High-risk merchant accounts for UK businesses

Pure CBD is not a controlled drug, but a finished product may hold no more than 1 mg of THC or other controlled cannabinoids per container. In England and Wales, CBD food and drink must be on the FSA public list, the FSA advises 10 mg of CBD a day at most, and a medicinal claim makes the product a medicine.

Home Office: cannabis, CBD and cannabinoids(opens in a new tab)Sector page

Only claims on the Great Britain nutrition and health claims register may be used, and adverts may not claim to treat disease or promise a rate of weight loss. A product presented as treating disease is a medicine and needs an MHRA licence.

DHSC: GB nutrition and health claims register(opens in a new tab)Sector page

Nicotine e-liquids are capped at 20 mg/ml in refills of 10 ml at most and must be notified to the MHRA before sale, and single-use vapes are banned since 1 June 2025. From 29 October 2026 the age limit of 18 covers nicotine-free vapes too, and every product needs a duty stamp from 1 April 2027.

Tobacco and Related Products Regulations 2016, reg 36(opens in a new tab)Sector page

General consumer law applies: digital content keeps its 14-day cancellation unless the buyer agrees to immediate access and acknowledges losing the right. Fake reviews are banned outright since April 2025, false time-limited offers since 2008, and earnings claims must reflect what an average participant achieves.

DMCC Act 2024, Schedule 20(opens in a new tab)Sector page

General consumer law applies: a service may start within the 14-day cancellation period only at the customer's express request, and misleading or aggressive selling is banned. Police describe the cold-call remote access model as fraud, and victims who paid by UK bank transfer can claim reimbursement of up to £85,000 from their bank.

Consumer Contracts Regulations 2013, reg 36(opens in a new tab)Sector page

Direct selling through independent distributors is legal, but a pyramid scheme paid mainly from recruitment is banned outright, now under the DMCC Act 2024 as under the 2008 rules before it. Trading schemes must carry statutory warnings, give participants 14 days to cancel and buy back goods when a participant leaves.

Trading Schemes Regulations 1997(opens in a new tab)Sector page

Legal for adults behind highly effective age assurance: since January 2025 for sites publishing their own content, since 25 July 2025 for platforms hosting user content. By July 2026 Ofcom had fined seven providers, the largest fine £1.35 million, and from 6 November 2026 pornography depicting strangulation or sex between relatives becomes an offence in England and Wales.

Ofcom: age assurance enforcement(opens in a new tab)Sector page

A dating service with UK users is a user-to-user service under the Online Safety Act: illegal content risk assessment, reporting tools and quick takedown, as Ofcom's 2026 dating guidance sets out. Where users can share pornography, direct messages included, highly effective age assurance applies.

Ofcom: dating and social discovery(opens in a new tab)Sector page

The buyer has 14 days to withdraw, and no payment, guarantee or reservation of money may be taken before that period ends; a resale service may take nothing before the sale. Breaking the rule is a criminal offence.

Timeshare Regulations 2010, reg 25(opens in a new tab)Sector page

Resale platforms must show the seat, any restriction and the face value, buying with bots above purchase limits is an offence, and unauthorised resale of tickets for designated football matches is an offence in England and Wales. A ban on resale above face value was announced in November 2025; the bill has not been introduced yet.

Consumer Rights Act 2015, ss.90 to 95(opens in a new tab)Sector page

A seller shipping goods from outside the UK to Great Britain charges UK VAT at checkout on consignments of £135 or less, unless a marketplace does it in its place. The customs duty relief on these parcels goes by October 2028 at the latest, and the General Product Safety Regulations 2005 still apply in Great Britain.

HMRC: overseas goods sold to UK customers(opens in a new tab)Sector page

The Consumer Contracts Regulations and the advertising code govern free trials today. For contracts made from January 2027 (1 January in the draft regulations), the DMCC Act adds reminders before a trial ends, before a renewal for 12 months or more and every six months on monthly plans, an easy way to leave and a 14-day cooling-off period after a trial or a long renewal.

