PayPal CBD policy: why the ban happens
The PayPal CBD policy is a prohibited-business rule, not a legal ruling. Aggregators put thousands of sellers under one shared merchant account, so they exclude whole categories instead of underwriting each seller. Hemp and CBD get excluded that way. Your product can be federally legal and still be outside their contract.
What does the PayPal CBD policy actually say?
PayPal publishes an acceptable use policy that lists the businesses it will not support, and drug and drug-paraphernalia categories sit inside it. Hemp and CBD sellers have long been caught by that language. The policy is a live document that PayPal revises, so read the current version before you build a store around it rather than trusting a summary anyone wrote last year.
PayPal's current acceptable use policy is published at paypal.com. We link it rather than quote it on purpose, because these documents change and a stale quote on our site would be worse than no quote at all. Read it against exactly what you sell, including any delta-8 or delta-10 items, which tend to be handled differently from plain CBD.
Why does an aggregator ban a product that is federally legal?
Because an aggregator is not underwriting you. Stripe, Square and PayPal put thousands of sellers under one shared merchant account, approve them in minutes and sort out the risk afterward. That model only works if entire categories are excluded up front. CBD is legal and it is also a category the shared account cannot carry, so it gets written out.
The trade is speed for durability. Instant sign-up is genuinely useful when you sell coffee mugs. It is the wrong shape for a category the shared account was never built to carry, and it means the review that closes you comes after you have already sent traffic and built the store. We walk through how underwritten boarding works instead on high risk processing.
Why does one shared account force a blanket policy?
Because there is only one account to protect. The aggregator holds the merchant relationship with its own sponsor bank and promises that bank the whole portfolio behaves. Every seller inside it shares that promise. So a category the bank does not want cannot be handled seller by seller. The only lever that scales is a list of businesses nobody in the portfolio may be.
Follow the chain and the logic stops feeling personal. The aggregator has a sponsor bank. That bank is examined, and it holds the aggregator responsible for every seller behind the shared account. If one category draws regulatory attention or a run of disputes, the bank does not call the seller. It calls the aggregator, whose own account is on the line.
Underwriting each seller individually would solve it, and that is exactly what the model gave up to sign people in minutes. So the control that remains is a published list of businesses nobody may be. Your store is not the target of that list. It is a rounding error inside a portfolio decision.
Is a policy ban the same thing as an illegal product?
No, and confusing the two costs sellers years. A prohibited-business list is a private commercial decision by a company choosing which risks it wants. Federal law on hemp and the acceptable use policy of a payments app are unrelated documents. One is a statute. The other is a contract term that the company can change on a Tuesday.
The legal side is settled enough to state plainly. Hemp with a delta-9 THC concentration of not more than 0.3 percent on a dry weight basis was removed from the federal controlled substances definition by the Agriculture Improvement Act of 2018, with the definition at 7 U.S.C. 1639o. Separately, the FDA has said CBD may not be lawfully added to food or marketed as a dietary supplement, which it explains here. Both facts matter to underwriting. Neither is what the aggregator's policy is about. Full detail sits on is CBD legal to sell online.
What happens when an aggregator closes a CBD account?
It usually arrives as an email, not a conversation. The account stops accepting payments immediately, and settled funds can be held while the review runs. Sellers often lose the payment method on their busiest week, because automated review tends to trigger on rising volume. There is rarely an appeal that puts the same account back.
Sellers describe the same sequence over and over. A good month, a volume spike, an automated flag, then a closure notice with a reserve on the balance. If you are reading this with an open account still running, treat it as borrowed time and build the replacement before you need it, not during the outage.
How does a review find a store that has been running fine?
Monitoring is automatic and it is looking at signals, not at you. Rising volume, a change in average order value, a jump in disputes, a buyer complaint, or a crawl of your own product pages that finds the words the policy lists. Any of those can open a file. Nothing about your store changed. The threshold that made it worth looking changed.
