You sell a legal product. You run a real business. And somewhere along the way, a payment processor told you no — or worse, told you yes and then shut you down three months later. If that sounds familiar, you’re in what the payments industry calls a “restricted” category. It doesn’t mean your business is the problem. It means the way most processors evaluate businesses is the problem.
This guide covers what “restricted” actually means, why processors say no even when your business is legitimate, what you need to have in place before applying anywhere, and how to find processing that doesn’t disappear on you.
What “Restricted” Actually Means
In the payments industry, “restricted” is a label applied to product categories that carry higher perceived risk for chargebacks, regulatory scrutiny, or reputational exposure. The key word is perceived. A well-run CBD company with a 0.3% chargeback rate and full compliance documentation is, by the numbers, less risky than a poorly run general-retail store with a 2% dispute rate. But the CBD company carries the “restricted” label and the general-retail store doesn’t.
Categories commonly labeled restricted include:
- CBD, hemp, and cannabis-adjacent products
- Supplements, nutraceuticals, and peptides
- Vape, e-liquid, and tobacco
- Adult products, content, and services
- Tactical gear and related equipment
- Subscription and continuity businesses in regulated categories
- Firearms accessories (varies by processor)
- Kratom and other botanical products
The list isn’t fixed. What’s restricted today might not be tomorrow, and a product that one processor declines, another underwrites. The label reflects industry convention and individual processor appetite, not a legal standard.
What restricted does not mean: illegal, shady, or doomed to fail. It means your business needs a processor who evaluates merchants individually instead of declining categories wholesale.
Why Processors Turn Restricted Merchants Away
Processors aren’t turning you away because they think your business is bad. They’re turning you away because their business model doesn’t accommodate yours. Here’s the chain:
Card networks set the rules. Visa and Mastercard define which merchant category codes (MCCs) carry additional requirements — higher reserve thresholds, stricter chargeback monitoring, mandatory compliance documentation. These requirements cost the processor time and money to manage.
Payment facilitators aggregate risk. Platforms like Stripe, Square, and PayPal are payment facilitators — they process transactions under their own merchant ID, not yours. That means every merchant’s risk is their risk. If your category triggers network scrutiny, the facilitator’s entire portfolio can be affected. The rational business decision, from their perspective, is to decline the category.
Automated systems can’t tell the difference. A machine that reads “CBD” on your product page doesn’t know whether you have certificates of analysis, GMP-certified manufacturing, and a five-year operating history. It knows the keyword matches a restricted list. That’s enough for a decline — or a shutdown, if the system catches it after you’re already selling.
Chargebacks are expensive for everyone. Some restricted categories do carry higher chargeback rates as an industry average. But the average hides wide variation: the best merchants in any category run well below the network thresholds, while the worst pull the average up. A processor without the expertise to tell the difference avoids the entire category.
Regulations change. CBD went from illegal to legal in most states in a few years. Vape regulations shift state by state. Supplement rules evolve with new FDA guidance. Processors who don’t track these changes can’t accurately assess risk, so they default to “no.”
What Every Restricted Merchant Needs
Regardless of what you sell, there is a baseline every merchant in a specialized industry should have in place before applying for processing. This is the universal checklist — the foundation that shows a processor you run your business like a business.
A real business entity. An LLC, corporation, or other registered business. Your EIN. State registration. If your industry requires licenses or permits, have them current and accessible.
A clear product catalog. Every product you sell, described accurately. No vague language, no missing categories, no products hidden from the application. If a processor discovers products you didn’t disclose, that’s grounds for immediate termination — and it’s a reputation stain that follows you.
Industry-specific compliance.
- CBD: Certificates of analysis (COAs) for every product, showing THC content within legal limits. Third-party lab results. No health claims on product pages.
- Supplements: GMP certification or documentation. Accurate labeling. No claims that haven’t been evaluated or approved.
- Vape and tobacco: Age verification process. State-by-state shipping restrictions. Product labeling requirements.
- Adult: Age verification. Content review processes. Record-keeping documentation where required by law.
- Tactical: Clear product categorization. Accurate descriptions distinguishing gear from restricted items. Age verification for age-restricted products.
Written policies, published on your site. Returns and refunds. Shipping times and methods. Privacy policy. Contact information — a real email, a real phone number. These aren’t optional — a processor will check, and missing policies are a red flag.
A clean billing descriptor. What shows up on your customer’s credit card statement. It should be recognizable — clear enough that your customer can identify the purchase without calling their bank. Unrecognizable descriptors are the single largest driver of “I didn’t authorize this” disputes in most restricted categories.
A chargeback management plan. Not a hope that disputes don’t happen — a plan for when they do. How you respond to alerts. How quickly you issue refunds when warranted. How you document delivery. Processors want to see that you’ve thought about this.
