CBD payment processing in the UK and EEA: Card acceptance for established CBD merchants

CBD businesses in the UK and EEA operate in a legal, growing consumer market. Getting a merchant account for one is another matter entirely.

Most mainstream acquirers decline CBD applications outright. Those that do approve them typically impose transaction limits, elevated fees, and rolling reserves that create real cash flow pressure for established merchants. The problem isn’t legality. It’s an acquirer risk appetite, and it’s unlikely to resolve without a payment provider that specialises in this category.

This article covers how card payment processing works for CBD merchants in the UK and EEA: which payment methods are available, what compliance requirements apply, and how to distinguish between CBD and cannabis payment processing, two categories that are frequently conflated but operate under entirely different regulatory and commercial conditions.

CBD and cannabis payments: Why the distinction matters

CBD and cannabis are frequently treated as interchangeable terms in payment processing discussions. They aren’t, and the difference has direct consequences for how merchants get approved, what they pay, and which acquirers will work with them.

The legal position in the UK

CBD derived from industrial hemp is a legal consumer product in the UK, provided the finished product contains no more than 1mg of THC per container and the CBD itself is derived from an approved hemp strain. 

The Food Standards Agency (FSA) regulates ingestible CBD products under the novel food framework, requiring authorisation before a product can legally be sold. Topical CBD products sit outside novel food requirements but remain subject to general consumer safety legislation.

Cannabis containing THC above 0.2% is a Class B controlled substance under the Misuse of Drugs Act 1971. There’s no legal recreational cannabis retail market in the UK. Medical cannabis prescriptions exist but are issued under highly restricted conditions and do not constitute a viable retail payment processing category.

The position in the EEA

CBD is permitted across most EEA member states, though specific THC thresholds and novel food requirements vary by jurisdiction. Germany introduced partial legalisation of recreational cannabis in 2024, making it the most significant market for cannabis payment processing within the EEA. Other member states maintain prohibition or restrict cannabis to medical use only.

What this means for payment processing

The legal distinction translates directly into acquirer behaviour. CBD merchants in the UK and EEA apply under general retail or health and wellness merchant category codes (MCCs). Approval isn’t guaranteed, and underwriting requirements are more stringent than for mainstream retail, but a viable pathway exists through specialist payment providers.

Cannabis dispensaries, even in markets where retail cannabis is legal, apply under MCCs that most acquirers refuse outright. Acceptance requires a provider with direct scheme relationships and explicit programme support for cannabis.

In short: CBD merchants have a real, processable option in the UK and EEA. Cannabis merchants outside a small number of legalised jurisdictions do not, regardless of what any payment provider’s marketing may suggest.

Payment methods available to CBD merchants in the UK and EEA

Not all payment methods are equally accessible to CBD merchants, and the options that are available carry different compliance requirements, approval conditions, and operational trade-offs. The following covers what is realistically available and what each method requires.

Card processing

Visa and Mastercard acceptance is available to CBD merchants through acquirers that have explicitly underwritten the category. Neither scheme prohibits CBD outright, but both require acquiring banks to conduct enhanced due diligence on cannabis-adjacent merchants before approval.

E-wallets

Not all providers permit cannabis-adjacent transactions. PayPal, for example, explicitly prohibits cannabis-related sales in its acceptable use policy. Others, including Apple Pay and Google Pay, process transactions over the underlying card rails and defer to the issuing bank’s policies rather than setting category-level restrictions themselves. Acceptance should be confirmed at the integration stage rather than assumed.

Pay by link

Pay by link is a practical option for CBD merchants operating without a full e-commerce build, or for wholesale and B2B order flows. It processes over the same card rails as standard card acceptance and carries the same acquirer approval requirements. No additional scheme approval is required beyond the base merchant account.

Recurring billing

Subscription and recurring billing models are available to CBD merchants through specialist payment service providers (PSPs) but require explicit acquirer support for the MCC. Merchants operating subscription models should confirm recurring billing is included in their merchant agreement before launch, as it’s not automatically included in all CBD merchant accounts.

SoftPOS

SoftPOS solutions turn a standard NFC-enabled Android device into a card acceptance terminal for in-person sales. For CBD retailers with physical locations, SoftPOS removes the need for dedicated hardware while maintaining PCI DSS compliance. Acceptance is subject to the same acquirer underwriting requirements as card processing generally.

Legal and compliance requirements for CBD payment processing in the UK

CBD merchants and their payment providers operate within a defined compliance framework. Understanding what that framework requires, and how it applies in practice, matters for both merchant onboarding and ongoing payment operations.

POCA 2002 and cannabis-adjacent transactions

The Proceeds of Crime Act 2002 (POCA 2002) applies to any business handling funds that could be connected to criminal activity. For payment processors, this creates a specific obligation: where a processor handles transactions for a merchant whose products sit adjacent to a controlled substance category, enhanced due diligence is required to establish that the funds being processed are derived from lawful activity.

For CBD merchants, this means a compliant processor must verify that products sold are derived from approved hemp strains, contain THC within legal limits, and where applicable hold FSA novel food authorisation. Processing for a merchant that can’t demonstrate product legality creates potential exposure under POCA 2002 for the processor, not just the merchant. A reputable PSP will require this documentation at onboarding and review it periodically.

Working with a specialist CBD payment provider

CBD merchants that have been declined by mainstream acquirers, or are operating without a compliant payment infrastructure, need a provider with direct scheme relationships and a clear understanding of the regulatory obligations involved.

Fibonatix is an FCA-regulated PSP (FRN 768776) specialising in merchant accounts for CBD and cannabis-adjacent businesses in the UK and EEA. We offer a compliance and payment method assessment before any acquirer application is made, so merchants understand exactly what they are applying for and why.

» Speak to our team to discuss your requirements

Disclaimer: Fibonatix is a UK-based, FCA-regulated payment service provider (FRN 768776) specialising in merchant accounts for B2C businesses globally, but B2B exclusively to the UK and EEA. Verify our regulatory status on the FCA Financial Services Register.

FAQs

Can CBD businesses accept card payments in the UK?

Yes. CBD is a legal consumer product in the UK and card acceptance is available through acquirers that have explicitly underwritten the category. Most mainstream acquirers decline CBD applications, but specialist PSPs with direct scheme relationships can facilitate approval.

What is the difference between CBD and cannabis payment processing?

CBD and cannabis operate under entirely different legal and commercial frameworks. CBD derived from industrial hemp is legal in the UK and processable through specialist acquirers. Cannabis containing THC above 0.2% is a Class B controlled substance with no legal retail market in the UK. The acquirer options, MCC classifications, and compliance requirements differ significantly between the two.

Why do payment processors reject CBD businesses?

Acquirer rejection of CBD applications is driven by risk appetite rather than legality. CBD’s proximity to cannabis as a product category causes most mainstream acquirers to decline applications at the underwriting stage. Specialist PSPs that have established acquiring programmes for the category are the practical solution.

What compliance requirements apply to CBD payment processing in the UK?

CBD merchants and their processors must meet FCA-required AML/KYC standards, and ingestible CBD products must hold FSA novel food authorisation. Processors handling cannabis-adjacent transactions also carry obligations under POCA 2002, including suspicious activity reporting to the National Crime Agency where transaction patterns suggest product category violations.

What payment methods are available to CBD merchants in the UK and EEA?

Card processing via Visa and Mastercard, pay by link, recurring billing, e-wallets, and SoftPOS for in-person sales are all available to CBD merchants, subject to acquirer approval and compliance requirements.