Key takeaways
- CBD is card-network legal but bank-scarce; the acquirer, not the network, decides whether your product mix and marketing pass underwriting.
- AB 45 legalized hemp in food, beverage and cosmetics with labeling rules, and later state restrictions on intoxicating hemp products changed what can be sold; check the current rule before listing.
- Ingestibles, tinctures and pet products are underwritten harder than topicals; separate SKUs, current COAs and no health claims are what get you approved.
CBD and hemp brands payment processing San Francisco is a question with a frustrating answer: the products are legal, the card networks allow them, and yet your bank or your last processor probably shut you down anyway. That is because CBD sits in a gap. Visa and Mastercard permit hemp-derived CBD under the 2018 Farm Bill definition, but they push the compliance burden to the acquiring bank, and most banks would rather not carry it. The brands that stay live in San Francisco, from tincture makers in Dogpatch to skincare lines selling at Ferry Building markets and DTC shops shipping out of Bayview warehouses, are the ones that make the acquirer's job easy.
The California layer: AB 45 and what came after
AB 45, signed in 2021, made it lawful in California to put industrial hemp and hemp-derived cannabinoids into food, beverages, dietary supplements and cosmetics, with registration, testing and labeling requirements administered by the Department of Public Health. It also required products to be from hemp that meets the federal THC limit and set rules on serving sizes and warning labels. In 2024 the state moved to restrict intoxicating hemp products, including limits on detectable THC in consumable hemp and age restrictions, and those rules have continued to evolve. Do not rely on a summary you read last year, including this one. Confirm the current CDPH rule with counsel before you list a product, because an underwriter will ask whether your SKUs comply, and a product that was fine in 2023 might not be now.
How underwriters actually sort CBD merchants
Every CBD application gets sorted on three axes, and knowing them lets you present your business in the strongest honest light.
- Product form. Topicals and cosmetics are the easiest to place. Ingestibles, tinctures, gummies, beverages and pet products carry more scrutiny because of FDA positions on CBD in food and supplements. Smokable hemp flower and vape cartridges are hardest and some acquirers exclude them entirely.
- Claims. Any language implying treatment of anxiety, pain, sleep disorders, or any disease is a decline. Underwriters read your product pages and your Instagram. Scrub testimonials that make medical claims too.
- Testing. A current third-party certificate of analysis for every SKU, showing cannabinoid content and contaminants, linked or QR-coded from the product page.
If you sell both topicals and ingestibles, keep them on separate product lines with separate descriptors where the processor allows it. It makes the ingestible risk easier to price and keeps a problem with one line from taking down the other.
Card-not-present risk in a DTC-heavy city
Most San Francisco CBD brands sell online, and card-not-present volume is where fraud and disputes live. The fix is not more friction at checkout but better signals. Collect billing address and CVV through hosted fields so card data never touches your server and your PCI scope stays small, run AVS and velocity rules, and use 3-D Secure on higher tickets. Subscription boxes, which many local brands offer, also fall under California's Automatic Renewal Law: clear terms, affirmative consent, and an online cancellation path that is as easy as sign-up. A subscription that is hard to cancel is a chargeback that you will lose.
Wholesale, farmers markets and the Bay Area retail mix
A lot of San Francisco hemp revenue is not DTC at all. Brands sell wholesale to Rainbow Grocery and independent shops in the Mission and the Haight, run booths at Fort Mason and Alemany markets, and ship to retailers across the state. Wholesale invoices over a few hundred dollars are better collected by ACH, which settles in 1-3 business days and avoids card fees on B2B tickets. For market booths, a mobile card reader tied to the same merchant account keeps reporting simple, but make sure the processor knows you sell in person as well as online, because an undisclosed sales channel is a common reason for a mid-term account review.
Reserves, pricing and what to expect
New CBD accounts typically carry a rolling reserve, often 5-10% for a set number of months, and pricing above what a coffee shop pays. That is the acquirer pricing in the chance you get shut down and disputes keep arriving after the fact. As you build six or twelve clean months, ask for the reserve to be reduced or capped. Pricing should be transparent enough that you can see interchange separately from the processor's markup; if a quote is a single blended number, ask for the breakdown.
Do not wait for a shutdown to find a backup
Banks change their risk appetite without warning, and a brand doing everything right can still get a 30-day termination notice when a sponsor bank exits the category. Keep your compliance package current, keep a second processor relationship warm, and read How to Switch High-Risk Processors Without Downtime so the transition is a configuration change rather than a crisis.
CBD in San Francisco is a compliance business first and a payments business second. Get the labeling, the COAs and the claims right, present the product mix honestly, and the processing side becomes a solvable problem instead of a recurring emergency.
Ready to get set up with Flux?
Cards, ACH, and stablecoins in one platform, with volume-based pricing. No setup fees or contracts.
Get Started