CBD and cannabis business banking, explained.

CBD and cannabis banking sits at the intersection of three separate legal questions that most founders conflate into one: whether the product is legal to sell where it is being sold, whether it is legal to bank the proceeds of that sale under the laws governing the bank, and whether the card schemes and payment networks the business relies on for e-commerce will process it at all. A business can be entirely legal in its home market and still be effectively unbankable because the answer to the second or third question is unfavourable, and understanding which of the three is actually the constraint is the first step to solving it.

The single biggest driver of difficulty is THC content and the resulting classification of the product as hemp, CBD, or cannabis in the jurisdiction of sale, because that classification determines which regulatory regime applies, which in turn determines which banks and payment providers will even consider the file. A hemp-derived product below the applicable THC threshold, properly tested and labelled, is a categorically different banking conversation from a cannabis product containing THC above that threshold, even where both are legal in the specific market being sold into.

The second driver is the split between US federal and state law, which remains the single most consequential fact in this sector for any business with US exposure: cannabis remains a controlled substance under US federal law even where state law permits its cultivation, sale and use, and federal law governs the banking system, including the reach of federal money-laundering statutes to funds derived from state-legal cannabis activity. This is the reason plant-touching cannabis businesses in the US, however fully licensed at state level, face a banking market that is narrower, more expensive and more procedurally demanding than almost any other legal industry.

The third driver is that even within hemp-derived CBD, which sits in a clearer legal position in more markets, product claims and marketing create real regulatory exposure that banks and payment providers price into their underwriting: a CBD product marketed with unsubstantiated health or medical claims invites regulatory action that a bank does not want its merchant relationship exposed to, regardless of whether the underlying product itself is entirely lawful.

This guide separates these threads deliberately, because the right structure, the right banking partner and the right documentation differ substantially between a hemp/CBD e-commerce brand and a state-licensed cannabis operator, and between a US-facing business and a European or UK one operating under novel-foods rules. Get the classification right first; everything else follows from it.

Hemp and cannabis are the same plant species, distinguished legally by THC concentration rather than botany. In most jurisdictions that have legislated on this, hemp is defined as cannabis containing THC below a specified threshold — commonly around 0.2% to 0.3% by dry weight, though the exact figure and measurement method vary meaningfully by jurisdiction — and products derived from compliant hemp, including CBD isolate and broad-spectrum or full-spectrum extracts formulated to stay under the threshold, are generally treated far more permissively than cannabis products above it.

This threshold distinction is not a technicality; it is the line that determines which regulatory regime, which banks, and which payment processors are even theoretically available. A business that can document, batch by batch, that its finished products test reliably below the applicable threshold is operating in a meaningfully different — and generally bankable — category from one selling products with higher or variable THC content, even if both products are derived from the same starting hemp biomass.

The complication that catches even well-intentioned operators is that THC concentration can vary between batches of raw material and can shift during extraction and formulation, so a single certificate of analysis on the input biomass does not guarantee the finished product stays compliant. Banks and payment providers that understand this sector specifically ask for finished-product testing, not just raw-material testing, and a business that can only produce the latter will face additional scrutiny or an outright decline from providers who have been burned by this gap before.

Full-spectrum products, which retain trace amounts of THC alongside other cannabinoids, occupy a genuinely harder banking position than broad-spectrum or isolate products formulated to be THC-free, purely because the presence of any THC, however small, moves the product closer to the classification boundary and increases the documentation burden needed to satisfy an underwriter that it stays reliably on the compliant side of it.

None of the thresholds or classifications described here should be treated as legal advice for a specific market; THC limits, measurement methodologies and the legal consequences of exceeding them vary by country and, within the United States, by state, and change periodically. Confirm the specific applicable threshold and testing methodology with qualified regulatory counsel in every market the product is sold into before relying on any figure in this guide.

In the United States, hemp cultivated and processed in compliance with the federal framework governing hemp, and containing THC below the federal threshold, is legal at the federal level, which is why hemp-derived CBD banking in the US, while still high-risk in card-scheme and bank underwriting terms, is a meaningfully more open market than banking for plant-touching cannabis. A hemp-derived CBD business can generally access mainstream high-risk merchant processing and a defined set of banks with sector appetite, provided its products test compliant and its marketing avoids the claims issues covered later in this guide.

Cannabis containing THC above the federal hemp threshold — including cannabis legal for medical or adult use under the law of an individual state — remains a Schedule I controlled substance under federal law, and federal law, not state law, governs federally chartered and federally insured banks. This is why a fully licensed, state-legal cannabis dispensary or cultivator can find it extremely difficult to open even a basic operating account: a federally regulated bank accepting deposits derived from state-legal cannabis activity is, in a technical sense, handling proceeds of activity that remains federally illegal, and banks manage that exposure through a small, specialised segment of the market rather than mainstream deposit-taking.

