Payment Processor Crackdown: Is Your Vape Business Next?
The payment processor crackdown on U.S. vape businesses has moved from threat to active enforcement.
By Jerry Smith · Senior Analyst, VapeTrends360 · July 10, 2026
Just hours before this story went to press, Shopify confirmed that a notice sent to merchants on June 24 is now in force: remove every vape product from your store, or risk suspension. That deadline — July 8 — already passed. It’s the clearest sign yet that the payment processor crackdown on vape businesses that VapeTrends360 first flagged in April is no longer a warning shot. It’s live enforcement, and it is spreading fast across the entire payments stack that retailers depend on to open the register every morning.
Table of Contents
- The Timeline: How We Got Here
- Who’s Behind the Crackdown
- Follow the Money: The Numbers Driving Enforcement
- Why Payment Networks Are Suddenly Cooperating
- The Legal Backbone: PMTA and the PACT Act
- Is Your Vape Business at Risk?
- What Compliant Businesses Should Do Now
- Frequently Asked Questions
- Final Verdict
1. The Timeline: How We Got Here
The pressure campaign against the illegal vape market’s financial plumbing didn’t start this month, but it has accelerated dramatically since spring. Here’s the sequence, pieced together from state attorney general filings and reporting from Reuters and trade outlet Nicotine Insider:
| Date | Development |
|---|---|
| April 14, 2026 | A coalition of 13 state attorneys general sends a joint letter to Visa, Mastercard, American Express and Discover demanding they cut off payment access for merchants selling illicit e-cigarettes. |
| April 28, 2026 | Pennsylvania AG Dave Sunday expands the push, leading 24 additional attorneys general and the City of New York in letters to nine companies, including PayPal, Stripe, Sezzle, Citi, Capital One and Block. |
| June 17, 2026 | Fuel retailer Valero warns store operators that card networks can levy mid-six-figure fines per violation or revoke card processing entirely. |
| June 23–24, 2026 | Shopify notifies merchants it will no longer support ENDS product sales and sets a July 8 removal deadline. |
| July 3, 2026 | Reuters reports that Fiserv (via its CardConnect unit), BP, Marathon Petroleum and Valero have all issued formal compliance notices to store-level partners. |
| July 8, 2026 | Shopify’s merchant removal deadline passes. |
| July 10, 2026 | Shopify confirms to Reuters that the vape ban is active and applies globally, not just in the U.S. |
Each entry looks incremental on its own. However, stacked together, they describe something else: a coordinated effort to make it functionally impossible for an unauthorized vape retailer to accept a credit card, run an online store, or keep a fuel-station franchise agreement intact.
2. Who’s Behind the Payment Processor Crackdown
This isn’t a single agency action — it’s a bipartisan, multi-state coalition that has grown from 13 attorneys general in April to more than 25 offices by late spring, alongside city-level authorities in New York and Washington, D.C., and the government of Puerto Rico. California Attorney General Rob Bonta and New York City have led coordination on the retail-platform side, pushing Shopify directly. Pennsylvania’s Dave Sunday has led the push on the financial-services side, targeting card networks and payment apps.
Their target list of companies is broad by design: Visa, Mastercard, American Express, Discover, Capital One, Citigroup, PayPal, Stripe, Sezzle, and Block (which operates Square, Cash App and Afterpay) have all received formal letters asking them to treat unauthorized vape sales as a card-network rule violation, not merely a regulatory gray area.
