TL;DR: Hemp-derived CBD has been federally legal since the 2018 Farm Bill, but mainstream payment processors like Stripe, Square, and PayPal still explicitly prohibit it — and getting caught means account termination with funds held for 90-180 days. CBD merchants pay 4-7% per transaction (versus 1.5-2.9% for standard e-commerce), face rolling reserves of 5-10% held for 90-180 days, and must maintain chargeback rates below 1% to avoid card network monitoring programs. On top of that, the November 2026 "hemp cliff" — a new federal law capping total THC at 0.4 milligrams per container — threatens to push an estimated 90-95% of current hemp products outside the legal definition. This guide covers the full regulatory landscape, what it takes to get and keep a CBD merchant account, and the compliance requirements that determine whether your business can accept credit cards.
The legal foundation for CBD payment processing starts with the 2018 Farm Bill (Agriculture Improvement Act of 2018). This law removed hemp from the definition of marijuana under the Controlled Substances Act and defined hemp as Cannabis sativa L. with a delta-9 THC concentration of not more than 0.3% on a dry weight basis. According to the Brookings Institution: "One big myth that exists about the Farm Bill is that cannabidiol (CBD) — a non-intoxicating compound found in cannabis — is legalized." The Farm Bill legalized hemp-derived CBD from licensed, compliant growers — but it did not create a clear pathway for CBD in food, beverages, or dietary supplements.
The distinction between hemp-derived CBD and marijuana-derived CBD is the single most important factor in payment processing. Hemp-derived CBD (≤0.3% delta-9 THC) is federally legal and can be processed through high-risk merchant accounts. Marijuana-derived CBD (>0.3% THC) remains a Schedule I controlled substance, and Visa and Mastercard prohibit transactions involving its sale at the network level — regardless of state legalization.
The FDA has not established a formal regulatory pathway for CBD in food, dietary supplements, or over-the-counter drugs as of 2026. The only FDA-approved CBD product is Epidiolex, a prescription medication for severe epilepsy. As FDA congressional testimony stated: "The passage of the 2018 Farm Bill has led to the misperception that all products made from or containing hemp, including those made with CBD, are now legal to sell in interstate commerce."
State laws add another layer of complexity. According to World Population Review, 24 states plus DC have fully legalized CBD without additional restrictions beyond federal hemp standards. Several states — North Dakota, Oklahoma, Pennsylvania, South Dakota, Utah, and West Virginia — allow CBD only for medical use. Idaho effectively bans most CBD products with a zero-THC requirement. This patchwork directly affects shipping compliance and merchant account underwriting.
CBD's high-risk classification is not a moral judgment — it is a financial risk assessment based on six specific factors that directly affect payment processors and acquiring banks.
Regulatory uncertainty. The FDA has not finalized a regulatory framework for CBD in food or supplements, even eight years after the Farm Bill. Without clear federal rules, processors treat regulatory ambiguity as liability. Every CBD transaction carries the risk that future FDA enforcement could affect the legality of products their merchants sell.
Legal patchwork. Operating legally in Colorado does not mean operating legally in Idaho. Processors must evaluate whether each merchant's operations comply with every state they ship to — a compliance burden that standard e-commerce merchants do not create.
Elevated chargeback rates. CBD e-commerce businesses face above-average dispute rates. KORONA POS reports that 72% of merchants reported rising friendly fraud in 2024, where customers dispute legitimate transactions. Customer expectation mismatches (expecting CBD to resolve specific health conditions), subscription confusion, and ambiguous billing descriptors all drive CBD chargebacks higher than standard retail.
Cannabis association. Despite being legally distinct from marijuana, CBD's association with cannabis creates reputational risk for acquiring banks and their upstream partners. Banks that support CBD merchants face additional scrutiny from regulators.
FDA health claims risk. Processors can face liability if merchants on their platform make FDA-prohibited health claims. Between 2015 and 2019, the FDA issued 39 warning letters to companies making unapproved health claims about CBD — 97% for violations on company websites and 56% for social media violations. Health claims were made for over 125 unique conditions.
SAFE Banking Act failure. The SAFE Banking Act, which would have provided federal protections for banks serving cannabis businesses, has passed the House seven times but has never been enacted. As of April 2026, no version has been reintroduced in the 119th Congress. This legislative failure perpetuates uncertainty in the banking relationship that underpins payment processing.
