Paymotile

Merchant Services For Your Business

Gregg Morrow

4 Steps to Get Your Merchant Account Approved

by

Whether you are opening your first merchant account or switching to a processor with better terms, approval comes down to one thing: showing the bank that your business is real, legal, well run and honest about what it sells. Preparing ahead of time makes that easy to prove.

Here are four steps to get your merchant account approved and, just as important, to keep it open once you have it.

Are you ready to get approved?

Quick answers

  • Who decides? The acquiring bank. Under the Visa Rules it must confirm a merchant is financially responsible and operating within an allowed jurisdiction before signing it.
  • What gets applications declined most often? Missing or inconsistent documents, a website that lacks basic policies, a vague description of what you sell, and a history of high chargebacks.
  • Does the 2025 FinCEN change mean I skip ownership questions? No. US companies no longer file beneficial ownership reports with FinCEN, but banks still identify and verify the owners of business customers.
  • What keeps an account open? Low dispute and fraud rates, honest sales practices and current PCI DSS compliance.

1. Do Your Homework

a laptop with a notebook, coffee cup to the side
Researching providers before you apply saves time and avoids needless declines.

Research providers before you fill out a single application, so you know which ones actually serve businesses like yours. Ask yourself:

  • Is my industry considered high risk? Travel, subscriptions, supplements, CBD, credit repair and similar verticals usually need a provider that specializes in high-risk credit card processing. Applying to a low-risk platform first often ends in a decline or a frozen account later.
  • How will I take payments? In person with a POS system, online through a gateway, over the phone, or all three? Card-not-present sales are underwritten differently from card-present sales.
  • What volume and average ticket will I run? Be realistic. Underwriters set limits based on what you state, and processing far above your approved volume can trigger holds.
  • How should my business be classified? Every merchant gets a merchant category code (MCC). The Visa Rules require the acquirer to assign the MCC that most accurately describes the business, and separate lines of business can require separate codes. Describe what you sell plainly so you are classified correctly from day one.

2. Organize Your Documents, Ownership Details and Website

a series of organized, colorful books and binders on shelves
Organized documents and a complete website make underwriting much faster.

While you research, pull together the paperwork underwriters ask for. Requirements vary by provider and risk level, but most applications request:

  • Business formation documents (articles of organization or incorporation) and your EIN
  • A government-issued photo ID for each owner and the main person who controls the business
  • A voided business check or bank letter for the deposit account
  • Recent business bank statements
  • Your last several months of processing statements, if you already accept cards, showing volume, refunds and chargebacks
  • A short business description: what you sell, how you fulfill orders, your refund policy and expected monthly volume
  • For regulated industries, the licenses or certifications that apply to you

Ownership Information

Banks have to know who owns and controls their business customers. FinCEN’s customer due diligence rule, 31 CFR 1010.230, defines a beneficial owner as each person who owns 25 percent or more of a legal entity, plus one person with significant responsibility to control or manage it. Expect your application to ask for the same details.

This is separate from Corporate Transparency Act reporting. According to FinCEN, US companies are now exempt from filing beneficial ownership information (BOI) reports. FinCEN published that change as an interim final rule in March 2025, and a final rule making the exemption permanent took effect on August 14, 2026. Not having to file with FinCEN does not change what your bank or processor will ask.

Website Requirements

If you sell online, underwriters will review your site before approving you. The Visa Rules require an ecommerce merchant’s website or app to show:

  • Customer service contact information, including an email address or telephone number
  • The country of the merchant outlet, clearly displayed during checkout (a link to a separate page does not count)
  • Your return, refund and cancellation policy, disclosed before final checkout with a “click to accept” button, checkbox or other acknowledgment if you restrict returns or cancellations

The business name on your site should match the name you apply under. Product descriptions, prices and terms should match what you put on your application. A half-built site or one selling things you didn’t disclose is a fast way to be declined. If you are building an online store, see our guide to ecommerce payment processing.

Security: PCI DSS 4.0.1

Every business that accepts cards must protect card data under the Payment Card Industry Data Security Standard. The PCI Security Standards Council published PCI DSS v4.0.1 on 11 June 2024, retired v4.0 on 31 December 2024, and kept 31 March 2025 as the date its future-dated requirements took effect. Ask your provider which self-assessment questionnaire applies to you and complete it on time.

Tip

Be upfront if you have applied elsewhere or been declined before. Underwriters can usually see your history, and a clear explanation is far better than an inconsistency they find on their own.

