Blog
There’s a Date on the Calendar. Most Shops Haven’t Heard About It.
If you run a vape shop that also sells CBD and kratom, you’re actually running three different businesses that happen to share a counter. Each one answers to a different set of rules, and your merchant account sits on top of all three.
That’s fine until one of them changes. And one of them just did.
What happened to hemp
In November 2025, Congress rewrote the definition of hemp. It went into the spending bill that ended the shutdown, which is why almost nobody in the industry saw it coming.
The old rule was simple. Under 0.3% delta-9 THC and you were hemp. That’s the line the whole delta-8 and THCA market was built on.
The new rule closes it from three directions. It counts total THC including THCA, not just delta-9. It puts a hard cap on finished products of 0.4 milligrams per container, which is a ceiling, not a percentage. And it excludes cannabinoids that were made in a lab rather than grown in the plant, which is how delta-8 is produced.
Put those together and most of the intoxicating hemp inventory on a vape shop wall stops being hemp.
The date to know: December 11, 2026 for the bulk of it. A narrower slice, the true synthetics, goes about a month earlier.
One honest caveat. That December date is attached to a temporary spending bill, and it has already been pushed back once. It could move again. So the right posture isn’t panic, it’s knowing your exposure and watching the date.
Kratom is a different animal, and mostly good news
Kratom is not a federally controlled substance. The DEA tried to schedule it in 2016, got flooded with public comment, and withdrew the attempt. It hasn’t come back.
What did change, in August 2026, is that three lab-made kratom derivatives went into Schedule I. Plain leaf kratom wasn’t touched. There’s also a pending action on 7-OH that would set a threshold rather than a flat ban, and as of right now it is still pending, not law.
The bigger risk with kratom isn’t federal. It’s the map. Eight states ban it outright, including Kansas and Tennessee, which both moved in 2026. Others set age limits, some at 18 and some at 21. If you ship, you need to know where you can ship, and that list changes.
Vape, where the rules are already strict
Two things surprise shop owners here.
First, only 48 vape products in the entire country have FDA authorization to be sold. Not 48 brands. Forty-eight products. Enforcement has shifted to the ports, and in one Chicago operation the government seized nearly five million unauthorized units worth over eighty million dollars.
Second, if you ship anything, the PACT Act applies to you. That means registering with ATF, registering with every state you ship into, filing monthly reports to each of those states, verifying age at purchase and again at delivery, and labeling the box. And you can’t use the mail. The Postal Service stopped carrying vapes in 2021, and UPS and FedEx both stopped too.
That’s not a merchant account rule. It’s federal law, and your processor knows it.
Now the part that actually gets accounts shut off
Here’s the thing most shop owners never see coming, and it has almost nothing to do with the products themselves.
Your merchant account is approved for a specific kind of business. Think of it like a food truck permit. The city licensed you to sell tacos at that location. If you start selling beer out the back window, the problem isn’t that beer is illegal. It’s that you’re doing something your permit doesn’t cover.
In payments they call it transaction laundering, and Visa’s own rules define it as running undisclosed goods through an approved merchant’s payment credentials. It is the single most common reason a multi-product shop loses processing.
It usually isn’t deliberate. A shop gets approved as a smoke shop, then adds a CBD line, then adds kratom, then puts the whole thing online, and everything runs through the one account that was opened two years ago for something narrower. Nobody made a decision. It just accumulated.
And the acquiring banks are required to go looking. Visa’s rules obligate them to run checks for concealed transactions during underwriting and on an ongoing basis. That’s why your website gets crawled and why someone places a test order.
Two related traps:
Your MCC has to match reality. That four-digit code is what the card networks think you sell. If it says one thing and your shelves say another, penalties start per transaction and can end with processing privileges pulled.
Online and in-store are not the same business. Visa treats several of these categories as high-integrity-risk specifically for card-not-present transactions. The same shop that boards easily over the counter is a different underwriting conversation the day it launches a website.
One myth worth killing
You’ll hear that Visa and Mastercard require LegitScript certification for CBD. They don’t. LegitScript doesn’t claim they do. It’s an advertising gate for Google and Meta, and individual processors often require it, but it isn’t a card network mandate.
More important, it doesn’t cover what most shops assume. LegitScript’s CBD certification covers topicals, creams, lotions and whole hemp flower. It specifically excludes ingestibles, tinctures, vapes, pet products and delta-8. Their own shorthand is that things you put on your body generally qualify and things you swallow generally don’t.
So a shop that pays for certification thinking it covers the gummies and the vape carts has bought something real that doesn’t protect the products it was worried about.
What running it right actually looks like
Separate what needs separating. Disclose everything you sell during underwriting, including the lines you’re planning to add. Get your MCC matched to the real mix. Know which products cross state lines and which states you can’t ship to. If you’re shipping vapes, be PACT registered before the first order, not after. And know your exposure to the December date before December.
None of that is exotic. It’s the difference between a shop that gets a letter and a shop that gets a phone call.
If this is you
If you’re selling any combination of vape, CBD, kratom or hemp products and you’re not sure whether your processing setup matches what’s actually on your shelves, that’s worth a conversation before someone else notices.
Send us what you sell, how you sell it, and whether you ship. We’ll tell you where the exposure is, what needs to be structured differently, and what it takes to keep processing through the December change. If your current setup is fine, we’ll tell you that too.
Current as of September 2026. The federal hemp deadline is tied to a temporary spending bill and has already moved once. Verify the current date before acting.
Questions about this article or the Guru Brief?
Email marketing@gogurupay.com or call (844) 725-3933.
Guru Pay helps with onboarding, checkups and billing questions, including when you cannot reach your provider, from 8 a.m. to 8 p.m. Eastern. Direct 24/7 technical support is available through your POS provider.
Guru Pay is an Atlanta merchant services team. We help business owners set up, protect and grow the way they get paid, and we write here about what we see working with shops, restaurants and high-risk merchants every week.
Talk it through with our team →
One thought on “There’s a Date on the Calendar. Most Shops Haven’t Heard About It.”