Most retailers treat the point of sale as a speed tool: ring it up, take the payment, move to the next customer. In a business that sells alcohol, tobacco or vapor products, or cannabis, the register is also where several compliance controls live. The starting point is not a generic rule for every sale. It is to identify the age checks and records required for each product and jurisdiction, then configure appropriate controls.
This post separates what the rules require, using a few official examples, from the controls a retailer may choose to add as internal policy, and covers where the two drift apart in practice. It reflects the sources listed at the end as of September 26, 2026, and is general information rather than legal advice.
Start with what the rules actually require
Alcohol, tobacco and vapor, and cannabis retail share a basic shape: verify age as required, and retain only the records that are required or otherwise lawfully justified. The details underneath differ by product and jurisdiction. Three examples show how much:
- Tobacco, federal. The FDA’s retail requirements say to sell tobacco products only to customers 21 or older and to check the photo ID of everyone under 30 who attempts to buy one. The requirement is the check itself. Whether you must also record anything about it depends on other rules that apply to you, so confirm that before building a log.
- Cannabis, California. The Department of Cannabis Control says retailers must verify customers’ age by checking ID, and lists acceptable forms of ID. Separately, state law requires licensees to keep accurate records of commercial cannabis activity for at least seven years.
- Cannabis, Oregon. State law allows the Oregon Liquor and Cannabis Commission to require licensed retailers to use an age verification scanner in some circumstances. Information obtained that way may not be retained after verifying the person’s age, and may not be used for any other purpose.
The Oregon example matters because it runs the other way: a system that stores scanned ID data by default could conflict with the rule. Alcohol rules come from each state’s alcohol regulator and should be confirmed the same way. A retailer selling more than one regulated category cannot run one blended rule set across the store, because a configuration that is right for one product line can be wrong for the one next to it.
Requirements versus recommended controls
It helps to write down, for each product category and each jurisdiction, four things: the age check required, the records required and for how long, any limits on what may be collected or kept, and the additional controls the business has chosen as internal policy. Keeping those in separate columns stops a helpful internal habit from being mistaken for a legal requirement, and stops a legal requirement from being treated as optional. Our Standard Operating Procedure Template is one way to document the result.
Five controls worth reviewing
These are recommended controls, not universal legal requirements. Where a rule does apply, it sets the minimum, and the control should be configured to meet it.
Age-verification controls and any required evidence, configured for the applicable rules. A register prompt that asks the cashier to confirm the check was done helps the process happen consistently. Whether to capture anything more, such as a scan, depends on what the rules require and what they allow you to keep.
Reason codes and approvers on voids and refunds. A voided regulated sale with a blank reason field is a transaction whose reason and approval may be difficult to establish later. A required reason and an identified approver make the same void easy to explain.
Flags on regulated SKUs. Relying on staff to remember which items need a check does not scale past a handful of products or a single shift. When the system knows which SKUs are restricted, it can prompt or stop the sale regardless of who is at the counter.
Records retained for the required period. Set retention from the rules that apply, such as California’s seven-year requirement for cannabis records, and do not keep personal information longer than the rules or a lawful business need justify. A written retention policy only works if it has been applied to the actual system. One test: can the business produce a specific register’s transactions from a specific date without a scramble?
Overrides tied to an individual employee login. A shared manager code makes an override log much less useful. If every override traces back to “manager” instead of a person, the business cannot show who made the call or how often.
A register that rings up a sale correctly can still fall short of the rules for that product. Configure the controls to the requirement that applies, not to a general assumption.
Where the gap opens
Staff are often trained on age verification at hire and not again. Rules change, turnover replaces trained employees with new ones, and the gap between the written procedure and what happens at the counter can widen without anyone deciding it should. A hard stop that is overridden several times a shift without a recorded reason is a sign the control is being worked around. Our Training Matrix and Sign-Off Log helps track who has been trained and when refreshers are due.
Multi-site retailers can see a second version of the problem. Registers configured independently at each location, sometimes by different installers at different times, can end up enforcing different standards under the same brand. A new SKU added without a compliance check can go live as an unrestricted item. Our article on standardizing operations across multiple sites covers how to keep one method while reflecting local rules. Cannabis retailers also have state track-and-trace reporting to reconcile, covered in our article on multi-state cannabis compliance.
Building a system that holds up under review
Start with one configuration standard for every register and site, with documented settings for each product category and jurisdiction, so the controls a customer meets do not depend on which location they walk into. Review override activity on a schedule you set, rather than only after a problem, and route new SKUs through a compliance check before they go on sale.
From time to time, pull a sample of transactions and compare them with what the configuration is supposed to enforce, the way you would test any other control. The Monthly Site Walk-Through can carry that check. Tie training to how the register is actually used at the counter, and refresh it when rules or systems change.
Sources
- Selling Tobacco Products in Retail Stores, U.S. Food and Drug Administration (accessed September 26, 2026)
- Retail, California Department of Cannabis Control (accessed September 26, 2026)
- California Business and Professions Code section 26160, California Legislative Information (accessed September 26, 2026)
- Oregon Revised Statutes chapter 475C, including ORS 475C.109, Oregon State Legislature (accessed September 26, 2026)
Review how your point of sale handles regulated products
SPL Management reviews point-of-sale configuration, staff procedure, and transaction records as part of Business Operations Management for licensed retailers. A consultation is a chance to discuss how your registers are set up today and whether a scoped review would be useful.
General information only, current as of the last review on September 26, 2026. Rules vary by jurisdiction and change often. This is not legal, tax, or real estate advice; confirm current requirements with the regulator or a qualified professional before acting. How we write and review articles.
Keep reading
Operations
How to Set an Internal Compliance Review Schedule
· 5 min read
Operations
Vendor and Supplier Vetting for Regulated Industries
· 6 min read
Operations
One Playbook, Every Location: Standardizing Operations Across Multiple Sites
· 5 min read
