If you sell CBD oil, gummies, vapes or topicals in the UK and your Stripe, PayPal, Square, SumUp or Adyen account has been refused or frozen, you’re not alone. Every mainstream UK card processor classifies CBD as prohibited or high-risk.
Their Restricted Businesses policies (quoted verbatim later in this article) make that explicit. We’ve verified five UK-friendly options that will actually process compliant CBD payments.
The cheapest realistic route is Wallid Pay by Bank at 1% + £0.25 on Open Banking, which bypasses card-network restrictions entirely. The FCA-regulated UK card option is Fibonatix (FCA FRN 768776, verified live).
The CBD-dedicated specialist is Nomupay with a stated “100% Approval Rate” for compliant merchants. For established brands processing £100k+/month, Worldpay underwrites CBD case-by-case.
Two brands worth knowing about that don’t accept CBD: ECOMMPAY (FCA FRN 607597) lists “psychoactive products (e.g., K2, Salvia Divinorum, CBD)” in its prohibited industries.
Nuvei (FCA EMI FRN 994233) states “ingestible CBD products are prohibited in all EU member states.” Don’t waste an application on either.
Best High-Risk Merchant Accounts at a Glance
We rank the five verified CBD-friendly UK options by buyer profile, not alphabetically.
The right choice depends on your processing volume, integration platform (Shopify vs WooCommerce vs custom), and whether you can absorb a rolling reserve that locks roughly half a reserve cycle worth of capital indefinitely.
We checked each provider’s acceptance policy directly against their published terms on 29 May 2026. Wallid, Fibonatix and Nomupay explicitly advertise CBD acceptance.
Worldpay underwrites CBD merchants case-by-case through a specialist team. Cardstream is a gateway rather than an acquirer — CBD acceptance depends on which of its 60+ partner acquirers underwrites the merchant.
No reader should sign anything without the written-confirmation checklist (Section “How to Get a Merchant Account if Your Business Is High-Risk”). That’s the unique decision-useful artefact of this article. Demand each line in writing before you put your business name on a contract.
Best High-Risk Merchant Accounts for UK Businesses
Best for Open Banking economics — Wallid Pay by Bank
Wallid Pay by Bank is a Shopify-native Open Banking app that lets UK CBD merchants take payments via Account-to-Account (A2A) bank transfer rather than Visa or Mastercard. Because the transaction never touches a card network, the network’s CBD restrictions don’t apply.
The headline fee is 1% + £0.25 per transaction on the standard plan. Merchants with higher monthly volume can negotiate down to 0.7% + £0.25. We verified both figures live at wallid.co on 29 May 2026.
Two structural advantages stand out: chargebacks are zero (Pay by Bank transactions are non-reversible by design), and settlement is instant or same-day to your UK business bank account.
No rolling reserve is held against future disputes — meaningful relief if you’ve previously had funds locked by a card acquirer.
The trade-off: conversion rates on Open Banking checkouts are typically lower than card checkouts because customers must complete a banking app redirect.
If your funnel can absorb a 5-15% conversion-rate hit in exchange for predictable cash flow and no chargebacks, Wallid is the cheapest viable route.
For context on how Direct Debit alternatives compare, see our GoCardless review — though note GoCardless itself does not accept CBD merchants either.
Visit WallidBest for FCA-regulated UK underwriting — Fibonatix
Fibonatix (UK) Limited is an FCA-authorised Payment Institution under PSR 2017. FRN 768776, company number 09738892. We verified both directly against the FCA Financial Services Register on 29 May 2026.
Fibonatix explicitly markets to the CBD sector through a dedicated underwriting team. Their published stance: “As a trusted provider specialising in high-risk industries, we understand the unique challenges faced by CBD businesses.”
That distinguishes them from offshore PSPs (CCBill, eMerchantBroker) and from acquirer-routed gateways like Cardstream — Fibonatix underwrites directly under a UK FCA licence.
