PMTA Compliance for Vape Shops in 2026 (Owner's Checklist)

The Premarket Tobacco Product Application (PMTA) process has been on the books since 2016, but 2026 is the year compliance moved from "FDA might inspect" to "FDA is inspecting." We've had three clients audited in the last six months alone. None were fined — but only because their POS, recordkeeping, and staff training were in order. Here's that playbook.

What PMTA actually requires

The Family Smoking Prevention and Tobacco Control Act (TCA) puts all "new tobacco products" — which legally includes vapes and e-liquids — under FDA premarket review. A product can be sold legally in the U.S. only if it has:

• A PMTA authorization (Marketing Granted Order), or
• A PMTA pending status that has not been formally denied, or
• An MRTP (Modified Risk Tobacco Product) authorization

As of 2026, FDA has authorized a relatively narrow list of products — primarily tobacco-flavored cartridge systems from a handful of large manufacturers. Most flavored disposables on the market do not have authorization. Selling unauthorized products is a violation regardless of whether the customer was 21+, regardless of whether ID was checked, regardless of whether the manufacturer told you it was "FDA approved."

The current authoritative list is on the FDA's tobacco products page. Bookmark it. Check it monthly.

The 5-discipline checklist

1. Product gating at the POS

The most common failure mode we see: a SKU enters inventory because the manufacturer rep brought it by, with no compliance check. By the time FDA inspects, the product has been on the shelf for six months.

The POS-level discipline:

• Maintain a "PMTA status" field on every tobacco/vape SKU (Authorized / Pending / Denied / Unknown)
• Block "Denied" or "Unknown" items at checkout with a hard stop
• Require manager override to add a new tobacco SKU, with status field as required
• Re-verify status quarterly against the FDA list

Modern counter-culture POS platforms have this gating built in. If your POS doesn't have a per-SKU compliance status, you're flying blind. See our specialty & counter-culture retail POS for what compliant gating looks like in practice.

2. Hard age verification

PMTA inspections almost always include an underage-sale check. The federal age is 21 (since the December 2019 TCA amendment). Several states are stricter on ID requirements or look-back ages (anyone appearing under 30 must show ID in many jurisdictions).

The POS-level discipline:

• Age gate prompts on every nicotine-containing SKU
• ID scan preferred over manual date entry — much harder to fake
• Date-of-birth log retained per transaction (or hashed if state privacy law requires)
• Calendar-aware prompts ("must be born before 2005-05-31") rather than a static "are you 21" yes/no

We've trained staff at over 400 vape locations. Even with perfect technical gating, the failure mode is always human: cashier waves through a known regular, cashier accepts an obvious fake, cashier doesn't realize the ID expired. The technical gate has to back up the human, not replace them.

3. Recordkeeping (4+ years)

FDA inspectors will ask for purchase records. The minimum retention list:

• Purchase invoices from every distributor, by SKU and date
• Product authorization certificates from manufacturers (where applicable)
• Manufacturer compliance attestations for PMTA-pending products
• Inventory adjustments (recalls, returns, damage-outs)
• Age verification logs at the transaction level
• Staff training records including dates and topics covered

FDA requirement is 4 years; we recommend 5 to allow margin. Counter-culture retailers especially should retain this in a digital, searchable format — paper files don't survive a real audit.

4. Staff training

FDA inspectors are entitled to interview staff. A cashier who says "I don't know, the manager handles that" is a finding. The training baseline:

• Initial training for every new hire: PMTA basics, age verification, ID standards, prohibited products
• Annual refresher for all staff
• Documented sign-off that each employee read the policy
• Quick-reference card at every register with the current authorized list
• Quarterly tabletop on inspection-day procedures (who greets the inspector, who pulls records, who calls the owner)

Our training guide for vape shops is in /resources/blog/vape-shop-age-verification-training-guide.

5. Quarterly self-audit

The most common pattern in successful FDA inspections is that the merchant had already self-audited and fixed gaps. The quarterly checklist:

• Pull current FDA Authorized Product list; compare to your active SKUs
• Pull 25 random age-verified transactions; spot-check the ID logs
• Pull staff training records; flag anyone overdue
• Pull recent purchase invoices; verify retention
• Walk the store and check that no expired or recalled stock is on the shelf
• Sign and date the audit log

90 minutes once a quarter. The discipline matters more than the format.

