CBD is not automatically excluded from card payments, but whether a CBD business can accept them depends on the product’s legal status, the markets it sells into and each provider’s own policy. When merchants ask why payment processors decline CBD merchants, the answer is rarely the word “CBD” on its own. A decline usually comes from what sits around the product: the claims made about it, what the lab reports show, how the business is classified and how its disputes behave. This guide covers CBD only, separates industry practice from what Niftipay itself confirms, and reflects the rules as of November 2026.
CBD is high risk for processors, not automatically prohibited
For many acquirers, declining a lawfully sold CBD product is a risk-appetite decision rather than a legal requirement. In the United States, hemp has not been a Schedule I controlled substance since the 2018 Farm Bill, and FinCEN’s 2020 guidance said banks need not file a suspicious activity report solely because a customer is a hemp business. Many providers still choose not to serve the sector, or only on strict terms. A product that is unlawful where it is sold is a different matter: no compliant provider can support it.
Three things push CBD into the high-risk bracket:
- Legal fragmentation. The same tincture can be lawful in one market, restricted in a second and unsellable in a third.
- Claims exposure. Wellness products attract health claims, and regulators act on them.
- Product uncertainty. Without lab evidence, a processor cannot tell whether a product is the hemp-derived CBD on the label or something it would not support.
A decline often means the processor cannot price or monitor that uncertainty. The same logic applies to other regulated product categories, as our guides on why processors reject peptide merchants and why they decline supplement merchants explain.
US hemp rules change again in November and December 2026
The US federal definition of hemp is being rewritten, and the change reaches many CBD products, not only intoxicating ones.
Under the 2018 Farm Bill, hemp meant cannabis with a delta-9 THC concentration of no more than 0.3% on a dry weight basis. Public Law 119-37, signed on 12 November 2025, amends that definition in three main ways:
- The 0.3% limit applies to total THC, including THCA, not only delta-9 THC.
- A final hemp-derived cannabinoid product is excluded if it contains more than 0.4 mg per container combined of total THC and any other cannabinoids that have, or are marketed as having, similar effects, as identified by the Department of Health and Human Services.
- Products containing cannabinoids that the plant cannot produce naturally, or that were synthesised outside the plant, are excluded.
The amendments were due to take effect one year after enactment, on 12 November 2026. Public Law 119-103, signed on 2 September 2026, narrowed that first step: from 12 November 2026, only the exclusion for cannabinoids that are not naturally produced applies. The total-THC and per-container rules are now scheduled to apply from 11 December 2026. At the time of writing, further bills to delay or repeal the change are before Congress, and the FDA has not yet published the cannabinoid lists or the “container” guidance the law asks for.
For CBD merchants, the per-container cap is the part to watch: a multi-serving product can exceed it even when each dose contains very little THC. Whether a product is affected depends on its composition and laboratory results, not its label category, and the list of other cannabinoids that count is still unpublished. Expect an underwriter to test each product against the new definition, not only the old one.
UK rules depend on the FSA public list and the claims made
In England and Wales, CBD sold as food has to be linked to a novel food application on the Food Standards Agency’s public list. The FSA’s CBD guidance, updated in August 2026, states that products not on the list, or marked as “Removed”, must be withdrawn from the market. It also confirms that no CBD extract or isolate has yet been authorised as a novel food.
Its figures of 10 mg of CBD and 70 micrograms of delta-9 THC per day for healthy adults are safety recommendations that businesses are encouraged to reformulate towards, not general statutory sales thresholds.
Authorisation is moving but not complete. In a paper for its September 2026 Board meeting, updated in October 2026, the FSA recommended that ministers in England and Wales authorise three high-purity CBD ingredients, mainly for food supplements, with a 10 mg daily maximum and warning labels. The decision rests with ministers and has no set date, so these remain proposed approvals.
Two other UK rules shape an application:
- Controlled drugs. Under the Misuse of Drugs Regulations 2001, a product is only treated as exempt if, among other conditions, no single component part contains more than 1 mg of a controlled drug such as THC.
- Medicinal claims. The MHRA treats CBD products used for medical purposes as medicines. A food or cosmetic sold with medical claims is a different product in regulatory terms.
For UK sales, expect questions on where each SKU sits on the FSA list and whether any product is presented as a treatment.
Card networks add their own scrutiny
Card networks do not decide individual CBD applications, but their classification and monitoring rules shape how cautious an acquirer is.
Every merchant is assigned a merchant category code (MCC) describing its primary business; CBD sellers may fall under food, pharmacy or tobacco-type codes. Visa’s Merchant Data Standards Manual (October 2026 edition) lists MCCs 5122, 5912 and 5993 as “high integrity risk” codes for card-absent transactions, with some regional limits for 5912 and 5993. A business coded inaccurately to avoid that scrutiny is a red flag for any reviewer. Our guide to merchant category codes for high-risk businesses covers how codes are assigned.
Monitoring then follows the account. Under the Visa Acquirer Monitoring Program (VAMP), the threshold for an “excessive” merchant fell to a 1.5% ratio of fraud and disputes to card-not-present sales from 1 April 2026, in the regions named in Visa’s fact sheet, for merchants with at least 1,500 such events a month. VAMP monitors live accounts; it is not a rule for rejecting CBD applications, though acquirers weigh that exposure when assessing dispute-prone categories.
