Your First Shopify Sale Is Also Your First Risk Check

I have been reading Shopify community threads about store terminations for a year, and last week I sat down and counted 22 unique cases from 2024 through July 2026. Some are the ones you would predict: a merchant selling counterfeit tools, a dropshipper importing branded product from AliExpress. Most are not. A custom jeweler shipped a $650 handmade piece and got the termination email the next morning. A Squarespace merchant with $66,000 a year in revenue migrated over and lasted one week. A merchant followed a Shopify support agent's explicit instructions and then had their appeal rejected for the same setup the agent walked them through. One commenter, still active in the threads eight months post-termination, has neither their account back nor their payout released.

The advice these merchants heard on the way in is the advice I used to give: read the Acceptable Use Policy, list clean products, keep chargebacks low, and you will be fine. It is still true on average. It is now the wrong advice to plan around for any specific new merchant, because a shopify store termination is not, in practice, a punishment for policy violation. It is a risk-scoring outcome. That changes what you should do before your first sale.

The 22 threads I read all end the same way

The merchant wakes up to an email using the same 47 words as every other termination email ("activity that is not, or that we suspect is not, a legitimate commerce practice..."). The storefront goes dark. Admin is locked or read-only. Pending customer orders cannot be fulfilled through Shopify's tools. Funds are held for 120 or 365 days depending on the case, with no explanation of which number applies. The merchant appeals. The appeal is denied with the same second boilerplate paragraph ("for security and privacy reasons we are unable to divulge the results of our reviews"). No specific reason is given. No SLA exists for a re-review. Live chat support is not accessible, because live chat requires an active store session.

The specific trigger is different every case, and this is the part the AUP advice does not cover. In April 2026 a cluster of terminations fired within one hour of the merchant adding a new bank account for payouts. In November 2024 one fired after four months of clean operation, apparently after the merchant linked Google Ads and Google Merchant Center. In March 2024 one fired for delayed document submission, not for the store's contents but for the merchant not responding fast enough to a document request. In April 2025 a merchant was terminated before their store had ever launched. In November 2025 another was terminated between the moment they submitted the Shopify Payments activation form and the moment they listed a product.

The pattern that connects these cases is timing. When the automated risk model happens to look at your account matters more than what the account contains.

Why "just follow the AUP" misses the point

The AUP tells you what is prohibited. It does not tell you what triggers a review, and it does not tell you what the risk model weighs when it does. The most useful thing I have ever read on this topic is a December 2025 comment from a former Shopify employee: pre-launch verification is skipped by design, to keep Shopify Payments onboarding frictionless relative to Stripe or Braintree. Risk checks fire after your first sale. A second former Shopify employee, a Plus support engineer, added that even legitimate API and headless usage patterns on sub-Plus plans can look "off-book" to the risk system and trigger a shopify store termination independent of what the merchant is actually selling.

You cannot pre-clear that check by re-reading the AUP. The AUP is the wrong document to plan around. What triggers a termination is a model that decided, based on some combination of bank details, product category, cart velocity, ad traffic pattern, IP geography, or something neither you nor Shopify's frontline support can see, that your account is more risk than it wants. That model has no published inputs, no appeal-to-human path, and no post-decision explanation. Telling a new merchant "just do not violate the AUP" is like telling a driver "just do not crash" while withholding the location of the speed cameras.

Most merchants are fine most of the time. Every new store is not doomed. But on the day a shopify store termination email arrives, no amount of AUP-reading beforehand will have prevented it, and the merchant will be trying to fulfill customer orders with no admin access. That is the scenario worth planning for.

The termination readiness kit I walk new merchants through

None of the following reduces the probability of a shopify store termination. All of it reduces the damage if one arrives.

1. Register your domain through a registrar other than Shopify. Namecheap, Cloudflare Registrar, Porkbun, any of them. If Shopify is your registrar and your account is locked, you cannot change DNS from the Shopify admin, and you cannot serve customers from an alternative storefront on your domain until a transfer completes. If your domain lives at Namecheap, you can point it at a WooCommerce or Squarespace instance the same afternoon.
2. Set up an alternative payment processor account before you need it. A Stripe account with your legal business details, verified and ready. Highest ratio of low cost to high recovery value of anything on this list. It takes an hour. It sits dormant until it does not.
3. Export your customer, order, and product data on a weekly schedule. Settings > Data export inside Shopify admin, download to local storage. If your admin drops into a lockout state, whatever you exported last is what you have to work with when customers reach out.
4. Keep a plain-text list of pending order commitments, with customer email addresses, outside Shopify. A Google Sheet or Notion doc will do. On the day the email lands, the first thing you need is a way to reach open customers directly.
5. Do not use Shopify Payments as your only merchant record with your bank. If your bank sees Shopify Payments as your sole processor and Shopify freezes your payouts for 365 days, you have no historical processing volume to show when applying for a replacement.

I sit with a lot of solo merchants in help1's expert chat, and when the conversation turns to "how do I bulletproof my store against Shopify shutting me down without warning," the honest answer is that you cannot, and the practical answer is those five items. It is the closest thing to a defensible position I have found.

For merchants who want to understand what Shopify actually protects them against on the chargeback side, that has a different shape: I wrote about it in what Shopify Protect actually covers. Protect covers a chargeback dispute cost. It does not cover an automated account termination. They are different failures and merchants sometimes conflate them.

When the conventional advice does work

If you sell supplements, firearms accessories, CBD, vape hardware, or anything Shopify's own policy or a state attorney general's letter can plausibly list, the AUP is describing your actual risk surface and reading it carefully is the first thing you should do. In the June 2026 vape category enforcement, the trigger was categorical: Shopify received coordinated pressure from 25 state attorneys general plus New York City, Washington DC, and Puerto Rico, and closed the entire ENDS category with a two-week window. There was no appeal path, because the enforcement unit was the category, not the individual merchant. If you sell in an adjacent regulated category (kratom, hemp, adult products), your risk is closer to a policy change at Shopify HQ than to a risk-model false positive at 3am. The readiness kit still applies, and a shopify store termination in that scenario is a category-scale event that no individual clean-record filing will unwind.

And the AUP is right in the sense that following it will keep you out of a lot of trouble that has nothing to do with the Merchant Trust team. Chargeback rates matter. Product-category rules matter. Being able to answer "who is your supplier and where is the paperwork" in an hour matters.

What the AUP will not do is tell you when the automated system will decide, based on inputs neither Shopify nor you can see, that your risk score crossed a threshold. That decision is not in the document you were told to read.

Closing take

I have stopped writing about how Shopify should run its risk system, because merchants reading me cannot fix it. What they can do is stop treating the first sale as the finish line and start treating it as the first audit.