A four-digit merchant code decided whether memecoin buyers faced KYC

The Block reported on 1 September 2026 that memecoins bought by credit card through Robinhood Wallet and Fomo were processed by Crossmint under merchant category code 5815, digital media, with no identity check and full card rewards. Visa's own rulebook puts crypto purchases under 6051 with a flag. Whether a memecoin is the one thing or the other has not been decided by anyone with authority to decide it.

The short version

• Its Merchant Data Standards Manual, April 2026, says purchases of cryptocurrency must use MCC 6012 or 6051 and carry special condition indicator 7, even if crypto is not the merchant's main business.
• The Block reported on 1 September 2026 that WIF bought by card on Robinhood Wallet and Fomo, via Crossmint, carried the code Visa defines as digital goods media, with no crypto flag.
• Buyers paid through Apple Pay or Google Pay without KYC and earned standard card rewards, which Visa and Mastercard rules withhold from crypto purchases.
• The bank told The Block it believed the 5815 categorisation was incorrect and that the transaction lacked the flags that indicate crypto.
• The SEC's Division of Corporation Finance said on 27 February 2025 that meme coins are akin to collectibles and not securities. That statement says nothing about payments or KYC.
• The New York Attorney General's office says it is reviewing. Its press release index shows nothing on the subject through 31 August 2026.

Card networks treat a crypto purchase as cash, and the code is what tells the issuer

Visa's Merchant Data Standards Manual, April 2026 edition, requires that purchases of cryptocurrency use merchant category code 6012 or 6051 and carry special condition indicator 7 in the authorisation request. Those are Visa's quasi-cash categories. The code and the flag are how a card issuer knows a transaction is a crypto purchase rather than a purchase of goods.

A merchant category code, or MCC, is a four-digit number an acquiring bank assigns to a merchant to describe what it sells. Networks and issuers act on it without looking further. Quasi-cash is the networks' term for things that are readily turned back into money: foreign currency, money orders, travellers' cheques, and cryptocurrency. Buying quasi-cash on a credit card is treated by most issuers as a cash advance. That means interest from day one, a fee, no rewards, and a set of fraud and money laundering controls that do not apply to buying a film.

The identity check sits inside that set. A crypto on-ramp coded as one usually has to establish who its customer is before the sale, because its acquirer, its network and the issuers on the other side expect it to. The same purchase coded as digital media inherits none of that. Nobody in the chain is told that anything unusual is being bought.

Visa's manual anticipates the temptation. Its rule applies "even if selling quasi-cash is not the Merchant's primary business". The question this story raises is what the rule does when the parties disagree about whether the thing sold is quasi-cash at all.

Memecoin purchases through Crossmint were coded as digital media and earned card rewards

The Block reported on 1 September 2026 that users could buy the memecoin WIF on Robinhood Wallet and on Fomo by credit card through Apple Pay or Google Pay, without a separate identity check, and earn standard card rewards. The transactions were processed by Crossmint and carried merchant category code 5815, which Visa defines as digital goods media.

Everything in this section is as reported by The Block's Zack Abrams; no regulator or network has published its own account. Chase, the issuer of the card used, told The Block it "believed the 5815 categorization was incorrect" and was "opening a case with Visa". It said the transaction "did not include the special flags that indicate crypto was involved".

The two apps deferred to their payments partner. Johann Kerbrat, Senior Vice President and General Manager of Robinhood Crypto, told The Block: "That's why we're using a partner, right? It's so that they can do the job on their side." Fomo said Crossmint "represents one of several on-ramp flows available to Fomo users", accounting for about 7% of its inflows.

The networks answered in general terms. Visa: "We require participants in our network to comply with Visa's Rules." Mastercard: "Generally, our goal is to work with acquirers and issuers to remediate problems and to improve compliance." Neither said whether 5815 was right or wrong for this transaction.

Set the two codes side by side and the difference is not a technicality. It is a different set of parties being told a different thing about the same purchase.

