If you sell CBD online or in-store and have been rejected by Stripe, PayPal or Square for “high-risk,” you’re not alone—most mainstream processors decline CBD merchants the first time around.
This guide explains exactly why banks and payment facilitators say no, what a compliant CBD merchant account actually looks like, how to get approved without overpaying, and how to keep the account healthy so it isn’t shut down after your first surge in sales.
The core reason mainstream processors decline CBD is risk: card networks treat CBD as a high-chargeback vertical, and the acquiring banks that fund those processors are contractually barred from boarding merchants whose underlying sale may violate federal controlled-substances law.
Even in states where adult-use cannabis is legal, processors must comply with federal guidance—most notably FinCEN’s 2014 marijuana banking guidance and the continued Schedule I status of cannabis under federal law—so they err on the side of rejecting CBD merchants rather than risk network penalties or reserve clawbacks.
Another practical blocker is the card networks’ merchant category code policies: Visa and Mastercard do not assign a dedicated MCC for CBD, so merchant descriptors often trigger manual reviews that end in declines or rolling reserve holds.
Finally, many processors rely on underwriting models trained on low-risk e-commerce, where chargeback ratios rarely exceed 0.5%; CBD businesses routinely see ratios above 1.5%, which triggers Visa’s Acquirer Monitoring Program (VAMP) and Mastercard’s Chargeback Monitoring Program (CMP), making mainstream approval statistically unlikely.
The key distinction banks make is between hemp-derived CBD with <0.3% THC (legal under the 2018 Farm Bill) and marijuana-derived CBD (still federally illegal).
Banks will only consider hemp-derived CBD merchants that can prove compliance with USDA regulations, state licensing, and testing requirements; any trace of marijuana-derived product or unlicensed cultivation immediately disqualifies the account.
LegitScript is the de facto certification layer most acquirers require: a LegitScript “Certified Merchant” status signals to the processor that your business model, product claims, age-verification, and supply-chain documentation meet their risk tolerance.
Without LegitScript certification—or an equivalent third-party compliance report—your application will be routed to manual underwriting, which almost always results in a decline or a prohibitively expensive rolling reserve.
A compliant CBD merchant account is not a generic “high-risk” account; it is a specialized product with explicit controls: age verification at checkout, purchase limits per customer, verified supply-chain documentation, and a rolling reserve that starts at 5% and can scale to 10% depending on chargeback history.
The discount rate you pay will be higher than standard e-commerce: expect an effective blended rate of roughly 3.95% plus a $0.25 per-transaction fee, reflecting the acquirer’s elevated risk and the card-network interchange surcharges applied to high-risk MCCs.
You will typically be issued multiple merchant IDs (MIDs) behind a load-balancing gateway so that if one MID is hit with excessive chargebacks, the others remain operational and your cash flow is preserved.
The underwriting package must include: LegitScript certification, USDA hemp producer license (if you cultivate), third-party lab certificates of analysis (COAs) for every SKU, a documented age-verification policy enforced at checkout, a refund and return policy that prohibits international sales, and a chargeback mitigation plan.
Step 1 is to obtain LegitScript certification: submit your business model, website copy, product claims, age-verification flow, and supply-chain documentation; LegitScript charges a one-time fee of roughly $995–$1,495 and the process takes 3–10 business days.
Step 2 is to gather your state and federal compliance documents: state hemp processor or retailer license, USDA hemp producer license (if applicable), and a certificate of analysis from an ISO/IEC 17025 accredited lab for every SKU you sell.
Step 3 is to select a CBD-friendly acquirer: specialized high-risk processors such as Kashu, Durango Merchant Services, or Instabill have dedicated CBD underwriting teams and can board merchants that LegitScript has certified.
Step 4 is to structure your MID strategy: request at least three MIDs behind a load-balancer so you can isolate high-chargeback SKUs or sales channels without disrupting your primary revenue stream.
Step 5 is to implement age verification and purchase limits: use a third-party AVS service that performs a government-ID check at checkout and enforces a daily purchase cap per customer (typically $100–$200) to reduce friendly fraud.
The most common decline reasons are missing LegitScript certification, incomplete supply-chain documentation, or product claims that imply health benefits (e.g., “cannabidiol may help with anxiety”).
Another frequent cause is an unclear business model: if your website mixes CBD with other controlled substances or sells unregulated delta-8 products with >0.3% THC, the processor will decline for regulatory risk.
If your chargeback ratio is already above 0.9%, the acquirer may decline outright rather than onboard you; in that case, you must reduce disputes by implementing clear product descriptions, easy returns, and proactive customer service before reapplying.
Incomplete age verification is a red flag: if your checkout flow does not verify customer age against a government ID, the processor will classify you as a “high-risk of regulatory non-compliance” and decline.
If your supply-chain documentation is missing COAs or shows inconsistent THC levels, the underwriter will flag you for potential non-compliance with the Farm Bill and reject the application.
Monitor your Visa Acquirer Monitoring Program (VAMP) and Mastercard CMP dashboards monthly; once your chargeback-to-transaction ratio exceeds 0.9% for two consecutive months, the networks place you into monitoring and your acquirer may increase your rolling reserve or throttle your processing volume.
Maintain a rolling reserve of 5–10%: the acquirer automatically withholds a percentage of each batch settlement and releases it after 180 days if your chargeback history remains clean.
Use a dispute-response tool that auto-generates representment packets with order confirmations, COAs, and shipping labels; winning disputes reduces your ratio and prevents VAMP escalation.
Keep your LegitScript certification current: recertify every 12 months or whenever you add new SKUs or sales channels, and update your supply-chain documentation annually to avoid a surprise termination.
Implement a clear refund policy and a customer-service hotline; friendly-fraud chargebacks often stem from buyers who never received a response to a refund request, so a visible support channel reduces avoidable disputes.
If you cannot obtain a traditional merchant account, consider a CBD-friendly payment facilitator that aggregates CBD merchants behind a single MID, but expect stricter limits and a higher rolling reserve (often 15–20%).
ACH/eCheck CBD processors such as PayKings’ ACH program can process CBD sales without card networks, but they carry their own risk of ACH returns and NACHA compliance audits.
Some CBD brands open multiple international merchant accounts in jurisdictions where CBD is legal (e.g., UK, EU, or Canada) to diversify revenue streams, but cross-border processing introduces FX fees and regulatory complexity.
If your volume is under $10k/month, a prepaid debit program or a white-label CBD wallet may suffice, but these products do not build credit card processing history and can complicate future boarding with a traditional acquirer.
See if your business qualifies →Yes—most specialized CBD acquirers require LegitScript’s “Certified Merchant” status before they will underwrite your account; without it, your application will be declined or routed to a prohibitively expensive tier.
Expect a 5–10% rolling reserve that is withheld from each batch settlement and released after 180 days if your chargeback history remains within the acquirer’s tolerance; the percentage can increase if your dispute ratio rises.
No—Stripe and Square explicitly prohibit CBD in their terms of service and will freeze or close accounts upon discovery, often without warning or payout of held funds.
The acquirer will place your funds on a rolling reserve hold and may withhold payouts for up to 180 days while it completes a final reconciliation; you will need to reapply with a new acquirer or migrate to an alternative payment method.
Implement age verification with government-ID checks, enforce purchase limits, provide clear product descriptions, offer a visible refund policy, and respond to customer inquiries within 24 hours to prevent avoidable disputes.