Payment Processing for CBD: The Only Guide You Need Before You Apply in 2026

Stripe and Shopify Payments ban CBD. Learn which processors allow it, what documents you need, and how to get approved without losing your account.

Why Can't You Use Stripe, Shopify Payments, or PayPal for CBD?

Stripe, Shopify Payments, and PayPal all explicitly prohibit CBD sales on their platforms. These are platform-wide restrictions that apply regardless of your state, your hemp compliance status, or your business history. Stripe's support documentation states the company cannot support CBD or THC products. Shopify Payments excludes hemp, CBD, and THC products from its native checkout. PayPal maintains a published policy prohibiting its platform for CBD sales entirely.

This is not a grey area and it does not vary by state.

The practical consequence is serious. RESTART CBD, a hemp retailer documented in Lightspeed's 2025 merchant case studies, had its processing dropped right before Black Friday after scaling through a mainstream platform. That is not an edge case. It is the standard outcome for CBD merchants who assume hemp legality equals platform eligibility. It does not.

Setting up payment processing for CBD is fundamentally different from standard retail. CBD merchants carry higher chargeback rates, operate under evolving federal regulations, and face strict marketing compliance requirements. That combination pushes CBD into what the financial industry classifies as "high-risk," which requires a completely different type of financial infrastructure.

What Is a High-Risk Merchant Account and Why Is It Different From a Payment Gateway?

A high-risk merchant account is a dedicated banking agreement underwritten specifically for elevated-risk businesses. CBD merchants need one. A payment gateway alone is not sufficient, and this is the single most misunderstood concept in CBD payment processing.

A payment gateway is the technical layer that transmits transaction data between your storefront and a bank. A merchant account is the actual banking relationship that holds and settles your funds. When mainstream processors decline CBD merchants, they are refusing to establish that banking relationship with you, not simply removing a software feature. Without a merchant account, no gateway can move your money.

High-risk merchant accounts for CBD typically involve:

• A full underwriting review before approval, covering product documentation, business ownership, and processing history.
• A rolling reserve of 5% to 10% of monthly volume, held for 90 to 180 days as a financial buffer against chargebacks.
• Higher processing fees of 4% to 8%, compared to the 2% to 3% rate standard merchants pay.
• A compatible gateway connecting your storefront to the acquiring bank's infrastructure.

Going through proper underwriting upfront is a protection, not a burden. Merchants who complete the process correctly face far fewer sudden account holds because the bank already knows exactly what they are processing.

Which Processors Allow CBD and Which Do Not?

The table below reflects official policy positions as of 2026. Always verify directly with each provider, as policies can change without notice.

Square supports hemp-derived CBD in most U.S. states but requires a separate application and has a documented pattern of holding merchant funds during compliance reviews. For merchants under $20,000 per month who want simplicity, Square is a reasonable starting point. Above that threshold, a dedicated high-risk merchant account gives significantly more predictability.

For high-risk specialists, the key variables to compare are processing rate (typically 4% to 8% depending on product type), rolling reserve terms, Shopify integration depth, and whether native subscription billing is included. Smokable hemp and edibles sit at the higher end of the fee range. Topicals and isolates typically qualify for lower rates. Get quotes from at least two providers before committing, and negotiate on the rate if your chargeback history is clean.

What Documents Do You Need to Get Approved?

Payment processing for CBD has one of the most documentation-intensive underwriting processes in the high-risk category. Missing even one item routinely delays or kills applications.

Certificate of Analysis (COA) for every active SKU. This is the most important document. The COA must come from a third-party lab accredited to ISO/IEC 17025 standards, the international benchmark for testing laboratory competence. It must show delta-9 THC at or below 0.3% on a dry-weight basis, include contaminant testing results, and be dated within the last 12 months. Outdated or incomplete COAs are the most common reason applications are rejected.

Business registration and ownership documentation. This means articles of incorporation, your EIN, and a personal guarantee from the majority owners in most cases.

Three to six months of bank statements and processing history. If you have no prior processing history, prepare a projected volume with supporting evidence such as pre-orders or a signed distribution agreement.

Website compliance package. Your website is underwritten alongside your documents. Banks require a visible refund policy, terms of service, a privacy policy, accurate product labeling, and no prohibited health claims.

A merchant who submits organized, current, ISO/IEC 17025-accredited lab results for every product signals operational maturity. A merchant who submits mismatched names, expired dates, or incomplete contaminant panels signals the kind of operational carelessness acquiring banks are specifically screening for.

If you are building your underwriting package and want a compliance review before you submit, BeastMetrics covers the technical requirements through its gateway compliance monitoring service.

What Marketing Claims Will Get Your Account Terminated?

Prohibited health claims are one of the most common and preventable reasons CBD merchant accounts are terminated after approval. This is where your marketing team's decisions become your payment team's problem.