As processed, per The Block

MCC 5815, digital goods media

Visa's definition · "books, movies, digital artwork/images or music that is delivered in electronic format"
Crypto indicator 7 · absent
Issuer treatment · ordinary purchase
Rewards · earned
Identity check at the on-ramp · none, per Crossmint
Who knows it is crypto · the buyer and Crossmint

As Visa's rule reads for crypto

MCC 6051 or 6012, quasi-cash

Visa's definition · "Foreign Currency, Liquid and Cryptocurrency Assets (for example: Cryptocurrency)"
Crypto indicator 7 · required in authorisation and clearing
Issuer treatment · quasi-cash, commonly a cash advance
Rewards · typically excluded
Identity check at the on-ramp · expected by acquirer and network
Who knows it is crypto · every party in the chain

Visa's manual already carves one digital collectible out of the crypto flag

Visa's Merchant Data Standards Manual says NFT purchases "can and often do occur in fiat currency, and as such do not require the use of the cryptocurrency Special Condition Indicator of 7 unless the Visa transaction actually represents the purchase of the cryptocurrency that is immediately used to purchase the NFT". It is the closest the manual comes to memecoins.

The full rule is worth reading in Visa's own words. "A Merchant that sells quasi-cash must use MCC 6051 (Non-Financial Institutions – Foreign Currency, Liquid and Cryptocurrency Assets (for example: Cryptocurrency), Money Orders (Not Money Transfer), Account Funding (not Stored Value Load), Travelers Cheques, and Debt Repayment) or MCC 6012 – Financial Institutions – Merchandise, Services, and Debt Repayment for those transactions even if selling quasi-cash is not the Merchant's primary business. Purchases of cryptocurrency must use MCC 6012 or 6051, as applicable."

Then the NFT sentence. An NFT is a token that represents a particular digital item, and Visa's position is that buying one with dollars is buying an item, not buying cryptocurrency, so the crypto flag is not needed. The flag returns only where the card transaction is really a crypto purchase that is instantly spent on the NFT.

The manual also defines the kind of business Crossmint is, for these purposes. "An entity is a Ramp Provider if it provides payment services to convert transactions from a fiat currency to a non-fiat currency (for example: cryptocurrency), or vice versa." For a Ramp Provider selling non-fiat currency directly to a cardholder, the manual says the MCC "is assigned after the Conversion Affiliate business has been evaluated", or 6051 for loading a self-custody wallet.

So the manual answers two adjacent questions and not the one at issue. Cryptocurrency bought by card: 6051 or 6012, with the flag. An NFT bought by card in dollars: an ordinary goods code, no flag. A memecoin bought by card is either the first thing or something like the second, and the word memecoin does not appear in the manual. The gap is where the parties' positions sit.

Crossmint's position rests on an SEC statement about securities law, which says nothing about payments

The SEC's Division of Corporation Finance said on 27 February 2025 that meme coins are typically bought for entertainment, social interaction and cultural purposes, are "akin to collectibles", and that transactions in them do not involve the offer and sale of securities. Crossmint's Head of Strategy, Fonz Olvera, told The Block that memecoins are not securities.

Olvera was direct about what the product is. "As far as I know, we're the only game in town when it comes to that particular product that involves no KYC," he told The Block. On why: "When you have tokens such as memecoins, it's a different ballgame because they're not securities." And on the limit: "But in the end, number one, nobody wants to go to jail, and that is the utmost priority."

A Crossmint spokesperson added that "Each product we support, including [WIF], goes through a detailed review and onboarding process involving the relevant partners and stakeholders before it is made available to users", and that "Not every good represented onchain belongs in the same category".

The SEC statement is what it says it is: the view of one division of the securities regulator on whether meme coins are securities. Its conclusion is that "transactions in the types of meme coins described in this statement, do not involve the offer and sale of securities under the federal securities laws", and its corollary is stark: "neither meme coin purchasers nor holders are protected by the federal securities laws."

