Is CBD Federally Legal? What the Farm Bill Actually Says

CBD is not simply federally legal or federally illegal, and anyone who gives you a one-word answer is selling something. Hemp-derived CBD sits inside a narrow carve-out created by the 2018 Farm Bill, which removed hemp from the federal drug schedule as long as the plant stays at or under 0.3 percent delta-9 THC on a dry weight basis (7 U.S.C. 1639o). That carve-out is real, but it is a carve-out from drug law only. The FDA never agreed that CBD belongs in food or supplements, and the definition of hemp itself changes on November 12, 2026. This post explains all three layers, and why none of them decide whether you can take a credit card.

Key takeaways

• The 2018 Farm Bill made hemp a separate legal category from marijuana, drawing the line at 0.3 percent delta-9 THC on a dry weight basis (7 U.S.C. 1639o). CBD inside that line is not a federally scheduled drug.
• It is a carve-out, not an approval. The FDA’s position is that adding CBD to food or marketing it in dietary supplements is unlawful, because CBD is an active ingredient in the approved drug Epidiolex (CRS, R46189).
• The definition changes on November 12, 2026, moving to total THC including THCA and excluding finished products over 0.4 milligrams of combined total THC per container (CRS, IF13136).
• Federal status is not what gets you approved. Processors price risk, not legality, and they read your lab reports rather than the headline.

Is CBD federally legal, in one honest answer?

Hemp-derived CBD is not a federally controlled substance, and that is the most that can be said cleanly. The 2018 Farm Bill defined hemp as “the plant Cannabis sativa L. and any part of that plant, including the seeds thereof and all derivatives, extracts, cannabinoids, isomers, acids, salts, and salts of isomers, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis” (7 U.S.C. 1639o). CBD extracted from a plant that meets that test falls outside the federal drug schedule.

What that sentence does not do is make CBD a normal consumer product. Removing something from drug law leaves every other federal law standing. Food law still applies. Labeling law still applies. State law still applies, and it varies. So a business can be entirely outside the drug schedule and still be crosswise with a different federal agency over the same bottle.

This site prices payment risk. It does not give legal advice, and the specific legal status of your specific product belongs with your own attorney. What we can tell you is how the pieces below get read by a bank, because that is the part that decides your cash flow.

What the 2018 Farm Bill actually changed

The Farm Bill did one clean thing, which was to split one plant into two legal categories using a number. Below 0.3 percent delta-9 THC on a dry weight basis, federal law calls it hemp. Above that line, federal law treats it as marijuana, which remains a controlled substance. Same species, same fields, two very different bodies of law, separated by a lab result.

That single number is why the hemp CBD industry exists at all. It let farmers grow the crop, let processors extract cannabinoids, and let brands ship products across state lines without those acts being federal drug crimes. The practical effect on the ground was enormous, and it happened fast.

It also created the ambiguity everyone is still living in. The Farm Bill is an agriculture law. It was written to legalize a crop, not to design a consumer market for cannabinoid products. So it said nothing about how much CBD is safe in a gummy, nothing about labeling accuracy, and nothing about who may sell what to whom. Congress opened a door and left the room, and other agencies had to decide what to do with the traffic.

Why the FDA still restricts CBD in food and supplements

Here is the layer most “CBD is legal now” articles skip entirely. The FDA’s stated position is that it is unlawful under federal food and drug law “to introduce food containing added CBD or THC into interstate commerce, or to market CBD or THC products as, or in, dietary supplements, regardless of whether the substances are hemp-derived” (CRS, R46189). Read that last clause again. Being hemp-derived does not resolve it.

The reasoning is technical but easy to follow. CBD is the active ingredient in Epidiolex, a drug the FDA approved in 2018. Federal law says an ingredient that was approved as a drug, or was studied as one in public clinical trials before being sold as a supplement, is excluded from being a dietary supplement ingredient (CRS, R46189). CBD hit that trigger. The drug approval that proved CBD works is the same event that blocked it from the supplement aisle.

