Mastercard’s Policy on Adult Content: What Merchants Need to Know

Mastercard lets adult content businesses accept its cards, but only through a bank that has registered the merchant and certified that it controls what appears on its site. That is the heart of the policy Mastercard announced in April 2021: documented age, identity and consent for everyone in the content, review before anything is published, a fast complaint process and a way for people to have their content taken down. Below we explain each requirement in plain words, who it reaches, what underwriting looks like and where we can and cannot help.

The bottom line

• The rules are about control, not about banning a category. Mastercard’s position is that it will not allow unlawful activity on its network, and its 2021 update asks adult content sellers to prove they can prevent it.
• Your bank has to vouch for you. The acquiring bank must certify that a seller of adult content has effective controls to monitor, block and take down illegal content. No certification, no processing.
• Four controls carry most of the weight: documented age and identity verification, review before publication, a complaint process that resolves illegal or nonconsensual content within seven business days, and an appeals process so any person depicted can ask for removal.
• Expect specialized underwriting. Adult businesses are treated as high-risk, which usually means more documents, closer monitoring, reserves and higher fees than a typical retail account.
• Rules change. Mastercard updates its standards over time, so check the current rules with your processor before you build or change your site.

Who wrote this, and what we will not claim

Nationwide Payment Systems (NPS) publishes this guide. We are a payments company in South Florida, in business since 2001, and we work with high-risk and regulated merchants, so we have an interest in this topic. This page describes Mastercard’s published policy in general terms. It is not legal advice, it is not Mastercard’s rulebook, and it does not quote anyone’s rates. The card brands, the acquiring banks and the law all set requirements that can change, and a processor or attorney who knows your exact business model should confirm what applies to you.

We also want to be clear about the tone of this page. It is a guide to payment rules for legal businesses. It does not describe content, and it does not offer any way around the rules. If the goal is to avoid the controls described below, we are not the right partner, and neither is any processor worth working with.

What Mastercard announced in 2021

On April 14, 2021, Mastercard published an update titled “Protecting our network, protecting you: Preventing illegal adult content on our network.” The starting point was a rule Mastercard has had for a long time: it does not permit merchants to engage in unlawful activity on its network. What changed was how much proof Mastercard now expects from the businesses that sell adult content and from the banks that connect them to the network.

Mastercard said it was extending its existing Specialty Merchant Registration requirements. Under that program, certain kinds of merchants must be registered by their bank before the bank processes their card sales. For adult content, the update added a certification step. The bank that connects the merchant to Mastercard has to certify that the seller has effective controls in place to monitor, block and, where necessary, take down illegal content.

Mastercard explained the reason in simple terms. Uploading content to the internet has become easy, and the risks that come with it, especially content made or shared without consent, needed stronger controls. The company tied the new requirements to strong content control measures and to clear, documented consent, and it listed four updated requirements, which we walk through next.

The four requirements, in plain words

Each requirement below is a control a merchant has to run and be able to show. None of them is a box you tick once at sign-up. An underwriter will want to see how each one works in practice, who is responsible for it, and what record it leaves behind.

1. Documented age and identity verification

Mastercard requires documented age and identity verification for everyone depicted in the content and for everyone who uploads it. Both halves matter. A site that checks the people who upload but not the people who appear in what they upload has only done half the job. So has a site that relies on a performer’s word without keeping the documents.

In practice, this means a written process that collects and stores proof of age, proof of identity and documented consent, and a way to match those records to each piece of content. Where outside creators supply content, the merchant needs agreements with them that cover these records and a way to confirm the records are actually kept. Underwriters ask how this works step by step, who has access to the records, and what happens when a record is missing.

2. Review before publication

Mastercard’s update calls for a content review process before publication. The point is that illegal content should be stopped before it goes live, not found later by a customer or a complaint. A merchant that publishes first and reviews afterward does not meet the standard as Mastercard described it.

Review can combine technology and people, and the right mix depends on the volume and the type of content. Live streaming is harder to review in advance than recorded content, so a platform that offers live content should expect detailed questions about how it monitors streams in real time and how quickly it can stop one. Whatever the method, be ready to explain it, show who does the work, and show the records it produces.

3. A complaint process with a deadline

The third requirement is a complaint resolution process that addresses illegal or nonconsensual content within seven business days. Anyone who sees content they believe is illegal or was shared without consent needs a clear, easy way to report it, and the merchant needs a process that reviews the report and resolves it within that window.