Pricing is fully bespoke. There is no published rate card. Demand a written quote that itemises the transaction percentage including high-risk premium, the gateway fee, the rolling reserve percentage and hold period, and the chargeback fee per case.
The full eight-point checklist (below) is the right framework to take into that conversation.
Best fit, as we read it: established CBD ecommerce merchants who can produce a complete underwriting pack (FSA Novel Food validation, third-party COA per SKU, 3-6 months of processing history with chargebacks under 2%) and want UK-FCA-direct rather than offshore acquirer-routed processing.
Get a Fibonatix QuoteBest CBD-dedicated specialist — Nomupay
Nomupay (formerly Total Processing) acquired the Manchester-based high-risk specialist in 2023 and now operates a dedicated CBD payment gateway.
The published claim: “100% Approval Rate on our CBD Payment Gateway” for compliant merchants. We verified this live at nomupay.com/cbd-payment-gateways/ on 29 May 2026.
One structural caveat to know upfront: Nomupay is not directly FCA-authorised in the UK. The regulated entity is UAB Nomu Pay Europe, authorised by the Bank of Lithuania (PI licence 20).
UK acquiring is routed through partners including Fiserv/Cardnet, Nexi and Acquired.com. That’s common for European PSPs operating in the UK post-Brexit.
It doesn’t affect operational service for you, but it means the safeguarding regime sitting behind your merchant funds is Lithuanian rather than UK FCA. Worth knowing if you compare safeguarding postures.
Nomupay’s THC underwriting threshold is stricter than the UK statutory ceiling of 0.2%: “We have a maximum limit of 0.09% THC and would require lab reports to show this for all products that are on your website” on their primary underwriting path.
Certain partner acquirers may permit up to 0.2%. If your existing COAs show 0.10-0.19% THC, confirm which acquiring partner you’ll be routed to before applying.
Integration breadth is strong: Shopify (via Cybs), WooCommerce, Magento v2, BigCommerce, OpenCart, PrestaShop plus Xero, QuickBooks and Sage. CBD transactions are categorised under MCC 5499.
Setup fees are zero per Nomupay’s published statement. Rolling reserves are described as “optional” but typically 5-10% over 90-180 days in line with industry norms.
Get a Nomupay QuoteBest for established CBD brands — Worldpay specialist underwriting
Worldpay is a Tier-1 UK acquirer and will underwrite CBD merchants directly under specialist conditions. Unlike aggregators (Stripe, Square), Worldpay assesses merchants on a bespoke basis rather than running automated screens that detect CBD keywords and auto-terminate.
The trade-offs are real: onboarding takes 10-15 business days for stringent Visa and Mastercard network clearances; rates are bespoke and elevated against the standard 2.75% e-commerce baseline; setup fees may apply.
A rolling reserve will be imposed on top. Worldpay also enforces a “Merchant Location Disclosure” rule — your business name, country and address must display before checkout. (For broader payment processing context, see our payment processing guide.)
Best fit: established CBD brands processing £100k+/month with a multi-year compliant trading history, complete FSA Novel Food authorisation, and the capital to absorb a 6-month rolling reserve cycle. Worldpay is not suitable for startups or merchants previously MATCH-listed.
Visit WorldpayBest for acquirer-switching flexibility — Cardstream
Cardstream is a UK PCI DSS Level 1 compliant white-label payment gateway integrated with 60+ acquiring banks including Worldpay, Elavon, Trust Payments, Allied Wallet, Credorax, Barclaycard and Global Payments (HSBC).
It does not underwrite merchants directly — CBD acceptance depends on the partner acquirer chosen.
The strategic value: if your underlying acquirer terminates your CBD account, you can switch to a backup acquirer within the Cardstream network without rebuilding your website’s checkout integration. For merchants previously terminated mid-trading, this multi-acquirer insurance is meaningful.
Two contracts to manage: a gateway contract with Cardstream (typically a monthly rental plus per-transaction pence) and a separate merchant agreement with the acquiring bank.
Read the exit terms on both before signing. Specialist ISOs frequently white-label Cardstream paired with CBD-friendly acquirers like Allied Wallet or Trust Payments.
