Most CBD businesses get declined not because of their product but because of incomplete compliance. Payment processors are not anti-CBD. They are anti-risk. And right now, CBD still sits in a gray zone where one missed document or an unclear refund policy can end an application before it gets reviewed.
If you are setting up payment processing for a CBD business, understanding the compliance requirements for CBD merchant accounts is not optional. It is the difference between a live merchant account and a stack of rejection letters.
Why CBD Merchant Accounts Require Specific Compliance
CBD is federally legal in the US under the 2018 Farm Bill, but the FDA has not approved it as a food additive or dietary supplement. That gap creates regulatory ambiguity that acquirers take seriously.
According to a report by the Brightfield Group, the US CBD market is projected to surpass $16 billion by 2026.
That scale has drawn more scrutiny from payment processors, not less, because high volume in an ambiguous regulatory category means higher dispute and chargeback exposure.
Acquirers are not waiting for federal clarity. They are building their own risk criteria, and your compliance package needs to meet them.
Core Compliance Requirements for CBD Merchant Accounts
Getting approved for a CBD merchant account is not just about processing payments. Acquiring banks and payment processors closely evaluate how compliant your business is before they take on the risk. Here are the compliance requirements you need to follow.
Proof of Hemp-Derived CBD and THC Compliance
Your product must come from hemp, not marijuana, and contain 0.3% THC or less by dry weight. That is the Farm Bill threshold.
Processors will ask for Certificates of Analysis (COAs) from an ISO-accredited third-party lab for every product you sell. The COA needs to confirm cannabinoid content, including THC levels. Outdated COAs or in-house testing results do not satisfy this requirement.
COAs should be less than 12 months old and product-specific. A batch COA that covers multiple SKUs is often flagged as insufficient.
Business Licensing and State-Level Permits
Several states have their own hemp program requirements on top of federal law. Depending on where you operate, you may need a state hemp processor license, a retail license, or both.
Processors commonly ask for your business registration, EIN, and any state-issued hemp-related permits. If your state requires a license to sell CBD and you are operating without one, no acquirer will touch your account.
Check your state’s Department of Agriculture website for hemp retailer and processor licensing requirements specific to your location.
Clear Product Labeling and Website Compliance
This is where a lot of applications fall apart. The FDA has specific rules on what you can and cannot claim about CBD products. You cannot make health claims. You cannot imply that your product treats, cures, or prevents any disease or condition.
Your product pages, landing pages, and checkout flows are reviewed during underwriting. If a processor finds language like “relieves chronic pain” or “clinically proven,” your application will not move forward.
Compliant labels include: net weight, a full ingredient list, a batch number traceable to a COA, and contact information. No unsubstantiated health claims.
Robust Terms and Conditions, Refund Policy, and Privacy Policy
Processors want to see these displayed clearly before the customer checks out, not buried in a footer link. Your terms need to cover:
- What the customer is purchasing and what is excluded
- Your refund and return policy with specific timelines
- How you handle disputes
- Age verification requirements, if applicable
A refund policy that is hard to find or vague about eligibility is a red flag during underwriting. It directly affects your expected chargeback rate, which is one of the main variables processors use to evaluate CBD merchant account applications.
Age Verification
Some acquirers require age gating for CBD purchases, especially if your product line includes anything that could be consumed or inhaled. A basic age verification gate at checkout or site entry is a low-effort compliance step that signals you are managing your platform responsibly.
KYC and AML Documentation
Know Your Customer requirements apply here just as they do in other high-risk payment processing categories. You will need to provide government-issued ID for all business owners with a significant stake (typically 25% or more), articles of incorporation, recent bank statements, and a valid business address.
Some processors will also ask for a short business description that explains your supply chain. Where does your hemp come from? Who handles extraction? Who performs third-party testing? This narrative supports your COAs and helps underwriters connect the documentation to an actual operational process.
Processing History or a Detailed Business Plan
If you have processed payments before, provide three to six months of statements. If you are a new business, a clear and specific business plan that includes projected monthly volume, average transaction size, and expected chargeback management steps will replace it.
Processors want to know your risk profile before they approve you. Either format works, but something needs to fill that gap.
Ongoing Compliance: What Happens After Approval
Getting approved is not the end of your compliance obligations. CBD regulations at both the state and federal level continue to shift, and processors will review your account periodically.
Keep your COAs current. Update them when you add new products or reformulate existing ones. Monitor your chargeback ratio closely. A dispute ratio above 1% puts most merchant accounts at risk of termination regardless of the industry.
Stay ahead of FDA guidance updates. Any formal rule-making on CBD as a supplement or food ingredient will affect what you can say on your website and how processors view your category.
Conclusion: Choosing the Right Processor
Not every high-risk processor has underwriting experience with CBD specifically. Ask directly whether they have active CBD accounts. Ask about their average approval timeline for CBD merchants and what documentation they require upfront.
A processor with CBD experience will have a clear checklist and a dedicated underwriting contact. One without it will ask for the same documents three times and still come back with vague decline reasons.
At EMS Global, we work with CBD merchants through the full compliance and application process, from documentation review to account approval. If you want to know whether your current setup meets the requirements or if there are gaps worth fixing before you apply, speak with our team.
FAQs
What documents are required for a CBD merchant account?
You will need COAs for all products, business registration, EIN, government-issued ID for owners, a state hemp license if required, and compliant terms, refund policy, and privacy policy pages.
Can a new CBD business get approved without processing history?
Yes. A detailed business plan that covers projected volume, transaction size, and chargeback management can substitute for prior processing statements during underwriting.
What THC limit applies to CBD products for merchant account compliance?
Products must contain 0.3% THC or less by dry weight to qualify as hemp-derived under the 2018 Farm Bill. This threshold must be confirmed in a third-party COA.
Why do CBD merchants get declined so often?
The most common reasons are missing or outdated COAs, non-compliant health claims on product pages, absent refund policies, or incomplete KYC documentation.
Do compliance requirements vary by state for CBD merchants?
Yes. Several states have their own hemp licensing requirements beyond federal law. Operating without the necessary state permits is grounds for immediate application rejection.
