Most owners in regulated industries start with one question: can I sell this? It is the right first question and a risky last one. A product can be fully permitted while the way it is advertised, shipped, paid for, taxed, banked, made, or sold falls under a different set of rules, often enforced by a different agency. The better question is broader: can the entire transaction survive scrutiny?
Regulators look at transactions, not just products
A license answers whether a product may be on the market, not whether a particular sale was handled correctly. Each step of a sale has its own rules, its own records, and its own way of reaching your financial statements when something goes wrong: unsellable inventory, refunds, back taxes, a frozen merchant account. Two businesses selling the same lawful product can carry very different risk.
Follow one order through every layer
Take a hypothetical: an online retailer based outside California sells a $100 nicotine vape kit to an adult customer in California and ships it to the customer’s home. Here is what it touches, and how each layer reaches cannabis, hemp, and psychedelics businesses.
- Product approval or license. A new tobacco product, meaning one not on the U.S. market as of February 15, 2007, generally needs an FDA marketing order before it can be sold (FD&C Act §910). Cannabis needs a state license, psilocybin a state program such as Oregon’s, and hemp must meet the federal hemp definition (7 U.S.C. §1639o).
- Marketing and claims. A tobacco product cannot be sold with labeling or advertising that states or implies lower risk, or uses descriptors like “light” or “mild,” without an FDA modified risk order (FD&C Act §911). A hemp or CBD product marketed to treat or prevent a disease can be treated as a drug (FD&C Act §201(g)(1)). The product may be lawful while a sentence on the website is not.
- Shipping. A law enacted December 27, 2020 brought electronic nicotine delivery systems under the PACT Act, and they have been generally nonmailable through the U.S. Postal Service since October 21, 2021, with narrow exceptions (18 U.S.C. §1716E; 86 Fed. Reg. 58398). Sellers must register with ATF and the states they ship into, verify age, require an adult signature with photo ID at delivery, and pay state and local excise taxes before shipping (15 U.S.C. §§376, 376a). The definition reaches devices that deliver “nicotine, flavor, or any other substance” (15 U.S.C. §375(7)), so the Postal Service treats hemp vapes as nonmailable too. Apart from a separate chapter on interstate agreements, California’s cannabis law does not authorize licensees to move cannabis out of state (Bus. & Prof. Code §26080).
- Payment processing and banking. Processors and card networks set their own rules, which can be stricter than the law: a processor may refuse a category, hold a reserve, or close the account overnight. For cannabis, FinCEN’s 2014 guidance still frames what banks expect, including thorough due diligence and suspicious activity reports on marijuana-related customers (FIN-2014-G001). A business that receives more than $10,000 in cash in one transaction or related transactions must report it on Form 8300 (IRC §6050I). More in When the Bank Says No.
- Excise and sales tax. California’s electronic cigarette excise tax is 12.5 percent of the sales price. The purchaser owes it, the retailer collects it, and a sale shipped to a California address is presumed to be for California use (R&TC §31002). According to CDTFA, it is collected in addition to sales and use tax and is not itself subject to sales tax, so the hypothetical kit carries $12.50 of excise tax, with any sales or use tax figured on $100, not $112.50. CDTFA also expects an out-of-state seller to hold a California distributor license and tax accounts. Cannabis retailers collect their own excise tax, 15 percent of gross receipts since October 1, 2025 (AB 564, Stats. 2025, ch. 127; CDTFA). In the books, tax collected from customers is a liability until remitted, not revenue.
- Federal income tax. IRC §280E reaches only a trade or business that consists of trafficking in Schedule I or II controlled substances. Nicotine is not a controlled substance, and hemp that meets the federal definition is excluded from marijuana (21 U.S.C. §802(16)). As of this writing, adult-use cannabis and psilocybin remain in Schedule I, while cannabis under a state medical license moved to Schedule III in April 2026 (more on §280E after rescheduling). Congress also narrowed the federal hemp definition in November 2025 (Pub. L. 119-37, div. B, §781), and a product that stops qualifying as hemp may become a controlled substance, with §280E close behind (The Hemp Cliff).
- Manufacturing and recordkeeping. Each regime keeps its own records on its own clock. California cannabis licensees keep records, including financial and tax records, for at least seven years from creation (Cal. Code Regs., tit. 4, §15037). PACT Act delivery sellers keep sale records through the end of the fourth full calendar year after the sale (15 U.S.C. §376a(c)). For producers, state inventory counts and the general ledger need to agree, or cost of goods sold becomes a number no one can support.
- Where the customer is. Delivery sellers must follow the destination’s state and local laws as if the sale happened there (15 U.S.C. §376a(a)(3)). California generally bars retail sale of flavored tobacco products, including flavored e-cigarettes with or without nicotine and flavored hemp vapes, and online and delivery sellers must comply (Health & Safety Code §104559.5; R&TC §30101.7). If the hypothetical kit is flavored, the sale may not be lawful at all. Psilocybin flips the question: in Oregon, a client may access psilocybin only at a licensed service center during an administration session with a licensed facilitator present (Oregon Health Authority).
Run a transaction map on your top revenue stream
Pick your highest-revenue product line or channel. For each layer, write down the rule that applies, the person or document that shows you meet it, and what it would cost if that layer failed for 60 days.
- Product. What makes this exact item sellable, and who holds that license or authorization: you, your supplier, or the manufacturer?
- Claims. Where is the product described (label, website, listings, social posts), and has counsel reviewed it?
- Route. Does your carrier or delivery method accept this product for this destination?
- Payment. Do your processor’s and bank’s terms allow it, and what reserve or termination rights do they hold?
- Tax. Which excise, sales, and use taxes apply at each step, who collects them, and where do they sit in the books?
- Income tax. Does any activity involve a Schedule I or II substance, and which costs would §280E take off the table?
- Records. Who can ask for records, how long must each set be kept, and do regulatory counts tie to the ledger?
- Destination. Which states and localities do you sell into, and how much revenue depends on any one of them?
Then put dollars on it. As a hypothetical, a top stream that brings in $600,000 a year produces $50,000 a month. A 60-day processor hold or shipping stop puts roughly $100,000 of sales at risk, before refunds or the cost of stock you cannot move. The cash flow calculator can show what a gap like that does to your runway.
Where counsel ends and the numbers begin
Whether a claim, shipment, or sale is lawful is a legal question for your attorney or regulatory counsel. TreeStar does not give legal or regulatory advice. We bring the financial map: what each layer costs, where it lands in the books, and how much revenue and cash depend on it. The best transaction map puts both views on one page, which is how we approach regulated product businesses. Revisit yours whenever you add a product, channel, state, or processor, or a rule you rely on changes.
How TreeStar can help
The TreeStar team can help you put numbers on every layer of your business model: bookkeeping and inventory accounting that tie regulatory records to the ledger, tax preparation and tax planning (including §280E for cannabis), financial modeling and cash flow planning that test what happens if a layer fails, and regulatory accounting support alongside your counsel.
This article is general information, not advice for your situation. Rules change; confirm current law before acting.
