CBD Payment Compliance: FDA, State and Card Network Rules

Hemp being legal doesn't make every CBD product legal to sell. The FDA regulates what goes into food and how products are marketed. Its CBD page (content current as of July 16, 2024) makes three points that matter to your processor.

1. CBD isn't a dietary supplement. In the FDA's words: "THC and CBD products are excluded from the dietary supplement definition under section 201(ff)(3)(B) of the FD&C Act."
2. CBD can't be added to food sold across state lines. "It is a prohibited act under section 301(ll) of the FD&C Act to introduce or deliver for introduction into interstate commerce any food (including any animal food or feed) to which THC or CBD has been added." That covers gummies, drinks and pet treats. It's a big reason many banks exclude CBD edibles, and why Stripe prohibits "CBD edibles" (restricted businesses list, updated September 22, 2026).
3. Disease claims draw warning letters. The FDA "has sent warning letters in the past to companies illegally selling CBD products that claimed to prevent, diagnose, treat, or cure serious diseases, such as cancer." The only FDA-approved CBD drug is Epidiolex, a prescription seizure medicine.

What underwriters flag, and what to say instead

Health claims are the most common problem underwriters find on CBD websites, and the easiest to fix. They read product pages, blog posts, reviews you've featured and social links. Claims that a product treats, cures or prevents a condition, or replaces a medicine, are a red flag wherever they appear.

One trap: the familiar "These statements have not been evaluated by the FDA" line comes from dietary supplement rules. Since the FDA says CBD isn't a supplement, that line doesn't make a disease claim acceptable.

A COA (certificate of analysis) is a lab report showing what's in a batch: how much CBD, how much THC, and whether it passed tests for things like pesticides and solvents. Underwriters compare your COAs with your labels and your product pages. If the label says 1,000 mg and the COA says 700 mg, or the THC result is missing, expect questions.

Keep a current COA from an independent lab for every product and batch, and link it from the product page. Our CBD merchant account requirements guide lists exactly what a COA should show and the other documents to have ready.

Hemp is legal under federal law only while it meets the federal definition of hemp. As of September 2026, that definition is changing in two steps, both enacted but not yet in effect:

• November 12, 2026: cannabinoids the plant can't naturally produce, such as THC-O, fall outside "hemp".
• December 11, 2026: cannabinoids converted outside the plant, such as delta-8 made from CBD, fall outside "hemp", hemp is measured by total THC, including THCA, and final products are capped at 0.4 mg total THC per container.

For payments, this matters because a product that stops being hemp becomes a controlled substance, and card-network rules on illegal sales then apply (see card network rules below). Full-spectrum products and larger bottles are the ones to check first. The dates, the product-by-product effect and a pre-deadline checklist are in our guide to the 2026 hemp law change.

Federal law sets the floor. States can be stricter, and they change their rules often. Because card networks require each sale to be legal where your buyer is, a product that's fine in your home state can still be a problem when you ship it somewhere else.

Three examples, checked at state sources in September 2026:

• Texas: the Department of State Health Services (DSHS) bars licensed and registered sellers from selling consumable hemp products to anyone under 21, and requires a valid government ID before purchase. The rule was first adopted as an emergency rule on October 2, 2025. Stores selling consumable hemp in Texas need a DSHS license or retail registration for each location.
• California: since January 1, 2026, under AB 8, hemp flower, pre-rolls and inhalable products containing hemp-derived THC can't be sold, offered or provided in the state (California Department of Public Health).
• Idaho: CBD products sold in the state must contain zero percent THC, according to the Idaho Office of Drug Policy. A full-spectrum product that's legal federally can still be illegal to ship there.

We don't publish a 50-state table on purpose. It would be out of date within months, and your attorney is the right source for a state-by-state legal opinion.

Visa and Mastercard don't publish a CBD rulebook. What they do have are general rules that decide whether a CBD sale can go through their networks.

• Legal on both ends. Visa's Core Rules (edition of April 18, 2026) say: "A Transaction must be legal in both the Cardholder's jurisdiction and the Merchant Outlet's jurisdiction." That's why the state you ship to matters as much as the state you're in.
• Illegal sales carry penalties. Once a product falls outside the hemp definition, it's treated as a controlled substance. Mastercard's rules on illegal or brand-damaging transactions (Rule 5.11.7) then apply, enforced through its Business Risk Assessment and Mitigation (BRAM) program. Penalties land on the acquiring bank, which is why banks watch CBD product lists closely.
• Disputes are monitored. Under Visa's VAMP program, a US merchant is "excessive" from April 1, 2026 when fraud reports plus disputes reach 1.5% of settled card-not-present transactions, with a minimum of 1,500 fraud reports plus disputes a month. See CBD chargebacks for prevention, and chargeback ratio limits for how each network measures them.

Is there a CBD MCC code?

No. An MCC (merchant category code) is a four-digit code that tells the card networks what kind of business you are. Visa's rules say the acquirer, the bank that sponsors your account, "must assign to a Merchant Outlet the MCC that most accurately describes its business." There's no MCC just for CBD. Depending on the acquirer and what you sell, CBD sellers are commonly coded 5499 (specialty food stores), 5912 (drug stores), 5993 (tobacco stores) or 5999 (miscellaneous retail).

You don't pick your MCC, but you do control the description the acquirer uses to choose it. Describe your products fully and honestly. A vague description ("wellness products") can lead to the wrong code, and a mismatch between your code and what you actually sell is a common reason accounts get reviewed later.

You may see claims online that Visa lists CBD as a "Tier 1" high-risk category under a single MCC. We couldn't find that in Visa's published rules, so don't plan around it.

Yes, with conditions. USPS Publication 52 (August 2026 edition), section 453.37, allows hemp and hemp-based products, including CBD, to be mailed within the US only when the mailer:

• complies with all applicable federal, state and local laws, including USDA-approved hemp plans; and
• keeps records that prove it, "including laboratory test results, licenses, or compliance reports, for no less than 3 years after the date of mailing."

Two limits catch sellers out:

• No international mail. Hemp and CBD shipments are prohibited in international mail, including APO, FPO and DPO military and diplomatic addresses.
• No CBD vapes. Publication 52 treats vape pens, cartridges and e-liquids as ENDS (electronic nicotine delivery systems) whether or not they contain nicotine, and ENDS are generally nonmailable. That includes CBD vape products.

Section 453.37 defines hemp by the federal definition "or any successor provision," so its meaning follows the December 11, 2026 change. USPS may also update the section's wording. Check it again before that date. Private carriers such as UPS and FedEx set their own rules; check your carrier agreement.

PCI DSS is the card industry's security standard for any business that accepts cards. It isn't CBD-specific, but CBD accounts get closer scrutiny, so gaps show up sooner. The basics:

• Never store full card numbers or security codes in your own systems or spreadsheets.
• Use a hosted or tokenized checkout from your payment gateway, so card data never touches your server.
• Complete your annual self-assessment questionnaire and any required scans.
• Keep your cart, plugins and passwords up to date.

Our PCI compliance guide explains which questionnaire fits your setup.

Processors don't only check at approval. Many review websites and product lists again later. If they find a product that's no longer hemp, a new health claim or shipments to a state that bans a product, the usual result is a reserve (money held back from your payouts), a request to remove products, or a closed account. Our guide to a CBD account shutdown covers what to do if that happens.

The simplest protection is to treat compliance as part of running the store, not a one-time task: tell your processor before you add new product types, re-test when formulas change, and review your site after every marketing push. If you're still choosing a provider, start with our CBD merchant account overview.