When an acquiring bank underwrites a CBD merchant, the license is the first thing it checks and the least of what it decides on. The reviewer is really asking one question: if this account is ever examined by the card brands, a regulator or the bank’s own auditors, can the bank show that it knew exactly what was being sold, that every product was tested, and that the business presents itself honestly to customers? Answering that means reading your product list against your lab reports, reading your website the way a secret shopper would, working out how much of your revenue comes from CBD, and studying how you have processed in the past. This article walks through each of those reviews in the order an underwriter tends to do them, so you can see your application the way the person approving it sees it.
The bottom line
- A license gets your file opened, not approved. The decision rests on your product file, your website, your sales mix and your processing history.
- Every product needs a current lab report that matches it. A reviewer will hold your inventory list next to your Certificates of Analysis and look for gaps.
- Your website is read word by word. Health claims, missing disclaimers, no age gate or no way to block shipping to certain states can stall a file that is otherwise clean.
- Disclose everything up front, including CBD that makes up only a small part of what you sell. A file that hides CBD tends to end badly later, not just at application time.
- Rules changed for hemp in 2026, so expect reviewers to read product files more carefully than they did a year ago.
Who wrote this, and what we will not claim
Nationwide Payment Systems (NPS) publishes this article. We are a payment processing company in South Florida, founded in 2001, and placing CBD and hemp businesses with acquiring banks that understand them is part of what we do every week, so we have a point of view. We are not lawyers, we do not quote rates or approval odds here, and no one can promise an approval, because the bank makes that call. Bank programs, card-network rules and hemp law all change, so treat this as a guide to how the review works and confirm the current requirements with your processor before you apply.
Why the license is where underwriting starts, not where it ends
It helps to know who is actually reading your application. The acquiring bank is the institution that sponsors your merchant account into the card networks and carries the financial risk if something goes wrong. A processor or an independent sales organization such as NPS packages your file and submits it, but the bank’s underwriting team, or a team acting under the bank’s rules, makes the decision. Those reviewers answer to the card brands, to their own compliance department and to bank examiners, and every approval they sign is one they may later have to explain.
That is why a license, a clean business registration and a good credit score are necessary but rarely decisive. A license tells the reviewer that a government agency allowed you to operate. It does not tell them what is in each bottle on your shelf, what your website promises customers, where you ship, or how often your customers dispute charges. Those are the things that create exposure for the bank, so those are the things the reviewer spends most of the time on. In our experience the files that move quickly are the ones where the merchant has already answered those questions before anyone asks.
It also explains why a bank can decline a lawful business. Legal and approvable are different tests. A bank may support CBD in general and still pass on a file because the product documentation is thin, the website makes claims the bank will not stand behind, or the product mix includes items outside its program. Our guide to high-risk merchant accounts explains the general review, and the rest of this article goes into what is specific to CBD.
What the reviewer actually works through
Every bank runs its own checklist, and the order varies, but the same six areas come up on nearly every CBD file we prepare. The table below is the short version, and each area is explained underneath it.
| Area | What the reviewer looks at | What tends to slow a file down |
|---|---|---|
| Product file | An inventory list with a current lab report for each product | Products with no report, old reports, or reports that do not match the label |
| Website | Claims, disclaimers, age verification, policies and shipping controls | Health claims, missing disclaimers, no age gate, words the bank will not accept |
| Sales mix | How much of your revenue comes from CBD and hemp products | A mix that does not match what the application says |
| Supply chain | Who makes the products and who tested them | No clear manufacturer or lab behind private-label products |
| Owners and history | Identification, past processing statements, chargebacks, prior closures | Unexplained closures, rising disputes, or a MATCH listing nobody mentioned |
| How you sell | In store or online, subscriptions, average sale, where you ship | Auto-renewing orders with weak disclosures, or no state shipping blocks |
1. The product file: your inventory against your lab reports
This is where most CBD files are won or lost. Reviewers usually ask for a list of every product you sell, often as a spreadsheet, and for a Certificate of Analysis from a testing laboratory for each one, either attached or linked from your website. Then they compare the two. They are looking for a report behind every product, a report recent enough to be believable, a cannabinoid profile that matches what the label claims, and a THC result that sits inside the federal hemp limit. A store with forty products and lab reports for thirty of them has a file with ten problems, not a file that is mostly fine.
The match matters as much as the report. If the label says one strength and the lab report shows another, or if the product name on the report does not match anything on your shelf, the reviewer cannot tell which document is true and will ask. Product photos and labels are often requested too, because the label is what the customer sees. The simplest way to make this part easy is to keep one master list with the product name, the batch, the testing lab and a link to the current report, and to update it whenever you add a product or receive a new batch.
