Keeping Financial Institutions on Track in Cannabis Banking: How third-party service providers power compliance, risk management, and sustainable growth

Cannabis banking didn’t become “normal” just because more states legalized it. The operating reality for banks and credit unions is still defined by regulatory ambiguity, examiner variability, and a compliance framework that has not kept pace with market complexity.

In a recent discussion, Chris Van Dyck (Cogent Law) and Adam Crabtree (CEO, NCS Analytics) made a blunt point that too many institutions learn the hard way:

Cannabis programs don’t fail because the risk is unmanageable. They fail because the institution tries to manage it with generic tools, generic assumptions, and generic resources.

The Big Picture: Why This Conversation Matters Now

Two things are happening at the same time:

• More institutions are entering cannabis banking (often attracted by deposits, fee income, and the “next big shift” headlines).
  
• The compliance burden is not shrinking and may actually expand as hemp, rescheduling chatter, and examiner expectations collide.
  

The result is predictable: pricing pressure increases, margins compress, and only the most operationally efficient programs win.

Third-Party Providers: Not a Shortcut, a Control System

Banks love to pretend that using third parties is “outsourcing.” That’s the wrong mental model.

In cannabis banking, the right third-party provider is an operational control system that helps you:

• Improve consistency under uneven examiner expectations
  
• Reduce manual workload without lowering standards
  
• Detect diversion, inversion, sales suppression, and other red-flag behavior faster
  
• Scale accounts per compliance officer without scaling risk
  

Or, in plain English: you don’t buy software. You buy time, signal, and defensibility.

Rescheduling: The Market Is Overreacting, Compliance Isn’t Changing Overnight

The conversation touched on a recurring problem: rescheduling is widely misunderstood.

Even if cannabis moves to Schedule III:

• FinCEN guidance doesn’t automatically change
  
• Enhanced due diligence remains
  
• Ongoing monitoring remains
  
• SAR obligations remain
  
• Examiners will still expect a robust, documented program
  

Where rescheduling may matter most in the near term is economic, not regulatory:
280E relief can improve client cash flow, stability, and balance sheets, which may expand lending appetite, but it does not erase the compliance load.

Bottom line: expect perception shift, not instant permission.

The Real Risk Model: Compliance Risk Is the Big Circle

Chris framed cannabis banking risk in a way institutions should steal and put into board materials:

1. Regulatory / compliance risk (largest and most consequential)
   
2. Legal risk (often discussed, rarely realized in practice)
   
3. Reputational risk (usually exaggerated; the real reputational damage is a messy exit)
   

The point isn’t that legal or reputational risk is irrelevant. The point is that institutions routinely overweight the wrong risks, then underinvest in the one that actually triggers findings.

Hemp: The “Lower Risk” Myth Is Collapsing

If your institution treated hemp as “the safer cousin,” this is where reality bites.

The discussion highlighted how quickly hemp can turn into a regulatory wildcard, especially for intoxicating hemp products (IHP):

• Many IHP businesses are interstate
  
• State cannabis regimes are largely intrastate
  
• If interstate commerce gets restricted, operating models break
  
• Banks can end up serving businesses that are neither clearly federally legal nor cleanly state-regulated
  

Chris’s recommendation was practical and aggressive (as it should be):

• Inventory your hemp/IHP portfolio
  
• Segment intrastate vs interstate exposure
  
• Treat uncertainty as risk now, not after the deadline
  
• Consider pausing onboarding if you can’t defend the exposure
  

If you’re thinking, “that sounds harsh,” good. Banking is not a feelings-based industry.

Deposits are easy to unwind. Loans are not. That’s why Adam flagged the issue most teams avoid until the situation is already ugly: many institutions may have active credit exposure tied to the hemp/IHP ecosystem, commercial real estate, equipment financing, facilities, and other forms of “paper” that simply can’t be shut off with a notice letter and a 30-day exit.

The right response isn’t panic. It’s disciplined, immediate risk work. Loan covenants need to be reviewed with specialized counsel, not a generic internal read that treats this like any other industry. At the same time, institutions should be stress-testing portfolios that rely on these business models, because repayment capacity and collateral value can deteriorate long before regulators issue anything “official.” The most important move is also the simplest: start borrower conversations early, while there is still room to adjust terms, restructure, or plan orderly exits.

That’s how you prevent a compliance question from quietly becoming a balance-sheet problem.

What Differentiates NCS Analytics (and Why It Matters to Examiners)

NCS positioned itself differently from typical “industry vendors”:

• They work with government agencies and financial institutions (not the industry being analyzed)
  
• Their system is event-driven, processing massive data volumes and highlighting where attention is needed
  
• They emphasized model validation, a key concept examiners respect because it mirrors bank model governance
  

Translation: the provider can help you prove your program is controlled, not improvised.

Pricing Pressure Is Real, Efficiency Is the Only Durable Answer

More competition is coming. Whether it’s rescheduling headlines or just boards chasing deposits, the space won’t stay “few players, high fees” forever.

As pricing compresses, institutions have only two choices:

• Become more efficient and defensible, or
  
• Exit and become the industry’s “last bad breakup” (which is the one reputational risk that actually lands)
  

What Proactive Institutions Are Doing Now

Institutions taking cannabis risk seriously are already:

• Using third-party analytics to prioritize risk instead of drowning in manual review
  
• Building documentation to survive examiner inconsistency
  
• Segmenting hemp exposure by jurisdiction + funds flow
  
• Preparing board and customer communications so rescheduling doesn’t trigger unrealistic expectations
  
• Seeking specialized cannabis banking counsel (because “general banking advice” is where mistakes are born)
  

Waiting for “clarity from Washington” is not a plan. It’s a posture.

Cannabis banking is no longer about whether institutions can participate,it is about whether they can operate with discipline, efficiency, and defensibility in a fragmented regulatory environment. 

As competition increases and margins tighten, programs built on generic assumptions will struggle. Institutions that invest in purpose-built controls, specialized expertise, and data-driven oversight will be the ones positioned not just to survive, but to grow responsibly as the market continues to evolve.