CBD Payment Processor: Merchant Account Approval Guide

A CBD payment processor exists to solve a gap that federal law never actually closed, and that gap just moved. The 2018 Farm Bill removed hemp and hemp-derived products under 0.3% THC from the Controlled Substances Act, which is why CBD has been legal to sell across most of the country since 2018. But legal to sell was never the same thing as approved to bill for, and a new law signed in November 2025 just narrowed what counts as legal hemp in the first place.

Why CBD gets treated as automatic high-risk#

The FDA still has not approved CBD as a food additive or dietary supplement ingredient, and it has sent repeated warning letters to companies making disease-treatment claims. That unresolved regulatory gap is exactly why mainstream banks and standard aggregators treat any CBD-related transaction as automatic high-risk. Many freeze an account the moment the transaction description is detected, regardless of how compliant the actual business is.

Card networks add another layer on top. Visa and Mastercard both restrict or condition acquiring for certain hemp-derived categories, particularly intoxicating THC isomers like delta-8, and require acquiring banks to document category-specific compliance before boarding the merchant. State law compounds it further. A product legal to ship from one state can be restricted or banned outright in the buyer's state, which means a single online storefront can be operating under a dozen different legal regimes depending on where the order ships.

It's worth noting that none of this makes CBD illegal. It makes CBD administratively inconvenient for a bank whose compliance team would rather decline the category outright than review it product by product. That's a business decision on the processor's side, not a legal requirement.

The 2026 hemp law change that resets the category#

In November 2025, Congress passed H.R. 5371 as part of a broader government funding package, and it does something the original 2018 Farm Bill didn't: it redefines hemp using a "total THC" standard. Instead of measuring delta-9 THC alone against the 0.3% dry-weight threshold, the new law adds delta-9 THC and THCA (its non-intoxicating precursor) together before applying the limit (Congress.gov CRS, 2025).

That single change is why industry press is calling it a ban on delta-8 and THCA products rather than a technical tweak. Under the old math, a hemp flower or extract could test under 0.3% delta-9 THC while still carrying enough THCA to convert into a psychoactive dose when heated or processed, which is exactly the loophole that let intoxicating hemp products sell legally next to non-intoxicating CBD oil for years. The bigger shift is the unit of measurement itself. The new standard caps a product at 0.4 milligrams of total THC per container, replacing the old 0.3% delta-9 dry-weight test, which is a far stricter limit and one a percentage-based COA cannot demonstrate. The law also bans cannabinoids "synthesized or manufactured outside the plant," targeting lab-created intoxicants like delta-8 and delta-10 directly (Akerman LLP, 2025).

The law takes effect in November 2026, which gives hemp and CBD businesses roughly a year to adjust product lines and testing protocols before enforcement begins (CNBC, 2025). For a business selling straight CBD isolate or broad-spectrum products with no detectable THC, the practical impact is limited. For anything carrying THCA, delta-8, or another intoxicating isomer, this is the moment to have a lab re-test under the total-THC method and get ahead of a category reclassification before an acquiring bank does it for you.

We'd expect underwriters at CBD-specialist acquirers to start asking for total-THC test results on renewal applications well before the November 2026 effective date, not after. That's the pattern with most regulatory phase-ins in this category: the compliance bar moves at the bank level before it moves at the enforcement level.

Why Stripe, PayPal, and Square won't touch CBD#

Mainstream payment platforms drew their lines before H.R. 5371, though not where most write-ups put them. It's worth reading what the policies actually say, because the real exposure is in what they leave to discretion.

Stripe's restricted businesses list names cannabis products, cannabis dispensaries and related businesses, and "CBD products with THC levels greater than the applicable local jurisdiction's legal limit, including CBD edibles". That's narrower than the blanket ban people describe. The line sits at the THC level measured against a local limit, not at the presence of CBD.

Which is precisely what makes it unstable. The limit moves with the jurisdiction and, after H.R. 5371, with the measurement method. A product inside the limit under a delta-9 test can fall outside it under a total-THC one without the formula changing at all.

PayPal is vaguer still. Its acceptable use policy doesn't mention cannabis, marijuana or CBD anywhere. What it restricts is transactions involving "narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety". Whether your product sits inside that phrase is PayPal's call, made after the fact, and you won't find the answer in the policy before you need it.

We're not going to quote you a standard hold period. The figures that circulate for both platforms appear in neither company's published terms, and the terms are what you'd be held to.

Here's the part that catches new CBD sellers off guard: neither platform requires a manual review to trigger this. Automated transaction-description scanning and merchant category code mismatches are usually enough. A business that lists itself as "health and wellness" but processes a transaction with "CBD" in the item description can get flagged within days of launch, sometimes before the first sale even settles.

That's the entire reason CBD-specialist processors exist. NMI, Payroc, Paysafe, and a handful of other acquirers have built underwriting programs specifically for hemp and CBD, price the category accordingly, and don't treat a legally compliant sale as a surprise to react to after the fact.

What underwriting actually looks for#

A CBD and hemp merchant account gets placed with acquiring banks and offshore partners who already underwrite the category, using correct MCC coding and product-level review so the account is classified correctly from day one instead of getting re-flagged later.

