Which processor will approve my CBD or vape online store?

If processors keep turning down your online CBD or vape store, the cause is rarely one company's taste. It comes from Visa's own rules, the federal PACT Act and a hemp law that changes on Dec. 11, 2026.

Why won't a regular processor take my online vape store?

Its bank may not be approved by Visa for your kind of store. Visa's October 2026 merchant data manual puts stores that sell e-cigarettes under MCC 5993, "Cigar Stores and Stands."

Card-absent sales under 5993 are on Visa's high-integrity risk list. Online, phone and mail orders are all card-absent. The same list covers adult content, gambling and online pharmacies.

Before it processes a single sale for a store like yours, the bank behind your processor must do three things:

• Apply to Visa for high-integrity risk acquiring and be approved
• Pass a financial review and meet Visa's capital standards
• Register your store with Visa

A processor whose bank isn't approved can't board you under Visa's rules, even if a sales rep says yes.

Why can an approved vape store still lose its account?

Being boarded under the wrong code puts the bank at risk with Visa. If a bank skips registration, Visa can charge it $2,000 per unregistered store per month. Visa can also bar that bank from high-integrity risk stores altogether.

That gives a bank every reason to close an online vape store it finds under a general retail code. Mixing in other products doesn't change the code either. Visa's manual says a merchant with several lines of business must put the high-integrity risk line under its own code.

Expect close watching even when everything is set up right. For these stores, Visa requires the bank to learn your normal daily pattern from your first month of sales. Daily monitoring starts on the 31st day after your first deposit. Each day's sales, average ticket and disputes get compared against that pattern.

Is a CBD store treated the same as a vape store?

No. Visa's high-integrity risk list has no code for CBD or hemp. For a CBD store, the questions are what you sell and where you ship it.

Visa's core rules say every transaction must be legal where the cardholder is and where the store is. For an online store, that means every state you ship to. FDA adds its own limits:

• FDA says CBD products can't be sold as dietary supplements.
• FDA says adding CBD or THC to food sold across state lines is prohibited.
• FDA treats a CBD product marketed to treat a disease as an unapproved drug, which can't be sold across state lines.

What changes for hemp products on Nov. 12 and Dec. 11, 2026?

Federal law narrows what counts as "hemp" in two steps. A 2025 funding law (Public Law 119-37) rewrote the definition, effective 365 days after its Nov. 12, 2025 signing. A funding law signed Sept. 2, 2026 pushed most of it back to Dec. 11.

The law defines "container" as the innermost package touching the product, such as a jar, bottle, can or cartridge. Shipping boxes don't count.

Congress can still move these dates. Check the current law before you plan inventory around them.

Example (hypothetical): An online store sells a 30-count jar of full-spectrum gummies with 2 mg of THC in each one. That's 60 mg of THC in the container, 150 times the 0.4 mg cap. From Dec. 11, that jar is no longer hemp under federal law.

Say those gummies bring in $18,000 of a $50,000 month. After Dec. 11, those sales stop being legal hemp sales, so no card sale of them should go through. Plan for $32,000 a month until you reformulate or drop the line. A plant-derived CBD tincture whose lab report shows no detectable THC still fits the new definition.

What does the PACT Act require for online vape sales?

Since 2021, the PACT Act treats e-cigarettes and other vaping devices as "cigarettes" for delivery sales. An online vape store is a delivery seller, so these rules apply:

The Postal Service can't carry these products to consumers, because federal law makes them nonmailable. The PACT Act also leaves state bans on delivery sales in place, so some states may be off-limits entirely.

FDA sets 21 as the minimum age for every tobacco product, e-cigarettes included.

What should I have ready before I apply?

Each item below answers one of the rules above. Have them ready before the first call:

• Lab reports for every hemp product, showing total THC per container
• Your PACT Act registrations and the list of states you ship to
• How your checkout verifies age, and how your carrier collects adult signatures
• Product pages with no claims that CBD treats a disease
• The MCC the bank plans to use for each product line

Ask about subscriptions too. Visa's high-integrity list also includes card-absent "negative option" subscription merchants under MCC 5968. If your store runs on auto-ship plans, ask how the bank will code them. Returns matter as well; see what refunds cost an online store in card fees.

How fast will I get paid on a high-risk account?

Get the funding schedule in writing before you sign, because it's part of the approval. Our guide to merchant funding times explains how deposits move once a batch closes.

When BP Global Merchant Services fits

BP Global is a Dallas-based, independent merchant services provider that works with online stores across the U.S. For CBD, vape and tobacco sellers, we work with a high-risk processing partner that takes all three. You can see how we price and support accounts on our services page. If you already take cards, start with the Free Statement Review, which shows in writing what you pay now and what you'd pay.