If you sell vape hardware, e-liquid, or nicotine pouches, you already know how this goes. Square shuts the account down the same week it opens. PayPal holds a month of receipts in a reserve you never agreed to. Shopify Payments flags “tobacco and vape” under prohibited products and turns off checkout while orders are still coming in. You have a state license, you card every customer, and none of it matters to a platform that decided years ago it would rather lose the category than underwrite it.
Vape has always been high-risk. What changed in 2026 is that the pressure moved from the processors to the card networks themselves, and the standard for staying approved got a lot more specific. This is what that looks like from the underwriting side, and how vape merchants are still getting approved.
Why Vape Businesses Are Classified as High-Risk
Underwriters don’t sort industries by how they feel about them. They sort by loss exposure, and vape stacks up more of it than almost any legal product category.
Start with the regulatory layer. Under federal law, any e-cigarette without an FDA marketing authorization is an adulterated product, and as of mid-2026 the FDA had authorized fewer than 50 products total, nearly all in tobacco or menthol flavors. The disposable brands that drive most retail volume are not on that list. An acquiring bank looking at a vape shop’s inventory sees a business whose bestsellers may be subject to seizure. That is not a hypothetical. In May 2026 the FDA published enforcement guidance that sorted the market into three tiers: authorized products, products with a pending PMTA on file, and everything else, with the third tier marked for seizure and destruction in coordination with DOJ and Customs.
Then there is the shipping layer. The 2021 PACT Act expansion pulled vape products into the same framework as cigarettes: mandatory registration with the ATF and state tax authorities, monthly reporting of shipments, adult signature on delivery, and a USPS mailing ban that the private carriers matched with their own policies. For an online vape merchant, that means a compliance program most e-commerce stores never have to think about, and an underwriter is going to ask to see it.
The state layer is where it gets messy. Several states now ban flavored products outright. A growing number, including Wisconsin, North Carolina, and Florida, run product directories where anything not on the approved list is illegal to sell, and those lists can shrink by thousands of SKUs on a single update. Texas took a different route and targeted disposables by country of manufacture. A merchant shipping to multiple states is managing a dozen different definitions of what is legal to sell.
Finally, the chargeback profile. Vape carries an age-restricted product, a high share of card-not-present transactions, subscription e-liquid programs, and a customer base that has learned disputing a charge is easier than returning a product. Put those together and you get dispute ratios that trip the network thresholds faster than most retail categories.
None of this means you’re a bad merchant. It means you’re an expensive one to underwrite, and mainstream processors have decided the math doesn’t work for them. We’ve covered the broader picture in our guide to payment processing challenges for high-risk industries, and vape is close to the worst case.
What Changed in 2026: The Networks Got Involved
For years, the practical rule was simple. The big aggregators wouldn’t touch vape, but if you found a high-risk acquirer, you could process and mostly be left alone. That is no longer the full story.
In April 2026, a bipartisan coalition of 25 state attorneys general plus New York City sent letters to Visa, Mastercard, American Express, Capital One, Citi, PayPal, Stripe, Sezzle, and Block, asking them to cut off merchants selling unauthorized vape products and to meet with the states about how to do it. The letters cited the FDA’s authorization list and the PACT Act, and made the argument that if a product is illegal to sell, the networks are the choke point.
Mastercard responded by tightening its Specialty Merchant Registration program for tobacco and vape. Merchants have to be coded under the correct merchant category code and registered by their acquirer before they can accept Mastercard at all, the registration fees roughly doubled, and new per-transaction and volume assessments were added on top. Visa received the same letters and the industry is watching for similar moves.
The practical effect is that “high-risk friendly” is no longer enough on its own. Your acquirer now has to be willing to register you with the networks, absorb the added scrutiny, and stand behind your product mix when a network reviewer asks what you sell. Processors that were quietly boarding vape accounts under generic retail codes are being pushed out, and the merchants on those accounts are getting the termination emails.
If you have an account that was opened without proper registration, the question isn’t whether it gets flagged. It’s when, and what happens to the funds in it. Our piece on the hidden costs of using the wrong payment processor walks through the reserve holds and MATCH list exposure that follow a bad termination.
What Happens When You Use the Wrong Processor
The failure modes are predictable because they happen the same way every time.
An account opened through a general-purpose platform gets reviewed, usually after a spike in volume or a chargeback cluster. The platform confirms the business sells vape, applies its prohibited-products policy, and terminates. Funds already settled are usually safe. Funds in the pipeline are frequently held for 90 to 180 days as a reserve against future disputes, and the platform is under no obligation to explain the timeline.
If the termination is coded as a policy violation rather than a simple closure, you may land on the MATCH list, the card industry’s shared file of terminated merchants. A MATCH placement follows the business and its principals for five years and makes every subsequent application harder, including with the high-risk acquirers who would otherwise take you.
Meanwhile you still have rent, payroll, and inventory landing. Merchants in this position often patch together a workaround: a personal Venmo, a second Square account under a different name, a friend’s business account. Every one of those creates a new violation on top of the first one, and the networks are far better at spotting them than they used to be.
The better path is to be on a properly underwritten account before any of this starts, so the volume spike is expected, the chargebacks are within the tolerances your acquirer already agreed to, and there is a human at the processor who knows what you sell.
What Underwriters Actually Look For in a Vape Merchant Application
A vape application that gets approved is one that answers the risk questions before they’re asked. Here is what a high-risk underwriter is looking at.
