The 2026 CBD Payments Reckoning: What MJBizDaily Says Is Disappearing

The Short Answer

CBD payment processing workarounds refers to the improvised payment solutions hemp merchants built after mainstream processors - Square, Stripe, Shopify Payments, PayPal - exited the category or began flagging accounts.

In 2026, those workarounds are failing. Grandfathered accounts are being reviewed and closed. DBA structures are being discovered when banks cross-reference articles of incorporation. Gray-market account rentals violate TOS and create fraud exposure. The workarounds were never stable - they were gap-fillers in a market that refused to properly underwrite CBD.

What is replacing them is a two-track answer. The first track is purpose-built high-risk card processing: processors that explicitly underwrite hemp and cannabinoid merchants, require Certificates of Analysis and farm-bill compliance documentation, and build the merchant relationship on disclosed terms - not easy approvals that collapse at the first quarterly review. The second track is ACH and eCheck processing, which sit outside card network acceptable-use enforcement entirely and allow CBD businesses to accept bank-based payments without exposure to Visa or Mastercard policy changes.

According to merchant discussions in r/ecommerce spanning more than eight years, the access problem for CBD businesses is not new - and the pattern of processor entry followed by sudden exit is the recurring threat that every workaround eventually runs into. The only durable path is a processor that has chosen to serve the category deliberately, with underwriting that matches what the category actually requires.

Why Is CBD Payment Processing Still So Difficult in 2026?

CBD payment access has always been fragile. Mainstream processors retain full discretion to exit the category, and they use FDA and FTC health-claim rules as the trigger.

I call it the enter-then-exit cycle, and it is the most important framework for any CBD merchant evaluating a processor today. A payment company enters the hemp space - sometimes aggressively, onboarding merchants fast - and then exits when the chargeback rate climbs, when a regulator raises concern, or when internal risk managers finally review what the underwriting team approved. The merchant is left scrambling. The cycle then repeats with the next processor willing to try, as of July 2026.

The clearest example is Elavon. In fall 2018, Elavon began offering CBD merchant services and onboarded thousands of CBD merchants in a matter of months. Merchants described it as a turning point - a credible, bank-affiliated processor finally treating hemp as a legitimate business category. Then in February 2019, those same merchants received notice that Elavon would no longer register new accounts. Existing accounts were set to close on May 15, 2019. Dee Dee Taylor, owner of the retail store 502 Hemp, described the announcement to WFPL News as a scramble: "You can't have a retail store and not have credit card processing. You just can't." Elavon's stated reason was regulatory uncertainty. The contributing factor, reported by US Bank, was that some CBD merchants had concealed that they were also selling federally illegal THC products, causing excessive chargebacks and fraud. One poor actor's behavior was enough to end the program for everyone.

That pattern has repeated across every major processor since. According to merchants posting in r/ecommerce, Square held funds for 2 years for a seller offering only compliant CBD products, while the account owner considered legal action. Square, which used to be described as the good alternative when other processors refused, stopped accepting CBD. A merchant who had used Square since 2019 reported being shut down with the explanation that the block was "due to 'unsubstantial health or therapeutic claims, which are prohibited by FDA and FTC guidelines.'"

An analysis of merchant accounts across payment processing communities spanning 2018 to 2026 shows the same three-stage pattern: initial approval, growing friction over health claims, and eventual account termination - with funds held during the transition.

A common misconception is that the difficulty stems from something merchants are doing wrong. According to r/smallbusiness merchant reports, Square's health-claim criteria are applied far more broadly than actual FDA regulations. One merchant passed annual bank and state audits and passed Square's own yearly reviews - then was flagged for "medical claims" on a link pointing to a completely different, unrelated company's website. The enforcement was not triggered by the merchant's own content at all. Another merchant described using Square for six years before facing the same shutdown cycle "several times, last year." As one merchant put it plainly: "everyone eventually gets flagged."

Banking access has the same structure. A Texas CBD startup I have heard described the experience of being rejected by bank after bank with zero explanation before finally getting one out-of-state institution to quote terms: $1,500 to open the account, $250 per month in maintenance fees, and a minimum $10,000 deposit. That is the cost of access for a compliant, legal hemp retailer. Square launched a CBD payments pilot at roughly the same time and reportedly stopped accepting new applications before it scaled.

