Hayden: Happy Wednesday, Jason. I'm excited to be back for another Wednesday recording session. You kind of jinxed us last week when you were talking about the beaches still being open and how you were excited about that, and now they're closed.

Jason: Yeah, I don't think anyone saw that coming, especially right before Cinco de Mayo. It was very lonely having margaritas and tacos in the office instead of on the beach.

Hayden: Right. Yeah, the beach getaway is no longer an option, so the office is kind of all we have. I guess that means I can expect everyone to work 80 hours a week now.

Jason: Yeah, I'm not going to be working 80 hours a week, Jason. I'm sorry.

Hayden: All right, well, let's jump into today's topics. First, we have the shift from the shelf. And no, we are not talking about toilet paper.

Jason: Next, API analysis: how failing to plan makes you plan to fail.

Hayden: And last, CBD compliance chaos with our industry experts Clint and Sarah from Khipu Technologies. Jason, it's no surprise people have been staying at home due to the virus scare that has affected everyone across the globe. And because of this, merchants across all verticals are shifting their business model to take advantage of the change in commerce and find new opportunities to sell their products.

Jason: Yeah, they absolutely are, Hayden. In fact, I have a friend who has an eco-friendly line of clothing that historically she relied entirely on boutiques to sell her products. And shortly after all of the retail locations were shut down, she called me and she was looking for advice on how to set up a website and sell her products online for the first time ever.

And it's created a huge transition to a card-not-present environment where businesses everywhere are looking for the quickest and fastest way to get their products online and take advantage of e-commerce opportunities. That's where the ISVs play a big role in this transition.

Hayden: Yeah, and this transition isn't only affecting the sale of products, but also the merchants that provide services that need to figure out a way to integrate these services into the homes of the consumers.

Jason: Yeah, I never expected to see my friends doing yoga classes online. I have a bunch of friends that are huge yoga fans and go to a studio two or three times a week. And now they're taking the classes online. I think it's very interesting to see how a lot of the health and wellness industry has converted their traditional studio memberships into online memberships.

Hayden: Yeah, Peloton, an at-home fitness company, just set a record for the most people streaming a single live class with 23,000 participants. The participation record came as the company's head instructor streamed from her home, which is also unusual for them, as this is the first time that Peloton has filmed a class outside of their studios. ISVs seem to play a critical role in solving the challenges of moving from a face-to-face environment to a more virtual environment.

Jason: Absolutely. If it weren't for the software and technology companies that are enabling these merchants, both product and service merchants, to reach consumers directly, I'm afraid a lot of them wouldn't be able to weather the storm. It's a huge opportunity for ISVs, both existing and new, to enable these merchants to get their products directly to consumers. We've worked with several ISVs on adapting their current card-present solution to also facilitate card-not-present transactions.

One of the biggest factors in how quickly they were able to get that done was the payment processing partners they were working with. But all in all, it's been really exciting to see the entire payment supply chain rally behind small businesses and help build new solutions that are allowing them to stay afloat and get their products to consumers in this time of chaos.

It's important to remember that there's more than just transaction processing that comes into play. When you pivot to card-not-present, your fraud profile changes. There's a whole different set of chargeback reasons that you have to deal with. It's important for the ISV to have a payments partner that really understands the profile of card-not-present transactions.

Hayden: Jason, I agree. And transitioning into our next topic, you said that the payment partner had a big impact on the timeline for the ISV to adapt. What are the differentiating factors?

Jason: Well, I think first and foremost, most ISVs are not payments experts. They're experts in a particular vertical that they're developing software for, and payments just happens to be a piece of it. I think the biggest component by far that differentiates timelines when it comes to selecting a payments partner is the capabilities of the API that the payments partner exposes and the certification process for integrating to that API.

I've seen the best of the best and the worst of the worst. Some payment processing companies have hundred-page API documents that aren't designed for the development community, but are designed for payments experts. Those are the types of partners that, when an ISV is trying to quickly get something done, are going to drastically bog down the process.

Hayden: Well, building on that, what exactly do you recommend ISVs look for when selecting the right payments partner?

Jason: There are a few things. Obviously, you're going to want a very simple-to-integrate API that exposes all functionality in a single API.

