The Visa and Mastercard adult content policy, explained for games

Visa and Mastercard do not ban adult content. Both networks allow it, on three conditions: the merchant is registered as high risk and pays for it, the merchant follows rules about what it sells and how, and the content stays clear of a short list of themes the networks will not carry. The widespread belief that the card networks prohibit adult material comes from the third condition, and from the way banks and processors apply all three more strictly than the networks wrote them.

This page sets out what each network’s policy says, which parts apply to games and fiction, what it costs, and how a rule written by a card network ended up removing games from Steam. It summarises published rules and reports about them. It is not legal or financial advice.

Key points

• Legal adult content is allowed on both networks, under registration and monitoring.
• Mastercard has two relevant rules: rule 5.12.7 on brand-damaging transactions, and the adult content standards that took effect on 15 October 2021.
• Visa manages the same risk through its Integrity Risk Program, where adult content sits in the highest tier under merchant category code 5967.
• The consent rules were written for real people. The content rules still reach fiction, including games.
• The networks do not deal with game stores. They hold banks responsible, and banks and processors enforce.
• Registration costs about $2,000 a year across both networks before any sales, on CCBill’s published fees.

The two networks side by side

Sources: the Mastercard Rules, LegitScript on Visa’s program, and CCBill’s pricing page for the fees.

Mastercard: rule 5.12.7

The Mastercard Rules contain a rule headed “Illegal or Brand-damaging Transactions”. It bars a merchant from submitting any transaction that is illegal, or that Mastercard, at its sole discretion, considers damaging to its goodwill or reflecting badly on its brand. The examples it gives include the sale of material showing non-consensual sexual behaviour, sexual exploitation of a minor and bestiality.

Two features make this the rule that matters most to games.

• It does not require the content to be illegal. The second half of the rule covers legal material that Mastercard decides is bad for its brand.
• It is not limited to real people. The rule speaks of transactions and of material. It makes no exception for drawings, text or rendered scenes.

When Valve explained the removal of games from Steam in 2025, it said payment processors had cited “Rule 5.12.7 and risk to the Mastercard brand”, as Game Developer reported.

Mastercard: the 2021 adult content standards

In April 2021 Mastercard announced new requirements for banks whose merchants sell adult content. It described them as a response to illegal material found on adult sites, four months after it and Visa stopped card payments to Pornhub. They took effect on 15 October 2021.

The adult industry law blog Adult.Law published the rule text at the time. Where a merchant lets other people upload or generate content, it must:

• have a written agreement with each content provider that prohibits illegal content;
• require written consent from every person depicted, covering the depiction, public distribution and, where offered, downloading;
• verify the identity and age of every person depicted, and of the content provider, using government identification;
• review all content before it is published;
• control and monitor any live streaming in real time;
• offer a complaints process, with complaints about illegal or non-consensual content resolved within seven business days;
• not market content, or allow search terms, that give the impression that it contains child exploitation material or depictions of non-consensual activity.

The last item is the one that reaches fiction. It concerns the impression a site gives, not whether anyone real was harmed.

What changed in 2026

According to the processor Mobius Pay, Mastercard revised its Merchant Monitoring Program from 1 January 2026. The changes it describes are that a merchant’s website must be scanned before its first transaction, that monitoring extends into members-only and password-protected areas, and that a compliance problem left unresolved after 15 calendar days counts as a separate failure. Mobius Pay also reports that Mastercard clarified in February 2026 that the standards apply to AI-generated images and video. We have not seen the Mastercard bulletins themselves, which go to banks and are not published, so treat these dates as a processor’s account.

Visa: the Integrity Risk Program

Visa handles the same risk through the Visa Integrity Risk Program, known as VIRP. Payments firms describe it as having replaced Visa’s Global Brand Protection Program on 1 May 2023. It sorts merchants into tiers by the risk they pose to the integrity of Visa’s network.

Adult content is in Tier 1, the highest. LegitScript, a firm that monitors merchants for banks, says Visa associates Tier 1 merchants with elevated risk and subjects them to “increased scrutiny, higher fees, and stricter compliance expectations”. It reports that Visa updated the Tier 1 standards for adult content, dating and escort services and began enforcing them late in 2025. The centre of that update is correct coding: adult content must be processed under merchant category code 5967, “including AI-generated adult content”, and a merchant using another code may be “considered miscoded and subject to enforcement actions”.

Like Mastercard, Visa allows legal adult content. The registration, the monitoring and the fees are what make it expensive.

Do the rules apply to games and fiction?