The FDA has taken the position that CBD cannot lawfully be sold as a dietary supplement and cannot be marketed with claims that it treats, cures, or mitigates any condition. The FTC requires that any health-related claim be backed by "competent and reliable scientific evidence," which the FTC's published guidance defines as rigorous, well-controlled human clinical studies. A customer testimonial or a wellness blog post does not qualify.

Acquiring banks now treat unsubstantiated health claims as a financial risk signal, not just a regulatory problem. Automated tools scan merchant websites for flagged language both during underwriting and on an ongoing basis after approval.

Phrases that routinely trigger account reviews: "reduces anxiety," "treats pain," "cures insomnia," "supports cancer recovery," "anti-inflammatory" applied to a medical condition, or any reference to a specific diagnosis.

Audit every product page, blog post, and FAQ before you apply, and repeat this audit quarterly. Banks monitor your site after approval, not just at onboarding.

How Does the 2026 Hemp Cliff Affect Your Processing?

The November 12, 2026, federal deadline is the most significant regulatory event for CBD merchants since the 2018 Farm Bill.

Under current rules, hemp compliance is determined by delta-9 THC at or below 0.3% on a dry-weight basis. Under the new standard, compliance shifts to total THC using this formula:

Total THC = (%THCA x 0.877) + %Delta-9 THC

A product that passes the delta-9 test today may fail under total THC once THCA is factored in. The new standard also imposes a 0.4mg per-container cap on total intoxicating cannabinoids.

Acquiring banks are legally required to de-risk accounts associated with products reclassified as Schedule I substances. Merchants who miss this deadline face mid-cycle terminations and fund holds that can last weeks.

Five steps to take now:

1. Pull the most recent COA for every active SKU.
2. Run the total THC formula using the THCA and delta-9 values on each COA.
3. Flag any product where total THC exceeds 0.25% as a compliance risk. Staying under 0.3% gives you a measurement uncertainty buffer.
4. Reformulate, repackage, or discontinue flagged products before November 12.
5. Notify your processor proactively. Banks treat merchants who surface compliance changes ahead of enforcement far more favorably than those caught reactively.

THCA flower, high-potency gummies, and certain vape formulations carry the highest reclassification risk. If any of those categories represent significant revenue, your payment strategy needs to address this now.

How Do You Keep a CBD Merchant Account Healthy After Approval?

Account approval is a starting condition, not a permanent state. Three areas determine whether you keep it.

Chargeback ratio. Most acquiring banks require CBD merchants to stay below a 1% monthly chargeback ratio. Best-in-class performance is closer to 0.5%. According to Mastercard's published monitoring thresholds, merchants who consistently exceed 1% are flagged for enhanced monitoring, leading to increased fees, reserve adjustments, or termination. A clear billing descriptor, easy subscription cancellation, and proactive post-purchase communication are the three most effective tools for keeping disputes low.

If disputes are already arriving, stopping them before they become formal chargebacks is the most cost-effective intervention. Chargeback alerts from networks like Ethoca and Verifi give you a window to resolve disputes with the customer before a chargeback is filed. For disputes that do reach the formal stage, a structured chargeback representment process recovers a meaningful share of lost revenue.

Compliance monitoring. Assign someone in your organization to review the FDA's hemp resource page and the FTC's health claims guidance quarterly. Update your product pages, packaging, and COA documentation accordingly.

Processor communication. If you are launching a new product, changing your supplier, or expanding into a new state, notify your processor before the change goes live. Banks treat undisclosed business changes as a risk escalation. A short email costs nothing and protects the relationship.

The single most effective long-term protection for high-volume merchants is a multi-acquirer strategy, distributing volume across more than one acquiring bank. If one bank terminates your account, processing continues through your secondary rail while you resolve the issue.

What Do You Do If Your CBD Merchant Account Gets Frozen?

An account freeze is not the end, but the first 48 hours determine how quickly you recover.

Hour 0 to 4. Contact your processor immediately and get a written explanation of why the hold was placed and what they need to lift it. Do not guess. Do not wait.

Hour 4 to 24. Pull COAs for every flagged product, three months of transaction history showing your chargeback ratio, and your website compliance documentation. Organize these into a clear response packet before you reply to the processor.

Hour 24 to 48. If the freeze affects your checkout, communicate with customers honestly. A brief message with an alternative contact method (phone or email order) preserves more revenue than silence.

Parallel action. If you have a secondary processor already approved, switch volume immediately. If you do not, begin that application now. High-risk account approval takes seven to fourteen days, and the sooner you start, the less total downtime you face.

If the termination is permanent, request written confirmation of the reason, address the underlying issue, and then apply elsewhere with documentation showing what you fixed. A termination that follows you into a new application without an explanation of what changed will produce another denial.

