MCC 5723 Rules for Online Gun Sellers by State and H.R. 1181

Card acquirers in California, Colorado, and New York have been required since May 1, 2025 to assign merchant category code (MCC) 5723, the code for firearm and ammunition stores, to qualifying gun retailers. A larger group of states forbids the same code or limits what banks can do with it, and the National Shooting Sports Foundation (NSSF), the trade group that campaigned for those laws, counts 20 of them. On July 14, 2026, the U.S. House voted 221 to 201 to pass H.R. 1181, the Protecting Privacy in Purchases Act, which would ban firearms-only codes nationwide and preempt state laws that regulate them, on either side. The Senate referred the bill to its Banking, Housing, and Urban Affairs Committee the next day, and congress.gov shows no further action.

For a firearm or ammunition seller that ships orders to federal firearms licensees (FFLs) around the country, the practical question is narrower than the politics. Which of these laws applies to the merchant account depends mostly on where the business is licensed and located, and the answer shows up in one place: the four-digit code the acquiring bank puts on the account.

What MCC 5723 is and why the networks paused it

An MCC is a four-digit number that card networks use to classify a merchant by its main line of business. It describes the store, not the item in the basket. The International Organization for Standardization (ISO) created the firearms and ammunition code on September 9, 2022, the date the California, Colorado, and New York statutes all cite.

Six months later the networks stepped back. On March 9, 2023, Visa said state actions had created “significant confusion and legal uncertainty in the payments ecosystem” and that it was “pausing implementation of the MCC,” CNBC reported. Mastercard spokesman Seth Eisen said competing state bills would cause “inconsistency” in how merchants, banks, and networks applied the code, and that the code would not let banks see which specific items a consumer bought. Discover said it was dropping the code from an April network update.

The state mandates brought it back in a limited form. Visa’s Merchant Data Standards Manual, April 2026 edition, lists 5723 as “Guns and Ammunition Shops” with the note “This MCC should only be used in those jurisdictions where it is legally required.” A footnote says acquirers “must assign ISO’s MCC 5723 to all retailers in California, Colorado and New York that meet the definition of a ‘firearms merchant’ under applicable law.” Mastercard’s merchant Quick Reference Booklet also lists MCC 5723, titled Firearm and Ammunition Stores. EC4IM did not find a current public statement from American Express on how it handles the code.

The three states that require the code

All three mandates follow the same pattern. The card networks had to make the code available by a set date, and on May 1, 2025 acquirers had to begin assigning it. Each law covers only a business whose largest share of sales comes from firearms, firearm accessories, and ammunition combined, as the business reports to its acquirer.

State	Law	Who is covered	Network deadline	Acquirer deadline	Enforcement
California	AB 1587 (Stats. 2023, ch. 247), Financial Code sections 110000 to 110002, effective January 1, 2024	A business licensed in California as a firearms dealer or ammunition vendor whose highest sales value is from combined sales in California of firearms, accessories, or ammunition	July 1, 2024	May 1, 2025	Attorney general only; $10,000 civil penalty per violation
Colorado	SB24-066, signed May 1, 2024, effective August 7, 2024 (C.R.S. 6-27-201 to 206)	A business physically located in Colorado whose highest gross revenue is from combined sales in Colorado of firearms, accessories, or ammunition	September 1, 2024	May 1, 2025	Attorney general only; 45-day notice, 30-day cure, up to $10,000 per violation
New York	S.8479-A/A.9862-A, signed October 9, 2024, amended by S.745 (Chapter 116 of 2025), General Business Law section 529-a	A gunsmith or firearms dealer licensed under Penal Law section 400.00 whose highest sales value is from combined sales in New York of firearms, accessories, or ammunition	November 1, 2024	May 1, 2025	Attorney general; 30-day cure, up to $10,000 per violation

The details differ in ways that matter for a catalog. Colorado defines a firearm accessory narrowly, as a device that alters a gun’s firing capability, its lethality, or the shooter’s ability to hold or use it. New York’s first version also covered anyone in the business of selling ammunition. The 2025 amendment, signed April 3, struck “dealer of ammunition” from the law, and its sponsor memo describes the change as a way “to better align” New York with other states. California still reaches licensed ammunition vendors.