3. Talk With an Agent

a man with a stylish haircut and sunglasses talking on the phone outside
An experienced agent can match your business with banks that will approve it.

A knowledgeable merchant services agent works with multiple banks and processors and knows which ones accept your industry, volume and sales model. That can save you from collecting declines at the wrong providers.

A good agent will:

  • Match you with acquirers that actually approve your type of business
  • Tell you exactly which documents and website changes underwriting will want
  • Explain pricing, reserves and contract terms before you sign

Walk away from anyone who suggests describing your business as something it isn’t, splitting sales across accounts to stay under limits, or running payments through someone else’s account. Processing transactions that aren’t your own genuine sales is called “laundering,” and it is one of the reasons a business can be placed on Mastercard’s MATCH list.

4. Read the Fine Print

a magnifying glass being held on top of a laptop
Read every term in your merchant agreement before you start processing.

Once you are approved, read the merchant agreement before you start processing. Check:

  • Term and renewal: How long is the contract, and does it renew automatically?
  • Early termination fees: What does it cost to leave, and when does that fee apply?
  • Pricing changes: Can the processor raise rates, and how much notice must it give?
  • Reserves and holds: Will part of your funds be held, for how long, and when is it released?
  • Equipment: Are you buying, renting or leasing the terminal? Leases can run for years and may be hard to cancel.

These details matter. In July 2022 the FTC sued First American Payment Systems, alleging that sales pitches promised low fees and cancellation at any time while the enrollment documents hid a three-year term and a $495 cancellation fee. New York’s Attorney General also won court rulings over long-term card equipment leases sold to small businesses. If something you were told verbally isn’t in writing, ask for it in writing, and consider having a lawyer review the agreement.

Note for Companies in High-Risk Industries

a man sitting on a red boulder, overlooking a stunning scenic landscape
High-risk businesses can get approved with transparency and strong dispute controls.

High-risk businesses can absolutely get approved, but underwriting is stricter and staying approved depends on your numbers. Two programs matter most.

Visa’s Acquirer Monitoring Program (VAMP)

Visa measures a monthly ratio of fraud reports plus disputes against settled card-not-present transactions. According to Visa’s VAMP fact sheet, the “Excessive” merchant threshold in the US dropped from 2.2 percent to 1.5 percent on 1 April 2026, and applies to merchants with at least 1,500 fraud and dispute cases in a month. Banks watch these numbers closely, so show underwriters how you prevent disputes: clear billing descriptors, easy cancellation, fast refunds and good customer service.

The MATCH List

If a bank terminates a merchant for reasons like fraud, laundering or excessive chargebacks, it may add the business and its owners to Mastercard’s MATCH database. Under Mastercard’s current rules, listings stay active for five years, the excessive chargeback code applies when Mastercard chargebacks over the previous three months exceed 1.5 percent of sales transactions and total at least 5,000 USD, and a listing can be removed early only if it was added in error or, for PCI noncompliance, once the business is compliant. Read more in our guide to the MATCH list.

Being on MATCH makes approval much harder but not always impossible. Be transparent about what happened and what you changed, and work with a provider experienced in high-risk merchant account setup. Expect higher rates, a reserve or both.

Conclusion

labor and wait store, green building on a quiet street corner at dusk

The Importance of a Reliable Merchant Account

A merchant account that fits your business saves money and prevents surprise freezes. Do your research, prepare your documents and website, describe your business honestly, and read every term before you sign. As long as your business is legal, there is a provider that can work with you.

Ready to find the right processor? Apply with Paymotile and our payment consultants will help you prepare a strong application.

This article is general information, not legal advice.

Sources

Statistics and legal references in this guide come from the sources below. We review them regularly and update the page when newer data is published.

  1. Visa, Visa Acquirer Monitoring Program (VAMP) fact sheet (2025).
  2. PCI Security Standards Council, Just Published: PCI DSS v4.0.1 (June 2024).
  3. Federal Trade Commission, FTC Takes Action to Stop Payment Processor First American from Trapping Small Businesses with Surprise Exit Fees and Zombie Charges (July 29, 2022).
  4. New York State Attorney General, Attorney General James Shuts Down Northern Leasing Spinoffs for Continuing to Prey on Small Businesses (2021).
  5. Financial Crimes Enforcement Network, Beneficial Ownership Information Reporting (updated August 2026).
  6. Legal Information Institute, Cornell Law School, 31 CFR § 1010.230: Beneficial ownership requirements for legal entity customers.
  7. Visa, Visa Core Rules and Visa Product and Service Rules.

