A convenience store owner in Ohio can lose card acceptance this quarter over a single product on a back shelf. That is the practical reach of the Mastercard ENDS policy in 2026. ENDS stands for electronic nicotine delivery systems, which covers vapes, e-cigarettes, pods, and refill cartridges. Card networks now treat those products as a payment risk, not only a health regulator’s problem.
This guide explains what the Mastercard ENDS policy requires, why it collided with new federal guidance in May 2026, what enforcement has cost merchants so far, and the steps that protect your ability to accept cards. We wrote it for store owners, online sellers, and sales agents who want plain answers.
One thing to settle up front. Nothing here is legal advice, and the policy is moving. Dates and sources appear throughout, so you can check the record yourself.
What the Mastercard ENDS Policy Actually Says
There is no standalone rulebook called “the ENDS policy.” The phrase describes how Mastercard applies its existing brand and risk rules to nicotine products. Two program layers do the work.
The rule underneath everything
Mastercard’s Business Risk Assessment and Mitigation program, known as BRAM, prohibits a merchant from submitting any illegal transaction, and prohibits an acquiring bank from accepting one. Mastercard’s published Anti-Piracy Policy describes BRAM in those terms and lists selling a product not in full compliance with applicable law as prohibited activity.
That single sentence is the hook. If a product cannot be sold lawfully, the transaction that pays for it becomes a network violation. Industry descriptions of the program frame its purpose the same way: limiting the network’s exposure to businesses that carry significant fraud, regulatory, or legal risk. The merchant sells the item. The acquirer answers for it.
The registration layer
Merchants whose primary business is nicotine sales sit inside Mastercard’s Specialty Merchant Registration Program, the same framework that covers adult content, gambling, cryptocurrency, and pharmacy. Compliance vendor Austreme, summarizing Mastercard’s 2020 bulletin AN4175, reported that acquirers must identify merchants selling ENDS, assign merchant category code 5993, and register tobacco merchants that run card-not-present transactions.
What Mastercard says it did in May 2026
In a letter to the National Association of Convenience Stores and three other trade groups dated July 27, 2026, and posted publicly by NACS, Mastercard described its May 2026 action this way: the update reminded acquirers to stay aware of FDA and other jurisdictions’ requirements on legal vaping and ENDS products, and to put strong controls in place.
Note the audience. Mastercard wrote to banks, not to stores. Merchants learned about it later, from processors and fuel brands.
Why the Mastercard ENDS Policy Arrived When It Did
On April 28, 2026, New York Attorney General Letitia James announced that she and 24 other attorneys general, including co-leads California and Pennsylvania, joined by New York City, had asked American Express, Capital One, Citi, Mastercard, Visa, PayPal, Stripe, Block, and Sezzle to block unlawful vape transactions. The coalition asked for meetings and urged the companies to keep merchants who break federal, state, or local law off their networks.
The AGs stated their reasoning plainly. In their view, stopping illegal e-cigarette sales takes joint effort between government and payment companies. Their argument rests on protecting public health, particularly youth, and on the gap between what federal and state regulations require and what reaches store shelves.
That was not the only April push. Iowa Attorney General Brenna Bird led a separate letter from 13 attorneys general on April 14, 2026, asking card companies for immediate assistance in stopping illicit e-cigarette sales. Trade press coverage of that letter reported that the attorneys general urged Visa, Mastercard, American Express, and Discover to find and remove merchants selling these products.
The same campaign had already worked elsewhere. New York’s letter to Mastercard notes that the states and New York City wrote to Shopify on November 24, 2025, about merchants selling e-cigarettes on that platform. California Attorney General Rob Bonta announced on June 23, 2026, that Shopify would ban all vaping product sales.
Industry estimates put the vape market at $9 billion or more in yearly sales, a figure NACS cited in its coverage. NACS went further in a letter dated April 14, 2026, to the Office of the U.S. Trade Representative. It said illicit e-cigarettes imported from China are hurting American retailers, cited estimates placing those products above 80 percent of the market, and asked the USTR to lead a coordinated federal response.
That last number reframes the whole dispute. If most of the category sits outside the authorized list, then a rule written around that list touches nearly every store, not a handful of bad actors. Regulators reached for the payment layer because it works fast. A store that cannot run cards stops selling, and nobody has to win a court case first.
