If you sell or ship cigarettes, smokeless tobacco, or ENDS into U.S. jurisdictions, you must register with ATF and every state tax administrator you ship into, file monthly reports, retain records for four years, verify age and identity independently, and avoid carriers that won’t accept tobacco shipments. Skip any of these steps and you risk civil fines, criminal exposure, and a spot on ATF’s non-compliant seller list.

TL;DR:

  • ATF Form 5070.1 is due before the first interstate sale; each destination may also require separate state or local registration, tax stamps, or renewals.
  • Monthly reports must list customers, addresses, brands, quantities, and carriers by city or town and ZIP code; tax remittance schedules vary by jurisdiction.
  • USPS exceptions are narrow; qualifying mailings require an eligibility letter, special markings, and in person acceptance through Express Mail with Hold For Pickup.
  • Some state laws ban direct to consumer shipments despite federal compliance, so ecommerce platforms should block orders from unlicensed or restricted destinations.
  • PACT Act violations can bring up to three years in prison, while ATF’s list of noncompliant delivery sellers can jeopardize carrier access and banking relationships.
Davincipay
davincipay.ai
Payment Processing for Complex Ecommerce
Davincipay supports high-risk and regulated online merchants with acquiring relationships, payment gateways, fraud prevention, and chargeback mitigation.
Explore payment solutions

Table of Contents

What the PACT Act and the 2021 ENDS Amendment Cover

The Prevent All Cigarette Trafficking Act regulates anyone who ships cigarettes or smokeless tobacco across state lines to consumers. In 2021, Congress amended the law to pull electronic nicotine delivery systems, including vapes and e-liquids, into the same framework. If you sell any of these products online and ship them, the law applies to you regardless of where your warehouse sits.

Three federal agencies share enforcement, and each handles a different piece. ATF oversees registration and reporting, requiring delivery sellers to register under 15 U.S.C. § 376 and file monthly sales reports. USPS controls mailability, meaning it decides what can physically move through the postal system. FDA governs marketing claims, premarket authorization for ENDS products, and enforcement against underage sales. Treat these as three separate compliance tracks, not one combined checklist, because a registration with ATF does nothing to satisfy USPS mailing rules or FDA’s youth-access standards.

Three federal agencies and their compliance roles

Registering With ATF and State Tax Administrators

Under the PACT Act, you qualify as a “delivery seller” the moment you sell tobacco products to a customer in a state where you have no physical retail presence and ship the product through the mail, a common carrier, or any other delivery method. That status triggers registration with ATF and the tobacco tax administrators of every state and locality you ship into or advertise toward.

Before you start the paperwork, gather your EIN, business license, and any existing state tobacco tax registrations. Then work through this sequence:

  • File ATF Form 5070.1 to register as a delivery seller before making your first interstate sale.
  • Register separately with each state and local tax administrator in every jurisdiction you ship to, since federal registration does not substitute for state-level licensing.
  • Confirm whether your target states require tax stamps or pre-collection of excise tax before shipment.
  • Build a jurisdiction list that tracks where you’re registered, licensed, and stamped, and set calendar reminders for renewals.

Treat registration as ongoing maintenance, not a one-time task. States update tobacco tax rules often, and an expired registration puts every shipment into that state at risk.

Monthly Reporting, Recordkeeping, and Tax Obligations

Delivery sellers must file a monthly report with the tax administrator of every state and locality where you shipped product in the prior month. These reports need to list customer names and addresses, the brands and quantities shipped, and the carrier used, organized by city or town and ZIP code so state auditors can cross-reference tax filings.

A practical monthly workflow looks like this:

  1. Pull every delivery sale from the prior calendar month and sort it by destination jurisdiction.
  2. Confirm excise taxes were collected or pre-paid and that any required tax stamps were affixed before shipment.
  3. Compile the report fields (customer, address, brand, quantity, carrier) and submit to each relevant state and local administrator.
  4. Archive the submission along with supporting invoices.

Retain every record for four full calendar years, since that’s the window regulators typically examine during an audit. Recordkeeping gaps and missed monthly filings are among the most common triggers for enforcement action.

