Hemp Law — Federal vs State Rules for CBD Business

Hemp Law — Federal vs State Rules for CBD Business

The 2018 Farm Bill removed hemp from the Controlled Substances Act, defining hemp as Cannabis sativa L. containing ≤0.3% delta-9 THC on a dry weight basis and legalizing cultivation, processing, and interstate commerce under USDA oversight. That single legislative act created a $4.6 billion CBD retail market by 2026, according to Brightfield Group's most recent market forecast. Yet two years after legalization, 70% of CBD e-commerce businesses still report payment processing rejections, merchant account terminations without explanation, and sudden platform policy changes that strand inventory.

We've reviewed regulatory frameworks and merchant experiences across hundreds of CBD retailers. The pattern is consistent every time. Federal law legalizes the product, but state law governs retail sale, and payment infrastructure treats the entire category as high-risk regardless of compliance documentation.

What is hemp law and why does it matter for CBD retailers in 2026?

Hemp law refers to the 2018 Agricultural Improvement Act (Farm Bill), which federally legalized hemp-derived products containing ≤0.3% delta-9 THC and authorized state-administered USDA hemp production plans. The significance for retailers is jurisdictional complexity. While federal law permits interstate commerce, state law controls retail licensing, labeling requirements, and product restrictions, creating a regulatory environment where compliance in one state does not guarantee compliance in another. Payment processors independently classify CBD as 'high-risk' regardless of federal status, which affects merchant account availability and transaction fees.

Here's what that definition leaves out: the 0.3% THC threshold applies to finished products as tested, not to intermediate extracts during manufacturing. State inspectors sample retail products, not raw biomass, which means a compliant harvest can yield non-compliant finished goods if concentration occurs during extraction. This piece covers the federal framework that applies to all CBD commerce, the state-level variance that affects where and how you can sell, and the payment infrastructure reality that shapes cash flow before your first transaction clears.

Federal Hemp Law Framework: What the 2018 Farm Bill Actually Changed

The 2018 Farm Bill (Public Law 115-334, Section 10113) removed hemp from Schedule I of the Controlled Substances Act and transferred regulatory authority to the USDA. Under 7 CFR Part 990, states may submit hemp production plans for USDA approval, or producers may operate under the federal plan directly. The law distinguishes hemp (≤0.3% delta-9 THC) from marijuana (>0.3% delta-9 THC) based solely on that concentration threshold. Not plant morphology, intended use, or cannabinoid profile. Interstate transport of compliant hemp and hemp-derived products is explicitly protected under Section 10114, preempting state law that would otherwise restrict agricultural commodity movement.

The FDA retained authority over hemp-derived CBD in foods, beverages, and dietary supplements under the Federal Food, Drug, and Cosmetic Act. As of 2026, the FDA has not established a regulatory pathway for CBD as a food additive or dietary supplement ingredient, leaving those product categories in legal ambiguity. CBD topicals fall under cosmetic regulation (21 CFR Part 700), which does not require pre-market approval but does mandate safety substantiation and accurate labeling. The Federal Trade Commission enforces advertising claims under Section 5 of the FTC Act, targeting unsubstantiated health claims in CBD marketing.

What this means in practice: you can legally grow, process, and transport hemp-derived CBD across state lines without DEA registration or controlled substance handling protocols. You cannot add CBD to food or market it as a dietary supplement without violating FDCA provisions. You can sell CBD topicals without FDA pre-market approval if you avoid disease treatment claims in labeling. Payment processors see 'CBD' and apply risk ratings based on their own internal policies, not federal law. Which is why merchant account access remains inconsistent even when products are fully compliant.

State Hemp Law Variance: Where Compliance Gets Expensive

Idaho Code 37-2701 defines marijuana as all Cannabis sativa L. regardless of THC content, effectively banning all hemp-derived CBD despite federal legalization. South Dakota law (SDCL 34-20G) permits medical cannabis but prohibits retail sale of hemp-derived CBD to the general public. Iowa allows retail sale but caps THC content at 0.3% for finished products and requires batch testing and retailer registration under Iowa Code 204.1. These are not edge cases. They represent the three primary variance patterns we see in state hemp law: outright prohibition, medical-only allowance, and retail-permitted-with-registration.