This is why the timing feels cruel. Growth is the signal, so the review lands when the store is finally working. It is also why cleaning up your copy matters even while an aggregator is still paying out. The crawler reading your product pages does not know your intent. It reads the words on the page.
What should a seller do in the first week after a shutdown?
Export first. Pull your transaction history, payout reports and customer records while you can still sign in, because access sometimes narrows. Get the stated reason in writing. Find out exactly which funds are held and what the review timeline is. Switch off any subscription billing so customers are not charged into a dead account. Then start the replacement.
Two things people forget in that week. Tell customers something honest on the checkout page rather than letting cards fail silently, because a failed payment with no explanation becomes a dispute. And keep every email from the platform. The stated reason is what a new underwriter will ask you about.
How is a real merchant account different?
A merchant account is underwritten for your business specifically, with a sponsor bank that has approved your product category before the first sale. You submit the file, the bank reviews it, and the approval is about you rather than about a category. That is slower to open and far harder to lose without warning.
The application asks more of you: business documents, product detail, lab certificates of analysis, your site's claims and your refund policy. That is the trade. The bank looks at your actual business before saying yes, so the yes means something. What underwriting looks for is on what makes CBD high risk, and the account itself is on CBD merchant account.
What does a reserve mean for your cash flow?
A reserve holds back part of your settlements so the bank has money on hand if disputes arrive later. It is common in this category and it is not a punishment. It does change your planning. Money earned this week is not all money you can spend this week, so build payroll and inventory around the deposit you actually receive.
Ask three questions about it before you sign. Is the reserve taken from each settlement or held as a lump sum, how long is each amount held, and what has to happen for it to be reduced. Those answers are knowable in advance, and a processor who will not put them in writing is telling you something.
Can a CBD store still use a normal checkout?
Yes. The checkout your customer sees does not have to change. A hosted gateway takes the card, the transaction routes to a bank that has approved hemp and CBD, and the buying experience looks like any other store. What changes is who is behind the account, which is the part that decides whether it survives.
Most stores keep their platform and swap only the payment layer. See CBD payment gateway for how that connects, or hemp merchant account if you sell raw flower and biomass rather than finished consumer goods.
What else do sellers ask after a shutdown?
Do Stripe and Square ban CBD as well?
Each of them publishes its own prohibited or restricted business policy, and CBD and related categories appear in them. Read the current version on each company site rather than a summary, including ours. These are contract documents and the companies revise them.
Can I keep an aggregator for non-CBD products and process CBD elsewhere?
Sometimes, if the businesses are genuinely separate and each account only sees what it is allowed to see. What you cannot do is run CBD sales through an account that prohibits them by describing them as something else. That is misrepresentation, and it ends the same way every time.
Will an aggregator release funds it has held?
Usually, eventually, minus anything used to cover disputes. There is no fixed calendar and no appeal that restores the account. Assume the money is slow rather than gone, and do not plan a payroll around it arriving on a particular day.
If the policy changes, can I just go back?
You can ask, but a closed account rarely reopens, and building a business around a policy that might loosen is a bad trade. An underwritten account does not depend on a policy team changing its mind, which is most of the reason to move.
What documents does a sponsor bank want to see?
Formation and ownership documents, recent bank statements, processing history if you have any, current certificates of analysis from an accredited lab, your labelling, your refund policy and your live website. Underwriters read the site copy too, so read it yourself first.
Do I have to change my ecommerce platform?
Almost never. Most stores keep the platform and swap only the payment connection, so the cart, the theme and the customer experience stay put. What changes is which gateway the checkout calls and which bank sits behind it.
Is being labelled high risk a penalty?
No. It is a pricing and underwriting category, not a judgment about your business. It means the bank expects more documentation, watches disputes more closely and may hold a reserve. Plenty of well-run stores operate that way for years without drama.
Stop rebuilding after every shutdown
Tell us what you sell and where you sell it. A Rooted Payments specialist walks you through what a bank actually needs to see.