2. The website, read like a secret shopper
Underwriters read your website before, during and after the application, and they read it the way a regulator would. On CBD sites they look first at the claims. Language suggesting that a product diagnoses, treats, cures or prevents any disease is a common reason for a file to stall, and it can draw attention from federal agencies that is far more serious than a payment problem. Most banks also expect the standard disclaimer that your statements have not been evaluated by the FDA and that the products are not intended to diagnose, treat, cure or prevent any disease.
After the claims, the reviewer checks the controls. That usually means an age gate at entry or at checkout, and we tell merchants to set it at 21 so they are covered everywhere. It means shipping controls that stop orders to states where your products cannot be sold, built into checkout rather than promised in a policy. It means the ordinary pages every merchant site needs, such as a real business name and address, a way to reach customer service, and clear shipping, refund, privacy and cancellation terms. Word choice matters as well. Some banks will not accept marketing that uses certain cannabis terms even when the products themselves are compliant hemp, and we have seen a merchant’s account put at risk over a single product description. Our article on merchant website compliance lists the pages and disclosures reviewers expect to find.
3. The sales mix: how much of the business is CBD
Banks often sort CBD merchants by how much of their revenue comes from CBD and hemp products, because a vitamin store with a shelf of CBD carries a different risk from a business that sells nothing else. The category you fall into can change what you are asked for, from a product list for the CBD items alone to a full review of the whole catalog and the advertising around it. Whatever the category, the reviewer expects the share you state on the application to match what your website, your inventory and your processing history show.
This is where mixed businesses get into trouble. A smoke shop, a wellness store or an online retailer may think of CBD as a side line and leave it off the application to keep things simple. A reviewer who later finds it on the website or the shelf sees a merchant who did not disclose a regulated product, and that is a much worse place to be than a merchant who disclosed it and was asked for a few more documents.
4. Where the products come from
Reviewers want to know who manufactured what you sell, especially when you sell under your own brand. A private-label product with your logo on it is still made by someone, and the bank wants to see that the manufacturer and the testing lab are real and that the lab reports were issued for your products rather than borrowed from a different line. Supplier invoices and manufacturer details help here, and they also help you answer questions later if a product is ever challenged.
5. The owners and the processing history
The ordinary parts of underwriting still apply to CBD. Expect to provide identification for the owners, business formation documents, a bank letter or voided check, and, if you already take cards, three to six months of processing statements. On those statements the reviewer looks at monthly volume, average and largest sale, refunds, chargebacks, how much is sold online versus in person, and how fast you are growing. A previous account that was closed is not automatically disqualifying, but it needs an honest explanation, and a listing on Mastercard’s MATCH database will come up in the bank’s check whether or not you mention it.
6. How you sell
Finally the reviewer looks at the shape of your sales. Card-present sales in a store are generally seen as lower risk than online orders. Subscriptions and auto-renewing orders get extra attention, because customers who forget they signed up are a common source of disputes, so the bank will look at how clearly the renewal is disclosed and how easy it is to cancel. A high average sale, international customers or a large share of sales to states with stricter hemp rules can each lead to more questions, and sometimes to a reserve, where a portion of sales is held back for a period as protection for the bank.
Why reviewers are reading CBD files more closely in 2026
Federal rules for hemp are changing. A law passed in November 2025 rewrites the federal definition of hemp, with the new definition taking effect on November 12, 2026. Among other things, it measures THC on a total basis that includes THCA rather than looking only at delta-9 THC, and it sets a per-container limit for finished hemp-derived cannabinoid products. Products that were sold for years as federally compliant hemp may not all fit the new definition, particularly intoxicating or converted cannabinoids.
The practical effect on underwriting is that reviewers have more reason than ever to read lab reports line by line, and some payment platforms have decided to leave the CBD category altogether rather than sort through it, which we wrote about in our note on a major platform dropping CBD merchants. A platform leaving a category is a business decision and does not mean every CBD product has become unlawful. It does mean that a merchant applying now should review the entire catalog against the new definition before submitting, and should expect the bank to ask about any product near the line. If you are unsure whether a product qualifies, ask a lawyer who works in hemp law, because a processor cannot answer that for you.
What usually gets a CBD file stalled or declined
Most declines we see are not about the business being CBD. They are about something in the file that the bank cannot get comfortable with. The common ones are:
- Missing or mismatched lab reports, including reports for a different product or batch than the one being sold.
- Disease claims on the website or packaging, or no FDA disclaimer at all.
- No age verification and no way to stop orders to states where the products cannot be shipped.
- Products outside the bank’s program, such as items the bank has said it will not support, sitting in the same catalog as compliant CBD.
- A sales mix that does not match the application, usually because CBD was left off or understated.
- History the merchant did not explain, such as a recent closure or rising chargebacks.
- Several applications at once. Applying to many processors in the same week can itself look like a warning sign to an underwriter.
How to package a CBD application so it reads well
The merchants who get through underwriting smoothly do the reviewer’s work before the reviewer does. That is less about paperwork volume and more about making every document agree with every other one. Here is the order we use when we prepare a CBD file.
