What High-Risk Underwriters Actually Check Before Approving a Supplement Offer

What documents does a high-risk underwriter ask for and why?

A high-risk merchant account underwriting file is built from six document sets: corporate formation papers, principal identification, three to six months of prior processing statements, a live website audit, product and claims substantiation, and a bank or trade reference. Underwriters read the file as a risk narrative, not a checklist. Missing pieces don't just slow the decision — they get read as something to hide, which is worse than a bad number disclosed upfront.

Prior processing statements carry more weight than any other document in the stack. The underwriter is reading chargeback ratio, refund ratio, average ticket and monthly volume trend month over month, looking for the shape of a business rather than a single snapshot. For readers deciding who actually reviews a supplement application first, the honest answer is that the acquiring bank's risk team does the real underwriting; the ISO or processor selling you the account is a sales layer in front of it.

Product substantiation means lab certificates of analysis, supplement facts panels and any third-party testing you can produce, because the underwriter is trying to price the odds of an FTC or FDA action against the exact formula you're billing for. Corporate documents establish who actually owns the business a MID is being issued to — a detail that matters more than it sounds, since structuring the offer through a merchant of record shifts underwriting liability to a different entity entirely rather than removing it.

Do underwriters actually read your sales page and VSL claims?

Yes — underwriters read the sales page and watch the VSL before they approve anything, because the page is the product as far as the card networks are concerned. Stripe's restricted-businesses list, for one, names nutraceuticals making harmful claims and negative-option marketing with unclear or hidden pricing as flatly prohibited categories, not gray areas to negotiate around.

The review looks for four things: unsubstantiated health claims (cure, reverse, eliminate), before-and-after imagery without disclaimers, pricing that isn't disclosed before checkout, and any negative-option mechanic buried below the fold. A VSL that claims a product reverses a disease state is a decline on sight at most acquiring banks, independent of how clean the merchant's financials are.

Affiliates and media buyers running someone else's funnel carry the same exposure the offer owner does, because the underwriter's decline and the card network's fine both attach to whoever's MID processed the sale. That's the case for running a compliance pass on the funnel before committing spend rather than after the account is already live.

How much does prior processing history weigh versus a fresh start?

Prior processing history weighs more than almost anything else in the file, and a fresh start is not the clean slate operators assume it is. Underwriters and the card networks both read an undocumented history as a bigger red flag than a disclosed bad one, because the absence of statements looks like something is being hidden rather than nothing having happened yet.

That reading has teeth: because a MATCH listing follows the principal — name, address, phone and tax ID, not just the company — an underwriter cross-checking a brand-new LLC against the owner's identity can surface a prior termination the applicant never disclosed. A shell with no history plus a principal who won't explain the gap tends to underwrite worse than a scarred file with a credible remediation story attached.

What actually counts as a bad history is defined by a small number of published thresholds across Visa and Mastercard. Below is where a processing file crosses from acceptable into program territory, per Visa's Acquirer Monitoring Program fact sheet and Braintree/PayPal's published Mastercard chargeback program documentation.

What do they check about the principals — credit, MATCH, prior shutdowns?

Underwriters run a MATCH inquiry and a personal credit check on every principal named on the application, not the corporate entity alone. Each check gets pulled independently, because a business with no history can still fail underwriting if the person behind it carries one, and that history follows the person regardless of how the current entity is structured.

The MATCH reason codes get confused constantly: code 04 is Excessive Chargebacks, code 05 is Excessive Fraud, code 01 is Account Data Compromise, code 10 is Violation of Standards, and code 12 is PCI DSS Non-Compliance. Removal is narrow — the processor has to admit it listed the merchant in error, or, for code 12 only, the merchant has to become PCI compliant; listings for excessive chargebacks or excessive fraud stay on file for the full five years no matter what gets fixed afterward.

Because the reporting acquirer must attach the principal's name, address, phone number and tax ID to the record, a new company formed by the same owner gets matched on inquiry even with a different brand and a different bank. That's the mechanic behind how a MATCH listing follows a person rather than a business, and it's why disclosing a prior shutdown upfront tends to underwrite better than an underwriter discovering it independently.

Personal credit gets pulled to gauge the principal's general reliability and to help price the reserve, not to relitigate the business plan. Trade references and bank references round out the picture — an underwriter calling a prior processor to ask, off the record, why the relationship ended is routine, and that answer can outweigh anything written on the application itself.

Which website elements (terms, refund policy, descriptor disclosure) are pass/fail?

Three elements on the website are pass/fail, not points for negotiation: a terms-of-sale page disclosing the full billing schedule, a refund/cancellation policy matching what checkout actually does, and a billing descriptor a cardholder can recognize on a statement. Fail any one and the file gets declined, or the account gets shut down later when a dispute pattern exposes the mismatch.