How to Make Your Online Store GDPR Compliant: 4 Steps

by

If your online store sells to people in the European Union, the General Data Protection Regulation (GDPR) applies to you, even if your business has no office in Europe. The law has applied since May 25, 2018, and enforcement is no longer theoretical: regulators have issued about €7.1 billion in GDPR fines through January 2026, according to the DLA Piper GDPR Fines and Data Breach Survey.

This guide explains, in plain English, when the GDPR covers a US ecommerce business, what it actually requires, and four practical steps to get compliant. It is general information, not legal advice. For your specific setup, talk to a privacy lawyer.

Quick Answers

  • Does the GDPR apply to a US store? Yes, if you offer goods or services to people who are in the EU, or track their behavior there (Article 3(2)). It is about where the customer is, not their citizenship.
  • What are the maximum fines? Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations. A lower tier allows up to €10 million or 2% (Article 83).
  • Do I need consent for everything? No. Consent is one of six legal bases. Fulfilling an order is covered by “contract,” and keeping tax records by “legal obligation” (Article 6).
  • Do I need a Data Protection Officer? Most small stores do not. It is only mandatory in three specific situations (more on that below).

a hall full of people sitting down, listening to a meeting indoors

What the GDPR Requires From an Online Store

The GDPR gives people control over their personal data: names, emails, shipping addresses, IP addresses, order history and anything else that can identify them. For an ecommerce business, the core duties are:

  • Have a legal basis for every way you use customer data, and only collect what you need.
  • Be transparent about what you collect, why, who you share it with and how long you keep it.
  • Respect customer rights, including access, correction, deletion (the “right to be forgotten”) and objecting to marketing.
  • Keep data secure and report breaches quickly. If a breach creates a risk to people, you must notify the regulator within 72 hours of becoming aware of it, and tell affected customers directly when the risk is high (Article 34).
  • Control your vendors. Hosting, email, analytics and other providers that handle data for you need a written data processing agreement (Article 28).

Tip

Your payment stack touches some of the most sensitive data you hold. When you choose an ecommerce payment processor, ask for its data processing terms and how it handles EU customer data and transfers. PCI DSS compliance protects card data, but it does not make you GDPR compliant on its own.

4 Steps to Make Your Store GDPR Compliant

1. Map and Document the Personal Data You Hold

classified document in an organized folder file

You cannot protect data you have not found. Start with an inventory of every place customer data lives: your store platform, payment processor, email tool, CRM, analytics, ad pixels, support desk and spreadsheets. For each one, note what data it holds, why you collect it, the legal basis, who can access it, where it is stored and how long you keep it.

This inventory becomes your record of processing activities. Article 30 exempts organizations with fewer than 250 employees only when processing is occasional and low risk. Taking orders every day is not occasional, so most active stores should keep this record.

Tip

Delete what you do not need. Old abandoned-cart lists, exported spreadsheets and data from discontinued tools are pure risk with no upside.

2. Update Your Privacy Notice and Internal Processes

reading the newspaper, optimistic feeling

Your privacy notice should tell customers, in plain language:

  • who you are and how to contact you about privacy;
  • what data you collect and the legal basis for each use;
  • which third parties receive it (payment, shipping, email, analytics, ads);
  • whether data leaves the EU and what protects it;
  • how long you keep it, and how customers can exercise their rights.

Behind the notice, you need working processes: a way to answer access and deletion requests (generally within one month), a breach response plan that can meet the 72-hour deadline, and signed data processing agreements with your vendors.

For transfers to the US, many vendors rely on the EU-US Data Privacy Framework, adopted on July 10, 2023. The EU General Court upheld it in September 2025, but it could still face further legal challenges, so check that your key vendors also offer standard contractual clauses as a backup.

black keyboard of a laptop with a red letter m

When you do rely on consent, such as for marketing emails, ad tracking or non-essential cookies, it must be a clear, active choice. The GDPR says plainly that “silence, pre-ticked boxes or inactivity” do not count. In the 2019 Planet49 case, the EU’s top court confirmed that a pre-ticked box is not valid consent for cookies.

In practice, that means:

  • A cookie banner where “Reject” is as easy as “Accept,” with tracking scripts blocked until the customer opts in.
  • Unticked boxes for newsletter signups at checkout, separate from accepting your terms.
  • No “consent to marketing” bundled into placing an order (Article 7).
  • A simple way to withdraw consent at any time, and a record showing when and how each person agreed.

