.png?width=365&height=122&name=BTLogo%20(1).png)
Cannabis and CBD Payments: Eliminating a Single Point of Failure
Cannabis, CBD, and hemp companies don’t have the luxury of assuming their payment processor will be there tomorrow.
Whether you’re operating as a dispensary, grower, or another merchant in the high-risk space, you’re forced to overcome incredible obstacles to even operate a business. Processing payments adds even more complications.
One cannabis and CBD merchant realized this when he opened his Stripe dashboard to find a red banner: 14 days left to transact, 90 days before any disbursements. His first instinct was to call Stripe. His second, and more productive instinct, was to build redundancy.
“I need redundancy. In the same way we learned during the SVB fallout that you should have an account with two banks. At best or worst, I've now learned that we should have two MIDs to prevent frantic work to get back up and running,” the owner said.
That lesson—eliminating a single point of failure before being forced to—is the most important point of this post.
What does redundancy mean with payments?
Building redundancy means two things: working with multiple payment service providers (PSPs), and owning your payment data independently of all of them.
That second part is where most high-risk merchants have a blind spot. If your payment data lives inside a processor vault, a shutdown doesn't just mean finding a new PSP—it means starting over. Your customers will need to re-enter their payment information, your recurring billing will break, and you'll be rebuilding from scratch under the worst possible pressure.
Tokenizing card data through an independent vault solves this. When payment data is stored outside of any single processor relationship, it travels with you. A new PSP can be connected without re-collecting payment details from a single customer. Transactions keep routing. Revenue keeps flowing.
Maxio experienced this firsthand when the company planned to expand into new markets with new payment methods. Rather than face a potentially seven-figure migration cost, the company's GM of Partnerships and Payments said they built their payments infrastructure to swap pieces in and out as needed.
“Many providers hold tokens hostage in an attempt to prevent you from leaving their platform,” says Jon Cochrane, GM of Partnerships and Payments at Maxio. “Because we had Basis Theory in place, this was a non-issue. We could simply focus on creating the best product experience for our customers. Without Basis Theory, that was a potential seven-figure problem for us.”
The stakes are even higher for high-risk merchants. A processor exit is an immediate threat to revenue. Owning your payment data independently isn't a nice-to-have. It's the difference between a shutdown notice being a 14-day crisis or an infrastructure change.
Cashless ATM transactions
Cashless ATM transactions are used in environments where traditional credit and debit card processing may be limited or restricted. These are very common among CBD and cannabis dispensaries. When a cashless ATM transaction is initiated, it is processed as an ATM withdrawal. Instead of receiving cash, the receipt shows the withdrawal amount, and the merchant receives the transaction amount in their bank account.
Hemp, on the other hand, has fewer payment restrictions compared to cannabis and therefore can be purchased through credit card networks.
A cashless ATM transaction operates on the same principle as ‘cash back’ options when shopping at a convenience store. The consumer uses their debit card to request a withdrawal from their bank, but the requested amount is delivered to the merchant’s account rather than disbursed as cash.
This way, no cash needs to change hands and the merchant need not be immediately identified as high-risk, as it is a cash withdrawal rather than a purchase. While this certainly has been a clever workaround for some time, there are some drawbacks. Customers generally must choose to ‘withdraw’ cash much like they would at a regular ATM. Merchants must, therefore, have change available, even though the transaction is theoretically cashless.
Tier 1 Risk Levels & MCC Codes
According to the Visa Integrity Risk Program (VIRP), cannabis and CBD merchants or dispensaries often fall under Merchant Category Code (MCC) 5912, a tier 1 industry that broadly covers pharmacies and drug stores.
According to the Visa Integrity Risk Program guide, “Tier 1” high-integrity risk merchants have a higher risk of illegal activity occurring if the proper controls aren’t in place, and any potential illegal activity that occurs could cause significant harm to the health and safety of individuals.
Tier 1 is the most highly regulated tier for these reasons.
However, Mastercard does not have a dedicated MCC for cannabis merchants. Mastercard requires cannabis merchants to be properly registered and categorizes them based on their primary business focus, using existing MCCs like 5411 (Grocery Stores) or 5999 (Miscellaneous Retail).
What’s even more complex is that CBD merchants (those that exclusively sell products under 0.3% THC) fall under MCC 5499 for specialty markets and convenience stores. CBD merchants have significantly fewer payment restrictions, but their services are still highly regulated.
If a merchant has more than one line of business, they must use the MCC for the line of business with the highest sales volume, or have different MCCs for each line of business.
Therefore, if a dispensary also sells less merchandise than they do marijuana, it can’t simply get a merchant account under a non-cannabis business category and process cannabis sales under that account. This would be a fast track to getting shut down.
And even if marijuana is a small proportion of the revenue, the card networks may still shut down the account if it is used to process marijuana sales.
Regardless, merchants in any sector of the broader cannabis industry can expect to be categorized as “High-Brand Risk Merchants” or “high-risk merchants.”
Hemp and CBD Payment Restrictions
The Farm Bill of 2018 authorized the production of hemp and removed hemp and hemp seeds from the DEA schedule of Controlled Substances. Hemp is a variety of the Cannabis sativa plant, bred to contain very low levels of tetrahydrocannabinol (THC), the psychoactive compound in marijuana. CBD, a cannabinoid compound found in both hemp and marijuana, can be extracted from the stalks, leaves, and flowers of the hemp plant. When extracted from hemp, CBD contains less than 0.3% THC, therefore making it legal for sale.
It was a bit of the “wild west” in the early days of hemp and CBD legalization, with some large banks and processors accepting these merchant accounts, then a few years later, exiting the space. Because many acquirers didn’t understand the high-risk merchant environment related to the CBD industry, it took a significant effort on all parties to understand and achieve compliance.
Today, CBD credit card processing has become a niche market served by a few specialty high-risk payment processors. Getting a CBD merchant services account is challenging but achievable for businesses that diligently achieve and maintain compliance.
Best Payment Practices for High-Risk Payment Processing
Implementing the right strategies can ensure that high-risk merchants are able to process payments successfully and thrive. Managing payments in a highly regulated environment requires the right partners, infrastructure, and a clear understanding of where the risk lives. This is not a place to “figure it out.”
Best practices all high-risk merchants in this space should follow include:
- Understanding industry regulations: Knowing the standards that card networks and PSPs have regarding chargebacks and disputes, plus state-specific cannabis, hemp, and CBD industry trends will help keep the business operational even as the industry evolves.
- Work with multiple PSPs: Partner with reputable and experienced payment processors that offer high-risk merchant accounts and have a history of working successfully with hemp and CBD merchants.
- Provide clear communication: Make it easy for prospective customers and partners to understand exactly what your business is, how payments work, and what the terms of use are. This will make it significantly easier not only for you to fight fraud on your own but also for your partners to do the same.
- Resolve disputes and chargebacks quickly: High-risk merchants face tighter processor scrutiny, and unresolved chargebacks are one of the fastest ways to trigger an account review or termination. Clear refund policies, responsive support, and documented transaction records are your best defense.
- Maintain PCI DSS compliance: Any merchant that handles sensitive card information must be—and work with partners who are—PCI compliant.
Basis Theory gives cannabis, CBD, and hemp merchants the infrastructure to never be one processor decision away from a revenue disruption. By outsourcing your Cardholder Data Environment (CDE) to Basis Theory, you reduce your PCI compliance scope by over 90% while retaining full ownership of your payment data—portable, network-agnostic, and ready to route to any PSP, partner, or gateway.
When the next red banner appears in someone else's dashboard, your business keeps running. Talk to our team about eliminating your single point of failure.
