Visa and Mastercard 2025: Card‑Network Rules for Hemp‑Derived THC and CBD—Chargebacks, MCCs, and Age‑Gating

Navigating Payment Processing for Hemp‑Derived THC and CBD in 2025: The Updated Federal Compliance Landscape

The hemp industry in 2025 finds itself at a regulatory crossroads, with card networks like Visa and Mastercard sharpening their focus on payment processing for hemp-derived cannabinoids, especially products containing psychoactive levels of THC (such as delta‑8 and delta‑9). While mainstream card acceptance remains elusive for cannabis, the distinction between non‑intoxicating CBD (≤0.3% delta‑9 THC) and hemp-derived intoxicating products determines whether merchants can access traditional processors—or are relegated to the high-risk corner of the payments industry.

This article provides a detailed overview of the federal rules, payment stack requirements, and evolving card‑brand risk controls affecting hemp businesses in 2025. Whether you’re a manufacturer, retailer, or compliance officer, understanding these rules is mission-critical to maintaining uninterrupted card acceptance, lowering chargebacks, and avoiding sudden offboarding by payment processors.

The Federal Compliance Split: CBD vs Intoxicating Hemp‐THC

Following the 2018 Farm Bill, products with hemp-derived CBD and ≤0.3% delta‑9 THC (by dry weight) are federally legal, and most mainstream payment providers only support these compliant SKUs. Still, the rapid adoption of intoxicating hemp‑based cannabinoids (like delta‑8, delta‑9 drinks, and edibles) has blurred lines at both state and processor levels.

• CBD Products (Non-Intoxicating, ≤0.3% Delta‑9 THC):
• Many processors (e.g., Square’s CBD program, mainstream ISOs) permit card acceptance for these SKUs—if labeled and marketed compliantly.
• Merchants must pass enhanced KYC (Know Your Customer) and ongoing content monitoring.
• Intoxicating Hemp Products (Delta‑8, Delta‑9, etc.):
• Card networks and gateways classify these as “high‑risk” and typically prohibit card acceptance via standard channels.
• Brands selling intoxicating hemp are funneled to high‑risk processors, carrying higher fees, rolling reserves, and stricter onboarding (source: Signature Payments 2025).
• Acceptance for these products can trigger processor termination and blacklisting from other merchant accounts.

Card Network Policy: Visa and Mastercard Rules for 2025

1. Merchant Category Codes (MCCs) and Accurate Descriptors

Card networks demand appropriate MCC assignment and product descriptions, especially as state law and federal scrutiny tightens. Using a generic or misleading MCC (e.g., "Specialty Retail", "Vitamins") for intoxicating products can result in:

• Account termination
• Placement on the Terminated Merchant File (TMF or MATCH list)
• Violations fines or bans across networks

Takeaway: Verify your MCC. Hemp/CBD merchants are often assigned codes like 5499 (Miscellaneous Food Stores) or 5912 (Drug Stores). Intoxicating or "cannabis-adjacent" SKUs may require high-risk MCCs or custom descriptors—always disclosed to your processor up front (see Visa MCC Manual, 2025).

2. Chargebacks and Dispute Management

Both Visa and Mastercard have introduced stricter chargeback response timelines and more aggressive monitoring for high‑risk verticals in 2025 (ChargeBlast).

• Response windows: Down to 30 days for many disputes (Mastercard); Visa timelines remain at 30 days for most, with some legacy transactions allowing 45 days.
• Automated systems: Automated evidence submission has become critical—manual processes are at a disadvantage.
• Prevention: 3DS2, Address Verification Service (AVS), and explicit customer journey disclosures are now expectations, not luxuries.

Takeaway: Invest in fraud prevention and respond rapidly to disputes. Chargebacks from product confusion (e.g., customer did not realize a product contains psychoactive THC) are increasing, underlining the need for clear product labeling and compliant checkout disclosures.

3. Enhanced Age‑Gating and KYC: How Strict Will 2025 Get?

Processors are under pressure from both card brands and state regulators to significantly tighten age-verification for intoxicating hemp sales. For compliant payment processing in 2025, expect requirements such as:

• Third‑party ID proofing at checkout (DOB, government ID scan—see Online Age Verification, CannabisRegulations.ai)
• 3DS2 for CNP (card-not-present) transactions
• Automated geolocation/geofencing
• COA (Certificate of Analysis) links presented at cart and in post-purchase emails/receipts

Takeaway: Relying on simple self-attestation pop-ups is a red flag for networks and regulators. Implement robust, integrated age‑gating and product verification workflows.

State Regulations Can Trip Federal Payment Compliance

Increasingly, state crackdowns on youth-appealing hemp formats (like delta‑9 seltzers or delta‑8 gummies) cause processors to clamp down preemptively—sometimes banning entire categories pending clearer regulatory guidance (Foley Hoag 2025). Several states are actively investigating or banning distribution of intoxicating hemp products in non-dispensary settings (e.g., convenience and grocery channels).

Key advice:

• Monitor state-level labeling, serving-size, and sale bans. Selling into a state with new or temporary bans could result in violating processor acceptance policies—even if federal law permits the SKU.
• Incorrect or missing labeling (e.g., failing to list true delta‑9 content per serving) is a top cause of surprise merchant termination.

Payment Processing Best Practices for Hemp‑THC in 2025

To keep your payment stack resilient and reduce the risk of offboarding or MATCH listing:

1. Choose the Right Payment Processor

• Ensure your provider explicitly allows your full product line (CBD and any intoxicating hemp/THC SKUs). Document this in writing.
• High-risk processors are sometimes a necessity for intoxicating SKUs; expect higher fees and rolling reserves.

2. Deploy Layered Fraud and Age Verification

• Activate full fraud and chargeback mitigation (AVS, CVV, 3DS2, geo‑IP analysis).
• Use reliable third-party digital identity proofing.

3. Maintain Compliance Automation

• Link a valid, batch-specific COA for every psychoactive SKU directly in the cart and purchase confirmation.
• Automate state-based shipping restrictions and incorporate inventory geofencing where necessary.

4. Prepare a Processor Contingency Plan

• Operate a backup payment gateway (parallel MID or secondary processor) to avoid business interruption during compliance reviews or sudden processor changes.
• Have internal SOPs for rapid MCC/descriptor updates and SKU delisting if state or federal policies shift.

What Happens if You Get Shut Down?

Processor de-risking, especially driven by vague or evolving state rules, can mean accounts are terminated with little warning. That’s why a contingency stack—and clear labeling, MCCs, and product disclosures—is your best defense. Merchants placed on the MATCH list may lose access to all mainstream card acceptance for years.

What Consumers Should Know (2025 Update)

• Consumers can only use Visa/Mastercard on sites selling federally legal (non-intoxicating) CBD, not delta‑8/delta‑9 edibles or drinks—unless the processor is explicitly high‑risk and compliant.
• Expect age and ID checks at checkout for all psychoactive hemp products.
• Hemp retailers may have product or payment restrictions that change based on your state—read checkout and product disclosures!

Stay compliant, stay selling. For tools to automate payment compliance and monitor regulatory change, explore the resources and live platform at CannabisRegulations.ai.

Informational only—not legal advice. Regulations and processor policies may change without notice.