This checklist mirrors what a compliance audit checks. Work through it with your team — tick items as you go, then print or save this page as PDF for your compliance binder.
Before you open
- ☐ Register with FDA as a tobacco retailer (required to sell any tobacco/vape product)
- ☐ Register with ATF under the PACT Act if you will ship any products
- ☐ Obtain state tobacco/vape retailer license for every state you operate or ship to
- ☐ Obtain local business and tobacco permits (city/county)
- ☐ Check your state's flavor-ban status — do not stock banned products
- ☐ Confirm every product you sell has FDA marketing authorization, a pending application, or grandfathered status — keep the list
Every sale
- ☐ Verify customer is 21+ before the transaction (ID scan in-store; age check at online checkout)
- ☐ No sales to anyone unable to produce valid ID — no exceptions
- ☐ For deliveries: verify age at the door and obtain adult signature (PACT Act requirement)
- ☐ Record retention: keep sale and age-verification logs per your state's retention window
Monthly / quarterly
- ☐ File PACT Act sales reports to destination states (frequency depends on volume thresholds)
- ☐ Remit state excise tax on vape products (per-mL or per-nicotine where applicable)
- ☐ File state sales tax returns
- ☐ Reconcile processor settlement reports against your POS reports
Yearly / when regulations change
- ☐ Review state law changes: tax rates, flavor bans, online-sale bans, shipping bans
- ☐ Re-verify PMTA status of every SKU you sell (enforcement actions change product availability)
- ☐ Renew licenses and permits on their actual renewal dates (set reminders)
- ☐ Review your processor agreement — confirm you're still within your merchant category
Tip: most compliance tools (see the compliance stack guide) automate monthly reports and keep an audit trail — the checklist above is your manual backstop.
