Health and wellness payments for CBD merchants.
CBD merchants face specific regulatory and processing challenges. Cardflo provides a compliant and efficient payment orchestration platform, enabling secure and reliable transaction processing for CBD products while navigating the complexities of the industry.
- Industry
- CBD merchants
- Category
- Health
- Cardflo support
- Yes
The overview
Processing payments for Cannabidiol (CBD) products requires navigating a complex intersection of national legislation, local bylaws, and card scheme mandates.
While CBD derived from hemp is legal in many jurisdictions, card networks typically categorise these businesses as high-risk, necessitating specific Merchant Category Codes (MCC) and rigorous monitoring.
CBD merchants often encounter difficulty securing stable merchant accounts from traditional tier-one acquirers who may avoid the sector due to perceived reputational risks or fluctuating legal statuses.
Payment orchestration serves as a critical infrastructure layer in this environment, allowing businesses to manage multiple merchant IDs (MIDs) and route transactions to acquirers with specific appetites for hemp-based products.
This decentralised approach mitigates the risk of sudden account closures and provides a framework for managing high dispute rates through proactive fraud screening and robust 3D Secure (3DS) implementations.
Effective management of these payments involves careful coordination between the gateway, the specialist acquirer, and compliance teams to ensure all activity adheres to hemp-specific risk parameters.
How it works
Specialist Acquirer Onboarding
Merchants are matched with acquirers that specialise in high-risk verticals and possess the necessary risk appetite for CBD.
This stage involves deep Know Your Business (KYB) checks, where the acquirer verifies laboratory reports (COAs) to ensure THC content remains within the legal limits defined by local jurisdictions and scheme rules.
MCC Assignment and Routing
Transactions are tagged with the appropriate Merchant Category Code, such as MCC 5912 or 5999, depending on the acquirer's preference and product type.
The orchestration layer then uses smart routing logic to send the authorisation request to the specific MID best suited for that transaction's geography or risk profile.
SCA and Fraud Scrubbing
Every transaction undergoes automated fraud analysis and 3D Secure 2. 0 authentication to satisfy Strong Customer Authentication (SCA) requirements under PSD2.
This process helps to differentiate between legitimate high-value purchases and potential fraudulent activity, reducing the likelihood of immediate declines or future chargeback requests by the issuer.
Authorisation and Settlement
Once the issuer authorises the payment, funds are captured and held according to the acquirer's settlement cycle.
Due to the high-risk nature, these settlements may include a rolling reserve, where a percentage of turnover is temporarily withheld to cover potential future disputes, representments, or administrative fines.
Why it matters
Redundancy and Business Continuity
High-risk merchants are frequently subject to sudden MID terminations if an acquirer changes its internal risk policy or faces regulatory pressure. By utilising multiple acquirer connections, a CBD business can instantly re-route traffic to an alternative provider if one link fails.
This redundancy prevents total revenue loss and ensures that a single point of failure does not compromise the entire digital storefront.
Chargeback Mitigation and Stability
CBD products can attract higher levels of friendly fraud and disputes related to delivery or product efficacy. Managing these through a centralised platform allows for the implementation of soft descriptors, clear billing statements, and rapid refund triggers.
Minimising the chargeback ratio is essential for maintaining a healthy relationship with card schemes and avoiding placement in monitoring programmes.
Regulatory notes
Card Scheme Compliance
Visa and Mastercard have specific programs for hemp and CBD, particularly in the US and Europe. Merchants must be correctly coded with the appropriate MCC and must ensure their marketing claims do not violate pharmaceutical regulations.
Failure to maintain these standards can lead to excessive fines or a permanent ban from the card networks, making the use of compliant processing partners essential.
PSD2 and SCA Obligations
Under the Revised Payment Services Directive (PSD2), CBD merchants operating in the European Economic Area must implement Strong Customer Authentication. This is not optional for high-risk goods and is enforced by issuers.
Merchants must utilise gateways that support robust 3DS2 flows to avoid high decline rates from issuers who will reject non-compliant, non-exempted electronic transactions.
Use cases
E-commerce Wellness Retailers
Online stores specialising in hemp-derived oils, tinctures, and topicals require a gateway that can ingest lab certificates while providing a smooth checkout process via 3DS2 to ensure compliance.
Subscription CBD Services
Businesses offering monthly CBD supplement boxes utilise tokenisation and account updater services to manage recurring billing cycles while navigating the high-risk requirements for Merchant Initiated Transactions (MITs).