Best fit: CBD merchants who’ve been terminated before and want the ability to switch acquirers without rebuilding checkout. Pair with a CBD-accepting acquirer to actually take payments — Cardstream by itself doesn’t process.
Visit CardstreamHigh-Risk Merchant Account Providers Compared
Full pricing detail is bespoke for four of the five picks — only Wallid publishes a public rate card. The comparison below records what we verified live on 29 May 2026 plus what reader needs to demand in writing where the published data ends.
Wallid Pay by Bank
Fibonatix (UK) Limited
Nomupay
Worldpay
Cardstream
Two US-domiciled high-risk specialists worth knowing about but not recommending as primary UK picks: CCBill at 5.9% + ~£0.43 ($0.55) per transaction and eMerchantBroker (EMB) at 2.7-4.3% plus roughly £8–36 ($10–45)/month in gateway fees (both USD-priced).
Both accept compliant UK CBD merchants via offshore acquirers. Currency conversion adds roughly 1% effective cost per transaction for GBP-settling merchants — making both materially more expensive than they appear on the headline rate.
How to Get a Merchant Account if Your Business Is High-Risk
CBD merchant account applications are document-heavy. The right frame, as we work with merchants on these, is this: assemble the full underwriting pack before you approach any PSP, then send the same pack to two or three providers in parallel.
We’ve seen re-submitting incomplete packs become the single biggest cause of rejection or extended onboarding delays. Get the pack right once, then go wide.
Corporate legitimacy: Certificate of Incorporation, Ultimate Beneficial Owner (UBO) identification, valid government ID for every director and shareholder, three years of address history per director.
Financials: 3-6 months of business bank statements. If you’ve previously processed cards, 3-6 months of historical processing statements showing volume, refund rate, and chargeback rate. Chargeback ratio under 2% is mandatory for acceptance at every CBD-friendly PSP we surveyed.
FSA Novel Food authorisation: For ingestibles (oils, gummies, capsules, beverages), evidence that your products are registered on the FSA Public List as “Validated” or “Awaiting Evidence”. Products marked “Removed” or absent from the list must be withdrawn from sale before applying.
Third-party Certificates of Analysis (COA): Independent lab reports for every product SKU you sell. COAs must show THC content below the underwriter’s threshold — Nomupay’s strict path is 0.09%; the UK statutory limit is 0.2%.
Where your COAs show traces between these two levels, confirm acquirer tolerance before submitting.
Website compliance: Clear refund and cancellation policies, delivery policies, no medicinal claims (per MHRA), secure SSL checkout, 18+ verification at checkout via AgeChecked or Yoti.
Once your pack is ready, demand written answers to the eight-point checklist below before you sign any agreement. Anything vague at this stage will be vague forever — you lose negotiating power the moment you commit.
High-Risk Merchant Account Fees and Reserves
The two financial mechanics that shape CBD merchant cash flow are the rolling reserve and the chargeback threshold. Understanding both quantitatively beats any qualitative provider review.
Rolling reserve worked example. A typical UK CBD merchant on a 10% rolling reserve over 180 days, processing £100,000 monthly: by Day 180, the processor is holding approximately £60,000 of your capital.
On Day 181 the £1,000 from Day 1 releases, and 10% of Day 181’s sales enters the reserve. The permanent cash-flow deficit equals roughly half a reserve cycle — you never get it back while you’re still processing.
Industry norms across CBD-friendly providers, as we’ve reviewed them: rolling reserves sit between 5% and 20% of monthly volume, held for 90 to 180 days. We recommend negotiating reserve reduction after 6-12 months of clean processing history — that’s standard but requires you to ask.
Visa VAMP threshold (effective 1 April 2026). Visa consolidated its dispute and fraud programs into the Visa Acquirer Monitoring Program (VAMP). Effective 1 April 2026, the “Excessive Merchant” threshold tightened from 2.2% to 1.5% (150 basis points).
