Think of compliance as three stacked layers. Regulators don't care if you were "compliant with the other two" — each layer is enforced independently, and failure in any one can end the business.

Layer 1 — FDA: products and retailers

Applies to: every retailer, distributor, and brand selling tobacco/vape products in the US.

• Retailer registration: any business selling tobacco products must register with the FDA as a tobacco retailer.
• Product authorization: you may only sell products that have FDA marketing authorization (PMTA), a pending application, or grandfathered status. This list changes as enforcement evolves — products get denied and pulled from the market regularly.
• ID checks and signage: federal law requires age verification (21+) and prohibits vending-machine sales except in adult-only facilities.
• Enforcement: FDA issues warning letters and civil money penalties; repeated violations escalate to injunctions and retailer registration revocation.

Layer 2 — PACT Act: shipping, registration, reporting

Applies to: anyone who ships vape products to consumers or retailers.

• ATF registration: before shipping any vape products, you must register with the ATF under the Prevent All Cigarette Trafficking (PACT) Act.
• USPS ban: the US Postal Service is prohibited from delivering vape products. You must use private carriers (UPS, FedEx, and approved regional carriers) that have agreed to PACT Act compliance.
• Age verification at delivery: every shipment requires the recipient to be verified as 21+ and to provide an adult signature at the door.
• Tax collection & reporting: you must collect and remit applicable state and local excise taxes, and file recurring sales reports to each destination state — monthly or quarterly depending on volume thresholds.

Layer 3 — State law: the 50-rulebook problem

Applies to: every business, but the complexity explodes when you ship across state lines.

• Excise taxes: most states tax vape separately — some per-milliliter of e-liquid, some per milligram of nicotine, some as a flat percentage. Rates change yearly.
• Flavor bans: California, Massachusetts, New Jersey, New York, Rhode Island, Vermont, Washington, and others restrict or ban flavored vape products. A product that's legal in your state can be a violation in the state you ship to.
• Licensing: retailers need state tobacco/vape licenses; some states require separate online-seller licenses and registration in every destination state.
• Online and shipping bans: a growing number of states prohibit online vape sales outright or ban shipping into the state (e.g., New York's online-sale restrictions).

The trap of "mostly compliant" A merchant who registers with ATF but uses USPS anyway, or verifies age at checkout but not at delivery, is still in violation. Each layer has its own inspectors, its own fines, and its own auditors. The compliance stack exists to close exactly these gaps — layer by layer, automatically.