Your Regulated Merchant Portfolio Needs an Audit. Then Your Underwriting Model Needs to Change.

New Rules Are Exposing an Old Problem: Payment Companies Know Their Merchants, But Often Don't Know Their Products.

This Is Bigger Than Another Regulatory Update

Payment companies serving CBD, hemp, smoke and vape, kratom, mushroom, nutraceutical, and other regulated-product merchants are entering another period of significant change.

But I don't think the most important story is any single regulation.

The bigger story is what these changes are revealing about the way our industry manages regulated merchants.

For decades, we have built underwriting primarily around businesses.

• We identify the merchant.
• We identify the owners.
• We determine the MCC.
• We review the website.
• We collect documents.
• We determine whether the merchant fits policy.
• We approve or decline.
• Then we monitor the relationship.

That model works reasonably well when the principal risks exist at the merchant level.

Increasingly, they don't.

They exist inside the merchant's product catalog.

And recent regulatory developments are making that distinction increasingly difficult to ignore.

The Regulatory Environment Is Moving at the Product Level

Consider what has happened across just a few regulated categories.

Federal law enacted in November 2025 amended the definition of hemp, with the relevant changes taking effect 365 days after enactment. Among other provisions, the amended framework uses total tetrahydrocannabinols, addresses synthetic or manufactured cannabinoids, and excludes certain final hemp-derived cannabinoid products containing more than 0.4 milligrams combined total per containerof specified cannabinoids.

That matters because determining exposure requires more than identifying which merchants have a hemp-related MCC or business description.

Someone needs to understand the actual products being sold.

The same issue appears elsewhere.

In May 2026, FDA issued updated enforcement-priority guidance for certain unauthorized electronic nicotine delivery systems and nicotine pouch products. FDA says it has issued more than 1,000 warning letters to retailers for unauthorized tobacco products, and its warning-letter database continued showing new actions into August 2026.

Kratom-related commerce presents another rapidly evolving issue. FDA has specifically targeted concentrated 7-hydroxymitragynine, or 7-OH, including warning letters and enforcement actions. In July 2026, FDA reported that DEA had begun a temporary scheduling process for 7-OH above a proposed threshold and three synthetic derivatives.

Mushroom products present still another example. FDA has stated that Amanita muscaria, its extracts, and certain constituents—including muscimol, ibotenic acid, and muscarine—are not authorized for use as ingredients in conventional food.

• Different products.
• Different regulatory frameworks.
• Different agencies and requirements.

But from the payment industry's perspective, they expose the same underlying problem:

• Can you identify which merchants in your portfolio are actually selling the affected products?

The First Problem Is Your Existing Portfolio

Before changing underwriting, payment companies have to deal with the merchants they already have.

Suppose you have 5,000 regulated-product merchants.

You may know which merchants were originally boarded as CBD, vape, smoke shop, nutraceutical, or similar businesses.

But can you answer:

• What products are they selling today?
• Which products were added after approval?
• What ingredients or active compounds do those products contain?
• Which vape products have appropriate authorization?
• Which merchants sell concentrated 7-OH products?
• Which merchants offer products containing Amanita-related constituents?
• Which hemp products may be affected by the new federal definition?
• Which COAs or supporting documents are current?
• Which marketing claims have changed?
• Which merchants remain consistent with your current policy?

If you cannot answer those questions from existing portfolio intelligence, then you don't merely have a regulatory-change problem.

You have a visibility problem.

Step One: Decide What Your Policy Actually Is

Before auditing anything, leadership needs to make policy decisions.

That sounds obvious, but it is frequently where organizations get stuck.

• Compliance identifies a regulatory change.
• Risk interprets it.
• Underwriting needs instructions.
• Sales wants to know what it can continue selling.
• Operations needs a remediation process.
• Agents need answers.
• Merchants want to know whether they can continue processing.

The organization therefore needs to establish, by category and product where appropriate:

• What remains acceptable?
• What requires additional review?
• What requires remediation?
• What new evidence will be required?
• What products or activities will no longer be supported?
• What effective dates apply?
• Are existing merchants treated differently during a remediation period?
• What exceptions, if any, are permitted?
• What happens when a merchant fails to remediate?

This needs to happen before thousands of merchants start asking individual relationship managers for answers.

Step Two: Audit the Existing Portfolio

Once policy is defined, the uncomfortable work begins.

You need to determine which merchants are affected.

And there are essentially three ways to do it.

Option 1: Audit Internally

The organization can assign internal underwriting, risk, compliance, and operations personnel to perform the review.

Teams can:

• Identify merchants by MCC and existing classifications.
• Review websites.
• Collect product inventories.
• Request COAs and other documentation.
• Review individual products.
• Compare findings against updated policy.
• Record exceptions.
• Contact merchants.
• Manage remediation.

Advantages

1. Internal teams understand institutional policy.
2. They retain direct control over the process.
3. Institutional knowledge remains inside the organization.
4. Complex cases can be escalated quickly.

Disadvantages

• It is labor intensive.
• It can divert experienced personnel from normal underwriting and monitoring.
• Data frequently ends up in spreadsheets or case notes.
• Product information may be difficult to normalize.
• The process can take months across large portfolios.

