The first things on the minds of most first-time business owners are lease costs, stock costs, and customers. However, a vape retail shop owner has to think about all of these, and a federal regulatory agency, a second federal regulatory agency, a state board of business licensing, a state revenue agency, and several rules imposed by card networks. The product on your shop’s shelf can be legal to sell, yet heavily restricted.
This contradiction is the story of the regulatory environment of this industry. Get the rules of the game wrong, and the shop won’t just incur a regulatory penalty. The shop will be cut off from all shipping services, lose its payment processing service, and in some instances, will be forced to stop selling its most popular product.
The rules are strict, for sure, but they can be learned. Thousands of vape shops are fully legally operating because the owners of the shops fully understood the importance of regulatory compliance from the start.
This guide walks through compliance regulations for vape shops from start to finish. You will gain an understanding of why the retail vape business is one of the most heavily regulated businesses in the country, how to go about setting up a vape business and establishing all the necessary state and federal licenses, what the PACT Act mandates of anyone who engages in shipping, why the FDA has made the bulk of the products in the vape market illegal to sell, what the mail ban has meant for shipping vapes and related products, what age verification truly means in practice, the variance of state taxation, and the uniqueness of payment processing that is required from day one.
Figure 1. A vape shop answers to five layers of rules at once, from federal product law down to the card networks.
A coffee shop has to concern itself with health codes. A clothing shop has to concern itself with sales tax. A vape shop has to concern itself with a huge stack of overlapping authorities, most of which do not communicate with one another. The federal government, through the FDA, has jurisdiction over the product. A different federal agency, the ATF, has jurisdiction over how the product is packaged and shipped. Your state has jurisdiction over the sale and the tax. Your city may join in as well. The private card networks decide whether you can accept card payments for the product. No single authority oversees all of this.
This is what blindsides a lot of new, first-time owners. They open the shop thinking that they have done all the necessary paperwork, and only later do they find out, say, that one of the products that they stock has not been approved, or that they have unmet reporting obligations because the product has been shipped to another state. For the most part, these are not reckless mistakes. They are failures to see the whole structure when five authorities overlap. Seeing that structure is most of the challenge of legally operating a retail shop like this.
There is also a kind of risk that normal retail never sees. Here, in addition to monetary penalties, loss of compliance can mean loss of a shipping service, loss of the ability to process payments, or being placed on the list of entities that are in violation of federal law. Each of those can be fatal by itself. That is why the goal is to meet the highest standard of any of the authorities, rather than the lowest.
Vape-specific rules come after you have the basics for a business. After selecting a business structure, perhaps an LLC for the liability shield, and registering with the state, you will need an EIN from the federal government. You will also need a business license from your city or county and a sales tax permit for your business to operate. None of this is vape-specific; it is the foundation for any business. After the basic structure of the business is done, you may apply for permits specific to vaping.
The tobacco or vape retail dealer license is the main license for this industry. Most states have this requirement for selling vape products, and it is different from your standard business license. The name, price, and requirements differ greatly from state to state. Some states include vapes under an existing tobacco retail license. Some states have vapor products retail licenses, and some have a licensing requirement for each retail location. However, the rules are pretty straightforward. Without a state-issued license, you cannot sell vapor products to the public legally.
Don’t just stop at state licensing requirements. Many counties and cities have their own regulations. For example, New York City has its own electronic cigarette retail dealer license, and it has its own application and a maximum limit for the number of retail licenses. Since it is easy to overlook these local regulations, the best practice is to contact your state licensing authority as well as your local government office right before leasing any commercial property. You cannot use a location that is not zoned for the business. It is a costly mistake to discover this after you have already completed the construction for the business.
The Prevent All Cigarette Trafficking Act used to only apply to the shipping and interstate sales of traditional tobacco. Then Congress expanded the Act to cover electronic nicotine delivery systems (vapes) in 2021. This caused a dramatic change to the online vape business. Now, any company that sells vapes online and ships them across state lines, must register and comply with the same regulations and reporting requirements that apply to the shipping and sales of cigarettes across state lines. If a company intends to sell vapes online, the PACT Act will be the most relevant legislation to their business.
Figure 2. The PACT Act turns every interstate vape shipment into a chain of registration, verification, and monthly reporting duties.
To comply with the law, prior to your first shipment leaving your facility, you must first file Form 5070.1 to register with the ATF. You must also register with the tobacco tax administrators for the states to which you are shipping. If you do not complete these registrations before your first shipment, you violate federal law for unregistered shipping. Once you complete the registrations, you must report. By the tenth of each month, you report the prior month’s shipments to each state’s tax administrator. These reports must include the shipment’s recipient, a description of the shipment, and the shipment’s destination. This reporting allows states to collect their excise tax.
