Cannabis Pay Hub logomarkCannabis PayHub

Directory · Payment Compliance

Cannabis payments regulatory resource directory

Published August 12, 2026 · Last reviewed · Cannabis Pay Hub editorial team · Reviewed by a Cannabis Pay Hub payments specialist

The primary sources that govern cannabis payments in the United States are federal financial-crime guidance, banking regulators, card and debit network rules, and state cannabis regulators. This directory links each one with its publisher and the date we last checked it.

How to use this directory

Cannabis payment rules come from four separate places, and they change on different timetables: the US Treasury's Financial Crimes Enforcement Network for Bank Secrecy Act expectations, prudential banking regulators for institution supervision, Nacha for ACH rules, and the card and debit networks for acceptance rules. State cannabis agencies control licensing and traceability. Always cite the primary document and the date you read it.

Primary sources

  • FIN-2014-G001: BSA Expectations Regarding Marijuana-Related Businesses

    Financial Crimes Enforcement Network (FinCEN), US Department of the Treasury

    Federal guidance on how financial institutions serve marijuana-related businesses, including marijuana-specific SAR filing categories.

    Last checked August 12, 2026

  • Bank Secrecy Act regulations and reporting

    FinCEN

    Underlying recordkeeping and reporting framework — SARs, CTRs — that shapes cannabis banking and payment monitoring.

    Last checked August 12, 2026

  • Nacha Operating Rules

    Nacha

    The rules governing ACH debits, credits, authorisations, return codes and Same Day ACH windows.

    Last checked August 12, 2026

  • Agriculture Improvement Act of 2018 (2018 Farm Bill)

    US Congress / congress.gov

    Statute that separated hemp from marijuana under federal law, which is why CBD and hemp payments are underwritten differently.

    Last checked August 12, 2026

  • Controlled Substances Act scheduling

    US Drug Enforcement Administration

    Federal scheduling status, the root cause of restricted banking and card acceptance for plant-touching cannabis.

    Last checked August 12, 2026

  • Visa Core Rules and Visa Product and Service Rules

    Visa

    Network acceptance rules, including prohibited transaction types relevant to cannabis retail.

    Last checked August 12, 2026

  • Mastercard Rules

    Mastercard

    Network acceptance and merchant registration rules, including terminated-merchant reporting.

    Last checked August 12, 2026

  • PCI Data Security Standard

    PCI Security Standards Council

    Security requirements for environments that store, process or transmit cardholder data, including dispensary POS deployments.

    Last checked August 12, 2026

  • FDIC Banker Resource Center

    Federal Deposit Insurance Corporation

    Supervisory expectations for insured institutions, relevant to whether a bank will hold a cannabis deposit account.

    Last checked August 12, 2026

  • NCUA regulatory guidance

    National Credit Union Administration

    Guidance for credit unions, which serve a meaningful share of cannabis deposit relationships.

    Last checked August 12, 2026

  • Consumer Financial Protection Bureau regulations

    CFPB

    Consumer payment rules — Regulation E for electronic transfers — relevant to debit and wallet products.

    Last checked August 12, 2026

  • Metrc state traceability program directory

    Metrc

    State traceability programs whose data must reconcile with POS and payment records.

    Last checked August 12, 2026

Educational reference material, not legal, tax or compliance advice. Rules, banking availability and provider policies change; check the linked primary source and the last-reviewed date before relying on anything here.

Cite this resource

Resource
Cannabis Payments Regulatory Resource Directory
Publisher
Cannabis Pay Hub · Cannabis Pay Hub editorial team
Published / updated
August 12, 2026 /
Canonical URL
https://cannabispayhub.com/resources/cannabis-payments-regulatory-directory

Cannabis Pay Hub. "Cannabis Payments Regulatory Resource Directory." Published August 12, 2026; updated August 12, 2026. https://cannabispayhub.com/resources/cannabis-payments-regulatory-directory

Attribution style: Cannabis Pay Hub (2026). Quote any passage with a link to the canonical URL above.

Related pages in this cluster

Part of the Payment Compliance cluster. Card-network rules, PCI DSS scope, state traceability and recordkeeping obligations that touch payment operations.

Articleour analysis of dispensary credit card restrictionsDispensary credit card restrictions do not come from a single law that says a shop cannot swipe a card.Open ArticleCard-Network Rules Cannabis Operators Are Judged AgainstEven where cards are available, as they often are for CBD and hemp sellers, the account is judged against network rules on accurate merchant coding, truthful…Open QuestionIs PCI required for cannabis POSYes, whenever your environment stores, processes or transmits cardholder data — including debit-based acceptance — PCI DSS applies, and your provider will usually require annual validation appropriate to your scope. Solutions that keep card data out of your systems reduce scope but do not eliminate obligations.Open QuestionCannabis payment compliance checklistAt minimum: maintain active licensing, verifiable ownership records, written KYC/AML and cash-handling procedures, accurate transaction and seed-to-sale records, tax remittance documentation, PCI obligations where card data is in scope, and prompt notification to your bank and processor when the business changes materially.Open GlossaryAML (glossary)Anti-money laundering: the program of controls, monitoring and reporting a financial institution maintains to detect and report suspicious activity.Open GlossaryMetrc (glossary)A seed-to-sale traceability system used by many state cannabis programs. It tracks inventory, not payments, but POS and payment data must reconcile with it.Open GlossaryPCI DSS (glossary)The Payment Card Industry Data Security Standard, which applies to any environment that stores, processes or transmits cardholder data.Open Industrypayments for healthcarePayments that fit clinical operations, patient balances, and compliance.Open Resourcepayment conditions state by stateJurisdiction-level reference pages covering market context, licence types, the responsible state agencies, banking conditions and practical payment issues — each with a visible last-reviewed date and links to official sources.Open

Read next

  1. 1our analysis of dispensary credit card restrictionsDispensary credit card restrictions do not come from a single law that says a shop cannot swipe a card.
  2. 2Card-Network Rules Cannabis Operators Are Judged AgainstEven where cards are available, as they often are for CBD and hemp sellers, the account is judged against network rules on accurate merchant coding, truthful…
  3. 3Is PCI required for cannabis POSYes, whenever your environment stores, processes or transmits cardholder data — including debit-based acceptance — PCI DSS applies, and your provider will usually require annual validation appropriate to your scope. Solutions that keep card data out of your systems reduce scope but do not eliminate obligations.

Want this reviewed against your own setup?

Send your current statements, POS details and licence type. We will walk through what applies to your state and licence, and what to get in writing from any provider.

Get a Free Payment Review Discuss an Integration

Educational reference material, not legal, tax or compliance advice. Rules, banking availability and provider policies change; check the linked primary source and the last-reviewed date before relying on anything here.