Visa's Merchant Data Standards Manual allows a merchant name up to 25 characters in authorization and clearing and requires anything longer to be abbreviated with the identifying part left intact, never simply cut off mid-word. The same manual specifically permits adding language after the merchant name on the first post-trial charge to flag that a promotional price has ended, a disclosure most trial-rebill operators skip and most underwriters now look for by name.

ROSCA sets the federal floor for a negative-option page: the material terms have to be disclosed before billing information is collected, consent has to be obtained affirmatively, and cancellation has to be simple, not tucked behind a retention offer, a phone-only cancel line or a maze of account settings. Section 5 of the FTC Act and state automatic renewal statutes back the same requirement even where a specific federal rule has been vacated or is still being rewritten.

Why do trial-rebill offers get harder scrutiny than straight sale?

Trial-rebill offers draw harder scrutiny because the recurring charge is the exact mechanic the card networks built their monitoring programs around. A straight one-time sale generates a single authorization and, if it goes wrong, a single dispute; a trial-to-subscription offer generates a disclosure obligation, a cancellation obligation and a recurring authorization that a cardholder can dispute weeks after they stopped paying attention to it.

Two Visa dispute codes carry most of that exposure: 10.4, filed for card-absent fraud, and 13.2, filed specifically for a cancelled recurring transaction the cardholder says kept billing. Both get filed disproportionately as friendly fraud, where the cardholder did authorize the purchase but disputes it anyway, which is a different problem than 13.1 or 13.3 disputes, which usually mean the product didn't ship or didn't match the listing.

The federal rule requiring a one-click cancel button, finalized in October 2024, got vacated in full by the Eighth Circuit in July 2025 on procedural grounds — but that vacatur didn't touch ROSCA, the FTC Act, or state automatic renewal law.

California's amended Automatic Renewal Law, effective July 2025, still requires a prominent online cancel link; New York's amended law, effective November 2025, adds price-increase notice windows; Colorado's SB25-145, effective February 2026, keeps the cancel link visible even while a retention offer displays. The FTC reopened rulemaking in March 2026 with an advance notice that doesn't propose specific text yet, so building for the strictest state on file is cheaper right now than betting on where federal policy lands.

What volume caps and conditions come attached to a first approval?

A first approval almost never comes uncapped: expect a monthly volume ceiling, a rolling reserve, and a probationary review window before the account gets treated as established. Nutraceuticals sit among the verticals underwriters reserve hardest against, and the standard structure — a rolling reserve holding back 5% to 15% of processing volume for 90 to 180 days — is the default starting point for a new supplement MID, not a worst case.

Two variants show up instead of the rolling structure: a capped reserve, where withholding stops once a fixed ceiling is reached, and an upfront reserve, funded before the account processes a single transaction. Which one you get depends more on the acquirer's read of your category and prior history than on anything negotiable in the first 90 days, which is the trade for the specific dollar range and holding period a reserve actually runs.

Volume caps exist for the same reason the reserve does: an acquirer limiting a new MID to a modest monthly ceiling limits its own exposure if the fraud or dispute ratio comes in hot before enough transaction history exists to trust it. Expect the cap to lift in stages tied to clean processing months rather than a calendar date, and expect the acquirer to watch the VAMP and Mastercard ratios covered above closely during that window, since a new MID that trips Excessive in month two rarely gets a second chance.

How do you pre-package an application so it clears in days, not weeks?

Pre-packaging an underwriting file means submitting the answer to every question above before the underwriter has to ask, which is the difference between a decision in days and one that drags for weeks of back-and-forth. The file should already contain formation documents, principal ID, prior statements or a credible explanation for their absence, a compliance-reviewed sales page, and a terms/refund/descriptor set that matches the live checkout exactly.

Providers that specialize in the category advertise speed on exactly this pre-packaging, not on lowering the bar — PaymentCloud quotes 24 hours to 5 days once a file is complete, and eMerchantBroker markets placement in as little as 48 hours after approval.

Underwriters reward completeness more than they reward a spotless history, because a complete file lets them price the risk instead of guessing at it. An application that discloses a prior shutdown with context and a fixed root cause routinely clears faster than one that hides a gap the reviewer finds anyway.

• Six months of processing statements, or a signed letter explaining a first-time launch and the founder's relevant experience elsewhere
• A written claims substantiation binder: certificates of analysis, supplement facts panels, and every health claim mapped to its evidence
• A terms page disclosing trial length, rebill amount and cancellation method, matched word-for-word to what checkout actually charges
• A descriptor request that fits Visa's 25-character standard and flags the post-trial price change on the first rebill
• Principal disclosure covering any prior MID, shutdown or MATCH inquiry, submitted proactively rather than surfaced by the underwriter

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, Click-to-Cancel Got Vacated. Your Rebill Rules Didn't Go Anywhere, The ROSCA-Proof Trial Funnel: Consent, Disclosure, and Cancellation Done Right, Stripe Is Holding Your Money: Payout Freezes, Reserves, and Your Exit Plan, Multiple MIDs for One Business: Load Balancing Without Crossing the Line, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.