ATF is the key federal agency enforcing the provisions of the PACT Act, and they mean business. They manage the registration system. They receive the reports and have the ability to fine sellers. Those fines can get serious. The maximum fine for a first violation is $5,000. The maximum fine for subsequent violations is $10,000 or 2% of the prior year’s gross sales, whichever is greater. The agency also partners with the FDA in enforcing the Act to limit youth access. Do not think of the ATF as some far-away government agency. The ATF is an active regulatory agency, and the violation of its rules can be very costly.
This rule surprises nearly all new owners. Each e-cigarette and vaping product in the US requires permission from the FDA to be sold. Manufacturers must submit a premarket tobacco product application (PMTA) to receive this permission. With the submission, manufacturers must demonstrate that the product is appropriate for the protection of public health. If a product has not been authorized, it is not legally sellable. This regulation is applicable to each vaping device, e-liquid, and each e-liquid flavor. This means that a public health justification is required for each product. The threshold is high, and many products have never been able to meet this threshold.
Current numbers reveal that the FDA has only permitted about forty-five e-cigarette products to be sold. All of them are either tobacco or menthol. All sweet flavors, such as fruits, candies, or desserts, remain banned. However, contrary to the restrictions placed by the FDA, sweet flavors are the majority of the products in the market. As a result, the FDA considers the majority of the flavored products being sold as completely unauthorized and illegal.
All retailers face the challenge of these restrictions. If retailers decide to carry only legally authorized products, they would carry a very limited inventory of only tobacco and menthol products that customers may not want. If retailers decide to carry the highly sought-after flavored products, they run the risk of selling unauthorized products and could face repercussions from the FDA. Retailers face a challenge without a straightforward answer, leading some retailers to be lax about the restrictions. Retailers would be wise to know exactly which flavored products they carry, understand the risks of carrying them, and watch the FDA’s enforcement posture, which shifts over time.
If you wanted to build a vape business that operated as a nationwide mail-order business, the PACT Act made sure you would have to change your plans. A part of the 2021 amendments made it so that the United States Postal Service was required to prohibit the mailing of vaping products to consumers. The vape mail ban, as it is called in the industry, took the single cheapest and most convenient shipping method completely out of the game. For a small business that is relying on inexpensive fulfillment, this is one of the most disruptive regulations to deal with.
Figure 3. The 2021 mail ban closed every major consumer shipping channel for vapes at nearly the same time.
It isn’t only USPS that has shut its doors to vaping shipments. After USPS was closed off to sending vaping products, UPS, FedEx, and DHL soon followed. Around the same time as USPS’s ban, the major private shipping companies refused to accept shipments of vaping products due to the compliance burden. Closed off from the major shipping companies, online vendors have to use smaller niche shipping companies that have the required agreements and PACT Act compliance.
These smaller shipping companies charge more and have limited service. All of the shipments have to comply with the act, which includes requiring someone 21 or older to sign for the package upon delivery. The law was intended to make shipping vaping products slow, expensive, and limited, and it has accomplished exactly that.
The goal of these regulations is to keep vapes out of the hands of minors, and age verification makes that a daily responsibility. The federal minimum age to purchase any tobacco product is twenty-one. If a business sells tobacco products in a physical store, they must check a government-issued ID for every customer who appears to be under the age of twenty-seven, and staff must be trained to check ID in all cases. Selling tobacco products to a minor may result in fines and may be the reason the store loses its license. The game is all about consistency.
Selling your products online is a whole different ballgame. A website checkbox claiming a customer is 21 is not in compliance with the law. Online age verification mandates checking a customer’s ID at checkout against a trusted ID database or government ID, with the order time stamped. Then, according to the PACT Act, the shipment has to be given to a 21-year-old or older who then signs the delivery. Nothing can be left in a mailbox or at the delivery step. So age verification is done at both the order and the delivery. There’s no way to get around this if you want to sell your product and ship it to customers.
Although Federal rules set a baseline for many things, it is your state that decides how costly and constricting your business will be. Federal laws and state taxes on vaping products lack cohesion and make little sense from a national standpoint. As of early 2026, 34 states and the District of Columbia levy an excise tax, whereas 16 states levy no vaping taxes at all. Where you choose to do business will determine how much you will be taxed, and that will be reflected in your prices and your profit margin.
Figure 4. Vape taxes swing from nothing to nearly the product’s wholesale value, depending entirely on the state.
The tax structures vary greatly across the nation. Some states charge a tax based on the volume of liquid. Rhode Island charges a tax of $0.50 per milliliter of liquid. Some states charge a tax as a percentage of the wholesale price, which has much wider variation. Minnesota taxes at 95% of the wholesale price and Vermont at 92%, while California uses a combination of a wholesale price tax and a retail price tax. Some states have different tax rates for open and closed systems of devices. It is unsafe to assume anything about a state’s tax structure. Because of that, it is prudent to check the tax rates for each state before going to market based on the prices that you anticipate.
