Vape and E-Cigarette Payment Processing: No Easy On-Ramp, Ever

Most high-risk founders lose an account after underwriting finally catches up with them. Vape founders lose it because there was never an underwriting decision to begin with. Nearly every mainstream processor writes nicotine and vapor products out of its acceptable use policy, so an account opened by describing the store as an accessories or gadgets retailer was never approved for what it actually sells. It processes cleanly for months, until a review, a keyword sweep, or one customer complaint connects the storefront to the merchant record. Then the gateway closes, the balance goes into a hold against refund and chargeback exposure, and your shipping problems get worse because you cannot refund with frozen money. Underneath all of that sit federal shipping and reporting rules, state excise registrations, a purchase age of 21, and a premarket pathway most products have not cleared. This is a guide to why vape merchants have no easy on-ramp, what a specialist acquirer requires, and the structure that keeps a compliant store processing when the approved-acquirer pool is this thin.

The 2021 rules that rewrote the shipping model

The PACT Act was written for mail-order cigarettes, and legislation signed at the end of 2020 extended it to electronic nicotine delivery systems, with the operative requirements landing in 2021.

The obligations are concrete. Register with the ATF and with the tobacco tax administrator in every state you ship into. File monthly reports of your sales into those states. Collect and remit state and local excise taxes on vapor products. Verify age at purchase and again at delivery, with an adult signature on receipt.

Then the mailing rules changed underneath the category. The Postal Service finalized its rule treating vaping products as nonmailable to consumers, and the major private carriers followed with their own bans on consumer vape parcels. What is left is a patchwork of regional couriers and age-verified delivery services, slower and more failure-prone than the shipping most operators plan around.

None of that is payments regulation, and all of it is payments-relevant. Acquirers treat PACT compliance as a proxy for whether you survive an audit, so your registrations get checked before your rates get quoted. And a fragile delivery network converts directly into disputes, the number your MID actually lives or dies on.

Why there is no aggregator on-ramp at all

CBD merchants can sometimes find a narrow, permissioned program at a large processor, as covered in the CBD guide. Vape has no equivalent. Stripe, PayPal, Square, and Shopify Payments prohibit tobacco, nicotine, and e-cigarette sales as a flat category decision, and there is no compliance file good enough to reopen that conversation.

So the only way a vape store ends up on an aggregator is by describing itself as something else. That is not a shortcut with a bad ending, it is one with a guaranteed ending, and the mechanism is the one described in why processors shut down high-risk accounts: onboarding is instant because underwriting is deferred, not waived.

The consequences are worse here than in a merely restricted category. Selling a prohibited product under a category description that does not match it is a card-network integrity problem, not just a policy breach, and terminations of that kind commonly come with a MATCH listing. Reason codes vary, but the listing follows the principals for five years and makes the dedicated accounts you now urgently need much harder to open. The fastest route to processing today is the one that removes your options tomorrow.

The authorization gap underwriters are pricing

The FDA requires premarket authorization for new tobacco products, including vapor products, and the deadline for products already on the market passed in 2020.

The agency has authorized a limited set of e-cigarette products, starting with tobacco-flavored devices and later extending to a small number of menthol products. The overwhelming majority of flavored products in circulation, and effectively the entire imported disposable segment, do not hold marketing authorization. Enforcement has been uneven and heavily litigated, so treat this as a live risk rather than a settled rule.

An acquirer sees a catalog that a federal agency could order off the market, with refund liability landing on the bank if that happens mid-cycle. Enforcement actions and import seizures aimed at unauthorized disposables have made that concrete enough that some acquirers screen for brands by name.

The state layer compounds it: flavor restrictions vary by state and sometimes by city, and a growing number of states now maintain directories of vapor products that may lawfully be sold there, typically keyed to authorization status. A catalog that is compliant in one state is contraband two states over, and the acquirer sits downstream of every one of those lines.