The FDA Conflict at the Heart of the Dispute
Here is where merchants got caught between two standards.
The FDA lists 48 authorized e-cigarette products and states that those are the only e-cigarettes that may currently be sold lawfully in the United States. That list grew on May 5, 2026, when the agency authorized four Glas pods, its first authorization of non-tobacco and non-menthol ENDS products. It grew to 48 on August 28, 2026, when the FDA authorized three JUUL2 products.
Then, on May 8, 2026, the FDA issued final guidance titled “Enforcement Priorities for Certain New Tobacco Products Marketed Without Premarket Authorization.” The Federal Register notice was published May 12, 2026, under docket FDA-2026-D-5083. The agency said it lacks the resources to pursue every unauthorized product, so it now uses enforcement discretion for products that meet set criteria.
Which products the guidance covers
This is the part most coverage skips, and it determines your exposure. Based on the coalition letters dated July 21 and 22, 2026, and published by Energy Marketers of America, the FDA generally does not intend to prioritize enforcement against an ENDS product sold without premarket authorization when one of these applies:
- A premarket tobacco product application, or PMTA, submitted on or after November 4, 2021 covers the product and the FDA has accepted and filed it, or
- A supplemental PMTA covers the product and has been accepted and is pending for more than 180 days, and
- For products in flavors other than tobacco, the FDA has determined that the application includes the data it needs to judge whether the product protects public health.
Two exceptions cancel all of that:
- Products with features that presumptively appeal to minors. The guidance points to things like cartoon-style characters, disguising the product’s nature as a vaping product, or a design that resembles a children’s toy, a phone, or a gaming platform.
- Products that raise a public health or safety concern greater than what ENDS or nicotine pouch products generally present.
So, the test is not “is it on the list of 45.” The test is whether a filed application covers the product, whether the flavor triggers the extra data requirement, and whether the packaging looks aimed at kids. A store can hold two similar devices where one qualifies, and one does not.
Pull that criteria list into your product audit. It is the argument your provider needs to hear, and the standard trade groups asked networks to adopt.
Two standards, side by side
Retailers read the guidance as breathing room. Payment companies did not.
| FDA position after May 8, 2026 | Standard applied in network and processor notices | |
| Governing document | Enforcement Priorities guidance, May 8, 2026 | Applicable law plus network brand rules |
| Test applied to a product | Is a filed PMTA or aging sPMTA behind it, and does the flavor meet the data requirement | Does it appear on the 45-product authorized list |
| Products treated as acceptable | Most products responsible retailers stock, per the trade coalition | A short authorized list |
| Legal status of the rest | Still unauthorized, but a lower enforcement priority | Treated as noncompliant |
| Practical result for a store | Much of the shelf stays sellable | The same shelf can trigger a violation |
The coalition of NACS, the National Association of Tobacco Outlets, Energy Marketers of America, and the Convenience Distribution Association argued that the FDA’s May 2026 guidance covers most ENDS products sold by responsible retailers. Read against a 45-product list; that gap is the whole problem.
NACS made the legal argument directly. Premarket authorization is required under the Federal Food, Drug, and Cosmetic Act. Still, the FDA exercises discretion, so it is wrong to say every unapproved ENDS item currently faces agency action. Margaret Mannion, NACS director of government relations, said NACS hopes Mastercard will change its approach to match current federal guidance, so responsible retailers don’t have to answer to conflicting rules.
The coalition sent letters in July 2026 to both Mastercard and Global Payments and published them. The ask was specific. The groups want each company to state that products marketed in line with the FDA’s May 8, 2026 guidance, and sold in compliance with state and local law, may stay on shelves while the PMTA behind them awaits a final decision. They also asked that this language appear in all future communications on the subject.
That request is worth noting for a practical reason. The coalition is not asking for an exemption. It is asking the payment side to use the same test the regulator uses. On July 14, 2026, anti-tobacco advocacy groups, a pediatrician, and a parent filed suit in the U.S. District Court for the District of Maryland (case number 8:26-cv-02767), challenging the May 2026 guidance.