Along with new taxes, more states and some cities are restricting or completely banning the sale of flavored vaping products. These local flavor bans work independently of the FDA’s authorization gap. These bans, coupled with new taxes, will eliminate the majority of your intended market. The same product, with the same flavor, can be perfectly legal in one state and be completely illegal just a few miles across the border. These bans impact every region of the country, and instead of guessing your flavor and inventory options, check the specific bans before making any orders, and often.
Even if you have ATF registrations, cleared licenses and permits, and verified IDs, your business may still be unable to accept credit card transactions. Payment processors label vape and e-cigarette retail as a “high-risk” category, and that label is attached to your business as well. This is not an indictment of your business’s integrity. This is a label that card networks and banks cast on the entire industry, and it alters the payment acceptance terms. It is a misconception to think that this label will not have an effect on your business, because that is how the most compliant shops end up having their funds frozen.
Figure 5. Four industry-wide risk factors push vape shops into the high-risk category, and each one shapes your payment terms.
There are four main classification drivers. First, regulations aren’t static. Processors are wary of sudden exposure. Second, chargebacks from vapes are, on average, greater than the chargebacks from traditional retail. This directly impacts a processor’s standing with the card networks. Third, there are vape-related health issues that expose processors to even greater liability risk. Finally, the negative publicity vapes attract creates a greater reputational risk for all businesses involved (including the processor). All of this combined signals to a bank that there is a greater risk of a lost investment. For these reasons, a bank will either outright deny the account or price the risk in with higher costs and fees.
Being considered high-risk alters the financials of your everyday operations. Expect to see higher fees for each transaction, higher fees for your account each month, and a rolling reserve, which means your processor will keep a portion of each sale to cover possible chargebacks and release it back to you on a delayed schedule. The greater threat is more subtle.
Many vape owners tend to open a generic, cheap account, usually by glossing over what they actually sell, and this account tends to work, that is, until the processor finally catches on. The account is then frozen without any notice, the funds are held, and the business can be placed on the MATCH list (an industry blacklist). This makes it much harder for the business to open an account anywhere else. A sudden account shutdown can mean losing access to all of your funds.
Specialized Processors
The first step is a processor tailored to deliberately serve high-risk industries. A provider of specialized high-risk merchant services understands your unique business structure. Because of this, approval is not a gamble. These providers have the structures needed by your industry, including payment-compliant age verification, chargeback management systems, and an understanding of vape-related regulations.
While pricing is higher than that of mainstream processors, a solid contract that won’t disappear in the middle of the month is invaluable. Treat payment processing as the infrastructure that will be in place before you open, not something to be placed around the business later.
Opening a vape shop has its challenges, like any other business, but not because the workload is more intensive. It is more difficult because you need to meet the requirements of so many disparate agencies simultaneously, and each of them can put a stop to your business. The FDA controls which products can be legally sold. The ATF is in charge of regulating how you must register and control each shipment. Each state has the power to control the sale and impose a tax, which can be significant. The mail ban controls how goods can be sent. Each sale must comply with age verification. Lastly, the card networks decide whether you can conduct any business at the point of sale.
Successful business owners regard all of these requirements as the foundational challenges of their business rather than the ancillary challenges. They secure the necessary licenses and tax registrations before renting a place of business. They register with the ATF and comply with the requirement to report monthly if they send goods. They understand the FDA risks for each product they sell.
They implement age verification controls on their business and their web page. Lastly, they purposefully select a high-risk payment processor so the loss of payment processing capability for their business is not a surprise. None of these steps requires extraordinary effort, only determination and order. If a business owner accomplishes these steps in the order presented, the regulations that cause failure for the unprepared become the reason their own shop operates with confidence.
Form a legal entity, obtain an EIN, and get a general business license along with a sales tax permit and a tobacco or vapor retail license for your state. Then, manage the FDA rules for your products, register for the PACT Act if you will be shipping products, set up age verification, and establish high-risk payment processing.
In 2021, the PACT Act added vapes to its original law and made it a requirement for vendors shipping vapes to register with the ATF and each destination state, report sales each month, and adhere to the Act’s strict delivery regulations. The PACT Act also triggered the USPS ban on mailing consumer vapes.
Yes. Almost all states necessitate a tobacco or vapor retail license for the sale of e-cigarettes. Many cities further impose their own permits in addition to state requirements. This is in addition to the typical business license you must obtain.
Currently, only specialized carriers that have adapted to the PACT Act will ship consumer vapes. USPS, UPS, FedEx, and DHL no longer ship consumer vapes. Shipment of consumer vapes also requires age verification and an adult signature upon delivery.
Changing regulations, elevated chargeback rates, product liability, and concerns over legal exposure and reputation, as well as potential losses, prompt banks to consider the entire industry to be high-risk. This results in increased costs, a rolling reserve, and the necessity of a specialized merchant account.
