E-Cigarette and Vape Merchant Accounts in 2026: High-Risk Underwriting, Compliance, and Chargeback Control

Call 866-305-6454 now for a vape merchant account review.

E-cigarette and vape businesses face stricter payment underwriting in 2026.

The risk comes from four areas:

• Federal tobacco regulation.
• State and local licensing.
• Card-network monitoring.
• Card-not-present chargebacks.

A standard payment aggregator may decline the business. An existing account may be frozen after the processor identifies vape products. A compliant business may still require a specialized acquiring bank, network registration, a rolling reserve, and enhanced transaction controls.

A high risk merchant account gives the business a structured path to approval. It also creates a payment setup designed for regulated products, age verification, recurring billing, fraud controls, and dispute response.

This article covers the approval requirements and operating controls that vape merchants should address before processing transactions.

Payment approval does not determine whether a product is legal to sell. Obtain advice from qualified regulatory, tax, and legal professionals. Rules change by product, state, locality, sales channel, and customer location.

Why Vape Merchants Are Classified as High Risk

Vape merchants are usually treated as high risk because the category combines regulatory exposure with card-not-present risk.

FDA oversight applies to ENDS products

The FDA’s 2016 Deeming Rule extended federal tobacco-product authority to electronic nicotine delivery systems, or ENDS.

The FDA identifies e-cigarettes, vapes, e-liquids, vape pens, and related products as tobacco products when they meet the applicable statutory definition. The FDA also distinguishes between retailers and manufacturers.

A retailer sells the product.

A business that mixes e-liquid, modifies devices, imports products, or manufactures components may also qualify as a tobacco-product manufacturer. That distinction affects documentation and underwriting.

The FDA’s Deeming Regulations page explains the federal framework.

PMTA status affects underwriting

A new tobacco product generally requires FDA premarket authorization before lawful marketing in the United States.

The Premarket Tobacco Product Application, or PMTA, is one route to authorization. The application evaluates whether marketing the product is appropriate for the protection of the public health.

Retailers are not always the PMTA applicant. The manufacturer, importer, or product owner may hold that responsibility. However, an acquiring bank can still request documents that establish the product’s legal supply chain and marketing status.

Underwriters may ask for:

• Manufacturer details.
• Importer information.
• Product descriptions.
• FDA marketing orders where applicable.
• Product authorization records.
• Supplier invoices.
• Certificates and compliance documents.
• Product-label images.
• Warning statements.
• Information about flavors, nicotine levels, and packaging.

A pending application is not the same as a marketing authorization. A retailer should not represent that a product is FDA-authorized without documentation.

The FDA provides premarket tobacco product application information for manufacturers and other regulated parties.

Youth-access scrutiny increases risk

The federal minimum age for tobacco-product sales is 21.

Age restrictions apply to vape products. Youth-access concerns also influence payment underwriting, even when a merchant targets adults and follows state law.

Underwriters review:

• Website age controls.
• Identity verification.
• Product images.
• Advertising language.
• Social media claims.
• Checkout procedures.
• Shipping methods.
• Adult-signature procedures.
• Customer-service records.
• Refund and cancellation policies.

A simple “Are you 21?” pop-up is usually not enough to demonstrate a complete compliance program.

Card-not-present transactions create additional exposure

Many vape businesses sell online, by telephone, through subscriptions, or through recurring auto-ship programs.

These are card-not-present transactions.

The cardholder is not physically present at the point of authorization. The merchant therefore has less direct evidence that the legitimate cardholder placed the order. The merchant also faces disputes involving:

• Unauthorized purchases.
• Merchandise not received.
• Product descriptions.
• Subscription renewals.
• Delivery failures.
• Billing-descriptor confusion.
• Product restrictions.
• Customer age or identity.

The risk increases when the merchant ships nationally or internationally.

Network monitoring affects account stability

Visa and Mastercard monitor fraud and disputes across the payment system.

A merchant can face operational pressure before reaching a formal network threshold. The acquiring bank may establish lower internal limits. A high-risk acquirer may require a reserve, enhanced monitoring, or transaction caps.

Incorrect business classification creates additional risk. A vape merchant should not conceal the product category to obtain a standard account. The correct business model, product information, website, MCC, and processing activity should match the application.

