Square Is Leaving Hemp. The Bigger Question Is Why Banks and Processors Keep Leaving.

The Hemp Industry Has Spent a Decade Outsourcing Compliance to Its Financial Partners. That Model Is Breaking.

For years, the hemp industry has complained about payment processors and banks.

• Accounts get terminated.
• Applications take too long.
• Documentation requirements change.
• Products get rejected.
• Compliance reviews become more demanding.
• Processing costs more.

And when a provider exits the category altogether, merchants understandably feel abandoned.

Now one of the most recognizable names in small-business payments is doing exactly that.

Square has notified affected merchants that it is winding down support for CBD and hemp-derived products in connection with the upcoming change in federal hemp law. Square's own support materials confirm that it is winding down its CBD Program and says CBD and hemp-derived products will no longer be permitted on its platform after the federal change takes effect. Reports based on merchant notices describe two important deadlines: mixed-catalog merchants have been instructed to remove affected CBD and hemp products by October 15, 2026, while businesses primarily selling CBD or hemp have been told their Square accounts will close November 5, 2026.

It's easy to look at this and say:

Square doesn't want hemp anymore.

I think that misses the bigger issue.

The more important question is:

Why is supporting compliant hemp commerce still so operationally difficult that walking away can be easier than managing it?

Because this isn't simply a Square problem.

It's an infrastructure problem.

And the hemp industry needs to acknowledge its role in creating it.

For Ten Years, We Built the Model Backwards

Something unusual happened as CBD and hemp entered mainstream payments.

In most regulated industries, the business selling the regulated product is expected to understand and maintain the compliance required to operate.

An alcohol retailer doesn't expect its credit-card processor to manage its liquor license.

A firearms dealer doesn't expect its bank to maintain its federal firearms compliance program.

A restaurant doesn't expect its processor to run its food-safety program.

The regulatory details vary enormously across industries and jurisdictions, but the underlying principle is familiar:

• The business operating in a regulated industry has responsibility for understanding and managing the requirements applicable to its business.

Financial institutions then perform their own due diligence and oversight to determine whether they are comfortable providing services.

But hemp evolved differently.

Payment agents saw a rapidly growing market and wanted the processing volume.

Processors wanted merchants.

Merchants desperately needed banking and payments.

So an unhealthy pattern developed.

Instead of merchants arriving at financial institutions saying:

"Here are our products. Here is our evidence. Here are our COAs. Here are our licenses. Here is how we comply. Here is how we monitor changes."

Many arrived asking:

"What do I need to give you so you'll approve me?"

That sounds like a subtle difference.

It isn't.

We gradually transferred responsibility for merchant compliance management from the merchant to the financial institution.

And then everyone wondered why the model became expensive.

The Processor Became the Merchant's Compliance Department

Consider what a processor supporting regulated hemp may need to understand.

Not simply:

Who is this merchant?

But potentially:

• What products do they sell?
• What cannabinoids are in them?
• What do the labels say?
• What claims are being made?
• Are appropriate COAs available?
• Are they current?
• Do the COAs actually correspond to the products?
• What does the laboratory evidence show?
• What states are products sold into?
• What licensing or registration requirements apply?
• What does federal law allow?
• What does state law allow?
• What does the sponsor bank allow?
• What does the processor allow?
• What do the card brands allow?

And then, after underwriting:

• Did anything change?

That's the part the industry's legacy model was never designed to handle efficiently.

Approval Became the Finish Line

A merchant goes through enhanced underwriting.

• Documents are collected.
• COAs are reviewed.
• Websites are inspected.
• Products are evaluated.
• Questions go back and forth.

Eventually:

APPROVED

Everyone celebrates.

The merchant starts processing.

But the merchant doesn't stop operating.

Next month it adds five products.

• Then twelve more.
• A new supplier comes aboard.
• A formulation changes.
• A new COA is issued.
• An old COA expires.
• Marketing launches a new campaign.
• Someone changes website language.
• The company enters another state.
• A new cannabinoid becomes popular.
• A distributor introduces a new brand.
• Federal regulation changes.
• State law changes.
• Sponsor-bank policy changes.

The merchant that was approved twelve months ago may bear surprisingly little resemblance to the merchant operating today.

Yet much of our compliance infrastructure still revolves around the original underwriting decision.

