The Federal Definition of Hemp Changes on 12 November and Again on 11 December. What Acquirers With CBD and Hemp Merchants Need to Check Before Then.

CBD and hemp merchants have been underwritten against one federal test: does the product stay at or under 0.3 percent delta-9 THC on a dry weight basis? That test came from the 2018 Farm Bill, and it stops being the federal definition of hemp this autumn. Congress rewrote the definition in November 2025, the first part of the new one takes effect on 12 November 2026, and the rest follows on 11 December 2026.

A product that falls outside the new definition is not hemp, and the Congressional Research Service says such products are instead to be regulated as marijuana under the Controlled Substances Act. For an acquirer that turns a merchant's catalogue into a card-network rules question. This piece sets out the law as enacted, the dates, and what it means for an underwriting or risk team, from the statute, the Congressional Research Service, and the Visa Core Rules (18 April 2026) and Mastercard Rules (2 June 2026). It is not legal advice.

What Congress Changed

Section 781 of Division B of Public Law 119-37, the appropriations act signed on 12 November 2025 that ended the government shutdown, replaces the definition of hemp in 7 U.S.C. 1639o. It takes effect 365 days after enactment. The new definition works in two layers.

• The plant test moves from delta-9 THC to total THC. Hemp is cannabis with a total tetrahydrocannabinols concentration, including tetrahydrocannabinolic acid (THCA), of not more than 0.3 percent on a dry weight basis. THCA now counts toward the limit.
• Products are excluded by what they contain. A hemp-derived cannabinoid product, meaning any product derived from hemp other than industrial hemp that contains cannabinoids and is intended for human or animal use by inhalation, ingestion, topical application or any other means, is not hemp if it contains cannabinoids that the plant cannot naturally produce, or cannabinoids the plant can produce but that were synthesised or manufactured outside it.
• Finished products have a per-container cap. A final product is excluded if it contains more than 0.4 milligrams per container, combined, of total THC and any other cannabinoids that have, or are marketed to have, similar effects, as determined by the Secretary of Health and Human Services. The container is the innermost packaging in direct contact with the product as sold at retail: the jar, bottle, can, packet or cartridge.
• Intermediate products, meaning those not yet in final form or sold as a powder, liquid, tablet or oil to be mixed into something else, are excluded above 0.3 percent combined total THC and similar cannabinoids, and excluded outright if they are marketed or sold as a final product or directly to consumers.

Industrial hemp, grown for fibre, grain, seed oil and other non-cannabinoid uses, is expressly inside the definition. A merchant selling hemp rope, hemp seed or hemp clothing is not the target of this change.

The Two Dates

Section 2019 of Public Law 119-103, the stopgap funding act signed on 2 September 2026, splits the effective date. Until 11 December 2026, the new definition applies only to products containing cannabinoids that are not capable of being naturally produced by the cannabis plant. Everything else, including the total-THC plant test, the synthesised-outside-the-plant exclusion and the 0.4 milligram cap, applies from 11 December.

• 12 November 2026: the exclusion for products containing cannabinoids the plant cannot naturally produce takes effect.
• 11 December 2026: the rest of the new definition takes effect. It is also the date the same act's government funding runs out, so the next funding bill is an obvious place for Congress to move it again. We found no later law changing it as of 6 October 2026.

Bills to delay the definition by two years (H.R. 7024 and S. 3686, the Hemp Planting Predictability Act) and to repeal it (H.R. 6209) were introduced in late 2025 and January 2026 and are in committee. None has had a vote. Plan for the dates in the statute, not for the bills.

The Lists That Have Not Arrived

The 2025 law told the Food and Drug Administration to publish, within 90 days, lists of the cannabinoids the plant can naturally produce, of the THC-class cannabinoids that occur naturally in it, and of other cannabinoids with THC-like effects, plus more detail on what counts as a container. The 90 days ran out on 10 February 2026. The Congressional Research Service reported in May 2026 that the lists had not been published, the Hemp Law Group reported the same in early September, and we could not find them on fda.gov when checking for this piece.