Multi-Market CBD Distributors
Organisations selling across different European borders use smart routing to settle transactions via local acquirers, reducing cross-border fees and improving authorisation rates through domestic processing.
By the numbers
Industry standard for high-risk CBD accounts to mitigate potential losses from chargebacks and scheme fines over a 180-day window.
Typical range for high-risk acquirers, providing a safety buffer for transaction verification compared to the T+1 cycles seen in low-risk retail.
The common industry-wide maximum monthly ratio of disputes to sales volume required to avoid entry into card scheme monitoring programmes.
Related terms
Book a scoping call to see how Cardflo would set you up.
What's included.
- Integration with specialist high-risk acquirers prioritising hemp and CBD industry stability and growth.
- Automated routing to multiple MIDs to reduce risk of single-point processing failures and outages.
- Comprehensive KYB documentation management for lab reports and THC compliance verification during onboarding.
- Implementation of 3D Secure 2 protocols to satisfy SCA mandates and reduce liability for fraud.
- Usage of specific Merchant Category Codes to maintain transparency with card schemes and issuers.
- Support for rolling reserves and delayed settlement cycles common within the high-risk payment sector.
- Advanced fraud screening tools designed to identify and block high-risk velocity patterns and bot activity.
- Tokenisation of payment data to facilitate secure recurring billing and one-click checkout experiences.
- Detailed reporting on chargeback ratios and retrieval requests to monitor MID health and performance.
- Management of soft descriptors to ensure clear identification on customer bank statements and reduce disputes.
Talk to an acquiring specialist about your MID setup.
Common questions.
Why is CBD considered high-risk by most acquirers and card schemes?
CBD is categorised as high-risk primarily due to the inconsistent legal framework across different territories and the potential for regulatory shifts. Card schemes like Visa and Mastercard impose stricter monitoring on these goods because they are associated with higher chargeback rates and reputational risks.
Furthermore, acquirers must perform enhanced due diligence to ensure products do not exceed legal THC thresholds, which adds administrative overhead. This classification often results in higher interchange-plus margins and the requirement for rolling reserves to protect the acquirer from financial losses.
What documentation is required to secure a CBD merchant account?
Acquirers typically require an extensive KYB package. This includes standard corporate documents such as a Certificate of Incorporation and proof of address for directors.
Specifically for CBD, merchants must provide Certificates of Analysis (COAs) from third-party laboratories to prove the THC content is below the legal limit (often 0. 2% or 0.
3% depending on jurisdiction). Additionally, a clear website privacy policy, terms of service, and a detailed description of the supply chain might be requested to ensure no prohibited substances are being sold.
How does 3D Secure 2.0 assist CBD merchants specifically?
For CBD merchants, 3DS2 serves two functions. First, it is a legal requirement for most European transactions under PSD2/SCA.
Second, it provides a layer of liability shift. When a transaction is successfully authenticated via 3DS, the liability for certain types of fraud-related chargebacks often shifts from the merchant to the issuer.
Given that hemp-related businesses can be targets for 'friendly fraud' or unauthorised use, 3DS2 helps maintain the chargeback ratio below the thresholds mandated by card scheme monitoring programmes.
Can I use a standard PSP for my CBD business?
Most mainstream Payment Service Providers (PSPs) and aggregators have strict Prohibited Business lists that include CBD or hemp products.
While some may initially allow a merchant to sign up, these accounts are often frozen or terminated during the first audit or after a spike in volume.
It is generally more sustainable to use a payment orchestration approach that connects to specialist high-risk acquirers who have intentionally built their infrastructure and risk models to accommodate the CBD industry's specific needs.
What is a rolling reserve and why is it applied to CBD accounts?
A rolling reserve is a risk management tool where an acquirer holds a percentage of the merchant's gross sales (typically 5% to 10%) for a fixed period (usually 180 days). For CBD merchants, this acts as a financial buffer.
If the merchant's business fails or chargeback rates spike, the acquirer uses these funds to cover the costs. Because CBD is viewed as having a higher potential for disputes and regulatory interventions, the reserve ensures the acquirer is not left with an unsecured liability.
How can I reduce my chargeback rate as a CBD seller?
Reducing chargebacks involves several technical and operational steps. Technically, ensuring that the soft descriptor on the customer's bank statement matches the website name is vital to prevent 'unrecognised transaction' disputes.
Operationally, providing clear tracking information and proactive customer service can resolve issues before they escalate to a card-level dispute. Using a gateway that supports real-time fraud scrubbing and CVV/AVS checks also filters out many potentially problematic transactions before they reach the authorisation stage.
Related industries.
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.