The banks and credit unions that do serve plant-touching cannabis operators generally do so under a specific compliance framework built around detailed, ongoing reporting to financial crime regulators, extensive verification that the business operates within its state's licensing and regulatory limits, enhanced transaction monitoring, and often a cash-management and armoured-transport relationship given the sector's continuing reliance on cash where card processing remains constrained. These relationships come with higher fees, slower onboarding, and account limits calibrated to the bank's own risk appetite and reporting capacity, and are a fundamentally different service tier from ordinary business banking.

Card-scheme processing for plant-touching cannabis sales remains extremely limited because the major card networks generally will not knowingly process direct sales of a federally controlled substance, which is why cannabis retail continues to rely heavily on cash, cashless ATM-style workarounds of varying legal durability, direct bank-transfer and account-to-account payment methods, and closed-loop payment systems built specifically for the sector rather than standard card acceptance.

The state-versus-federal tension is a live policy question that shifts periodically as legislation is proposed and occasionally passed to give state-legal cannabis businesses clearer access to banking; the practical position for any operator is to plan around the current federal framework as it stands today, build the compliance and reporting relationship a bank actually needs to accept the risk, and treat any prospective legislative change as upside rather than something to plan around before it happens. This is general information and not legal advice; state licensing requirements and the federal framework should be confirmed with qualified counsel.

The European Union and the United Kingdom regulate ingestible CBD products through a novel-foods framework rather than through the controlled-substance classification that dominates the US cannabis conversation, and understanding this distinction matters because it changes what a bank or payment provider in these markets is actually assessing. Under novel-foods rules, CBD extracts intended for consumption as food or food supplements require authorisation before they can lawfully be placed on the market, based on a safety dossier submitted to and reviewed by the relevant food-safety authority.

The practical consequence for a business selling ingestible CBD products into the EU or UK is that banking and payment underwriters increasingly ask whether the specific products being sold hold, or are covered by, a valid novel-food authorisation or an accepted transitional application, because selling an unauthorised novel food is a genuine regulatory breach that exposes both the seller and, by extension, its payment partners to risk. A business that cannot answer this clearly should expect that gap to surface in underwriting.

Topical CBD products — cosmetics and skincare rather than ingestible supplements — fall outside the novel-foods regime and are instead regulated under cosmetics safety frameworks, which is a materially different and generally more straightforward compliance path; a business selling both ingestible and topical products needs to be able to describe which regime applies to which SKU clearly, because a payment provider reviewing the product catalogue will expect that distinction to be reflected in labelling and marketing, not blurred across the range.

THC limits in the EU and UK differ from the commonly cited US figure and vary between individual EU member states and the UK itself, with some jurisdictions applying stricter limits or additional controls on hemp cultivation and CBD retail than others; a product compliant in one European market is not automatically compliant in another, and a business selling across borders within Europe needs a market-by-market compliance check rather than a single continent-wide assumption.

As with the US section above, specific novel-food authorisation status, THC thresholds and cosmetics classification requirements change and vary by jurisdiction; this guide describes the framework generally and is not a substitute for qualified regulatory advice on the specific products and markets involved.

A certificate of analysis, or COA, from an accredited independent laboratory testing the finished product's cannabinoid profile and confirming THC content below the applicable threshold, is the single document most consistently requested across CBD and hemp banking applications, and its quality matters as much as its existence. A COA should identify the specific batch it covers, the testing methodology used, the accreditation of the laboratory, and a date recent enough to be representative of current stock, because banks and payment providers that understand the sector have seen outdated or vaguely batch-matched COAs used to paper over products that would not actually pass testing today.

Beyond cannabinoid content, a well-built testing regime covers contaminants relevant to the sector specifically: pesticide residue, heavy metals, residual solvents from extraction, and microbial contamination, because these are the failure modes that generate product recalls and regulatory action independent of the THC question entirely, and a bank underwriting the business's overall risk profile reasonably wants to see that the business tests for all of them, not just the cannabinoid panel that happens to be the headline compliance issue.

Product claims are a distinct and, in practice, an equally important underwriting issue: regulators in multiple jurisdictions have taken action against CBD sellers for unsubstantiated health or medical claims — treating, curing, mitigating or preventing specific diseases or conditions — and a bank or payment provider reviewing a merchant's website and marketing materials as part of underwriting is specifically looking for this kind of language, because a regulatory action against the merchant for its marketing becomes a reputational and compliance exposure for the payment provider processing on its behalf.

The safest and most bankable marketing position describes the product accurately by its ingredients and intended general use — a wellness or lifestyle product — without asserting therapeutic outcomes the business is not licensed and able to substantiate through the relevant regulatory pathway. Businesses that have built genuine clinical evidence and hold the relevant medical or pharmaceutical licensing to make specific therapeutic claims are operating in an entirely different, more heavily regulated category with its own separate banking and licensing conversation, distinct from general consumer CBD retail.

