Wholesale CBD guide: documents, MOQs, tiers, COAs and B2B ordering

Wholesale is the part of the CBD business that is still growing. This guide covers what a buyer needs to open an account, what minimums and price tiers look like in 2026, what a certificate of analysis package has to contain, how resale certificates work when the supplier ships straight to the buyer's customer, and which states limit bulk shipments. The numbers come from supplier price sheets, agency pages and statute, and every one of them is linked.

Who buys wholesale CBD?

The buyers split into three groups with different needs. Storefront retailers buy by the case, want a display-ready product with a scannable COA, and reorder every 4 to 8 weeks. Service businesses such as spas and massage studios buy topicals in smaller quantities, often one case at a time, and care most about a clean ingredient list and a label that stays within structure and function language. Distributors buy pallets, sell to the first two groups, and need a price tier that leaves them a margin after the retailer's margin.

A fourth group has appeared since 2024: brands that do not manufacture anything. They buy white-label finished goods, apply their own label, and resell through their own site or a marketplace. That buyer needs the same documents as a retailer plus a labeling agreement, because the brand on the label becomes the responsible party. The white-label section below explains why.

The cbdMD numbers show the direction. A public company with a national consumer brand grew wholesale by 18 percent in a year while its own online store shrank, and its CEO pointed to beverages as the next growth line (Yahoo Finance). Wholesale accounts, once onboarded, reorder.

What documents do wholesale buyers need?

The W-9 is the simplest. The IRS describes it as the form you use "to provide your correct Taxpayer Identification Number (TIN)" to the party that will report payments; the current revision is March 2024 (IRS). A supplier keeps it on file to tie the account to a legal entity and an EIN. A sole proprietor can use a Social Security number, but most suppliers ask for an EIN so the account is in the business's name.

The resale certificate is the document that lets the supplier sell without charging sales tax. It is issued by the buyer's state, not by the supplier, and it certifies that the goods are purchased for resale. Shopify's own guidelines for retailers who buy through its dropship channel put the obligation on the buyer: retailers must provide "appropriate resale certificates to your suppliers in the United States" (Shopify Collective guidelines). The dropship section below covers the multi-state form and the ten states that will not accept it without an in-state registration.

The hemp retailer license depends on the buyer's state. Texas requires a Retail Hemp Registration under Health and Safety Code chapter 443 and 25 TAC chapter 300, and its agency page states the fee "has been restored to $5,000 annually per location, plus the applicable TOL fee" (Texas DSHS). Oregon requires a Hemp Vendor Site license for anyone who stores, transfers or sells hemp for resale to Oregon consumers; the Department of Agriculture page says "the vendor license costs $100 per year and is valid from July 1 - June 30" (Oregon ODA). Several other states register retailers; many do not. A supplier asks for the license where one exists and records the number on the account.

The signed terms carry the no-health-claims clause, recall cooperation and ship-to verification. FDA's page of warning letters for cannabis-derived products lists roughly 130 firms from 2015 through August 2025, and the agency says it "will continue to take action against CBD and other cannabis-derived products" that are marketed unlawfully (FDA). A retailer who repeats a supplier's product description on its own site inherits the risk in that description, and a supplier who sells to a retailer making unlawful claims inherits it back. The clause binds both sides to structure and function language and to pulling a lot on request.

What is a typical MOQ?

The case minimum tracks the carton. The January 2025 KureLeaf sheet lists a 1500 mg tincture, a 3500 mg salve and a 3000 mg roll-on at an MOQ of 24, and 25 mg softgels at 50; vape cartridges, which this store does not carry, sit at 150 (KureLeaf price list). The August 2024 Moon Ranger sheet uses 24 for tinctures, gummies and salve (Moon Ranger price list). The Slumber catalog Go North distributes prints wholesale and retail prices without a stated minimum, which in practice means one case (Slumber catalog).

Bulk ingredients work differently. Go North Hemp states a 100 gram minimum for most isolates, distillates and water-soluble formats, with volume pricing from 1 kilogram and "Standard lead times range from 3 to 14 business days depending on volume and ingredient availability" (Go North Hemp wholesale). Its beverage program, Beverage Fast Track, carries a 500-unit minimum (Go North Hemp). A buyer sampling an ingredient for formulation can start at 100 grams; a buyer launching a drink cannot start below a pallet.

A dropship account is the exception to both bands. When the supplier ships single orders to the retailer's customers, the MOQ is one unit per order and the economics move into the per-order fee and the wholesale price. Whether a supplier offers that at all, and at what fee, is an account-level question rather than a price-sheet one. TODO: confirm per-order dropship fees and per-SKU dropship minimums with the supplier.

What is white label CBD and who is the labeler?

The price gap is real. On the KureLeaf sheet the same tincture lists at $49 retail, $24 wholesale and $16 white label; the salve at $49, $25 and $18; the softgels at $36, $18 and $13 (KureLeaf price list). The Moon Ranger sheet prices its 1500 mg tincture at $34, $14 and $11 (Moon Ranger price list). White label is cheaper because the manufacturer sells the formula and the fill and nothing else: no brand, no marketing, no customer service.