FDA, PMTA, PACT Act, and State Licensing Requirements

Payment approval depends on more than a website and a bank account.

The business must build a compliance file that matches its products and sales channels.

Review the Deeming Rule

The FDA’s Deeming Rule subjects covered tobacco products to federal requirements involving:

• Manufacturing.
• Product reporting.
• Premarket review.
• Health warnings.
• Retail sales.
• Distribution.
• Advertising.
• Recordkeeping.

The specific requirements depend on the business role.

A vape shop that only sells sealed products may have a different compliance profile from a company that mixes e-liquid or modifies devices. An importer may face another set of documentation requirements.

Underwriting should identify the role clearly.

Do not describe a retailer as a manufacturer unless the operations support that classification. Do not describe a manufacturer as a retailer if the business performs manufacturing, mixing, importing, or modification activities.

Verify PMTA documentation

A merchant should maintain product-level documentation where applicable.

The file can include:

• Product name and SKU.
• Manufacturer name.
• Supplier information.
• Country of origin.
• Product ingredients.
• Nicotine concentration.
• Packaging and warning labels.
• FDA marketing order information.
• PMTA-related records supplied by the manufacturer.
• Inventory records.
• Purchase invoices.
• Product withdrawal notices.

The acquirer may request a website review. The merchant should ensure that the online catalog matches the documents supplied during underwriting.

Remove discontinued or unauthorized products promptly. Do not use old product pages that create confusion about current inventory.

Follow PACT Act delivery rules

The PACT Act applies to delivery sales of covered tobacco products, including ENDS.

The ATF identifies delivery-sale obligations that can include:

• Seller registration.
• State and local tax registration.
• Customer age verification.
• Delivery records.
• Required reporting.
• Shipping restrictions.
• Package labeling.
• Adult signature delivery.
• Government-issued identification review.

A shipment should not be left unattended when the applicable delivery rules require an adult signature.

The signer must meet the applicable minimum legal age at the destination. Because federal Tobacco 21 law establishes 21 as the federal minimum age for tobacco sales, vape merchants should plan for 21-plus verification at delivery.

The ATF tobacco seller requirements provide official information on delivery sales, reporting, shipping, and tax compliance.

The USPS PACT Act information materials also describe adult-signature procedures for covered shipments.

Check state and local licenses

A federal framework does not replace state or local licensing.

Requirements may include:

• State tobacco-retailer licenses.
• Vapor-product permits.
• E-cigarette retailer permits.
• Sales-tax registration.
• Tobacco-tax registration.
• Local tobacco-retail licenses.
• Health-department permits.
• Business licenses.
• Product restrictions.
• Flavor restrictions.
• Local zoning requirements.

A merchant selling into multiple states should maintain a jurisdiction matrix.

The matrix should list:

• Destination state.
• Destination locality.
• Products sold.
• Required license.
• Issuing agency.
• Renewal date.
• Tax registration.
• Shipping restrictions.
• Recordkeeping rules.
• Flavor and packaging limits.

California retailers, for example, should review the California Department of Tax and Fee Administration tobacco licensing requirements.

The CDC’s State Tobacco Activities Tracking and Evaluation System provides state-level tobacco policy information. It is not a substitute for direct confirmation from the relevant state and local agencies.

Visa and Mastercard Treatment of Vape Merchants

The payment networks do not treat vape processing like ordinary online retail.

MCC 5993 matters

Visa and Mastercard materials identify MCC 5993 as “Cigar Stores and Stands.”

The category includes tobacco products, electronic cigarettes, vaping devices, and smokers’ supplies.

Visa’s Merchant Data Standards Manual identifies MCC 5993 and includes it among high-integrity-risk categories for card-absent activity.

Mastercard’s Quick Reference Booklet states that tobacco sales must use MCC 5993.

The acquirer assigns the MCC. The merchant should not select a different code to make approval easier.

Misclassification can cause:

• Account closure.
• Transaction reversals.
• Network compliance action.
• Reserve increases.
• Fund holds.
• Acquirer termination.
• Placement on industry negative databases.

Registration and enhanced review

Visa treats qualifying tobacco activity as high brand risk or high integrity risk under applicable programs and regional rules.

The merchant may need to be registered before Visa transactions are submitted. The acquirer normally manages the registration process.

