Boarding a gun shop involves one decision that most merchants never hear about: which four-digit merchant category code goes on the account. In three states the law requires a code that exists only for firearms and ammunition retailers. In about twenty others the law forbids it. In July 2026 the US House passed a bill that would forbid it nationwide and override every state law on the subject, mandates and bans alike. The Senate has not acted on it.
This piece sets out where things stand as of October 2026, from the statutes, Visa's Merchant Data Standards Manual (April 2026) and Mastercard's Quick Reference Booklet (2 June 2026). It is not legal advice; a portfolio with firearms merchants in several states should have counsel confirm each one.
Where MCC 5723 Came From
The International Organization for Standardization approved a merchant category code for firearms and ammunition businesses, MCC 5723, on 9 September 2022. Before then a specialist gun shop was usually coded under a broader category such as sporting goods or miscellaneous specialty retail.
The networks first said they would implement it, then stopped. On 9 March 2023 Visa paused implementation, citing confusion and legal uncertainty created by state legislation. Mastercard paused the same day, and American Express and Discover followed.
What the Network Manuals Say Now
The pause did not keep the code out of the networks' rulebooks. Both now list it, but only for use where a law requires it.
- Visa's Merchant Data Standards Manual (April 2026) lists MCC 5723, Guns and Ammunition Shops, for merchants whose primary business is guns or ammunition, to be used only in jurisdictions where it is legally required. A footnote says acquirers must assign MCC 5723 to all retailers in California, Colorado and New York that meet the definition of a firearms merchant under applicable law.
- Mastercard's Quick Reference Booklet (2 June 2026) lists MCC 5723, Firearm and Ammunition Stores, as conditional use only, based on the merchant's primary business and on the acquirer's determination that applicable law or regulation requires it.
- Both manuals still give firearms a home elsewhere. Visa lists hunting equipment and supplies, including firearms and ammunition, under MCC 5941, Sporting Goods Stores. Mastercard's description of MCC 5999, Miscellaneous and Specialty Retail Stores, names firearms and ammunition stores as an example. Both list firearms among the products of MCC 5099, the wholesale durable goods code.
In practice the networks have passed the decision to the acquirer: whether 5723 applies depends on the law, and the acquirer decides what the law requires for each merchant.
The Three States That Require It
California, Colorado and New York passed near-identical laws: networks had to make the code available in 2024, and acquirers must assign it from 1 May 2025.
- California (Financial Code sections 110000 to 110002, added by AB 1587, signed 26 September 2023). A firearms merchant is a business licensed in California as a firearms dealer or ammunition vendor whose highest sales value is, or is expected to be, from the combined sale in California of firearms, firearm accessories or ammunition, as stated by the business to its merchant acquirer. The Attorney General enforces it exclusively after 30 days' notice and a chance to cure; the penalty is $10,000 per violation.
- Colorado (C.R.S. 6-27-201 to 6-27-206, added by SB24-066, signed 1 May 2024). A firearms merchant is physically located in Colorado and has its highest gross revenue, or expected revenue, from the combined sale in Colorado of firearms, firearm accessories or ammunition, as stated by the business to its merchant acquirer. The Attorney General must give at least 45 days' notice and may not sue if the violation is cured within 30 days and the acquirer confirms it in a statement made under penalty of perjury. The penalty is up to $10,000 per violation.
- New York (General Business Law section 529-a, added by Chapter 430 of 2024, signed 9 October 2024). A dealer of firearms is a gunsmith or firearms dealer licensed under Penal Law section 400.00 whose highest sales value is, or is expected to be, from the combined sale in New York of firearms, firearm accessories or ammunition, as stated by the business to its merchant acquirer. The law originally also covered any business that sells ammunition. Chapter 116 of 2025, signed 3 April 2025, removed that category before the acquirer deadline. The Attorney General gives 30 days to cure, and a court may impose up to $10,000 per violation.
Two features matter for an onboarding team. None of the three laws catches every merchant that sells a gun: a sporting goods chain with a firearms counter is not covered unless firearms, accessories and ammunition are its largest line. And the tests turn on the merchant's sales mix and, in California and New York, a state licence. An application that asks for neither leaves the acquirer nothing to apply the test to.