What processing actually looks like

	Aggregator	Vape-approved dedicated MID	Offshore acquiring
Vape appetite	Prohibited outright	Available through a small pool of high-risk ISOs	Available, jurisdiction dependent
Coding	Miscoded by definition	MCC 5993 or equivalent, monitored	Varies by acquirer
Onboarding	Days, then discovery	2 to 4 weeks with full underwriting	3 to 6 weeks
Reserve	None, then the held balance on termination	Rolling reserve, often 10% or more	Often higher
MATCH risk	High	Low	Low
Realistic role	None	Primary processing	Redundancy and international

Vape merchants are typically coded under MCC 5993, the cigar stores and stands code, which is designated high risk and carries registration and monitoring obligations for the acquirer. That coding is correct and you want it, but your dispute headroom is smaller and escalation faster than for a general retailer.

The small approved-acquirer pool has a second effect founders underestimate. Thin supply means poor pricing, almost no leverage, and no fallback that understands the category when a single account ends. Running at least two vape-approved MIDs and balancing volume across them, the approach in the MID load balancing guide, is not an optimization in this vertical. It is the difference between a routing change and a dead storefront.

Juice and pod replenishment subscriptions make the second structural piece matter as much. If your recurring cohort is tokenized inside one gateway, an acquirer change forces every subscriber to re-enter a card, which is where the revenue actually disappears. Holding cards in a token vault outside your processors keeps the customer file yours.

The underwriting pack

Vape underwriting is document-heavy and mechanical, so preparation converts directly into approval speed.

Lead with compliance evidence, because that is what the file is assessed on. ATF registration, state tobacco tax registrations for every state you ship into, your monthly reporting process, and your excise tax handling. Then your age-verification vendor: an integration that checks identity against public records at checkout, not a birth-date checkbox, plus the adult-signature delivery setup with your carriers. No real age-verification provider is an automatic decline at every acquirer that touches this category.

Give a complete SKU and brand list, flag which products hold authorization and which do not, and name the states and products you block. Disclose disposables rather than letting a site review find them, because undisclosed catalog reads as concealment and kills otherwise priceable files.

Show that blocked-state and blocked-product logic runs at checkout and again at fulfillment, and that your descriptor, domain, and storefront name match.

Then bring the numbers: processing history, chargeback and refund ratios, average ticket, monthly volume, and a projection you can defend.

Day to day, disputes here are a logistics problem

In most high-risk verticals the dispute baseline is driven by billing. In vape it is driven by delivery.

Item-not-received is the dominant reason code, because the carrier network is thin and adult-signature requirements produce failed deliveries that customers dispute instead of waiting out. Hardware failure rates on coils, pods, and devices run higher than general ecommerce, so quality disputes stack on top. Some cardholders dispute to hide the purchase from family, friendly fraud you can only beat with delivery evidence. Subscription programs add forgotten-rebill disputes to all of it.

The controls follow from that: tie signature confirmation and carrier tracking to every transaction so representment has something to work with, refund shipping complaints instantly rather than arguing them, and wire prevention alerts from both major networks into your support queue before disputes post. Pull your actual chargeback reason codes monthly, because the mix tells you whether you have a carrier problem, a hardware problem, or a billing-clarity problem. Handle decline codes precisely as well, since retrying hard issuer declines on a monitored MCC erodes your authorization rate and attracts exactly the scrutiny you are trying to avoid.

One control sits above all the others. Never let a sale to a minor through: that is the fastest way for a vape merchant and its acquirer to attract enforcement, and it is the one failure no compliance pack recovers from.

Practical takeaway

Vape is not hard to bank because the product is illegal. It is hard to bank because the compliance surface is enormous, the delivery network is broken by design, the authorization status of most inventory is unresolved, and the pool of acquirers willing to sit downstream of all that is small. The account that lasts runs on two or more vape-approved dedicated MIDs, real age verification, current PACT and state tax registrations, disclosed inventory, delivery evidence attached to every order, and cards vaulted outside any single processor. The account that fails is coded as something it is not, processes beautifully for a quarter, and ends with a held balance, a MATCH listing, and no acquirer left to call. If your vapor revenue runs through one processor, or one that does not know what you sell, fix the structure while your history is still clean. When you want it mapped to your catalog, states, and volume, apply for an architecture review.