What Stripe, Square, PayPal and Shopify Say About High-Risk Merchants

The short version

The same merchant can be fine on one aggregator and refused by the next, so "high risk" is partly a question of where the merchant happens to process. Square draws its line between online and in person: tobacco in the shop is fine, tobacco on the website isn't. And Shopify Payments is stricter than Stripe, one of its two US processors, because Shopify's help pages add their own refusals on top of Stripe's list.

Stripe

Stripe's restricted businesses list was last updated on 22 September 2026. Its definition of restricted: "Businesses in these categories require additional due diligence by Stripe in order to confirm our ability to support them." Its support page is blunter about the odds: "If your business is on our Restricted Business list, it is unlikely we will be able to accept payments for you."

• Vapes and tobacco. Restricted: "Tobacco products, including e-cigarettes, cigars, and e-liquid sold in accordance with applicable law", with a US note that "merchants selling electronic tobacco may only sell products authorized by the Food and Drug Administration".
• CBD. Restricted: "CBD products containing only negligible amounts of THC, per local limits". Prohibited: "CBD products with THC levels greater than the applicable local jurisdiction's legal limit, including CBD edibles". Stripe's FAQ adds: "Our restrictions currently include products with CBD or THC in them." Delta-8 and THC-A aren't named.
• Kava and drug equipment. Prohibited: "Illegal drugs, substances designed to mimic illegal drugs, including kava", and "Equipment and items intended to be used for making or using drugs". Kratom isn't named.
• Firearms. "Legal firearms and other weapons (Limited availability: Please contact our sales team if you would like to work with Stripe."
• Supplements. Only "Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims" are prohibited.
• Peptides. The FAQ says "Yes, Stripe supports the sale of many different peptides, with some limitations", adds that "A large number of peptides are prescription only and are required to be sold by pharmacies, meaning Stripe must preapprove the merchant", and prohibits "Incorrectly labeled research chemicals".
• Pharmacies and telemedicine. Restricted: "Online pharmacies, including SaaS platforms", "Card-not-present prescription-only products and pharmaceuticals" and "Telemedicine and telehealth services". Compounded GLP-1s aren't named.
• Free trials. Prohibited when hidden: "Negative option marketing, negative option membership clubs, and reduced price trials with unclear or hidden pricing". Trials themselves are supported under the card-network rules.

Square

Square keeps its US restrictions in the Payment Terms (updated 30 July 2026) and the General Terms (updated 14 September 2026).

• Tobacco and vapes online. Unsupported: "(24) internet/mail order/telephone order of age restricted products (e.g., tobacco)". Square's help page explains the line: such products "may only be sold with a card-present swipe, dip, or tap payment".
• CBD and hemp. The Payment Terms don't mention CBD. Square's loan eligibility page says CBD businesses "will not be eligible for new Square loans" because of "a change in federal law that affects businesses selling CBD and hemp-derived products". An email to sellers, published by Marijuana Moment on 7 August 2026, said: "By October 15, 2026, please remove any CBD, hemp and hemp-derived items from your Square catalog (both in-person and online)." Congress has since delayed the federal change in the definition of hemp; we couldn't confirm whether Square moved its own date.
• Firearms and paraphernalia. Unsupported: "(23) sales of (i) firearms, firearm parts or hardware, and ammunition" and "(2) paraphernalia that may be used for illegal activity".
• Pharmacies. Unsupported: "(8) internet/mail order/telephone order pharmacies or pharmacy referral services".
• Med spas. Square sells to them directly: "Med spas, aesthetic clinics, aesthetic medical clinics, and spas are examples of businesses that can benefit from a med spa software solution."

PayPal

PayPal's Acceptable Use Policy was last updated on 29 October 2022. It splits the list into prohibited items and items that need PayPal's pre-approval.

• Prohibited: "(a) narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety", "(b) drug paraphernalia", "(c) cigarettes", and "(j) ammunition, firearms, or certain firearm parts or accessories".
• Pre-approval: tobacco ("Non-cigarette tobacco products, e-cigarettes, cigars"), prescriptions ("The sale of any product(s) requiring a prescription or prescription dispensing services."), telemedicine ("Providing medical services and consultations in a remote fashion.") and health care in general, defined as "all services or treatment provided by a person or organization holding itself out as a provider of health-care services".
• Braintree, PayPal's processing arm, has its own older policy (2017) that prohibits "online or other non-face-to-face tobacco or e-cigarette sales" and "pseudo pharmaceuticals".

The main policy doesn't mention CBD, kratom, delta-8 or peptides at all.

Shopify Payments

Shopify's Payments terms no longer carry their own list. They point to each processor's, which in the US means Stripe's and PayPal's. Shopify's own eligibility page then goes further: "Products or services that require regulatory approval or compliance, such as cannabis and related products, prescription drugs, medical devices, tobacco and related products, firearms, holsters, ammunition, or weapons." On hemp it is explicit: "Shopify Payments doesn't support the sale of hemp, cannabidiol (CBD), and tetrahydrocannabinol (THC) products." Supplements are refused when they "make health claims that are not verified by a local or national regulatory body."

The card networks behind them

Visa and Mastercard decide which merchant types an acquirer has to register and watch, and the processors' lists inherit from that. Mastercard's Security Rules and Procedures (4 August 2026) require registration for, among others, "Non-face-to-face pharmaceutical Merchants - MCCs 5122 and 5912", "Non-face-to-face tobacco product Merchants - MCC 5993", where tobacco includes e-cigarettes, and "Negative option billing Merchants selling physical products - MCC 5968", which covers recurring sales of products "such as cosmetics, health-care products, or vitamins". Visa's Merchant Data Standards Manual (April 2026) lists the same pharmacy and tobacco codes as high integrity risk for card-absent sales, and in the US that applies to domestic sales too.

Free trials have their own rules. Visa's took effect on 18 April 2020: merchants "must require the cardholder to expressly consent to entering an ongoing subscription service" and send a reminder "at least seven (7) days" before a trial converts. Mastercard's rule started in 2019 for physical goods and was extended to digital goods and services on 22 September 2022.

Elavon, a U.S. Bank subsidiary, is a reminder that these lines move. It started taking on CBD merchants in the autumn of 2018 and stopped processing CBD and hemp transactions after 15 May 2019, and Square's CBD notice this year is the same kind of reversal.

What this means for a payments rep

The merchant on the wrong aggregator is the conversation. A CBD shop checking out through Shopify Payments, a vape shop selling online through Square, a telehealth clinic on Stripe without the approval its list asks for: each one is running a business its processor's own page says it won't support, or will only support after a review the merchant may not have had.

You can find them from the outside, because both halves are on the merchant's homepage. What it sells is in its own words: "CBD gummies", "disposable vapes", "semaglutide weight loss", "FFL transfers". Which checkout it uses is in the page's code. Lyre Leads reads both for every business a Google Maps search returns, and the Database's "Restricted product, on Square, Stripe, PayPal or Shopify" view puts them on one list. The guide to high-risk merchant leads covers that view and the eight others, and the merchant services leads guide shows how to work a whole territory with them.

A restricted category isn't proof of a problem, though. Stripe says some restricted businesses "can use Stripe after additional detailed review and explicit approval", Square takes tobacco in person, and PayPal's pre-approval list is by definition a list of things it can approve. What the homepage gives you is the reason to ask.