Breach the threshold AND record 1,500+ combined fraud or dispute events per month, and an $8 enforcement fee per fraudulent or disputed transaction applies on top of whatever your acquirer charges you per chargeback.
Mastercard ECP and MATCH list. Excessive Chargeback Merchant (ECM) status triggers at 100 chargebacks per month AND a ratio of 1.5%-2.99% — fines start at up to $1,000/month for the first three months.
High Excessive Chargeback Merchant (HECM) triggers at 300 chargebacks AND 3.0%+ ratio — fines up to $200,000/month.
Account termination for excessive chargebacks puts you on the MATCH list for five years, making standard processing services near-impossible to obtain globally during that window.
For CBD merchants specifically, hitting these thresholds is commercial extinction. Tooling that helps stay below them — Ethoca Alerts (Mastercard issuer network) and Verifi RDR (Visa Rapid Dispute Resolution) — should be one of your written-confirmation checklist items at any PSP onboarding.
The Verdict
There is no mainstream payment gateway for CBD — Stripe, PayPal, Square and most high-street acquirers prohibit the sector outright. The realistic choice is between an Open Banking workaround and a genuine high-risk merchant account, and the right answer depends on how you sell and how much documentation you can produce.
If you sell on Shopify to UK customers, Wallid Pay by Bank is the cheapest viable route at 1% + £0.25 — it sidesteps card-network restrictions entirely, carries zero chargebacks and holds no reserve, provided your funnel can absorb the lower Open Banking conversion. If you need card acceptance with UK-regulated underwriting, Fibonatix is the strongest pick: FCA-authorised, CBD-specialist, and underwriting directly rather than through an offshore acquirer — provided you can supply a full FSA Novel Food and COA documentation pack. Nomupay is the dedicated CBD specialist with a published 100% approval claim for compliant merchants, but note the Lithuanian (not UK FCA) safeguarding and the stricter 0.09% THC underwriting threshold.
Worldpay suits established, higher-volume CBD brands that can withstand an 18-month contract and slower onboarding, while Cardstream is a gateway rather than a provider — useful as insurance against repeat termination, but only once paired with a CBD-accepting acquirer. Whichever you choose, the decisive factor is the same: get the transaction rate, gateway fee, rolling reserve percentage and hold period, and per-chargeback fee itemised in writing before you sign.
Frequently Asked Questions
Why do Stripe, PayPal, Square, SumUp and Adyen all ban CBD in the UK?
Each operates under aggregator card-network agreements that flag CBD as a prohibited or restricted category. Stripe states “Our restrictions currently include products with CBD or THC in them.” PayPal’s Acceptable Use Policy lists narcotics and controlled substances. Square states “Unfortunately, Square cannot support card-processing payments for CBD-related services and products in the UK.” SumUp bans “marijuana-related businesses.” Adyen prohibits “ingestible CBD products in all EU member states.” These are commercial risk decisions by each provider, not regulatory bans — CBD sold under FSA Novel Food authorisation with under-0.2% THC is legal in the UK.
Is CBD legal to sell in the UK?
Yes, with conditions. CBD must be extracted from EU-approved industrial hemp containing under 0.2% THC. Ingestibles (oils, gummies, capsules, beverages) require FSA Novel Food authorisation — products on the FSA Public List marked “Validated” or “Awaiting Evidence” may be sold; “Removed” or unlisted products must be withdrawn. No medicinal claims allowed (regulated by the MHRA). Sale to 18+ only with age-verified checkout. The FSA also set a provisional Acceptable Daily Intake of 10 mg CBD/day for healthy adults in June 2025, plus a 1 µg/kg body weight/day THC upper limit.
What is a rolling reserve and how does it affect my cash flow?
A rolling reserve is a percentage of your monthly card volume that your acquirer holds back to cover future chargebacks and refunds. Typical CBD rates are 10% of processed volume held for 180 days. The cash-flow impact: processing £100k/month with a 10% × 180-day reserve, the acquirer holds approximately £60,000 of your capital by Day 180. The reserve “rolls” — Day 1’s reserve releases on Day 181 just as Day 181’s reserve enters. You permanently lose access to half a reserve cycle while you’re still processing.