The result is a market running on a contradiction. As CRS notes, CBD “continues to be widely marketed and sold in both food and dietary supplements in the United States” despite the agency’s position (CRS, R46189). Enforcement has been limited and targeted rather than sweeping. For a bank, though, that gap is the whole story. An entire product category sold at scale against a federal agency’s stated position is precisely the sort of thing a risk committee writes a blanket rule about, and it is why compliant operators get swept up with everyone else.

What changes on November 12, 2026

The federal definition of hemp is being rewritten, and the new version is significantly tighter. Under P.L. 119-37, effective 365 days after its November 12, 2025 enactment, hemp will be defined by “total tetrahydrocannabinols concentration (including tetrahydrocannabinolic acid) of not more than 0.3 percent on a dry weight basis” rather than by delta-9 THC alone (CRS, IF13136; 7 U.S.C. 1639o amendment notes). The date is November 12, 2026.

Three changes matter here. The first is the shift from delta-9 to total THC, which sweeps in THCA and the intoxicating variants like delta-8 that were built on the delta-9-only wording. The second is a hard product-level cap. Finished hemp-derived cannabinoid products containing more than 0.4 milligrams of combined total THC and other cannabinoids with similar effects per container fall outside the hemp definition entirely (CRS, IF13136). A container, in this context, is the innermost packaging that touches the product at retail. The third is an exclusion for cannabinoids the plant does not naturally produce, or that are synthesized outside it, which reaches the lab-converted products the delta-8 market was built on (CRS, IF13136).

That is a per-container limit, not a percentage, and it is small. Products that pass today’s dry-weight percentage test can land outside the definition under a milligrams-per-container test, because the two measure different things. Whether any given product clears it is a question for your lab and your counsel, not for a blog post. What is not in doubt is the direction of travel, and the date is on the calendar.

Why federal legality does not get you a merchant account

None of the above is what a processor is actually deciding. Payment access is a risk decision, not a legality vote, and this is the point that costs CBD operators the most time. You can be fully inside the Farm Bill, fully documented, and selling a product no agency has ever objected to, and still get an automated decline at signup, because the underwriting model scored the word CBD before a human read anything.

Risk teams look past the statute at things the statute never mentions. They weigh reputation risk, the FDA gap described above, your dispute history, and whether the definition shifting in November 2026 changes your product’s footing. Mainstream aggregators like Stripe, Square, and PayPal mostly resolve all of that by rejecting the category on sight. The harder version arrives after approval, when an aggregator boards the account, sees a pattern it dislikes, and imposes a rolling reserve or freezes the balance. That is money you already earned, held right when payroll is due.

It is also why a banking bill would not fix this on its own. The SAFE Banking Act speaks to whether banks can hold accounts for cannabis businesses. It does not rewrite the card networks’ private rules, and it does not touch the FDA question that hangs over ingestible CBD. Federal legal status and card acceptance are two separate locks on the same door.

What CBD businesses should do now

Stop arguing legality with underwriters, because that is not the conversation they are having. Bring evidence instead. A certificate of analysis, which is a lab report stating exactly what cannabinoids are in your product and at what levels, is what converts a claim about Farm Bill limits into a fact an underwriter can verify. Clean documentation of your product mix, your supply chain, and your labeling does more for an approval than any citation to the statute.

Then get ahead of the November 12, 2026 change rather than reacting to it. Have your products tested against total THC including THCA, not delta-9 alone, so you know where you stand before the definition moves. Talk to your own attorney about the 0.4 milligram per container exclusion and what it means for your specific formulations. An operator who can show a processor that they already understand the coming test reads as a much better risk than one who has not heard of it.

The rest is underwriting that reads your actual model instead of the category label. That is the purpose of cannabis and CBD merchant accounts built for this space, where hemp-derived CBD, ancillary, and B2B risk are scored separately rather than swept into one rejection. If a previous processor already dropped you and left a mark, there are still options after a MATCH or TMF listing, the industry databases that flag terminated merchants. The federal answer on CBD will stay complicated. Your documentation is the part you control.