Cannabis and CBD Payments: Cashless ATMS and more
Cannabis, CBD, and hemp companies, whether dispensaries, growers, or other merchants, face incredible obstacles to even operating a business. Processing payments adds even more complications, as cannabis is still considered a Schedule 1 controlled substance under federal law.
Because merchants cannot access the traditional card networks, they rely on a combination of cash, bank transfers, and cashless ATM transactions through the debit card rails for payments.
Cashless ATM or point-of-banking transactions are used in environments where traditional credit and debit card processing may be limited or restricted. These are very common among CBD and cannabis dispensaries. When a cashless ATM transaction is initiated, it is processed as an ATM withdrawal. Instead of receiving cash, the receipt shows the withdrawal amount, and the merchant receives the transaction amount in their bank account.
Hemp, on the other hand, has fewer payment restrictions compared to cannabis and therefore, can be purchased through credit card networks.
Cashless ATM transactions
A cashless ATM transaction operates on the same principle as ‘cash back’ options when shopping at a convenience store. The consumer uses their debit card to request a withdrawal from their bank, but the requested amount is delivered to the merchant’s account rather than disbursed as cash.
In this way, no cash needs to change hands, and the merchant need not be immediately identified as high-risk, as it is a cash withdrawal rather than a purchase. While this certainly has been a clever workaround for some time, there are some drawbacks, including:
- Customers generally must choose to ‘withdraw’ cash in $10 - $20 increments (much as they would at a regular ATM). Merchants must, therefore, have change available, even though the transaction is theoretically cashless.
- Because the practice has teetered on the edge of unethical (often the address provided as part of the withdrawal, for instance, is not that of the dispensary itself), many of the largest ATM processors have opted to withdraw support for cashless ATMs.
Tier 1 Risk Levels & MCC Codes
According to the Visa Integrity Risk Program (VIRP), cannabis and CBD merchants or dispensaries often fall under MCC 5912, a tier 1 industry that broadly covers pharmacies and drug stores. According to the Visa Integrity Risk Program guide, “Tier 1” high integrity risk merchants have a higher risk of illegal activity occurring if the proper controls aren’t in place, and any potential illegal activity that occurs could cause significant harm to the health and safety of individuals.
Tier 1 is the most highly regulated tier for these reasons.
However, Mastercard does not have a dedicated MCC for cannabis merchants. Mastercard requires cannabis merchants to be properly registered and categorizes them based on their primary business focus, using existing MCCs like 5411 (Grocery Stores) or 5999 (Miscellaneous Retail).
What’s even more complex is that CBD merchants (those that exclusively sell products under 0.3% THC) fall under MCC 5499 for specialty markets and convenience stores. CBD merchants have significantly fewer payment restrictions, but their services are still highly regulated.
If a merchant has more than one line of business, they must use the MCC for the line of business with the highest sales volume, or have different MCCs for each line of business.
Therefore, if a dispensary also sells less merchandise than they do marijuana, it can’t simply get a merchant account under a non-cannabis business category and process cannabis sales under that account. This would be a fast track to getting shut down.
And even if marijuana is a small proportion of the revenue, the card networks may still shut down the account if it is used to process marijuana sales.
Regardless, merchants in any sector of the broader cannabis industry can expect to be categorized as “High-Brand Risk Merchants” or “high-risk merchants.”
Best Payment Practices for High-Risk Payment Processing
Implementing the right strategies can ensure that high-risk merchants are able to process payments successfully and thrive. Managing payments in a highly regulated environment is not the time or place to DIY or “figure it out.”
Best practices all high-risk merchants in this space should follow include:
- Understanding Industry Regulations: Knowing the standards that card networks and PSPs have regarding chargebacks and disputes, fraud prevention, reporting and compliance, and state-specific cannabis, hemp, and CBD industry trends will help keep the business operational even as the industry evolves.
- Work with Multiple PSPs: Partner with reputable and experienced payment processors that offer high-risk merchant accounts and have a history of working successfully with hemp and CBD merchants in your state or territory. Route payments accordingly.
- Provide Clear Communication: Make it easy for prospective customers and partners to understand exactly what your business is, how payments work, and what the terms of use are. This will make it significantly easier not only for you to fight for yourself in the event of fraud but also for your partners to do the same.
- Effective Customer Service: Great customer service should be table stakes for most businesses, and especially for merchants in high-risk sectors. Ensure that inquiries into refunds, cancellations, issues, or general questions get addressed promptly and clearly to keep chargebacks low.
- Maintain PCI DSS Compliance: Any merchant that handles sensitive card information must be—and work with partners who are—PCI compliant.
Hemp and CBD Payment Restrictions
The Farm Bill of 2018 authorized the production of hemp and removed hemp and hemp seeds from the DEA schedule of Controlled Substances. Hemp is a variety of the Cannabis sativa plant, bred to contain very low levels of tetrahydrocannabinol (THC), the psychoactive compound in marijuana. CBD, a cannabinoid compound found in both hemp and marijuana, can be extracted from the stalks, leaves, and flowers of the hemp plant. When extracted from hemp, CBD contains less than 0.3% THC, therefore making it legal for sale.
It was a bit of the “wild west” in the early days of hemp and CBD legalization, with some large banks and processors accepting these merchant accounts, then a few years later, exiting the space. Because many acquirers didn’t understand the high-risk merchant environment related to the CBD industry, it took a significant effort on all parties to understand and achieve compliance.
Today, CBD credit card processing has become a niche market served by a few specialty high-risk payment processors. Getting a CBD merchant services account is challenging but achievable for businesses that diligently achieve and maintain compliance.
Working with Basis Theory as a CBD or Cannabis Merchant
Basis Theory will assist high-risk merchants who want to secure their payments, achieve PCI compliance, and maintain ownership over their payment data.
Outsourcing your CDE to Basis Theory not only removes a significant portion of maintaining compliance, but it also provides freedom in the form of network-agnostic tokens that growing merchants can use with any PSP, partner, or network.
As an example, a CBD company reached out to Basis Theory after hearing Stripe would shut them down. When the owner logged into his Stripe dashboard, he found a red warning that said he’d be able to transact for another 14 days but could not take any disbursements for 90 days. This, essentially, informed this CBD company that they’d need to stop using Stripe to accept payments.
The owner had two options: reach out to anyone and everyone who might be able to help get calls with the right people at Stripe or build redundancies.
“I need redundancy. In the same way we learned during the SVB fallout that you should have an account with two banks. At best or worst, I've now learned that we should have two MIDs to prevent frantic work to get back up and running,” the owner said.
By partnering with a solution like Basis Theory, they—and other CBD merchants—can continue transacting and have the security of a fallback PSP in the event of a shutdown.
