant Services is a registered MSP/ISO of Elavon, Inc., and has worked with Authorize.Net for more than 20 years. Not sure whether your site is ready? Call us at 888-573-7587 (Monday to Friday, 9 to 5 Mountain Time) before you apply. Most merchants are approved in 1–5 business days, and an Authorize.Net gateway is usually set up within 24 business hours of approval.

Pricing is interchange-plus, with no termination, annual or AVS fees. If your website is ready, start your merchant account application.