LegitScript has launched two new reporting updates to keep client portfolios safe from merchants offering unauthorized tobacco products and illegal sales to minors.
Keep reading to learn how we are helping payment processors navigate key aspects of the ENDS landscape, including pre-market authorization, age verification, merchant category codes, and more.
Then, request a copy of our new report on navigating the complex tobacco and vaping market.
August 13, 2026 | by Erin Feebeck
Tobacco: The Leading Cause of Preventable Deaths
According to the FDA, tobacco use is the largest source of preventable disease and death in the United States. There is no amount or type of tobacco that is safe to use, and that is especially true for minors. Those under the age of 21 are prohibited from purchasing tobacco products in the US. However, according to statistics on the FDA website pulled from SAMHSA, around 1,500 children try their first cigarette daily with about 200 of them becoming daily smokers.
The situation surrounding e-cigarettes is even more dire, with 5.9% of high school students smoking Electronic Nicotine Delivery Systems (ENDS) products. While some manufacturers and merchants market ENDS products as a safer alternative to traditional smokes, the FDA has found that no product containing tobacco is safe, with risks including lung injuries, seizures and neurological symptoms, and device hardware malfunctions such as overheating and fires.
Learn more by requesting our new report, Navigating the ENDS Market
Safety and Smokes: The Regulatory Landscape
Due to the safety risks associated with tobacco products, the United States government has strict regulations in place regarding which products are approved for sale, how products are shipped, and how merchants verify the age of their customers. The FDA requires all new tobacco products to receive pre-market authorization prior to being sold to ensure they adhere to strict quality and safety standards. A new tobacco product is defined as any product first marketed commercially after February 15, 2007, or that has undergone a significant change since that date. Because no ENDS product was commercially available prior to that date, all such products are required to have pre-market authorization to be sold legally.
Unauthorized ENDS products found in a merchant’s catalogue during analysis
In addition to authorization standards enforced by the FDA, the Prevent All Cigarette Trafficking (PACT) Act was passed by Congress in 2010 and amended in 2021. This act places strict regulations on packaging, shipping, and record keeping regarding the card-absent sale of tobacco products. It also strictly prohibits the sale of tobacco to anyone under the age of 21 in the US and requires specific age verification procedures to be in place. The PACT Act is rigorously enforced by the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF).
What Is New in Our Reporting?
As a part of the Visa Integrity Risk Program (VIRP), Visa requires payment processors with merchants shipping tobacco products within the United States to comply with all federal and state laws, including the PACT Act. Processors must also use age verification to ensure such products are only being sold to individuals age 21 or older. Disregarding these rules can result in heavy fines for merchant acquirers.
Here is how LegitScript approaches these critical updates to help clients stay compliant:
Pre-market Authorization
It’s important to know which ENDS products have pre-market authorization. While ENDS products lacking pre-market authorization have always carried heightened regulatory risk, recent card brand stances indicate these products may now carry increased risk for card brand violations.
Despite the numerous ENDS products sold in the United States, only five manufacturers currently offer products that have received pre-market authorization. These manufacturers are:
- Glas Inc.
- JUUL Labs Inc.
- Logic Technology Development LLC
- NJOY LLC
- R.J. Reynolds Vapor Company
Among these five manufacturers, only 45 products in total have received authorization to be sold within US markets. All other ENDS products sold in the United States are done so illegally.
Age Verification
In December of 2019, the federal minimum age for the sale of tobacco products in the US was raised from 18 to 21. It is illegal to sell any tobacco product to minors under the age of 21. For card-absent sales, an age verification check is the first line of defense in protecting minors from purchasing tobacco. Additionally, this process is required by Visa.
Due to strict government regulations and Visa requirements around age verification, LegitScript reports a lack of age verification on websites offering tobacco products as a higher risk. This helps payment processors to identify merchants that may not be in compliance with applicable laws before they become a financial and reputational risk.
Age verification disclaimer on ENDS merchant’s website
Merchant Category Codes and Terms and Conditions
LegitScript reports all merchants lacking the Merchant Category Code (MCC) of 5993, which is required by Visa for all ENDS merchants, as at risk of being in violation of BRAM and VIRP rules in every jurisdiction. MCCs help card brands ensure businesses with higher risk profiles and greater regulatory requirements remain in compliance with local laws. Such merchants may also be subject to higher processing fees due to risk mitigation requirements. Merchants with the improper MCC may be avoiding the fees necessary to conduct high-risk sales.
LegitScript recognizes that all tobacco products present risk regardless of whether they are sold legally. Since the sale of tobacco carries inherent risk to payment processors, LegitScript actively monitors client portfolios for these products, empowering customers to swiftly identify and action risky merchants.
LegitScript Can Help Guard Your Merchant Portfolio
For more information on how LegitScript can protect your payments business from risks like unauthorized tobacco sales, please contact us today to learn more about our Merchant Risk Solutions.
LegitScript has published a full report on the ENDS market, covering FDA authorization requirements, PACT Act obligations, and the merchant compliance practices that separate a defensible program from a liability. Download the full report to get ahead of the next letter.
Navigating the ENDS Market
This report examines the regulatory landscape shaping the ENDS market and what it means for the payment service providers.