It does not mention the Bank Secrecy Act, customer identification, anti-money laundering, card networks or merchant coding, because none of those is the securities regulator's question. "Collectible" in that statement is a description of why a meme coin is not a security. Whether the same word carries a memecoin out of Visa's "Liquid and Cryptocurrency Assets" and into its goods codes is a different question, addressed to a different rulebook, and the SEC did not answer it because it was not asked.

Nor has Visa, in terms. The manual's NFT sentence shows the network is willing to treat some tokens as goods when bought in fiat. It also confines that treatment to NFTs and re-attaches the flag the moment the transaction "actually represents the purchase of the cryptocurrency". A memecoin is a fungible token traded on exchanges for its price, which is the property the SEC itself describes when it says value "is driven primarily by market demand and speculation". Whether that makes it a collectible or a cryptocurrency for coding purposes is the open question, and it is one for the acquirer and the network rather than for anyone quoted so far.

No regulator has published anything, and the New York Attorney General says it is reviewing

As of 1 September 2026, the New York Attorney General's office has told The Block it "is aware of and reviewing the matter". Its press release index shows nothing on the subject through 31 August 2026. Visa and Mastercard have each issued a general statement about compliance with their rules. No ruling, enforcement action or rule change has been published.

That is the state of the record, and it constrains what can be said. There is a reported transaction flow, four parties' positions in their own words, a network rulebook that answers the neighbouring questions, and a securities statement that answers a different one. What there is not is a decision.

Three things would change that. An acquirer or Visa reclassifying the merchant, which would move the transactions to 6051 and attach the flag. An issuer declining or re-pricing them, which Chase's case with Visa may lead to. Or a public authority publishing something, which the New York Attorney General has not yet done. Any of them would make this a different post, and the evidence file behind it records what to re-check.

Two observations stand regardless of how it resolves. The first is structural. Whether a memecoin buyer met an identity check was decided by a coding choice at an acquirer, not by any regulator. The parties who could have overridden it, the issuers, were not told what they were looking at. Robinhood itself sits under a separate identity obligation as a broker, a point we covered when investigators asked prediction markets who their users were, and its answer here was that the partner handles this product.

The second is the proportionality question that runs through every one of these stories. The purchases in question were small, entertainment-shaped, and for a token whose own regulator says buyers are unprotected. Whether that harm justifies the friction of an identity check on every one is a fair question. What this episode shows is that the question was being answered, in practice, by a four-digit code, and that nobody whose job it is to answer it had been asked. Where United States regulators have wanted a customer identification duty to attach to a crypto product, as with stablecoin issuers in June 2026, they have written one. For memecoins bought by card, nobody has.

Key takeaways

The rule is clear for crypto.

Visa's April 2026 manual: purchases of cryptocurrency must use 6012 or 6051 with special condition indicator 7, even if crypto is not the merchant's main business.

The purchases were coded as media.

MCC 5815, no crypto flag, rewards earned, no separate identity check, per The Block's reporting of 1 September 2026.

Visa's manual has a fiat-collectible carve-out, for NFTs.

NFTs bought in fiat need no crypto flag. Memecoins are not mentioned. That gap is where the dispute sits.

The SEC statement is about securities, not payments.

It says meme coins are akin to collectibles and not securities, and that buyers are unprotected by securities law. It says nothing about KYC or merchant codes.

Nobody with authority has decided.

Chase has a case open with Visa. The New York Attorney General is reviewing and has published nothing. The networks issued general statements.

Using Didit when the code does not decide for you

The lesson of this episode for an on-ramp is that a merchant category code is not a compliance decision, even though it behaved like one. A business that sells tokens for cards can decide to know its customers independently of how an acquirer codes the transaction. The question of whether the code was right then becomes one about fees and rewards rather than about identity.