Building a testing and claims-compliance file that a bank can actually review — current COAs matched to current stock, a documented marketing-review process, and evidence that claims have been checked against the applicable regulatory standard before publication — is one of the highest-leverage things a CBD business can do to improve its banking prospects, because it directly addresses the two issues underwriters raise most often.

Most CBD and hemp businesses sell primarily online, which makes card-not-present acquiring the central banking relationship for the business, distinct from and in addition to any operating bank account. Mainstream payment processors generally exclude CBD from their standard terms of service, which is why the sector relies on specialist high-risk acquirers that have built specific underwriting frameworks, reserve structures and pricing for the category, in much the same way as other high-risk verticals.

The underwriting file for CBD e-commerce acquiring typically covers current finished-product COAs, sourcing documentation showing the hemp input is itself compliant, website and marketing review against the claims standards discussed above, business licensing appropriate to the jurisdiction of sale, and standard business documentation and beneficial-ownership verification. Businesses that assemble this proactively, before applying, consistently move through underwriting faster than those that wait to be asked.

Chargeback and reserve terms in CBD acquiring reflect genuine underwriting cost rather than opportunism, and reserves — held back from settled processing volume against future disputes — are standard practice in this category rather than a sign of a poor deal; the specific terms should be reviewed and, where the business has an established processing history, renegotiated periodically as that history demonstrates lower actual loss rates than the initial file assumed.

Cross-border e-commerce adds jurisdiction-by-jurisdiction complexity directly into the acquiring relationship: a business shipping into multiple countries needs its acquirer to understand that product legality, THC thresholds and novel-food or equivalent authorisation status differ market by market, and a geofencing or market-specific compliance approach — restricting sale of specific SKUs to jurisdictions where they are actually compliant — is frequently a condition acquirers impose, or should be adopted proactively, rather than an optional refinement.

Alongside card acquiring, many CBD businesses also maintain alternative payment methods — bank transfer, open banking payment initiation, and in some markets cryptocurrency payment options — both to diversify away from reliance on a single acquiring relationship and because a meaningful share of banks and card networks continue to decline the category outright regardless of documentation quality, making genuine payment-method diversification a practical resilience measure rather than a convenience feature.

A CBD or hemp business selling into multiple markets — for example the US, the UK and several EU jurisdictions — faces a genuinely different compliance and product-classification standard in each one, and structuring the business around a single entity attempting to satisfy the most permissive standard everywhere is a common and risky simplification. A more resilient structure separates market-facing entities or at minimum maintains clear, documented, market-specific compliance sign-off for each jurisdiction's product formulation, labelling and marketing before sale begins there.

For businesses with any plant-touching cannabis exposure alongside a hemp/CBD product line — common where a US multi-state operator also runs a hemp-derived consumer brand — keeping the cannabis and hemp activities in clearly separated legal entities, with separate banking relationships, is close to essential, because commingling the two in a single entity or a single bank account risks contaminating the hemp business's otherwise more bankable position with the cannabis business's federal-law exposure in the eyes of any bank reviewing the group.

Holding company structure and the jurisdiction chosen for group ownership should account for how that jurisdiction's own regulators and banks view cannabis and CBD exposure specifically; a holding jurisdiction with no domestic cannabis or CBD market of its own may still have banks with no appetite whatsoever for holding structures with cannabis exposure anywhere in the group, so jurisdiction selection needs to be checked against actual current bank appetite rather than assumed from the jurisdiction's general reputation for company formation.

Licensing across borders compounds the structuring question: a business holding a state cannabis licence in the US, a novel-food authorisation route in the EU, and general hemp-processing registration elsewhere is managing three distinct regulatory relationships that do not automatically recognise or rely on each other, and the corporate structure should make clear which entity holds which licence and how compliance responsibility and liability sit relative to the group as a whole.

For genuinely multi-market operators, the practical advice is to build the compliance and structuring plan market by market with local regulatory counsel in each jurisdiction, then layer the banking strategy on top of that confirmed compliance position, rather than attempting to design a single global structure first and retrofit local compliance into it afterward — the latter sequence is consistently the more expensive one to unwind when a gap is found.

For a hemp-derived CBD e-commerce business with compliant products, current COAs and clean marketing, a well-prepared application to a specialist high-risk acquirer and a bank or EMI with sector appetite typically takes several weeks from submission to a live, funded setup — broadly comparable to other high-risk verticals, though with the added step of product and marketing compliance review specific to this sector.