What the buyer takes on in exchange is the label. Federal labeling rules require a packaged food label to "specify conspicuously the name and place of business of the manufacturer, packer, or distributor," and when the named firm did not make the product, "the name shall be qualified by a phrase that reveals the connection," such as "Manufactured for" or "Distributed by" (21 CFR 101.5). The firm whose name appears is the one a regulator writes to. Every FDA warning letter on the cannabis-derived products page is addressed to the company on the label, not to the contract manufacturer behind it (FDA).

The practical checklist for a white-label buyer: the manufacturer supplies the batch COA, the ingredient statement and the fill weight; the labeler writes the front panel, the supplement-style facts panel, the FDA disclaimer, the lot code and any state-required warning; the labeler keeps a lot-to-customer record so a recall can be executed; and the labeler, not the manufacturer, decides whether a product can ship to a given state. A supplier that asks for a signed labeling agreement before printing is protecting both parties.

How do wholesale, distributor and retail tiers work?

The math is keystone pricing with a second step. Retail (MSRP) is the price printed for the end customer. Wholesale is what a retailer pays and in the CBD category runs 40 to 50 percent off MSRP, which gives the retailer a 1.7 to 2.0 multiple; the Slumber catalog prints it as a flat 50 percent, "RETAIL: $60 MARGIN: $30" on most lines (Slumber catalog). Distributor sits another 20 to 30 percent under wholesale so a distributor can sell to retailers at the wholesale price and keep the difference. On the KureLeaf sheet that gap is $24 to $18 on the tincture and $25 to $20 on the salve.

Tiers are gated by volume and by role, not by negotiation. A retailer buying 24 units gets wholesale. A buyer who commits to pallet quantities, carries inventory and resells to other businesses gets distributor. A white-label buyer gets the white-label column because the manufacturer is not supplying a brand.

On this site the structure is the same with simpler names: Tier 1 at about 40 percent off MSRP for approved retail accounts, Tier 2 at about 50 percent off for accounts above a volume threshold, and a Distributor tier reserved for signed distribution agreements. The B2B section below explains how an account lands in a tier. Minimum advertised price follows the retail column; a wholesale account that advertises below MSRP without a written promotion loses its tier.

What should a wholesale COA package include?

The potency panel is the one that changed in 2026. A percentage is enough to prove a lot is hemp at 0.3 percent, but from December 11, 2026 a final product must also carry no more than 0.4 milligrams of total THC per innermost container (7 U.S.C. 1639o). A COA that reports "ND" at a limit of 0.01 percent cannot prove that: 0.01 percent of a 28 gram bottle is 2.8 milligrams. A wholesale buyer should ask for milligrams per container on the certificate or a stated limit of quantitation low enough to resolve 0.4 milligrams in the finished unit, which for a 30 milliliter format is around 10 parts per million.

The safety panels are the ones a retailer's customers ask about. Go North Hemp's hub states that "Every batch is tested through an ISO 17025 accredited laboratory" and names KCA Laboratories, PharmLabs San Diego, Botana Labs, California Ag Labs and Badger Labs as the labs behind its certificates; each product row carries the lab, the batch or sample ID and a PDF (Go North Hemp COA hub; Go North Hemp wholesale). That is the shape a buyer should expect from any supplier: a named accredited lab, a batch number that matches the carton, a date, and a permanent URL rather than an emailed PDF that cannot be checked later.

Two more items belong in the package even though they are not on the certificate. First, a process attestation for CBN and CBC inputs stating whether the cannabinoid was produced by natural degradation or by chemical conversion, because the amended federal definition excludes cannabinoids "synthesized or manufactured outside the plant" and a COA cannot tell the two apart (7 U.S.C. 1639o). Second, the carrier record: UPS requires a COA on hemp shipments from December 11, 2026, and USPS requires the mailer to keep "laboratory test results, licenses, or compliance reports" for at least 3 years (UPS; USPS Pub 52). The COA is a shipping document now, not only a marketing one.

How does B2B ordering work on this site?

Step one is the application. The wholesale page collects the legal business name, EIN, ship-to addresses, the resale certificate and any state hemp license, and the applicant signs the terms described above. Nothing is visible until a person reviews the file and creates a company profile, which is the Shopify object that holds the buyer's locations, tax exemptions and assigned catalog. The changelog lists "company profiles," "up to 3 active B2B catalogs (assigned via Markets)," "payment terms," "volume pricing," "ACH payments (U.S. only)" and "vaulted credit cards" as included on Basic, Grow and Advanced plans (Shopify changelog).

Step two is the catalog. Each tier is a catalog: Tier 1, Tier 2 and Distributor. A company sees one catalog, with wholesale prices, case-pack quantity increments and per-state availability already applied. Bulk ingredients are not in any public catalog and never appear on the consumer site; they are quoted by email to licensed or registered buyers only, for the statutory reason covered in the intermediates section below.

