Cannabis Payment Risk Statistics 2026

FinCEN's 2014 guidance describes three marijuana-related Suspicious Activity Report filing categories: Marijuana Limited, Marijuana Priority, and Marijuana Termination [1]. Those categories organize federal reporting expectations; they do not count dispensaries with stable payment access. Cannabis Payment Risk Statistics 2026 therefore separates banking availability, transaction performance, fraud, cash exposure, tax handling, and reconciliation instead of manufacturing one national risk rate.

What the national data can and cannot answer

FinCEN tells covered institutions to file a marijuana-related SAR using the Limited, Priority, or Termination label according to the facts and the institution's assessment [1]. The filing framework reflects reporting behavior and financial relationships rather than a complete merchant census.

The guidance was issued in 2014 and should not be described as a 2026 measure of banking access [1]. It remains useful for understanding why SAR-derived figures and merchant-access figures are not interchangeable.

Federal Reserve payment studies cover huge volumes but do not isolate licensed cannabis merchants. The Federal Reserve’s fraud study analyzed 12.7 billion debit card payments and 2.8 billion general-purpose credit card payments in its 2021 data collection [2]. Those values provide payment-system context, not dispensary authorization or fraud benchmarks.

No source reviewed supplied a nationally representative dispensary-only series for authorization declines, reversals, chargebacks, cash variance, settlement delay, or account closure. Operators must calculate those measures from processor, bank, point-of-sale, cash, and ledger records.

Screenshot-ready payment risk table

“Eligible” must be defined before calculation. Test transactions, duplicate retries, outages, and customer cancellations can change the interpretation and should be reported as explicit categories rather than discarded after results are known.

Banking risk is not just account availability

A bank relationship can carry due-diligence, monitoring, reporting, and documentation requirements. FinCEN’s 2014 guidance describes marijuana-related SAR categories and continuing activity reporting within the federal Bank Secrecy Act framework [3]. It does not legalize cannabis under federal law or guarantee that an institution will serve a business.

Account continuity depends on truthful, current information. License status, beneficial ownership, locations, expected activity, deposits, tax records, and material changes should align across approved files. A discrepancy queue is useful, but only authorized management and advisers should determine disclosures.

Track bank notices separately from ordinary support tickets. A request for updated records, transaction-monitoring question, returned item, account restriction, and closure notice are different events with different consequences.

Do not infer the number of businesses banked from SAR filings. One institution can serve many businesses, one business can use multiple institutions, and FinCEN's guidance concerns reporting records [1].

Authorization, reversal, and settlement risk

Authorization is only a request outcome. Approval does not prove settlement, and a decline does not necessarily indicate fraud. Network rules, balance, issuer controls, terminal configuration, merchant classification, connectivity, and customer action can all affect the result.

Store the original processor response code and normalized reason separately. If the mapping changes, preserve the old code set and effective date so trend breaks remain visible.

A reversal attempts to release or cancel an authorization, while a refund is a later merchant-initiated return and a chargeback is a disputed-transaction process. Combining them into “failed payments” destroys both operational and financial meaning.

Settlement reconciliation should match processor batch, payment event, point-of-sale transaction, bank deposit, fees, adjustments, and ledger entry. Measure unmatched items by count and amount, but never publish an amount without its currency and period.

For administrative support around processor and ledger records, see our dispensary billing and accounting service. The sibling dispensary cybersecurity statistics page covers the account and device controls behind payment records.

Card data and payment security

PCI DSS version 4.0.1 is the current published revision in this review, released in June 2024 [4]. PCI scope and validation obligations depend on the card environment and participating payment brands; PCI compliance is not proof that every security risk is controlled.

Minimize stored card data and use approved payment architecture. Never place full payment credentials in customer-service notes, email, general cloud storage, or screenshots.

PCI’s standard includes requirements for protecting account data, strong access controls, logging, testing, and security policy [4]. Processor marketing language should not replace written confirmation of transaction type, merchant setup, settlement path, data responsibilities, and incident obligations.

Cannabis merchants face an additional description risk when a purported workaround mischaracterizes the transaction. Visa's public rules page directs participants to the Visa Rules and public rule documents that govern its payment system [5]. Operators should verify the actual transaction architecture and current contractual requirements rather than infer legality or network acceptance from terminal behavior.

Cash exposure and reconciliation

Federal tax law can make cash operationally important. The IRS states that income from marijuana businesses is taxable and explains cash-payment procedures, while Internal Revenue Code section 280E limits deductions or credits for businesses trafficking in controlled substances covered by the statute [6][7].

Cash volume is not itself an incident rate. Measure expected cash, counted cash, transfers, deposits, verified adjustments, and unresolved variance by shift or drawer under a documented process.

Use absolute variance for risk reporting. If one drawer is over and another is short, netting can conceal two exceptions. “Absolute variance rate” in the table is a local calculation, not a public benchmark.

Separate custody from record preparation where feasible. The person who counts or transfers cash should not be the only person able to alter the expected total and approve the difference.

Physical security, worker safety, insurance, and local rules affect the cash process. CISA’s guidance for small businesses recommends planning around physical and cyber risks, but it does not prescribe a cannabis-specific cash target [8].

