Vapes have become a card processing problem. This year, state attorneys general asked the card networks to cut off stores selling illegal e-cigarettes. Processors warned convenience stores and smoke shops of heavy fines. Some retailers were told a single violation could cost them their card acceptance.
Unlike the hemp change, there's no single deadline. The rules come from several directions at once, and they don't all agree. For a store, that makes it easy to assume the vapes on the counter are fine because a supplier, a regulator or a competitor says so.
This guide explains what's happening, why your processor's rule is the one that matters for your account, and what merchants and the agents who serve them should do now.
This article explains how card processors are responding to vape regulation. It isn't legal advice. For decisions about specific products, talk to a lawyer who works with tobacco and vape businesses.
Key takeaways
- Only a few dozen e-cigarette products have FDA marketing authorization. Most vapes on the market, including most flavored disposables, don't.
- The FDA has said it will put a lower priority on some unauthorized products with applications under review. That's an enforcement choice, not an authorization.
- Some processors have told merchants to sell only FDA-authorized vapes or risk fines and termination. On your account, your processor's rule wins.
- A growing number of states ban vapes that aren't on a state registry, and online sales carry their own federal rules.
- Vape sellers are expected to be boarded under the tobacco store category. Selling vapes under another category or account can end your card acceptance.
- The merchants who keep their accounts are the ones who can show, product by product, what they sell and why it's allowed.
Why vapes are a payments problem now
Card network rules require every transaction to be legal, and the networks hold the processor's bank responsible when it isn't. For years, vapes were treated as a gray area. In 2026 that changed quickly.
- The states turned to the payment companies. In April, a coalition of 13 state attorneys general asked the major card networks to identify and remove merchants selling unauthorized e-cigarettes. Their argument: these sales already break network rules on illegal transactions, so the networks can act now. Other attorneys general followed with their own appeals.
- Processors warned their merchants. In June and July, processors and fuel brands told stores to remove vapes not on the FDA's authorized list. Some retailers were warned of "mid-six-figure" fines for a single violation, or the loss of card processing.
- One card network paused its fines, for now. After the convenience store industry pushed back, the network said it would "temporarily pause" assessments to give merchants time to fix things. Paused is not cancelled.
- More checking is coming. LegitScript, which monitors merchants for processors, expects updated underwriting rules and monitoring requirements from acquirers. That means license checks, product checks against the FDA list, and ongoing monitoring rather than a one-time review.
What the FDA allows, and what it doesn't enforce
Any vape product introduced after February 2007 needs FDA marketing authorization to be sold legally. Only a few dozen have it, mostly tobacco- and menthol-flavored closed systems from a handful of large makers. The FDA keeps the list on its website, and authorizations are product by product: a brand having one authorized device doesn't make its other products legal.
On May 8, 2026, the FDA issued new enforcement guidance. In plain terms:
- Lower priority: unauthorized products whose applications the FDA has accepted and is reviewing. For flavored products, the application must also contain the data the FDA needs. The FDA will publish a list of these.
- Top priority: products with no application at all, counterfeit or mislabeled products, anything designed to appeal to kids (cartoon characters, products disguised as toys, phones or games), and products with extra safety risks.
Two points get lost in the retelling. A lower enforcement priority is not authorization: the FDA itself says it has no bearing on whether a product will be approved. And the flavored disposables that fill many counters are usually in the top-priority group, not the lower one.
Why your processor's rule matters more than the FDA's
The convenience store industry's argument this summer was that processors were stricter than the FDA. On the facts, that's right. It doesn't change much for a single store.
Your processor sets the conditions of your account. If its rule is "FDA-authorized products only," a product on the FDA's lower-priority list can still cost you the account, even though the FDA may never act on it. Arguing the point after a termination letter arrives rarely works.
So the first question isn't "is this vape legal?" It's "what has my processor said I can sell?" The answer may be in your agreement, in an email notice, or in the message section of your monthly statement.
State registries and online sales
State registries. A growing number of states have passed "directory" laws. Manufacturers must certify each product's FDA status to get on the state's list, and stores may not sell what isn't listed. Courts are divided on whether some of these laws hold up, and start dates move: one state delayed its registry in October. Check your own state's list, not a supplier's assurance.
Online sales. Since 2021, federal law treats vapes like cigarettes for remote sales. Online sellers must register with federal and state authorities, file reports, ship with carriers that check ID and get an adult signature at delivery, and can't use the Postal Service. Federal regulators also share a list of noncompliant sellers with card companies.
Is your account coded correctly?
Every card account is boarded under a merchant category code. Card network rules expect stores selling vapes to be identified under the tobacco store category, code 5993. A convenience store or gas station that sells vapes may be boarded under its own category, which is normal, but the processor should know vapes are part of the business.
What's never acceptable is moving vape sales somewhere they don't belong: a second account set up for something else, another business's terminal, or a category chosen to avoid review. The industry calls that transaction laundering. It's grounds for termination, and a merchant closed for it can be placed on the industry's shared list of terminated merchants, which makes processing hard to find anywhere.
