The short answer
To get approved, show the bank who you are (formation documents, EIN, owner ID, bank statements), what you sell (a full product list with a current third-party COA for every product) and how you sell it (a finished website with no health claims, clear policies and shipping blocks for states you can't sell into). Disclose everything, including past account closures. From December 11, 2026 (pending), your COAs should show total THC, including THCA, and milligrams per container. Most declines come from fixable gaps: a health claim, a missing COA or one product that doesn't belong on the list.
Why Is CBD High Risk for Banks?
The bank behind a CBD merchant account is responsible for every sale it processes. With CBD, three things make that harder to judge than it is for most shops:
- The law is changing. Today, hemp-derived CBD is legal federally if the product meets the federal definition of hemp at the time of sale. That definition changes in two steps on November 12 and December 11, 2026. A product that qualifies today may not qualify in December, and the bank carries the risk if it keeps processing it.
- Health claims. The FDA says CBD is excluded from the dietary supplement definition and can't be added to food sold across state lines. It sends warning letters to sellers that claim CBD treats or cures disease. Banks don't want to process for a site the FDA could target.
- Disputes. Most CBD sales are online, and many are subscriptions. Both bring more chargebacks (a customer disputing a charge through their card issuer) than in-person sales do.
For the general factors every underwriter weighs, see what makes a business high risk.
Documents for a CBD Merchant Account: The Checklist
Exact lists vary by bank, but expect to send most of these. A complete file on day one is the biggest thing you control.
| Document | What the underwriter checks |
|---|---|
| Formation documents and EIN | The legal business name matches the tax ID, bank account and website |
| Photo ID for each owner | Who owns the business and who is responsible for it |
| Voided check or bank letter | Deposits go to an account in the business's name |
| Recent business bank statements | Cash flow, and whether you can cover refunds and disputes |
| 3–6 months of processing statements, if you've taken cards | Real volume, average sale, refunds and chargebacks |
| Full product list with SKUs | Every product you'll sell, so the bank approves exactly that |
| Supplier or manufacturer details | Where the hemp and finished products come from |
| A current third-party COA per product or batch | That each product meets the federal definition of hemp (details below) |
Our guide to the standard approval document checklist explains the general items. What's specific to CBD is the lab paperwork.
The COA for Your Merchant Account: What It Must Show
A COA (certificate of analysis) is a lab report that shows what's in a product. For a CBD application, it's the proof that each product is legal hemp. Underwriters commonly look for:
- An independent, accredited lab. Not your manufacturer's in-house test. Many underwriters ask for ISO/IEC 17025 accreditation, the international standard for testing labs.
- A batch or lot number that matches the product you're selling.
- A full cannabinoid profile, not just a CBD number. It should show every THC form the lab tested.
- A recent test date. Many underwriters want COAs from the last 12 months or so. That's common practice, not a written rule, and each bank sets its own.
What changes on December 11, 2026 (pending)
Today the federal test counts only delta-9 THC. Under P.L. 119-37, as delayed by P.L. 119-103 (signed September 2, 2026), hemp will be measured by total THC, including THCA, and final products can contain no more than 0.4 mg of total THC per container. A COA that reports only delta-9 THC by percentage won't show either number. Ask your lab to report total THC and mg per container, and plan to replace older COAs. Our guide to the 2026 hemp law change covers the dates, the pending delay bills and which products are affected.
The Website Review: What CBD Underwriters Look For
Underwriters open your website before they approve you, and they may check it again later. Fix these before you apply:
- No disease or treatment claims. Remove words like "treats", "cures" or "prevents", and any named condition, from product pages, blog posts and featured reviews. This is the most common fixable reason for a decline.
- COAs linked from each product page, or a QR code on the label that opens the right batch.
- Refund, shipping, privacy and terms pages that are easy to find and match what happens at checkout.
- An age gate where a state requires one. There's no federal minimum age for CBD, but some states set one for consumable hemp products.
- Shipping blocks for states you can't sell into. State hemp rules differ, so your cart should stop orders to states where a product isn't allowed.
- Clear subscription terms, if you offer auto-ship: the price, how often you bill, and how to cancel, shown before the customer pays.
Our CBD payment compliance guide covers FDA rules, state examples and shipping in more detail.
Your Product List: Why One SKU Can Sink an Application
The bank approves your business, not each product. If your site sells one product the bank can't process, the underwriter may decline the whole application, not just that item.
Delta-8 THC is the common example. Most delta-8 on the market is made by converting CBD. Under the new federal definition, cannabinoids the plant can't produce naturally, such as THC-O, fall outside "hemp" from November 12, 2026, and cannabinoids converted outside the plant, such as delta-8 made from CBD, fall outside it from December 11, 2026 (both pending). One delta-8 gummy next to your CBD oils tells the underwriter your list includes products that may soon be outside the law.
Other products that get extra questions:
- Edibles and drinks. The FDA says adding CBD to food sold across state lines is a prohibited act. Stripe, for example, prohibits "CBD edibles" (restricted businesses list, updated September 22, 2026). Banks set their own lines.
