High Risk Merchant Handbook

CBD Merchant Accounts: What to Expect

CBD is a restricted business at Stripe. Here is what Stripe and the card networks say about it.

A CBD merchant account lets your shop take card payments. Stripe puts CBD on its restricted list. This page explains why, in the words of the processors and card networks themselves.

What a CBD merchant account is

A merchant account is the agreement that moves money from a customer's card to your bank. A CBD merchant account is the same thing, sold to a business whose products come from hemp or cannabis plants.

Stripe puts CBD in a group it calls restricted businesses.

Why CBD is a restricted business category

Stripe's own page says restricted businesses are industries and products that need extra checks. It says Stripe runs extra checks on them first. Stripe must confirm it can support them.

In plain terms, Stripe checks you more before it says yes. And it may still say no. Stripe's policy says businesses in restricted categories might not get approval to use its products.

Mastercard also has a rule about some cannabis merchants.

What Stripe's own policy says about CBD

Stripe names CBD directly in its restricted businesses list. Its policy also restricts CBD products with only tiny amounts of THC, based on local limits. It also bans CBD products with more THC than the local law allows.

So the THC content of your products, measured against the limit where you sell, decides how Stripe treats you. That limit is set by law, not by the processor. Is your product legal where you sell it? Ask a lawyer and your processor.

Two more things in Stripe's policy matter to every CBD seller. First, Stripe says its list of restricted businesses is representative but not exhaustive. Its prohibited list works the same way. Being missing from the list is not a promise. Second, Stripe's policy says you must not use its services for illegal activities or for the businesses listed on its page.

What the card networks say

The card networks, Visa and Mastercard, write rules your processor must follow. Those rules reach your account.

Mastercard's manual talks about recreational cannabis by name. It says these merchants in the Canada Region must register, no matter what MCC they use. Its manual says the acquirer must register the merchant with Mastercard first. Only then can it take those sales.

That is Mastercard's rule, for Mastercard merchants, in one region.

MCC codes and why they matter for CBD

MCC stands for Merchant Category Code, according to Visa's standards. Visa's manual says the Merchant Category Code is a four-digit number describing a Merchant's primary business based on annual sales volume in local currency.

Your MCC tells the banks behind every card what kind of business you are. Visa's manual says merchants must use a miscellaneous MCC only when no other MCC applies to their business. It says MCC 5999 is for shops with special products that fit no other code.

The MCC you are given must match what you actually sell. Both networks speak to mismatches. Visa's standards say acquirers must review a merchant's business activity when issuer documents show it does not match the assigned MCC. Visa's manual also says acquirers watch for names and MCCs that do not match. Mastercard recommends that acquirers monitor mismatches of merchant name, MCC, merchant ID, and terminal ID. Mastercard's manual says acquirers should check for products unrelated to the merchant's business or MCC when screening e-commerce merchants.

This is why honesty about your MCC matters.

Applying honestly: what to disclose

Do not dress the business up as something else on the application. Stripe's page prohibits using Stripe products with false, manipulated, inaccurate, or misleading information about your identity or business.

Stripe also checks that three things match. Your business address, the place where you registered, and an owner's address must all match.

Stripe's page says you must notify Stripe immediately if your personal or business information changes. Keep the processor current as your business grows or shifts.

Do not split your sales across accounts to hide what you sell. Do not let anyone code your shop under the wrong category. Both hide the real business.

After approval: what the policy allows

Approval, if it comes, is not forever. Stripe's policy says any approval it gives is specific to each service offer and can be modified or revoked at any time.

That is Stripe's own wording, for Stripe accounts.

Your processor has a bank of its own, and that bank watches it. Read why banks watch payment processors to see what the bank looks for and how your numbers reach it.

If you sell CBD by phone, billing consent has its own rules. See billing authorization on phone sales for what those rules require.

Sources