CBD is legal to sell across most of the United States, yet CBD merchant accounts get frozen and terminated every week. The reason is rarely the product. It is the file the merchant hands the underwriter. Approval is an underwriting exercise, not luck, and the acquirers that actually bank CBD are looking for a specific, checkable set of evidence.
Give them exactly that evidence and a clean site, and a decision usually lands in five to ten business days. This is the account-opening companion to our pillar guide, CBD and nutra payment processing in 2026. For the vertical agnostic version of this checklist, see what high-risk underwriters actually check before they approve you. Below is the checklist underwriters actually score you against.
Underwriters buy documents, not promises
A CBD application lives or dies on paperwork. The single most common reason a file stalls is a missing or mismatched lab report. Assemble these five items before you apply, in this order.
- A Certificate of Analysis for every SKU. A third-party lab COA showing under 0.3% THC on a dry-weight basis, matched to each product you sell. One report for the whole catalogue is not enough. Underwriters spot-check the COA against the product page.
- The correct merchant category code. Most compliant CBD sits under MCC 5499 or 5912. Miscoding is a fast route to the MATCH list, so confirm the code on your file before the first transaction settles.
- Visa Integrity Risk Program registration. CBD is a high-integrity-risk category, so your acquirer must register the merchant under VIRP and pay the fee. Budget for it and expect the control questions that come with it.
- A website with zero health claims and a visible FDA disclaimer. Strip every “treats,” “cures,” “reduces anxiety,” or “anti-inflammatory” line. Add the standard disclaimer that statements are not evaluated by the FDA and the products are not intended to diagnose or treat disease.
- Published refund and shipping policies. Clear, reachable, and honest. Underwriters read them as a proxy for how you will handle disputes once you are live.
Get the MCC right or get coded onto MATCH
The code on your file decides whether the schemes see a compliant specialty retailer or an unclassified risk. There is no single “CBD” MCC, so the right code depends on what you actually sell.
| What you sell | Typical MCC |
|---|---|
| CBD oils, tinctures, edibles (ingestible) | 5499 Misc food stores |
| CBD positioned in a pharmacy or drug context | 5912 Drug stores and pharmacies |
| CBD topicals and cosmetics | 5977 Cosmetic stores |
| CBD vape and e-liquid | 5993 Cigar stores and stands |
Source: Basis Theory, Cannabis and CBD Payments best practices
Health claims are the fastest way to lose the account
The FDA has issued a steady stream of warning letters to CBD sellers that market products to prevent, treat, or cure disease. Acquirers know this, so their risk teams crawl your site for claim language before and after approval. One “clinically proven to reduce anxiety” banner can undo a clean COA file.
Warning
Disease claims re-open a closed file. Acquirers re-scan CBD sites after go-live. A single therapeutic claim, even in a blog post or a customer testimonial you reposted, can trigger a compliance review and a mid-term termination.
What approval actually costs and how long it takes
A complete, honest file moves quickly. The numbers below are the ones a new CBD merchant should plan around.
The initial cap is not a punishment. It is how acquirers manage exposure while your dispute history builds. Process cleanly for a few months, keep chargebacks low, and the cap lifts. Treat the first ninety days as an audition, because that is exactly what they are.
A CBD approval is not a favour from a processor. It is a file that answers every question before it is asked.
The bottom line
Getting a CBD merchant account approved in 2026 is procedural. Bring a COA for every SKU, the correct MCC, VIRP registration, a claim-free site with an FDA disclaimer, and published policies, and you hand the underwriter a decision they can say yes to. Skip one and you hand them a reason to say no. For the wider picture on staying approved once you are live, read the pillar guide on CBD and nutra payment processing.
- LegitScript, “What You Need To Know About The Visa Integrity Risk Program (VIRP),” exact page, 2025.
- PaymentCloud, “A Comprehensive Guide to the Visa Integrity Risk Program (VIRP),” registration fee $950, 2025.
- Basis Theory, “Cannabis and CBD Payments: Eliminating a Single Point of Failure,” MCC 5499 and 5912 guidance.
- U.S. Food and Drug Administration, “Warning Letters for Cannabis-Derived Products,” exact page.
