CBD MCC Codes: 5499 vs. 5912 vs. 5993 and What Each One Triggers

Which CBD MCC code fits your store? Compare 5499, 5912 and 5993, the card network registration fees each can trigger, and how to fix a mismatch.

Marcus BennettPayments Risk & Compliance Analyst

October 31, 2026 · 8 min read

Gloved hand in purple nitrile glove inspecting a young cannabis plant in a grow facility

Photo: Pixabay

On this page 6 sections

What Your Code Tells Every Bank That Sees a Sale
How Processors Choose a CBD MCC Code
What Card Network Registration Costs an Online Hemp Store
Why a Lower-Risk-Looking Code Backfires
Delta 8 and THC Products Can Change Your Code, or Your Account
Checking Your Code Before an Underwriter Does

Key takeaways

If your online store is registered with Mastercard, Mastercard now charges your acquirer $1,000 a year, $0.02 per transaction and 0.10% of Mastercard volume. Registration covers vape or smoking products sold online under 5993 and online pharmacies under 5912. Most acquirers pass the cost on to you.
The fixed fee hits small stores hardest. In our illustrative example it costs 1.81% of $5,000 in monthly Mastercard sales but 0.56% of $20,000.
A lower-risk-looking code doesn't get you out of registration. Visa can charge an acquirer $25,000 for each merchant it recodes to avoid registering.
Adding Delta 8 or THC lines triggers re-underwriting. The federal total-THC standard and the 0.4 mg per-container cap take effect December 11, 2026.

Visa and Mastercard have no CBD MCC code. Their category lists contain nothing named for hemp, so your processor assigns the closest existing merchant category code during underwriting. That's usually 5499 (Miscellaneous Food Stores) or 5993 (Cigar Stores and Stands), and occasionally 5912 (Drug Stores, Pharmacies). The code matters most if you sell online. Some online activity under 5993 and 5912 falls into Visa and Mastercard registration programs, mainly vape and smoking products sold online and online pharmacy sales. Those programs now carry real annual and per-transaction costs.

What Your Code Tells Every Bank That Sees a Sale

An MCC is a four-digit label your acquiring bank attaches to your merchant account. You don't pick it. The acquirer sets it based on what you disclosed and what its reviewers found on your website. It then travels with every authorization request.

Issuers feed the code into their approval and fraud models, and some business and employer cards block whole categories outright. Banking apps also use it to label the charge for your customer, so a gummy order can show up as "tobacco" or "pharmacy" in someone's transaction history. That kind of mismatch often starts an "I don't recognize this" dispute. Our article on CBD chargebacks and unrecognized charges explains how to respond. The networks read the MCC too, to decide which monitoring and registration rules apply to your account. That's where the code starts to cost money.

How Processors Choose a CBD MCC Code

Acquirers don't always agree on the same store. Most of them look at where your revenue comes from and whether the card is present. The category names and registration programs below come from the networks. The "fits when" column is a general guide, not a network rule.

MCC	Official Category	Usually Fits When Most Revenue Comes From	Card-Absent Registration
5499	Miscellaneous Food Stores: Convenience Stores, Markets, Specialty Stores	Gummies, hemp drinks and other food-style products	Not among the registration codes listed for either program
5993	Cigar Stores and Stands	Hemp flower, pre-rolls and vapes	Mastercard registration for tobacco and vape sold online; Visa lists 5993 in Tier 3 of its integrity risk program
5912	Drug Stores, Pharmacies	Tinctures and topicals, at some acquirers	Visa Tier 1 for online pharmacies; Mastercard registration for online pharmacies
5999	Miscellaneous and Specialty Retail Stores	Mixed assortments with no dominant category	Not among the registration codes listed for either program

5499 Signals Consumables

A food-store code fits a wellness shop or café where ingestible products drive sales. It stops being accurate once a vape wall or flower case becomes your biggest category.

5993 Is the Honest Code for Smoke Shops

Processor references describe 5993 as covering tobacco and vaping products along with smoking accessories. If most of your customers buy hemp to smoke or vape, this is the code that matches what you actually sell. Expect age-verification questions about both the register and your online checkout. Shops with significant nicotine vape sales should also read our page on vape and e-cig payment processing.

5912 Is a Poor Match for Most CBD Brands

CBD merchants often misjudge this code. A tincture brand is not a pharmacy, and the pharmacy code brings pharmacy-level scrutiny. Mastercard's registration for 5912 and 5122 targets online pharmacies that mainly sell remote prescriptions. Visa puts online pharmacies in Tier 1, its highest-risk tier, where acquirers need separate Visa approval for each MCC. On a CBD site, a pharmacy code also means every health statement gets a much closer look. Before you accept 5912, read which CBD website claims get merchant accounts shut down.

What Card Network Registration Costs an Online Hemp Store

Two network programs matter here. Both are network rules that bind your acquirer. Both charge the acquirer fees, which it typically passes through to you, and your processor's own pricing sits on top and varies by provider.

Visa Integrity Risk Program (VIRP). Visa launched VIRP on May 1, 2023, replacing its older high-risk merchant program. Acquirers need Visa's approval before they sign merchants in covered categories, and they must register those merchants through Visa's High-Integrity Risk Registration system. Visa's registration fee rose from $500 to $950 on April 1, 2024. Processor summaries also describe Visa transaction fees for registered U.S. merchants of 0.10% of volume plus $0.10 per transaction. Some summaries say the Tier 3 tobacco listing is aimed at cross-border card-absent sales. Ask your acquirer directly whether your account is registered with Visa and which of these fees it passes to you.