Timeline of the Mastercard ENDS Policy
| Date | What happened |
| Nov 24, 2025 | States and New York City write to Shopify about e-cigarette merchants |
| Apr 14, 2026 | Iowa-led letter from 13 state AGs asks Visa, Mastercard, American Express and Capital One for immediate assistance |
| Apr 14, 2026 | NACS writes to the U.S. Trade Representative on illicit imports from China |
| Apr 28, 2026 | NY AG announces 25-AG coalition asking payment companies to block unlawful vape sales |
| May 5, 2026 | FDA authorizes four Glas pods, reaching 45 authorized products |
| May 8, 2026 | FDA issues final enforcement priorities guidance |
| May 12, 2026 | Guidance publishes in the Federal Register, docket FDA-2026-D-5083 |
| May 2026 | Mastercard updates acquirers on legal vaping and ENDS requirements |
| Jun 17, 2026 | Valero notice warns of mid-six-figure fines for a single violation |
| Jun 23, 2026 | California AG announces Shopify will ban all vaping product sales |
| Jul 3, 2026 | Reuters reports Fiserv, BP, Marathon Petroleum and Valero warnings to merchants |
| Jul 14, 2026 | Lawsuit filed challenging the FDA guidance |
| Jul 2026 | Coalition letters go to Mastercard and Global Payments, asking both to match FDA guidance |
| Jul 27, 2026 | Mastercard tells NACS it will temporarily pause assessments |
What Enforcement Has Cost Merchants
Reuters reported on July 3, 2026, that Fiserv, through CardConnect, along with fuel retailers including BP, Marathon Petroleum, and Valero, warned merchants and partners against selling ENDS products lacking FDA marketing authorization. According to that report, BP told branded station operators that Mastercard had started issuing compliance notices tied to transactions involving illegal ENDS products. Valero’s June 17 notice warned that processors could impose six-figure fines for a single violation or cut off processing.
The trade coalition letters add detail the news reports left out. According to those letters, as summarized by CSP Daily News, both Mastercard and Global Payments had already warned retailers. The instruction was to pull any product missing from the 45-product authorized list, or face fines. So, merchants were hearing the same demand from two directions, a network and a large processor, and neither demand tracked the FDA guidance issued weeks earlier.
That matters how you respond. A notice from your processor is not automatically a network notice, and the two can rest on different standards. Ask which one you received.
Published estimates of BRAM assessment sizes vary. Compliance vendor Ballerine reported that BRAM penalties have historically reached $150,000 per violation. Monitoring firm LegitScript describes fines as high as six figures per transaction, and notes that acquirers using an approved monitoring partner can qualify for substantial mitigation.
Then came the pause. On July 27, 2026, Mastercard told NACS it had decided to temporarily pause any assessments, to give customers more time to carry out remediation plans and reach compliance.
A pause on assessments is not a change to the underlying rule, and Mastercard did not say the standard had moved.
The 2026 fee changes stacked on top
Registration costs moved in the same season. Multiple processor and industry sources, including summaries of Fiserv’s and PayPal’s spring 2026 release notes, reported the following changes to Mastercard’s Specialty Merchant Registration Program:
- The annual registration fee doubled from $500 to $1,000 per registered merchant, effective May 1, 2026.
- A new annual license fee of $50,000 applies to acquirers that want to keep registering specialty merchants.
- A per-transaction fee of $0.02 and a volume fee of 0.10% were set to take effect June 3, 2026, with first billing reported for June 14, 2026. At least one processor reports a July 24, 2026 effective date for tobacco and other non-crypto categories, so confirm the date with your provider.
Visa’s Integrity Risk Program carries its own, separate requirements.
What rising costs mean at the checkout line
Higher program fees push some owners toward passing costs along. Surcharging is legal in most of the country, and many retailers use it to recover part of what they pay to accept credit and debit cards. The idea is to price each payment method closer to what it actually costs you. It is worth understanding the limits first, because this is an area where small businesses trip over the details.
Three rules matter. Card brand standards cap what you may add, and a surcharge cannot exceed your actual cost of acceptance. State law still governs in some places, so your address changes the answer. And the credit and debit distinction is strict. The rules do not treat a debit card the same way they treat a credit card, and network rules prohibit applying a credit surcharge to a debit purchase.
Who Feels the Mastercard ENDS Policy Most
Convenience stores and fuel sites. The June and July 2026 warnings reached them through fuel brands and processors rather than Mastercard, leaving many owners reacting to secondhand information.
