CBD Certificates of Analysis: The Lab Docs Processors Demand
Learn the CBD certificate of analysis requirements underwriters check, from batch matching to total THC math, so your files are ready for review.
Photo: Pixabay
On this page 7 sections
- Why Processors Require a COA for Every CBD Product
- CBD Certificate of Analysis Requirements: What a Compliant COA Must Show
- Delta-9 THC Dry Weight vs. Total THC Testing for Hemp
- Matching Batch Numbers, Labels, and Your Website
- Third-Party ISO 17025 Labs and Red-Flag Reports
- Keeping COAs Current for Processor Audits
- Next Steps for Hemp Merchants
Key takeaways
- Underwriters expect a third-party COA for every SKU, and the batch number on it must match your label and product page.
- Check both delta-9 THC and total THC, because THCA converts to THC when heated.
- A COA QR code on a label should open the exact batch report, not a homepage or a generic file.
- A dated, organized COA library makes processor audits faster and protects your account between reviews.
If you sell hemp-derived products, your certificates of analysis will get as much scrutiny as your financials. This guide covers CBD certificate of analysis requirements from the processor's side. You will learn which COA fields underwriters check, how delta-9 and total THC differ, how to match batch numbers across labels and your website, and how to keep documentation ready for periodic audits.
This is general information, not legal or regulatory advice. Hemp rules vary by state and have been changing at the federal level, so confirm current requirements with a qualified attorney or compliance professional.
Why Processors Require a COA for Every CBD Product
An acquiring bank that processes your card sales takes on legal and reputational risk for those sales. Card network rules prohibit processing illegal transactions. Whether a hemp product is legal depends on what is actually in it. A COA is the main evidence that a product is what you say it is.
That is why underwriters review a CBD COA for merchant account approval at the SKU level, not the brand level. Different products carry different risks:
- A 500 mg tincture and a 2,000 mg tincture are different formulations.
- A broad-spectrum gummy and a full-spectrum gummy can test very differently for THC.
- A new flavor of an existing product is still a new batch with its own results.
Processors also review your products after approval. Many acquirers run website reviews and ask for documents during periodic audits. A product added without a matching COA can trigger a hold, a reserve increase or a closure. That applies whether you sell through an online store, a retail counter or both.
If you are applying now, MannyPay's CBD and Delta 8 merchant services page explains what the application process covers. Underwriting decisions depend on your full file, and approval is never automatic.
CBD Certificate of Analysis Requirements: What a Compliant COA Must Show
A COA that satisfies an underwriter usually has three parts: identification, potency results and contaminant results. A missing or unclear section can stall a file.
Lab and Sample Identification
- Lab name, address and contact details, plus its accreditation information
- Client name that matches your business or your manufacturer, with a clear link to your brand
- Product name and type, such as tincture, gummy, topical, flower or vape cartridge
- Batch or lot number and the lab's sample ID
- Dates: when the sample was collected, received, tested and reported
- Signature or approval from an authorized lab representative
- Page numbering, such as "Page 1 of 4," so reviewers know the report is complete
Cannabinoid Potency Results
The potency panel should list each cannabinoid tested, the result and the units. For THC, look for:
- Delta-9 THC
- THCA
- A calculated total THC figure
- Delta-8 THC and other cannabinoids, if your product contains them or is marketed around them
- The method used, plus the limit of detection (LOD) and limit of quantitation (LOQ)
Reviewers also compare the measured CBD content with the amount on your label. A large gap between labeled and measured potency suggests weak quality control. Unhappy customers can also turn that gap into "didn't work" chargebacks on CBD orders.
Contaminant Testing
Some underwriters accept a potency-only report for a single product, but they treat a full-panel COA as stronger evidence. A full panel typically covers:
- Heavy metals
- Pesticides
- Residual solvents, which matter most for extracts and vapes
- Microbial contaminants
- Mycotoxins
Each line should show a pass or fail result, or a result alongside the action limit.
| COA Element | What Underwriters Check | Common Problem |
|---|---|---|
| Batch/lot number | Matches label and product page | COA batch differs from the batch in stock |
| Product name and type | Matches what you sell | Report covers a different product or strength |
| Test date | Recent, and after the batch was made | Report is older than the product |
| THC results | Delta-9, THCA and total THC listed | Only delta-9 shown, with no THCA |
| Lab details | Independent, accredited lab | In-house or unaccredited testing |
| Contaminants | Full panel with passing results | Potency-only report, or failed lines |
Delta-9 THC Dry Weight vs. Total THC Testing for Hemp
Underwriters often read the THC section first, and merchants often misread it.
Delta-9 THC dry weight is the delta-9 THC concentration expressed as a percentage of the sample's weight after moisture is accounted for. Federal law has historically defined hemp by this measurement. Total THC also counts the THC that THCA will produce when heated, such as by smoking, vaping or baking.
Federal hemp law has been changing, and state limits differ. Our article on what the federal hemp THC ban means for your merchant account covers the processing side. Confirm the limits that currently apply to your products with counsel before you rely on any number.
How the Total THC Math Works
THCA turns into delta-9 THC when heated, and it loses part of its molecular weight in the process. Labs commonly use this formula:
Total THC = delta-9 THC + (0.877 × THCA)
Illustrative example: a hemp flower sample shows delta-9 THC at 0.2% and THCA at 10%.
- 0.877 × 10% = 8.77%
- 0.2% + 8.77% = 8.97% total THC
On delta-9 alone, that flower looks low. On total THC, it does not. Underwriters know this math, and many run it themselves. If your COA lists THCA but no total THC line, expect the reviewer to calculate it. Most acquirers treat a smokable hemp product that depends on low delta-9 and high THCA as a red flag.