What FDA inspectors look for

From the inspection findings we've seen in the past year:

First-offense civil penalties for tobacco retailers start at $300 per violation and escalate to $11,000+ for repeat violations within a 36-month window. The fines compound by SKU and by transaction. We've seen one inspection with 14 SKU findings — a $4,200 penalty before any staff or recordkeeping issues were counted.

"But my distributor said it was approved..."

This is the most common defense merchants try. It doesn't hold up. FDA's position is that retailers are independently responsible for verifying status. A distributor invoice or a manufacturer's email is not a substitute for the FDA Authorized Product List.

In one of our client audits, the distributor had provided a signed letter claiming PMTA authorization on a SKU that was, in fact, denied. The merchant had to pay the fine. The merchant then sued the distributor. That suit is still pending. The merchant is out the $7K either way.

The lesson: verify against FDA.gov directly. Not the distributor's website, not the manufacturer's marketing.

State-level overlays

Federal PMTA is the floor. Several states impose additional layers:

• Massachusetts — banned flavored vape sales statewide (2020-present)
• California — Prop 31 prohibits flavored tobacco at retail (2022-present)
• New York — flavored vape ban + tax stamp requirements
• Several states — directory laws requiring SKUs be registered on a state list

If you operate in multiple states, your POS needs per-location SKU availability — a product that's legal in Texas may be banned in Massachusetts. Most counter-culture POS platforms support per-location SKU gating; verify yours does before you add a second location.

Where Lifelong fits

We configure compliant vape retail POS for clients across 30+ states. For the full feature set a smoke shop POS should have — including age verification, variant matrix, and scan-data — see smoke shop POS features. Every deployment includes:

• Per-SKU PMTA status field with FDA-list integration
• ID scan + DOB log on all nicotine SKUs
• 4-year recordkeeping retention with searchable archives
• Quarterly self-audit reports auto-generated
• Per-location SKU gating for multi-state operators

For the full payments + compliance stack tailored to vape, see our specialty & counter-culture retail POS.

A note on banking: vape retailers sit in a high-risk merchant category, which means the banks behind your payment processor must apply enhanced due diligence under FDIC supervisory guidance. PMTA compliance documentation — product authorization status, age-verification logs, sales records — is exactly the kind of operating record that demonstrates to your processor and their bank that your business runs cleanly. A compliant POS that produces that documentation on demand is part of your banking stability, not just your FDA compliance.

FAQ

What products are currently PMTA-authorized?

The list changes — check FDA's official authorized products page. As of 2026, it's a relatively narrow set of tobacco-flavored cartridge systems. Most flavored disposables are not authorized.

What's the difference between "authorized" and "pending"?

Authorized means FDA has issued a Marketing Granted Order. Pending means the manufacturer has submitted a PMTA and FDA has not yet issued a final decision. Pending products can generally be sold; denied products cannot.

How do I know if a product's PMTA was denied?

FDA publishes Marketing Denial Orders (MDOs) and warning letters. Distributors are supposed to notify retailers but often don't. Quarterly self-audit against the FDA list catches denials before inspectors do.

What happens if FDA finds a violation?

First offense usually draws a warning letter or civil penalty starting at $300/violation. Multiple violations within 36 months escalate the penalty, and repeat offenders can face "No Tobacco Sale Orders" prohibiting tobacco sales at the location for 30+ days.

Do I need to report sales to FDA?

No, retail tobacco sales aren't reported transaction-by-transaction. But you must produce purchase records and other compliance documentation on request.

Can I sell synthetic-nicotine products without PMTA?

No — the 2022 Consolidated Appropriations Act extended FDA jurisdiction over synthetic nicotine. All nicotine-containing products, regardless of source, require PMTA.

Get a free compliance read

If you're not sure where your vape shop sits on PMTA, age verification, or recordkeeping — we'll do a 30-minute compliance walk-through and flag what needs to be fixed before FDA shows up. No contract, no upsell. talk to our Atlanta team to book.

---

By the Lifelong Merchant Services team · Atlanta, GA Lifelong configures compliant POS, payments, and recordkeeping for vape and smoke retailers across all 50 states.