How payment processors decide which adult games can be sold

Payment companies decide what can be sold online because nearly every online sale passes through them, and each company in the chain can refuse a merchant. Adult games are legal in most countries. They are still restricted in practice, because card networks have rules about transactions that could damage their brand, banks enforce those rules cautiously, and stores cannot survive without card payments.

This page explains who the companies are, which rules they apply, and how a rule written for a card network ends up removing a game from a store.

Key points

• Four kinds of company sit between a buyer and a game: the card network, the buyer’s bank, the store’s bank and the payment processor.
• Mastercard’s rule 5.12.7 bars transactions that are illegal or that Mastercard considers brand-damaging. The second part covers legal content.
• Stripe does not support adult content at all. PayPal restricts it.
• Specialist processors accept adult businesses at higher fees and after a review.
• A store that loses card payments loses them for everything it sells, which is why stores comply quickly.

Who is in the chain

The networks rarely deal with merchants. They hold the acquiring banks responsible, the banks hold the processors responsible, and the processors hold the merchants responsible. A concern raised at the top travels down as an instruction, and each layer tends to be stricter than the one above, because none of them wants to be the one that is fined.

The rules that matter

Mastercard: rule 5.12.7

The Mastercard Rules contain a rule headed “Illegal or Brand-damaging Transactions”. It bars a merchant from submitting any transaction that is illegal, or that Mastercard, at its sole discretion, considers damaging to its goodwill or reflecting badly on its brand. The examples it gives include the sale of material showing non-consensual sexual behaviour, sexual exploitation of a minor and bestiality.

The rule gives Mastercard discretion, and it does not require the content to be illegal. When Valve explained the removal of games from Steam in 2025, it said payment processors had cited this rule and “risk to the Mastercard brand”.

Mastercard: the 2021 adult content standards

In 2021 Mastercard tightened its requirements for merchants that sell adult content. From 15 October 2021, as CCBill summarised, banks have had to certify that such a merchant verifies the age and identity of everyone depicted, keeps written consent, reviews content before publication and resolves complaints about illegal content within seven business days.

Those standards were written for content showing real people. Drawn and rendered games do not have performers to verify. The standards still matter to games, because they made banks and processors far more cautious about adult merchants of every kind.

Visa: the Integrity Risk Program

Visa manages the same risk through its Integrity Risk Program. Adult content sits in its highest tier of “high integrity risk” merchants, which brings registration, closer monitoring and higher costs, as LegitScript describes. Adult content merchants are assigned a specific merchant category code, 5967, and Visa’s program explicitly includes adult content generated by AI.

Like Mastercard, Visa allows legal adult content. The conditions are what make it expensive.

Stripe

Stripe’s list of restricted businesses includes adult content in any medium that is made for sexual gratification, and says the same applies to AI-generated content.

Stripe explained the reason to itch.io in July 2025. In the statement itch.io published, Stripe said it is “currently unable to support sexually explicit content due to restrictions placed on them by their banking partners, despite card networks generally supporting adult content”. In other words, the networks permit it, and Stripe’s banks do not.

PayPal

PayPal’s Acceptable Use Policy prohibits using the service for transactions involving “certain sexually oriented materials or services”. The wording leaves the decision to PayPal, which applies it account by account.

Why adult content is treated as high risk

Three reasons come up repeatedly in the processors’ own material.

• Chargebacks. Processors class adult merchants as high risk partly because of disputed payments. Each dispute costs the bank money, and too many of them can end a merchant’s account.
• Legal exposure. A bank that processes payments for illegal content can be liable. Checking every item a merchant sells is costly, so refusing the category is cheaper.
• Reputation. Networks and banks are large public companies. A news story linking a card brand to abusive content is a cost they will pay to avoid.

None of these reasons separates a carefully made adult game from a careless one. That is the core complaint developers make: the rules work on categories, and a category cannot tell good work from bad.

How a rule becomes a removed game

The route is indirect, and the events of July 2025 show each step.

1. Someone complains to the payment companies. In July 2025 the campaign group Collective Shout wrote an open letter to the heads of PayPal, Mastercard, Visa and three other companies, asking them to stop processing payments for Steam and itch.io.
2. The network’s concern reaches the banks and processors. Valve said Mastercard communicated with payment processors and their acquiring banks, and never with Valve directly.
3. The processors go to the store. They cited rule 5.12.7.
4. The store acts on a whole category. Steam added a rule against content that might violate its payment partners’ standards and removed a set of games. itch.io removed all adult content from search while it audited its catalogue.

The store acts broadly because the threat is broad. Valve said the loss of payment methods would stop customers buying anything on Steam. A store cannot isolate the risk to the games in question, so it protects the whole business.

For the dated sequence, see the timeline of what happened on Steam and itch.io.

This has happened before

What was new in 2025 was the target: large general game stores, where adult titles are a small part of the catalogue.

Which processors accept adult businesses

A small group of processors specialises in adult merchants. The names that appear most often are CCBill, Segpay, Epoch and Verotel. They differ from mainstream processors in three ways.

• Review. They look at a live site before approving it and expect clear terms, a privacy policy, a refund policy, age controls and a way to complain about content.
• Cost. Fees are well above the rates mainstream processors charge.
• Content rules. They apply the card networks’ rules directly, so content the networks consider brand-damaging is refused there too.

A specialist processor makes selling possible. It does not widen what can be sold.

The MATCH list

Processors have one more tool. MATCH is a database run by Mastercard of merchants whose accounts were terminated for reasons such as fraud or excessive chargebacks. An entry lasts five years. Other processors check the list before opening an account, so a listed merchant is usually refused or offered much worse terms. This is why merchants treat a warning from a processor as urgent.

Can the law change this?

In the United States, the Fair Access to Banking Act was introduced in the Senate in February 2025. It would penalise large banks that refuse lawful, creditworthy customers and would bar card networks from refusing service for reputational reasons. It had not become law when this page was written.

After July 2025, itch.io said it was looking for payment partners that could handle what Stripe would not. More processors would give stores more room, but every processor that takes cards answers to the same networks.

What this means for developers

• Read the acceptable use policy of every processor your store uses. Stores now ask creators to confirm compliance themselves.
• Assume the themes named in rule 5.12.7 cannot be sold through card payments on any mainstream store.
• Do not depend on one store or one processor. A rule change at any layer can remove a sales channel in a day.
• Keep your own audience. A mailing list and a website cannot be deindexed by somebody else’s bank.

How this page was put together

The rules are described from the card networks’ and processors’ own published policies, and the events from statements by the companies involved or reports that quote them. All are listed under Sources. This page is not legal or financial advice.

It was written on 2 October 2026 and will be updated when a network or a major processor changes its policy. To report an error, see the corrections standard.