What Is a High-Risk Merchant Account? A 2026 Guide

Written by the InclusivePay Merchant Advisory Team | Last updated: April 2026

InclusivePay has been placing high-risk merchants since 2018. This guide reflects what we’ve seen work – and what blows up – across hundreds of applications in CBD, hemp, peptides, nootropics, and other alternative health verticals.

If you’re reading this, there’s a decent chance something already went wrong. Maybe Stripe just froze your account. Maybe PayPal is holding your funds with no explanation. Or maybe you’re smarter than that – you’re doing the research before the shutdown happens. Either way, you’re in the right place.

Here’s the thing most guides won’t tell you upfront: being labeled “high-risk” has nothing to do with whether your business is legitimate. You can have perfect COAs, clean labels, zero health claims, and a spotless chargeback history – and still be high-risk. We’ve seen it with brands doing $50K/month and brands doing $500K/month. The classification is about your category, not your company. Understanding that changes everything about how you approach this.

So What Actually Is a High-Risk Merchant Account?

A merchant account is the underlying bank relationship that lets your business accept credit and debit card payments. When a customer checks out on your site, the transaction flows from their card through Visa or Mastercard to the acquiring bank that holds your merchant account, then settles in your business bank account.

A standard merchant account works for businesses with simple, predictable risk profiles. A high-risk merchant account is the same structure – but underwritten by a bank that has specifically reviewed your business, your products, and your compliance posture, and agreed in advance to support you. That prior agreement is everything. It’s the difference between a bank that approved you after reading your application and a processor that approved you in 30 seconds without reading anything.

Most CBD and alternative health brands learn this difference the hard way. They start on Stripe because it’s fast and easy, process for a few weeks or months, then wake up to frozen funds and a termination email. The processor wasn’t the problem. Using an aggregator instead of a proper merchant account was.

Why Stripe, PayPal, and Square Keep Failing High-Risk Merchants

Let’s be direct about this. Stripe, PayPal, and Square explicitly prohibit CBD in their terms of service. This isn’t a gray area. Stripe’s restricted businesses list includes CBD and hemp products. PayPal’s Alternative Payment Methods Agreement lists “CBD and hemp products” as prohibited. Square’s acceptable use policy bans it too. Even Farm Bill-compliant topical CBD with zero THC falls under these bans.

The reason most merchants don’t realize this until it’s too late is the way aggregators work. They don’t do real underwriting. They approve everyone instantly, pool thousands of merchants under one master account, then use automated risk algorithms to monitor transactions and remove anyone who triggers a flag. CBD always triggers that flag. So do supplements, peptides, subscriptions, and dozens of other legitimate business categories.

Real consequence: Funds are typically held for 90 to 180 days after termination. You cannot withdraw, cannot process new payments, and may be placed on the MATCH list – a database of terminated merchants that follows you for five years and makes future approvals much harder.

The other thing nobody warns you about: you don’t have to be doing anything wrong for this to happen. A sudden spike in volume, a product description with a wellness phrase an algorithm doesn’t like, a chargeback ratio that ticks up during a busy season – any of these can trigger an automated freeze. Clean businesses get shut down constantly.

Who Actually Needs a High-Risk Merchant Account?

Short answer: more businesses than you’d think. Banks and card networks classify businesses as high-risk based on the category – not the individual company. If you’re in any of these verticals, you need a dedicated account.

• CBD, hemp, and delta-8 brands. Federally legal, but Stripe, PayPal, and Square prohibit it anyway. Standard processing is not an option.
• Supplements, nutraceuticals, and nootropics. Health-adjacent claims, subscription billing models, and above-average chargeback exposure all push these into high-risk territory.
• Research peptides. Regulatory gray area, evolving FDA positioning, and elevated dispute rates. Mainstream processors won’t touch them, and many high-risk processors won’t either. See our peptide merchant account page for specifics.
• Subscription and continuity billing. Recurring billing generates predictable chargebacks from customers who forget they subscribed, don’t recognize the billing descriptor, or can’t find the cancel button.
• Adult content, firearms, travel, and gambling. Standard processors prohibit these categories entirely.
• International ecommerce. Cross-border transactions increase card-not-present fraud exposure and dispute complexity regardless of what you’re selling.

If you’ve been rejected by Stripe, PayPal, or Square – or shut down without warning after processing for weeks or months – you’re in a high-risk category whether you knew it or not. The fix isn’t finding a smarter workaround. It’s getting the right type of account from the start. See our comparison of CBD payment processors for a full breakdown of which processors actually work.

Aggregator vs. High-Risk Specialist: What’s the Actual Difference?