Pro Tip: Export your monthly reports by jurisdiction automatically rather than compiling them by hand, since manual sorting is where most reporting errors slip in.

Shipping Rules: USPS Restrictions and the Narrow Exception Process

USPS generally treats cigarettes, smokeless tobacco, and ENDS as nonmailable to consumers, which removes the most familiar shipping option from the table for most online tobacco sellers. Major private carriers have followed with their own voluntary bans on ENDS consumer shipments, which means you often can’t fall back on standard parcel services either.

A narrow set of USPS exceptions exists for business, regulatory, or consumer-testing mailings, but they come with real operational weight:

  • Apply using PS Form 4615 or PS Form 4615-E depending on whether the shipment is business/regulatory or testing-related.
  • Obtain an eligibility letter and assign the required eligibility number to qualifying mailings.
  • Apply special package markings as specified in USPS mailing guidance.
  • Use Express Mail with Hold For Pickup, and accept the package face-to-face at a USPS acceptance point rather than dropping it in a collection box.

These exceptions were built for narrow use cases, not routine retail fulfillment. Most consumer-facing sellers end up relying on private freight arrangements or carriers with specific tobacco-shipping agreements rather than the USPS exception pathway.

Age and Identity Verification Standards That Hold Up

Regulators expect independent age and identity verification that checks customer data against reliable public records, not a checkbox asking shoppers to confirm they’re 21. A self-attestation click-through won’t satisfy FDA or state enforcement expectations, and it’s one of the most commonly cited gaps in enforcement actions against online tobacco retailers.

Build verification into two points in the transaction:

  • Run an identity and age check at account creation, tied to the customer’s name, address, and date of birth against public record databases.
  • Re-verify for high-value or first-time orders where fraud risk is elevated.
  • Require an adult signature and ID check at the point of delivery, not just at checkout.
  • Retain verification logs, delivery confirmations, and order metadata together so you can produce a complete audit trail on request.

Pro Tip: Link your verification logs directly to each order record rather than storing them in a separate system, since reconstructing that connection during an audit costs far more time than setting it up correctly from the start.

Penalties and Enforcement Actions You Should Expect

Violations carry real teeth. Criminal penalties under the PACT Act can reach up to three years in prison, alongside civil penalties that accumulate per violation. FDA layers on its own civil money penalties for underage sales, which scale upward with repeat violations and can accompany no-tobacco-sale orders against persistent offenders.

ATF also maintains a non-compliant delivery seller list, and landing on it can cut off access to carriers and banking relationships that routinely check it before doing business with a tobacco seller. If you receive a notice or suspect a violation has occurred, bring in counsel immediately, preserve every relevant record rather than editing or deleting anything, and start a remediation plan before regulators request one.

How a Compliance-Aware Payment Partner Reduces Risk

A payments partner that understands tobacco compliance does more than process transactions. We build underwriting around high-risk verticals, which means we evaluate your registration status, shipping practices, and verification workflow as part of approving your account, not after a problem surfaces.

The capabilities that matter most:

  • Integration of independent age and ID verification directly into the checkout and payment flow.
  • Underwriting calibrated for tobacco and other regulated categories rather than generic ecommerce risk models.
  • Chargeback mitigation and ongoing transaction monitoring tied to your order volume.
  • Transaction-level flags linked to shipment jurisdiction, so orders heading into restricted states get caught before fulfillment.

When evaluating any payment partner, ask about their vertical experience, their acquiring bank relationships, their onboarding timeline, and how their reporting integrates with your own compliance records.

State-by-State Variations You Can’t Ignore

Federal registration is the floor, not the ceiling. Every state sets its own tobacco tax rate, licensing requirements, and in some cases outright bans on direct-to-consumer tobacco shipments regardless of federal PACT Act compliance. A handful of states require tax stamps to be affixed before a package ships, while others calculate excise tax based on wholesale price rather than unit count, and the mismatch between these systems is where many sellers get tripped up.

