CBD payment gateway
A CBD payment gateway is the piece that carries an online hemp sale from your checkout to a merchant account that actually allows the product. The gateway is plumbing. The account behind it is the part that gets shut off, which is why buying one without the other is how most CBD stores end up stranded mid-season.
What does a CBD payment gateway actually do?
People use the word gateway to mean the whole payment stack, and that confusion is where the trouble starts. Five separate pieces have to agree before an online hemp order clears:
- The checkout on your site, which collects the card details
- The gateway, which encrypts and carries that transaction to the processor
- The merchant account, which is where the money lands and where the risk sits
- The sponsor bank behind the account, which decides your category is acceptable
- The platform your store runs on, which has its own policy about all of the above
A gateway that supports your category is easy to find. A sponsor bank that supports it is the scarce part, and it is the part nobody advertises. When a CBD store loses payments overnight, the gateway almost never failed. The account behind it did. The mechanics are laid out on CBD merchant accounts and high-risk processing.
A few practical things are worth insisting on while the account is being set up. Keep the gateway account in your own business name so you can move processors without rebuilding checkout. Ask whether a backup processing route is available, because a single point of failure in a seasonal business is expensive. And make sure your subscription or refill billing is disclosed clearly at checkout, since unclear recurring charges are one of the fastest ways to collect disputes.
Why do Stripe, Square and PayPal turn CBD stores off?
Because they are aggregators. They put thousands of merchants under one umbrella arrangement, which makes signup fast and makes exceptions impossible. Their published prohibited-business policies exclude CBD and related products, so the decision is made before anyone reads your lab results. Enforcement is usually automatic, arrives without warning, and can include a hold on funds already collected.
None of that means your product is illegal. Hemp has been federally legal since the 2018 Farm Bill, which defines it as cannabis containing no more than 0.3% delta-9 THC on a dry weight basis. The gap between legal and bankable is a policy gap, not a legal one. We take it apart on why PayPal bans CBD, what makes CBD high risk and is CBD legal to sell online.
Can I sell CBD on Shopify?
You can build the store on Shopify. What you cannot do is run those sales through Shopify Payments, which follows the same aggregator logic as the others. Shopify does allow approved third-party gateways for hemp and CBD sellers, so the practical setup is your Shopify storefront connected to a gateway that feeds a merchant account boarded for your category.
The same shape works on WooCommerce, BigCommerce and most custom carts. Platform policies change, so confirm the current rule with the platform before you build around it rather than trusting a forum post from two years ago. What stays constant is the requirement underneath: a real merchant account with a bank that knows what you sell.
What does underwriting want to see from an online store?
Your site, first. Underwriters read the storefront the way a customer would, and they look for claims that create risk: anything that reads as a medical promise, anything that implies a cure, and any product page that contradicts your lab results. Certificates of analysis from a third-party lab, clear ingredient labelling and a visible refund policy do more for an application than a polished pitch deck.
Then the basics: business documents, ownership, processing history if you have it, and an honest description of everything you sell. If you also carry kratom or smokable hemp, say so at the start, because adding a category after boarding is a common way to lose a working account. See kratom merchant accounts and hemp merchant accounts.
There is no published rate card on this site, because we would be inventing the numbers. Terms depend on your volume, your product mix, your chargeback history and the bank that takes the file. What we will do is put the real terms in front of you in writing before you sign anything. If you sell in a shop as well as online, the counter side is covered on smoke shop POS. When you are ready, send us your store and we will tell you where it stands.
How do you cut card-not-present fraud without losing sales?
Selling online means you never see the card, so the gateway is where your fraud controls live. Turn them all to maximum and you decline good customers. Turn them off and you fund somebody's test run with stolen cards. The work is finding the setting that fits your basket and your season, and then reviewing it rather than forgetting it.
The tools worth having on from day one:
- Address and security code checks, so a card number alone is not enough
- Cardholder authentication at checkout, which can shift dispute liability on fraud claims
- Velocity rules that flag the same card or address hitting your store repeatedly
- Block lists for the addresses and emails that already cost you money
- A manual review queue for large or odd orders, before they ship rather than after
Watch the decline reports as closely as the approvals. A rule that quietly kills every order from one region is expensive in a way nobody notices. And keep the rules written down, because the person tightening them after a bad weekend is rarely the person who set them.
How does an online dispute work, and what evidence wins one?
A chargeback starts with the cardholder calling their own bank, not you. That bank pulls the money back out of your settlement and sends a reason code, and you get a window to respond. Most online sellers lose disputes they could have won, because nobody assembled the evidence while it was easy to find.