Chargebacks and fraud data

A chargeback rate requires a network-defined numerator and denominator. Disputes received, disputes lost, fraud-coded disputes, and represented disputes are distinct. Use the processor’s contractual definition when comparing against its monitoring program.

The Federal Reserve found that fraud rates differ by payment type and authentication environment [2]. Because its study does not isolate cannabis merchants, copying its aggregate fraud rate into a dispensary dashboard would be a population error.

Keep order, authorization, fulfillment, customer communication, refund, and dispute evidence linked by stable identifiers. Restrict access because the evidence may contain customer and payment information.

Report dispute aging by contractual deadline, not an invented universal window. Networks and processors define evidence and response periods, and those rules can change.

Tax payments and record integrity

The IRS’s cannabis-industry page explains that all income is taxable regardless of source and points cash-intensive businesses to filing and payment resources [6]. Tax payment completion should be reconciled to the agency confirmation and bank or cash receipt, not inferred from an internal task status.

Keep tax calculations, approvals, submissions, and confirmations as separate evidence states. An administrative preparer can assemble records, but qualified owners should approve positions and filings.

Do not describe 280E as a payment-processing fee or card rule. It is a federal tax provision, and its application depends on facts and law [7].

For broader context on retail operations, the dispensary customer service benchmarks guide explains how payment exceptions should be measured without blending them into general resolution speed.

A local payment-risk scorecard

The recommended seven-measure local scorecard is authorization approval, retry duplication, reversal completion, settlement match, chargeback incidence, absolute cash variance, and unresolved bank notices. Seven is an editorial recommendation, not a sourced standard.

Publish channel, location, processor, period, currency, count, amount, denominator, exclusions, and data completeness. Suppress sensitive detail in management summaries while preserving controlled source records for authorized review.

Use event time and posting time separately. A payment can be authorized on one business date and settle on another, while a cash deposit can be delayed by holidays or transport.

Investigate changes before attributing cause. Processor routing, terminal releases, customer mix, outages, promotions, staffing, and code-mapping revisions can all coincide with a trend.

Methodology and limitations

This desk review uses 14 sources published or updated from 2014 through 2025 and verified on July 23, 2026. We prioritized FinCEN, the Federal Reserve, IRS, PCI SSC, payment-network, NIST, CISA, and Virginia primary materials.

FinCEN's guidance describes SAR reporting rather than merchant access [1]. Federal Reserve data covers broad US payments rather than cannabis merchants [2]. Neither source supports a national dispensary decline, chargeback, cash-loss, or settlement-failure rate.

The local formulas are labeled calculations. Results depend on complete processor exports, stable identifiers, code mappings, cash controls, and declared exclusions. This article does not provide legal, tax, banking, or accounting advice.

Frequently asked questions

Does FinCEN's guidance show how many businesses are banked?

No. The guidance describes marijuana-related SAR filing categories and due-diligence expectations [1]. It is not a census of banked businesses or a current merchant-access rate.

Is cashless ATM processing ordinary debit acceptance?

Do not assume that it is. Merchants should verify the actual transaction architecture against Visa's current rules and their contractual requirements [5].

What is a good dispensary chargeback rate?

No representative national dispensary benchmark was found. Use the processor or network definition, report the denominator and period, and separate fraud-coded disputes from other disputes.

Should declined retries be counted as new transactions?

Keep every attempt, but link retries to the original checkout so reports can show attempt-level and checkout-level approval. The choice of denominator must be declared as a local calculation.

Can a remote assistant reconcile payments?

An authorized assistant can match approved exports, flag exceptions, and maintain evidence. Bank changes, tax positions, write-offs, and regulated decisions should remain with accountable owners.

Sources

1. FinCEN, BSA Expectations Regarding Marijuana-Related Businesses, published February 14, 2014.
2. Federal Reserve, 2024 Federal Reserve Payments Study: Card Payments Fraud Data, published 2024.
3. FinCEN, BSA Expectations Regarding Marijuana-Related Businesses, published February 14, 2014.
4. PCI Security Standards Council, PCI DSS v4.0.1, published June 2024.
5. Visa, Visa Rules and Policy, accessed July 23, 2026.
6. IRS, Marijuana Industry, updated June 26, 2025.
7. US Code, 26 USC 280E, current through 2025.
8. CISA, Small and Medium Businesses, updated 2024.
9. NIST, Cybersecurity Framework 2.0, published February 26, 2024.
10. NIST, Digital Identity Guidelines SP 800-63B, updated March 2, 2020.
11. Federal Reserve, Payments Study, updated 2024.
12. FDIC, Risk Management Manual of Examination Policies, updated April 2025.
13. Virginia Cannabis Control Authority, Laws and Regulations, accessed July 23, 2026.
14. Virginia Administrative Code, Regulations Governing Pharmaceutical Processors, updated January 1, 2025.

Conclusion

Payment risk is measurable when bank, processor, point-of-sale, cash, tax, and ledger events remain distinct and reconcilable. For light administrative help organizing that evidence, book a free consultation call.