7 CBD Merchant Account Challenges & how to Overcome Them

Securing a CBD merchant account is one of the hardest operational problems a CBD business will face, and it rarely gets easier once trading begins. The difficulty is structural: CBD products sit inside a shifting legal framework, acquirers treat them as a specialist category however well the brand is run, and few payment providers will underwrite the sector at all.

This guide covers what distinguishes a CBD merchant account from a standard one, the hurdles UK and EEA businesses hit when securing payment processing, and the practices that keep accounts stable.

The 7 biggest CBD merchant account hurdles and how to solve them

Seven hurdles recur across CBD businesses trying to secure and keep a merchant account. Each is broken down by root cause, who is most exposed, the mistakes merchants make, and the most effective fix.

1. Are you licensed in every market you sell into?

Licensing requirements differ by geolocation, and often by authority within a single jurisdiction. Some of your products may fall under a medicines authority (e.g., European Medicines Agency), others under a food authority (e.g., European Food Safety Authority), and even in the EU those requirements diverge across member states.

• Most exposed: You sell medicinal-grade or higher-THC products, or you're expanding into new markets without re-checking local requirements first.
• Common mistake: Assuming a licence in one market carries over to another, the same error that recurs across other regulated sectors when a firm wrongly assumes it can passport its services elsewhere.

2. Do you have a robust AML/CFT programme?

You need to demonstrate to prospective providers that you have effective systems to manage money-laundering and terrorist-financing risks., because CBD products can be acquired legally and then resold illegally. The exposure isn't yours alone; it extends across every licensed entity your provider accepts as a client.

• Most exposed: Your customer, product-and-service, interface, or geographical risk signals are elevated, particularly if you sell online where customer identity is harder to verify.
• Common mistake: Outsourcing part of AML/CFT compliance and buying an off-the-shelf solution rather than a tailored one. Even where you outsource, you remain the licensed entity in law and therefore own any failure by the outsourcing provider.

3. Are your delivery and supply partners reputable?

You have to ensure that every company acting on your behalf, from supply through to delivery, reflects your own values. Where clear legal requirements are absent, the vacuum can attract less reputable companies offering services to CBD firms. If you sell medicinal products above the relevant THC threshold, you face a bigger challenge here.

• Most exposed: You rely heavily on third-party suppliers and couriers, especially without quality-assurance oversight of those partners.
• Common mistake: Treating the contract as the end of the process. A common pattern is signing the agreement and then doing no real compliance monitoring until a financial dispute surfaces.

4. Have you found the right payment provider?

Finding a payment provider willing to support CBD businesses is often the first major hurdle. Because the category is treated as "specialist" (or “high-risk”), few payment service providers or financial institutions offer CBD merchant accounts at all. This leaves you with a narrow field and often higher transaction fees, since providers price in the exposure they're accepting. When choosing a CBD payment provider, the costs and compliance matter as much as the fees.

• Most exposed: You're a smaller or newer operator. The harder it is to hit the transaction thresholds providers expect, the more critical the problem becomes from day one.
• Common mistake: Defaulting to a large, well-known provider on the assumption that its reputation will legitimise your business. If you take time to reach the thresholds the provider expects, you can incur additional fees and see the relationship deteriorate.

PSP checklist:

5. Are your payment services available in every market you sell into?

Since legal requirements differ across jurisdictions, your payment gateway and merchant account provider may restrict which services they offer in which locations. A payment method available in one market may be unavailable in another.

• Most exposed: You sell across borders. Complaints tend to rise when customers compare available payment options against other retailers.
• Common mistake: Failing to address service limitations in your website terms and conditions. For online sellers, your commercial relationship with the customer typically begins at registration or first order, and your terms need to reflect that from the outset.

6. Do you prevent access by minors?

Where a jurisdiction lacks specific CBD legislation, responsible marketing becomes a self-regulatory obligation. As a legitimate firm, you should ensure your marketing doesn't reach vulnerable people or minors. This isn't a problem created by merchant account providers, but it's one worth addressing proactively.

The risk shows up differently depending on the channel, in person at a point of sale, or online where identity is harder to confirm.

• Most exposed: You sell CBD at all, irrespective of THC level. Differences in regulation across markets mean merchants must take additional steps to ensure products are marketed and sold responsibly.
• Common mistake: Not examining who actually acquires the product. If you sell online, the failure is not verifying that the person buying is the person to whom the product is delivered.

