Key takeaways
- Stripe and PayPal ban hemp/CBD in their terms regardless of the 2018 Farm Bill legality.
- Aggregators shut accounts down fast because they can't hold reserves against your risk.
- A dedicated high-risk merchant account with the right MCC is the durable fix.
If you're wondering why hemp retailers get declined by Stripe and PayPal even though the 2018 Farm Bill made hemp-derived products federally legal, the short answer is that legality and payment eligibility are two different things. Stripe and PayPal are payment aggregators, and their acceptable-use policies list hemp and CBD as prohibited businesses no matter what the DEA or your state says.
Legal to sell doesn't mean easy to process
The Farm Bill removed hemp (under 0.3% THC) from the controlled-substances list, but card networks and sponsor banks set their own risk appetites. Visa and Mastercard don't ban CBD outright, yet they require the acquiring bank to underwrite the merchant, assign the correct MCC, and monitor for compliance. Aggregators skip that per-merchant underwriting, so they simply exclude the category.
How aggregators actually work
Stripe and PayPal place thousands of merchants under one master account. That model is fast to onboard but has no room for individual risk management. When your account can't be individually reserved, reviewed, or priced for risk, the only lever they have is exclusion. That's why you can process for weeks and then get frozen the moment a review flags "CBD" or "hemp" in your descriptor or product pages.
What triggers the shutdown
- Product pages mentioning CBD, cannabinoid, or dosage/health claims
- Descriptors or business names containing hemp keywords
- A spike in volume or chargebacks that pulls a manual review
- Bank or acquirer sweeps of the aggregator portfolio
The compliance layer you actually need
A durable setup starts with a dedicated merchant account underwritten for hemp, mapped to the right MCC, and sponsored by a bank that knows the vertical. From there, the mechanics look like any other e-commerce stack: PCI-scoped hosted payment fields to keep card data off your servers, real fraud detection tuned for your average ticket, and clean product labeling that avoids drug claims.
Reserves and chargebacks
High-risk approvals usually come with a rolling reserve — often 5-10% held for ~180 days — and you'll be watched against the ~0.9% chargeback threshold Visa uses and Mastercard's ~1% program trigger. That's not punishment; it's the collateral that lets a bank say yes where an aggregator says no. Keep disputes low with clear billing descriptors, delivery tracking, and responsive support.
Lab testing and documentation
Underwriters want COAs (certificates of analysis) showing sub-0.3% THC, a compliant website, and accurate marketing. If your PCI compliance and documentation are in order, approval is a paperwork exercise, not a coin flip. This mirrors what we see in adjacent categories — the same pattern plays out in how vape and e-cig payment processing actually works, explained simply.
The takeaway: Stripe and PayPal aren't wrong about hemp being risky for their model — they're just built for low-risk volume at scale. Move to a processor that underwrites you as an individual merchant and the declines stop being a recurring emergency.