Key takeaways
- Stripe and PayPal prohibit CBD in their terms of service, so any approval is temporary until a risk review catches it.
- Aggregator models can't underwrite individual CBD merchants, so they ban the category wholesale rather than assess risk.
- A true high-risk processor boards CBD under the correct MCC with a reserve — the durable alternative to a surprise freeze.
The reason CBD companies get declined by Stripe — and PayPal, and Square — isn't a glitch or a fixable paperwork error: it's written directly into their terms of service, which list CBD and hemp-derived products as prohibited businesses. Whether you're blocked at signup or, worse, approved and then frozen months later with funds held, the underlying cause is the same aggregator business model that makes those platforms so easy to start with in the first place.
The aggregator model is the real reason
Stripe, PayPal, and Square are payment aggregators. Instead of underwriting each merchant individually, they board thousands of businesses fast under a shared master account. That convenience comes with a tradeoff: they can't do the case-by-case risk assessment that high-risk categories require, so they manage risk by banning entire categories outright. CBD is on that banned list. It's not personal, and it's not a rejection you can appeal your way out of.
Why a temporary approval is worse than a decline
The dangerous scenario isn't the clean decline — it's the account that gets approved because the automated system didn't immediately flag it. You start processing, volume grows, and then a risk review notices CBD-related products. The account gets frozen, funds get held (often for months), and you can even land on the MATCH list, which makes getting a legitimate account afterward much harder. A quiet approval on a prohibited-business platform is a trap, not a win.
The regulatory backdrop
Hemp-derived CBD was federally legalized under the 2018 Farm Bill within certain THC thresholds, but the FDA's stance on CBD in foods and supplements remains unsettled, and state rules vary. Aggregators don't want to police that patchwork per merchant, so they opt out entirely. This is a work-with-your-processor-and-counsel space — the point isn't that CBD is illegal, it's that mainstream platforms won't do the underwriting it requires.
What actually works instead
A true high-risk processor underwrites you individually and boards you under the correct MCC with a dedicated merchant account, not a shared aggregator bucket. That means real scrutiny up front — product lab reports, THC compliance, marketing claims — in exchange for a stable account that survives review. Read our practical checklist for CBD payment processing to see what boarding actually involves, and high-risk payment gateway vs the old way for how this differs from the aggregator model.
What to expect from high-risk CBD processing
- A rolling reserve, commonly 5% to 10% held for 90 to 180 days, because the processor is carrying real risk.
- Above-retail pricing — ask for pass-through pricing so interchange and markup are visible separately.
- Chargeback monitoring against the roughly 0.9% to 1% network thresholds, backed by real fraud detection.
- Compliant handling of stored cards through tokenization, especially if you run subscriptions.
The reserve and the scrutiny feel like friction compared to Stripe's instant signup, but they're the price of an account that won't vanish overnight.
Don't try to hide the business
Some sellers try to slip CBD past an aggregator by miscoding the business or describing products vaguely. It works until it doesn't — and when it fails, the freeze and potential MATCH-list placement are far more damaging than an honest high-risk setup would have been. Board correctly the first time.
If Stripe or PayPal has declined or frozen your CBD business, nothing is wrong with your company — you're simply using the wrong kind of processor. The fix is a high-risk merchant account that underwrites CBD honestly, prices the risk in, and keeps you processing through the reviews that shut aggregator accounts down.