The details are where merchants get caught. A complaint form buried several clicks deep, an inbox nobody watches, or a review that has no record of when it started and finished will all look weak to an underwriter. A good process has a visible reporting link, a log of every complaint with dates, a named person or team responsible, and a clear rule that confirmed illegal content comes down.

4. An appeals process for removal

The fourth requirement is an appeals process that allows any person depicted to request that their content be removed. This is separate from the general complaint process. It gives the people in the content a direct path to ask for removal, which matters most when consent is disputed or has changed.

Merchants should be able to show how a person makes that request, how the request is verified, how long it takes, and what happens to the content while the request is reviewed. As with complaints, a written policy is the start, and a working, logged process is what an underwriter will want to see.

Who the policy reaches

Several parties sit between a customer’s card and an adult content merchant, and each one carries part of the responsibility. Mastercard sets the standards. The acquiring bank registers the merchant and certifies its controls. The processor reviews the merchant’s application and monitors the account. The merchant runs the controls every day. When any one of them is missing, the merchant cannot process Mastercard sales properly.

The 2021 update was written about sellers of adult content, and it speaks most directly to websites and platforms where content is uploaded, sold, streamed or offered by subscription. It is not a rule for every website that publishes content. A news site, a streaming service for general entertainment or a digital library is not covered by the adult content requirements simply because it publishes video or articles. If your business sells adult products in a physical store, or you are not sure whether your model counts as adult content, ask your processor how it is classified before you apply.

Platforms that host content from many creators carry the heaviest load, because they have to run the controls for every person and every upload, not just their own productions. A single studio with its own content still needs the same records, but it controls the whole process and usually has fewer moving parts to explain.

What underwriting looks like for an adult business

Adult entertainment businesses are usually considered high-risk because of chargeback exposure, brand risk, age verification concerns, content restrictions and regulatory requirements. Our guide to high-risk merchant accounts explains that the label does not mean a business is doing anything wrong. It means the bank wants an underwriter who understands the category and a merchant who can show its controls.

When we describe this category in our high-risk credit card processing questions and answers, these are the things processors may require:

• Age verification, and the records behind it.
• Clear terms and conditions, plus refund and cancellation policies a customer can find.
• Proper billing descriptors, so customers recognize the charge on their statement.
• Strong fraud controls and chargeback monitoring.
• A content review process and compliance documentation.
• Registration with the card brands, handled through the bank.
• Payouts to creators made through a compliant provider.
• Higher fees and reserve requirements than a typical retail account.

Two more points come up often. First, sites built on AI-generated adult content are difficult to get approved, so raise it early if it applies to you. Second, disclose the whole business model. A specialized merchant account works only when the bank knows what you sell, how you advertise it and how you deliver it. Describing an adult site as a general media company to get through underwriting is the fastest route to a closed account, because reviewers look at your website and can see what is actually there.

What happens when the controls are not in place

Mastercard has said plainly that it does not permit unlawful activity on its network. When a merchant’s controls fail, or turn out to have been missing, the bank and the processor are the ones who act, and the usual outcomes are serious. Funds can be held while the account is reviewed, a reserve can be added or increased, and the account can be closed.

A closed account can also follow the business. Our guide to the MATCH list explains that MATCH is a list maintained by Mastercard of merchants whose processing was terminated for risk-related reasons, and that being on it can make a new merchant account very hard to get for up to five years. The bank or processor places a merchant there, not Mastercard. For an adult business, that is one more reason to get the controls right before applying, not after a problem.

If an account has already been flagged, our article on the restricted merchant label explains what that status usually means and the questions to ask your processor. And if you think you may already be on MATCH, start with how to find out why a business is on the MATCH list.

Chargebacks, billing and subscriptions

Content rules get most of the attention, but many adult businesses run into trouble through chargebacks. Subscriptions and digital delivery both raise dispute risk. Customers forget they enrolled, do not recognize a billing descriptor, or cannot find how to cancel, and each of those turns into a dispute. When dispute ratios pass the card networks’ thresholds, a merchant can be placed in a monitoring program, and the account becomes harder to keep.

The fixes are practical. Use a billing descriptor customers will recognize. Disclose recurring billing clearly at sign-up. Make cancellation instructions easy to find, and make customer support easy to reach. Send receipts. Our guide to high-risk chargebacks and account protection covers dispute monitoring programs and tools that can refund a disputed sale before it becomes a formal chargeback, which can protect an account that is close to a threshold.

