Updated 4 October 2026
What changed, and when
A dated record of the platform policies and regulations that decide whether a merchant in a regulated category can take cards. seven documents, re-read on a schedule, each carrying the date it states for itself and the date we last read it.
How this is kept
- Two dates, always
- The date a document claims for itself, and the date we last read it. A reading of somebody else’s policy is worth nothing if you can’t check it, and worth less than nothing if it’s quietly stale.
- four of the seven publish no date at all
- So you can’t tell whether one has changed just by looking. We fingerprint the vocabulary of each page instead, and a script re-reads them all and reports what moved. It catches a category being added, removed or renamed. It won’t catch a sentence reworded using words already on the page, and we’d rather tell you that than let you assume otherwise.
- Quiet checks get published too
- A tracker that only appears when something happens gives you no way to tell watching from forgetting. When nothing moves, we still post an entry.
- Primary sources only
- The policy page, the Federal Register document or the statute. Quotes are verbatim and marked as quotes. We link to policies instead of reproducing them.
Ahead
These dates are already fixed. Underwriting moves before the date arrives, so they’re worth acting on early.
- Regulation
The first part of the federal hemp change takes effect
“cannabinoids that are not capable of being naturally produced by a Cannabis sativa L. plant”
Only one piece of the new definition still starts on this date: hemp products containing cannabinoids the plant can't produce at all. Everything else moved to 11 December. If anything in your catalogue fits this description, it has five weeks less than the rest.
Hits:CBD and hemp
Source: Public Law 119-37, section 781; Public Law 119-103, section 2019. Our longer read: What the hemp change means for payments.
- Regulation
The rest of the federal hemp change takes effect, unless Congress moves it again
This is the date that matters for most hemp merchants now. The threshold moves from delta-9 THC to total THC, which counts THCA and delta-8. Finished products get a ceiling of 0.4 milligrams of total THC per container, and unlike a percentage, that doesn't scale with product size. Cannabinoids the plant can produce but that were made outside it, such as delta-8 converted from CBD, are excluded from this date too. 11 December is also the day the stopgap funding law that moved it runs out, so another extension is possible. Don't plan around one. Acquirers reprice a known exposure before it arrives.
Hits:CBD and hemp
Source: Public Law 119-103, section 2019; Congressional Research Service, IN12620. Our longer read: What the hemp change means for payments.
Recorded
- Watch note
Correction: Shopify Payments has its own list, and we left it out
“Shopify Payments doesn't support the sale of hemp, cannabidiol (CBD), and tetrahydrocannabinol (THC) products.”
We said Shopify Payments had no list of its own and simply inherited Stripe's. Its US terms do point at Stripe and PayPal, but Shopify's help center also lists what Shopify Payments won't support: tobacco, firearms and ammunition, cannabis, CBD and hemp, cryptocurrency, credit repair, sexually explicit content, and products making unverified health claims. Where that list names a category, it's stricter than Stripe. We've corrected every Shopify ruling on the can-I-sell pages, and the biggest changes are CBD, vapes and firearms, which we had shown as allowed on conditions.
Hits:CBD and hempVapes and e-cigarettesFirearms and ammunitionCryptocurrencyCredit repair
Source: Shopify Help Center: Shopify Payments eligibility; Shopify Help Center: Payment options for hemp sales.
- Watch note
All seven sources re-read: Stripe moved
Stripe now states 22 September 2026 (see that entry). PayPal still states 29 October 2022 and Squarespace still states 21 July 2026. The undated Shopify, Wix and Squarespace pages fingerprinted differently, but the clauses we cite on them read the same as before. Those pages also changed navigation and surrounding text, which our fingerprint counts, so not every flag is a policy change.
Source: Our watchlist.
- Platform policy
Stripe changes its tobacco and credit monitoring rules
“In the United States, merchants selling electronic tobacco may only sell products authorized by the Food and Drug Administration”
Two changes, according to Stripe's own note. US vape and e-liquid merchants on Stripe can now only sell FDA-authorized products, which rules out most of the disposable market. And credit monitoring moved from prohibited to supportable in the United States. Credit repair and counselling are still prohibited.
- Regulation
Congress pushes most of the federal hemp change to 11 December
“Until December 11, 2026, the amendments made by section 781 of division B of Public Law 119–37 (7 U.S.C. 1639o note) shall only apply with respect to products described in paragraphs (1)(C)(ii)(I) and (1)(C)(iv)(I)”
The stopgap funding law signed on 2 September moved most of the new hemp definition from 12 November to 11 December. The two paragraphs it keeps on the original date cover products containing cannabinoids the plant can't produce. We missed this for a month, and our hemp pages said 12 November for all of it until 4 October 2026.
Hits:CBD and hemp
Source: Public Law 119-103, section 2019.