None of the three laws tells banks to do anything with the data once the code is assigned. A California Assembly Banking and Finance Committee analysis of AB 1587 put it plainly, saying the bill “imposes no requirements on institutions” to report suspected illegal firearms trafficking.

The states that prohibit or restrict it

NSSF’s tally reached 20 states when Arkansas Gov. Sarah Huckabee Sanders signed House Bill 1509 in April 2025: Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kentucky, Louisiana, Mississippi, Montana, New Hampshire, North Dakota, Ohio, South Dakota, Tennessee, Texas, Utah, West Virginia, and Wyoming. That count comes from an advocacy group. EC4IM read the enacted text in five of those states, and the five laws do not work the same way.

Texas. Business and Commerce Code chapter 610, in effect since September 1, 2023, bars anyone who facilitates or processes a card payment, including a card issuer or network, from assigning a firearms code or requiring a merchant to use one. It names 5723 and says a firearms retailer “may only use or be assigned” a general merchandise or sporting goods code. Issuers and networks must notify the cardholder in writing each time a firearms code is assigned to a transaction. After a 30-day cure period, the attorney general can seek $10,000 per violation.
Florida. Section 790.335, amended in 2023, bars acquirers, networks, issuers, and payment settlement entities from classifying a seller of firearms or ammunition apart from general merchandise or sporting goods retailers. The Department of Agriculture and Consumer Services can impose administrative fines for each unlawfully classified retailer.
Kentucky. KRS 237.150, effective July 15, 2024, bars a payment card network from requiring a firearms-specific code and bars any entity that processes card payments for a retailer from assigning one, “including the assigning of merchant category code 5723.” It covers retailers physically located in Kentucky.
Arkansas. Act 452, approved April 3, 2025, contains the same ban for retailers physically located in the state and adds that a merchant itself may not assign 5723 to a purchase of firearms, accessories, components, or ammunition.
West Virginia. Chapter 31A, article 2B, enacted in 2023 as House Bill 2004, aims at what can be done with the code. It bars financial institutions from using a firearms code to decline a lawful transaction, charge a higher fee, or cut off a merchant or customer, and it limits disclosure to government agencies of card records sorted by that code. Its definition of a financial institution includes a gateway.

Penalties vary as much as the wording. The Association of Payment Professionals, an industry trade group, counted 11 enacted bans and 16 states with bills pending in April 2024, and said the laws in some states carry fines of $10,000 to $25,000 per transaction or code assignment, while others treat a violation as a felony.

Which state’s law reaches an online seller

Most of the statutes EC4IM reviewed tie coverage to the seller’s own state, though not all in the same way. Colorado’s mandate applies only to a business physically located in Colorado. California’s applies to a business licensed in California as a firearms dealer or ammunition vendor, and New York’s to a dealer licensed under New York penal law. The Kentucky and Arkansas bans are limited to retailers physically located in those states.

Two of the bans are written more broadly. The Texas definition of a firearms retailer is “any person or entity engaged in the sale of firearms, ammunition for use in firearms, or firearms accessories,” with no in-state limit, and Florida’s classification ban carries no location test either. Neither text says how it applies to an out-of-state merchant that sells into the state.

That leaves room for collisions. The Association of Payment Professionals wrote in 2024 that California’s definition reaches a licensed merchant’s online sales as well as its store sales, and it warned of a possible conflict when an acquirer must assign 5723 to a merchant selling online in California that is physically located in a state that bans the code. EC4IM found no court ruling or attorney general action that has settled such a conflict.

Acquirers also look past the home address. Bank of America’s merchant help page on MCC 5723, dated December 17, 2025, says it asks e-commerce firearms merchants for their principal place of business, state of incorporation, every state with a retail, office, or warehouse location, and the states where they make all or most of their sales. The state of physical location “generally” decides, the bank says, but if most e-commerce firearms, accessory, or ammunition sales go to buyers in California, Colorado, or New York, “we should further evaluate applicable laws.” The same page says a merchant coded 5723 that sells at a gun show outside those three states needs a separate temporary location with a different code, and that a merchant heading to a show inside them needs a temporary location coded 5723.

The sales test can also pull in stores that sell few guns. All three mandates count firearm accessories toward the sales total, so a California-licensed dealer whose revenue comes mostly from optics, magazines, and parts can still land in 5723. EC4IM’s earlier explainer on accessory versus firearm coding covers how processors draw that line.