None of this replaces the content controls. A merchant with a clean chargeback record can still lose an account over a content failure, and a merchant with strong content controls can still lose one over disputes. Underwriters look at both.

Where NPS fits, and where it does not

We work with high-risk and regulated industries, including adult businesses, through a full underwriting process. That includes adult websites, strip clubs, bars, adult toy stores and lingerie shops. Many of them struggle to get approved mainly because of how their website is worded, so we look at the site with you before the application goes in. We help merchants prepare for that review, walk them through industry practices such as chargeback management, and offer live, U.S.-based support with a dedicated account manager. Every account is subject to underwriting and compliance approval by the bank, so we cannot promise any merchant an approval, and we do not set the card brands’ rules.

Here is where we may not be the right choice:

• You cannot document age, identity and consent for everyone in your content. No processor can fix that, and Mastercard’s rules require it.
• You want to describe the business as something else to get approved. We will not do that, and a processor that offers to is putting your account at risk.
• You want instant, self-service sign-up. We underwrite each account, and adult accounts take longer than most.
• You would rather not provide underwriting documents. Any specialized processor will ask for them.
• Your site is built on AI-generated adult content. These sites are difficult to get approved, and we will tell you so at the start.
• You are choosing only on the lowest advertised rate. We price each merchant individually and do not publish one universal rate.

Our NPS review page explains how we price, what we support and who we are not built for in more detail.

Before you apply: a short checklist

Use this list to test your own readiness before you talk to any processor, including us. If you cannot answer one of these plainly, that is the place to start.

1. Records: documented age, identity and consent for everyone depicted and everyone who uploads, matched to each piece of content.
2. Review: a written process that reviews content before it is published, including how live content is monitored.
3. Complaints: a visible reporting link and a logged process that resolves illegal or nonconsensual content within seven business days.
4. Appeals: a way for any person depicted to request removal, with a record of each request and its outcome.
5. Billing: a recognizable descriptor, clear recurring billing terms, and refund and cancellation policies that are easy to find.
6. Honesty: a full, accurate description of what you sell, how you sell it and how creators are paid.

Have your business registration, your website, your policies and, if you already process cards, several months of recent statements ready as well. Underwriting goes faster when the documents arrive together.

Next step

Mastercard’s adult content policy rewards businesses that can show their controls, not businesses that promise them. If you run those controls today, the conversation with a processor is about fit, pricing and support. If you do not, build them first, because no application will get far without them.

If you want a second opinion on whether your business is ready, or why an existing account was flagged, you can talk with our team. If we are not the right fit, we will say so.

Frequently asked questions

What is Mastercard’s policy on adult content?

Mastercard does not permit unlawful activity on its network, and in April 2021 it strengthened its rules for adult content sellers. The bank that connects a merchant must certify that the merchant has effective controls to monitor, block and take down illegal content. The merchant must also verify age and identity, review content before publication, resolve complaints and offer removal appeals.

Can an adult content website accept Mastercard?

Yes, if a bank and processor will underwrite it and the merchant meets Mastercard’s requirements. The bank registers the merchant and certifies its content controls before processing. Approval is never automatic, so expect detailed questions about your controls and your business model.

What are the four main requirements in Mastercard’s 2021 update?

Documented age and identity verification for everyone depicted and everyone who uploads. A content review process before publication. A complaint process that addresses illegal or nonconsensual content within seven business days. An appeals process that lets any person depicted request removal of their content.

Does the policy apply to every website that publishes content?

No. The 2021 update was written about sellers of adult content, especially sites where content is uploaded, sold or streamed. A general news, entertainment or media site is not covered just because it publishes video. If you are unsure how your business is classified, ask your processor before you apply.

Is an adult business considered high-risk?

Usually, yes. Adult entertainment businesses are typically treated as high-risk because of chargeback exposure, brand risk, age verification concerns, content restrictions and regulation. That means more detailed underwriting, closer monitoring, and often higher fees and reserves.

What happens if a merchant does not meet the requirements?

The bank or processor can hold funds, add a reserve or close the account. A merchant whose account is terminated for risk reasons can be placed on the MATCH list, which Mastercard maintains, and that can make a new account very hard to get for up to five years.

Are Mastercard’s adult content rules still the same today?

Mastercard updates its standards over time, so the details can change. This page describes the policy as Mastercard published it in 2021. Check the current rules with your processor before you build or change your site or your controls.