Tip

You do not need consent to process an order, charge a card or send a shipping confirmation. Those rely on the contract with your customer. Asking for consent you do not need just creates a choice you then have to honor.

4. Decide on a DPO and an EU Representative

well-lit building interior, lots of sunshine and greenery

Under Article 37, a Data Protection Officer is only mandatory if you are a public authority, if your core business involves large-scale, regular and systematic monitoring of people, or if you process sensitive categories of data at large scale. Most small and mid-sized stores fall outside all three. If you do appoint one, the DPO can be an employee or an outside contractor.

A requirement that catches more US businesses is the EU representative. Under Article 27, a business outside the EU that falls under the GDPR must name a representative in the EU in writing, unless its processing is only occasional and low risk. Regular sales to EU customers usually mean you need one. Many firms offer this as an affordable subscription service.

What Has Changed Since 2018

  • Enforcement is real. The largest fine so far is €1.2 billion against Meta in 2023, for transferring EU user data to the US. Fines reached about €1.2 billion in 2025 alone (DLA Piper).
  • The UK has its own rules. After Brexit, UK customers are covered by the UK GDPR, which was updated by the Data (Use and Access) Act 2025, with most changes in force from February 2026.
  • US states have caught up. 23 states had enacted comprehensive consumer privacy laws as of June 2026. A GDPR-grade privacy program puts you in a strong position for those too.
  • More changes are proposed. In November 2025 the European Commission proposed a “Digital Omnibus” package that would adjust parts of the GDPR and move cookie rules into it. Until it is adopted, the current rules apply in full.

Final Thoughts

GDPR compliance is less about one big project and more about good habits: know your data, explain it honestly, ask for real consent where you need it and pick vendors that take privacy seriously. Those same habits build customer trust in every market you sell to.

Your payment setup is a big part of that. If you want a processor that fits your ecommerce business and your compliance needs, talk to Motile’s payment team. You can also explore our payment processing solutions or browse more guides on the Motile blog.

Sources

Statistics and legal references in this guide come from the sources below. We review them regularly and update the page when newer data is published.

  1. DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026 (January 2026).
  2. IAPP, Vermont becomes 23rd state to enact consumer privacy law (June 17, 2026).
  3. Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (May 22, 2023).
  4. Court of Justice of the European Union, Press Release No 125/19: Storing cookies requires internet users’ active consent (Case C-673/17, Planet49) (October 1, 2019).
  5. legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (2026).
  6. European Commission, EU-US data transfers.
  7. intersoft consulting (gdpr-info.eu), Art. 3 GDPR: Territorial scope.
  8. intersoft consulting (gdpr-info.eu), Art. 6 GDPR: Lawfulness of processing.
  9. intersoft consulting (gdpr-info.eu), Art. 7 GDPR: Conditions for consent.
  10. intersoft consulting (gdpr-info.eu), Art. 27 GDPR: Representatives of controllers or processors not established in the Union.
  11. intersoft consulting (gdpr-info.eu), Art. 28 GDPR: Processor.
  12. intersoft consulting (gdpr-info.eu), Art. 30 GDPR: Records of processing activities.
  13. intersoft consulting (gdpr-info.eu), Art. 33 GDPR: Notification of a personal data breach to the supervisory authority.
  14. intersoft consulting (gdpr-info.eu), Art. 34 GDPR: Communication of a personal data breach to the data subject.
  15. intersoft consulting (gdpr-info.eu), Art. 37 GDPR: Designation of the data protection officer.
  16. intersoft consulting (gdpr-info.eu), Art. 83 GDPR: General conditions for imposing administrative fines.
  17. intersoft consulting (gdpr-info.eu), Art. 99 GDPR: Entry into force and application.
  18. intersoft consulting (gdpr-info.eu), Recital 32: Conditions for Consent.

Selling CBD: A Comprehensive 7-Step Guide to Success

by

There’s a lot of confusion out there when it comes to CBD. From its legality to what it actually is, cannabidiol (better known as CBD) leaves a lot of people scratching their heads. Is it marijuana? Is it even a drug? Where can I buy it (if I can legally purchase it at all)?

Get your cbd account now

It doesn’t matter if you’re trying to launch a start-up or simply wish to refine your existing CBD business – this seven step guide provides actionable advice for anyone looking to succeed as a CBD merchant. From marketing strategies on how to sell CBD oil to perfecting your website, we’re here to lay it all out for you so you can thrive in this growing industry.

