The landscape in 2026
CBD remains federally legal under the 2018 Farm Bill (hemp-derived, <0.3% delta-9 THC by dry weight), but the 2024 FDA guidance and the closure of several of the delta-8 loopholes mean acquirers are stricter than they were in 2022. Approval is still very achievable — we place 95%+ of compliant CBD files — but the documentation bar is real.
The standard document set
- Standard underwriting docs (bank statements x3, processing statements x3 if applicable, EIN, formation docs, owner IDs, voided check).
- Product catalog with SKUs. Every product you sell, with category (tincture, gummy, topical, smokable, pet, etc.) and delta-9 THC content per serving.
- Certificates of Analysis (COAs) from an ISO 17025-accredited third-party lab for every SKU. Must be current (within 12 months) and must show cannabinoid profile + heavy metals + pesticides + residual solvents.
- Supplier / manufacturer documentation. Who manufactures your products, where, with what hemp source.
- State hemp license if your state requires one (most states do for retailers; some are still patchwork).
- Insurance certificate — product liability insurance, typically $1M/$2M minimum.
- Website compliance items (covered below).
Website compliance — the checklist underwriters actually run
- SSL across the entire site (not just checkout).
- Clear age gate (21+) on first visit.
- Refund / return policy visible from every product page.
- Terms of service and privacy policy with explicit hemp/CBD language.
- Physical business address in the footer (PO boxes are flagged).
- Contact phone number that's actually answered during business hours.
- No medical claims. "Reduces inflammation," "cures anxiety," "treats pain" are all auto-declines. Stick to structure/function language ("supports recovery," "promotes calm").
- No statements implying FDA approval.
- COAs linked from every product page (industry best practice, increasingly required).
What got harder in 2025–2026
- Delta-8 / delta-10 / THC-O. Most domestic acquirers will no longer underwrite synthetic / converted cannabinoids. Smokable hemp flower also harder.
- Pet CBD. Still placeable but requires explicit pet-product COA and clear "not for human consumption" labeling.
- Subscription / autoship. Requires explicit continuity disclosure pre-purchase and a clear cancellation flow. Hidden continuity = MID termination.
Typical approval timeline
Clean files with all docs in hand: 24–72 hours. Files missing COAs or with non-compliant website copy: 5–10 days while we help you fix the compliance items. Files involving delta-8 or smokable flower: 5–14 days, frequently requiring offshore placement.