We built a dynamic industry on top of a static approval process.

Eventually, something had to break.

Now Multiply One Merchant by Thousands

This is the part merchants rarely see.

A merchant sees its own business.

• Its own products.
• Its own COAs.
• Its own website.
• Its own licenses.
• Its own questions.

The processor sees the portfolio.

Imagine supporting 2,000 regulated merchants averaging only 100 products each.

That's:

200,000 products.

And those products don't remain static.

• Products are added.
• Products disappear.
• Ingredients change.
• COAs expire.
• Labels change.
• Claims change.
• Websites change.
• Laws change.
• Policies change.

Now imagine managing that through PDFs, spreadsheets, emails, shared folders, questionnaires, periodic website scans and human review.

The economics become brutal.

This is one reason I believe the industry needs to be careful about interpreting exits from regulated commerce as simply:

"Banks don't want our business."

Sometimes the more accurate statement may be:

• The cost and complexity of proving that the commerce remains inside policy can exceed what the institution is willing or able to support.

Square itself explains more generally that certain products and businesses cannot be supported because of the regulatory environment in which it operates, and that it must comply with laws, bank
agreements and card-network requirements.

That's an important distinction.

Square Is a Warning, Not the Villain

I don't think the productive response is to attack Square.

Square made a business and risk decision.

Its current materials say the federal change affecting CBD and hemp-derived products led it to wind down the CBD Program. Square has also stopped making new Square Loans available to businesses selling CBD products or services as of August 2026.

Affected merchants have every right to be frustrated.

But the industry should use this moment for something more valuable than frustration.

Ask:

Why does a provider with Square's technological resources determine that exiting an entire category is preferable to continuing to support it?

And then ask the harder question:

What does the hemp industry need to change so supporting compliant merchants becomes easier—not harder—for financial institutions?

That's the conversation we need.

Compliance Cannot Continue to Be Something Your Processor Does to You

This is where merchants need to accept some responsibility.

Too many regulated merchants have treated compliance as something that happens when somebody asks.

Processor asks for a COA?

Find the COA.

Bank asks about a product?

Answer the question.

Auditor identifies an expired document?

Replace it.

Processor says remove website language?

Remove it.

New application asks for licenses?

Upload them.

That's reactive compliance.

And reactive compliance makes the financial institution the trigger for compliance activity.

That relationship needs to reverse.

Your processor should verify your compliance. It shouldn't have to create it for you.

The merchant should know what it sells.

The merchant should maintain its evidence.

The merchant should know when documentation expires.

The merchant should understand which products require additional review.

The merchant should know when formulations change.

The merchant should know when new products are added.

The merchant should maintain applicable licenses.

The merchant should understand the claims it makes.

The merchant should be able to demonstrate that information quickly to its financial partners.

That's what operating a regulated business requires.

Merchants Have Become Too Comfortable With "They'll Tell Me If There's a Problem"

This is perhaps the hardest part of the conversation.

Over time, merchants became accustomed to the processor finding problems.

A new product gets added.

Nobody says anything.

So another gets added.

Then another.

Eventually hundreds of products may be sold that were never individually reviewed during the original underwriting process.

The merchant may assume:

"We're processing them, so they must be okay."

The processor may assume:

"The merchant knows its obligations."

The bank may assume:

"The processor is monitoring the merchant."

And everyone may be operating with a different understanding of what is actually being sold.

Until an audit happens.

Or a regulator asks.

Or the sponsor bank changes policy.

Or federal law changes.

Or the processor discovers the portfolio is materially different from what it originally approved.

Then everyone is surprised.

That isn't a compliance program.

That's accumulated compliance debt.

And eventually compliance debt comes due.

The Hemp Industry Is Reaching That Point

The upcoming federal hemp changes are forcing the issue.

Square's merchant communications tie its decision directly to the federal law taking effect in November 2026 that changes the definition and treatment of hemp and hemp-derived products.

Qredible has previously written about Section 781 and the implications of the federal changes for banks, processors and sponsor banks. The fundamental challenge is that the new framework can require institutions to understand much more than simply whether a merchant calls itself a "hemp business." Product composition and other product-level facts can determine whether particular items remain within applicable definitions and institutional policies.

That creates a massive portfolio question.

A bank doesn't simply need to ask:

"Do we have hemp merchants?"