Local ordinances add another layer. Some cities impose their own tobacco taxes on top of state rates, and the PACT Act’s reporting requirement extends to those local tax administrators too, not just the state level. A seller shipping into a dozen states might be managing a dozen different tax rates, filing schedules, and licensing renewal dates simultaneously.

ENDS products complicate this further, since several states have passed standalone vapor product taxes or flavor restrictions that sit outside traditional tobacco tax codes. A product that’s fully compliant to ship into one state might require a different tax treatment, different packaging disclosure, or be outright restricted in a neighboring one.

The practical response is to treat each shipping destination as its own compliance project. Before you add a new state to your shipping list, confirm its tax rate, stamping requirement, licensing process, and any product-specific restrictions on ENDS or flavored tobacco. Build this verification into your onboarding process for new markets rather than treating it as a one-time setup task, since state tobacco laws change on a near-annual basis.

Going Beyond Federal Rules: State Tax Collection and Reporting

Federal PACT Act compliance gives you a registration and reporting framework, but the actual tax collection obligation runs through state and local law. Most states require you to collect excise tax at the point of sale and remit it on a schedule set by that state’s tax administrator, which rarely lines up neatly with your federal monthly reporting cycle.

Some states require sellers to pre-pay excise tax and affix a physical or digital tax stamp before a product ships, which means your fulfillment process needs a stamping step built in before a package ever reaches a carrier. Others bill tax quarterly or require a bond posted against future tax liability, particularly for sellers with higher shipping volume into that state.

Your state-specific compliance file should include the applicable tax rate, the remittance schedule, any stamping or bonding requirement, and the specific report format each administrator expects. Many states accept the same monthly report format used for federal PACT Act filings, but a growing number have their own electronic filing portals with different field requirements, so confirm this before your first shipment into a new state rather than after a report gets rejected.

Keeping a master compliance calendar across every state you ship into, with tax due dates, report due dates, and renewal dates in one place, is the single most effective operational habit for avoiding missed filings.

Building Compliance Into Your Ecommerce Platform

Compliance works best when it’s built into your checkout flow rather than bolted on as a manual review step after the fact. Automated age verification tools that check identity against public records at account creation catch problems before a sale happens, rather than after a shipment has already left your warehouse.

Tax calculation software that updates automatically as state tobacco tax rates change removes one of the most common sources of error, since manually tracking excise tax rates across a dozen or more states invites mistakes. Look for a solution that flags a transaction automatically when a customer’s shipping address falls in a state where you aren’t yet registered, rather than catching the gap during your next audit.

Your platform should also enforce shipping restrictions at the cart level, blocking orders to jurisdictions where you don’t hold a license or where tobacco delivery sales are banned outright. This prevents an order from ever being placed rather than requiring you to cancel it after the fact, which creates a cleaner customer experience and a cleaner compliance record.

Integrating these checks means your platform, your payment processor, and your shipping workflow all need to share the same jurisdiction and verification data. A disconnect between these systems, where your payment processor approves a transaction your shipping system should have blocked, is one of the most common operational failure points for online tobacco sellers.

Building Compliance Into Your Ecommerce Platform — overview diagram

Payment Processing Challenges Unique to Online Tobacco Sales

Online tobacco sales sit firmly in high-risk merchant territory for most acquiring banks, which means standard payment processors and many mainstream platforms will decline your application outright or shut down your account after approval once your category becomes clear. Chargeback rates, regulatory scrutiny, and the reputational sensitivity banks attach to tobacco all factor into this.

Securing a compliant merchant account starts with transparency: disclose your product category accurately during underwriting rather than hoping it goes unnoticed, since a mismatch between your stated business and your actual transactions is one of the fastest ways to trigger an account freeze. Work with an acquiring partner that has existing banking relationships built for regulated verticals, because a bank unfamiliar with tobacco compliance is more likely to react to volume spikes or chargeback patterns with a sudden hold or termination.

We structure underwriting and ongoing monitoring around the realities of tobacco sales, including real-time transaction monitoring and reserve structures that reflect actual risk rather than a blanket high-risk markup. That combination gives you a processing relationship built to last rather than one you’ll need to replace after your first chargeback cluster.