This is the most important thing to understand before you choose a processor. Not all processors are built the same way – and the difference determines whether your account is stable or a ticking clock.

That kind of long-term account health is rare in this industry. Most CBD and alternative health brands cycle through processors every 12 to 18 months. The difference is proper underwriting upfront and a processor that has actual banking relationships built for this category – not a workaround that gets quietly shut down six months in.

What Does a High-Risk Merchant Account Cost?

Higher than standard processing. That’s the honest answer. The question is whether it’s worth it – and compared to what.

Processing rates: For high-risk accounts typically run 2.5% to 5.0% per transaction, depending on your category, volume, and chargeback history. CBD is on the lower end for established merchants with clean processing history. Peptides and nutraceuticals run higher.

Rolling reserves: Typically 5% to 10% of monthly volume held by the acquiring bank for 90 to 180 days. This isn’t a fee – the funds come back to you. But it’s a cash flow consideration, especially in the first 6 to 12 months. Plan for it before you apply. Reserves typically reduce or disappear after a year of clean processing history.

Compare that to the alternative: A CBD brand with $40,000 in frozen Stripe funds waiting 120 days for release has paid an enormous implicit fee for choosing the wrong processor. And that’s before counting the revenue lost while the account was down. Stable processing at 3.5% beats frozen funds at 2.9% every single time.

InclusivePay does not charge application fees or volume lock fees. Rates and reserve terms are disclosed before you sign anything.

How to Get Approved – What Actually Works

Getting approved isn’t complicated if you come prepared and apply through the right channel. Here’s what the process actually looks like.

Step 1: Get your documents ready before you apply.

Most denials happen because merchants apply without a complete documentation stack. Have these ready:

• Business registration documents (LLC, EIN, articles of incorporation)
• Government-issued ID for all owners with 25% or more ownership
• 3–6 months of business bank statements
• Processing statements if you have prior history
• Certificates of Analysis (COAs) for all products – current, third-party lab, within 12 months
• Product labels for all active SKUs
• Live, compliant website with clear return/refund policy

Step 2: Clean up your website.

Underwriters look at your site before approving you. Anything that looks like a health claim – even subtle language like “reduces anxiety” or “supports sleep” – can kill an application. Remove any FDA-prohibited claims, make sure your COAs are linked or accessible, and confirm your checkout flow is clean.

Step 3: Apply through a specialist, not an aggregator.

The most common mistake is applying to Stripe or PayPal after getting rejected elsewhere. It doesn’t work – and it can get you placed on the MATCH list if you process even a small amount before getting flagged. Apply through a processor that does actual underwriting for your vertical. InclusivePay works with CBD, hemp, delta-8, research peptides (no LegitScript required for research-only sellers), nutraceuticals, and supplements. CBD payment processing page and nutraceutical merchant account page.

Step 4: Be honest about your volume and product catalog.

Underwriters will find out what you sell and how much you process. If you understate your volume to get approved and then exceed it, you risk triggering a review or freeze. Be accurate from the start and work with a processor who knows your category.

Step 5: Expect real underwriting to take time.

Pre-approval with InclusivePay typically comes within 48 to 72 hours. Full setup with your gateway live is usually 5 to 7 business days for CBD. For peptides and nutraceuticals, allow 10 to 14 business days. Real underwriting takes longer than instant approval – that’s the point. The stability you get on the other side is worth every day of the wait.

Keeping Your Account Stable After Approval

Getting approved is step one. Keeping your account stable means staying on top of a few things that matter more than most merchants realize.

• Keep chargebacks below 1%. Visa and Mastercard flag merchants above 1% for dispute monitoring. Aim for 0.8% or below to have a real buffer. For subscription businesses this means a recognizable billing descriptor, easy cancellation, and pre-billing reminders. For CBD merchants, clear product descriptions and a transparent return policy eliminate most efficacy disputes before they start.
• Maintain site compliance after approval. Processors do ongoing website monitoring. A new blog post with health claims, an updated product description with treatment language, or an ad campaign that contradicts your research-only framing can trigger a review even if your original application was spotless.
• Tell your ISO before volume spikes. A campaign that triples your monthly volume overnight looks like fraud to automated risk systems, even when it’s completely legitimate. Give us a heads-up before it happens.
• Don’t add new product categories without checking. Adding CBD to a supplement account, or peptides to a CBD account, without disclosure changes your risk profile mid-account. Run new product additions by us before they go live.

What Is the MATCH List and Should You Be Worried?

The MATCH list – Member Alert to Control High-Risk Merchants – is a database maintained by Mastercard of merchants whose accounts have been terminated for specific reasons. Being on it makes future approvals harder for up to five years.