On the same shelf: kratom and 7-OH
Many of the stores that sell vapes also sell kratom, and kratom is now moving through the same kind of crackdown.
- Natural kratom leaf is not federally controlled. The federal action is aimed at concentrated and synthetic products.
- Three kratom-related compounds are already in Schedule I. The DEA placed them there by temporary order effective August 26, 2026.
- Concentrated 7-OH is next. The DEA announced in July that it intends to place 7-OH in Schedule I, describing the products as widely sold in gas stations and smoke shops. In October it issued a new notice using health officials' thresholds, which target products far stronger than the natural leaf. No 7-OH order was in effect when this was written, but one can take effect as soon as it's published.
- States are moving faster. About a dozen states had banned 7-OH products by March 2026, and several ban kratom altogether.
For card processing, kratom follows the same logic as vapes. Many processors already treat kratom sellers as high risk and ask for lab reports for each product, and some have closed accounts that sold 7-OH. The steps below apply to kratom too.
What to do now
- Find out what your processor allows. Check your agreement, your email and the message section of your last few statements, and ask in writing if it isn't clear.
- List every vape and kratom product you sell, by brand and product name.
- Check each vape against the FDA's authorized list and your state's registry, if your state has one. Check each kratom product's lab report against your state's rules and the federal 7-OH action.
- Remove products with no FDA application, anything that looks made for kids, and anything your processor doesn't allow. Keep a dated record.
- Keep the paperwork for what stays: supplier invoices, and the FDA or state listing for each product.
- If you sell online, confirm you meet the federal remote-sale rules.
- Make sure your processor knows you sell vapes, and that your account is boarded accordingly.
Selling hemp-derived THC or CBD products too? Those face a separate federal deadline on December 11, 2026. See the federal hemp change and your card processing.
For agents: which merchants to call
Most of your merchants who sell vapes aren't vape shops. They're convenience stores, gas stations, liquor stores and smoke shops, where vapes are one shelf among many. Those are the accounts most likely to be surprised.
Clues on the statement. A statement won't list products, but it can tell you who to ask:
- a tobacco store category (5993), printed on some statements and shown on others by the card programs the account bills;
- a convenience store or fuel category, where vapes are common;
- a notice in the message section about vapes, e-cigarettes or prohibited products;
- reserve holds, risk fees or registration fees, which mean the processor already treats the account as high risk.
What to tell them. Share the steps above, point them to their processor's rule, and recommend a lawyer for product questions. Don't tell a merchant a product is fine. Compliance isn't your call, and it's not a promise you want your name on.
Why the paperwork matters. Some banks and processors respond to rules like these by exiting a whole category, compliant merchants included. A merchant who can show exactly what they sell, product by product, with the documents to back it up, gives the processor a reason to keep the account instead of closing it.
Get an independent read
Statement Forensics reads processing statements line by line and explains them in plain English. That includes the category your account is boarded under, every fee and hold, and the notices in the small print, so you know where you stand with your processor.
We don't sell processing, have no processor or ISO affiliation, and take no residuals or referral fees. Agents can send a merchant's statement too, with the merchant's permission. We don't advise on whether a product is legal; that's a question for a lawyer.
Email a recent statement to audit@statementforensics.com.
Frequently asked questions
Are disposable vapes illegal?
Most flavored disposables sold in the US have no FDA marketing authorization, so they can't legally be sold. Many have no application on file at all, which puts them in the FDA's top enforcement priority. A few products are authorized; check the FDA's list for each one.
If a product has an FDA application pending, can I sell it?
A pending application isn't authorization. The FDA has said it will put a lower priority on enforcement for certain products under review, but that's a policy choice, not approval. Your processor may still require authorized products only, and on your account its rule is the one that counts.
Can my processor fine me for selling vapes?
Card networks can fine the processor's bank for illegal transactions, and processor agreements usually let the processor pass those fines on or close the account. This year some retailers were warned of large fines per violation, though one network has paused its assessments for now.
What merchant category code should a vape seller use?
Card network rules expect vape sellers to be identified under the tobacco store category, code 5993. Stores whose main business is something else may keep their own category, but the processor should know vapes are part of the business.
Can I process vape sales through another account?
No. Running sales through an account, business or category that wasn't approved for them is transaction laundering. It's grounds for termination and listing, and it can end card acceptance for the whole business.
Is kratom legal to sell?
Natural kratom leaf is not federally controlled, but three kratom-related compounds are in Schedule I, the DEA has proposed adding concentrated 7-OH products, and many states restrict or ban kratom or 7-OH. Check your state's rules and each product's lab report, and ask a lawyer about anything unclear.
Do these rules apply to nicotine pouches?
The FDA's May 2026 enforcement guidance covers nicotine pouches as well as vapes. Processor rules vary, so check what yours allows.