This is the most common and most avoidable mistake CBD merchants make. Stripe, Square, and PayPal all explicitly prohibit CBD and cannabis-related products in their terms of service. Using these platforms for CBD sales is not a gray area — it is a policy violation that leads to predictable consequences.
Stripe lists CBD and hemp products as restricted businesses in its acceptable use policy. According to Unison Payment Solutions, accounts are flagged and terminated — often without warning — and funds may be held for 90-180 days after termination. Stripe's support documentation states the company "cannot support CBD or THC products."
Square prohibits CBD and cannabis-related products. Even if an account is not immediately terminated, Square monitors transactions and eventually flags and closes CBD accounts. The result is the same: terminated account and held funds.
PayPal formally prohibits cannabis-related transactions. PayPal typically freezes the account balance, restricts withdrawals, and holds funds for up to 180 days when CBD activity is discovered. There is no meaningful appeal process.
As KORONA POS describes the real-world impact: for businesses processing $50,000-$100,000 per month, a sudden processor termination means "five or six figures locked with no timeline for release." Worse, using a prohibited platform and being terminated creates negative processing history that complicates future applications for legitimate CBD merchant accounts.
A CBD merchant account application is a full underwriting process with documentation requirements beyond what standard merchants face. Based on requirements from EnergyCore Merchant Services, Borderfree Payments, and KORONA POS, here is what processors require.
Business documentation: LLC or corporation formation documents, articles of incorporation, EIN letter from the IRS, government-issued ID for all owners with significant equity stake, and a voided check or bank letter for the deposit account.
Compliance documentation: A Certificate of Analysis (COA) for every product you sell is the single most critical document. As Borderfree Payments explains: "This document, provided by a third-party lab, confirms the cannabinoid content and proves your products meet legal standards." COAs must come from ISO-accredited third-party laboratories, confirm THC content below 0.3%, test for pesticides, heavy metals, and residual solvents, and typically must be less than 12 months old. You also need your state hemp or CBD business license if required by your state.
Financial documentation: 3-6 months of business bank statements, previous processing history and statements (if applicable), and increasingly, product liability insurance.
Website compliance review: Underwriters will review your entire website before approval. You need a complete site with terms of service, privacy policy, refund and return policy, shipping policy with timelines, full business contact information (not just a web form), the FDA disclaimer, no health claims anywhere on the site, an age verification system, and product descriptions that match your COA findings. Approval typically takes 3-10 business days with complete documentation.
CBD merchants pay significantly more than standard e-commerce merchants, and the headline transaction rate is only part of the total cost. According to Fibonatix, "Transaction fees for CBD merchant accounts typically range from 4-7% per transaction, compared to 1.5-2.9% for standard e-commerce."
| Cost Component | CBD Merchant | Standard E-Commerce |
|---|---|---|
| Transaction rate | 4-7% | 1.5-2.9% |
| Monthly gateway fee | $20-$50/month | $10-$25/month |
| Chargeback fee | $35-$50 per dispute | $15-$25 per dispute |
| Rolling reserve | 5-10% held 90-180 days | Typically none |
| Early termination fee | Common in long-term contracts | Less common |
Sources: Fibonatix, KORONA POS.
The rolling reserve deserves special attention. If you have a 10% rolling reserve with a 180-day hold and process $10,000 on Day 1, the processor withholds $1,000. That money is unavailable for six months — while new daily sales continue being withheld. After six months of processing $50,000 per month at 10%, you have $30,000 tied up in reserve. According to TailoredPay, reserves are reviewed after 6-12 months of clean processing history, but they rarely disappear automatically — you must request a review.
Established CBD merchants with clean processing history and low chargebacks may negotiate toward the lower end of the rate range (3.5-4%). The key negotiation leverage is consistent volume, chargeback rates below 0.5%, and complete compliance documentation.
Processors actively scan CBD merchant websites for compliance — both during underwriting and on an ongoing basis. Failing any of these requirements can result in application denial or account termination.
The FDA disclaimer is mandatory and must appear on every product page: "This product has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease." This is not optional and not negotiable.