Why CBD health claims can lead to payment processing declines
Unsupported health claims can turn an otherwise well-documented CBD application into a decline. Regulators have acted on such claims directly, and underwriters read websites with the same lens.
In the US, the FDA states that CBD products are excluded from the dietary supplement definition, and it has sent warning letters over claims to prevent, treat or cure serious diseases. In December 2020 the FTC’s Operation CBDeceit targeted six sellers over unsupported health claims.
Underwriters therefore review more than the product page. They look at:
- product names, descriptions and packaging copy;
- blog posts, FAQs and customer testimonials;
- affiliate and influencer content that sends traffic to the store;
- marketing aimed at specific conditions, children or pets.
If the application describes a wellness product but the website promises to treat anxiety, that gap becomes the problem. Compliance requirements by vertical explains why claims weigh so heavily in this category.
Lab reports show whether the product matches the label
A certificate of analysis (COA) is an important part of industry due diligence on CBD products. Many reviewers ask for one per product, and sometimes per batch, from an independent laboratory, although document requirements differ from one provider to another.
A useful COA typically shows:
- cannabinoid content, including CBD, delta-9 THC and THCA, so total THC can be calculated;
- THC and other relevant cannabinoids per serving and per container, which matters more in the US from December 2026;
- contaminant screening for solvents, heavy metals and pesticides;
- a batch number that matches the label and the product listing.
Missing, outdated or mismatched reports can stall a file, and replacing them may require new testing, time and cost, so check them before applying.
Chargebacks, refunds and shipping show how the business operates
Processing history tells an underwriter how the business behaves after the sale. For CBD, three patterns draw attention:
- Disputes. “Not as described” and “not received” claims rise when delivery is slow or strength is unclear. Our guide to reducing chargebacks in high-risk industries covers prevention.
- Refund policy. A clear, visible policy that is honoured reduces disputes; a hidden or restrictive one increases them.
- Shipping destinations. Selling into markets where a product is restricted creates legal and dispute risk, so reviewers often ask how the checkout enforces destinations.
Where risk remains, a provider may approve with conditions such as a rolling reserve rather than decline outright.
What underwriters check in a CBD application
The table below reflects common industry practice, not one provider’s form. Each provider sets its own requirements; Niftipay’s own are described further down.
| Layer | What is usually requested | Risk it answers |
|---|---|---|
| Business and owners | Company registration, directors, beneficial owners, proof of address | Who is accountable |
| Product | COA per product or batch, labels, ingredient lists | Legal status and product accuracy |
| Website | Claims, age gate where relevant, terms, refund and shipping policies | Marketing and consumer risk |
| Markets | Countries or states sold to, any licences held | Legality per destination |
| Processing history | Recent statements, dispute and refund levels | Post-sale behaviour |
Our high-risk merchant account application checklist goes through the general file in more detail.
What to do after a CBD application is declined
A decline is useful feedback on the application, so the first step is to find out which part of the file raised concerns.
- Ask for the reason. Providers do not always give one, but many will say whether the issue is product, market, claims or history.
- Fix the evidence, not the description. Update COAs, remove or rewrite claims, align the website with the application and restrict unsupported destinations.
- Check whether the account was terminated. A closure for cause can lead to a listing that other acquirers see. Our guide to accepting payments while on the MATCH list explains how that works.
- Never disguise the category. Describing CBD as something else, or processing it through another business’s account, turns a decline into a far bigger problem.
How Niftipay reviews CBD merchant applications
Niftipay reviews CBD merchants individually, and approval is not guaranteed. Niftipay Card Payments lists CBD businesses among the business models it can review. Beyond CBD, the broader cannabis-related categories Niftipay reviews case by case, including hemp, cannabis accessory, medicinal cannabis and THC-related businesses, are set out on the cannabis payment gateway page. Product classification, claims, licensing, jurisdiction and underwriting all affect the outcome.
As part of KYB, Niftipay asks for company information and the identity of any shareholder or beneficial owner holding 25% or more, alongside details of the products sold and the markets targeted. Additional documents may be requested depending on the products and any licensing requirements. Applications are normally reviewed within two to five business days; complex cases can take longer.
Approved merchants may be able to accept Visa, Mastercard, Apple Pay and Google Pay where supported, and crypto and stablecoin payments, depending on Niftipay’s individual assessment and the account configuration approved during onboarding. Card Payments processes each payment as an individual transaction, without subscriptions or stored cards.
CBD merchant underwriting FAQs
Why do payment processors decline CBD merchants?
Usually because of what surrounds the product: legal status that varies by market, health claims, weak lab evidence, inaccurate classification or dispute history.
Is CBD considered high risk by payment processors?
Most processors treat it as high risk, which usually means closer review and sometimes conditions such as reserves. Some providers do not accept the category at all.
Does the new US hemp law affect CBD payment processing?
It can. A narrower change on non-naturally produced cannabinoids starts on 12 November 2026. From 11 December 2026, as currently scheduled, final products are excluded if they contain more than 0.4 mg per container of total THC (including THCA) combined with certain other THC-like cannabinoids. Whether a product is affected depends on its composition and lab results.
Can a CBD business apply again after being declined?
Yes. Find out why the application failed, fix the underlying evidence and apply again, with the same provider or one that reviews CBD individually. Never disguise the category.
Can CBD merchants accept crypto payments?
Crypto and stablecoin payments may be available to approved cannabis-related merchants. As with cards, availability depends on Niftipay’s individual assessment of the merchant and the account configuration approved during onboarding.