Registration can require:

• Website URLs.
• Business ownership information.
• Product details.
• Licensing documents.
• Compliance controls.
• Processing history.
• Delivery procedures.
• Fraud-monitoring information.

Mastercard also applies special rules to non-face-to-face tobacco merchants using MCC 5993.

The business should ask the acquiring bank:

1. Will the merchant be boarded with the correct MCC?
2. Will the acquirer complete required network registration?
3. Which product categories are approved?
4. Are international transactions allowed?
5. Are recurring transactions allowed?
6. What reserve applies?
7. Which chargeback reports will be provided?
8. What internal dispute limit applies?

Visa VAMP planning threshold

Visa’s current monitoring structure can combine fraud and dispute activity.

For planning purposes, a vape merchant should monitor the applicable VAMP ratio every month. The excessive level specified for this operating framework is a 1.5% ratio with a 1,500-event floor for combined fraud and dispute activity.

Network programs can change by region, merchant type, and effective date. The acquiring bank should confirm the current calculation method and applicable thresholds.

Do not manage only to the maximum threshold. Internal underwriting limits may be lower.

Mastercard ECM planning threshold

Mastercard’s official rules define an Excessive Chargeback Merchant using two measurements:

• At least 100 chargebacks in a month.
• A chargeback-to-transaction ratio of at least 1.5%.
• The conditions apply in two consecutive calendar months.

See the Mastercard Rules and the Security Rules and Procedures Merchant Edition.

A merchant should target a lower operating range. Waiting until the network threshold is reached reduces the time available for remediation.

Why Mainstream Processors Decline Vape Businesses

Mainstream payment platforms are designed for broad, lower-risk acceptance.

Their automated onboarding systems may not support regulated tobacco and vape activity.

PayPal

PayPal’s Acceptable Use Policy prohibits transactions involving cigarettes and lists non-cigarette tobacco products and e-cigarettes as activities requiring pre-approval.

Pre-approval does not mean automatic acceptance. The category remains subject to eligibility, jurisdiction, product, and risk review.

A merchant should not open a general PayPal account and assume that a later product upload will be accepted.

Stripe

Stripe classifies tobacco products, including e-cigarettes and e-liquid, as restricted businesses.

Stripe states that restricted businesses require additional due diligence. Approval can depend on applicable law, financial partners, card-network rules, and product details.

See Stripe’s Restricted Businesses policy.

A merchant should obtain written approval for the actual product and sales model. Approval for one business line does not necessarily cover a new product category, a new country, or a new recurring-billing model.

Square

Square’s terms require accurate business information and allow Square to suspend or terminate access. The terms also require compliance with applicable law and prohibit transactions involving illegal goods or activity.

See Square’s General Terms of Service.

A vape merchant should verify category eligibility before processing. A general account should not be used as a workaround for a restricted category.

Account freezes and negative database exposure

An aggregator may identify a vape business after reviewing:

• Website content.
• Product feeds.
• Customer complaints.
• Shipping descriptors.
• Refund activity.
• Sudden volume changes.
• Transaction metadata.
• Social media links.
• Chargeback submissions.

The account may then be suspended while the platform investigates.

Funds may remain unavailable during the review. The business may also face difficulty opening another account if the termination is reported to an industry database such as MATCH.

The best protection is accurate disclosure before boarding.

Underwriting Documents Acquiring Banks Request

A complete application reduces back-and-forth.

Prepare the following before applying.

Business and ownership records

Provide:

• Articles of incorporation or organization.
• EIN confirmation.
• Government-issued owner identification.
• Ownership percentages.
• Business address.
• Bank statements.
• Voided check or bank letter.
• Processing statements.
• Website URL.
• Customer-service contact information.

Product and supplier records

Provide:

• Product catalog.
• SKU list.
• Supplier invoices.
• Manufacturer information.
• Import documents.
• Product images.
• Ingredient information.
• Nicotine information.
• FDA-related documentation where applicable.
• Proof of lawful distribution.

Regulatory records

Provide:

• State tobacco licenses.
• Vapor-product permits.
• Local retailer licenses.
• Tax registrations.
• Shipping policy.
• Age-verification procedures.
• Adult-signature carrier agreement.
• Refund policy.
• Privacy policy.
• Terms of sale.
• Compliance training records.

