CBD Payment Processing Guide
Why card networks classify CBD as high-risk, what lab documentation acquirers expect, how domestic and international acquiring compare, and how to keep a CBD account alive.
- By the OpenGate underwriting desk
- Updated
- 10 min read
CBD payment processing is card and alternative-payment acceptance for merchants selling hemp-derived products, a vertical the card networks classify as high-risk. Because US federal law permits hemp while state rules and network policies differ, acquirers demand lab documentation, age controls and clean marketing before they will board a CBD merchant.
Why CBD payment processing is high-risk
The card networks and their banks look at CBD through three lenses. The legal lens comes first. US federal law changed in 2018, removing hemp with THC under the legal limit from the federal controlled substances definition, but state rules differ widely, and products like delta-8 sit in a gray zone the states interpret differently. The federal definition itself is narrowing, a change widely called the federal hemp ban. As the law stood in October 2026, it excludes cannabinoids the plant cannot produce from November 12, 2026, and from December 11, 2026 it counts total THC with THCA and caps a finished product at 0.4 mg per container. Cannabinoids made by conversion, delta-8 included, are excluded by December 11 at the latest and possibly from November 12, so plan on the earlier date. Many full-spectrum products as formulated in 2026 sit above that cap. Congress has already moved these dates once, so confirm the current status with counsel before you build a catalog around those products. The networks do not want to adjudicate dozens of state laws per transaction, so they classify the whole category as high risk.
The second lens is banking. Many US banks refuse to hold deposits from hemp merchants, which shrinks the pool of acquirers and gives the remaining ones pricing power. The third is chargebacks. CBD sells heavily through subscriptions and autoship programs, and continuity billing produces disputes when customers forget what they signed up for. Add marketing that overpromises, and you get the dispute profile the networks watch closely.
The same three lenses explain why mainstream processors apply blanket rules. Stripe and PayPal restrict the vertical by policy, not because any single merchant is bad. The platforms around them keep moving: Stripe’s CBD policy follows local THC limits, Square told sellers in August 2026 that it was winding down the Square CBD program, and selling CBD on Shopify depends on a third-party payment provider that accepts hemp. The practical consequence is that CBD operators should expect to be re-underwritten by a specialist gateway, with the lab documentation and the site discipline in place before the first application goes out. A file prepared for a mainstream processor is not prepared enough.
Certificates of analysis and why they decide the file
A certificate of analysis is a lab report from an independent laboratory that measures what is in a product: cannabinoid potency, THC content, and contaminants like pesticides, heavy metals and residual solvents. Acquiring banks treat the COA as the dividing line between a compliant hemp product and an unlicensed cannabis product. The file must show COAs that match the products on the website, from an accredited lab, batch by batch or product by product. For US sales, ask the lab to report total THC, THCA included, in milligrams per container and to state its reporting limit, because the federal cap applies per container from December 11, 2026.
The COA is not a formality. When a bank questions a CBD file, the COA set is usually the first thing it asks for, and mismatches between the lab reports and the product pages are a fast decline. The same logic applies to the site: an age gate at entry, a clear disclaimer that the products are not medicines, and no claims about curing anything. We list the documents the acquirers expect, but the lab reports and the site copy are yours to produce. The full document logic is in the underwriting guide.
Payment methods for CBD merchants
Cards carry the core of the volume, and the setup matters more than the logo. A merchant with US domestic acquiring runs Visa and Mastercard locally with dollar settlement. One with international acquiring runs the same cards cross-border, plus local methods where the market demands them: SEPA and iDEAL for European customers, and bank-transfer rails that avoid card network policies entirely. Subscriptions need card-on-file with proper mandate handling, because rebills on unsupported rails are where continuity disputes breed.
Crypto plays a narrow role. Some CBD merchants accept stablecoin payments where card acquiring is unavailable, and settlement in stablecoins is possible where the jurisdiction allows it. Crypto does not replace the card account, because most customers still pay by card. It is a parallel rail that keeps orders flowing when a card lane fails, and it belongs in the offer as an explicit term.
Domestic versus international acquiring
Domestic acquiring means a bank in your own country processes your cards. For US merchants, domestic banks that accept CBD exist, but the pool is small, the documentation demands are high and pricing sits at the top of the high-risk range. What you buy is local settlement in dollars into a US bank account, and an acquirer that understands your state’s rules.
