Merchant Website Requirements for Card Payments

Visa and Mastercard rules set out what a merchant website must display, and acquirers combine them into one checklist. In practice they ask for all of the items below, and a missing item often triggers follow-up questions.

• A complete description of the goods or services you sell.
• Your refund and return policy, shown during checkout so the customer acknowledges it before paying. A link in the footer alone is often not enough.
• Customer service contact details: at least an email address or phone number.
• Your business address on the site, and the country your business operates from shown prominently during checkout, not only behind a link, so the customer knows before paying whether the purchase is domestic or international.
• The currency you charge in.
• Your delivery policy, including timescales and where you ship.
• Any export or legal restrictions on what you sell or where.
• Your privacy policy.
• How card details are kept secure when customers pay.

Reviewers compare your website with your application. The legal company name, the products, the prices and the markets on the site should match what you told the provider. A different trading name is fine if the legal entity behind it is shown, usually in the terms and conditions and the footer.

Show the full legal name, registered address, company registration number, VAT number where you have one, and an email address and phone number. If you take payments on more than one website, every one of them has to meet the same requirements and should be declared in your application.

• Terms and conditions that name the legal entity, what you sell, how payment and delivery work, how disputes are handled and which country's law applies.
• A refund and cancellation policy that states when customers can get their money back, or clearly that they cannot.
• A delivery policy with timescales and regions, and what happens if an order is split into several shipments.
• A privacy policy covering what data you collect, why, who you share it with, how long you keep it and how customers can exercise their rights.

The checkout must work end to end when the site is reviewed, with real products and prices. Prices should include taxes where customers expect them to, and extra costs such as shipping must be shown before payment. Payment pages must use HTTPS, and many providers also expect the card brand logos you accept.

Under PCI DSS, the card industry's security standard, card data must be encrypted when it crosses public networks. Since 31 March 2025, merchants that host their own payment page must also authorise and monitor the scripts on it and detect unauthorised changes. With your provider's hosted page or embedded fields, much of that sits with the provider, but you still have to confirm your site is protected against script attacks, so check what your provider and acquirer expect.

If you sell subscriptions or offer free trials, the card schemes require more, because unclear recurring billing is a leading cause of chargebacks.

• Visa, since 18 April 2020, for free trials and introductory offers: the customer must expressly agree to the ongoing subscription at sign-up, receive a confirmation with the terms and an easy way to cancel, get a reminder at least 7 days before the first charge after the trial, see a trial marker on the first statement after the trial, and be able to cancel online.
• Mastercard, since 22 September 2022: the subscription terms must be shown at the point of payment, without a link out, and actively accepted. The customer gets a confirmation and a receipt after every charge, both with cancellation instructions, and must be able to cancel online. Trials need a reminder 3 to 7 days before they end, and plans billed every 180 days or less often need a notice 7 to 30 days before each charge.

• Before the customer orders: your identity, geographical address, phone number and email, the main characteristics of what you sell, the total price including taxes, and the delivery and payment arrangements.
• An order button that makes clear the customer is committing to pay.
• Information about the 14-day right of withdrawal, where it applies.
• Since 19 June 2026, for contracts made online that carry a right of withdrawal, a prominent withdrawal function labelled 'withdraw from contract here' or similar, available throughout the withdrawal period and followed by a confirmation step. Customers cannot be made to register or log in to use it unless that was needed to make the contract.
• You no longer need to link to the EU's online dispute resolution platform: it closed on 20 July 2025 and the requirement went with it.

• The site is live and public, not password protected or under construction.
• Products and prices are visible, and the checkout works.
• You own the domain, or can explain how it connects to your business.
• What you sell matches the category and products in your application.
• Age verification is in place for age-restricted products, and licences are shown where your activity needs one.
• Nothing on the site suggests a product or market you did not declare.

Many providers will review a staging site or screenshots if you are not live yet, but expect the final site to be checked again before or soon after you start processing. Put the policies and company details in place first: they are what reviewers look for before anything else.

Ecompayer is not a payment provider. You add your business, website, markets and volumes once, and your profile is matched with a payment provider that accepts your industry. Your account is then prepared with that provider. Final approval and terms are always the provider's decision.

• Visa, Providing the Proper Location of Your Merchant Business, and Optimize Cross-Border Ecommerce.
• Visa, rules for free trials and introductory offers, April 2020.
• Mastercard, Subscription, Recurring Payments and Negative Option Billing Merchants, merchant FAQ and summary.
• Directive 2011/83/EU on consumer rights, as amended by Directive (EU) 2019/2161 and Directive (EU) 2023/2673; Regulation (EU) 2024/3228 on the ODR platform.
• PCI Security Standards Council, PCI DSS v4.0.1, requirements 4.2.1, 6.4.3 and 11.6.1.
• Website requirements published by Stripe, Checkout.com, Adyen, Braintree, Clearhaus, Worldline and Fiserv.

All payment guides