CBD Business Success in 7 Steps

  1. Learn How to Sell CBD Oil Legally
  2. Comply With the Law
  3. Create a CBD Business Plan
  4. Get a High Risk Payment Processor
  5. Optimize Your Website
  6. Write CBD-oriented Legal Policies
  7. Build & Strengthen Your Brand

Step 1: Learn How to Sell CBD Oil Legally

cannabis plant, very green image
Hemp and marijuana are the same species of cannabis, but their chemical composition is noticeably different – making them different plants altogether.

First things first: CBD extracted from marijuana is illegal at the federal level. While there are numerous reasons to believe the tides are turning here, it’s still risky getting involved in an industry that isn’t fully understood by the government yet. However, there are loopholes and gray areas, and they all involve hemp.

What’s the difference between CBD and THC?

CBD (cannabidiol) and THC (tetrahydrocannabinol) are both chemical compounds found in the cannabis plant – the two most famous examples of cannabis being marijuana and hemp. THC has psychoactive properties (it gets you high). Cannabidiol has zero mind-altering effects, and instead has been primarily used over the years as a natural remedy for headaches, insomnia and other ailments of the body. Hemp-seed oil has negligible amounts of THC and greater (but still minor) quantities of cannabidiol, whereas marijuana has substantially more of both.

Hemp-seed oil and hemp-extracted CBD products are deemed legal by state and federal officials if they were produced using industrial hemp. Until the new federal rules take effect, oils, topicals and edibles under the 0.3% delta-9 THC limit can be sold in most states, although many states add their own testing, labeling and age rules. After December 11, 2026, finished products must also stay at or below 0.4 mg of total THC per container. The FDA still does not allow CBD to be added to food or marketed as a dietary supplement, so health claims remain off limits. Nootropic sellers face similar limits on health claims, as our guide to what nootropics are and how to sell them online explains.

CBD oil extracted from marijuana exceeds this 0.3% THC threshold, which makes it illegal in the eyes of the U.S. government. For now, it remains a substance exclusively marketed in states that have passed recreational marijuana laws. If you’re trying to sell this at a store or online, you will:

  1. Need a creative banking solution (many operations struggle with this)
  2. Want to be in a state where recreational marijuana is legal
  3. Make sure your policies are clearly hashed out and transparent

Step 2: Comply With the Law

capitol building front lawn, Utah
Adhering to state and federal laws will help keep you in business (and out of courthouses).

Even if you play by the book, there are still inherent risks as long as the industry is operating in a legally gray area. Follow the laws set by your state government and be honest about your business. Not doing so could cripple your reputation – as it did several “CBD” companies that lied about the ingredients in their products.

Also, make sure you acknowledge that CBD has not been cleared by the FDA as an efficacious substance somewhere on your website (assuming you’re integrating ecommerce into your business, which we highly recommend). While there are numerous studies outlining the benefits of cannabidiol consumption, it’s still not medicine in the eyes of the American government.

Place a small disclaimer somewhere in a clearly visible location on your site to avoid trouble.

example of a cbd disclaimer on the CW Hemp website
Ex. 1 CWHemp.com
example of a disclaimer for CBD website Green Mountain CBA
Ex. 2 GreenMountainCBD.com

One way many merchants have managed to operate within this space is to list all of their products as “hemp oil” or “hemp-seed oil.” Labels must still be accurate, though: products that meet the federal hemp definition can be sold online, but a “hemp oil” label will not protect a product that breaks the THC limits.

Step 3: Create a CBD Business Plan

two men jot down notes, laptops in front of them
“A goal without a plan is just a wish.” ― Antoine de Saint-Exupéry

U.S. farmers grew industrial hemp worth $739 million in 2025, up 64% from 2024, according to the USDA National Hemp Report (April 2026). The opportunities are there, but you need a plan of attack. Especially in this market, where you’ll be under more scrutiny than if you were opening a bakery, for example.

If you want to get your business started on the right foot, it’s critical to lay everything out beforehand.  This is where having a comprehensive business plan comes in.

There are two primary ways entrepreneurs usually lay out their course of action – either through business plan software or via the help of a professional writer. Either way, investors will be looking to see that your plan is sound – so be sure avoid rushing things. It will be easier for you to move forward when everything is down on paper. Key things you need include:

  • Financing Methods
  • Products & Services
  • Customer & Market Analysis
  • Marketing Plan
  • Strategy & Implementation
  • Sales Forecasts

Step 4: Get a High Risk Payment Processor

Female barista interacting with customer using a bank terminal to process and acquire credit card payments.
Payment processing is at the heart of every successful retail business.