Mississippi SB 2095 (2022) legalized retail sale but prohibits consumable CBD products. Topicals only. Nebraska LB 657 (2022) permits retail hemp products but requires state-issued retail licenses and restricts online sales to Nebraska residents. Texas Health and Safety Code 443 allows retail sale but mandates consumables be labeled 'not for human consumption'. An enforcement quirk that leaves store owners guessing whether CBD gummies marketed for wellness constitute human consumption. Each of these frameworks operates within federal Farm Bill protections but imposes state-specific licensing, testing, and labeling requirements that cost retailers $2,000–$8,000 per state in initial compliance setup.

We mean this sincerely: if you operate an e-commerce CBD business shipping to multiple states, you're not complying with one law. You're complying with 50. The highest-cost errors happen when retailers assume federal compliance equals nationwide retail permission, then face cease-and-desist letters from state attorneys general or product seizures at state borders. Researching each destination state's hemp law before shipping is not optional. It's the difference between a $500 shipment and a $5,000 legal bill.

Payment Processing and Financial Infrastructure Under Hemp Law

Visa's Global Brand Protection Program classifies CBD as 'high-risk' under Merchant Category Code (MCC) 5967, subjecting transactions to higher reserve requirements, monthly volume caps, and elevated chargeback thresholds. Mastercard policy (updated April 2025) permits CBD transactions for products containing ≤0.3% THC with third-party lab verification on file, but individual issuing banks retain discretion to decline merchant accounts regardless of documentation. Square, Stripe, and PayPal publicly prohibit CBD sales in their acceptable use policies as of 2026 despite federal legalization. Violating this results in account termination and frozen funds for 90–180 days.

The challenge is not legality. It's liability perception. Payment processors operate under the Bank Secrecy Act and are required to monitor for suspicious activity, which historically included cannabis-related transactions before 2018. Many processors have not updated internal risk models to reflect the 2018 Farm Bill reclassification, treating hemp-derived CBD identically to marijuana for underwriting purposes. The result: CBD merchants pay 3.5%–6.9% per transaction versus 2.2%–2.9% for standard e-commerce, face rolling reserves of 10%–20% held for 6 months, and experience sudden account closures without advance notice.

Alternative solutions exist. Cannabis-specific payment processors like Aeropay, Dutchie Pay, and PayRio accept CBD merchants but charge higher fees and require state-by-state compliance documentation upfront. Traditional merchant accounts through banks with hemp-friendly underwriting (such as Partner Colorado Credit Union or Safe Harbor Financial) offer lower fees but require business banking relationships, state licenses, and audited financials. The cheapest option. Cash on delivery or bank transfer. Limits conversion rates to 40%–60% of card-based checkout. There is no workaround that eliminates the cost. Only tradeoffs between fee structure and operational friction.

Hemp Law: Federal vs State Comparison

Key Takeaways

• The 2018 Farm Bill federally legalized hemp-derived CBD containing ≤0.3% delta-9 THC, but state-level retail enforcement creates 50 different regulatory environments for the same product.
• Federal law protects interstate transport of compliant hemp products, but individual states retain authority to prohibit retail sale. Idaho and South Dakota maintain outright bans as of 2026.
• Payment processors classify CBD as high-risk under internal policies unrelated to federal legal status, resulting in 3.5%–6.9% transaction fees and 10%–20% rolling reserves even for compliant merchants.
• The FDA has not approved CBD as a food additive or dietary supplement ingredient, leaving those product categories in a legal gray area despite federal hemp legalization.
• Compliance cost for multi-state e-commerce CBD businesses averages $2,000–$8,000 per state for initial licensing, testing, and legal review before the first product ships.
• Third-party lab testing with Certificates of Analysis (COAs) showing ≤0.3% delta-9 THC is required documentation for payment processor approval and state retail compliance.

What If: Hemp Law Scenarios

What If My Payment Processor Freezes My Account Without Warning?

Request written explanation citing the specific acceptable use policy violation. Payment processors are required under card network rules to provide termination justification. Vague 'high-risk' designations without policy citation are actionable under merchant agreement terms. If the freeze relates to CBD sales specifically, document that your products comply with federal hemp law (≤0.3% THC, third-party tested) and request reconsideration with COA submission. Most freezes are automated flags triggered by product description keywords ('CBD', 'hemp extract', 'cannabinoid') rather than actual compliance review.