How Do You Choose the Right CBD Payment Processor?

Most payment processors for CBD are not equal, and choosing the wrong one based on a headline rate can cost more in reserves, terminations, and integration problems than a slightly higher rate with a better-matched provider.

If you sell through Shopify. Shopify Payments is unavailable. When evaluating CBD-friendly payment processors for Shopify, assess integration depth specifically: does checkout work natively, can refunds be processed without custom development, and does the provider have documented Shopify support. Rate is a secondary consideration.

If you run subscriptions or auto-ship programs. Subscription models carry structurally higher chargeback exposure. According to the FTC's guidelines on negative option marketing, subscription merchants face specific disclosure and cancellation standards that directly affect dispute rates. Prioritize processors with native subscription billing, automated dunning, and real-time dispute alerts. Understanding how involuntary churn compounds in subscription models is worth reviewing before you finalize a processor for this use case.

If you are processing above $50,000 per month. Gateway redundancy is not optional at this scale. Look for processors that explicitly support multi-bank distribution or load balancing. Running all volume through a single acquiring bank at high volume creates a single point of failure that can take your entire business offline.

Conclusion

Getting payment processing for CBD right comes down to three decisions made before you apply: choosing the right type of financial infrastructure, building a documentation package that passes underwriting, and auditing your website against FDA and FTC standards.

Stripe, Shopify Payments, and PayPal are not options. Square works at low volume but carries stability risk at scale. The only reliable path for a serious CBD brand is a dedicated high-risk merchant account, properly underwritten from the start, paired with a chargeback ratio that stays below your acquiring bank's monitoring threshold and COAs that are current, accredited, and matched to every active SKU.

The 2026 Hemp Cliff adds a hard deadline to all of this. Merchants who have not run the total THC formula on their current inventory are carrying compliance risk that will land directly on their payment infrastructure. Run the formula now. Reformulate or discontinue flagged products before November 12. Notify your processor before enforcement begins.

If you want to know exactly where your current payment setup stands against these standards, BeastMetrics works with high-risk merchants on payment routing, compliance monitoring, and dispute management. Book a payment strategy review here.

FAQ: CBD Payment Processing

What is CBD payment processing?

CBD payment processing is a specialized financial service enabling hemp-derived CBD businesses to accept card payments through high-risk merchant accounts. Mainstream processors like Stripe, PayPal, and Shopify Payments explicitly prohibit CBD transactions, making dedicated high-risk providers the required infrastructure.

Why is CBD considered high risk?

CBD is classified as high risk because hemp-derived CBD businesses operate under evolving federal and state regulations, carry elevated chargeback rates, and face strict marketing compliance requirements. These factors increase financial exposure for acquiring banks.

Can Shopify Payments process CBD orders?

No. Shopify Payments explicitly excludes hemp, CBD, and THC products. Shopify merchants selling CBD must connect a compatible third-party high-risk gateway to Shopify's checkout to accept card payments.

Does Square allow CBD sales?

Yes, with restrictions. Square operates a dedicated CBD program supporting hemp-derived CBD in most U.S. states, but merchants must apply separately and accept that compliance reviews can result in temporary fund holds.

How much does CBD payment processing cost?

CBD processing fees typically range from 4% to 8% of transaction volume, compared to 2% to 3% for standard merchants. Additional costs include rolling reserve holds of 5% to 10% of monthly volume for 90 to 180 days, and in some cases a monthly account fee.

What is a rolling reserve?

A rolling reserve is a percentage of monthly processing volume, typically 5% to 10%, that the acquiring bank holds for 90 to 180 days as protection against chargeback liability. It is returned to the merchant on a rolling basis once the hold period expires.

What chargeback ratio do CBD merchants need to maintain?

Most acquiring banks require CBD merchants to maintain a monthly chargeback ratio below 1%. Best-in-class accounts hold at or below 0.5%. Exceeding 1% triggers Mastercard and Visa monitoring programs that lead to fee increases, reserve adjustments, or termination.

What is the MATCH list and why does it matter?

The MATCH list (Member Alert to Control High-Risk Merchants) is a Mastercard-maintained database recording merchants whose accounts were terminated for cause. A MATCH listing prevents obtaining a new merchant account from most acquiring banks for up to five years.

How does the 2026 Hemp Cliff affect CBD payment processing?

The November 12, 2026 federal deadline shifts hemp THC compliance from delta-9 only to total THC, calculated as (%THCA x 0.877) + %Delta-9 THC. Products currently compliant under delta-9 rules may fail under total THC, risking reclassification as Schedule I substances and triggering bank account terminations.

How long does CBD merchant account approval take?

Most applications take seven to fourteen business days assuming documentation is complete at submission. Incomplete COAs or flagged website content can extend review to three to four weeks.