DMCC Act 2024, Part 4, Chapter 2(opens in a new tab)Sector page

Brokers and exporters need no sector licence; a carrier using vehicles over 3.5 tonnes needs a goods vehicle operator's licence. The exporter sends the permanent export section of the V5C to the DVLA, and a VAT-registered seller zero-rates the sale only with proof that the vehicle left the UK within three months.

GOV.UK: taking a vehicle out of the UK(opens in a new tab)Sector page

From 29 October 2026, selling any nicotine product to under-18s is an offence, nicotine pouches included, and selling snus is an offence whatever the buyer's age. From 1 January 2027 tobacco may not be sold to anyone born on or after 1 January 2009, and Scottish sellers must join the national retailer register.

Tobacco and Vapes Act 2026, s.1(opens in a new tab)Sector page

A game of chance with prizes that can be cashed out is gaming and needs a Gambling Commission licence, even when entry is free. A social casino with no cash-out stays outside the Gambling Act, and paid prize draws need an equal free entry route.

Gambling Act 2005, s.6(opens in a new tab)Sector page

A Gambling Commission remote operating licence is required whenever the site is used in Great Britain, wherever its servers sit. Licensees refuse credit cards (since April 2020), cap online slots stakes at £5 (£2 for players aged 18 to 24) and run a light-touch financial vulnerability check once net deposits pass £150 in a rolling 30 days.

Gambling Act 2005, s.36(opens in a new tab)Sector page

A paid contest whose prize pool depends on the number of paying entrants is pool betting and needs a Gambling Commission licence, with the credit card ban. A genuine skill competition with no element of chance needs no licence, if the skill test can be expected to stop a significant proportion of entrants from winning.

Gambling Commission: remote pool betting licence(opens in a new tab)Sector page

FCA authorisation is required. Retail CFD rules cap leverage between 30:1 and 2:1, close positions at 50% of margin, protect clients against negative balances and ban deposit bonuses; binary options have been banned for retail clients since April 2019.

FCA: contracts for difference(opens in a new tab)Sector page

Exchanges and custodian wallets register with the FCA under the money laundering rules before they start, and crypto promotions follow the regime of October 2023. Crypto derivatives stay banned for retail clients. A full authorisation regime starts on 25 October 2027, with applications open until 28 February 2027.

FCA: who needs to register(opens in a new tab)Sector page

Debt counselling, debt adjusting and credit information services, which is what UK credit repair is, need FCA authorisation. Debt management firms may not take any payment before the contract or accept fees by credit card.

FCA Handbook, CONC 8.7(opens in a new tab)Sector page

Online providers in England register with the CQC, prescribers follow the GMC remote prescribing standards and dispensing goes through a GPhC-registered pharmacy. Since February 2025, weight-loss medicines may not be prescribed on an online questionnaire alone.

GPhC: safeguards for online pharmacies(opens in a new tab)Sector page

Every pharmacy selling to Great Britain, online ones included, must be on the GPhC register, and prescription-only medicines are supplied only against a prescription. The EU distance selling logo has not applied in Great Britain since 2021: the GPhC registration is the credential to show.

GPhC: checking an online pharmacy(opens in a new tab)Sector page

Selling flight packages or flights to UK consumers requires an ATOL from the Civil Aviation Authority, including for businesses based abroad, unless the seller is the airline or acts as an exempt agent. Packages without flights need insolvency protection, and from 6 April 2027 separate travel services paid in one visit to one trader count as a package.

Civil Aviation Authority: do I need an ATOL(opens in a new tab)Sector page

Selling firearms, shotguns, ammunition or air weapons by way of trade requires registration as a firearms dealer, buyers of firearms and shotguns need a certificate and handover happens in person; Scotland also licenses air weapons and Northern Ireland has its own regime. Knives sold online reach a home only in the hands of an adult, never a locker, and ninja swords are banned in England and Wales since August 2025.

Firearms Act 1968, s.3(opens in a new tab)Sector page

In England and Wales the premises that dispatches online orders needs a premises licence under the Licensing Act 2003, and age is checked again at the door on delivery; Scotland and Northern Ireland license under their own laws. Scotland and Wales set a minimum price of 65p per unit of alcohol.

Home Office: Licensing Act guidance, 2026(opens in a new tab)Sector page