It increasingly needs to ask:

"Which products are those merchants actually selling?"

And then:

Which products remain permissible?

Which need additional evidence?

Which need remediation?

Which need to be removed?

Which merchants can continue processing?

That is a Product Intelligence problem.

And legacy merchant files weren't built to solve it.

There Are Two Ways Financial Institutions Can Respond

The first is easy.

EXIT

Prohibit the category.

Terminate existing relationships.

Stop onboarding new merchants.

Eliminate the operational burden.

From a purely economic and risk-management perspective, that can be rational.

But there is another option.

BUILD THE INFRASTRUCTURE TO UNDERSTAND IT

That doesn't mean accepting illegal products.

It doesn't mean weakening underwriting.

It doesn't mean increasing risk tolerance.

It means increasing risk precision.

Instead of:

CBD/Hemp = Too Difficult

the institution can potentially determine:

Merchant → Product → Evidence → Regulation → Policy → Compliance Status

And make decisions accordingly.

That's a fundamentally different operating model.

Some Payment Companies Are Choosing the Second Path

While some providers are retreating, others are explicitly building around regulated commerce.

FLEX Payment Solutions publicly identifies CBD/Hemp among the specialty industries it supports and emphasizes in-house compliance as part of its operating model. Its site says it processed more than $2.6 billion in 2025 across more than 250 merchant accounts.

WestTown Payments similarly identifies hemp among the compliance-driven segments it serves. WestTown describes its mission around creating commerce through compliance using modern technology, while offering payments alongside banking services.

And its banking relationship is particularly significant.

Dart Bank says it supports approximately 700 cannabis and hemp-related businesses and offers specialized hemp payment processing through WestTown Payments.

These organizations aren't demonstrating that hemp suddenly became simple.

They're demonstrating something more important:

Complexity can be supported when the infrastructure is designed for complexity.

This Is Where Qredible and MyCOA® Change the Equation

This is exactly why we have been building Qredible around Product Intelligence rather than simply another merchant-monitoring system.

Q-Trust is designed to help financial institutions understand what merchants actually sell at the product level and connect that information to evidence, regulation, policy and continuous monitoring. Qredible describes the platform as automating product discovery, documentation validation and ongoing compliance evaluation for regulated merchant portfolios.

But technology on the processor side solves only half the problem.

The other half is changing who owns the compliance work.

That's where MyCOA® becomes important.

Instead of the processor repeatedly chasing merchants for:

COAs.

Lab reports.

Product information.

Supporting documents.

Updated evidence.

Product changes.

The merchant maintains that information as part of operating its business.

Qredible's merchant platform is designed to help regulated businesses manage product-level compliance information, including COAs and supporting documentation, while creating greater transparency with financial partners.

The model becomes:

MERCHANT OWNS THE COMPLIANCE RECORD

↓

TECHNOLOGY STRUCTURES THE INTELLIGENCE

↓

PROCESSOR VERIFIES AGAINST ITS POLICY

↓

BANK APPLIES ITS RISK APPETITE

↓

SYSTEM MONITORS FOR CHANGE

↓

MERCHANT REMEDIATES EXCEPTIONS

That is dramatically more scalable than:

Processor asks → Merchant searches → Processor reviews → PDF gets stored → Product changes → Nobody knows → Audit → Start over.

The Merchant Has to Carry More of the Load

This may be uncomfortable for the industry.

But I believe it is necessary.

If you're selling regulated products, compliance is part of your cost of doing business.

Not your processor's.

Not your bank's.

Yours.

Your financial partners absolutely have independent regulatory, risk-management and card-network responsibilities.

They must perform due diligence.

They must establish policies.

They must monitor their portfolios.

They must investigate exceptions.

They must make their own decisions.

But they shouldn't also have to become the merchant's outsourced product-compliance department.

The future has to be shared compliance infrastructure—not transferred compliance responsibility.

That's a major distinction.

Imagine If Every Merchant Arrived Ready

Think about how different underwriting could look.

Instead of a merchant applying with a website and a folder of PDFs:

Its business is registered.

Its products are digitized.

Its COAs are associated with the correct products.

Testing dates are structured.

Ingredients are structured.

Labels are available.

Licenses are available.

Evidence is current.

Missing information is already identified.

Products are continuously maintained.