What changes in the gateway when the code changes

The MCC is set by the acquirer, not by the storefront or the payment gateway. Whether a dealer opened its account directly with a bank or through an agent such as Blue Payment Agency, the code appears on the Value-Added Reseller (VAR) sheet, the processor parameter document the gateway uses to connect the account.

Authorize.Net’s processor update instructions list the MCC among the VAR sheet items and include a four-digit category code field for its TSYS and Heartland connections. A new code is entered through a Processor Update Request support case that only an account owner or administrator can open. When a reseller subsidizes the account, the reseller has to approve and submit the change. Authorize.Net says most updates are finished within one to two days, that transactions authorized before the update settle with the original processing platform, that refunds issued afterward go to the new processor, and that the change does not affect website or API connections.

NMI’s transaction API reference offers two relevant fields. A processor_id value routes a transaction to a specific MID for merchants that run multiple MIDs, set up under Settings and Transaction Routing in the control panel. A descriptor_mcc field sets the descriptor MCC “on supported processors.” NMI does not list which processors honor that field, so whether a store can send it, and whether its acquirer allows it, is a question for the acquirer.

Firearm and ammunition sellers can put these questions to the acquirer before an account review rather than after one:

Which MCC is assigned to each MID and each location, and can the acquirer confirm it in writing?
Which state’s law does the acquirer treat as controlling, and does it rely on principal place of business, incorporation, warehouse locations, or where buyers are?
At what share of sales into California, Colorado, or New York does the acquirer reopen the coding decision?
Will gun show or other temporary sales outside the home state need a separate location or MID with its own code?
Does a code change also change the statement descriptor, and will open batches settle under the old setup?
If a federal ban takes effect, how will the acquirer recode accounts now set to 5723?

The answers also matter at checkout. Federal FFL transfer and age rules apply no matter which code the account carries, as EC4IM laid out in its guide to FFL transfer and age rules for online firearm sales.

Analysis: what H.R. 1181 would change

The House-passed bill, introduced February 11, 2025 by Rep. Riley Moore (R-W.Va.), would bar a payment card network from requiring a firearms retailer to use a code “used only or primarily for firearms retailers,” and would bar any entity that processes card payments for a merchant from assigning one. Its definition of a firearms retailer covers any business physically located in the United States that sells firearms, ammunition, accessories, or components, so it would reach accessory sellers too.

The preemption clause is broad. It voids “any law of a State or local government regulating the assignment, use, or disclosure” of a firearms-specific code. That language would wipe out the California, Colorado, and New York mandates, and on its face it would also displace the state bans, including the Texas cardholder notice rule and West Virginia’s disclosure limits. The bill keeps room for networks and acquirers to comply with laws on dispute processing, fraud, and transaction integrity.

Enforcement would rest with the U.S. Attorney General, who would take complaints, give a violator 30 days to fix a problem, and then could sue for an injunction. The text sets no civil fine and creates no private right of action. The state laws, by contrast, carry penalties of up to $10,000 per violation.

The bill’s path is short on time. A Senate companion, S. 1715 from Sen. Bill Hagerty (R-Tenn.), has sat in the Banking Committee since May 12, 2025, and H.R. 1181 has been there since July 15, 2026. If the Senate does not pass H.R. 1181 before the 119th Congress ends on January 3, 2027, the bill expires and would have to be reintroduced. On the other side, New Jersey Assembly Bill 2117, pre-filed for the 2026 session, would require 5723 beginning May 1, 2027, which would add a fourth mandate state if it passes.

Where this leaves online gun sellers

MCC 5723 is live for qualifying dealers in California, Colorado, and New York, where acquirers have had to assign it since May 1, 2025, while NSSF counts 20 states, Texas, Florida, Kentucky, and Arkansas among them, that ban the code or restrict how it is used. Visa’s own manual now limits the code to places where law requires it. Most of these statutes follow the seller’s license or location rather than the buyer’s address, but acquirers such as Bank of America also weigh where sales go, and the Texas and Florida bans have no location test at all. H.R. 1181 would replace the whole patchwork with a single federal ban, yet it has not moved in the Senate since July. Until that changes, the code a seller actually carries is whatever its acquirer has printed on the VAR sheet, and that is the document worth checking first.

MCC 5723 State Laws Split Online Firearm Processing as H.R. 1181 Waits in the Senate