Step three is payment. New accounts pay by card at checkout, and the card can be vaulted for reorders. Net 30 is available only to accounts with an order history and a signed credit application, paid by ACH or vaulted card at the due date. Orders ship with adult signature required, per the carrier rules above, and tracking posts to the company account.

What are the resale-certificate rules for a three-party dropship?

A dropship is two sales and one shipment. The retailer sells to the customer and the supplier sells to the retailer, but the supplier ships to the customer's address. For sales tax, each sale is judged on its own. The retailer-to-customer sale is taxable in the customer's state if the retailer has nexus there. The supplier-to-retailer sale is exempt as a sale for resale, but only if the supplier holds a valid certificate from the retailer. The Multistate Tax Commission's Uniform Sales and Use Tax Resale Certificate, updated October 14, 2022, is the form "36 States have indicated can be used as a resale certificate," and the commission directs users to each state's revenue department to confirm acceptance (MTC).

The ten strict states are the trap. California, Connecticut, Florida, Georgia, Hawaii, Illinois, Indiana, Louisiana, Maine and Massachusetts require the retailer to hold an in-state registration before the supplier can accept its certificate for a shipment into that state, even if the retailer has no other presence there (Beancount). When no valid certificate exists, the supplier "charges sales tax on the wholesale price," and the retailer absorbs it, because the customer already paid the retail price. In an audit the exposure runs the other way: a missing certificate makes the exempt sale taxable retroactively, and the supplier, not the retailer, owes the tax, interest and penalties.

The working procedure for a supplier is simple. Collect the MTC form at onboarding, record which states it names, and for the ten strict states collect that state's own permit number or charge tax on shipments into it. Re-collect certificates on a schedule, because several states expire them. For a retailer the procedure is the mirror image: register where you have nexus, including economic nexus from sales volume, and give every supplier a current certificate before the first dropship order.

Which bulk products are intermediates and why they are never sold as final products?

The statute draws the line in two places. Paragraph (3)(B) of the amended definition describes an intermediate product as one that "is not yet in the final form or preparation marketed or intended to be used or consumed by a human or animal," or that "is a powder, liquid, tablet, oil, or other product form which is intended or marketed to be mixed, dissolved, formulated, or otherwise added to or prepared with or into any other substance" (7 U.S.C. 1639o). A kilogram of CBD isolate is the textbook case. So is a liter of distillate and a 20 percent water-soluble powder.

Then clause (1)(C)(iii) excludes from hemp "any intermediate hemp-derived cannabinoid products which are marketed or sold as a final product or directly to an end consumer for personal or household use" (7 U.S.C. 1639o). The same isolate that is hemp when sold to a manufacturer is not hemp when sold by the gram to a consumer. A listing on a consumer storefront is the marketing act the clause describes, which is why bulk SKUs never appear in a public collection, a sitemap or a product feed, and why bulk pages require a logged-in, approved company account.

Intermediates also face a tighter THC rule than finished goods. Clause (1)(C)(ii)(III) excludes an intermediate with "more than 0.3 percent combined total of" total THC and any cannabinoid with similar effects, measured by concentration, while finished products are judged by the 0.4 milligram per container cap (7 U.S.C. 1639o). A broad-spectrum distillate at 0.2 percent total THC is a lawful intermediate; the same distillate at 0.5 percent is not hemp at all and cannot be shipped. Every bulk lot is held to that number on its certificate before it is quoted.

What are the state restrictions on bulk shipments?

Washington is the clearest no. The Liquor and Cannabis Board states that "only licensed cannabis retailers may sell products with detectable levels of THC to consumers" and that "it is illegal for unlicensed stores to sell products with any detectable levels of THC," covering hemp-derived and converted THC alike (WSLCB). A full-spectrum or broad-spectrum distillate with any measurable THC does not ship into Washington from this program. A CBD isolate lot with a non-detect result at a stated limit can, to a registered buyer.

California changed in 2025. Assembly Bill 8, signed October 2, 2025, gave state and local agencies hemp enforcement powers from January 1, 2026, and the Department of Cannabis Control states that "if a hemp product contains any detectable amount of THC, it is considered intoxicating" (CA DCC). California also bans hemp flower and inhalable hemp products outright, and its licensed cannabis manufacturers operate under their own sourcing rules. Bulk into California is limited to non-detect isolate for buyers who hold the relevant state registration. TODO: confirm the current DCC rule on cannabinoid sourcing for licensed manufacturers before quoting a California bulk order.

Idaho and Arkansas set the floor at zero in practice. Idaho Code 37-2701 defines industrial hemp by total THC including THCa at "not more than three-tenths of one percent (0.3%)," requires that it be handled under a license, and presumes that material outside the definition which contains tetrahydrocannabinols is marijuana. Arkansas enforces Act 629 of 2023, its ban on delta-8 and similar hemp-derived THC products, after the Eighth Circuit lifted the injunction on June 24, 2025 (Arkansas AG). The only bulk lot this program ships into either state is isolate with a non-detect THC result at a stated limit of quantitation, to a buyer who holds whatever license that state requires. Every other state is checked against the state legality table at quote time, and any lot over 0.3 percent total THC is not shipped anywhere.