Vape Payment Compliance: What Your Processor Checks in 2026

Every merchant account carries a merchant category code (MCC): a four-digit number that tells the card networks what kind of business you run. Vape and tobacco sellers use MCC 5993, "Cigar Stores and Stands".

Why it matters:

• It's required for online sales. Mastercard's rules say acquirers "must identify all non-face-to-face tobacco product Transactions using MCC 5993… and TCC T" (a transaction category code for card-not-present sales). Mastercard's definition of tobacco includes "electronic nicotine delivery systems [such as electronic cigarettes]".
• It triggers registration. Online sales under MCC 5993 need network registration (next section).
• A wrong code is a real problem. Processing vape sales under a generic retail code hides them from the networks. When it's found, it's a common reason accounts are closed without warning.

You don't pick the code; your processor does. The question to ask is simple: "Will you set me up under MCC 5993 and register me for online sales?"

Both card networks treat card-not-present tobacco sales, including vapes, as a category that must be registered before the first transaction. The bank that holds your merchant account (the acquirer) does the registering. You supply the information.

What this means for you:

• Not every processor can take you. The bank needs the right network approvals in place first. That's one reason mainstream payment apps limit or refuse online vape sales.
• Expect questions about legality. Because the bank has to vouch that your business is legal, and recheck it every year, it will ask what you sell and where you ship.
• In-store sales are different. These registration rules apply to card-not-present sales. A shop that only sells in person still uses MCC 5993 but isn't registered for online sales. As section 6 shows, though, product legality now matters in store too.

The approval side of this, including the documents underwriters ask for, is in vape merchant account requirements.

Under federal law, a new tobacco product needs an FDA marketing order before it can be legally sold. For vapes, that means a granted premarket tobacco product application (PMTA).

That list covers only a small share of the vapes on the market. Many other products fall into one of two groups:

• PMTA pending: the manufacturer has applied, and FDA hasn't decided yet.
• Unauthorized: never applied, refused, or denied. This includes many disposables.

The May 2026 enforcement guidance

In May 2026 FDA published Enforcement Priorities for Certain New Tobacco Products Marketed Without Premarket Authorization. In short, FDA says it generally won't prioritize enforcement against an unauthorized vape if:

• its application has been accepted and filed and is still pending, and
• for flavors other than tobacco, FDA has found the application includes the data needed to evaluate it.

The guidance also carves out exceptions. FDA still prioritizes products with youth-appealing features (cartoon-like characters, products disguised as something else, or products that look like toys, phones or gaming devices) and products with added safety concerns, such as high nicotine content, no child-resistant packaging or fire risk. FDA says it will publish a list of the products this covers.

What the guidance does not do matters just as much. In FDA's words, "all new tobacco products on the market without authorization are illegally marketed products", and being covered by the policy "in no way has a bearing" on whether a product will be authorized. Enforcement discretion is not authorization. As of September 2026 the guidance has also been challenged in federal court.

Why payment companies use "FDA-authorized" as the test

It's the one clear line. Stripe's restricted-business list (updated 22 September 2026) says that "in the United States, merchants selling electronic tobacco may only sell products authorized by the Food and Drug Administration". Mastercard's July 2026 warnings to retailers and the 2026 attorney general letters (section 6) point to the same list. Expect any processor to ask for your product list and compare it with FDA's.

At START, we work with businesses selling FDA-authorized nicotine vape products. As of September 2026, that's the 48 products on the FDA's list. For now, we don't process products that are awaiting FDA review, including those covered by the May 2026 guidance, or unauthorized products.

If you're not sure where your menu stands, send us your product list before you apply and we'll tell you up front what fits.

A state vape directory (also called a registry) is a list of the vape products a state allows to be sold. Manufacturers certify their products, often by showing FDA authorization or a pending application. Anything not on the list can't be sold in that state. In 2026 these laws became the biggest state-level issue for vape sellers.

Status as of 25 September 2026:

Flavor restrictions are the other state-level rule that shapes what you can sell, and ship, into a state. As of September 2026:

• Statewide bans on flavored vapes: California, Massachusetts, New Jersey, New York, Rhode Island and Utah. Massachusetts and New Jersey include menthol. Utah allows only tobacco and menthol flavors. California also enforces an Unflavored Tobacco List from 1 January 2026.
• Partial ban: Maryland restricts flavored cartridge-based and disposable products (tobacco and menthol excepted).
• Local bans: hundreds of cities and counties have their own flavor rules, so a product that's legal statewide can still be banned in one city.

For payments, the point is the same as with directories: a processor that has to confirm your business is legal will look at whether your product list and shipping rules match these laws.

This year, pressure moved from sellers to the payment system itself:

1. April 2026, Iowa-led letter. Thirteen state attorneys general, led by Iowa, asked Visa, Mastercard, American Express and Discover to stop processing illegal vape sales, identify and remove merchants selling them, and report what they've done.
2. 28 April 2026, New York-led letters. New York's attorney general, 24 other attorneys general and New York City wrote to American Express, Capital One, Citi, Mastercard, Visa, PayPal, Stripe, Sezzle and Block (Square, Cash App, Afterpay). They asked them to prevent their services from being used for illegal e-cigarette transactions. The model they cite is a 2005 effort with card companies on online cigarette sales.
3. July 2026, fine warnings to retailers. Mastercard and Global Payments warned retailers, including convenience-store chains, to remove vape products that aren't on FDA's authorized list or face fines. In late July, Mastercard said it would "temporarily pause any assessments to provide customers additional time to execute their remediation plans and ensure compliance". It also said retailers may keep accepting Mastercard for lawful vape purchases.

The letters aren't laws, and the fines are paused, not dropped. But the direction is clear, and it reached in-store retailers as well as online ones. For a vape business, a clean product list is now part of keeping your merchant account. If you've already been shut down, see what to do when your vape merchant account is shut down.

What to have ready for your processor

• ✓A SKU list with each product's FDA status
• ✓The states you sell or ship to, and their directory listings
• ✓Checkout rules that block flavor-ban and no-ship states
• ✓Your state tobacco or retail license
• ✓For online sales: age verification and delivery setup
• ✓A plan to tell your processor before adding products

PCI DSS (the card industry's data security standard) applies to every business that takes cards. For most vape shops it means an annual self-assessment questionnaire, regular security scans if you sell online, secure terminals, and never storing full card numbers. Many processors charge a monthly non-compliance fee until the questionnaire is done. See our PCI compliance guide.

Chargebacks are the other number the networks watch. Since 1 April 2026, Visa treats a U.S. merchant as excessive at 1.5% (fraud reports plus disputes, divided by settled card-not-present transactions, with at least 1,500 a month). Age and delivery disputes can push vape sellers toward that line. Here's how vape sellers prevent and win chargebacks.