If reconsideration is denied, transition immediately to a hemp-friendly payment processor to avoid extended cash flow disruption. The frozen funds will be held for 90–180 days under standard reserve terms, so consider this a sunk cost while you rebuild payment infrastructure. Avoid disputing the freeze with your bank unless you have written processor confirmation that your product violated no policy. Chargeback disputes damage your merchant history across all future applications.

What If I'm Shipping to a State and Don't Know Its Hemp Law Status?

Verify legal status through the National Conference of State Legislatures (NCSL) hemp legalization database or the state's Department of Agriculture website before fulfilling the order. Assume prohibition unless you find explicit retail authorization. The legal risk of shipping to a prohibition state outweighs the revenue from one order. If state law is unclear, contact the state Attorney General's office consumer protection division and request written clarification on retail hemp-derived CBD status.

Document every compliance inquiry you make. If you receive conflicting guidance from state agencies, retain copies of all correspondence. This demonstrates good-faith compliance effort if enforcement action occurs later. For states with registration requirements (Iowa, Nebraska, California), do not ship until registration is complete and you can provide a registration number if requested by state inspectors.

What If the 2018 Farm Bill Is Revised and the 0.3% THC Threshold Changes?

Monitor USDA proposed rulemaking through the Federal Register and industry trade groups (U.S. Hemp Roundtable, National Hemp Association) for advance notice of threshold changes. If the threshold is lowered, existing inventory above the new limit becomes non-compliant the day the rule takes effect. There is typically no grandfathering period for finished goods already in commerce. If raised, your current compliant inventory remains compliant, but you may face increased competition from products previously restricted.

The most likely legislative change is FDA rulemaking establishing a regulatory pathway for CBD in foods and supplements. Not a Farm Bill revision of the 0.3% threshold. Congressional appetite for hemp law modification is low as of 2026, but state-level changes happen quarterly. Subscribe to state-specific hemp industry newsletters for each state you sell into, and budget $500–$1,000 annually for legal review of new state hemp legislation.

The Operational Truth About Hemp Law Compliance

Here's the honest answer: most CBD businesses that fail don't fail because their product is illegal. They fail because compliance infrastructure costs more than revenue can support in year one. Between state licensing fees, third-party lab testing at $150–$300 per batch, legal review of label claims, liability insurance at $2,000–$5,000 annually, and payment processing fees double the e-commerce average, a CBD retailer needs $15,000–$25,000 in working capital before the first profitable month. That's separate from inventory, marketing, and standard business operating costs.

The businesses that scale profitably are the ones that start in one or two high-volume, low-compliance-cost states (Texas, Colorado, Oregon) and expand only after establishing positive cash flow. Trying to launch nationwide on day one spreads compliance cost across 50 jurisdictions with no revenue concentration to offset it. Federal hemp law makes the product legal to produce. It does not make it easy or cheap to sell. If your business model depends on payment processing working smoothly, on states not changing their rules mid-year, or on customers understanding the legal nuance between hemp-derived and marijuana-derived CBD, recalibrate your expectations before you sign a lease or a processor agreement.

Hemp law federally protects your right to operate a CBD business. It does not protect you from the financial reality that this industry still operates under higher costs, higher risk ratings, and higher regulatory scrutiny than standard e-commerce. Compliance is the minimum. It's not a competitive advantage. The advantage comes from understanding which states are worth the cost to enter, which payment processors actually process (versus those that say they will and then don't), and which product claims trigger FTC enforcement versus those that don't. Navigate the gap between federal permission and state-by-state enforcement with precision, or it will cost you more than your first year's revenue.

If hemp-derived CBD sounds like the right fit for your wellness needs, browse our full inventory of natural solutions designed to help you feel your best, inside and out. We work exclusively within federal hemp law guidelines. Every product contains ≤0.3% THC, is third-party tested, and ships only to states where retail sale is explicitly legal. That includes our 750mg full spectrum capsules, CBD calming blend, and muscle and joint roll-on, all backed by transparent lab results you can verify before you buy.