One of the biggest challenges facing entrepreneurs getting into the hemp oil market is finding a payment processor willing to work with them. Stories of marijuana merchants carrying thousands of dollars in cash because they couldn’t find someone to handle their transactions are popping up in the media, and CBD’s association can make things tricky.

The good news is, as CBD is better understood and further differentiated from THC, there are more opportunities to work with legitimate payment processors for people selling it. There are even solutions for start-ups available, who until recently struggled to establish themselves in this market.

Until the day cannabidiol reaches full legality throughout America, it will be deemed a risky industry by banks everywhere – requiring a dependable high risk merchant account provider to simply keep the doors open. However, there are more options now than ever. Do your homework so you can find a processor that believes in you and your business, because they do exist.

Step 5: Optimize Your Site

cellphone with google analytics in the search bar
Google sets you up to succeed – take advantage of what they have to offer.

Having an ecommerce website up and running is important if you want to maximize revenue opportunities. However, you need to make sure your website attracts users and turns them into paying customers. There are many sites in the CBD market that are simply unattractive and poorly optimized. Here are some ways to separate yours from the competitors:

Write blog posts

Many companies are too busy or too lazy to produce free content for their users. If you put together pieces that are useful for your target audience, it will help you build authority and generate traffic (which means more customers). These posts can even be used for your social media accounts if you plan on going down that path.

Use Google Tools

Things like Google PageSpeed and Google Analytics are free, and with a little research they can help you improve your website. Speed up your pages, fix places on your site that aren’t getting traffic, learn more about user demographics and target them when marketing. You’d be surprised how many businesses out there aren’t taking advantage of these free resources to fine-tune their websites.

Hone your conversion funnel

Make it a habit to check Google Analytics so you know your users are converting. Making it easy for customers to get to the checkout page is an essential part of running a successful website, so tweak things as necessary to facilitate this. Things like having plenty of links and buttons across your site that drive traffic to product pages can help move people in the right direction.

Step 6: Write CBD-Oriented Legal Policies

lawyer writing down notes while reading law
Focusing on small details early on will pay big dividends in the end.

Transparency is important – it will help you build trust with your customers, and it’ll protect you from violating the law. Having a clearly laid out privacy policy and terms of service is critical for every CBD business.

Letting users know the data you collect and the conditions for making purchases on your site will help legitimize the sales of your industrial hemp oil and other hemp-related products. Including a section about adhering to U.S. law is a great addition to your terms, for instance, because many people worry about the legality.

snippet from CWHemp's terms and conditions section about U.S. law
Ex. CWHemp.com’s terms & conditions page

While privacy policies are mandated by law, having a terms of service is optional in the United States. However, operating in the CBD industry makes it an essential addition to your website. If you don’t know how to write your own terms and conditions, there are people (and programs) out there to help you get the job done.

Step 7: Build & Strengthen Your Brand

red nike sweater, cellphone concept
You know you’ve made it when your brand is this recognizable.

Once you’ve taken care of the legal nuances and have a great website ready to go, it’s time to establish your brand name (if you hadn’t started already). A great way to begin is to write pieces related to CBD and pitch them to other websites. Getting your name out there (not to mention valuable links back to your site) will help you build authority in the industry.

Another great way to get people visiting your site is through Google’s Pay Per Click (PPC) advertising. This can get expensive, so make sure you do your research before diving too deep into it. If done correctly, you can make money, boost brand awareness, and increase your customer base.

Conclusion

The world of hemp oil & CBD products is a relatively new one, and could explode if the U.S. government lightens its restrictions on cannabis-related goods. Things are pointing that way, but it’s hard to say until it actually happens.

We’ve outlined the ins and outs of how to sell CBD oil and thrive – are you ready to make it happen?

Sources

Statistics and legal references in this guide come from the sources below. We review them regularly and update the page when newer data is published.

  1. USDA National Agricultural Statistics Service, National Hemp Report (April 16, 2026).
  2. Vicente LLP, Federal Hemp Update: Definition Change Delayed to December 11 (2026).
  3. Congress.gov, Public Law 119-37 (H.R. 5371) (November 2025).
  4. U.S. Food and Drug Administration, Warning Letters for Cannabis-Derived Products.
  5. U.S. Small Business Administration, Choose a business structure.
  6. U.S. Small Business Administration, Write your business plan.

Paymotile

Merchant Services For Your Business