CBD Business Compliance: Legal Requirements for Selling CBD

What Is CBD Business Compliance?

CBD business compliance is the practice of aligning your products, claims, operations, and documentation with applicable federal and state law. It covers sourcing lawful hemp, accurate labels, valid certificates of analysis, honest advertising, safe shipping, and audit-ready records.

Federal Legal Snapshot

Here’s what every CBD seller should know at the federal level:

• Hemp definition: The 2018 Farm Bill defines hemp as cannabis with no more than 0.3% Delta-9 THC by dry weight. Anything above that is marijuana under federal law.
• FDA oversight: CBD cannot currently be marketed as a dietary supplement or added to foods under federal law. Cosmetics with hemp-derived CBD may be sold if they are not adulterated/misbranded and you avoid drug claims.
• Disease claims: Don’t claim your product diagnoses, treats, cures, or prevents disease. Such claims can trigger “unapproved drug” actions.
• FTC advertising: Health-related claims must be truthful and supported by competent and reliable scientific evidence.
• USPS/Carriers: Shipping hemp products is allowed with proper documentation; carriers may set additional rules.
• Banking/FinCEN: Banks can work with hemp businesses, but expect due diligence and ongoing monitoring.

State-by-State Landscape

States vary widely on age limits, product forms (e.g., gummies, smokables), labeling, testing, and retail licenses. Some states require manufacturer or retailer permits; others restrict inhalable products or serving sizes.

Because state regulations change frequently, verify requirements where you operate and where you ship. When in doubt, consult a local attorney or your state hemp program.

Step-by-Step Launch Plan

1. Choose your model: White label, private label, or custom manufacturing. Vet partners with audited facilities and strong QA systems.
2. Confirm lawful hemp: Require documentation showing hemp is derived from licensed growers with Delta-9 THC ≤ 0.3%.
3. Set product scope: Focus first on formats with the clearest federal path (e.g., topical cosmetics). Know that ingestibles are restricted under federal law, even if some states allow them.
4. Adopt cGMP: Follow applicable Good Manufacturing Practices (e.g., 21 CFR Parts 111/117) for consistent quality, even if not expressly required.
5. Third-party testing: Obtain COAs for each batch: potency, residual solvents, heavy metals, pesticides, microbials, mycotoxins.
6. Build compliant labels: Include identity, net contents, ingredient list, responsible party name/address, lot/batch, and access to the COA (e.g., QR code).
7. Claims review: Remove disease claims and avoid implying medical benefits. Substantiate all performance statements.
8. Website controls: Publish policies (privacy, terms, shipping/returns), add age gates if required, and include COA access for each SKU.
9. Payments and banking: Use a high-risk merchant processor that supports hemp. Expect underwriting and evidence of compliance.
10. Insurance: Obtain product liability coverage appropriate to your revenue and risk profile; some retailers may require it.
11. Shipping SOPs: Keep hemp documentation on file and follow carrier rules. Train staff on age verification where applicable.
12. Ongoing monitoring: Track recall procedures, complaint logs, and label and website audits. Calendar annual policy reviews.

Labeling, Testing, and Quality

Potency and COAs

List total hemp extract and CBD content per container and per serving when applicable. Link or QR-code to an independent, ISO/IEC 17025-accredited lab COA, matching lot and product.

Required Elements

• Statement of identity (e.g., “Hemp Extract Topical”)
• Net quantity of contents (U.S. customary and metric for cosmetics)
• Ingredients in descending order; allergens where relevant
• Responsible party name and street address (or online address with directory listing)
• Lot/batch number and expiration or best-by date (if used)
• Warnings as required by state law (e.g., age, THC, pregnancy)

Quality Systems

Document your suppliers, specifications, and change controls. Keep retain samples. Use tamper-evident and, where required, child-resistant packaging.

Website, Marketing, and Claims

Your claims should be conservative and evidence-based. Avoid disease terms and implied medical benefits. Train customer support to steer clear of health advice.

• Replace disease claims with general, non-medical statements (e.g., “calming scent” for a topical aromatherapy product).
• Use human-readable COAs and explain test results in plain language.
• Follow FDA guidelines for cosmetics and labeling basics where applicable.
• Ensure endorsements and reviews follow FTC rules (disclose incentives, be truthful, no cherry-picking).

Before launch, compare your site and labels to recent FDA and FTC warning letters. Align with FDA guidelines to reduce enforcement risk.

Payments, Insurance, and Taxes

Merchant Processing and Banking

Hemp is a high-risk category. Processors may require COAs, labels, and policy reviews. Keep documentation current to avoid account holds.

Insurance

• Product liability with appropriate limits
• Recall expense coverage if available
• Cyber coverage if you store customer data

Taxes

Account for sales tax nexus and local rules on hemp-derived goods. Track excise tax if your state imposes one on certain product types.

Shipping and Cross-Border

Domestically, keep documentation that your products meet the hemp definition and share COAs on request. Carriers may restrict vape or inhalable formats.

International shipments are complex. Many countries prohibit CBD or treat it as a medicine. Don’t export without local counsel; rules can be stricter than U.S. federal regulations.

Real-World Example: The Boutique That Fixed Its Gaps

A small online boutique in the Midwest launched hemp topicals with clean branding but limited controls. Within weeks, their processor froze payouts pending documentation. They had COAs, but they didn’t match lot numbers on labels.

They paused ads, relabeled products with correct batch IDs, added QR codes linking to current COAs, and removed wellness claims from product pages. The processor reinstated their account, and chargebacks dropped after they added clearer usage directions and a 30-day return policy. This true-to-life example shows how quick fixes—and strong documentation—can stabilize sales.

CBD Business Compliance Checklist

• Hemp source verified and lawful (≤ 0.3% Delta-9 THC)
• Supplier agreements, cGMP, and audit rights documented
• Third-party COAs per batch for potency and contaminants
• Labels with identity, net contents, ingredients, responsible party, lot, warnings, and QR to COA
• Website with COAs, age gate if required, clear policies, and no disease claims
• Marketing substantiated; endorsements disclose incentives
• Processor and bank onboarded; compliance documents on file
• Product liability insurance active
• Staff trained on claims, shipping SOPs, and customer communications
• Annual review calendar for labels, COAs, SOPs, and state law changes

Common Pitfalls to Avoid

• Using generic COAs that don’t match your lot numbers
• Implying medical benefits through blog posts or testimonials
• Selling ingestibles into states that prohibit them
• Neglecting age gates or shipping constraints for certain formats
• Outdated privacy/returns policies that spook processors

Conclusion

Getting cbd business compliance right is less about guesswork and more about disciplined systems: lawful sourcing, precise labels, verified testing, honest claims, and airtight documentation. Start with the checklist, audit your site and packaging, and build a recurring review cycle to stay ahead of change.

FAQs