That matters to an underwriter because the 12 November exclusion turns on which cannabinoids the plant can naturally produce, and the agency that was meant to say so has not. Until it does, the classification of a given ingredient is a question for the merchant's counsel and its lab results, and an acquirer should not treat a merchant's own assurance that its products are natural as settling it.

Why It Is an Acquiring Problem

Both networks put illegal transactions on the acquirer. Visa's Core Rules say a transaction must be legal in both the cardholder's jurisdiction and the merchant outlet's jurisdiction (section 1.1.1.3), and that an acquirer must not knowingly accept from a merchant any transaction that is illegal or that the acquirer or merchant should have known was illegal (section 1.5.1.4). Every Visa merchant agreement must require the merchant not to submit such transactions (section 1.5.2.1).

Mastercard Rule 5.12.7 bars any transaction that is illegal, including the sale of a product other than in full compliance with the law applicable to the acquirer, issuer, merchant or cardholder. An acquirer that has been notified and fails promptly to stop the practice can face a franchise review and a third-party audit at its own expense, and Mastercard may list the merchant on MATCH Pro. It may also assess the acquirer USD 200,000 for each merchant, or USD 2,500 a day back to the first day of the practice if the acquirer can show by clear and convincing evidence that it began less than 80 days before Mastercard's notice.

The Congressional Research Service notes it is unclear how, or how hard, federal agencies will enforce the new definition, and that both FDA and the Drug Enforcement Administration may lack the resources to do it broadly. The card rules do not wait for enforcement. They ask whether the transaction is legal, and whether the acquirer knew or should have known it was not.

The Processors Are Already Moving

Square told US sellers in August 2026 that selling CBD and hemp-derived products, online or in person, would no longer be permitted on its platform, and gave them until 15 October to remove those items from their catalogues, according to Marijuana Moment, which obtained the email and a confirming statement from the company. The notice covers CBD generally, not only intoxicating products. Merchants leaving a processor at the same time as a law change will be looking for new accounts in October and November, and some of the applications that reach your team will be from them.

What a Merchant-Services Team Should Do

• Find the portfolio. Pull every merchant whose application, website or catalogue mentions CBD, hemp, THC, THCA or delta-8, not just those on a CBD code or programme. Mixed-catalogue merchants, such as convenience stores, vape shops and health-food retailers, are where this hides.
• Ask for product-level evidence, not a policy statement. For each product, the certificate of analysis should show total THC including THCA, other THC-class cannabinoids, and the amount per container, not only a percentage. A product that passed the 0.3 percent delta-9 dry-weight test can fail the 0.4 milligram per-container cap: 0.3 percent of a 50-gram jar is 150 milligrams.
• Ask how each cannabinoid was made. The exclusion for cannabinoids synthesised or manufactured outside the plant catches converted products even when the compound also occurs naturally. The merchant's supplier documentation should say whether an ingredient was extracted or converted.
• Treat 12 November and 11 December as two separate reviews. The first date catches products with cannabinoids the plant cannot produce. The second catches the rest. A merchant cleared for the first is not cleared for the second.
• Re-underwrite rather than re-paper. A new merchant agreement clause does not change what is in the catalogue. Review the website and a sample of transactions after each date, and record what you checked.
• Look hard at merchants arriving from another processor. Ask why the previous account ended. A merchant that cannot or will not show product-level lab results in October 2026 is telling you something.
• Keep counsel on the state layer. State hemp laws differ from the federal one and from each other, and Visa requires legality in both the cardholder's and the merchant's jurisdiction. A product that meets the federal definition can still be restricted by a state.
• Watch the December funding bill. If Congress moves the date again, the review schedule moves with it. If it does not, the full definition is in force from 11 December.

None of this needs a new system. It needs the merchant's product list, its lab results and the date each was reviewed held on the merchant record, so that the answer to whether a transaction was legal is something the acquirer can show rather than assume.