The States That Forbid It
The other side has more states. The National Shooting Sports Foundation, which campaigns for these laws, lists 20 states with a prohibition in its 2026 fact sheet: Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kentucky, Louisiana, Mississippi, Montana, New Hampshire, North Dakota, Ohio, South Dakota, Tennessee, Texas, Utah, West Virginia and Wyoming. That is an advocacy group's count. We checked the Texas, Florida and Arkansas (Act 452 of 2025) enactments directly, and earlier tallies from Payments Dive and the Association of Payment Professionals match the states they cover. The laws are not uniform: the Association of Payment Professionals reported in 2024 penalties from $10,000 to $25,000 per transaction or assignment, with some states making a violation a felony.
- Texas (Business and Commerce Code chapter 610, in effect since 1 September 2023). Anyone involved in facilitating or processing a card payment, including an issuer or network, may not assign a firearms code to a merchant or require one to use it. The statute defines a firearms code as any ISO code for a firearms retailer, including 5723. A firearms retailer is anyone engaged in selling firearms, ammunition or firearms accessories, with no primary-business test. Such a retailer may only use or be assigned a code for general merchandise retailers or sporting goods retailers, and any contract saying otherwise is void. The Attorney General enforces it, with a 30-day cure period and a $10,000 penalty per violation; a cardholder who bought a firearm, ammunition or an accessory may also sue an issuer or network for a declaratory judgment or injunction.
- Florida (section 790.335, amended by CS/SB 214, in effect since 1 July 2023). An entity facilitating or processing a card transaction may not assign or require a code that classifies a merchant as a firearms or ammunition retailer or places it in a similar classification; such merchants may be assigned a general merchandise or sporting goods code. A separate clause bars a merchant acquiring entity from classifying a seller of firearms or ammunition separately from general merchandise or sporting goods retailers. The Department of Agriculture and Consumer Services can investigate and impose administrative fines.
Texas and Florida name only general merchandise and sporting goods codes as the alternative. MCC 5941 is plainly a sporting goods code, and MCC 5399, Miscellaneous General Merchandise, plainly a general merchandise one. Whether MCC 5999 counts as general merchandise under those statutes is a question for counsel, whatever Mastercard's manual lists there.
The Federal Bill
The Protecting Privacy in Purchases Act, H.R. 1181, passed the House on 14 July 2026 by 221 votes to 201. It was received in the Senate the next day and referred to the Banking Committee. The congress.gov record shows no later action as of early October 2026. A companion Senate bill, S. 1715, has been in the same committee since May 2025. Neither is law.
As passed by the House, the bill would bar networks from requiring, and any covered entity from assigning, a code used only or primarily for firearms retailers or that identifies a retailer as selling firearms, ammunition, accessories or components. Covered entities include anyone with a relationship with a merchant for processing card transactions and anyone with a relationship with such an entity, which on its face reaches beyond the acquirer to its processing partners.
It would preempt any state or local law regulating the assignment, use or disclosure of such codes, displacing the mandates and the prohibitions alike. The US Attorney General would enforce it through complaints, written notice, 30 days to remedy and then an injunction in federal court. The House text has no civil penalty and creates no private right of action.
What a Merchant-Services Team Should Do
- Ask the primary-business question at boarding for any merchant that sells firearms, ammunition or accessories, and keep the answer. The mandate states' tests rely on what the business tells its acquirer about its sales mix. California and New York also require a state dealer licence, so collect it.
- Decide the code by the merchant's state, not from a national default. Visa says 5723 should be used only where legally required, and in at least Texas and Florida assigning it is itself the violation. Colorado's test requires the merchant to be physically located in the state. Get counsel's view on how online sellers are treated.
- In a prohibiting state, check that the fallback is a code the statute allows. Texas and Florida name general merchandise and sporting goods codes.
- Re-check when the sales mix changes. The mandate tests use highest sales value that is, or is expected to be, from firearms, so a sporting goods merchant that shifts toward firearms can cross the line after boarding.
- Record why the code was chosen: the state, the licence and the merchant's statement. Each mandate state gives 30 days to cure after an Attorney General's notice, and Colorado wants a sworn statement of the cure.
- Watch the Senate. If H.R. 1181 or something like it becomes law, every 5723 assignment in California, Colorado and New York would need remapping.
None of this needs a new system. It needs the MCC treated as an underwriting decision with a recorded reason, not a value picked from a drop-down at the end of boarding.
Tags
About the author
Kyle Hall
Founder
Kyle Hall is a fintech entrepreneur, software engineer, and marketing strategist with over a decade of experience in high-risk payment processing and SaaS development. He is the CEO of PayKings, a leader in high-risk merchant services, and the founder of PulseCRM, a purpose-built CRM platform for the payments industry. Kyle specializes in building custom payment processing systems and growth strategies that empower merchant services providers to scale and succeed in the digital marketplace.