CBD Shopify Payments Hold in Germany: What Merchants Need to Know

CBD Shopify Payments Hold in Germany: What Merchants Need to Know TL;DR: Germany sits in the EU CBD gray zone — CBD oils are technically classified as Novel Food and not authorized for ingestion, even though they’re sold openly. Shopify Payments treats German CBD stores as elevated risk, frequently freezing funds for 120 days or terminating accounts outright. Win the appeal by separating compliant SKUs (cosmetics, aroma) from food-style claims.

    Why CBD merchants in Germany get held
Germany is the largest EU market for CBD by revenue, and also the most regulatorily ambiguous. The European
Food Safety Authority placed CBD on the Novel Food list in 2019, which means CBD ingestibles need
authorization that, as of 2026, no producer has fully received. German authorities — particularly the
Bundesamt für Verbraucherschutz und Lebensmittelsicherheit (BVL) and state-level food safety offices —
have run targeted enforcement against CBD oil shops marketed as supplements.

Shopify Payments sees this risk and reacts. Common triggers for German CBD merchants:

      Product pages with German-language ingestion claims (“Tropfen unter die Zunge”, “tägliche Einnahme”)

      Health or wellness claims that veer into medical territory (“hilft bei Schlafproblemen”, “lindert Schmerzen”)
      THC content not clearly stated as below 0.2% (the legal German threshold for hemp products at retail)

      Lab reports (Certificates of Analysis) not visible on the product page
      A sudden volume spike — typical for newer CBD stores running paid traffic into Germany

When the risk team flags an account, you’ll typically see a 120-day hold on existing funds and either a payout
pause or a hard suspension going forward.

   Local regulatory context: BaFin, BVL, and the EU Novel Food file
CBD merchants in Germany operate under several overlapping regimes:

      BaFin (Bundesanstalt für Finanzdienstleistungsaufsicht) — supervises payment service providers
      operating in Germany. Shopify Payments is operated via Stripe Payments Europe (Ireland), passported into
      Germany. BaFin oversight is one reason Shopify’s risk team is conservative with German CBD accounts:
      payment processors don’t want regulatory questions about facilitating sales of unauthorized Novel Foods.
      BVL and state food authorities — enforce Novel Food classification. CBD cosmetics (creams, balms) sit
      outside Novel Food. CBD ingestibles do not.
      Betäubungsmittelgesetz (BtMG) — Germany’s Narcotics Act. Hemp-derived CBD with under 0.2% THC is
      exempt, but products positioned for human consumption can still be challenged.
      EU CBD Novel Food register — as of 2026, applications are pending but no CBD ingestible has received
      full Novel Food authorization. This is the core legal gray area.

For Shopify’s risk team, the practical question isn’t “is this legal in Germany?” — it’s “if there’s a chargeback,
regulatory complaint, or banking partner audit, can we defend continuing to process for this merchant?” In
Germany, the answer is fragile, and they respond by holding funds.

   Common patterns we see in German CBD holds

  TRIGGER                                WHAT SHOPIFY SEES                            HOW THEY RESPOND

  Ingestion language on PDPs             “Risk of regulatory enforcement”             120-day hold, payout pause

  THC % not displayed                    “Inability to verify legal compliance”       Account review, hold

  Health claims in German                “Medical device or food violation”           Suspension or termination

  Subscription model for CBD oil         “Recurring exposure to flagged SKU”          Reserve 20-30% or hold

  Volume spike from German paid          “Velocity anomaly”                           Temporary freeze
  traffic

The hold itself isn’t a verdict — it’s risk holding the line until you prove compliance. That’s also the lever for
getting it released.

   What documents to prepare

If you’re a German (or German-targeting) CBD merchant facing a Shopify Payments hold, gather the following
before responding to the risk team:

  1. Certificates of Analysis (CoA) for every SKU sold — third-party lab tests showing THC content, CBD
      content, contaminants. Linked to the actual product batches you ship.
  2. Supplier invoices showing the source of your hemp/CBD raw material and confirmation it’s EU-grown
      industrial hemp from the EU certified varieties list.
  3. Product page screenshots and a written copy audit — show that ingestion language has been removed
      (or never existed) and that products are sold as cosmetics, aroma products, or research-only where
      applicable.
  4. Compliance memo — a short document (1-2 pages) referencing the Novel Food classification, your THC
      %, and your positioning. Written calmly, not defensively.
  5. Customs documentation for any imports — showing legal entry into the EU.
  6. Bank statements and shipping logs for the past 90 days to demonstrate genuine fulfillment.
  7. Refund and chargeback data — keep chargeback rate documented at below 0.65% (the Visa Early
      Warning threshold).

EUR-denominated invoices and German-language product page screenshots matter — they signal to the
reviewer that your operation is locally compliant rather than a cross-border drop-shipper.

   How Unholdr handles this specifically
CBD in Germany is one of the categories where the generic “appeal Shopify in writing” playbook fails
repeatedly. The risk team has likely already decided you’re a “yellow” or “red” account before you write a word,
and a polite email doesn’t move that needle.

What works:

      Reaching the right reviewer at Shopify Risk Operations — not a frontline agent — and presenting the
      compliance memo, CoAs, and product page audit in one structured package
      Framing the brand as a cosmetics or wellness brand (where the SKUs justify that), not a supplement seller

      Pre-empting the THC question with documented CoAs from accredited labs (ISO 17025) rather than
      supplier-provided test sheets

    Need this resolved faster than 120 days? Unholdr is the only company built specifically for
    Shopify Payments holds and Klarna merchant bans. We’ve helped 200+ stores, win 95% of accepted
    cases, and resolve in 14–21 days. Fully refundable if we fail. We accept 10 clients per month — apply at

   Frequently asked questions

Can a German CBD store legally use Shopify Payments?

Yes, but with significant friction. Shopify’s terms don’t categorically prohibit CBD in Germany, but the risk
team’s underwriting is strict and many accounts end up held or suspended within the first 90-180 days.
Cosmetic-only catalogs face less risk than ingestible-positioned catalogs.

Does BaFin directly approve or block my Shopify Payments account?
No. BaFin supervises Shopify’s banking partner at the framework level, not individual accounts. But Shopify and
its partners self-regulate aggressively because they don’t want BaFin or BVL questions. That’s why German CBD
holds happen even when no formal complaint exists.

How long is a typical German CBD hold?
The standard hold matches the 120-day Visa/Mastercard chargeback window. Funds release to processing on
day 120, then 5-7 business days for the actual payout — so deposits land around day 125-135 if the account
isn’t terminated outright.

Can I just switch to a different processor?
You can try, but Shopify Payments runs on Stripe infrastructure, and Stripe Europe is generally aware of
merchants flagged by Shopify. High-risk CBD processors exist (e.g., specialized EU acquirers), but they typically
charge 3.5-5% per transaction versus Shopify Payments’ standard rate, and onboarding takes 4-8 weeks.

Will moving my entity from Germany to another EU country help?
Rarely. Shopify and Stripe look at the merchant of record, the directors, the bank account, and the customer
base. Restructuring is expensive and the underlying compliance question (Novel Food positioning) follows you.
Fixing the catalog and presentation is faster.