3. Follow the Money: The Numbers Driving Enforcement
The numbers behind the payment processor crackdown explain why attorneys general are coordinating this aggressively. In their April letter, the 13-state coalition put the size of the illicit e-cigarette market at more than $11 billion in annual U.S. retail sales — and claimed unauthorized products now account for over 80% of all e-cigarette sales nationwide. Reuters’ July reporting cited a separate estimate putting the illegal vape trade at $9 billion or more a year. Either figure dwarfs the legal, FDA-authorized segment of the market.
| Metric | Figure | Source |
|---|---|---|
| Estimated annual illicit vape sales | $9B–$11B+ | Reuters / State AG coalition letter |
| Share of U.S. e-cigarette sales that are unauthorized | Over 80% | 13-state AG coalition letter, April 2026 |
| FDA-authorized vaping products (April 2026) | 41 | Pennsylvania Attorney General’s office |
| FDA-authorized vaping products (July 2026) | 45 | Reuters / Nicotine Insider |
| Estimated illicit retail locations nationwide | 100,000+ | 13-state AG coalition letter |
| Potential fine per violation cited to retailers | Mid-six figures | Valero merchant notice, June 17, 2026 |
Note the FDA authorization count moved from 41 to 45 between April and July — a reminder that the list of legal products, while growing, remains a small fraction of what’s actually on shelves. Every authorization is limited to tobacco or menthol flavor; no flavored disposable currently holds full FDA marketing authorization.
4. Why Payment Networks Are Suddenly Cooperating
Card networks and payment processors aren’t acting out of goodwill. Instead, three forces are converging on them at once.
Legal exposure. The attorneys general’s letters explicitly frame unauthorized vape transactions as violations of card-network rules governing illegal activity, high-risk merchants and brand protection — rules the networks themselves wrote. Once a payment platform is “on notice,” the coalition argues, continuing to process those transactions becomes a compliance failure the network owns, not just the merchant.
Precedent. The current push explicitly echoes a 2005 campaign that pressured payment networks to stop processing illegal cigarette sales — an effort that helped produce the federal PACT Act. Attorneys general are using the same playbook, and card networks that remember how that ended have an incentive to move early rather than face years of litigation and legislation.
Franchise and channel risk. For fuel retailers like BP, Marathon Petroleum and Valero, the risk isn’t abstract. Mastercard has reportedly begun issuing compliance violation notices directly to merchants across the industry, and a single violation can reportedly trigger fines in the mid-six figures or termination of a store’s ability to process cards at all — a franchise-ending outcome for a small operator.
5. The Legal Backbone: PMTA and the PACT Act
Specifically, two federal mechanisms give the coalition its legal footing.
Premarket Tobacco Product Applications (PMTA). Since 2016, every e-cigarette product sold in the U.S. has been required to receive FDA marketing authorization through the PMTA process before it can be legally sold. Products without it are considered “adulterated” and cannot legally be sold or shipped in interstate commerce — regardless of how long they’ve been on shelves or how popular they are with consumers.
The PACT Act. Formally known as the Prevent All Cigarette Trafficking Act, it imposes registration, age-verification and reporting requirements on anyone shipping vapor products across state lines. Attorneys general allege that many online sellers mislabel shipments specifically to dodge PACT Act reporting, routing packages through USPS, UPS and FedEx in ways carriers may not catch. That allegation is part of why shipping carriers, not just payment processors, are now facing similar pressure.
Together, these two laws are what let a state AG’s office argue — credibly, to a general counsel at Visa or Mastercard — that a transaction isn’t just ethically dicey but plainly illegal.
6. Is Your Vape Business at Risk in This Payment Processor Crackdown?
Not every vape-adjacent business faces the same exposure to the payment processor crackdown. Overall, here’s how the risk breaks down by business type.
| Business Type | Exposure Level | Why |
|---|---|---|
| Convenience stores / gas stations selling unauthorized disposables | Very High | Directly named in BP, Marathon and Valero notices; franchise agreements now explicitly prohibit it. |
| Independent smoke/vape shops selling unauthorized brands | Very High | Named specifically in AG coalition letters as part of the “100,000+ locations” problem. |
| E-commerce sellers on Shopify or similar platforms | Very High | Shopify’s global ban took effect July 8; other hosting platforms are reportedly being approached next. |
| Retailers selling only tobacco/menthol, FDA-authorized products | Low | These are the exact products the enforcement push is designed to protect from unfair competition. |
| Distributors/wholesalers of unauthorized brands | High | Payment terminations at the retail level cut off their customers’ ability to buy from them. |
| Nicotine pouch retailers (authorized products) | Low | Not the target of this campaign, though card networks are watching the broader nicotine category. |
In short, the common thread is simple: if the products on your shelf or in your online store don’t appear on the FDA’s list of authorized vaping products, your merchant account is now a target, not a formality.