No health claims — anywhere. This is the most common compliance failure. According to KORONA POS, "Processors actively scan for health claims like 'cures anxiety' or 'treats inflammation.' Those phrases alone can get your account denied or terminated." Even implied claims trigger enforcement. A California retailer faced a $50,000 fine for unverified claims in 2024. And the FDA does not limit its monitoring to your website — of the 39 warning letters issued between 2015 and 2019, 56% cited social media violations.
Certificate of Analysis access for every SKU, from an ISO-accredited third-party lab, confirming THC below 0.3% and the absence of pesticides, heavy metals, and residual solvents. Increasingly, states require a QR code on the product or website linking to a batch-specific COA.
Product labeling under the FD&C Act requires an identity statement, net weight, ingredient list in descending order by weight, manufacturer contact information, and serving size with total CBD content. State-specific requirements add additional layers: California Prop 65 warnings for products with detectable THC, Texas QR codes linking to COAs, child-resistant packaging in many states, and a prohibition on youth-appealing graphics. Sources: Harris Sliwoski, Food Label Maker.
Age verification is expected by processors. There is no federal minimum age for CBD purchases, but most states set the minimum at 18, with a growing number requiring 21 for edible and drinkable CBD (California, New York, Oregon, Texas, and Connecticut among them). A 2023 PubMed study found only 37.5% of CBD websites required age confirmation — processors now expect robust verification.
This is the most significant regulatory development affecting CBD businesses since the 2018 Farm Bill. On November 12, 2025, President Trump signed H.R. 5371, which materially amends the definition of hemp. The law takes full effect on November 12, 2026 — creating what the industry calls the "hemp cliff."
According to Frier Levitt and Manzuri Law, the law introduces three principal changes. First, hemp must now contain no more than 0.3% total THC — including THCA and delta-8 THC — replacing the prior delta-9-only threshold. Second, finished hemp-derived cannabinoid products cannot contain more than 0.4 milligrams of total THC per container, far below current market norms where most products contain 2.5-10 mg per unit. Third, cannabinoids synthesized outside the cannabis plant (delta-8 THC produced via CBD isomerization, HHC) are banned.
The impact on the industry is severe. McGowan Wholesale estimates that 90-95% of hemp products currently on the market would fall outside the amended definition. Full-spectrum CBD products with even trace amounts of THC may be affected. The National Law Review outlines the critical 2026 calendar: the Farm Bill extension expires September 30, and the new hemp restrictions take full effect November 12.
For payment processing, this means every CBD merchant account will face re-underwriting scrutiny in 2026. Products that were compliant in 2025 may no longer qualify. Processors and acquiring banks are already evaluating which merchants can survive the transition and which will see their product lines become federally non-compliant.
There is a potential pathway for non-intoxicating CBD. A December 2025 Executive Order directs senior White House staff to "ensure patient access to full-spectrum CBD" and directs HHS to expand access to hemp-derived CBD consistent with federal law. This suggests a narrower but potentially viable lane for non-intoxicating CBD products going forward.
ACH (Automated Clearing House) bank-to-bank transfers are growing rapidly as a CBD payment alternative. ACH runs on the federal ACH network, which has not prohibited cannabis or hemp payments — sidestepping Visa and Mastercard restrictions entirely. According to ArentFox Schiff, ACH is projected to reach approximately 42% of cannabis transaction volume in 2026, up from 28% in 2025. The economics are compelling: ACH typically costs 1-1.5% per transaction versus 4-7% for card processing. Canna Secure estimates that a dispensary processing $1 million per month saves $10,000-$25,000 monthly by shifting from card alternatives to ACH.
Cryptocurrency payments offer a niche option. Bitcoin, Ethereum, and stablecoins (USDC, USDT) involve no card network restrictions and no chargebacks since blockchain transactions are final. Platforms like ForumPay convert crypto to fiat at the moment of purchase, eliminating volatility risk for the merchant. However, as CannabisRegulations.ai notes, crypto remains a "niche for tech-forward customers, not mainstream replacement." Most consumers do not hold cryptocurrency.
Cash discount and surcharging programs help offset high-risk processing premiums. Cash discount programs reward non-card payments by discounting from a posted price that incorporates processing costs. Surcharging adds a fee to credit card transactions at checkout. Visa caps surcharges at the merchant discount rate or 3% (whichever is lower), while Mastercard caps at 4%. Surcharging is prohibited in some states and requires advance notification to the processor and card networks. Non-compliant merchants face fines of $50,000 to $1 million.
