Start with jurisdiction and product scope
ATF explains that the US PACT Act applies to electronic nicotine delivery systems and requires covered interstate sellers to register, follow reporting, shipping, age-verification and recordkeeping rules, and comply with state, local and tribal requirements. FDA separately regulates retail sales and online promotion. A merchant must confirm the exact product, customer location, licences and remote-sale rules before checkout. Card acceptance does not establish that a product or shipment is lawful.
Join order, payment and shipment records
Give every order a stable reference that connects customer details, product and quantity, destination, taxes, payment authorisation, capture, carrier and delivery result. ATF’s reporting guidance requires detailed shipment information for affected jurisdictions. Finance should be able to trace reported units back to paid or refunded orders. Do not create a reporting extract from successful authorisations alone because cancelled, partially fulfilled, returned and chargeback orders can differ from final shipments.
Control age verification and delivery
ATF describes database age verification and adult-signature requirements for delivery sales. FDA says US retailers may not sell tobacco products to anyone under 21. Keep the verification outcome, method and timestamp without retaining unnecessary identity data. The shipping instruction should preserve the required service and recipient check. A passed online payment or cardholder name is not proof of age, and a successful age check does not confirm product authorisation or destination legality.
Reconcile taxes, reports and refunds
Monthly reporting should use the final shipment ledger, organised as required for the destination. Reconcile product quantities, taxable values, taxes paid, carrier details and customer records to payment settlement. When an order is refunded, determine whether the shipment occurred and how the correction appears in tax and regulatory records. Do not delete the original transaction. Preserve an audit trail showing the initial order, change, refund and any amended report.
Review provider and carrier dependencies
The PACT Act generally restricts mailing ENDS and imposes requirements on delivery sellers and carriers. Confirm that the selected carrier lawfully accepts the product and destination. Payment providers may also restrict tobacco categories. Keep current written approvals and do not disguise the product or descriptor. If a provider or carrier changes policy, pause unsupported checkouts and update the jurisdiction matrix before routing orders elsewhere.
Protect sensitive customer data
Reporting obligations can require names and addresses, creating meaningful privacy and security exposure. Restrict access, encrypt approved systems, log exports and retain records only for the verified period. Separate marketing permissions from regulatory records. When responding to an authorised request, validate the requester and transfer only the required information through an approved channel. A compliance obligation is not permission for unrestricted internal use.
Practical operating review
A month-end control should compare three populations: orders for which payment was captured, orders actually shipped and shipments included in required reports. Differences need a coded reason such as cancellation, partial fulfilment, return, replacement or reporting correction. Investigate uncoded gaps before filing. The catalogue should preserve product category and brand data required for reporting, while checkout should validate destination before capture where practicable. If a state or locality changes a tax, licence or product rule, record the effective date and treatment of orders already in progress. Keep payment-provider descriptions accurate and provide requested compliance evidence through approved channels. Management should review exception trends because repeated manual overrides can reveal a broken destination rule, supplier record or fulfilment process. Use access controls around reports because they contain identifiable customer and purchase information. Confirm that fulfilment staff cannot replace a blocked destination or delivery service without approval. Sample completed orders to verify that age evidence, carrier service and reported data agree. Review chargebacks that allege non-delivery or unauthorised purchase against the same record, but disclose only the information permitted by scheme and privacy rules. If a customer returns a product, document physical disposition and any tax adjustment separately from the payment refund. Review data quality before filing because corrections made after submission may require jurisdiction-specific procedures and supporting evidence.
What it means to Merchants
US vape merchants should reconcile PACT Act reporting from final shipment facts, not merely payment approvals. Confirm product and destination legality, connect age verification with adult-signature delivery, match taxes and quantities to settlement, and preserve corrections after refunds. Verify carrier and provider acceptance without disguising the business. These sources describe US federal requirements; state, local and tribal rules may add restrictions. Inclusion does not imply that FixPays accepts a merchant, supports a product or determines legality. Assign an owner for the jurisdiction matrix. Freeze unsupported destinations automatically. Test cancelled and partial orders. Compare carrier scans with adult-signature evidence. Review monthly reports before submission. Protect exported customer data. Track returned packages and destroyed stock. Reconcile chargebacks without erasing shipment history. Verify forms with each taxing authority. Update product authorisation records. Train support not to override destination controls. Seek specialist advice for ambiguous products. Review PACT, orders, payments, shipments, reports, taxes, age, delivery, records, refunds, governance, ownership, training, testing, escalation, reporting, privacy, security, contracts, customer-impact, exceptions, recovery, documentation, changes, outcomes, responsibility, timing, support with accountable teams before launch.