For a card-not-present sale, the evidence pack is specific. The order record with the address and security-code match results. The delivery confirmation, and a signature if you have one. The terms the customer accepted, with the timestamp. Any support messages, especially ones where the customer acknowledged the order. If a subscription was involved, the renewal notice you sent and the cancellation option you offered.
The version that costs hemp stores most is friendly fraud, where the customer got the product, kept it, and disputed anyway. Usually the descriptor on their statement meant nothing to them, or a refill renewed unnoticed, or your refund form looked slower than a phone call. Fix the descriptor, make refunds easy, confirm every renewal, and answer support fast. Your dispute ratio is watched harder in this category than in ordinary retail, because the networks run monitoring programs against it and your account is already the one under review.
What breaks when you move to a different processor?
The account changes and the checkout has to follow, which is where the avoidable damage happens. Sequence it so the new account is boarded and tested with a live transaction before anything on your site changes, then move the checkout, then leave the old account open long enough to absorb refunds and disputes on its own sales.
These are the things that break in practice:
- Saved card tokens do not transfer, so recurring customers need re-entry or a token export
- Subscription schedules have to be rebuilt and tested before the next billing date
- Webhooks and order confirmations point at the old gateway until someone repoints them
- Refunds on old sales must go back through the account that took them
- Anything hard-coded into a theme or a plugin breaks quietly at checkout
Put a test order through every path before you announce anything: one-off purchase, subscription signup, refund, and a partial refund. Then check the descriptor on a real statement rather than trusting the setting. The account side of a switch is on CBD merchant accounts and high-risk processing.
How do you reconcile a gateway bill against a processor statement?
Online sellers get charged in two places, and almost nobody reads both. The processor statement covers the card network costs and the markup on your volume. The gateway bill covers the software: a monthly charge, a per-transaction charge, and whatever fraud tools, tokenisation or virtual terminal features you enabled. Judging one without the other is how a cheap-looking quote stays cheap-looking.
Do the arithmetic once a month. Add every charge from both bills, divide by the card volume you actually ran, and you have your effective cost for the month. That single figure is the only fair way to compare offers, and it is the one a headline rate cannot flatter. Track it across months, not in isolation.
Then hunt for the lines nobody explained. A monthly minimum that charges you for a slow month. A statement fee and a batch fee. A compliance non-compliance charge because the questionnaire never got filed. A fee per dispute whether you win or lose. Ask for every unexplained line in writing, and compare two months side by side. If your effective cost drifted upward while your sales mix stayed the same, something was reclassified and you are owed an explanation. More on what drives processing cost.
What online hemp sellers ask before they build
Do I need a separate gateway and merchant account, or one provider for both?
Either can work, but keep the gateway account in your own business name. A gateway held in a reseller name is what turns a processor change into a checkout rebuild. Ask who the account holder is on the paperwork, not just who supports it.
Can I keep my Shopify store if Shopify Payments will not take CBD?
Yes. You keep the storefront and connect an approved third-party gateway that feeds a merchant account boarded for hemp and CBD. The same shape works on WooCommerce, BigCommerce and most custom carts. Confirm the current platform rule directly with the platform before building around it, since these policies change.
Will my checkout look like a high-risk checkout to customers?
It should not. A properly boarded account with a hosted or embedded gateway looks like any other card form, and the brand on the page stays yours. What customers do notice is the descriptor on their statement, so make sure it names your store rather than a processor nobody recognises.
Can I take recurring or subscription payments for refills?
Yes, and it is one of the things worth setting up carefully rather than quickly. Disclose the renewal terms at checkout, send a notice before each charge, and make cancelling easy to find. Unclear recurring billing is the fastest way to collect disputes in this category, and disputes are what put an account under review.
What happens to my checkout if the account behind it gets closed?
The gateway keeps working and the transactions start declining, which is why the failure feels like a technical problem when it is not. Settled funds are normally held while the bank works out its remaining exposure. Ask before you sign how a hold works and how long it runs, and keep a second processing route in mind if your season is short.
Do I still need to worry about PCI compliance?
Yes, though a hosted or tokenised checkout keeps card data out of your systems and narrows what you are responsible for. You will still be asked to complete a compliance questionnaire, and skipping it usually shows up as a non-compliance charge on your statement. Ask your provider which questionnaire applies to your setup.
The platform-specific version is on Shopify CBD payments, and more answers sit on our FAQ.
Get your online checkout on solid ground
Send us your CBD store and a Rooted Payments specialist reviews the checkout, the gateway and what a sponsor bank will want to see before boarding it.