The processor doesn't begin by reconstructing the merchant.

It begins by evaluating the merchant's existing intelligence against its policy.

That changes everything.

Onboarding gets easier.

Audits get easier.

Monitoring gets easier.

Policy changes get easier.

Regulatory changes get easier.

Portfolio management gets easier.

And supporting regulated commerce becomes economically more rational.

This Is Bigger Than Hemp

The lesson extends far beyond CBD.

Alcohol.

Tobacco.

Vape.

Kratom.

Cannabis.

Peptides.

Nutraceuticals.

Food.

Firearms.

And many other categories operate with product-, licensing-, evidence-, jurisdiction- or policy-specific requirements.

The more complex commerce becomes, the less realistic it is to expect banks and processors to manually reconstruct every merchant's compliance environment.

The future cannot be:

Sell first. Let the bank figure out whether it's compliant later.

That model doesn't scale.

Merchants Should Pay Attention to What Square Is Telling Them

The obvious lesson is:

Find another processor.

That's necessary for merchants affected by the deadlines.

But it isn't the most important lesson.

Because moving from Square to Processor B without changing anything about the merchant's compliance infrastructure simply transfers the same problem.

Maybe Processor B supports the merchant today.

What happens when federal rules change again?

What happens when a state changes its requirements?

What happens when the sponsor bank changes policy?

What happens when the merchant adds another 200 products?

What happens when the next portfolio audit arrives?

What happens when Processor B determines the category costs too much to manage?

A new processor isn't a compliance strategy.

That's the message merchants need to hear.

If You Want Banks to Stay, Make It Easier for Them to Stay

The hemp industry has spent years asking:

Why won't more banks support us?

Perhaps it's time to ask another question:

What are we doing to make ourselves easier to support?

Are our products documented?

Are our COAs current?

Are our labels accurate?

Are our websites compliant?

Can our financial partners see what we're selling?

Can they verify it?

Can they identify when something changes?

Can we respond quickly when policy changes?

Can we demonstrate compliance without somebody spending hours reconstructing our business?

Those things matter.

Trust isn't something the industry can demand from financial institutions.

Trust has to be made verifiable.

Square May Be a Breaking Point. It Doesn't Have to Be the End Point.

I believe there are two possible futures for regulated commerce.

In one, financial institutions continue concluding that these categories are simply too difficult, too expensive and too operationally burdensome to support.

More providers leave.

Merchants have fewer choices.

Pricing rises.

Underwriting becomes harder.

Legitimate businesses get caught alongside problematic ones.

In the other future, merchants take greater ownership of compliance while financial institutions deploy technology capable of understanding and monitoring regulated commerce at scale.

Products become digitized.

Evidence becomes structured.

Policies become machine-evaluable where appropriate.

Changes become detectable.

Exceptions become manageable.

Humans focus on decisions instead of document collection.

And banks can distinguish a compliant merchant from a noncompliant merchant without treating an entire industry as one undifferentiated risk.

That's the future I believe we should be building.

Final Thought

Square's decision should be a warning to the hemp industry.

But perhaps not for the reason everyone thinks.

The warning isn't simply:

"Square is leaving."

The warning is:

"The old compliance model is becoming economically unsustainable."

For too long, regulated merchants have expected processors and banks to shoulder an enormous portion of the burden required to understand, verify and continuously monitor their products.

Processors accepted that burden because they wanted the business.

Merchants became accustomed to it.

Legacy systems struggled to support it.

Product catalogs expanded.

Regulation became more complicated.

And compliance debt accumulated.

Now the system is beginning to push back.

The answer isn't to become angry every time another financial institution leaves.

The answer is to change the model.

Merchants need to own their compliance.

Processors need technology capable of verifying it.

Banks need intelligence capable of governing it.

And everyone needs continuous visibility into what is actually being sold.

Companies like FLEX Payment Solutions, WestTown Payments and Dart Bank show that there are financial institutions choosing to continue supporting complex regulated commerce.

The difference going forward will increasingly be whether the economics and infrastructure make that support sustainable.

Because the future of hemp payments should not depend on finding the next processor willing to carry the industry's compliance burden.

It should depend on building an industry capable of carrying its own.

And if the hemp industry wants banks and processors to stop leaving, that may be the most important lesson of all.

About Qredible

Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →