What BRAM actually does
Mastercard does not directly underwrite merchants — its acquiring banks do. BRAM is the mechanism by which Mastercard holds those acquirers accountable. If an acquirer boards a peptide merchant without the right paperwork, BRAM fines the acquirer per merchant, per month — until the issue is remediated or the merchant is terminated.
The practical effect on the market: generalist high-risk processors who used to advertise peptides as a specialty category quietly stopped accepting applications in late 2025. The math no longer works. Every peptide merchant boarded without LegitScript and full BRAM-compliant documentation is a per-month fine waiting to land.
The GLB 11691.1 update
In June 2025, Mastercard amended BRAM to explicitly include:
- Research peptides marketed for human use
- Unapproved injectables (compounded GLP-1s without telemedicine + 503A/503B pharmacy chain of custody)
- Merchants with public-record FDA warning letters and no documented remediation
- Merchants on the MATCH list without acquirer-level review and documentation
This is why a peptide merchant who was boarded easily in 2023 cannot replicate that experience in 2026 — the rules changed and the acquirers' tolerance for BRAM exposure tightened.
How PeptideRails handles BRAM
Our underwriting screen is built around BRAM requirements, not retrofitted to them. Every MID we issue carries the documentation set the BRAM auditors look for, in the order they look for it. We don't board merchants whose presence in your portfolio would create BRAM exposure for the acquirer.