International acquiring means a bank in Europe or an offshore jurisdiction processes your US customers’ cards cross-border. The advantage is availability: European and offshore acquirers board CBD files that US banks decline, often with faster onboarding. The disadvantages are the cross-border fees the schemes charge on each transaction, the FX and payout costs, and the stability questions covered in the EU versus offshore guide. Many CBD merchants run both: domestic acquiring for core volume, international for redundancy.
One structural note for US merchants: the choice is not permanent. A merchant can start on international acquiring to get live, build clean processing history, then apply for domestic acquiring with evidence in hand. The reverse also happens, when a domestic account grows too restrictive and the merchant adds an international lane for specific markets. Placement is a portfolio decision you revisit as your history grows.
The chargeback reality
CBD’s dispute profile has a few repeat patterns, and they are mostly controllable:
- Continuity disputes. Autoship and subscription charges the customer does not recognize or remember approving. Unclear terms at checkout feed these.
- Friendly fraud on high-ticket orders. A customer disputes a legitimate order and keeps the product.
- Product disputes. Potency claims that do not match the product, or delivery promises the operation cannot keep.
- Descriptor confusion. A billing statement that shows a name the customer does not recognize turns a confused customer into a dispute.
Chargebacks are the metric that ends CBD accounts. The scheme monitoring programs apply here exactly as they do anywhere else, and the math of staying under them is in the chargeback ratio guide.
The ratio math is unforgiving because CBD tickets are often high and dispute volume concentrates in a few SKUs. One bestselling autoship product with unclear terms can produce a steady drip of disputes that no representment effort fully offsets. The pattern to watch is the count per product line, because that tells you where to fix terms or pull a SKU.
Marketing claims that close accounts
The fastest self-inflicted closure in CBD is a claim the product cannot legally make. Medical language, disease references, before-and-after narratives and anything resembling a cure put the merchant in breach of card network rules and bank policy at the same time. The networks review merchant sites routinely, and a CBD store flagged for medical claims loses the account, not just the page.
The other claims kill the account slowly, through disputes. Overstated potency promises, guaranteed results and shipping timelines the operation cannot hit convert into not-as-described chargebacks. The review standard is simple: if the claim on the page cannot be supported by the COA and by what actually ships, it costs you the account eventually. Underwriters read the marketing layer as part of the file, and so should you.
How to keep a CBD account alive
A CBD account survives on discipline, not luck. Run it this way:
- Keep COAs current and matched. Every product on the site has a lab report, and new batches get new reports before they sell.
- Keep the marketing conservative. No medical claims, no cures, no before-and-after promises. The acquirer reviews the site periodically, and so do the networks.
- Age-gate the store and log the gate. An entry check and a checkout confirmation are the minimum the acquirers expect.
- Use a recognizable descriptor. The billing name should resolve to your brand in one search, so customers recognize the charge instead of disputing it.
- Make cancellations trivial. A visible cancellation path cuts continuity disputes more than any other single change.
- Watch the ratios monthly. Refund early when an alert shows a customer about to dispute, and read the dispute breakdown to fix the cause rather than the symptom.
None of these steps requires money. They require consistency: the same COA discipline, the same descriptor, the same cancellation flow, reviewed the same week every month. Acquirers close CBD accounts for drift, not for drama. The merchant who keeps the file current and the site honest is the one whose account outlives the industry’s churn.
What the underwriting file needs
The CBD file has a vertical-specific layer on top of the standard set: corporate registration, ownership structure and UBO identity, six months of processing history if it exists, a corporate bank account that accepts hemp proceeds, and the site itself. The CBD layer is the product list with matched COAs, the lab accreditation, the age-gate implementation and the marketing review. One warning before you start: check that your bank accepts CBD funds, because accounts that look fine at opening get closed later when the bank discovers the industry. The same logic as the pricing page applies: the quote follows the file, and a clean CBD file with current lab reports prices better than a rushed one. The vertical’s full requirement list is on the CBD industry page.
Timeline matters too. A complete CBD file can move from first review to go-live in as little as two weeks. The usual delay is the COA set, because batch reports for a full product catalog take time to pull from the lab. Start the lab documentation early, in parallel with the corporate documents, and the two tracks finish together.
When the corporate documents and the COA set are ready, send your CBD file. A human underwriter reads it and replies within 1 business day with an offer, a list of missing documents or an honest no. Applying is free, and the written offer states the rates, the reserve and the limits before you sign.