The documentation that actually moves an application forward:

• Certificates of analysis (COAs) confirming THC content is under the federal threshold for every product sold, ideally already tested under the new total-THC method rather than delta-9 alone
• State hemp licensing applicable to every state the business ships into, since state rules on hemp-derived isomers vary independently of federal law
• Label and site copy review that avoids FDA-flagged disease or treatment claims, since wellness framing survives underwriting review far better than medical framing
• A gateway configured through NMI, Authorize.net, or USAePay with a billing descriptor matching the storefront brand, which cuts down on unrecognized-charge disputes

A compliant COA is the single most-requested document in this process, and it's also the fastest thing to have ready before you ever submit an application. Businesses that walk in with lab results already in hand consistently move through underwriting faster than those who scramble to get testing done mid-application.

Typical fees and reserve terms#

CBD-specialist processing costs more than standard retail card processing, and that's not a hidden markup so much as a direct reflection of the underwriting work involved. Expect processing fees in the 3.5% to 5.5% range depending on ticket size, chargeback history, and which acquirer is doing the underwriting, compared to roughly 2.5% to 3% for a typical low-risk retail account.

Whether a rolling reserve applies, and how large it is, gets set at underwriting based on processing history and creditworthiness, not a flat industry markup. A brand-new CBD business with no processing history will usually see a reserve requirement; an established brand with 12+ months of clean statements and a chargeback ratio under 1% can often negotiate it down or off entirely over time. Reserve terms are always disclosed in writing before signing, and there's no reason to accept a program that won't put the number in front of you before you're locked in.

Domestic vs. offshore: how CBD accounts actually get structured#

Most CBD businesses assume there's a single "CBD merchant account" product, but underwriting usually structures it as one of two paths, or both at once for redundancy.

A domestic account places the business with a US acquiring bank that has a hemp-specific underwriting program. This is the simpler path when it's available: settlement lands in a US bank account on a normal schedule, and there's no currency conversion to manage. Not every acquirer offers this for CBD, so the pool of available banks is smaller than for a low-risk retail account.

An offshore account, placed through an international merchant account structure, routes transactions through an acquiring bank outside the US that's more willing to underwrite hemp-derived categories, or willing to underwrite at higher volumes than a domestic program allows. Settlement can take a day or two longer, and multi-currency handling adds a step most domestic-only sellers don't need to think about. In exchange, offshore programs often support higher processing volume caps and provide a genuine backup path if a domestic MID gets capped or reviewed.

Many CBD brands that scale past their first year end up running both: a domestic MID for the bulk of US card volume, and an offshore MID as failover capacity. That's the same multi-MID logic that protects any high-risk business from a single point of failure, just applied to a category where the failure risk (an aggregator termination) is higher than average.

Documentation mistakes that slow down a CBD application#

The fastest CBD applications share a pattern: everything an underwriter needs is attached before they ask for it. The slowest ones share a different pattern, and it's almost always one of these:

1. COAs that don't match the SKUs actually being sold. A lab result for "CBD Tincture 500mg" doesn't cover "CBD Tincture 1000mg" as a separate SKU. Every distinct product and potency needs its own current COA.
2. Outdated lab results. Hemp genetics and formulations drift, and a COA from 18 months ago doesn't reflect what's shipping today. Underwriters increasingly want testing within the last 6 to 12 months, and that window is likely to tighten further as the total-THC standard phases in.
3. Site copy that hasn't been reviewed for health claims. "May help with sleep" and "supports relaxation" read differently to an underwriter than "treats insomnia" or "cures anxiety." A quick copy audit before applying catches this before it becomes a decline reason.
4. No clear return/refund policy. High-risk underwriters read a missing or vague refund policy as a chargeback risk signal, since it usually means customers will dispute instead of requesting a refund through a process that doesn't exist.
5. Applying to a generalist processor first. Every prior decline shows up as processing history that a new underwriter has to account for. Applying directly to a CBD-specialist acquirer, rather than burning an application on a mainstream platform that was always going to decline, keeps the record clean.

None of these are hard to fix. They're just easy to miss when a business is moving fast, which is exactly when they cause the most delay.

Demand isn't the constraint. Payment infrastructure is#

It's easy to assume payment friction this severe would shrink the category. It hasn't. CBD products are sold openly across mainstream retail while the banking side stays difficult, which tells you the bottleneck sits in processing rather than in customer demand.

We've deliberately left market-size projections out of this. Published CBD forecasts vary enormously depending on who commissioned them and what they count as the category, and none of them change what an underwriter asks you for.

What that means practically: demand isn't the constraint for most CBD brands. Payment infrastructure is. A brand that locks in a stable, correctly-underwritten merchant account early has a real competitive advantage over one still bouncing between aggregators that will eventually flag and freeze the account, usually at the worst possible moment for cash flow.

What happens when a mainstream processor freezes you anyway#

Even a fully compliant CBD account can get caught by an aggregator's automated review, especially one that started on a mainstream platform before moving to a specialist. When that happens, speed of recovery matters more than almost anything else, because held inventory and a paused revenue stream compound fast in a category with real supply chain costs.

One CBD brand we worked with was back to live processing in 36 hours after a mainstream processor terminated their account without notice, with held funds released within 7 days and a dual-MID structure put in place afterward so a single termination can't take the business offline again. That kind of chargeback and dispute infrastructure matters just as much as the initial approval, since a clean account can still accumulate disputes that threaten it later.