Hemp-Derived Headache
In 2020, a major New York-based payment processor announced support for CBD and cannabinoid-related merchants through its omnichannel payment platform, including ACH transfers, mobile payments, QR-code transactions, and digital wallets as alternatives to cash handling.
By 2024, the company doubled down, acquiring a CBD merchant portfolio representing more than $400 million in annual transaction volume. On paper, the opportunity looked enormous.
In reality, turns out CBD wasn't the only thing being sold.
CBD Bubble
Between 2022 and 2023, the CBD market reached a fever pitch. Across the country, entrepreneurs opened wellness shops built around conversion models. Start as CBD sales today, convert to dispensary once regulations shift. But clear regulations never came, and many jumped on the hemp loophole train. As sales increased, so did scrutiny.
The first warning signs weren't necessarily regulators. They were chargebacks. For physical retail stores, chargebacks remained tame. E-commerce was a different story. Merchants faced higher fraud rates, friendly fraud, age verification disputes, and growing confusion around hemp-derived products.
Chargeback Boyz
The scam was simple and never particular to hemp sales:
Place order online → product arrives → disputes transaction → merchant forced to prove it’s legite.
Merchants get a window to dispute, if documentation is weak, the bank often sides with the cardholder. and lets be honest, compliance and record keeping are rarely the priority.
Cash, Card, or Kidney?
This led to a slow burn, processors don't just monitor dollars. They monitor chargeback ratios. A merchant processing 1,000 transactions and receiving 15 chargebacks carries a 1.5% dispute rate. That may not sound significant, but most processors want merchants well below 1%. Exceed those thresholds long enough and people start asking more questions.
If a processor, sponsor bank, or card network determines that a merchant approved as a CBD, hemp, or wellness business is actually selling products outside its approved risk profile, the response can be immediate.
Funds frozen.
Reserves imposed for months.
Merchant accounts terminated.
In some cases, merchants may find themselves placed on industry watchlists such as MATCH (Member Alert to Control High-Risk Merchants), making it difficult to secure payment processing elsewhere. And that's exactly what happened.
No Funds Available
As merchants were reviewed and accounts were closed, a significant portion of the acquired portfolio became inactive. The question was no longer whether merchants were selling products. It’s what they were selling, when they started selling it, and how long they sold it for. The answer was buried in over 20,000 COAs
In order to build a case, each merchants transactions needed to be mapped out. Every COA represented a potential piece of evidence. Test results, names, dates, even the labs who claimed to test them needed to be verified. The challenge was that most of the data existed as paper reports and digital PDFs.
For more than a year, teams overseas manually translated lab reports into spreadsheets, one COA at a time. The process was painfully slow, and completing a comprehensive review would take years. There had to be a faster way.
Mickey Mouse Operation
Searching online brought very few results for COA automation, one of those was CDM.
Long story short, with the help of the dev team at Cloudbox. we turned a year long project into a weekend project. Not only mapping the COAs, but listing every lab and business implicated to see if they even exist.
Once the data was structured, legal and compliance teams could begin asking the questions that mattered.
Not just:
"What is this product?"…
But:
"What did the merchant know?"… "When did they know it?"…"What documentation did they possess?"…"What representations were made at the time?"…
Even if operating within a loophole, if a COA pops for more than the allotted amount of potency, its now a legal document regardless of how much time you spent reading, or understanding it.
Whether any particular merchant intentionally operated outside its approved business model is ultimately a question for the courts now.
