Card Networks Are on Notice: What Concerns About the ENDS Market Means for Payment Processors

Which E-Cigarettes Are Legal to Sell in the U.S.?

Under the Federal Food, Drug, and Cosmetic Act, any e-cigarette or vaping product introduced after February 15, 2007, needs premarket authorization from the FDA before it can be lawfully marketed. That authorization comes through the Premarket Tobacco Product Application (PMTA) pathway, and it’s a high bar. Manufacturers have to show, with clinical, toxicological, and behavioral data, that a product is “appropriate for the protection of the public health,” weighing its potential to move adult smokers off combustible cigarettes against the risk of hooking a new generation of teenagers.

Roughly 17,000 tobacco and nicotine products have received some form of authorization over the years. For e-cigarettes specifically, the number is far smaller: Only a few dozen closed-system devices and pods, from a handful of manufacturers such as Logic, NJOY, Vuse, and Juul, have cleared the bar. Everything else, including the disposable flavored products that dominate convenience store counters and online marketplaces, is being sold without FDA authorization.

That’s a critical distinction for payments risk teams to internalize. A merchant selling a disposable vape isn’t operating in a gray area. In the vast majority of cases, they’re selling a product the FDA has never cleared for sale at all.

What Does the PACT Act Require of ENDS Sellers?

The Prevent All Cigarette Trafficking (PACT) Act has governed remote cigarette sales since 2010, and a 2021 amendment extended its reach to vape products. The law effectively closes off the U.S. Postal Service as a shipping option for vapes, and major private carriers, including FedEx, UPS, and DHL, have voluntarily followed suit, cutting off most remaining direct-to-consumer shipping routes for noncompliant sellers.

For merchants that do qualify to ship, the PACT Act sets out real obligations: Register as a remote seller with the ATF, file monthly tax reports with state authorities, collect all applicable excise taxes, verify buyer age against a database at the point of sale, and confirm age again with an adult signature at delivery. Packages have to be labeled to disclose that they contain a vapor product.

The ATF also maintains a noncompliance list and shares it not just with government agencies but with carriers and payment companies, specifically so those companies can identify and cut off noncompliant sellers. That list offers a signal that regulators expect the payments industry to play an active role in enforcement, not a passive one.

What Is the State AG Letter Actually Asking Card Networks to Do?

The April 2026 letter, led by Iowa Attorney General Brenna Bird and joined by attorneys general from 12 other states, asks Visa, Mastercard, American Express, and Discover to identify and remove merchants selling illicit e-cigarettes from their networks. It leans on a specific legal argument: selling unauthorized ENDS products already violates card network rules on illegal transactions, prohibited merchant categories, and brand protection, which means the networks already have the contractual authority to act. The letter argues that once a payment platform is on notice of illegal activity, it has an obligation to investigate and terminate the account.

The letter also draws a direct line to history. In 2005, state attorneys general worked with the ATF and payment card networks on a joint initiative to cut off illegal online cigarette sales. That effort helped shape the original PACT Act. The 2026 letter asks the networks to repeat that playbook for ENDS, and it comes with real teeth behind it: Field research cited in the letter found illicit disposable vapes available in roughly 28% of retail doors checked, and it links the illicit supply chain to money laundering networks and organized crime, not just noncompliant small retailers.

This is a coordinated ask from state law enforcement, not a single state flexing. Twelve attorneys general signing one letter to four networks is the kind of pressure that tends to produce a policy response, and payments companies should expect that response to show up in updated underwriting rules and monitoring requirements before the year is out.

How Do ENDS Create Risk for Banks, ISOs, and PSPs?

Once a payment provider is on notice of illegal vape sales in its portfolio, processing further transactions stops being a gray area and starts looking like knowing facilitation. That exposes acquirers, ISOs, and PSPs to card network fines, brand protection actions, state enforcement, and reputational fallout, on top of the underlying legal risk the merchant itself carries.

The risk is compounded by how this merchant category actually behaves. A merchant can look compliant during underwriting and then add unauthorized SKUs, switch suppliers, or open new sales channels without ever notifying its acquirer. Products get relisted under new names, new flavors get added between review cycles, and social media storefronts often carry a completely different catalog from the merchant’s main website. A one-time site review at onboarding does not hold up against a merchant base that changes this quickly.

How Should Payments Companies Screen ENDS Merchants?

A defensible ENDS compliance program should be able to answer a few questions for every merchant in the portfolio, and answer them on an ongoing basis, not just at onboarding:

• Does the merchant hold ATF registration and the required state-level licensing for remote sales?
• Are the specific products in its catalog, down to the SKU, actually on the FDA’s list of authorized e-cigarettes?
• Does the merchant properly verify buyer age at the point of sale and again at delivery?
• Is the merchant complying with PACT Act shipping, labeling, and tax reporting requirements?
• Has the merchant, its owners, or its suppliers appeared in FDA warning letters, ATF’s Non-Compliance List, or state AG enforcement actions?

Getting reliable answers means going beyond a website scan at signup. It requires ongoing merchant monitoring that can catch catalog changes, flag unauthorized products by name and packaging, and cross-reference merchants against the enforcement actions piling up from the FDA, the ATF, and now a growing coalition of state attorneys general.

Common Questions About ENDS Products

Is it illegal to sell most e-cigarettes in the United States?

Yes. Only a small number of e-cigarette products, largely closed-system devices from a handful of major manufacturers, currently hold FDA marketing authorization. The disposable, flavored products that make up most of the U.S. vape market do not have that authorization and are illegal to sell.

Can payment processors be held responsible for merchants selling illegal vapes? 

State attorneys general argue that once a payment network is on notice that a merchant is selling unauthorized ENDS products, it has an obligation under its own card network rules to investigate and terminate that merchant. Continued processing after notice increases legal and reputational exposure for the acquirer, ISO, or PSP involved.

What is the PACT Act and does it apply to online vape sales? 

The PACT Act is a federal law that restricts remote sales of cigarettes and, since a 2021 amendment, ENDS products. It requires remote sellers to register with the ATF, verify buyer age at sale and delivery, collect state taxes, and label shipments. USPS is barred from delivering vaping products, and most major private carriers have adopted similar restrictions.

How many e-cigarettes has the FDA authorized? 

As of the publishing of this post, only 45 e-cigarette products held FDA marketing authorization. That number changes as new applications are decided, so it needs to be checked against current FDA data rather than treated as fixed. However, even as authorizations increase, they remain a small fraction of the number of products being sold on the market today.

What should acquirers look for to flag a high-risk ENDS merchant? 

Warning signs include products that can’t be matched to the FDA’s current authorization list, age verification limited to a website pop-up, shipping that extends beyond what was disclosed at onboarding, sudden catalog changes, and any connection to prior FDA warning letters or state enforcement actions.

Learn Where the ENDS Market Is Headed

The vapes market isn’t waiting for regulators to catch up, and neither are state attorneys general. With 13 states now pressing card networks directly, and federal agencies continuing to seize unauthorized product by the millions of units, payments companies that haven’t built ENDS-specific screening into their underwriting and monitoring programs are exposed right now, not at some point down the road.

LegitScript has published a full report on the ENDS market, covering FDA authorization requirements, PACT Act obligations, and the merchant compliance practices that separate a defensible program from a liability. Download the full report to get ahead of the next letter.