Online vape retailers. Card-not-present sales trigger registration requirements, and the PACT Act added ENDS to the definition of cigarettes, which pulls shipping rules into the picture. New York’s letter to Mastercard cited the PACT Act alongside state law.
Vape shops with mixed inventory. A store can sell authorized products and unauthorized ones from the same counter. The product mix decides your exposure, not the storefront sign.
Distributors and wholesalers. Trade group letters named wholesalers among the parties affected by the enforcement standard.
Two Other Mastercard Rules That Reach ENDS Sellers
The ENDS dispute did not arrive alone. Two separate Mastercard rules apply alongside it, and both catch online nicotine sellers. Neither one is part of the ENDS policy, so keep them straight, but plan for all three at once.
The 72-hour investigation clock
Effective July 24, 2026, Mastercard requires acquirers and payment facilitators to open an investigation within 72 hours when a merchant trips defined warning signals. If the review confirms scam activity, the acquirer must block that merchant from submitting Mastercard and Maestro transactions right away. Industry analysts describe the revised standard as part of a broader merchant trust effort announced May 19, 2026.
This rule targets fake storefronts and deceptive operators, not vape shops. The risk for a legitimate seller is pattern matching. Reported triggers include a sharp drop in authorization approval rate over a short window and a Mastercard GRIP investigation letter linking the account to suspected scam activity. Businesses with six months or less of history face tighter thresholds.
Auto-ship programs pull in a second set of rules
Plenty of e-liquid and pod sellers run auto-ship or subscription programs. Those fall under Mastercard’s negative option billing standards, and negative option billing merchants selling physical products fall into their own registration category within the same specialty program that already covers tobacco. So, one business can sit in two monitored categories at once.
Negative option billing means enrolling a customer in recurring charges without their clear agreement, usually by treating silence at the end of a trial as consent. Mastercard requires explicit consent instead, and the requirements are specific:
- Capture the cardholder’s acceptance at the point of payment. A link to a terms page does not count. The terms belong on the checkout page.
- Send an enrollment confirmation with the subscription terms and cancellation steps.
- For trials longer than seven days, send a reminder at least three and no more than seven days before the trial ends, telling the customer the plan continues unless they cancel.
- Send a receipt after each billing, including cancellation instructions.
- Let customers cancel online, even when they sign up in person or over the phone.
- Confirm cancellations in writing.
Physical product sellers carry an extra step. Reporting the standards indicates these merchants must obtain fresh consent when the trial ends, before billing at the regular rate. If you sell nicotine on a recurring plan, treat this as a separate compliance project from your ENDS product audit. The two share nothing except the account they can cost you.
A Practical Compliance Plan
Work through these in order. Each step should end with a document you can hand to someone who asks.
- Pull your product list. Every SKU, every brand, every flavor. Include anything behind the counter and anything in a display you rarely touch.
- Check each item against the FDA-authorized list. The agency maintains the list of authorized e-cigarette products on its website. Print the version you checked and date it.
- Record PMTA status separately, using the FDA’s own test. For each product not on the authorized list, write down three things: whether the FDA has accepted and filed a PMTA for it, whether a supplemental application has been accepted and is pending beyond 180 days, and whether the product comes in a flavor other than tobacco. Flag anything with cartoon art, toy-like styling, or other features that could read as aimed at minors, because those fall outside the guidance no matter what the application says. This is the standard trade groups asked the payment companies to adopt, so it is the strongest documentation you can hold.
- Ask your provider two specific questions. First, which standard applies to your account: the 45-product authorized list, or the May 2026 enforcement guidance. Second, whether any notice you receive comes from the network or from the processor, since those can rest on different tests. Get both answers in writing. Providers differ, and the answer changes what you have to pull.
- Confirm your merchant category code. Ask whether your merchant account is high-risk, carries MCC 5993, and whether you are registered under Mastercard’s specialty program. Guessing here costs money.
- Tighten age verification. Nicotine sales require it at the point of sale and online. Weak checks invite a separate line of trouble.
- Audit your web presence. List every domain, subdomain, and gated page tied to your business. Industry reporting on Mastercard’s monitoring program indicates that scans now cover members-only and password-protected areas, and that merchants onboarded on or after January 1, 2026 need a scan before their first transaction.
- Write down who decides. Name the person who reviews a compliance notice, the person who approves pulling a product, and the deadline. A named owner beats a general policy.
