CBD payment processing before the hemp rules change

The only distinction that matters right now

Every CBD application in the second half of 2026 is really two applications, and which one you are filing decides almost everything about your rate, your reserve and whether you get boarded at all.

Non-intoxicating CBD — isolate, broad-spectrum, and full-spectrum products sitting inside the legal THC limit — is a mature high-risk category. Several acquirers board it routinely. Pricing is settled. The documents are well understood. This is a solvable problem.

Intoxicating hemp derivatives — delta-8, delta-10, THCA flower, HHC and their relatives — are a different business wearing the same MCC. Appetite was already thin, and the federal change now landing across November and December 2026 is narrowing it week by week.

If you sell both, split the revenue figures before you apply. An underwriter who discovers halfway through that forty percent of your volume is delta-8 will decline the whole application, and that decline follows you.

What actually changes, and when

The 2018 Farm Bill defined hemp as cannabis containing no more than 0.3 percent delta-9 THC by dry weight. It said nothing about the other cannabinoids. That silence is the whole of the so-called loophole: extract CBD from compliant hemp, convert it into an intoxicating analogue that is not delta-9, and the product sits outside the wording of the definition while producing an effect the definition was written to exclude.

The Continuing Appropriations Act, 2026 rewrites that definition. The federal test moves from delta-9 alone to total THC — delta-9 plus THCA at a conversion factor of 0.877 — with a cap of 0.4 mg of total THC per retail container, measured at the innermost packaging rather than by dry weight. That cap, not the total-THC test, is what reshapes the market: it is low enough to put most intoxicating hemp beverages and edibles outside the definition of hemp altogether. State-legal cannabis programmes are untouched.

The commencement is now split, and this is where most write-ups are out of date. H.R. 6500, the Continuing Appropriations and Extensions Act, 2027, was signed on 2 September 2026 and delayed most of the new restrictions to 11 December 2026. The exclusion of cannabinoids that cannot be naturally produced by a cannabis plant — the synthetics — still takes effect on 12 November 2026. If a supplier or a competitor is still telling you everything lands in November, they are working from superseded reporting, and the difference is a month of sell-through on a large part of the catalogue.

One caveat we would rather state than leave you to discover: 11 December 2026 is also the day the current government funding runs out. The date has moved once already. Plan against the substance of the change, not the calendar.

Three consequences that matter for payments:

1. Compliance becomes a date question. A certificate of analysis proves what was in a batch when it was tested. After November, an underwriter is asking a different question: which definition applied on the day this was shipped? Merchants who can answer that with dated records will board. Merchants who cannot will not.
2. Acquirers move before the deadline, not after. Risk teams reprice on announced changes. If you are planning to apply, the window where appetite is widest is now.
3. Catalogue composition becomes an underwriting fact. Expect to be asked for a SKU-level revenue split, and expect a follow-up about what the catalogue looks like in December.

What underwriters check on a CBD site, in order

Risk analysts work through a CBD domain in a predictable sequence. Knowing it lets you fix the problems before they cost you an application.

1. Product pages, for claims. Any condition named next to a product — anxiety, pain, sleep, inflammation — is a decline in most shops, because it converts a supplement into an unapproved drug in the reader’s mind and the regulator’s.
2. The blog, for the same thing. This is where most merchants lose it. Long-tail SEO posts written two years ago by a freelancer routinely contain exactly the claims the product pages carefully avoid.
3. COAs, for currency and match. Present, accessible without an account, dated within a sensible window, and naming the product actually on sale.
4. The age gate and shipping rules. Present, and actually enforced at checkout rather than a modal anyone can click through.
5. Dispute history. Under the 2026 VAMP rules the merchant excessive threshold is 1.5 percent of card-not-present transactions, counting fraud reports and disputes together, with no warning tier before penalties apply. Free-trial and subscription models make that threshold much easier to hit than merchants expect.

Reserves are not punishment

Merchants read a ten percent rolling reserve held for 180 days as a lack of trust. It is usually simpler than that: a reserve is the acquirer’s cover for disputes that arrive after you have been paid, and in a category where the legal ground is shifting, it is also cover for the possibility that your catalogue becomes unsellable mid-term.

Two things reduce it in practice. A clean dispute record over six months, and a catalogue that is obviously and demonstrably on the safe side of the definition. Neither is something an introducer can argue you into. Both are things you can build before you apply.