Mastercard Specialty Merchant Registration. Mastercard requires registration for tobacco and vape products sold online under 5993, and for online pharmacies under 5912 and 5122. Processor summaries of Mastercard's late-2025 bulletin list three charges for U.S. merchants. The annual registration fee doubled from $500 to $1,000 on May 1, 2026. On June 3, 2026, Mastercard added a $0.02 per-transaction fee and a 0.10% fee on Mastercard sales volume.

Worked Example: Registration Fees at Two Store Sizes

These numbers are illustrative. Assume an online hemp store that sells mostly vapes, is coded 5993 and is registered with Mastercard. Its average ticket is $50, and the acquirer passes Mastercard's fees through at cost with no markup.

	Store A	Store B
Monthly Mastercard sales	$20,000	$5,000
Monthly Mastercard transactions	400	100
Volume fee (0.10%)	$20.00	$5.00
Transaction fee ($0.02 each)	$8.00	$2.00
Annual registration ($1,000 ÷ 12)	$83.33	$83.33
Monthly total	$111.33	$90.33
Yearly total	$1,336	$1,084
Share of Mastercard sales	0.56%	1.81%

At small volumes, the fixed annual fee is the biggest cost. Store B pays more than three times Store A's rate on its Mastercard sales. If the acquirer also passes through Visa's $950 registration fee, add roughly $79 a month for either store, plus any Visa transaction fees that apply. A small online seller should build this into its prices before launching a vape or flower line. It's also worth asking whether in-store and online sales can run on separate, fully disclosed merchant accounts, so that only the online volume sits on the registered account.

For the rest of the cost picture, see our breakdown of CBD credit card processing fees, rates and reserves.

Why a Lower-Risk-Looking Code Backfires

Some merchants, and some sales agents, treat registration fees as a reason to ask for 5499 on a store that mostly ships vapes. That doesn't work, because registration depends on what you sell and how you sell it. The code your account was opened under doesn't change that. Processor guidance on VIRP says Visa can charge an acquirer a $25,000 non-compliance assessment for each affected merchant if it changed a merchant's MCC or other data to avoid registration. With that much at stake, an acquirer acts quickly when a website review turns up a mismatch.

The account is then recoded with a new reserve, or it's terminated and funds are held to cover disputes. Deliberate miscoding can also put you on Mastercard's MATCH list, a database acquirers check during underwriting, which makes your next account much harder to open. Running hemp sales through another company's account is transaction laundering, and the networks actively look for it. If you've already been shut down, read about getting held funds back after a processor drops your CBD store and how a rolling reserve works and how to lower it.

An honest mismatch carries risk too. A code that fit when you sold only tinctures can become wrong after you add disposables. The acquirer has to act on what it finds whether you meant it or not.

Delta 8 and THC Products Can Change Your Code, or Your Account

Federal law on intoxicating hemp is changing. Section 781 of Public Law 119-37, enacted November 12, 2025, rewrote the federal definition of hemp. Once it takes effect, the THC limit will apply to total THC, including THCA, rather than delta-9 alone, at not more than 0.3% on a dry weight basis. The new definition also excludes final hemp-derived cannabinoid products that contain more than 0.4 milligrams of total THC per container.

Most of these changes were set to start November 12, 2026. On September 2, 2026, Congress passed a continuing resolution (Public Law 119-103) that pushed the total-THC standard and the per-container cap back to December 11, 2026. The exclusion of synthetic cannabinoids still takes effect November 12, 2026. State laws vary, and some are stricter than federal law, so confirm your obligations with a qualified attorney.

For your merchant account, the practical effect is re-underwriting. When you add Delta 8 or THC beverages, expect your processor to ask for updated product lists and lab results. It may reassign your code or reprice the account. Some processors will decline the new lines entirely. Tell your processor before those products go on sale. Our article on what the federal hemp THC ban means for your merchant account covers the account side in more depth.

Checking Your Code Before an Underwriter Does

Find the four digits. Your MCC appears on your monthly statement and in your merchant portal. If you can't find it, ask your processor in writing.
Pull your sales mix. Run a report of revenue by product category and by channel from your POS or e-commerce platform, then compare your top category with the table above.
Ask about registration. Find out whether your account is registered with Visa or Mastercard. If it is, ask for the dollar amount of each network fee passed through to you.
Have documents ready. A current catalog and certificates of analysis for your CBD products speed up any review. So does a checkout with age verification tools that pass review.
Request reclassification if the code is wrong. Expect re-underwriting and possible pricing changes. Truly separate businesses, such as a café next to a smoke shop, can have separate accounts with their own codes as long as both are fully disclosed and approved.
Repeat after every catalog change. New product lines and a move into online sales are the two triggers that matter most.

If the code on your statement doesn't match what's on your shelves, fix it now, before the December 11 federal hemp deadline. MannyPay offers high-risk merchant accounts and works with CBD and Delta 8 businesses on in-store and online sales. You can request a free processing quote, and a MannyPay specialist will respond within one business day. Approval and pricing depend on underwriting.

This article is general information, not legal or tax advice. Confirm your obligations with a qualified professional.

Sources

About the author

Marcus Bennett

Marcus Bennett is Payments Risk & Compliance Analyst for Beyond the Swipe, covering high-risk processing, chargebacks, rolling reserves, frozen merchant accounts and fraud prevention.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.