1. Map your exposure. Write down: do you sell in-store, online, or both? Do you ship, and to which states? How many locations? Your answers determine which layers apply. In-store only = FDA + state. Shipping = FDA + PACT + state.
2. Register everything. FDA tobacco retailer registration; ATF PACT Act registration (before the first shipment); state licenses in every state you operate or ship to. Our step-by-step PACT registration guide walks through the ATF process.
3. Automate age verification. In-store: POS ID scanning. Online: checkout age check that verifies 21+ against databases/KYC. Shipping: adult-signature at delivery. One vendor can often cover checkout + delivery; in-store is usually a POS feature.
4. Automate tax & PACT reporting. Choose PACT Act software that pulls order data from your checkout, calculates excise/sales tax per destination state, and generates the reports on schedule. Set the calendar once; let it remind you.
5. Set a monitoring rhythm. Monthly: reconcile reports. Quarterly: review state law changes and FDA action lists. Yearly: re-verify every SKU's PMTA status and renew every license. A compliance calendar is the cheapest tool you own.

Common mistakes to avoid Using USPS for vape shipments (banned — carries statutory penalties), treating age verification as a checkout-only feature (delivery matters), ignoring flavor bans in destination states, and assuming your processor handles PACT reporting (it doesn't). For the full list, see our "10 vape compliance mistakes that will get you fined" checklist.