- Full-spectrum products. Trace THC can push a larger bottle over 0.4 mg per container once the December 11 rule applies.
- Hemp flower and vapes. THCA will count toward total THC, and CBD vapes carry shipping limits of their own.
List every product on the application, and take anything off your site that you haven't listed. See what we accept for how we review product lists.
New CBD Business? Getting a Merchant Account Without History
A new CBD business can apply. Without processing statements, the underwriter leans harder on everything else. Help your file with:
- A finished website. Live products, prices, policies and COAs. A "coming soon" page usually stalls the file.
- A realistic volume estimate of monthly sales and average order size.
- Your background in retail or the industry, and who your suppliers are.
- A business bank account in the company's name, with some history if you have it.
Home-based sellers are reviewed the same way. What matters is that your business is registered, your address is real and consistent across documents, and your site shows how customers reach you. A new account often starts with a monthly volume limit or a reserve (money held back to cover future disputes) until you build a record. Our guide to CBD rates, fees and reserves explains what those terms usually look like.
Shut Down Before? Disclose It
Many CBD sellers are applying because a payment app closed them. Square told sellers in August 2026 that CBD and hemp products will no longer be permitted, with catalog removal by October 15. That kind of closure is a policy change, not a mark against you, but you still need to say so.
- Say who closed you and why, and include the closure email.
- Send your processing statements from that account. Low chargebacks help your case.
- Check whether you were reported to Mastercard's MATCH database or Visa's list of terminated merchants. Being listed doesn't always rule you out, but hiding it usually does. Our guide to the MATCH list explains how to check.
If you're mid-switch, our guide on what to do after a CBD account shutdown covers held funds and moving without a gap.
CBD Merchant Account Setup: The Approval Process, Step by Step
- Apply. Send the application, the document checklist, your product list and your COAs together.
- Underwriting review. The bank checks identity and credit, your website and COAs, and the card networks' terminated-merchant lists. Quick, complete answers to follow-up questions keep the file moving.
- Approval and terms. You get your pricing and any conditions, such as a reserve or a monthly volume limit. Read them before you sign.
- Gateway setup. Your payment gateway (the software that sends card payments from your website to the bank) is connected to your cart, and you run a test sale. Authorize.Net, for example, connects to more than 1,000 shopping carts. Ask which gateway your approved account supports.
How long it takes depends mostly on how complete your file is and how many follow-up questions the underwriter has. Missing COAs and website fixes are the usual delays.
Common CBD Decline Reasons and How to Fix Them
| Decline reason | The fix |
|---|---|
| Health or disease claims on the site | Remove them everywhere, including blog posts, reviews and product names, then reapply |
| Missing, old or in-house COAs | Get a current third-party COA per batch and link it from each product page |
| A product the bank can't take (delta-8, THCA flower) | Remove it from the site and the application, or keep it off the account entirely |
| Products on the site that aren't on the application | Make the product list and the site match exactly |
| Missing or hidden policies | Add refund, shipping, privacy and terms pages, linked in the footer and at checkout |
| Undisclosed past closure or MATCH listing | Disclose it with the closure notice and your statements |
| Name or address mismatch | Use the same legal name and address on the EIN, bank account, application and site |
| Unclear subscription or "free trial" offer | Show the price, billing schedule and cancellation steps before payment |
Disputes are the next test after approval. Our guide to CBD chargebacks covers how to keep them low.
This article is general payments guidance, not legal advice. Federal and state hemp laws and platform policies are described as of September 2026 and change often. The November 12 and December 11, 2026 changes are enacted but not yet in effect, and bills to delay or change them are pending. Check with your attorney and your lab about your specific products.
Frequently Asked Questions
What documents do I need for a CBD merchant account?
Expect to send formation documents and your EIN, photo ID for each owner, a voided check or bank letter, recent bank statements, 3–6 months of processing statements if you've taken cards, a full product list, supplier details and a current third-party COA for each product or batch.
Do I need a COA for every product?
Yes, in practice. Underwriters want to see that each product you sell is legal hemp, and the COA is the proof. It should come from an independent lab and match the batch number of the product you're selling.
How old can a COA be?
There's no single rule. Many underwriters want COAs from roughly the last 12 months, and each bank sets its own limit. A COA should also match the batch you're selling now. From December 11, 2026 (pending), COAs that don't show total THC and mg per container will likely need replacing.
Can a new CBD business get approved?
New businesses can apply. Without processing history, underwriters rely more on a finished website, clean COAs, a realistic volume estimate and your background. New accounts often start with a volume limit or reserve that can be reviewed once you build a record.
How long does approval take?
It depends mostly on how complete your file is. Sending every document, COA and product detail at the start, with a finished website, avoids the follow-up questions that slow most CBD applications down.
Ready to apply?
Tell us what you sell and how you sell it, and we'll tell you what your application needs before you apply. START has been in payments for 20+ years and has set up more than 60,000 Authorize.Net accounts.
New to this topic? Start with our CBD Merchant Accounts overview.
