Why does a legal product with a large customer base and ordinary retail margins end up in the same underwriting tier as offshore gambling? The answer has almost nothing to do with the product and everything to do with a definition that Congress has changed twice in eight years and is about to change again.
The next change takes effect on November 12, 2026. Every merchant file in the category will be re-read against it.
The Underlying Legal Position
The 2018 Farm Bill defined hemp as Cannabis sativa L. containing no more than 0.3% delta-9 THC on a dry weight basis, and removed hemp and its derivatives from the Controlled Substances Act. That looked like resolution to everyone outside the compliance function.
The FDA read it differently. The agency held that marketing foods or dietary supplements containing CBD remained unlawful under the drug preclusion provisions of the Food, Drug, and Cosmetic Act, since CBD had already been approved as the active ingredient in a prescription drug. A CBD gummy is therefore a legal agricultural derivative sold in a form the FDA says it cannot legally take.
Banks cannot resolve that contradiction, so they treat the category as one where a federal agency has stated on the record that the product form is not lawful. Nothing in a merchant application answers that.
Congress then narrowed the definition again. The Continuing Appropriations Act signed in November 2025 excluded synthesized or manufactured cannabinoids from the definition of hemp, along with any finished product containing more than 0.4 mg per container of combined THC and cannabinoids producing similar effects. Products falling outside the new definition become marijuana under the Controlled Substances Act as of November 12, 2026.
Risk Pricing and Reserve Requirements
Underwriters price three separate exposures in this category. The first is regulatory, meaning the possibility that a product legal at boarding becomes contraband during the contract term. The second is dispute volume, since card-not-present sales, subscription billing, and buyers who expected a stronger effect all push chargeback ratios upward. The third is reputational exposure to the acquiring bank’s own regulators.
Card networks require chargeback ratios below 1%. Merchants approaching that line are placed under monitoring without being told. Disputes exist across all of retail, with retail returns totaling roughly $890 billion a year in the United States. A category built on card-not-present sales simply starts closer to the ceiling. Reserves follow from the same logic. Rolling reserves hold back a percentage of settled receipts so the acquirer has funds available if the merchant disappears or a wave of disputes arrives after the fact.
That treatment is arithmetic applied to a category. Five-year-old companies with clean books receive the same opening treatment as a startup with a website built last month.
Termination and the MATCH List
The worst outcome in this category is a sudden closure with no replacement ready. It happens without warning, usually by email. Settlement funds already in transit can be held for months.
The reason a single termination causes lasting damage is a database called MATCH, which is Mastercard’s list of terminated merchant files. Every processor is required to check it when boarding a new account and to add a merchant to it when closing an account that meets the criteria. A listing lasts five years. Many acquiring banks decline any applicant who appears on it.
Businesses can therefore lose an account for a reason they dispute, find themselves listed, and then discover that the listing rather than the original issue is what blocks every subsequent application. Removal is possible where the listing was made in error, though the process runs through the acquirer that filed it, which is the same institution the merchant has already fallen out with.
Merchants are rarely told the criteria in advance. The reason code attached to a listing is chosen by the acquirer at the moment of closure. Merchants often learn which code was used only when a later application is declined without explanation. Asking for the reason code in writing at the moment an account closes is worth doing immediately, because that request is far harder to answer six months later.
Redundancy is the only real defense. This is business continuity planning applied to banking. A second boarded account with a different acquirer, kept live with a small share of volume, converts a termination from an emergency into an inconvenience.
The Shape of the Application File
Underwriting here runs longer than in most categories because the questions are structural. A reviewer wants the corporate structure, the supply chain, the states shipped into, and the ratio of card-not-present volume, and firms that specialize in payments for CBD businesses build the pricing around those answers.
Applications rarely fail on a single item. They stall because three answers arrive a week apart, and the file goes cold between them.
What Belongs in the Submission
Open with the legal analysis. A short memorandum stating the statutory basis for each product, the states it ships into, and the specific rule that permits it does more for an underwriter than any amount of brand material.
Show the dispute history in numbers. Merchants who volunteer a 0.4% chargeback ratio alongside the refund policy that produced it have answered the underwriter’s real question before it was asked.
The November 12, 2026 changes need naming directly, product by product. Anything reclassified falls under a statute that is itself in motion, since state-licensed medical marijuana was moved to Schedule III in December 2025. Applicants who have already mapped their catalog against the new definition are describing a business that survives the transition.
Website copy has to match the application. Underwriters read the site. A page promising effects the application never mentions creates a discrepancy that has to be explained before anything moves forward.
Ordinary record keeping and compliance practice already requires retaining licenses and inspection certificates, and merchants who keep those current have most of an underwriting refresh assembled before the acquirer asks for one.
The Source of the Difficulty
Processors have asked for the same things for years, which are documentation and dispute ratios and a product line that matches what the paperwork says. Those requirements have barely moved.
The instability is in the statute. It moves again on November 12, 2026.