This is the question the published rules answer least clearly, and the answer has two halves.

The consent rules do not fit. Written consent, identity checks and age verification are requirements about people. A drawn or rendered character has no identity document. A studio that makes its own game is also not a platform taking uploads from third parties, which is the situation the 2021 standards describe.

The content rules still apply. Rule 5.12.7 covers any transaction Mastercard considers brand-damaging. On Visa’s side, LegitScript states its own practice plainly:

“Merchants whose content includes objects or fictional depictions intended to mimic egregious adult content are reported with elevated risk, allowing customers to request content removal when appropriate. Merchants that primarily offer this type of content are reported as noncompliant with VIRP guidelines.”

It gives the examples: “fictional depictions of bestiality or nonconsensual sexual activity”.

In practice, fiction gives a game no general exemption. The themes named in these rules are the same ones that stores such as itch.io now list as unsellable.

What the networks charge

Both networks charge an annual registration fee for high-risk merchants, collected by the processor. CCBill’s pricing page lists “High-Risk Registration (Annual)” fees paid to the card schemes of $950 for Visa and $1,000 for Mastercard, and notes that they apply “only to certain business verticals”.

That is close to $2,000 a year to accept both cards, before the processor’s percentage on each sale. For a store with thousands of adult titles it is nothing. For one developer selling one game from their own site, it is a real part of the reason most sell through a store.

Who actually enforces the rules

Neither network signs up merchants. A merchant has a contract with a processor or an acquiring bank, and the bank answers to the network. Responsibility passes down the chain, and each layer has a reason to be stricter than the one above, because the fines land on the layer that let a problem through.

Stripe described the result in the statement itch.io published in July 2025: it could not support sexually explicit content “due to restrictions placed on them by their banking partners, despite card networks generally supporting adult content (with the appropriate registrations)”. The network permits what the bank refuses. See does Stripe allow adult content and does PayPal allow adult content for those two processors.

The full chain is set out in how payment processors decide which adult games can be sold.

What the networks said about Steam and itch.io

In July 2025 Steam removed a set of adult games and itch.io removed adult content from search. Both pointed to their payment partners.

Mastercard issued a statement in August 2025: “Mastercard has not evaluated any game or required restrictions of any activity on game creator sites and platforms, contrary to media reports and allegations.” It said it allows all lawful purchases on its network and requires merchants to have controls against unlawful ones.

Valve answered that Mastercard had not communicated with it directly, “despite our request to do so”. It said Mastercard communicated with payment processors and their acquiring banks, and that the processors then cited rule 5.12.7 to Valve.

Visa made no comparable public statement that we could find. Mezha reported that Visa replied to customers who wrote in, saying that it prohibits illegal activity, is committed to “protecting legitimate commerce”, and does not make moral judgments about legal purchases.

Both accounts can be true at once. A network can decline to evaluate any game and still maintain a rule that banks and processors invoke on their own initiative. That is the structure working as designed. The dated sequence is in the timeline of the Steam and itch.io removals.

A short history of the policy

Is the policy under pressure?

In the United States, yes, although not on behalf of adult games. On 26 March 2026 the chairman of the Federal Trade Commission wrote to the chief executives of Visa, Mastercard, PayPal and Stripe about denying customers access to financial services. PC Gamer reported that the letter to Mastercard said the company must not “countenance unlawful debanking by members that process transactions on its network”.

The letters follow an executive order about political and religious views, and the FTC’s announcement does not mention adult content. They put no rule out of force. A bill in Congress would go further by barring card networks from refusing lawful customers for reputational reasons. Our page on the Fair Access to Banking Act explains it.

What this means for developers

• Legal does not mean sellable. The test is the networks’ rules as banks read them, not the law of your country.
• Fiction is not an exemption. Non-consensual themes and the other content named in these rules are treated as high risk in drawn and written work too.
• If you sell direct, you need registration. That means a processor that handles adult merchants and the annual fees above. See the payment processors that accept adult content.
• If you sell through a store, the store’s rules are these rules, read cautiously. See where adult games can be sold in 2026.

How this page was put together

Rule 5.12.7 is described from the Mastercard Rules. The 2021 standards are described from Mastercard’s announcement and from the rule text a law blog published at the time. Visa does not publish its program guide, so the description of it comes from LegitScript and from payment firms that work under it, and is labelled as theirs. The 2026 Mastercard changes are one processor’s account. The companies’ statements are quoted from the reports listed under Sources.

This page was written on 7 October 2026 and will be updated when either network changes its rules. To report an error, see the corrections standard.