And perhaps most importantly:

When the next regulation changes, much of the work may have to be performed again.

That last point should concern executives.

Option 2: Engage a Third-Party Audit Provider

Organizations can also engage external compliance consultants, auditors, or specialized firms to conduct a portfolio review.

Advantages

• Additional resources can be deployed quickly.
• Specialized regulatory expertise may be available.
• Internal teams experience less operational disruption.
• An independent review can provide valuable perspective.

Disadvantages

• Costs can become significant for large portfolios.
• The engagement may still rely heavily on manual review.
• Findings may ultimately be delivered as reports or spreadsheets.
• Product data may not become part of the organization's permanent infrastructure.
• Once the engagement ends, the intelligence may begin aging immediately.

And again:

The next regulatory change can create another audit.

A third-party audit can solve an immediate problem.

It does not automatically solve the underlying intelligence problem.

Option 3: Implement Product-Level Compliance Technology

The third approach is to use technology to discover, digitize, classify, and maintain product-level merchant information.

Instead of treating the audit exclusively as an event, the organization uses it to build a persistent product intelligence layer.

That can include:

• Merchant-product relationships
• Product categories
• Ingredients or compounds where relevant
• Product URLs
• COAs and laboratory evidence
• Licensing
• Product claims
• Supporting documents
• Compliance findings
• Remediation history
• Policy status
• Changes over time

Advantages

• The initial audit can create reusable structured intelligence.
• Future regulatory changes can potentially be evaluated against existing product data rather than restarting discovery.
• Portfolio searches become significantly more precise.
• Monitoring can extend below the merchant level.
• Evidence can become easier to audit.
• The same intelligence can support underwriting, monitoring, compliance, and executive reporting.

Considerations

• Technology still requires policy.
• It still requires knowledgeable compliance professionals.
• Product classification and regulatory logic must be governed carefully.
• Exceptions still require human judgment.
• Data quality matters.
• Implementation requires process change.

Technology is therefore not a substitute for a compliance program.

It is infrastructure for operating one at scale.

Don't Waste the Audit

This may be the single most important recommendation I would make to payment executives.

If you are going to spend the time and money to audit your portfolio, do not allow the result to become another spreadsheet.

Think about what you're actually collecting.

• Merchant.
• Product.
• Brand.
• Manufacturer.
• Ingredient.
• COA.
• License.
• Website.
• Claim.
• Jurisdiction.
• Regulatory status.
• Policy determination.
• Evidence.
• Those are valuable data assets.
• Digitize them.
• Structure them.
• Connect them.
• Make them searchable.
• Maintain them.

Because the next regulatory question may be completely different from today's.

Today you may need to find hemp products exceeding a new threshold.

Tomorrow you may need to identify a specific cannabinoid.

Next month it could be a vape manufacturer.

Then an ingredient.

Then a mushroom constituent.

Then a marketing claim.

If you retain product-level intelligence, the question changes from:

“How do we audit the portfolio again?”

to:

“What does our existing portfolio intelligence tell us?”

That is a massive operational difference.

Step Three: Notify Your Existing Merchants

Once affected merchants have been identified, communication becomes critical.

Merchants need clear answers about:

• What changed.
• Why it matters.
• What your institution's policy will be.
• What information is required.
• Which products require review.
• What remediation is necessary.
• What deadlines apply.
• What happens if the merchant takes no action.

This is also where the responsibility reset from my previous article becomes important.

Payment companies should not have to maintain the merchant's compliance program for them.

Merchants should be expected to maintain their own products, evidence, testing, documentation, and compliance readiness.

The processor's role is to establish requirements, verify information, manage risk, and maintain appropriate oversight.

Step Four: Tell Sales and Your Distribution Network Before They Submit the Next Merchant

This part is frequently overlooked.

A policy change sitting inside a compliance department does very little if sales continues submitting merchants under yesterday's rules.

• ISOs.
• Agents.
• Referral partners.
• Independent sales organizations.
• Integrated software partners.
• Internal sales teams.
• Everyone sourcing merchants needs updated guidance.

They need to understand:

• Which categories remain supported.
• Which products are prohibited.
• Which merchants require enhanced review.
• What documentation must be obtained.
• What remediation can make a merchant supportable.
• When a merchant should not be submitted.

Otherwise underwriting becomes the place where sales discovers policy.

That is inefficient for everyone involved.

Step Five: Change New-Merchant Underwriting

Auditing the current portfolio without changing onboarding simply recreates the problem.

Every new regulated merchant should now force a deeper question:

What exactly does this merchant sell?

Not simply:

What industry is it in?

For regulated-product merchants, underwriting increasingly needs visibility into areas such as:

• Product inventory
• Product categories
• Brands and manufacturers
• Ingredients or active compounds where relevant
• COAs and testing
• Product authorization status where applicable
• Licenses
• Labels
• Marketing claims
• Geographic availability
• Applicable regulations
• Institutional policy

This is where Product Intelligence™ becomes foundational.

The underwriting record should no longer stop at the merchant.