The deeper issue is an equity gap. Large corporate chains - Rite Aid, CVS, Nordstrom - have access to mainstream merchant services for the same CBD products that small and medium businesses are denied. The products are the same. The regulatory environment is the same. The difference is that large retailers have enough leverage, legal resources, and transaction volume to negotiate the relationship. Independent CBD operators do not.

Getting approved is not the same as having stable processing. That single distinction is where most CBD payment strategies fail - and it is the first thing I would want any hemp merchant to understand before choosing their next processor.

What CBD Payment Workarounds Are Still Working - and Which Ones Are Closing Off?

Merchants who lost mainstream processors did not stop selling. They found workarounds - some legitimate, some not - and those workarounds have been quietly failing one by one.

From what I have seen, there are four responses merchants typically reach for after a Stripe or Square deplatforming. Each has a distinct risk profile, and only one of them is still viable in 2026.

The first workaround is renting aged, verified PayPal or Stripe accounts from third-party providers. The logic is that an established account avoids the new-account flags that trip up fresh CBD registrations. In practice, this is a terms-of-service violation for both platforms - and it creates a fraud vector that can expose the merchant to account investigation rather than just deplatforming. When this approach was surfaced in a small business payment forum, a payment processing specialist called it "a very unique idea, I'll admit I've never heard before" - not an endorsement. Account rentals are also inherently unstable: you are one platform audit away from losing both the rented account and whatever funds were settling through it. The takeaway is simple. Renting someone else's account does not solve the underlying problem. It moves the risk to a place with no legal protection.

The second workaround is switching to direct bank transfers only - telling customers to pay via ACH directly. According to merchants in r/PaymentProcessing, some cannabinoid sellers have operated this way while seeking a longer-term card solution. Direct transfer-only works for repeat buyers who trust you. It does not work for new customers or e-commerce conversion rates that depend on instant, card-at-checkout convenience.

The third approach is offshore or high-risk specialist processors. This is the most legitimate of the workarounds, but it comes with a pricing barrier that has historically excluded most small operators. Processing rates in the CBD category were running at 5% + $0.30 per transaction at the height of the 2019 access crisis, with offshore and domestic specialist solutions requiring minimum monthly volumes of $50,000 to $150,000 to even qualify. A retailer doing $20,000 per month had no path to those programs at all.

The fourth workaround is staying on a grandfathered account - a Square, Authorize.net, or similar account that predates the current enforcement stance. According to r/ecommerce merchant accounts, one CBD seller described being kicked off Shopify Payments and calling the forced migration "a blessing in disguise" because it drove them to a properly underwritten high-risk merchant account. But the merchants still on grandfathered arrangements have a different problem: those accounts are under periodic review, and enforcement has intensified. In the words of one payment developer reporting on their US CBD clients using Authorize.net and Square: "not sure if either is grandfathered in." That uncertainty is the product. Every quarter of operation is borrowed time.

What is replacing these workarounds is not another loophole. According to specialists posting in r/PaymentProcessing, the merchants who maintain stable CBD card processing are using processors that explicitly support the category - with real underwriting, not just easy onboarding. Getting into one of these programs is slower than renting an account. The result is a payment relationship that does not collapse at the first quarterly review. In practice, that distinction is worth far more than the rate savings of a shortcut that fails.

Which Payment Processing Companies Actually Work for High-Risk E-Commerce in 2026?

The processors that work for CBD and high-risk e-commerce in 2026 share one characteristic: they underwrote the category deliberately rather than approved it quietly.

The conventional read is that payment access is disappearing. I think the reality is more useful: the market is professionalizing. The same enforcement pressure that ended Elavon's CBD program and tightened Square's health-claim rules has also created the conditions for a different kind of processor - one built from the underwriting up to serve regulated categories, not one that onboarded them opportunistically and then retreated.

The shift in how chartered banks approach controlled payment categories is visible in adjacent infrastructure. According to Digital Transactions, Cross River Bank - a chartered bank based in Fort Lee, New Jersey - announced on July 2, 2026 a partnership with Stripe on a card issuance project that builds bank-grade controls directly into the payment layer, including single-use virtual cards and user-authorization limits on what an account can process. Gilles Gade, Cross River's founder and CEO, stated: "Consumers and businesses are increasingly relying on agents to act on their behalf, but the payments infrastructure has not kept pace." The implication is that what lacked before - deliberate underwriting controls built into the issuing layer rather than patched on after the fact - is now being built. In practice, this kind of bank-fintech architecture is where stable high-risk payment access eventually gets built.

The same principle applies to bank-to-bank payment rails. In other regulated categories, the move away from card dependency has accelerated. According to GoCardless, recurring bank-to-bank payment infrastructure is being professionalized across sectors where card networks historically created friction - precisely because bank-to-bank transfers are outside the card network enforcement layer that trips CBD merchants. The takeaway for hemp businesses is direct: ACH and eCheck processing is not a workaround. It is a different rail with a different risk profile.

For CBD merchants specifically, the practical alternatives in 2026 come down to three categories.

The first is purpose-built high-risk card processing with explicit underwriting. These are processors that review your product list, your website, your COAs (certificates of analysis), and your volume history before approving you - and that is the point. The underwriting process is what protects the merchant relationship. Approval is slower than a gray-market rental. It is also not reversible at the first quarterly review.

The second is ACH and eCheck processing. For card-not-present CBD sales, ACH is the most stable rail available today. It sits outside card network acceptable-use enforcement entirely. A CBD business processing via ACH is not exposed to Visa or Mastercard policy changes. The trade-off is checkout conversion - ACH checkout adds friction for first-time buyers accustomed to card-at-click. The merchants I have seen build it successfully treat ACH as the primary rail for repeat buyers and combine it with a properly underwritten card option for new customer acquisition.

The third is a multi-rail stack. Processors experienced with CBD now commonly recommend carrying at least two payment options - a high-risk card merchant account and an ACH alternative - so that if one rail encounters enforcement pressure, the other keeps the business running. This is not theoretical redundancy. For a CBD business that built its operation on a single mainstream account, a single deplatforming can mean weeks without the ability to take payments.

Getting approved is the beginning of the evaluation, not the end of it. The right question to ask any processor is not "Do you accept CBD?" but "What happens to my account and my settlement if your underwriting bank changes its category policy?" The answer to that second question tells you everything about whether the relationship will last.

What Will Define CBD and High-Risk Payment Access Over the Next 12-24 Months?

The core dynamic for the next two years is not whether CBD businesses can get approved - it is whether the processor approving them can sustain that commitment through the next enforcement cycle.

Three signals stand out to me when I look at where this is heading.

What most buyers miss: the popular assumption is that high-risk payment access is disappearing. I think that is wrong. What is disappearing is cheap, easy, undisclosed access - the gray-market gap-fillers that never had stable underwriting behind them. The processors that remain and grow in this space will be more expensive and require more compliance documentation. That is not a worse market. It is a more honest one, and the businesses that engage with it now will have a structural advantage over the ones still searching for a workaround in 2027.

What Does Stable CBD Payment Processing Actually Look Like in 2026?

Stable CBD processing means documented underwriting, disclosed pricing, and a processor that will not exit the category under the same pressure that closed Elavon in May 2019.

I want to reframe something that gets lost in the frustration: the problem is not that CBD merchants cannot get approved. The problem is that approval and stability are not the same thing. Getting a merchant account is easy. Keeping one - through a quarterly risk review, through a Visa or Mastercard policy update, through a new bank compliance audit - is where the model fails. According to discussions spanning more than eight years in r/ecommerce, merchants who held Square accounts through repeated health-claim enforcement cycles found their funds frozen for two full years even when their products were fully Farm Bill compliant. Approval did not protect them. Compliance documentation did not protect them. What they lacked was a processor who had actually underwritten the category.

Stability has three requirements. First, the processor must explicitly underwrite hemp and cannabinoid products - not simply approve the account pending review. Second, the pricing and reserve structure must be disclosed upfront; processors that offer "easy approval" rates that adjust at the first chargeback threshold are replicating the same conditions that caused the enter-then-exit cycle. Third, the merchant needs a fallback rail. When card network policy shifts - and it will shift again - ACH and eCheck processing provide a parallel channel that sits entirely outside Visa and Mastercard enforcement.

That last point matters more than it gets credit for. The merchants who fared best through the Elavon closure, through Square's enforcement wave, and through the broader tightening that followed were the ones who had already built a second payment lane. Not as a workaround - as architecture. I've seen the difference in practice: a business with two operational rails absorbs a card processor exit as an inconvenience. A business with one rail treats it as an emergency.

The sectors being asked these questions today - peptides, GLP-1, nutraceuticals - are in the position CBD merchants were in 2018. The same pattern is beginning. The merchants who act on multi-rail infrastructure now will not be the ones scrambling for a workaround two years from now.