CBD Merchant Account Compliance: The Rules That Keep You Approved
By Rey Pasinli, Payments Engineer · 8 min read · LinkedIn
The short version
A CBD merchant account survives on compliance. You need lab COAs proving under 0.3% THC, GMP-compliant manufacturing, an FDA disclaimer that the product is not FDA-evaluated, marketing free of medical claims and prohibited imagery (cannabis leaves, 420, celebrity or fake-news endorsements), and age verification where required. Get these right and you clear both the underwriting bar and the ongoing monitoring that keeps the account open.
What compliance does a CBD merchant account require?
More than a normal supplement, because CBD sits under the FDA's cannabis-product framework. At a minimum, underwriters want lab-verified THC testing, evidence of compliant manufacturing, an FDA disclaimer on the site, marketing that avoids medical claims, and no prohibited imagery. Miss these and you either get declined up front or shut down later during monitoring.
What is a COA and why do I need one?
A Certificate of Analysis is a lab report proving your product contains under 0.3% THC, the legal line for hemp-derived CBD. It is issued by an independent laboratory that tests the concentrate before it goes into your products. Underwriters treat the COA as non-negotiable proof that the product is what you say it is. Keep current COAs on file for every product line; expired or missing COAs are a common reason accounts get flagged.
What marketing rules keep a CBD account open?
The line is claims and imagery. Do not claim the product cures, treats, or prevents any disease, and do not name specific illnesses; the FTC requires real scientific substantiation for health claims (Health Products Compliance Guidance). Add the standard disclaimer that statements have not been evaluated by the FDA. And keep the visuals clean: no cannabis leaves, marijuana, "Rasta" or "420" references, no celebrity endorsements without a signed agreement, and no fake news logos or manufactured urgency. The FDA's CBD regulation overview is the backdrop for all of it.
| Allowed | Prohibited |
|---|---|
| General wellness language | Disease cure or treatment claims |
| "Not evaluated by the FDA" disclaimer | Naming specific illnesses |
| Product and ingredient facts | Fake testimonials or fake news logos |
| Real, substantiated benefits | Cannabis / 420 / Rasta imagery |
Do I need age verification or signature delivery?
Often, yes. Age-restricted products can require age verification at delivery, and signature-on-delivery both keeps you compliant and helps win the "I never received it" chargebacks. Building these into fulfillment is part of keeping the account healthy, which we tune as part of ongoing strategy.
What happens if my CBD site drifts out of compliance?
High-risk accounts are monitored, so a site that adds a disease claim or swaps in prohibited imagery overnight can get flagged and frozen. That is why compliance is ongoing, not a one-time approval hurdle. If your account has already been frozen or terminated, the recovery playbook covers the way back.
Frequently asked questions
Is CBD legal to sell and process in the US?
What THC level does my CBD product need to be under?
Can I say my CBD product helps with anxiety or pain?
What imagery gets a CBD account in trouble?
Rey Pasinli — Payments Engineer, Total-Apps
27 years in payments and more than 85,000 merchants placed across roughly 250 banks, processors, and PayFacs. A former mechanical engineer on the International Space Station program, Rey has authored a 100-page compliance guideline covering CBD and peptide processing and certified four separate PayFac licenses.
For educational purposes only. This article is general information, not legal, financial, tax, or compliance advice. Card-network rules, reserve practices, and regulations change and vary by acquirer, so consult a qualified professional about your specific situation.
Frozen, terminated, or just trying to get placed the right way?