Product mix and authorization status. Expect to provide a product list. Underwriters want to know what share of your inventory is FDA-authorized, what share has a pending PMTA on file, and what share falls outside both. You do not need a 100% authorized catalog to get approved, but you need to know your own numbers and be candid about them. A merchant who says “we don’t carry anything without a filed PMTA and here’s how we verify that” is a very different risk than one who shrugs.
State licensing and directory compliance. Copies of your tobacco or vape retail license for every state you operate in, and for online sellers, evidence that you’re checking state directories before shipping. If you geo-block orders to states where you can’t legally sell, say so and show how.
PACT Act program. For any merchant shipping product, underwriters will ask about ATF registration, state tax registration in destination states, monthly reporting, and your carrier arrangements. If you’re using a PACT-compliant carrier or a fulfillment partner that handles it, document the relationship.
Age verification. Not a checkbox on the site. Underwriters want to see a third-party verification service at checkout for online orders and an adult signature requirement on delivery. For brick-and-mortar, a POS that enforces ID scanning is a meaningful plus.
Processing history. Six months of statements from your current or previous processor, including chargeback and refund ratios. A history with disputes under 1% is the target. If you’ve been terminated before, disclose it. The underwriter will find it anyway, and finding it after you didn’t mention it ends the conversation.
Financials. Business bank statements, and for newer businesses, personal financials of the principals. Vape accounts often carry a rolling reserve at the start, and healthy financials shrink that reserve or shorten how long it lasts.
Website and marketing review. Clear age gates, accurate product descriptions, visible refund and shipping policies, no health claims, and nothing on the site that looks like it’s marketed to minors. Cartoon packaging and candy branding in product photos are the fastest way to a decline in 2026, because they are exactly what the FDA said it would target regardless of PMTA status.
Green Financial underwrites vape merchants directly and knows what a clean file looks like. Most applications are answered within one week, and most of those in 1-2 business days. You can read more about what a vape merchant account includes, or skip ahead and apply.
Online vs. Brick-and-Mortar Vape Sales
The two channels are underwritten differently, and a lot of merchants run both.
A retail vape shop is the easier file. Card-present transactions carry lower fraud exposure, ID checks happen in person, and there’s no PACT Act shipping component. A retail merchant account for a vape shop looks a lot like one for any other specialty retailer, with the added network registration and a closer look at your product list. Many shops pair it with a mobile payments solution for events and pop-ups.
Online vape is the harder file, for all the reasons above. An ecommerce merchant account for vape will come with a closer look at your age verification vendor, your shipping compliance, and your state-by-state controls. The good news is that the merchants who have built those systems are exactly the ones the market is consolidating toward, because the operators who haven’t are getting shut out.
If you run both, the account should be set up to reflect that from day one rather than bolted together later. Our guide to omnichannel payment setup covers how to structure it so your reporting, reserves, and risk profile stay coherent across channels.
The Subscription E-Liquid Question
Subscription and auto-ship programs are common in e-liquid and pouch sales, and they are worth having, but they change the underwriting conversation. Recurring billing pushes up dispute ratios because customers forget they signed up, and regulators have been paying close attention to negative-option billing across every industry.
If you run a subscription, expect the underwriter to ask about your cancellation flow, your renewal reminders, and how you handle a card that fails on renewal. Clear terms at signup and an easy cancellation path are not only good practice, they are what keeps your dispute ratio under the thresholds that get accounts reviewed. We’ve covered the mechanics in our post on managing recurring payments for subscription businesses, and the continuity and subscription page covers how those accounts are structured.
PCI Compliance Is Not Optional, Especially Here
Every merchant that accepts cards is bound by PCI DSS, but a vape merchant has less room for error than most. A data incident on an account that is already under network scrutiny is the kind of thing that turns a reserve into a termination.
For most vape shops, PCI compliance means using a validated payment gateway and terminal rather than handling card data directly, completing the annual self-assessment questionnaire, and running the quarterly scans your processor requires. It is not complicated, but it has to be done, and your acquirer will ask for the attestation. We’ve written about why PCI compliance matters in merchant services if you want the full breakdown.
Funding the Inventory Side of the Business
Vape inventory is expensive, it turns over fast, and a directory change can strand product you already paid for. Conventional bank lending is close to nonexistent for the category. The options that do work are the ones structured around your processing volume rather than your industry classification.
Merchant cash advances are the most common route for vape merchants because repayment is a percentage of daily card receipts, so a slow month costs less. Unsecured lines of credit suit shops with a longer processing history that want flexibility on timing. Equipment financing covers POS hardware, ID scanners, and shop buildouts. We’ve laid out the tradeoffs in our guide to choosing the right business funding option.
Having your processing and your funding under one roof also matters more in this category than most, because the lender is seeing your real volume in real time rather than underwriting off a stale statement.
What to Do Next
Get ahead of the review instead of waiting for it. Pull your product list and know your authorization percentages. Get your state licenses and PACT Act documentation in one folder. Look at your last six months of dispute ratios and fix whatever is pushing them up. Then apply with a processor that underwrites vape on purpose, registers you correctly with the networks, and will still be answering the phone when the next state directory update lands.
Green Financial works with vape and e-cigarette merchants across all 50 states, retail and online. If you want to talk through your specific situation, apply now or get in touch. We’ll give you a straight answer on what approval looks like for your business.