Pros and Cons of the Current Approach
| Strengths | Weaknesses |
| Cuts off revenue to genuinely illegal sellers faster than court action | Applies a stricter standard than the federal agency that regulates the products |
| Gives compliant merchants a defined path to keep card access | Reached merchants through processors and fuel brands, not directly |
| Pushes better records and age verification across the category | Penalty exposure can reach six figures for one violation |
| The pause shows the policy responds to industry input | A pause is not a rule change, so uncertainty continues |
What Agents and ISOs Should Do Differently
Every nicotine account in your book now carries a compliance conversation. Agents who handle this well do three things.
They ask about product mix before writing an application, not after. They tell the merchant, in writing, which standard the sponsoring bank applies. They place the account with a bank that has an appetite for the category rather than hoping one materializes.
We place accounts across several acquiring banks based on what each bank approves today. That matters in a category where two banks can look at the same store and reach opposite conclusions. We also partner with agents who need a home for accounts their current provider declined.
Protect Your Card Acceptance
The Mastercard ENDS policy turned a product decision into a payment decision. Know your inventory. Know which standard your provider applies. Keep dated records of both. Those three habits separate the stores that ride this out from the stores that lose acceptance.
If your provider cannot tell you which standard it applies to your ENDS inventory, treat that as a signal. Talk to a payment team that works in this category every day and can tell you where your account stands before a notice arrives.
Ready to find out where your business stands? Contact us for a straight answer on your classification, your registration status, and your options across several acquiring banks.
Frequently Asked Questions About the Mastercard ENDS Policy
What is the Mastercard ENDS policy?
The Mastercard ENDS policy is not a standalone rulebook. It describes how Mastercard applies its existing brand and risk rules to electronic nicotine delivery systems, meaning vapes, e-cigarettes, pods, and refill cartridges. The core rule sits in the Business Risk Assessment and Mitigation program, or BRAM, which prohibits merchants from submitting illegal transactions and prohibits acquiring banks from accepting them. In a letter dated July 27, 2026, Mastercard described its May 2026 action as a reminder to acquirers to stay aware of FDA and other requirements on legal vaping and ENDS products and to put strong controls in place.
Did Mastercard fine retailers over vape sales?
Reuters reported on July 3, 2026, that BP told branded station operators Mastercard had begun issuing compliance notices tied to transactions involving illegal ENDS products. Valero’s June 17, 2026 notice warned that processors could impose mid-six-figure fines for a single violation or cut off processing. The coalition’s July 2026 letter to Mastercard referred to fines already issued to retailers.
Has Mastercard paused ENDS enforcement?
Mastercard told NACS on July 27, 2026, that it had decided to temporarily pause any assessments to give customers additional time to carry out remediation plans and reach compliance. That is a pause on penalties, not a stated change to the rule.
How many vape products can I legally sell?
The FDA lists 48 authorized e-cigarette products and states that those are the only e-cigarettes that may currently be sold lawfully in the United States. The list reached 45 on May 5, 2026, when the agency authorized four Glas pods, its first authorization of non-tobacco and non-menthol ENDS products, and reached 48 on August 28, 2026, with three JUUL2 products. Check the FDA’s authorized products page for the current list, since it can change.
Why does the Mastercard ENDS policy conflict with FDA guidance?
The FDA’s May 8, 2026 guidance says the agency generally does not intend to prioritize enforcement against certain unauthorized ENDS products that have an accepted and filed premarket application. Network notices reported in June and July 2026 applied a stricter test based on the 45-product authorized list. NACS argued that because the FDA exercises enforcement discretion, it is not correct to treat every unapproved ENDS item as currently subject to FDA action. A merchant can therefore sell a product the FDA is not pursuing and still receive a network compliance notice.
Which vape products qualify under the FDA’s May 2026 guidance?
Per the coalition letters dated July 21 and 22, 2026, the FDA generally does not intend to prioritize enforcement when a premarket tobacco product application submitted on or after November 4, 2021 covers the product and the agency has accepted and filed it, or when a supplemental application has been accepted and is pending for more than 180 days. For flavors other than tobacco, the FDA must also determine that the application includes the data it needs to judge whether the product protects public health. Two exceptions apply regardless: products with features that presumptively appeal to minors, such as cartoon characters or designs resembling children’s toys, and products raising a public health or safety concern greater than what ENDS or nicotine pouch products generally present.