- Watch note
All seven sources re-read, none moved
Stripe still states 13 May 2026, PayPal still states 29 October 2022, and the five undated documents fingerprint identically to our last reading. Nothing to do. We post the quiet checks too, so you can tell we're still watching.
Source: Our watchlist.
- Platform policy
Squarespace updated what it says you can't sell
The article states this date for itself and publishes no changelog, so there's no way to tell from the page what moved. We started fingerprinting it on 27 August 2026. We'll catch the next change, but we missed this one. It's recorded here so you can see the gap.
- Regulation
DEA moves to place 7-OH above a threshold in Schedule I
“notice of intent to publish a temporary order to schedule 7-hydroxymitragynine above a specified threshold”
The action targets concentrated 7-hydroxymitragynine above a stated threshold. Kratom leaf isn't the target, and that distinction is real. An underwriter is unlikely to make it for you, though. If you sell leaf product, expect to be asked to prove which side of the threshold your catalogue sits on, and have certificates of analysis ready that answer it before a review opens.
Hits:Kratom
Source: Federal Register, DEA notice 2026-13580; DEA press release, 1 July 2026.
- Platform policy
Shopify stops the sale of vaping products on its platform
“to ban the sale of all vaping products, including e-cigarettes, through its platform”
This is a platform ban, not a payments rule, so switching payment provider doesn't help. A vape store on Shopify has to move to another platform. The announcement came from the attorneys general who asked for it, and we haven't found a Shopify page that announces it. We missed this until 4 October 2026, when we corrected our vapes page.
- Platform policy
Stripe's restricted-businesses list last moved
“Updated domestic charter air travel from prohibited to restricted in the US, CA, UK, EU, BR, IN, TH, AU.”
Nothing moved in the categories we cover, and that tells you something. Stripe keeps this list current enough to post a one-line note about charter air travel. So if the list doesn't mention your category, don't assume that's an oversight that'll get fixed in your favour. It's a call left to an underwriter, and they make it after you've built the store and taken orders.
Source: Stripe: Prohibited and restricted businesses. Our longer read: How to read Stripe's restricted list.
- Platform policy
PayPal's Acceptable Use Policy last moved, and hasn't since
Nearly four years without a revision, through a whole cycle of hemp, peptide and kratom enforcement. Treat that as a warning sign. When the text stays put and the outcomes change, the change is happening in enforcement, and a merchant watching the document will never see it coming. It's the most common way merchants end up with us convinced they did nothing wrong, and they're usually right.
Source: PayPal: Acceptable Use Policy.
What we watch
sevendocuments. Two of them aren’t payment policies. They decide whether the storefront can exist at all, which is a different way to lose a business and the one merchants tend not to see coming.
The only mainstream processor list that names categories individually, and one of the two lists Shopify Payments' US terms point to.
The document states 22 September 2026. We last read it on 4 October 2026 and have been watching it since 3 August 2026.
- PayPalAcceptable Use Policy
Written in categories rather than products, which is why merchants who read it and concluded they were fine still get shut off.
The document states 29 October 2022. We last read it on 4 October 2026 and have been watching it since 3 August 2026.
- ShopifyPayment processor list
Names which processor serves each country. For the United States it names Stripe and PayPal, so their lists apply to Shopify Payments on top of Shopify's own.
The document publishes no date. We last read it on 4 October 2026 and have been watching it since 3 August 2026.
- ShopifyAcceptable Use Policy
Decides whether the store itself may exist, separately from whether Shopify Payments will process for it. Losing this one takes the storefront, not just the checkout.
The document publishes no date. We last read it on 4 October 2026 and have been watching it since 27 August 2026.
Where the delegation to the per-country processor is actually written down.
The document publishes no date. We last read it on 4 October 2026 and have been watching it since 27 August 2026.
An explicit list, unusually for a site builder, and stricter than most merchants expect when they arrive from a template.
The document publishes no date. We last read it on 4 October 2026 and have been watching it since 27 August 2026.
- SquarespaceWhat can't I sell on Squarespace?
The support article merchants actually read before choosing a platform, which is not the same document as the terms they agree to.
The document states 21 July 2026. We last read it on 4 October 2026 and have been watching it since 27 August 2026.
Watching a policy isn’t the same as predicting one. Nothing here is legal advice, and none of it is a promise about what any processor will do with your account. If a date on this page matters to your catalogue, check your own products against it now instead of waiting to see. That’s what the free underwriting check is for.
Does any of this land on your catalogue?
A date on a calendar only matters if it touches what you sell. We'll tell you which of these apply to your products and what to do about them, even if it doesn't lead to work for us.
Both are free, and neither is a sales call. The check only asks for your web address. The call takes thirty minutes, and you leave with an answer even if we never work together. Ready to start now? Tell us what you sell.