- Build the product list. Every product, its batch, the lab that tested it and a link to the current report.
- Check each report against the label. Same product name, same strength, a THC result inside the federal limit, and recent enough to trust.
- Clean up the website. Remove disease claims, add the FDA disclaimer, set an age gate at 21, block shipping to restricted states, and publish your policies.
- State your sales mix honestly. Give the real share of revenue from CBD and hemp, and make sure the website and inventory show the same picture.
- Gather the standard documents. Owner identification, formation documents, bank verification and three to six months of processing statements if you have them.
- Explain your history in writing. A short note on any past closure or dispute problem, and what you changed, saves a round of questions.
None of this guarantees an approval. What it does is turn a file that raises questions into a file that has already answered them, which is the difference between a review that takes days and one that drags on for weeks. Our earlier guide on how to get approved for a CBD merchant account covers the same ground from a bank program’s point of view.
Underwriting does not stop after approval
An approved CBD account stays under review for as long as it is open. Banks and processors monitor chargebacks, refunds and volume, and many re-check the website and the product list from time to time, sometimes by placing a test order. If you add products, add them to your list with their lab reports and tell your processor before they go live, because a new product is exactly what an account approved for something else was not approved for. If your mix changes, for example a store that was mostly accessories becomes mostly CBD, say so. Merchants who keep their processor informed rarely get surprised. Merchants who let the business drift away from what was approved are the ones who find out from a held deposit. If that has already happened to you, our guide to the restricted merchant label explains what to do the same day.
Where NPS fits, and where it does not
We work with CBD and hemp businesses and with cannabis-related businesses that do not touch the plant, such as pipes and smoking accessories, medical card services and companies that sell to the industry. We review the business and the website before anything is submitted, help put the product file in order, and send the application to a bank program that supports the category. Our high-risk merchant services page lists the industries we place.
We are specific about the line. We do not process for dispensaries, growers or any business that touches the plant, and we cannot place products that a bank program does not support. Here is where we may not be the right choice:
- You sell marijuana or touch the plant in any way. We cannot help with that, and no conventional merchant account can.
- You do not have lab reports for your products and do not plan to get them. Every bank program we know of will ask.
- You want an instant, self-service account. CBD underwriting is a real review, and we do not offer instant approval.
- You would rather keep CBD off the application. We will not submit a file that hides what you sell.
- You are choosing only on the lowest advertised rate. We price each merchant individually and do not publish one universal rate.
Next step
A CBD application is approved by a person who has to be able to defend it later. Give that person a product list that matches your lab reports, a website that makes no promises the bank cannot stand behind, and a sales picture that matches what you told them, and most of the work is already done.
If you want a second set of eyes on your product file or website before you apply, you can talk with our team. If your business is a better fit somewhere else, we will tell you. You can also browse our other payments guides for related topics.
Frequently asked questions
What do underwriters look for in a CBD merchant application?
They look at your product list and the lab report behind each product, your website’s claims and controls, how much of your revenue comes from CBD, who makes your products, and your owners’ processing history. The license is checked too, but it is rarely what decides the file. The reviewer wants to see that every document agrees with every other one.
Do I need a Certificate of Analysis for every CBD product?
In practice, yes. Banks that support CBD generally expect a current lab report for each product you sell, either attached to the application or linked from your website. A product without a report is one of the most common reasons a file is sent back.
Can a CBD website make health claims?
Claims that a product diagnoses, treats, cures or prevents a disease are a common reason a CBD file is declined, and they can create regulatory problems far beyond payments. Most banks also expect the standard FDA disclaimer on the site. Describe your products plainly and remove any disease language before you apply.
Does a store that sells only a little CBD still have to disclose it?
Yes. Banks often group CBD merchants by how much of their revenue comes from CBD, and a small share usually means a lighter review, not no review. Leaving CBD off the application and having a reviewer find it later is far worse than disclosing it up front.
How long does CBD merchant underwriting take?
It depends on the bank and on how complete your file is when it arrives. A file with a matched product list, a compliant website and clear history moves much faster than one that needs several rounds of questions. Ask your processor for its current timeline in writing.
Will the 2026 hemp law change affect my merchant account?
It may. A new federal hemp definition takes effect on November 12, 2026, and it changes how THC is measured and limits finished products. Review your full catalog against the new definition, ask a hemp lawyer about any product near the line, and expect your bank to read your lab reports closely.
Can I get a CBD merchant account after a previous account was closed?
Sometimes. A past closure is not automatically disqualifying, but the bank will want an honest explanation of what happened and what you changed. If you are on the MATCH list, that will show up in the bank’s check, so say so up front.
Does NPS work with cannabis dispensaries?
No. We work with CBD and hemp businesses and with cannabis-related businesses that do not touch the plant, such as pipes and smoking accessories and medical card services. We do not process for dispensaries, growers or any business that touches the plant.
