What law does a code 93 decline refer to?

Whatever statute or regulation makes the transaction illegal for the issuer to process: sanctions rules, state or national prohibitions on the purchase category, or regulated-product restrictions. The issuer is legally required to block it, not choosing to.

Can a legitimate customer trigger code 93 by mistake?

Yes, through compliance false positives such as a name resembling a sanctions-list entry, or by attempting a purchase category prohibited in their location, like gambling from a restricted state. The cardholder's bank is the only party that can review and clear it.

Decline code · Hard decline

Decline code 93: Transaction Cannot Be Completed, Violation of Law

Completing this transaction would break a law or regulation, so the issuer must refuse it. Sanctions compliance, embargoed jurisdictions, and legally prohibited purchase categories are the usual territory. The refusal is a legal obligation on the bank rather than a discretionary risk decision.

Should you retry?

Never retry. The legal condition does not expire on a schedule, resubmission of a legally blocked transaction is itself a compliance red flag, and Visa places 93 among codes that must not be reattempted. Any path forward runs through fixing the legal posture, not the payment flow.

Why code 93 happens

The transaction touches a sanctioned country, entity, or individual on OFAC or equivalent lists, whether through the merchant, acquirer location, or cardholder.
The purchase category is illegal for this cardholder's jurisdiction, such as online gambling charges into US states where it is prohibited, which issuers must block.
Regulatory restrictions bar the card from the transaction type, as with credit card purchases of certain regulated products in specific countries.
The issuer's compliance screening matched something in the transaction against a legal blocklist, correctly or as a false positive.

What to do about it

Do not resubmit or attempt to restructure the transaction to evade the block, which converts a decline into potential legal exposure.
Verify your own compliance posture: confirm your acquiring, licensing, and geographic restrictions actually permit selling what you sell where this customer is.
Implement geo-blocking so customers in jurisdictions where your product is prohibited never reach payment, keeping these declines from occurring at all.
For suspected false positives, direct the cardholder to their bank; only the issuer's compliance team can resolve a screening mismatch.

High-risk merchant angle

Merchants at the regulated edges of high-risk, notably gaming, crypto, kratom, and CBD, should treat 93 as a jurisdictional map drawn by issuers: it shows exactly where banks consider your category prohibited for their cardholders. Do not answer it with routing; pushing legally blocked traffic through alternate MIDs or descriptors is transaction laundering territory that ends acquiring relationships and can attract regulatory attention personally to the operators. The professional response is licensing and geography discipline, aligning where you sell with where you are legal, and encoding that in geo-blocks upstream of checkout. A high-risk merchant with near-zero 93 volume is demonstrating exactly the operational control that makes acquirers comfortable expanding capacity.

Frequently asked questions

What law does a code 93 decline refer to?: Whatever statute or regulation makes the transaction illegal for the issuer to process: sanctions rules, state or national prohibitions on the purchase category, or regulated-product restrictions. The issuer is legally required to block it, not choosing to.
Can a legitimate customer trigger code 93 by mistake?: Yes, through compliance false positives such as a name resembling a sanctions-list entry, or by attempting a purchase category prohibited in their location, like gambling from a restricted state. The cardholder's bank is the only party that can review and clear it.

Related decline codes