Is Global Payments enforcing the same ENDS standard as Mastercard?
Trade coalition letters reported by CSP Daily News said both Mastercard and Global Payments had sent warnings telling retailers to remove products missing from the FDA’s 45-product authorized list or face fines. The coalition wrote to both companies asking each to align with the FDA’s May 2026 guidance.
Does the May 2026 FDA guidance make unauthorized vapes legal?
No. Law firm analyses published in May 2026 emphasized that the guidance does not legalize unauthorized ENDS or nicotine pouch products. It sets out how the FDA intends to allocate enforcement resources while applications are pending. Products without authorization remain unauthorized under the Federal Food, Drug, and Cosmetic Act.
What does the Mastercard ENDS policy cost merchants in fees?
Separate from any penalty, nicotine merchants sit in Mastercard’s Specialty Merchant Registration Program. Industry and processor sources reported that the annual registration fee doubled from $500 to $1,000 per registered merchant effective May 1, 2026, that a $0.02 per-transaction fee and a 0.10% volume fee took effect in June or July 2026, depending on category, and that acquirers now carry a $50,000 annual license fee to keep registering specialty merchants. Merchants do not pay the license fee directly. Ask your provider how these changes appear in your pricing.
Which merchant category code applies to vape and ENDS merchants?
Compliance vendor Austreme, summarizing Mastercard’s 2020 bulletin AN4175, reported that acquirers must identify merchants whose primary business is ENDS sales, assign merchant category code 5993, and register tobacco merchants running card-not-present transactions. Ask your provider to confirm the code on your account rather than assuming. Misclassification affects registration, monitoring, and pricing.
I sell vape products on auto-ship. What extra rules apply?
Recurring nicotine sales fall under Mastercard’s negative option billing standards, and negative option billing merchants selling physical products fall into a separate registration category within the same specialty program that covers tobacco, so one business can sit in two monitored categories. You need explicit consent captured on the checkout page rather than a link to a terms page, an enrollment confirmation with cancellation steps, a reminder three to seven days before any trial longer than seven days ends, a receipt with cancellation instructions after each billing, online cancellation even for customers who signed up over the phone, and written confirmation when someone cancels. Reporting the standards indicates physical product sellers must also get fresh consent when a trial ends before billing at the regular rate.
Can I add a surcharge to cover higher card costs?
Surcharging is legal in most of the country, and many retailers use it to recover part of what they pay to accept credit and debit cards. Three limits apply. Card brand standards cap the amount, and a surcharge cannot exceed your actual cost of acceptance. Some states regulate the practice, so your location matters. And the credit and debit distinction is strict, since network rules prohibit applying a credit surcharge to a debit purchase. Ask your provider what your merchant agreement permits and how your terminal separates the two before you post a sign.
Does the Mastercard ENDS policy apply to in-store sales or only online?
Both, though the requirements differ. Registration obligations reported under AN4175 focus on card-not-present tobacco merchants. The 2026 enforcement notices reached brick-and-mortar convenience stores and fuel sites, which shows that in-store product mix carries exposure too.
Can I lose my merchant account over an ENDS violation?
Yes. Valero’s June 2026 notice warned that processors could revoke card processing services. Under BRAM, acquirers may be required to end a merchant relationship when prohibited activity is confirmed, and terminated merchants can be reported to the MATCH system, which makes finding a new account harder for several years.
What should I do if I receive an ENDS compliance notice?
Contact your payment provider on the same day and ask three questions: which products triggered the notice, which standard the bank applied, and what the remediation deadline is. Then document what you pulled and when.
Are other card networks and processors doing the same thing?
The April 2026 state AG coalition wrote to American Express, Capital One, Citi, Mastercard, Visa, PayPal, Stripe, Block, and Sezzle. Reuters reported that Fiserv, through CardConnect, warned partners that vape sales must comply with applicable law. Shopify announced it would ban all vaping product sales in June 2026.
How do I keep card acceptance while the policy is unsettled?
Audit your product list against the FDA-authorized list, record PMTA status for anything not on it, confirm your merchant category code and registration status, tighten age verification, and get your provider’s applied standard in writing. Date every record. Those steps are useful under either outcome of the current dispute.