ID Verification at $0.15 per check establishes who the buyer is from a document, which is the check that was absent from the flow The Block described. Phone Verification from $0.03 per check is the lighter step for low-value purchases where a full document check is more friction than the risk warrants, which is exactly the proportionality trade this story turns on. AML Screening at $0.20 per check screens the buyer against sanctions and politically exposed person lists, which the securities question does not touch and the card networks expect of a quasi-cash merchant. Wallet Screening (KYT) at $0.15 per screening looks at the destination wallet, which is the part of a self-custody purchase a card check never sees. Current prices are on the pricing page.

Four limits. Didit does not assign merchant category codes and has no part in network rules. Whether a token is a collectible or a cryptocurrency for coding purposes is for the acquirer and the network, and nothing here has been adjudicated. The only public account of the transaction flow is The Block's reporting, which this post relies on for what happened and attributes throughout. And an identity check chosen by the on-ramp does not make the code correct or incorrect; it makes the on-ramp's own obligations, whatever they turn out to be, easier to meet.

Frequently asked questions

What is a merchant category code?

A four-digit code assigned by a merchant's acquiring bank that describes what the merchant sells. Card networks and card issuers act on it: it determines whether a transaction is treated as a purchase or as quasi-cash, whether it earns rewards, and which risk controls apply. Visa publishes the assignment rules in its Merchant Data Standards Manual.

What does Visa require for cryptocurrency purchases?

Visa's Merchant Data Standards Manual, April 2026 edition, states that purchases of cryptocurrency must use MCC 6012 or 6051, and must contain special condition indicator 7 and the quasi-cash transaction indicator in the authorisation request and special condition indicator 7 in the clearing record. This applies "even if selling quasi-cash is not the Merchant's primary business".

What did The Block report on 1 September 2026?

That users could buy the memecoin WIF on Robinhood Wallet and on Fomo by credit card through Apple Pay or Google Pay, without a separate identity check, earning standard card rewards. The transactions were processed by Crossmint and coded MCC 5815, which Visa defines as digital goods media, without the crypto indicator. Chase told The Block it believed the code was incorrect and was opening a case with Visa.

What is Crossmint's position?

Crossmint's Head of Strategy, Fonz Olvera, told The Block that memecoins are not securities and are a different case, and that the product involves no KYC. A Crossmint spokesperson said each product goes through a detailed review and onboarding process with the relevant partners, and that "Not every good represented onchain belongs in the same category". Crossmint cites the SEC staff statement of 27 February 2025 describing meme coins as akin to collectibles.

Has any regulator acted?

Not publicly, as of 1 September 2026. The New York Attorney General's office told The Block it is aware of and reviewing the matter; its press release index shows no publication on the subject through 31 August 2026. Visa and Mastercard each gave a general statement about compliance with their rules. No ruling, enforcement action or rule change has been published.

Related reading

• Prediction markets: who are your users? — Every investigator landed on the same question. Here it was answered by a code.
• Stablecoin ID rules: FinCEN's 2026 proposal — A customer identification duty attached to a crypto product on purpose.
• AUSTRAC suspends Cryptolink — A supervisor on the other point where money becomes crypto.

Sources

1. Merchant Data Standards Manual — Visa, VISA PUBLIC · April 2026 edition · the quasi-cash rule, the crypto indicator requirement, the MCC 5815 definition, the NFT carve-out and the Ramp Provider definition, all quoted verbatim
2. Staff Statement on Meme Coins — SEC Division of Corporation Finance · 27 February 2025 · every SEC quotation in this post
3. Buying memecoins with credit cards on Robinhood Wallet, Fomo sidesteps card network crypto rules — The Block, Zack Abrams · 1 September 2026 · reporting of record: the observed transaction flow and every quotation from Crossmint, Robinhood, Fomo, Chase, Visa, Mastercard and the New York Attorney General's office are as reported here; no regulator has published its own account

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit.

Last reviewed 1 Sep 2026 against the sources above