Processing history

Provide:

• Previous processor statements.
• Monthly volume.
• Average ticket.
• Highest ticket.
• Refund ratio.
• Chargeback ratio.
• Chargeback notices.
• Previous termination details.
• Reserve history.
• Current gateway information.

Do not omit a prior account closure. Underwriting will likely identify it through processing records or industry databases.

A clear explanation is better than an unexplained inconsistency.

Reserve and Pricing Expectations

Vape merchants may receive pricing terms that differ from ordinary retail.

Rolling reserves protect the acquirer

A rolling reserve holds a percentage of processing volume for a defined period.

The reserve gives the acquirer funds to cover:

• Future chargebacks.
• Refunds.
• Product-not-received disputes.
• Regulatory interruptions.
• Delivery failures.
• Sudden account closure.
• Delayed customer claims.

Bridge’s high-risk page states that some merchants may receive a 5% to 10% rolling reserve for an initial period, typically about six months. The actual amount depends on the business profile, bank, processing history, product mix, and dispute record.

Reserve terms should be documented in the merchant agreement.

Ask whether the reserve is:

• Rolling.
• Capped.
• Fixed-term.
• Reviewed periodically.
• Released after account closure.
• Reduced after performance improves.

High-risk rates should be transparent

A high-risk rate can include:

• Interchange.
• Processor markup.
• Network assessments.
• Gateway fees.
• High-risk registration charges.
• Chargeback fees.
• Monthly platform fees.
• Reserve requirements.
• International settlement costs.

A low advertised rate may not reflect the full cost.

Bridge uses an interchange-plus structure described on its transparent credit card processing pricing page. The merchant pays the applicable wholesale interchange cost plus an identified markup.

Interchange-plus pricing matters because card mix varies. Debit, credit, rewards, commercial, international, and card-not-present transactions can produce different interchange costs.

Request a written quote based on actual volume and transaction type.

Chargeback Control for Vape E-Commerce

Chargeback prevention begins before authorization.

Use accurate descriptors

The billing descriptor should match the customer’s recognition of the business.

A confusing descriptor can trigger a “fraud” dispute even when the customer placed the order.

Use:

• A recognizable trading name.
• A working customer-service phone number.
• A monitored support email.
• Clear order references.
• A consistent descriptor across receipts and statements.

Keep adult-signature evidence

Retain delivery evidence that connects the order to the shipment.

Records may include:

• Order date.
• Customer name.
• Customer address.
• Product and quantity.
• Age-verification result.
• Carrier.
• Tracking number.
• Delivery date.
• Adult-signature confirmation.
• Delivery address.
• ID-check result where available.
• Customer communications.

Do not retain prohibited sensitive information. Follow privacy and security requirements.

Address common dispute reasons

Vape merchants commonly face disputes involving:

• Cardholder claims of unauthorized use.
• Merchandise not received.
• Product not as described.
• Damaged or defective products.
• Canceled subscriptions.
• Recurring charges after cancellation.
• Refunds not received.
• Duplicate transactions.
• Customer confusion about the merchant name.

Build evidence for each category.

For unauthorized-use claims, provide:

• AVS result.
• CVV result.
• IP address.
• Device information.
• Order history.
• Customer account activity.
• Delivery confirmation.
• Customer communications.

For merchandise-not-received disputes, provide:

• Tracking.
• Delivery confirmation.
• Address match.
• Adult signature.
• Carrier records.
• Customer contact history.

For recurring disputes, provide:

• Original enrollment consent.
• Terms accepted.
• Price and billing frequency.
• Reminder notices.
• Cancellation instructions.
• Cancellation timestamp.
• Subsequent transaction history.
• Refund record.

Manage auto-ship carefully

Subscriptions create predictable revenue. They also create repeat dispute exposure.

Before charging a recurring transaction:

• Display the renewal terms.
• Identify the billing interval.
• Show the total price.
• Explain cancellation.
• Send a confirmation.
• Send a renewal reminder where appropriate.
• Provide a simple cancellation route.
• Stop billing immediately after valid cancellation.
• Retain consent and communication records.

Do not store CVV or CVC for recurring transactions.

PCI Security Standards Council guidance states that card verification codes cannot be stored after authorization, including for card-on-file and recurring payments. Review the PCI Security Standards and applicable payment-provider documentation.

