Merchant accounts for CBD and hemp brands

A CBD merchant account is approved based on the underwriter's assessment of regulatory and reputational risk, which they primarily gauge from your website. While your product's certificate of analysis (COA) is critical, the first checks are nearly always on your marketing copy. Acquirers and their partner banks operate under licence from card schemes like Visa and Mastercard, which have strict rules against making unproven health claims. An underwriter will scan your product pages, blog, and social media for language that suggests your CBD or hemp products can diagnose, treat, cure, or prevent any disease. Using words like "anxiety", "pain relief", "insomnia", or "inflammation" is the fastest route to a decline.

This is not a matter of scientific validity but of financial compliance. The schemes fine acquirers for allowing merchants to make claims that could attract scrutiny from regulators like the UK's MHRA or the US FDA. To the payment provider, any health benefit language is a direct financial and regulatory liability. They are not assessing your product's efficacy; they are assessing whether your marketing language exposes them to fines or licence review. For this reason, a compliant website with generic wellness language paired with a clean COA is more likely to be approved than a scientifically superior product marketed with prohibited health claims.

The underwriting process for a CBD merchant account is a multi-stage review. It begins with an automated and manual scan of your website for trigger words related to health claims and THC content exceeding the legal threshold in your target markets (e.g., 0.2% in the UK, 0.3% in the US). The underwriter verifies that every product batch has a recent, third-party certificate of analysis confirming its cannabinoid profile. They will cross-reference the lab report with the product descriptions on your site.

Next, they examine the product type. Ingestible products like oils and edibles face greater scrutiny than topicals like creams and balms due to different regulatory frameworks. Vape products often fall into a separate high-risk category entirely, sometimes requiring specialist providers. The underwriter also checks your fulfilment and shipping policies to ensure you are not selling to jurisdictions where your products are illegal. Finally, the directors and ultimate beneficial owners of the business undergo KYC (Know Your Customer) checks, including screening against industry blacklists like the MATCH list. Only after all these checks are cleared does the provider move to discussing commercial terms.

Pricing for CBD payment processing is provider-specific and reflects the perceived risk of the business. You should expect rates to be higher than for standard low-risk e-commerce. For UK and European merchants, indicative rates from EEA-licensed acquirers typically range from 2.5% to 5.0% per transaction. US-based businesses may see rates from 3.5% to 6.0% with specialist domestic acquirers. These figures are illustrative; your final offered rate depends on your processing history, sales volume, chargeback ratio, and the underwriter's assessment of your file.

A rolling reserve is standard practice for any high-risk merchant account. This is a percentage of your revenue held by the provider to cover potential chargebacks and refunds. A typical reserve for a CBD business is 10% of sales, held for a rolling period of 180 days. This means that 10% of Monday's sales are released 180 days later, 10% of Tuesday's sales are released 180 days after that, and so on. Well-established businesses with a strong processing history may be able to negotiate a lower reserve or have it capped once a certain threshold is reached. Expect monthly fees and per-transaction fees in addition to the discount rate.

Termination of a CBD merchant account usually stems from three areas: chargebacks, changes to your product or marketing, or shifts in the provider's risk appetite. A chargeback ratio exceeding the scheme threshold (typically 0.9% by transaction count) for several consecutive months will trigger a review and likely termination. Even a single, large-value fraudulent transaction can attract unwanted attention. Using 3-D Secure is a standard requirement to mitigate this risk.

The second common trigger is a compliance breach discovered after approval. If you change your website to introduce health claims, add a new product with questionable ingredients, or start selling products with THC levels above the legal limit, a periodic review by the acquirer’s risk team will flag it. This is considered a material breach of your merchant agreement and can lead to immediate termination and placement on the MATCH list, making it much harder to get another account.

Finally, accounts are terminated because the acquirer or their sponsor bank decides to exit the CBD vertical. This is a portfolio-level decision that has nothing to do with your specific business. It can happen with little warning, which is why relying on a single payment provider is a critical strategic error for any high-risk business.

A successful application for a CBD merchant account is a comprehensive, well-organised file that anticipates and addresses every question an underwriter will have. It goes far beyond just filling out a form. The core of the file is your corporate documentation: certificate of incorporation, articles of association, and a shareholder register. You will need government-issued photo ID and proof of address for all directors and ultimate beneficial owners holding 25% or more.

For the product itself, you must provide a recent (typically less than 12 months old) third-party certificate of analysis for every product you sell. The COA must confirm THC content is within legal limits for all your target sales regions. A full ingredient list for each product is also necessary. Your website must be live and fully functional, with all product descriptions, privacy policies, and terms of service free of prohibited claims. Providing six months of recent processing statements and bank statements demonstrating healthy cash flow and a low chargeback ratio will significantly strengthen your file. A cover letter summarising the business and its compliance posture helps the underwriter navigate the file and presents a professional image.

Relying on a single merchant account is the single greatest operational risk for a CBD business. The only way to survive a sudden termination is to have a second, active processing relationship in place before you need it. Building redundancy means placing your business with at least two different providers, ideally in different regulatory jurisdictions and with different underlying sponsor banks. For example, a UK business might have one account with an EEA-licensed acquirer and another with a UK FCA-authorised payment institution.

This "two-in-market" approach diversifies your risk. If one provider ceases to support CBD or terminates your account for a business reason, you can immediately route all your volume through the backup account and remain operational. While it requires maintaining two separate relationships, the cost is an essential insurance policy against catastrophic revenue loss. Your goal is not just to get approved, but to construct a payment infrastructure that is resilient. When applying, it is best to be transparent with each provider that you are building a multi-acquirer setup; it signals that you are a serious, sophisticated operator.