7. Is your product authorised as a novel food?

CBD extracts and isolates are classified as novel foods in Great Britain, which means they require authorisation before sale. The Food Standards Agency maintains a Public List of CBD products linked to a valid novel food application; products not on that list should be withdrawn from sale. Northern Ireland follows a separate pathway (the Windsor Framework) through the European Commission rather than the FSA.

• Most exposed: This applies to ingestible CBD only, oils, capsules, gummies, and supplements, not topicals or cosmetics, which sit under different regulation. You're most exposed if your product isn't linked to a validated application, or if you sell into Northern Ireland without accounting for its separate EU-governed process.
• Common mistake: Assuming novel food status is a formality, since so many CBD products are already on shelves. It isn't. It can be “provisionally tolerated” but yet not authorised.

How to build a more resilient CBD payments strategy

Securing an account is only half the problem. Keeping payment processing stable, and recovering quickly when a relationship ends, is what separates businesses that scale from those that stall.

What to do after losing a processing relationship

Depending on a single processing relationship is the core vulnerability. Losing it is far more damaging when you have no fallback, unless the dispute involves a card scheme such as Mastercard or Visa, in which case it can affect every provider relationship you hold.

How you recover depends heavily on why the relationship ended. A termination driven by insufficient transaction volume demands a different response than one driven by a risk concern. Across both, the recurring failure is communication and business re-alignment. Newer businesses in particular take time to reach a level of operation that satisfies a provider, and the friction usually centres on transaction costs.

Plan for this scenario before it happens. Build the response into your internal policies and procedures in advance, so you know exactly how to act when a relationship ends, rather than improvising under pressure.

Proactive habits that protect account stability

Account stability comes down to maintaining customer due diligence under a robust AML/CFT programme, with ongoing monitoring throughout every customer relationship. Extend that risk-based approach beyond AML/CFT into technical operations, responsible marketing, and outsourcing arrangements.

The risk of freezes, holds, and terminations isn't abstract. Mastercard's Excessive Chargeback Merchant programme flags any account with 100 or more chargebacks and a 1.5% chargeback ratio in a single month. Left unresolved, fines escalate from there, reaching $100,000 to $200,000 a month once non-compliance passes 19 months, per JPMorgan Chase's guide to the programme. Every business relationship carries that level of risk, and it needs to be understood and mitigated well before it gets there.

Documentation to keep continuously updated

Many businesses only maintain documentation when the law compels them to, which is a problem where CBD regulation is thin or absent. In that vacuum, look at what other regulated, specialist-category businesses maintain. At minimum, keep:

• Customer documentation records.
• Transaction records.
• IP records.
• Payment-method records.
• Customer-behaviour records, particularly for non-face-to-face sales.

Hold these records alongside internal policies and procedures across every department, under the oversight of a legal and compliance function, with mandated annual updates. Where no update is needed, document the review anyway. The record most businesses let slip is customer-behaviour monitoring in non-face-to-face environments, precisely where identity and intent are hardest to verify.

Where the payment gateway fits

Every hurdle in this guide sits on the merchant account side: the relationship where funds settle, and where CBD's risk classification does the most damage. But a merchant account on its own doesn't move money. It needs a payment gateway, the software layer that actually processes each transaction, configured correctly alongside it.

» See how that side of the equation works in practice with our guide on CBD card acceptance in the UK and EEA

How Fibonatix approaches CBD merchant accounts

Fibonatix offers its payment gateway, Paragon, to businesses across the UK and EEA, including specialist categories such as CBD. Its gateway supports card processing for Visa and Mastercard with PCI DSS compliance, alongside Pay by Link and a virtual terminal for MOTO transactions. It also handles recurring billing and automated rebilling for subscription models, with fraud prevention and chargeback risk management built into every transaction.

Merchants get reporting and transaction monitoring as standard, plus integrations with existing systems. Support comes from a named account manager, not an anonymous queue.

If you're still searching for the merchant account side of this equation, the hurdles above are the questions worth putting to any prospective provider. Fibonatix can tell you what it offers on the gateway; it can't answer for accounts it doesn't hold.

Fibonatix (UK) Limited, company number 09738892, is authorised and regulated by the UK Financial Conduct Authority (FCA) as a Payment Institution (FRN 768776).