Most successful CBD merchants use a multi-channel approach: a dedicated high-risk merchant account for card processing as the primary method, ACH as a lower-cost alternative for willing customers, and backup processors to avoid single-provider dependency. Per KORONA POS, having only one payment processor means one termination shuts down all revenue.
For CBD merchants, exceeding the 1% chargeback threshold is not just expensive — it is existential. Card networks place merchants above this threshold into monitoring programs with escalating fines, and repeated violations lead to account termination and placement on the MATCH list, which prohibits card processing for five years.
The chargeback environment is getting worse across all industries. Payscout reports that retail e-commerce chargebacks surged 233% from Q1 to Q3 2025. Merchants lose an estimated $4.61 for every $1 in chargebacks when accounting for the refunded amount, chargeback fees, lost merchandise, and operational costs. Global chargeback volume is projected to reach 281.3 million cases in 2026.
CBD businesses face specific chargeback drivers. Customer expectation mismatches are the most common — buyers expect CBD to resolve specific health conditions, and when results fall short, they dispute the charge. Ambiguous billing descriptors that do not match the store name trigger "unrecognized charge" disputes. Subscription confusion drives disputes when customers forget they signed up for recurring billing. And friendly fraud — customers disputing legitimate purchases knowing processors typically side with the cardholder — accounts for an estimated 21-70% of all disputes depending on the data source.
Prevention strategies that should be in place before you process your first transaction: use a billing descriptor that clearly matches your store name, integrate Verifi (Visa) and Ethoca (Mastercard) chargeback alert services — Chargeback.io reports that RDR alerts can prevent up to 70% of chargebacks — send pre-billing reminders 3-5 days before recurring charges, make your cancellation process more visible than filing a dispute ("Every customer who cancels through your site is one who didn't file a chargeback through their bank," per Fibonatix), provide shipment tracking on every order, and review chargeback reason codes monthly to identify and fix patterns.
Yes, for hemp-derived CBD (≤0.3% delta-9 THC). The 2018 Farm Bill federally legalized hemp and its derivatives, and Visa and Mastercard do not have a blanket prohibition on hemp-derived CBD transactions. However, CBD businesses are classified as high-risk by card networks, which means higher processing rates, more aggressive chargeback monitoring, and the requirement to use a specialized high-risk payment processor rather than mainstream platforms like Stripe, Square, or PayPal. Marijuana-derived CBD (>0.3% THC) remains federally illegal and prohibited by all card networks.
The MATCH list (Member Alert to Control High-Risk Merchants) is a database maintained by Mastercard and used by all payment processors. It functions as a merchant blacklist. A CBD merchant gets placed on MATCH for exceeding the 1% chargeback threshold, transaction laundering (misrepresenting business type to avoid high-risk classification), fraud, or PCI noncompliance. A MATCH listing lasts five years and makes obtaining any merchant account nearly impossible during that period. The most common path to MATCH for CBD merchants is hiding the nature of the business on merchant applications — which processors consider transaction laundering. Full transparency during the application process is the best protection.
The "hemp cliff" refers to new federal restrictions in H.R. 5371, signed November 12, 2025, that take full effect on November 12, 2026. The law changes the hemp definition to require total THC (including THCA and delta-8) below 0.3%, caps finished products at 0.4 milligrams total THC per container, and bans synthetic cannabinoids. An estimated 90-95% of current hemp products would fall outside the amended definition. CBD businesses must reformulate or risk their products becoming federally non-compliant, which would trigger banking and payment processing consequences.
Shopify as a platform allows CBD merchants, but Shopify Payments (powered by Stripe) does not support CBD. Merchants must integrate a separate, specialized high-risk payment processor through Shopify's third-party payment gateway options. WooCommerce is similarly permissive on its platform while not supporting CBD through its default payment options. Amazon does not permit CBD product listings at all.
With complete documentation — COAs for every product, business formation paperwork, bank statements, and a fully compliant website — approval typically takes 3-10 business days. Some providers offer 24-48 hour fast-track approval. Incomplete documentation is the most common cause of delays. Having a current Certificate of Analysis from an ISO-accredited lab for every SKU, a website free of health claims, and clear refund and shipping policies significantly accelerates the process.