What Makes a Cannabis Payment Method Compliant

The short answer

A cannabis payment method is compliant when every party in the chain knows exactly what the transaction is, and each one is permitted to handle it under its own rules. That means the sponsoring bank has been told it is banking a state-licensed cannabis business, the merchant category and descriptor describe the real business, and the rail being used is one the network or institution behind it actually allows for this activity.

Most arrangements that later collapse fail one of those tests. They work for a while because the transaction is described as something it is not, and they stop working the moment a routine review looks closely.

Compliance is not a one-time badge earned at boarding. It is a running property of the arrangement that has to survive personnel changes at the provider, ownership changes at the merchant, and periodic portfolio reviews at the sponsoring institution, so treat the initial approval as the start of an ongoing obligation rather than a finished task.

The four tests to apply to any offer

Before evaluating price or hardware, run a proposed method through four questions. If a provider cannot answer all four in writing, treat that as the answer.

• Disclosure: does the sponsoring institution know this is a plant-touching cannabis merchant?
• Coding: is the business coded and described accurately at the point the transaction is authorised?
• Rail permission: does the network, ACH originator or account provider permit this activity on this rail?
• Settlement: will a depository institution knowingly accept the settled funds without a further review that could freeze them?

Patterns that have historically caused terminations

Misdescribed merchant categories, transactions rounded to fixed amounts to imitate ATM withdrawals, offshore acquiring for a domestic retail business, and layered entities that hide the licensed operator from the sponsoring bank have all been sources of sudden shutdowns and withheld settlements. The merchant absorbs the loss in almost every case, because the arrangement that failed the review was in the merchant's name.

The tell is usually simple: the provider is vague about which institution is behind the product, or describes the arrangement as a workaround that is fine because everyone does it.

Auditing the setup you already have

You do not need a lawyer to do a first pass. Pull a recent statement and a settlement report, then confirm the legal entity, the descriptor customers see, the merchant category and the depositing institution all describe the same real business. Compare the tender types your point of sale records with the tender types that reach the bank account.

Where those do not line up, document the gap and ask your provider to explain it in writing. A durable arrangement survives that question easily; a fragile one does not.

• Keep written answers on disclosure, coding, rail and settlement in your compliance file.
• Re-run the audit after any provider, gateway or bank change.
• Maintain a documented fallback tender so a review cannot stop you trading.

Documentation that supports a compliant setup

A compliance file is only useful if it is organised well enough that you can hand it to a new bank or provider without a scramble. Keep a single folder, physical or digital, that a reviewer could work through in under an hour.

The goal is not volume of paperwork, it is coherence: every document should point at the same legal entity, the same licence numbers and the same descriptor, so a reviewer never has to reconcile conflicting records to understand what your business does.

• Current licences and any conditions attached to them.
• Written disclosure confirmation from your acquiring bank or processor.
• A copy of the merchant agreement showing the coded category and descriptor.
• Monthly reconciliation records tying POS, settlement and bank totals together.
• A log of any provider communications about coding, rail or settlement changes.

What happens when a compliance gap is discovered later

Reviews rarely announce themselves in advance. A card network audit, a change in a sponsoring bank's risk appetite, or an unrelated regulatory inquiry can surface a mismatch that has existed quietly for months, and the discovery usually triggers an immediate hold on settlement rather than a warning period.

Because the merchant has little visibility into when or why a review starts, the only real protection is keeping the four tests answered in writing before the fact, so that if a question arrives, the answer already exists rather than needing to be constructed under pressure.

Operators who have been through a sudden freeze consistently report the same lesson afterward: the arrangement looked fine on the surface for a long time, and the paperwork that would have caught the problem early was never assembled until it was demanded.