Selling CBD and nutra on high-risk MIDs

I spent nine years as CTO of a direct-response company and built its checkout, multi-MID routing included. Getting a high-risk MID approved is the easy part. Keeping it is a funnel problem, and most of the work happens on pages the acquirer never looks at until something goes wrong.

Why CBD and nutra count as high risk

An acquirer underwrites risk: the risk that the product is not legal where it is sold, that buyers dispute the charge, and that the merchant disappears and leaves the bank with the refunds. CBD and supplements score badly on all three.

• Legal status. Hemp-derived CBD is legal federally in the U.S. under the hemp definition, but the FDA says CBD cannot be sold as a dietary supplement or added to food, and states set their own rules on top.
• Disputes. Supplements often sell on trials and subscriptions, and a buyer who forgot about a rebill disputes it.
• Claims. Health claims draw regulators, and a product that did not do what the page promised draws refund requests.

So high-risk accounts come with rolling reserves, lower monthly caps and closer monitoring. Each MID is a separate agreement with its own limits, and your job is to stay inside every one of them. I'd write those limits down before the first page is built, because a funnel that scales past its caps usually finds out from the acquirer.

The legal ground for CBD, in brief

Three facts shape a U.S. CBD funnel. Check the current state before you launch, because all three are moving.

• Hemp is defined by THC. The 2018 Farm Bill defined hemp as cannabis with no more than 0.3% delta-9 THC on a dry weight basis. A 2025 law changes that to total THC and limits final products to 0.4 mg total THC per container. It was due to take effect on 12 November 2026; a September 2026 funding bill moved that to 11 December 2026 (Congressional Research Service).
• The FDA does not treat CBD as a supplement. It has concluded that CBD products are excluded from the dietary supplement definition, and that adding CBD to food sold across state lines is prohibited. The only approved CBD drug is Epidiolex (FDA).
• States add their own rules, from age limits to labelling to outright bans on some products. They change often, which is why this post does not list them.

This is general information, not legal advice. Have a lawyer who knows your product decide where you can sell and what you can say.

The compliance rules your funnel should enforce

Your acquirer will ask how you enforce your restrictions, not just whether you have them. Rules written in a policy page do nothing. Rules the funnel applies to every visitor do. If I could only fix one thing in a new CBD funnel, it would be this, because a rule that lives in a PDF gets forgotten the first time someone clones a page for a new traffic source.

Geo blocks with page events

In ElasticFunnels, page events can check a visitor's country, or their U.S. state, from their IP address. Then an action follows: hide the order button, show a notice, redirect, or load a version of the page without the restricted product. The checkout also has an allowed-countries setting, so a buyer cannot pick a country you do not ship to. IP location is a first filter, not proof, so apply the same list to the shipping address before you fulfil.

Age gate

ElasticFunnels has no built-in age verification. A page-event popup can ask visitors to confirm their age before the offer, which is a self-declaration. Where the law requires a real age check, use an age verification service or an adult signature on delivery.

Claims and disclaimers

For supplements, a structure/function claim ("supports restful sleep") needs the FDA disclaimer next to it: "This statement has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease." (21 CFR 101.93). A disease claim turns the product into an unapproved drug in the FDA's eyes, and the disclaimer does not fix that. The FTC separately expects competent and reliable scientific evidence behind any health claim (FTC). Presells count: the rules apply to your advertorial as much as to the sales page.

Running several MIDs: capacity and redundancy

High-risk merchants almost always hold more than one MID. The reasons are the ones any growing business has, just sharper: each account has a cap, any account can be paused for review, and approval rates differ by acquirer and by market.

• Stay inside each acquirer's limits. Set the caps you agreed with each acquirer: a minimum and maximum order amount and a daily transaction cap per MID, plus a monthly volume cap that least-used routing reads. A MID at its cap stops taking orders instead of breaking the agreement.
• Route to the MID approved for the market. Route by the buyer's country, currency or card BIN, so each order goes to the account whose underwriting covers it.
• Fail over. With a priority order, a backup account takes orders when the main one is paused or full.
• Cascade soft declines only. A soft decline, such as insufficient funds, can be retried once on the next MID. ElasticFunnels retries only the soft-decline codes you list, at most twice by default. Hard declines stop.

ElasticFunnels has 6 routing algorithms for this. High-risk acquirers usually connect through a gateway such as NMI; the checkout runs on Stripe, NMI, PayPal, Klarna and Authorize.net.

For a new high-risk setup I'd start with a priority order, one main account and a backup, with every MID's caps entered on day one. Country or BIN routing earns its place once a second acquirer is approved for a market the first one isn't.

MID routing will not keep a dispute ratio under a monitoring threshold, whatever the people offering to help with that tell you. Spreading volume so that each account stays under the line is treated by acquirers and card networks as evading the program, and it usually ends with every account closed at once, and a place on the lists that follow a merchant to the next acquirer. The same goes for cloaking, "white pages" shown to reviewers and descriptor tricks. We don't support any of it, and you should not do it.

Chargeback prevention

The ratio that matters most is disputes plus fraud against settled sales, per MID. Visa's program counts both and, from April 2026, flags merchants in the U.S., Canada, Europe and Asia Pacific at 1.5% (see What is a MID? for the sources). The honest way to stay under it is to have fewer disputes, and on a subscription offer a lot of them start with a buyer who doesn't recognise a charge or forgot the rebill. Picture a buyer who sees an unfamiliar name on a statement three weeks after a trial. Calling their bank is easier than finding your support email, so every item below is about making the refund easier than the dispute.

• Dispute alerts. ElasticFunnels connects to Dispute.com and Chargebacks911. Dispute.com alerts (Ethoca and CDRN) can refund the order automatically, within a maximum amount you set. Chargebacks911 alerts and cases are recorded on the order and can start automations.
• Fraud rules before the charge. Block or review by velocity, BIN, country, email domain, amount or IP, and keep a blocklist of emails, phones and IPs.
• Refunds that are easy to give. Refund from the order or customer screen, in full or in part, and cancel the subscription in the same step. A refund costs less than a chargeback.
• A descriptor buyers recognise. Set a card charge name on each merchant and repeat it in the order emails, which ElasticFunnels does ("the charge on your statement will appear as…"). Make it match your brand name, and agree it with your acquirer.
• Clear billing terms. Put the price, the rebill amount and date, and how to cancel next to the order button, in plain text. ElasticFunnels has no built-in terms checkbox, so write the terms into the checkout page.

A launch checklist

1. Get the MIDs approved for the exact product, pages and billing model you will run. Each extra MID is its own application.
2. Have counsel sign off on the states and countries you sell to, the claims, the disclaimers and the age rules.
3. Build the rules into the funnel: geo conditions, the checkout's country list, age confirmation, disclaimers, billing terms.
4. Enter each MID's agreed limits, then pick a routing rule and turn on the soft-decline cascade.
5. Connect dispute alerts and set your auto-refund limit before the first order, not after the first chargeback.
6. Read the numbers per MID every week: approvals, refunds, alerts and disputes.

All of this runs on the ElasticFunnels checkout, with chargeback prevention and MID routing on the same order record.

High risk mostly means low tolerance. The acquirer will forgive a slow month, and it has very little patience for a surprised buyer. Build the funnel so nobody is surprised, and the account tends to look after itself.