Lots of legacy platforms have multiple different versions of their APIs, some that support card-present, a completely different API for card-not-present, and it puts the ISV in the situation where if they fail to think far enough in advance about what other types of functionality they may need to expose in their platform, they'll select an API that isn't going to allow them to quickly pivot.

That's a scenario we've seen lots of ISVs fall into with the coronavirus pandemic. The features and functionality they need to support a card-not-present environment weren't readily available. I think the second piece is a self-certification process.

Anytime you're dealing with a certification or integration process where the payments partner on the other side is manually reviewing the data as opposed to an automated process, you could have days, if not weeks, of lag time in actually getting the certification done. And finally, you need a partner who has a willingness to teach, somebody that's going to collaborate with you, that has a thorough understanding of compliance and can help you avoid making mistakes.

You want somebody who ultimately makes you feel like they're your virtual payments department.

Hayden: All right, Jason. Speaking of compliance, we are super excited to have our first ever expert guests on Cents Chat to weigh in on processing payments for CBD.

Jason: Yeah, Hayden, definitely excited to have Sarah Thomas and Clint Lowry here from Khipu Technologies. They've been a vital part in working with some of the financial institutions that we've consulted for that wanted to accept payments for CBD. Super interesting landscape to navigate. Sarah, Clint, why don't you tell us a little bit about yourselves?

Sarah: Yeah, so I'll go first. My background is in what I really call the three Ps: project, program, and product management. I've had the great opportunity of working for a number of Fortune 500 companies, including Amazon and a large global real estate development services firm, doing everything from running rebranding programs to launching in-market pilots. At Khipu, I'm one of the product leads, and I'm also involved with the CBD e-commerce program.

Clint: A little bit about me: I come from the financial services space. I spent most of my career working in fintech with strategic product management, building software and solutions to support financial services companies, a lot around payments and product risk management. My role with Khipu is around product management and strategy, as well as marketing.

Hayden: Awesome. Thanks, guys. So let's get into it. Clint, why have some banks entered, then quickly exited, the CBD space, and many others just stay out of it altogether?

Clint: It seems counterintuitive at first, given that CBD is growing like crazy. You would think banks would be lining up to service these businesses. But for now, I think there are a combination of factors that have scared banks away. First is just a lack of knowledge and understanding of the industry. CBD products have been around for a while, but until 2018 they were classified in the same category with marijuana.

Therefore, they were only available through a licensed dispensary in states where marijuana is legal. But suddenly now CBD is everywhere, and a lot of people don't really know or understand what it is, how it differs from marijuana, and how you would determine what is legal. I think there's also some fear from banks that if they give CBD businesses a merchant account, those businesses might use it to sell marijuana as well, which is still illegal at the federal level.

Another major concern for banks, and honestly this is probably the biggest one, is the ambiguous regulatory landscape. Banks hate ambiguity, and that's exactly what you have with CBD regulation right now. It's evolving rapidly, and in a lot of cases it's unclear. The FDA has issued guidelines and restrictions for CBD products around their content and even around the marketing claims that a business can make.

But no one really knows at this point how strictly those are going to be enforced, and particularly how service providers like banks might be held liable if their clients violate these. The FDA has also made it clear that they continue to research CBD, which means changes are likely coming in the future. And then to further muddy the waters, each state is also free to establish its own set of regulations for CBD.

Naturally, those are inconsistent from one state to the next, and some of them are rather ambiguous to say the least. Beyond regulation, I think there are a couple of more factors for banks. One is a fear of fraud and chargebacks. CBD falls into the category of a higher-risk industry. It's got that combination of newness and fast growth, and frankly, a product that's rife for counterfeiting.

The risk of fraud, both on the merchant and the consumer side, is higher than it would be in a lot of industries. Finally, I think banks worry about the expense, the upfront investment and the headcount that might be required to manage a CBD program.

Because of many of the items that I already discussed, I think banks feel that they'd have to hire a bunch more compliance and risk people to manage a CBD program, to make sure they can keep up with changing regulations and provide the right level of rigor for underwriting and ongoing monitoring of the merchants. When you take all these factors together, I think it's a little easier to understand why many banks have steered clear so far.

But CBD is such a growth area that sooner or later most banks will take the plunge and figure out how to make it work.