How do CBD-friendly options compare to mainstream payment processing?
Mainstream UK card processors like Stripe ban CBD entirely. See our Stripe review for what their published Restricted Businesses policy looks like. For Direct Debit alternatives that are CBD-agnostic, see our GoCardless review — though GoCardless doesn’t accept CBD merchants either. The five providers in this article are the verified options.
What’s the difference between a payment gateway and an acquiring bank?
A payment gateway (e.g., Cardstream) is the software layer that transmits card data securely from your checkout to the acquirer. An acquiring bank (e.g., Worldpay, Elavon, Trust Payments) is the financial institution that underwrites your merchant account, holds reserves, settles funds and accepts chargeback risk. For CBD: Cardstream is gateway-only, you still need a CBD-friendly acquirer behind it. Fibonatix, Nomupay and Worldpay each combine both roles (or route them through partners) under a single contract.
What chargeback ratio will get me terminated?
Visa’s VAMP threshold tightened to 1.5% effective 1 April 2026 — breach it plus 1,500+ events/month and you face $8 per disputed transaction. Mastercard’s ECP triggers at 100 chargebacks AND 1.5%-2.99% ratio (Excessive Chargeback Merchant) with fines from $1,000/month. HECM triggers at 300 chargebacks AND 3.0%+ with fines up to $200,000/month. Most CBD acquirers terminate well below network thresholds — in practice keep chargebacks under 1.0% to stay in good standing.
Do I need FSA Novel Food authorisation to take payments for CBD?
For ingestible CBD products (oils, gummies, capsules, beverages), yes. FCA-authorised PSPs underwriting CBD merchants require evidence that your products are on the FSA Public List as “Validated” or “Awaiting Evidence”. Products marked “Removed” or absent from the list must be withdrawn before applying. For topicals (creams, balms), vapes, and smoking accessories, FSA Novel Food doesn’t apply but MHRA medicinal-claims rules and Trading Standards 18+ rules still do. The FSA also permitted product reformulation from February 2026 specifically to meet the new 10 mg/day CBD and 0.07 mg/day THC limits.
Are ECOMMPAY or Nuvei viable for UK CBD merchants?
No. Both explicitly ban CBD in their published Restricted Businesses policies, despite their reputations as high-risk specialists. ECOMMPAY lists “psychoactive products (e.g., K2, Salvia Divinorum, CBD, nitrate inhalers…)” as prohibited. Nuvei states “ingestible CBD products (e.g. oils, gummies, teas, supplements, capsules, vapes) are prohibited in all EU member states.” Applying to either is wasted time for a UK CBD merchant.
Methodology and Disclosure
How we reviewed this
Provider acceptance verification: Each provider’s published Restricted Businesses or CBD policy verified live on 29 May 2026.
Verbatim policy quotes in this article are taken directly from each provider’s primary source (stripe.com, paypal.com, squareup.com/gb, sumup.com/gb, adyen.com, nuvei.com, ecommpay.com, nomupay.com, wallid.co, fibonatix.com, cardstream.com, worldpay.com).
Regulatory data: FCA Firm Reference Numbers verified against register.fca.org.uk on 29 May 2026 (Fibonatix 768776, ECOMMPAY 607597, Nuvei 994233). Nomupay’s Bank of Lithuania Payment Institution licence verified via Lietuvos bankas register.
FSA Novel Food regime updates and reformulation allowance verified against food.gov.uk and Cannabis Trades Association reporting. Visa VAMP 1.5% threshold and Mastercard ECP/HECM thresholds verified against each scheme’s published merchant documentation.
Affiliate disclosure: BusinessExpert may receive referral fees from some providers. This doesn’t affect our verification process or editorial assessment.
Wallid, Fibonatix, Nomupay, Worldpay and Cardstream were selected because they demonstrably accept compliant UK CBD merchants — not based on commercial relationship. Read our full editorial policy.