For a plant-touching cannabis operator in the US seeking a compliant banking relationship, timelines are typically longer, often extending to a few months, because the small population of banks and credit unions serving the sector conduct deeper and more continuous compliance review, including verification against the state licensing and reporting regime, before and after onboarding, and often maintain waiting lists given the limited number of institutions actively serving the category.

Businesses entering a new market for the first time — a US hemp brand expanding into the EU, for example — should budget additional time for the market-specific regulatory compliance work (novel-food authorisation status, local THC threshold confirmation, labelling review) before banking and acquiring applications in that market can even be meaningfully submitted, since providers in that market will expect that compliance position to already be resolved rather than pending.

Preparation materially compresses these timelines in both categories: assembling current finished-product COAs, licensing documentation, marketing-compliance review, corporate and ownership documentation, and — for cannabis operators specifically — evidence of the compliance and reporting infrastructure the business has built, before making any approach, consistently produces a faster process than applying first and responding to follow-up requests as they arrive.

As with other high-risk categories, expect at least one decline in any serious search that has little to do with the specific file and everything to do with an individual institution's current risk appetite; this is normal, and running applications in parallel across multiple institutions with genuine current sector appetite, rather than sequentially, is the more efficient approach.

The most common failure mode in this sector is product or formulation drift that is never re-disclosed to the bank or acquirer: a business launches with a compliant, tested product line and later adds a new SKU, a higher-potency formulation, or a full-spectrum product with different THC characteristics, without updating its compliance file or notifying its payment partners. Acquirers and banks in this sector actively monitor merchant websites and product catalogues for exactly this kind of change, and discovering it themselves is treated far more seriously than the business disclosing it proactively.

The second common failure is a lapse in testing discipline — COAs that are not refreshed against current production batches, or testing that covers cannabinoid content but quietly drops the contaminant panel over time as a cost-saving measure — which surfaces either during a periodic bank review or, worse, after a product-quality incident that draws regulatory attention and immediately implicates the banking relationship as well.

The third is marketing drift, where compliant initial marketing copy is gradually expanded by a growing marketing team into therapeutic or medical-sounding claims that were never present in the file the bank originally approved; this is one of the most common triggers for account review or closure in the sector because it is highly visible to regulators, competitors and payment-network monitoring alike.

The fourth, specific to plant-touching cannabis operators, is a change in state licensing status — a licence renewal missed, a compliance violation recorded by the state regulator, or an expansion into an activity not covered by the existing licence — that the bank's ongoing reporting relationship is specifically designed to catch, and that typically triggers an immediate and serious review of the account given how central licensing compliance is to the bank's own justification for serving the sector at all.

The fifth, common to both hemp/CBD and cannabis businesses, is simple reliance on a single banking or acquiring relationship with no contingency in place; de-risking events in this sector — an institution exiting the category, tightening its appetite, or itself facing a regulatory issue — occur periodically and with limited warning, and a business with no second relationship in reserve faces a genuine operational crisis when its sole provider gives notice.

Our work in this sector begins with product and market classification: confirming, with the client's own testing and, where needed, coordination with qualified regulatory counsel, exactly where each product line sits against the applicable THC threshold and licensing regime in every market it is sold into. This classification exercise, done properly at the start, is what allows the rest of the engagement to move efficiently, because it determines which category of bank, acquirer and structure is realistically available.

Where compliance documentation needs strengthening, we advise on what a specialist acquirer or bank in this sector will actually expect — current finished-product COAs, contaminant testing, a documented marketing-compliance process, and licensing evidence appropriate to the jurisdiction — and coordinate with qualified counsel on novel-food authorisation status, state licensing questions, and cross-border compliance where the business operates in more than one market.

On structure, we build separate entities where separating hemp/CBD activity from any plant-touching cannabis exposure is warranted, select holding jurisdictions with actual confirmed banking appetite rather than assumed reputation, and document beneficial ownership and licensing allocation clearly enough that a bank reviewing the group can follow it without ambiguity.

On banking and acquiring, we position applications across our network of more than 120 banking and payment institutions across 19 jurisdictions, matching the specific product classification, market footprint and licensing position to institutions with genuine current appetite for that exact profile, and build a layered architecture — acquiring, operating account, and a contingency relationship held in reserve — because de-risking events in this sector are common enough to plan for rather than hope to avoid.

After onboarding, we support periodic review preparation and flag proactively when a product change, a new market, or a licensing update needs to be disclosed to and re-underwritten by existing banking and payment partners before it becomes a discovery during their own monitoring. Every engagement is scoped and quoted on the specific business, we tell clients plainly where we think a plan will not be bankable as designed, and no institution can be guaranteed in advance — every bank and acquirer decides independently. This guide is general information and not legal or tax advice; THC thresholds, licensing regimes and novel-food or equivalent authorisation requirements vary by jurisdiction and change over time, and should be confirmed with qualified counsel before you rely on them.