CBD, vape, and smoke shops are real, legal, growing businesses — and a lot of them still get turned away or dropped by a payment processor with little explanation. That rejection has almost nothing to do with whether what you sell is actually illegal. It has to do with how banks classify risk, and CBD and vape both land in a genuine legal gray zone that makes most processors say no by default, even to a fully compliant business. This page covers why that happens, what the real compliance landscape actually looks like, and what it takes to get approved with a processor that actually says yes.
Why “legal” doesn’t automatically mean “easy to get approved”
Take CBD specifically: the 2018 Farm Bill removed hemp — cannabis with no more than 0.3% THC — from the federal controlled substances list. That’s real, and it’s often where the “CBD is legal” claim stops. But according to the FDA’s own current guidance, that bill explicitly preserved the FDA’s authority to regulate CBD products separately — and the FDA still doesn’t allow CBD to be sold as a dietary supplement or added to food in interstate commerce, with only narrow exceptions. That gap — federally decriminalized on one hand, still restricted by a separate federal agency on the other — is exactly the kind of ambiguity that makes a bank’s risk department default to “no” rather than sort out the nuance themselves.
What actually makes a business “high-risk” to a payment processor
“High-risk” isn’t a judgment about whether a business is doing anything wrong. It’s a specific underwriting category, and CBD and vape both land in it for real, practical reasons:
- Regulatory complexity that varies by state. Rules on what can be sold, how, and to whom shift from state to state and change over time — a processor has to stay current on all of it, not just federal law.
- Age-restricted products with real compliance stakes. A sale to a minor isn’t just a business risk — it can trigger real regulatory penalties, which raises the bar for how carefully a processor has to underwrite the account.
- Card network sensitivity. Visa and Mastercard maintain their own restricted and high-risk category lists, separate from what’s federally or state legal — a processor has to satisfy the network’s rules, not just the law.
None of this means a CBD or vape business is doing anything wrong. It means the account needs a processor actually set up to underwrite that risk correctly — not one that simply declines the application to avoid the paperwork.
The compliance work vape and smoke shops are already doing
Most vape and smoke shop owners are already navigating real, specific federal requirements — the challenge is finding a processor willing to underwrite the business, not a lack of compliance on the merchant’s side:
- Minimum age of 21 to purchase tobacco and vapor products nationwide, under the federal “Tobacco 21” law.
- Age verification at the point of sale, and stricter identity-verification requirements for any online or shipped sales specifically.
- Product registration and reporting requirements that apply to vapor products under federal tobacco regulation.
A processor that actually understands this space treats that compliance work as a normal part of underwriting the account — not a reason to decline it outright.
Where Paramount can actually help
Paramount underwrites CBD, vape, and tobacco/smoke shop merchants as high-risk accounts — businesses that get declined by processors unwilling to do the underwriting work at all. That’s a real, specific answer for an owner who’s already been turned down elsewhere, not a workaround or a loophole — it’s a processing relationship actually built to evaluate these businesses on their real compliance posture instead of rejecting the application by category. Since high-risk accounts often carry higher processing rates, it’s also worth looking at whether dual pricing makes sense for your business, to offset that cost.
What to actually have ready when applying
- Business licenses and registrations specific to your state and product category.
- Lab test results (a Certificate of Analysis) for CBD products, confirming THC content is within the legal 0.3% threshold.
- Your age-verification process, documented — how you confirm a buyer’s age both in-store and online, if you sell both ways.
- Prior processing history, including any past account closures or high chargeback periods — a high-risk underwriter expects to see this and account for it, rather than being surprised by it later.
A real checklist before applying for a high-risk merchant account
- Gather your compliance documentation before you apply — licenses, lab results, and age-verification process, not after underwriting asks for it.
- Be upfront about prior account closures — a high-risk underwriter is set up to evaluate this honestly, and hiding it usually causes more delay than disclosing it.
- Confirm the processor actually names your category as one it underwrites, rather than a general processor hoping it slips through review.
- Ask what happens if state or federal rules change — a real high-risk processor should have a real answer, not a shrug.
Been declined elsewhere for CBD, vape, tobacco, or smoke shop processing?