7. What Compliant Businesses Should Do Now
Responding to the payment processor crackdown doesn’t have to be complicated. Whether you’re a single-location smoke shop or a multi-state distributor, four steps can meaningfully reduce exposure:
- Audit your SKUs against the FDA’s authorized products list. Cross-check every disposable, pod, and e-liquid you carry against current PMTA marketing orders. Remember that authorization is brand-and-flavor specific — a company having some authorized products doesn’t clear every SKU it sells.
- Read your payment processor’s merchant agreement, not just its rate sheet. Most agreements already prohibit “illegal product” sales; the card networks are now enforcing clauses that were previously dormant.
- If you’re already flagged as high-risk, work with a processor built for it. Providers like PaymentCloud, Host Merchant Services and similar high-risk merchant specialists exist specifically to underwrite compliant vape, CBD and age-restricted retailers — but they still require proof of FDA-authorized inventory and PACT Act registration.
- Document age-verification and PACT Act compliance now, before an inquiry. Several of the AG letters single out weak age-gating as evidence of bad faith. A retailer that can show robust age verification is in a materially different position than one that can’t.
The payment processor crackdown will keep evolving, and for manufacturers and distributors watching from further up the supply chain, our earlier coverage of the FDA’s proposed rule targeting foreign vape makers and Pennsylvania’s new compliance directory (see this week’s briefing) are worth revisiting — both point toward the same conclusion: PMTA status, not brand recognition, is becoming the market’s real currency.
Frequently Asked Questions About the Payment Processor Crackdown
Can a payment processor really shut down my vape business overnight?
Yes. Merchant agreements typically allow processors to suspend or terminate accounts for violations of card-network rules, and several notices reviewed by Reuters describe exactly that outcome for repeat or serious violations.
Does this only affect online sellers?
No. Brick-and-mortar retailers are squarely in scope — BP, Marathon Petroleum and Valero have all issued warnings directly to their branded gas station operators, independent of any e-commerce activity.
What counts as an “unauthorized” vaping product?
Any e-cigarette product that has not received a marketing authorization from the FDA through the PMTA process. As of mid-2026, that authorized list includes only 45 products, all in tobacco or menthol flavor.
Is Shopify’s vape ban limited to the United States?
No. A spokesperson for California Attorney General Rob Bonta told Reuters that Shopify’s policy change applies globally, not just to U.S.-based merchants.
Are nicotine pouches affected by this crackdown?
The current campaign is focused specifically on electronic nicotine delivery systems (vapes), not nicotine pouches, though the broader regulatory environment for all nicotine products continues to tighten.
What should I do if my processor sends me a compliance notice?
Treat it as urgent. Audit your inventory against FDA authorization status immediately, remove any unauthorized products, and document the steps you’ve taken — processors are more likely to work with merchants who can show a rapid, good-faith response.
Final Verdict on the Payment Processor Crackdown
The payment processor crackdown is no longer a looming threat for the vape industry — as of this week, it’s operational. Shopify’s ban is live, Mastercard’s compliance notices are going out, and fuel retailers are already threatening franchise-level consequences. For businesses built entirely around FDA-authorized, tobacco- and menthol-only products, the practical impact should be minimal. For everyone else, the question in this article’s headline has already been answered by the industry’s largest platforms: if your inventory isn’t on the FDA’s authorized list, your payment processor isn’t just watching — it’s coming.
VapeTrends360 is editorially independent and not affiliated with any brand, payment processor, or government agency mentioned in this article. 21+ only. Nicotine is addictive. This article is for informational purposes only and does not constitute legal or financial advice.
