If you sell vapes online, three layers of law sit on top of every order: the federal PACT Act, FDA product rules, and a patchwork of state requirements. Miss one and the consequences can reach well past a fine, all the way to your merchant account.
This is a 2026 snapshot of what each layer requires and how processors use it to judge your business. Rules change often, so verify current requirements before relying on any single source.
How the PACT Act came to cover vapes
The Prevent All Cigarette Trafficking (PACT) Act was written for cigarettes and smokeless tobacco. In December 2020, Congress passed the Preventing Online Sales of E-Cigarettes to Children Act, which extended the PACT Act to electronic nicotine delivery systems (ENDS) starting in 2021.
The definition is broad. It covers devices, e-liquids, components, and accessories, whether or not they contain nicotine. If you sell, transfer, or ship these products for profit across state lines, the PACT Act applies to you.
Registration and monthly reporting
Before making interstate delivery sales, you must register with the ATF and with the tax administrator of each state you ship into. Registration isn't a one-time box to check. It creates a reporting duty.
- Monthly reports: By the 10th of each month, you report the prior month's shipments to each state's tax administrator. Reports include customer names and addresses, brands and quantities sold, and delivery service details.
- Recordkeeping: You keep delivery sale records until the end of the fourth full calendar year after the sale, available to the ATF, state tax officials, and state attorneys general.
Taxes are paid before the package ships
The PACT Act requires delivery sellers to comply with state and local tax laws as if they were located in the buyer's state. That means paying applicable excise taxes in advance and applying any required stamps before delivery.
Many states now tax vapor products, and rates and methods vary widely. Some tax by volume of liquid, others by percentage of price. Building this into your checkout is usually the hardest operational piece for small sellers.
The practical answer for most sellers is to limit shipping to states where you're registered and set up to remit tax, then expand one state at a time. Selling everywhere on day one creates a tax and reporting obligation in every one of those states, whether or not you've caught up to it.
Age verification happens twice
Federal law sets the minimum age for tobacco products, including e-cigarettes, at 21. The PACT Act adds specific verification steps for online sales.
- At the sale: Verify the buyer's full name, birth date, and residential address against commercially available databases.
- At delivery: Use a delivery method that requires an adult signature and checks the recipient's ID.
A checkbox that says "I am 21" doesn't meet either requirement. Strong verification also helps you against fraud, since many stolen-card orders fail identity checks. Our fraud screening tools work alongside a dedicated age verification provider.
Shipping: the USPS ban and the carrier problem
The 2020 amendment made ENDS generally nonmailable through the U.S. Postal Service. USPS finalized its rule on October 21, 2021. Exceptions are narrow: shipments within Alaska or Hawaii, certain business-to-business and regulatory shipments, limited noncommercial shipments by adults, and some government uses. Retail shipments to consumers aren't among them.
Major private carriers, including UPS, FedEx, and DHL, stopped delivering vapes to consumers in 2021. Online sellers now rely on specialized delivery services that can handle adult signature and ID checks.
Two more PACT rules apply to each shipment:
- Packages must carry a label identifying the contents as tobacco or nicotine products and stating that federal law requires payment of applicable taxes.
- Each delivery sale must weigh less than 10 pounds.
What PACT Act violations can cost
Violations can bring federal criminal penalties of up to three years in prison, plus civil penalties that scale with the number of violations or a percentage of gross sales. States can also bring their own enforcement actions.
For your processor, a violation is a direct risk to the bank. That's why PACT compliance comes up in underwriting before anything else for online vape sellers.
For an online vape seller, PACT compliance isn't paperwork on the side. It's the evidence your processor uses to decide whether your business is bankable.
The FDA layer: authorization comes first
Every e-cigarette sold in the U.S. needs FDA marketing authorization through the premarket tobacco application (PMTA) process. Selling unauthorized products violates the Federal Food, Drug, and Cosmetic Act, and the FDA has issued hundreds of warning letters to retailers, including online stores.
The FDA has authorized a limited set of products, mostly tobacco and menthol flavors. In April 2025, the Supreme Court unanimously upheld the FDA's denials of flavored e-cigarette applications in FDA v. Wages and White Lion Investments. Authorizations have continued since, such as JUUL2 tobacco and menthol pods in August 2026, but flavored disposables generally remain unauthorized.
Check the FDA's list of authorized products against your catalog. Processors increasingly do the same.
The state layer: flavors, registries, licenses, and taxes
State rules add the most variation, and they change every legislative session.
- Flavor restrictions: Massachusetts, New Jersey, New York, Rhode Island, and Utah restrict flavored e-cigarettes, each with different exceptions, and California bans the retail sale of most flavored tobacco products.
- PMTA directories: More than a dozen states now maintain product registries that list which vapor products can be sold there, usually tied to FDA authorization or a pending application. North Carolina's registry went live May 1, 2026, and Virginia's and Wisconsin's took effect July 1, 2026. Products missing from a directory can be seized.
- Licensing: Many states require retail or remote seller licenses for vapor products.
- Direct-to-consumer limits: Some states restrict or prohibit shipping vapor products directly to consumers.
How compliance shows up in your merchant account
Underwriters for vape accounts commonly ask for your ATF registration, state registrations, age verification provider, delivery method, and product list. During periodic reviews, they may check whether your site still ships to restricted states or sells products that aren't authorized.
When a processor finds a compliance gap after approval, outcomes range from a reserve increase to a frozen balance or termination. A termination for violating card network standards can also lead to a MATCH listing, which follows you to future applications. Our guide on how the MATCH list works explains why that matters.
Our page on payment processing for vape and e-cig sellers covers how we review these items and why they shape your terms.
PACT gaps that commonly surface in underwriting
Most online vape sellers aren't ignoring the PACT Act. They're partway through it. The gaps below are the ones that tend to come up when a processor reviews a file.
- Federal registration without state registration. Registering with the ATF is only half of it. Each state you ship to needs its own registration and monthly report.
- Reports filed late or not at all. A missed month is easy to fall into and hard to explain later.
- Age checks at checkout but not at the door. Database verification alone doesn't satisfy the delivery requirement.
- Carrier settings that don't match the law. A delivery service that offers adult signature only helps if every vape order actually uses it.
- Taxes collected for some states but not others. Excise rules differ widely, and sellers often miss states with smaller order volume.
- A catalog that drifted. New disposables added after approval may not be FDA authorized or listed in state directories.
Each of these is fixable, and fixing them before you apply is far easier than explaining them during a review. When an underwriter sees that you found and closed a gap on your own, it reads as control rather than risk.
A working PACT and vape compliance checklist
- Register with the ATF and each state tax administrator you ship to.
- File monthly reports by the 10th, and keep records for the required period.
- Collect and remit state and local excise taxes before shipping.
- Verify age at checkout with a database check and at delivery with adult signature and ID.
- Ship through a carrier that supports PACT requirements, never USPS for consumer orders.
- Label every package and keep each shipment under 10 pounds.
- Compare your catalog to the FDA authorized list and each state's PMTA directory.
- Block shipments to states with flavor bans or direct-to-consumer restrictions that apply to your products.
- Review state changes monthly and update your site the day a new rule takes effect.
This is general information, not legal advice. Talk with qualified counsel about your specific products and the states you serve.
Put your compliance work to use in underwriting
Every item on that checklist is something an underwriter wants to see. Sellers who can hand over registrations, reports, and a clean catalog tend to get better terms and fewer surprises later. Our vape seller underwriting is built to read exactly that file.
When your documentation is ready, apply with Karma Card Payments and we'll review it with you and set up an account that fits how you actually sell.