Hayden: So you mentioned compliance being a big concern for the banks, and it sounds like much of this concern is driven by the regulatory landscape and the challenge of keeping up and complying with CBD regulations at federal and state levels. I understand that laws vary from state to state, but why are they sometimes, as you said, ambiguous?

Clint: Great question. As I said, the FDA provides regulatory guidelines for CBD products at the federal level. Most states have generally adopted those same guidelines, but others have modified them.

You end up with CBD being legal in some states, actually still illegal in a few others, and then a range in the middle with a bunch of state-level nuances that place greater or stricter limits around things like acceptable product ingredients, purchasing age, or the types of products that you can put CBD into. Then still others require a state-specific license to sell there or registration of products within a state database to legally sell in that state.

Even beyond that, you have a few states where just the general legality is still unclear. Missouri is an example of one of those states with ambiguous CBD laws. There's no law in Missouri that has formally legalized CBD for the general consumer, meaning that you can't buy it without a doctor's recommendation like you would need for medical marijuana.

According to the Missouri Department of Agriculture, the state is still deliberating on the true legality of the CBD sold in that state. That said, you can find CBD for sale over the counter in Missouri, in places like grocery stores and convenience stores. So they don't seem to be enforcing anything right now, even if it may not be technically legal. As I said, pretty ambiguous, and you can see why that might make some banks feel uncomfortable.

Hayden: I can see why that can make some banks uncomfortable. Sarah, before CBD products hit the shelves, they need to be tested by the state, and I believe these are called COA tests. Can you give us some more details on what these tests are?

Sarah: Absolutely. COAs, which are certificates of analysis, are really critical for CBD products for a number of reasons. First, of course, is ensuring that the product is legal CBD, and that means that the results from the potency or the cannabinoid analysis must show that the total THC percentage is below 0.3%. This is the federal legal limit to consider something a hemp product versus a marijuana product.

The cannabinoid analysis is also really important because it validates that the amount of CBD on the label is also the amount of CBD in the bottle. But these tests go beyond just potency and also provide valuable information about the product cleanliness by analyzing the product to ensure that it's free from foreign contaminants like heavy metals or pesticides, for example.

Hayden: Something that Clint said earlier surprised me regarding FDA marketing restrictions, something that never really crossed my mind in the CBD space. But what are some of these restrictions?

Sarah: To date, the FDA has only approved one CBD product, and that is the CBD epilepsy drug. In this case, CBD was approved as a drug ingredient, and so it has not yet been approved or evaluated by the FDA and confirmed as a food ingredient or a dietary supplement. This is what puts limitations on how CBD products can be legally marketed.

The FDA has put out guidance to say CBD products should not be marketed, for example, as conventional human foods. When we think of conventional human foods, we're thinking of snacks, candy, chocolates, things like that. CBD products also cannot be marketed as a dietary supplement, the way we talk about multivitamins or a capsule with melatonin.

The FDA has also made it clear that marketed CBD products should be free of any medical claim saying that CBD can alter the human body in some way. So marketing a CBD product and saying that it can cure cancer or that it's a great opioid substitute because it relieves pain from the body are also no-nos.

It's not to say the FDA's stance won't change on this in the future, and in fact, I would be surprised if it didn't. But for the time being, and until more scientific studies are completed on CBD, it's very important to avoid marketing CBD products in these ways, which violate the FD&C Act.

Jason: Well, that definitely sounds like a very complex space to play in. And I know in addition to being experts in this field from a consulting perspective, Khipu has developed some really exciting technology to minimize the burden for financial institutions that want to play in the space and do it compliantly. Join us next week for part two of CBD Compliance Chaos, where we explore the Khipu technology solutions.

Hayden: Alright, Jason, it is time to make payments make sense. Give me those takeaways.

Jason: Merchants, the whole payment supply chain is here to help you transition. We've got your back. ISVs, find a feature-rich API from a payments partner that makes you feel like they're your virtual payments department. Banks, CBD can be profitable but problematic if you don't have the right tools. Tune in next week to find out how Khipu minimizes the burden.

Hayden: Thanks for joining us today. And if you've got a topic you would like us to discuss, follow and message us on social media at Cents Chat. And as always, we would love your feedback. Hayden out.