Processing history, if you have it. Your last 3-6 months of statements showing volume, chargeback rate, and average transaction size. If you’ve processed before, this is the strongest evidence of how your business actually performs. If you’re new, say so — that’s a different underwriting path, not a disqualification.
How to Find a Processor That Stays
The goal isn’t just to find a processor who will say yes today. It’s to find one who will still be processing your transactions a year from now, after a regulation changes, after your volume grows, after you add a product line. Here’s what to look for:
They specialize in your industry. A processor who works with merchants in specialized industries every day has seen the compliance patterns, the common dispute drivers, and the regulatory shifts. They aren’t surprised by any of it. A general-purpose processor who takes you on as an exception is one bad quarter away from exiting your category.
They underwrite your business, not your category. Ask directly: “How do you evaluate my application?” If the answer is about your products, your policies, and your compliance, that’s a processor who makes business-level decisions. If the answer is about which categories they accept, you’re still being evaluated by label.
They tell you the hard parts upfront. Reserves, hold periods, rolling reserves, chargeback thresholds — a good processor explains all of this before you sign. If they won’t talk about reserves until after you’re approved, that’s a sign they’re not transparent about the rest either.
They don’t promise what can’t be promised. No processor can guarantee zero holds, zero reserves, or instant approval for a restricted category. If someone promises that, they either don’t understand the industry or they’re telling you what you want to hear. Look for honesty over optimism.
Your store and your payments are connected. When your storefront and your payment application sit in the same place, the processor can see your real catalog, your real policies, and your real customer experience. That visibility makes for a better underwriting decision — and a more stable long-term relationship.
Industry-Specific Notes
Every restricted category has its own quirks. Here’s a brief overview — follow the links for a deeper dive on each:
CBD and hemp: The regulatory landscape is shifting. Federal hemp rules are changing, and state laws vary widely. The merchants who keep their processing are the ones who document everything — COAs, sourcing, THC compliance — and update their documentation when the rules change.
Supplements and nutraceuticals: The biggest risk here is claims. Products that promise to cure, treat, or prevent specific conditions attract regulatory attention and customer disputes. Accurate labeling and honest marketing are your best protection.
Tactical gear: The word “tactical” triggers automated filters designed to catch weapons sales. If you sell packs, apparel, lighting, and field gear, your product descriptions need to be specific enough that a reviewer — human or automated — can see the difference.
Vape and tobacco: Age verification isn’t optional — it’s the first thing a processor checks. State-by-state shipping restrictions add complexity, but they’re also what separates a compliant merchant from a risky one. Build the controls into your store, and document them in your application.
Adult products and services: Discreet billing descriptors, clear cancellation processes, and thorough age verification are the foundation. Subscription and trial models need extra attention — most disputes in the adult category come from recurring charges customers didn’t expect or couldn’t easily cancel.
FAQ
Is “restricted” the same as “prohibited”?
No. “Prohibited” means a processor won’t touch the category under any circumstances — illegal products, for example. “Restricted” means the category is accepted by some processors under certain conditions, with additional underwriting requirements. Most of the categories listed in this guide are restricted, not prohibited.
Can I process payments through a personal account or a friend’s business?
No. This is called “transaction laundering” and it’s a federal offense. It also violates every card network’s rules and will result in a permanent ban from processing. Always apply under your own business entity for your actual products.
What’s a rolling reserve, and should I be worried about it?
A rolling reserve is a percentage of each transaction that the processor holds for a set period (typically 6-12 months) as protection against chargebacks. It’s standard for merchants in specialized industries. The money is yours — it’s released after the hold period. A processor who is upfront about reserves is more trustworthy than one who doesn’t mention them.
How long does underwriting take for restricted categories?
It varies, but expect a few days to a few weeks. The processor is reviewing your business, your compliance documentation, and your processing history. Having all your documentation ready before you apply speeds this up significantly. Some processors let you build your store while underwriting is in progress, so you’re not idle.
What if I’ve been shut down by multiple processors?
Multiple shutdowns don’t automatically disqualify you, but they do raise questions. A processor who specializes in your industry will want to understand what happened and why. If the shutdowns were category-based (the processor decided to exit your industry), that’s very different from shutdowns caused by chargebacks or policy violations. Be honest and specific about what happened each time.
Do I need a lawyer before I apply?
Not necessarily, but if your product is in a heavily regulated category (CBD, supplements, adult content), a compliance review by someone who knows your industry is money well spent. A processor can only evaluate the compliance documentation you provide — if that documentation is incomplete or outdated, it weakens your application.
Find the Right Processor for Your Business
Shop Ave works with merchants in specialized industries every day. Your application is reviewed on your business, not your category.