Age Verification and Adult Signature as Payment Controls

Age verification has two distinct stages.

Verify age before sale

The checkout should verify that the customer meets the legal age requirement before the order is accepted.

Possible controls include:

• Identity-document verification.
• Knowledge-based verification.
• Database verification.
• Address validation.
• Manual review.
• Order risk scoring.
• Repeat-customer checks.

A website checkbox alone provides limited evidence.

The merchant should document:

• Verification vendor.
• Verification result.
• Date and time.
• Customer location.
• Order reference.
• Failure reason.
• Manual-review decision.

Verify age at delivery

The carrier process should require an adult signature and government-issued photo ID when applicable.

The package should not be delivered through an unattended drop-off process when the applicable rules require in-person verification.

Make the delivery requirement visible before checkout. This reduces customer surprise and helps prevent “goods not received” disputes caused by missed deliveries.

Retain records securely

PACT Act records, age-verification records, payment records, and customer information require controlled access.

Use:

• Role-based permissions.
• Encryption.
• Audit logs.
• Defined retention periods.
• Secure deletion.
• Vendor oversight.
• Incident-response procedures.

PCI DSS applies to environments that store, process, or transmit payment account data. Tokenization can reduce payment-data exposure, but it does not remove all compliance responsibilities.

Payment Stack for Vape Businesses

A vape merchant needs more than a merchant ID.

The payment stack should connect the website, gateway, acquirer, fraud tools, recurring billing, shipping, and reporting systems.

Select an approved gateway

The gateway should support the merchant’s approved acquiring account and sales channels.

Evaluate:

• E-commerce compatibility.
• Virtual terminal access.
• Card-not-present controls.
• AVS and CVV tools.
• Velocity filters.
• IP and device controls.
• Recurring billing.
• Tokenization.
• Hosted payment pages.
• API access.
• Chargeback alerts.
• Reporting.
• ACH support.
• Multi-currency support.

Bridge’s payment gateway integration page describes gateway options including NMI, Authorize.net, USAePay, and PayTrace.

The selected gateway must be approved for the merchant’s vape activity. A gateway connection does not independently authorize a restricted product category.

Use tokenization for stored credentials

Tokenization replaces payment-card data with a payment token.

The merchant can use the token for approved recurring transactions without storing raw card data in its own systems.

Tokenization should be implemented through a qualified gateway or service provider. The merchant still needs to understand:

• Where payment data is stored.
• Which systems can access it.
• Which APIs can initiate charges.
• How tokens are protected.
• How cancellations work.
• How account migrations are handled.
• How PCI responsibilities are assigned.

Use recurring billing only with documented consent

Recurring billing should connect to:

• Customer consent.
• Order terms.
• Cancellation records.
• Renewal notices.
• Failed-payment logic.
• Retry limits.
• Refund rules.
• Chargeback monitoring.

Avoid aggressive retry sequences. Repeated attempts can increase issuer declines, customer complaints, and fraud signals.

Consider ACH for B2B wholesale

ACH can support wholesale distribution, invoices, and business-to-business recurring payments.

It may reduce card-network costs for eligible transactions. It also creates different risks, including:

• Unauthorized debits.
• Returns.
• Insufficient funds.
• Account validation issues.
• Settlement delays.
• Authorization requirements.

ACH does not bypass tobacco regulation, state licensing, product restrictions, or delivery rules.

Use ACH for documented business relationships. Maintain signed authorizations, invoice records, customer identity information, and return procedures.

Review the right merchant account features

A vape business should evaluate merchant account features that support daily operations.

Relevant tools include:

• Chargeback alerts.
• Representment assistance.
• Fraud screening.
• AVS.
• CVV matching.
• Velocity controls.
• IP geolocation.
• Device fingerprinting.
• Recurring billing.
• Virtual terminal access.
• ACH and eCheck.
• Reporting dashboards.
• Deposit reconciliation.
• Multi-currency settlement.
• Dedicated support.

The lowest rate is not enough if the account lacks dispute controls or stable underwriting support.

How a Merchant Account Broker Helps

A merchant account broker can match the business with acquiring banks that understand regulated and card-not-present industries.