Not every aggregator termination triggers a MATCH listing. A Stripe shutdown for selling CBD doesn’t automatically land you there. But serious violations – excessive chargebacks, fraud, deliberate policy violations – can. The best protection is never using aggregators for categories they prohibit, keeping chargebacks under 1%, and working with a processor that communicates with you before issues escalate.

If you’re not sure whether you’re on the MATCH list, contact us. We can help determine your status and figure out the right path forward.

FAQs

What is a high-risk merchant account?

A high-risk merchant account is a dedicated payment processing account individually underwritten by an acquiring bank that has specifically evaluated and agreed to support your business category. It lets businesses in regulated, chargeback-prone, or compliance-sensitive industries accept card payments when aggregators like Stripe, PayPal, and Square can’t reliably serve them. The key difference from a standard account is upfront underwriting – the bank knows what you sell before your first transaction.

Why is my business considered high-risk?

Most likely because of your industry category. CBD, hemp, supplements, peptides, adult content, gambling, travel, firearms, subscriptions, and international ecommerce are all classified as high-risk regardless of individual merchant performance. The classification is about what banks and card networks know about the category historically – not about you specifically. Chargeback history, billing model, prior terminations, and geography also factor in.

How long does approval take?

With InclusivePay, pre-approval typically comes within 48 to 72 hours. Full setup with banking in place is usually 5 to 7 business days for CBD, assuming your documents are in order. Peptides and nutraceuticals take 10 to 14 business days. Real underwriting takes longer than instant approval – that’s exactly the point.

How much does a high-risk merchant account cost?

Processing rates typically run 2.5% to 5.0% depending on category, volume, and history. Most accounts start with a rolling reserve of 5% to 10% of monthly volume held for 90 to 180 days. InclusivePay does not charge application fees or volume lock fees. Rates and reserve terms are disclosed before you sign anything.

Can I get approved if Stripe or PayPal already shut me down?

Yes. Aggregator terminations are extremely common in high-risk categories and underwriters know the pattern. A prior shutdown doesn’t disqualify you. The important thing is to be upfront about your history when you apply – a concealed termination discovered during underwriting is far more damaging than one disclosed upfront.

What is the MATCH list and am I on it?

The MATCH list is Mastercard’s database of terminated merchants. Being on it makes future approvals harder for up to five years – but it’s not a permanent ban. The best protection against ending up there is not using aggregators for categories they prohibit, and keeping chargebacks under 1%. Contact us if you think you might be listed and we’ll help figure out your options.

Does InclusivePay work with CBD, peptides, and supplements?

Yes. InclusivePay places merchants in CBD, hemp, delta-8, research peptides (no LegitScript required for research-only ecommerce), nutraceuticals, supplements, nootropics, and other alternative health verticals. See our CBD payment processing page, peptide merchant account page, and nutraceutical merchant account page for details on each vertical.

Is InclusivePay a payment processor?

No. InclusivePay is a U.S.-based ISO – an Independent Sales Organization. We work directly with domestic acquiring banks to place your business in a properly underwritten merchant account. You know who holds your account and processes your transactions. We manage the relationship and stay involved after approval. That’s very different from an aggregator like Stripe, which pools you with thousands of other merchants and monitors you with algorithms that don’t know your business from the next one.

What ecommerce platforms does InclusivePay support?

WooCommerce via Authorize.Net or NMI plugin, Shopify via approved third-party gateways, BigCommerce, ClickFunnels, and custom cart via API. See our WooCommerce CBD payment gateway guide for full setup details. One important note: Shopify Payments runs on Stripe infrastructure and doesn’t support CBD. You need a third-party gateway regardless of which platform you’re on.

The Bottom Line

Most high-risk merchants don’t fail because of a bad product or a compliance issue. They fail because their payment processing collapses at the worst possible moment – during a launch, a seasonal spike, or right after they’ve scaled ad spend.

The processors that work for this category do one thing differently: they underwrite your business before you start processing, not after. That single difference – underwriting upfront versus automated approval with delayed termination – is what separates a stable payment setup from a ticking clock.

If you’re starting fresh, do it right the first time. If you’ve already been shut down, don’t make the same mistake twice. And if you’re selling peptides or nootropics and getting turned away everywhere, the problem isn’t your business – it’s that most processors haven’t built the relationships to serve your vertical yet.

InclusivePay has been in this space since 2018. If you want to talk through your situation before applying, reach out through the contact page – no application fee, no pressure, just a straight answer on whether we can help.

– InclusivePay Merchant Advisory Team | inclusivepay.com | Updated April 2026