It should connect:

Merchant → Product → Evidence → Regulation → Policy → Decision

Step Six: Change Ongoing Monitoring

This is where organizations can make the same mistake again.

They perform a thorough audit.

They clean the portfolio.

They improve underwriting.

Then they assume the merchant remains the same.

It won't.

A smoke shop can add a new vape brand tomorrow.

A CBD retailer can introduce a new cannabinoid.

A convenience store can begin selling 7-OH products.

A wellness merchant can add mushroom gummies.

A nutraceutical merchant can introduce a new ingredient.

Nothing about the merchant's legal entity needs to change.

Its risk profile can change completely.

Ongoing monitoring therefore needs to ask more than:

Did the merchant change?

It needs to ask:

Did what the merchant sells change?

The New Operating Model

For regulated commerce, I believe payment companies should increasingly think about the merchant lifecycle this way:

DEFINE POLICY

↓

AUDIT EXISTING PORTFOLIO

↓

DIGITIZE PRODUCT INTELLIGENCE

↓

REMEDIATE AFFECTED MERCHANTS

↓

COMMUNICATE WITH MERCHANTS

↓

EDUCATE SALES & PARTNERS

↓

CHANGE UNDERWRITING

↓

CONTINUOUSLY MONITOR PRODUCTS

↓

UPDATE POLICY AS REGULATIONS CHANGE

↓

QUERY THE PORTFOLIO AGAIN

Notice something important?

It is a loop.

Not a project.

There Will Be Another Regulation

This is the point I hope payment executives take away from this article.

• Don't build your response around the current hemp change.
• Don't build it around vape.
• Don't build it around kratom.
• Don't build it around mushrooms.

Build it around change itself.

Because regulations will continue changing.

• FDA priorities will change.
• State laws will change.
• Federal laws will change.
• Card-brand requirements will change.
• Sponsor-bank policies will change.
• Products will change.
• Ingredients will change.
• Merchants will change.

The only sustainable answer is infrastructure capable of adapting with them.

This Is Why Product Intelligence Matters

For most of payments history, our fundamental unit of risk was the merchant.

Increasingly, regulated commerce requires another layer.

Portfolio

↓

Merchant

↓

Product

↓

Ingredient / Compound / Attribute

↓

Evidence

↓

Regulation

↓

Policy

↓

Compliance Status

That hierarchy matters because regulation frequently operates below the merchant level.

If a rule affects one cannabinoid, one ingredient, one formulation, one product authorization, or one marketing claim, an MCC cannot tell you where the exposure exists.

A merchant application cannot tell you.

A transaction-monitoring system cannot tell you.

A chargeback report cannot tell you.

You need product-level intelligence.

The Executive Decision Isn't Whether to Audit

For many organizations with exposure to these categories, some level of portfolio reassessment will be difficult to avoid.

The more important strategic decision is:

What do we want to have when the audit is finished?

A completed project?

A consultant's report?

A collection of updated spreadsheets?

Or a structured intelligence asset describing the products being sold throughout the portfolio?

That decision determines whether today's investment solves today's problem...

or begins solving tomorrow's as well.

Questions Payment Leadership Should Be Asking Now

• Which recent federal and FDA developments affect our existing policies?
• Which regulated-product categories do we currently support?
• How many merchants in those categories are in our portfolio?
• Do we know what those merchants actually sell today?
• Can we identify affected products without contacting every merchant?
• Do we need a full portfolio audit?
• Will we perform it internally, outsource it, or use technology?
• What will happen to the data after the audit?
• Have sales teams, ISOs, agents, and referral partners received updated policy?
• Has new-merchant underwriting changed?
• Can ongoing monitoring identify product changes after approval?
• Can we search the portfolio when the next regulation changes?
• Can we demonstrate what we reviewed, what we found, what we remediated, and when?

And perhaps the most important:

• Are we solving this regulatory change—or finally solving the operating model that makes every regulatory change so painful?

Final Thought

There is an understandable temptation whenever regulations change.

Create a project.

Build a team.

Audit the merchants.

Fix the exceptions.

Close the project.

Move on.

I think that approach is becoming obsolete.

Because the problem isn't CBD.

It isn't hemp.

It isn't vape.

It isn't kratom.

It isn't mushrooms.

The problem is that modern commerce changes continuously while much of merchant compliance still operates periodically.

So yes—review your policy.

Audit the portfolio.

Notify merchants.

Educate agents.

Change underwriting.

Update monitoring.

But don't stop there.

Use this moment to build something the payments industry has historically lacked:

A persistent, searchable, continuously maintained understanding of what your merchants actually sell.

The next regulation will come.

When it does, the question shouldn't be:

“How do we audit everyone again?”

It should be:

“Show me every merchant and every product affected.”

That is the difference between repeatedly reacting to regulatory change and building an organization capable of operating through it.

And that is why Product Intelligence™ is rapidly becoming foundational infrastructure for regulated commerce.

Sources and regulatory references: FDA tobacco enforcement actions · FDA 2026 ENDS and nicotine pouch enforcement guidance · FDA 7-OH update · FDA Amanita muscaria industry alert · Federal hemp definition and 2025 amendment notes.

About Qredible

Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →