Cannabis and CBD Merchants: Payments Best Practices

Payments for cannabis and hemp companies, whether dispensaries, growers, or other merchants, can be quite complex.

Unfortunately for those in the business, cannabis, whether medical or recreational, cannot be purchased via credit card in the United States. However, these merchants may still have the ability to process payments via specialized secured payment processing.

Broadly speaking, the current dispensary payment options in the United States include:

• Debit card processing (for in-store ad delivery)
• Online payments (using ACH)
• Cash (includes ATMs and cashless ATMs)

Hemp, on the other hand, has fewer payment restrictions than cannabis, and therefore can be purchased via credit card payments. Let's dive into all the specifics.

What are the Payment Risks for Cannabis Merchants?

According to the Visa Integrity Risk Program (VIRP), cannabis merchants and dispensaries often fall under MCC 5912, which is a tier 1 industry that broadly covers pharmacies and drug stores. According to the Visa Integrity Risk Program guide, “Tier 1” high integrity risk merchants have a higher risk of illegal activity occurring if the proper controls aren’t in place, and any potential illegal activity that occurs could cause significant harm to the health and safety of individuals. Tier 1 is the most highly regulated tier for these reasons.

However, Mastercard does not have a dedicated MCC for cannabis merchants. Mastercard requires cannabis merchants to be properly registered and categorizes these merchants based on their primary business focus, using existing MCCs like 5411 (Grocery Stores) or 5999 (Miscellaneous Retail).

What’s even more complex is that CBD merchants (those that exclusively sell products under 0.3% THC) fall under MCC 5499 for specialty markets and convenience stores. These merchants have significantly fewer payments restrictions but are still highly regulated.

Regardless, merchants in any sector of the broader cannabis industry are usually categorized as “High-Brand Risk Merchants” or “high-risk merchants”. 

Business and Sales Model Risks

Cannabis merchants may experience more prevalent business risks, which often makes PSPs apprehensive to do business with them. 

A breakdown of the risk factors into which issues may arise include:

Why Credit Card Processing Isn’t An Option for Cannabis

Because cannabis is listed as a Schedule I drug by the United States Drug Enforcement Agency, the sale or possession of marijuana is still illegal according to Federal law. Therefore, it is not possible to sell marijuana via credit cards, as the card networks will not permit any transaction that violates Federal law.

However, the card networks require each merchant to be assigned a Merchant Category Code (MCC) based on their primary business activity based on annual sales volume. Because there is no MCC for cannabis sales in the United States, this classification can be tricky.

If a merchant has more than one line of business, they must use the MCC for the line of business with the highest sales volume, or have different MCCs for each line of business. Therefore, if a dispensary also sells less merchandise than they do marijuana, they can’t simply get a merchant account under a non-cannabis business category and process cannabis sales under that account. This would be a fast-lane to getting shut down. And even if marijuana is a small proportion of the revenue, the card networks may still shut down the account if it is used to process marijuana sales.

Fewer Payment Restrictions for CBD and Hemp

The Farm Bill of 2018 authorized the production of hemp and removed hemp and hemp seeds from the DEA schedule of Controlled Substances. Hemp is a variety of the Cannabis sativa plant, bred to contain very low levels of tetrahydrocannabinol (THC), the psychoactive compound in marijuana. CBD, a cannabinoid compound found in both hemp and marijuana, can be extracted from the stalks, leaves, and flowers of the hemp plant. When extracted from hemp, CBD contains less than 0.3% THC, therefore making it legal for sale.

It was a bit of the “wild west” in the early days of hemp and CBD legalization, with some large banks and processors accepting these merchant accounts, then a few years later, exiting the space. Because many acquirers didn’t understand the high-risk merchant environment related to the CBD industry, it was a significant effort on all parties to understand and achieve compliance.

Today, CBD credit card processing has become a niche market served by a few specialty high-risk payment processors. Getting a CBD merchant services account is challenging but achievable for businesses that diligently achieve and maintain compliance.

Best Practices of Successful Cannabis and CBD Merchants

It can be challenging to operate in a high-risk vertical due to the increased challenges of fraud, scrutiny, chargebacks, fees, and more. Implementing the right strategies, however, can ensure that these merchants not only operate successfully, but also thrive.

Best practices all high-risk merchants in this space should follow to become successful include:

• Understanding industry regulations: Becoming knowledgeable about the standards that card networks and PSPs have in place regarding chargebacks and disputes, fraud prevention, reporting and compliance, and state-specific cannabis, hemp, and CBD industry trends can ensure that your business remains operational even as the industry evolves.
• Choosing the right PSP(s): Partner with reputable and experienced payment processors that specialize in high-risk merchant accounts and have a history of working successfully with hemp and CBD merchants in your incorporated state or territory so that you have a partner in compliance.
• Providing clear communication: Make it easy for prospective customers and partners to understand exactly what your business is, how payments work, and what the terms of use are. It becomes significantly easier not only for you to fight for yourself in the event of fraud, but also for your partners to do the same.
• Offering best-in-class customer service: These days, great customer service should be table stakes for most businesses, and especially for merchants in high-risk sectors. Ensure that inquiries into refunds, cancellations, issues, or general questions are addressed promptly and clearly to keep chargebacks low.
• Maintaining PCI DSS compliance: Any merchant that handles sensitive card information must be - and work with partners that are - PCI compliant. With several partners in the market that can assist, it is easier than ever to achieve compliance for CBD merchants.
• Monitoring transactions and alerts: Regularly review transaction data to identify trends, patterns, and anomalies that may indicate potential fraud - and pay close attention to any alerts your payment partners share. High-performing merchants diagnose and address issues before they ever threaten business continuity.
• Leveraging specialty partners: Managing payments in a highly regulated environment is not the time or place to DIY or “figure it out”. Enlist trusted partners with expertise to assist with fraud management, compliance, security, and analytics.

How Basis Theory Helps Cannabis and CBD Merchants

Basis Theory can assist high-risk merchants that would like to secure their payments, achieve PCI compliance, and maintain ownership over their payments data. Outsourcing your CDE to Basis Theory not only takes away a significant portion of the burden to maintain compliance, but it also provides freedom in the form of network-agnostic tokens that growing merchants can use with any PSP, partner, or network.

A CBD company came to us after hearing from Stripe that they were going to be shut down. One day, the owner logged into his Stripe dashboard to find a red warning that said he’d be able to transact for another 14 days but could not take any disbursements for 90 days. This, essentially, informed this CBD company that they’d need to stop using Stripe to accept payments.

The owner had two options: reach out to anyone and everyone that might be able to help get calls with the right people at Stripe, or build redundancies.

“I need redundancy. The same way we learned during the SVB fallout that you should have an account with two banks. At best or worst, I've now learned that we should have two MIDs to prevent frantic work to get back up-and-running,” the owner said.

By partnering with a solution like Basis Theory, they - and other CBD merchants - are able to continue transacting and have the security of a fallback PSP in the event of any shutdown.