CBD Is Federally Legal. Your Processor Doesn't Care.

The 2018 Farm Bill legalized hemp-derived CBD with less than 0.3% Delta-9 THC at the federal level. That was over seven years ago. The industry has matured. State regulations have solidified. Consumer demand is massive.

And yet, CBD businesses still can't use Stripe, Square, or PayPal.

The card networks (Visa, Mastercard) have specific rules for CBD processing, including designated MCC codes and compliance requirements. Most mainstream processors either don't have the acquiring bank relationships to support CBD, or they've decided the compliance overhead isn't worth their time. So they put "CBD" on the prohibited list and move on.

That leaves you, the CBD business owner, navigating an opaque market of high-risk processors, confusing rate structures, and account instability.

The Three Tiers of CBD Processing Difficulty

Not all CBD products are created equal in the eyes of acquiring banks. Your product mix determines your processing difficulty and rate.

Tier 1: Topicals, Oils, and Capsules

These are the easiest CBD products to process. They're clearly hemp-derived, non-ingestible (topicals) or considered dietary supplements (oils, capsules), and they carry the lowest risk perception. If this is your product line, you should be getting approved quickly with rates in the 4.5% to 6% range.

Tier 2: Edibles, Beverages, and Pet Products

Ingestible CBD products face additional FDA scrutiny because the agency hasn't officially approved CBD as a food additive. This doesn't make them illegal to sell, but it creates uncertainty that some acquiring banks factor into their underwriting. Rates typically run 5.5% to 7%, and your application needs stronger compliance documentation around product labeling and health claims.

Tier 3: Vapes, Delta-8, THC-A, and HHC

This is where it gets complicated. CBD vapes face additional scrutiny after the PACT Act. Delta-8, THC-A, and HHC exist in a legal grey zone where the Farm Bill's THC limit technically applies but enforcement and interpretation vary by state. Fewer acquiring banks will work with these products, rates are higher (7% to 10%), and your compliance narrative needs to be airtight.

The MCC code trap: Visa and Mastercard have specific MCC codes for CBD and hemp products. If your processor sets up your account with the wrong MCC code, your account will eventually get flagged and terminated during a network audit. Proper MCC classification from day one isn't optional. It's the foundation of a stable account.

What Your CBD Application Needs

The application that gets approved fast looks different from the one that sits in underwriting for three weeks.

Supply Chain Documentation

Acquiring banks want to see that your products are genuinely hemp-derived and Farm Bill compliant. That means documentation of your supply chain from seed to shelf: where your hemp is grown, who processes it, and how you verify THC content at each stage. If you source from multiple suppliers, each one needs documentation.

Lab Testing and COAs

Third-party certificates of analysis showing cannabinoid profiles, Delta-9 THC content below 0.3%, heavy metals, pesticides, and residual solvents. Every product in your catalog needs a current COA. Banks check these. If your COAs are expired or from an uncredited lab, your application stalls.

Marketing Compliance

The FDA hasn't approved CBD for most health conditions. Claims like "cures anxiety" or "treats chronic pain" on your website will get your application rejected. Your site needs to be reviewed for compliant language before submission. Testimonials and before-and-after content are especially scrutinized.

State Licensing

Each state has its own hemp licensing requirements. Some require a hemp handler's license, others a general business license, others specific hemp registrations. Your application should include documentation of your compliance in every state you sell to.

The Vape and Ingestibles Complication

If you sell CBD vapes or ingestible products, your application needs a stronger compliance story. The PACT Act imposes shipping and age verification requirements on vape products that card networks take seriously. Your application should document your age-gating systems, shipping carrier compliance, and state-by-state restrictions for these product categories.

This isn't a reason to avoid these products. The margins on vapes and edibles are often the best in the catalog. But the processing infrastructure needs to match the compliance requirements, and that takes a processor who understands the category.