Why Edibles and Tinctures Need Extra Attention
In a heavy product, a small percentage by weight can still mean a meaningful amount of THC per serving.
Illustrative example: a 5-gram gummy contains 10 mg of delta-9 THC.
- 10 mg ÷ 5,000 mg = 0.2% by weight
The percentage is low, but each gummy still contains 10 mg of THC. Reviewers may look at milligrams per serving and per package, not just the percentage. Make sure your COA reports results in mg per serving or mg per unit alongside the percentage.
Delta-8 and other intoxicating hemp-derived cannabinoids draw extra scrutiny. Some processors restrict them or decline them outright. Legality also varies by state, which affects where you can ship. See how to block banned states at checkout.
Matching Batch Numbers, Labels, and Your Website
A valid COA can still fail review if the reviewer cannot connect it to the product being sold. Underwriters check that the details agree in three places:
- The COA: batch number, product name, strength and product type
- The physical label: the same batch number, the same strength and a working COA link or QR code
- The product page or POS listing: the same product name, the same strength and a link to the current COA
These mismatches cause problems:
- The website links to last year's COA after several new batches have shipped.
- One COA is used for every flavor or strength in a product line.
- A white-label product's COA names the manufacturer's product, with no batch link to your branded version.
- The label rounds the potency up well beyond the measured result.
If you buy white-label products, ask your manufacturer for batch-specific COAs showing the batch number that is printed on your label. The underwriter needs a clear chain from the lab result to the product in your customer's hands.
Your product page copy matters too. A clean COA will not offset website claims that get CBD merchant accounts shut down, such as disease or treatment claims.
Getting the COA QR Code on Your Label Right
Underwriters often look for a COA QR code on the label, and the code only helps if it works. Before you print:
- Point the code to the specific batch report, not your homepage or a general "lab results" page.
- Link to the lab's hosted report or verification portal when the lab offers one. Lab-hosted reports are harder to dispute.
- If you host the PDF yourself, use a stable URL that will not break when you redesign your site.
- Test the code by scanning a printed proof with more than one phone.
- Keep the link live as long as that batch could still be on shelves or in customers' homes.
For in-person sales, staff should be able to scan the QR code at the counter and show a customer the results. For online sales, link the same report from the product page.
Third-Party ISO 17025 Labs and Red-Flag Reports
Underwriters want testing from an independent, third-party lab, and they look for ISO/IEC 17025 accreditation, the international standard for testing and calibration laboratories. Accreditation alone is not enough. Check that the lab's scope of accreditation includes the cannabinoid and contaminant methods on your report. Some states and testing programs require additional lab registrations or licenses, so confirm what applies to your products.
These red flags make underwriters slow down or decline:
- In-house or manufacturer-run testing presented as independent
- Reports that cannot be verified on the lab's website or by contacting the lab
- Visible editing, such as mismatched fonts, misaligned numbers or missing pages
- A test date earlier than the batch production date
- A client name with no connection to your business or supplier
- Unusually high LOQs, which can hide THC behind a "not detected" or "<LOQ" result
- Failed contaminant lines, or THC results above the applicable limit
Never alter a COA, reuse one for a different batch, or relabel a report. Underwriters compare documents with lab portals, and falsified records can lead to account termination. They can also lead to placement on industry databases that make future processing very difficult.
If a result surprises you, retest through the lab and fix the product or the label. Do not change the paperwork.
Keeping COAs Current for Processor Audits
Approval is only the start. Acquirers may ask for COAs on randomly chosen SKUs, review your site for new products, or request updated reports when batches change. An organized system lets you answer an audit quickly.
Build a COA library with these fields for every SKU:
| Field | Why It Matters |
|---|---|
| SKU and product name | Ties the report to your catalog and POS |
| Batch/lot number | Matches labels and inventory |
| Lab name and report ID | Allows verification |
| Test date and report date | Shows the report is current |
| Total THC and delta-9 results | Lets you spot issues before a reviewer does |
| COA URL or QR destination | Confirms links still work |
| Date added to website or POS | Shows the documentation came before the sale |
These habits hold up in audits:
- No COA, no listing. Do not publish a product online or ring it up in-store until its batch COA is in the library.
- Tell your processor before launching new product types, especially new cannabinoids or smokable products. Check your merchant agreement for notice requirements.
- Review quarterly. Check links, retire reports for sold-out batches and confirm that current inventory matches the reports on your site.
- Answer document requests quickly. Slow responses during a review can lead to longer holds.
Weak documentation can also affect your reserve terms and pricing. See how rolling reserves work and how to lower them and our breakdown of CBD processing rates, reserves and hidden costs. If an account has already been closed, getting held funds back after a CBD account closure walks through the next steps. If you sell on autoship, see our guide to billing CBD subscriptions without getting shut down.
Next Steps for Hemp Merchants
Before you apply, or before your next review:
- Get a batch-specific, third-party COA for every SKU you sell.
- Check delta-9 THC, THCA and total THC on each report, and confirm the applicable limits with counsel.
- Match batch numbers across COAs, labels, product pages and POS listings.
- Scan every QR code and fix any broken or generic links.
- Build a COA library and schedule quarterly reviews.
MannyPay offers high-risk merchant accounts, including accounts for hemp and CBD sellers. Underwriting decisions depend on your business and documents. To discuss your situation, request a free processing quote, and a MannyPay specialist will respond within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