The broker should help with:

• Application preparation.
• Product review.
• Document collection.
• Bank matching.
• Gateway selection.
• Reserve negotiation.
• Pricing analysis.
• Network registration.
• Chargeback planning.
• Migration from a current processor.
• Ongoing account support.

Bridge’s high-risk page reports:

• A 94% approval rate for high-risk applications.
• Relationships with 30+ acquiring banks.
• Average approval times of 3 to 5 business days.
• Potential support for 135+ currencies.
• Case-by-case reserve negotiation.
• 5% to 10% rolling reserves for some merchants during an initial period, typically about six months.

These are Bridge-reported business claims. Actual approval, pricing, reserve, currencies, and timing depend on underwriting, product legality, licensing, processing history, bank policy, and network requirements.

Apply with a complete file

Send the broker:

• Corporate documents.
• Ownership records.
• Processing statements.
• Bank statements.
• Product catalog.
• Supplier records.
• FDA-related documentation.
• State licenses.
• Shipping process.
• Age-verification process.
• Chargeback history.
• Website access.
• Customer-service policies.

A complete file allows the broker to present the risk accurately.

Disclose every sales channel

List all channels:

• Website.
• Telephone orders.
• Invoices.
• Subscriptions.
• Retail point of sale.
• Wholesale.
• International sales.
• Marketplaces.
• Mobile checkout.

Approval for online retail may not cover telephone sales or wholesale invoicing. Approval for one website may not cover a second brand or domain.

Negotiate the reserve

Reserve terms should reflect actual risk controls.

A merchant with strong licenses, low disputes, verified delivery, clean statements, and stable history may have more negotiating leverage than a new business with no processing records.

Ask for a reserve review after a defined performance period. Request written terms for reductions, release dates, and account closure.

2026 Vape Merchant Account Checklist

Complete this checklist before applying.

Regulatory

• Confirm the business role.
• Identify retailer, manufacturer, importer, or distributor activity.
• Review FDA product status.
• Collect PMTA documentation where applicable.
• Confirm federal warning requirements.
• Check state licenses.
• Check local licenses.
• Review flavor and product restrictions.
• Confirm PACT Act obligations.
• Confirm shipping availability.
• Confirm adult-signature procedures.

Underwriting

• Prepare corporate documents.
• Prepare ownership records.
• Prepare bank statements.
• Prepare processing statements.
• Prepare supplier invoices.
• Prepare product catalog.
• Prepare website policies.
• Disclose prior account closures.
• Disclose all sales channels.
• Disclose recurring billing.
• Explain international activity.

Payment technology

• Use an approved gateway.
• Configure AVS.
• Configure CVV.
• Configure velocity controls.
• Configure fraud screening.
• Use tokenization for stored credentials.
• Do not store CVV.
• Test recurring billing.
• Test refunds.
• Test cancellations.
• Connect chargeback alerts.
• Reconcile deposits.

Chargeback control

• Use a recognizable billing descriptor.
• Send order confirmations.
• Send shipment notices.
• Provide tracking.
• Require adult signature where applicable.
• Retain delivery evidence.
• Show subscription terms.
• Provide cancellation access.
• Monitor Visa and Mastercard ratios.
• Respond to disputes quickly.
• Review disputes by product, campaign, and channel.

Final Action

Vape payment processing requires disclosure, documentation, compliant delivery, accurate network classification, and active chargeback management.

Do not rely on a generic payment account.

Do not hide the product category.

Do not process before confirming that the product, website, shipping method, and acquiring account are approved.

Call 866-305-6454 now to review the business model, product mix, processing history, gateway needs, reserve expectations, and approval path for a high-risk vape merchant account.

Sources

• FDA Deeming Regulations for E-Cigarettes, Cigars, and Other Tobacco Products
• FDA Premarket Tobacco Product Applications
• ATF Tobacco Sellers: Reporting, Shipping, and Tax Compliance Requirements
• USPS PACT Act Information Kit
• Visa Merchant Data Standards Manual
• Visa Public Rules
• Mastercard Quick Reference Booklet
• Mastercard Rules
• Mastercard Security Rules and Procedures Merchant Edition
• PCI Security Standards Council
• PayPal Acceptable Use Policy
• Stripe Restricted Businesses
• Square General Terms of Service
• California Department of Tax and Fee Administration Tobacco Licensing
• CDC State Tobacco Activities Tracking and Evaluation System