Protecting Customer Data Collected for Compliance

Age and identity verification requires collecting sensitive personal data: full names, addresses, dates of birth, and sometimes government ID images. That data carries real privacy obligations alongside the compliance value it provides.

Store verification data separately from general marketing data, and limit access to the staff who actually need it for compliance or audit purposes. Encrypt stored identity documents and verification logs, and set a retention policy that matches your legal requirement, which is four years for PACT Act records, rather than keeping sensitive data indefinitely out of convenience.

Review your privacy policy to make sure it accurately discloses what verification data you collect, why you collect it, and how long you retain it. Customers increasingly expect this transparency, and several state privacy laws require it regardless of your tobacco-specific obligations. If you work with a third-party verification vendor, confirm their data handling practices meet the same standard you’d apply internally, since you remain responsible for that data even when a vendor processes it on your behalf.

Recent and Upcoming Regulatory Changes to Watch

The 2021 ENDS amendment to the PACT Act remains the most significant recent expansion of the law’s scope, and enforcement around vapor products has intensified since then. FDA continues to focus enforcement resources on marketing authorization and underage access, with recent research showing many online e-cigarette retailers still rely on weak age-screening methods and use carriers that don’t permit the shipments they’re accepting.

State legislatures continue to adjust their own tobacco and vapor tax codes, and several states have introduced or expanded flavor restrictions on ENDS products in recent years. These changes tend to move faster at the state level than at the federal level, which makes the state compliance calendar mentioned earlier more important than ever.

Keep an eye on FDA’s enforcement guidance and ATF’s published compliance updates, since both agencies periodically issue clarifications on registration procedures, reporting formats, and mailing exceptions. For site security and verification infrastructure, platforms also face growing expectations for certificate management, and resources like SSL monitoring guidance can help you keep your verification and checkout systems meeting current security baselines.

Where to Start If You’re Building a Compliance Program Now

Register first, verify age and identity second, cut off any shipping method that risks nonmailability third, then bring in a payments partner built for regulated verticals. Sequencing matters more than speed here.

— Peter

How DavinciPay Supports Compliance-Minded Online Tobacco Sellers

We built our high-risk payment processing around merchants who need underwriting, verification, and monitoring that match their actual regulatory exposure. If you’re ready to evaluate a processing relationship built for tobacco and other regulated categories, apply now to get started.

Davincipay

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Are tobacco products regulated by the FDA?

Yes. FDA regulates tobacco product marketing, premarket authorization for ENDS products, and enforcement against sales to minors, issuing civil money penalties that scale with repeat violations. This sits alongside ATF’s registration and reporting authority and USPS mailability rules, so compliance requires satisfying all three.

Where can I buy tobacco online?

Tobacco products are sold online through sellers who have registered with ATF and the relevant state tax administrators and who follow PACT Act age-verification and shipping rules. Availability varies by state, since several states restrict or ban direct-to-consumer tobacco shipments regardless of a seller’s federal registration status.

Why can’t tobacco be delivered?

Cigarettes, smokeless tobacco, and ENDS are generally nonmailable through USPS, and most major private carriers have adopted their own voluntary bans on consumer tobacco shipments. Narrow USPS exceptions exist for business, regulatory, or testing mailings, but they require special forms, markings, and in-person acceptance rather than standard drop-off shipping.

What state is banning tobacco products?

Several states restrict or prohibit direct-to-consumer shipment of tobacco or vapor products, and the specific rules change frequently as state legislatures update their tobacco and ENDS tax codes. Check the current licensing and shipping requirements for each state you plan to sell into before shipping, since state law can be more restrictive than federal PACT Act requirements.

What is tobacco compliance for online sellers?

Online tobacco compliance means registering with ATF and the state tax administrators in every jurisdiction you ship into, filing monthly sales reports, retaining records for four years, and verifying customer age and identity independently rather than through self-attestation. It also means following USPS and carrier mailability rules, since most tobacco products can’t move through standard parcel shipping.

Sources