What Biden’s Cannabis Policy Review Means for the Industry

What Cannabis Related Businesses (CRBs) need to know about banking cannabis Financial Institutions have a reputation for being cautious when it comes to taking on risk, and for good reason. They are involved in one of the most highly regulated industries in the U.S., subject to numerous financial laws and regulations. In addition, they are subject to periodic examinations by their prudential regulators who examine all aspects of their business, following which they are presented with a kind of report card, providing ratings for the following categories: capital adequacy, asset quality, management, earnings, liquidity, and sensitivity. A rating of one is considered the best, and a rating of five is considered the worst. As part of their examination, examiners take a close look at how financial institutions are fulfilling their obligations under the Bank Secrecy (BSA) and its corresponding regulations. The BSA work that financial institutions perform include “knowing your customer” (or KYC), which includes initial and ongoing due diligence as well as filing Currency Transaction Reports and Suspicious Activity Reports. Failure by a financial institution to carry out its BSA obligations can result in a downgrade in its management rating, something no financial institution wishes to see. The BSA work financial institutions carry out has always been considered high-risk. The work is often labor intensive, and regulators can impose hefty fines and sanctions against financial institutions – and their employees – if they determine the financial institution’s BSA work is unsatisfactory. While BSA work is considered high-risk, this risk is amplified if a financial institution decides to offer financial services to a cannabis-related business. Why is this? First, because cannabis is still listed as a Schedule 1 substance under the Controlled Substances Act, there is a technical argument that a financial institution is “aiding and abetting” in the commission of a federal crime when it offers financial services to a cannabis related business. Second, while the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (or FinCEN) issued guidance for financial institutions electing to bank cannabis-related businesses in 2014, the guidance is less than clear in certain areas. Unlike most regulations, there are no definitions or staff commentary to guide BSA Officers or attorneys in interpreting the guidance. Because of this lack of clarity, there is a risk that examiners may interpret the FinCEN Guidance inconsistently from one exam cycle to the next or from one financial institution to the next. Furthermore, the guidance is just that: guidance. It is not codified in statute or regulation. What financial institutions need to know about CRBs The days of the “stoner-owner” are long gone. Like financial institutions, CRBs are subject to some of the strictest regulatory compliance regimes faced by any industry. Prior to receiving licensure, CRBs must be able to demonstrate that they can and will comply with the regulations to which they are subject. They therefore understand the risks and pitfalls associated with operating in a highly regulated environment and that the risks and time spent in avoiding these pitfalls come at a cost. Examples of the requirements CRB’s are subject to are as follows: (a) Seed-to-Sale Tracking Most states require cannabis businesses to use seed-to-sale tracking software, such as METRC, to track the cannabis through all stages of growth, processing and sale. Each plant is tagged with a unique identifier once it reaches a certain stage of growth. After that, everything that happens to that plant – harvest, drying/curing, packaging, transportation, and retail sale – is recorded in the seed-to-sale tracking software. This makes diversion of product very difficult. Being subject to seed- to-sale reporting requires CRBs to acquire a level of administrative sophistication. (b) Surveillance/Security requirements Financial Institutions may be hesitant to work with CRBs due to the perception that these businesses are not physically secure. There may be a concern that these businesses may be targets for criminals. In fact, CRBs are required by regulation to adopt effective security measures. The exact requirements vary by state. For example, in Massachusetts, which has a robust regulatory regime, cameras are required everywhere there is cannabis or cannabis products. Destruction of unusable cannabis must be filmed and must involve at least two employees. Security cameras are also required to record any nearby activity outside of the facility, and must be powerful enough to capture a person’s face in the dark from several yards. This video footage must be stored for 90 days and made available to regulators upon request. (c) Record-keeping Requirements CRBs often must keep certain documents at their office headquarters – employee files, background check results, financial documentation. These records must be available for inspection by the state agency at any time. (d) Product Testing Nearly all state programs require some testing of the product, whether by the business that produced it or an independent laboratory. This helps to ensure that consumers are not harmed by consumption of the product. (e) License Renewal Applications Final CRB licenses are issued for a period of one year or more. To renew a CRB license, CRBs are required to provide information on its operations and compliance with the agency’s regulations. There is also typically a fee involved. This renewal process ensures that the state agency “checks in” on the CRBs periodically, and that the CRBs are mindful of the fact that they will have to submit certain information each year. Misplaced concerns about CRB Owners Many outside the cannabis industry wrongly believe that cannabis business owners wish to disregard the rules which their businesses are subject to, and consider these rules as nothing but a burden. Rather, the individuals who work in the cannabis industry – particularly those who may have had origins in the unregulated market – strongly desire to operate a state-legal business, and understand that compliance with regulation is part and parcel of having that status. Operating in the unregulated market carries many grave risks, from both a legal and financial perspective – and CRB owners know this. The risk of getting robbed or not getting paid is ever present. Random violence or incarceration are also real risks. As such, the ability to operate a CRB without those risks is so highly valued that the vast majority of CRB owners will do what the regulators require of them in order to operate, not because they have to, but because they know these requirements make sense for their businesses. Abiding by these regulations also carries an additional – and very important – benefit for CRB’s: the ability to operate their business, like any other business, using a bank or credit union. Having access to banking services is extremely desirable, due to the security risks and administrative complications of running a cash-only business. The vast majority of cannabis business owners will very willingly comply with what financial institutions require of them because they know that these financial institutions have chosen to operate in a very risky and highly regulated space. Adrienne Dean is a partner at Cogent Law Group specializing in cannabis law. She may be reached at (978) 770-8163 and at adean@cogentlaw.com . Chris Van Dyck is a partner at Cogent Law Group specializing in cannabis banking law. He may be reached at (207) 844-0196 and at cvandyck@cogentlaw.com .

Quite apart from increasing your financial institution's revenue, providing banking services to cannabis businesses makes a lot of sense for a number of public policy reasons. First and foremost, your financial institution is enhancing its community's safety by providing a secure place for these businesses to deposit their money. Cannabis businesses are cash intensive, making them ripe targets for robbery or employee theft. If getting into the canna-banking space, I would recommend being open with your local police department about your program. They will likely thank you for making the community safer and easing their burden. There is a good chance your branches may even benefit from a few more local police drive-bys. Second, as we all know, it is very difficult for any business to function without a bank account. Operating on a cash-only basis is not only dangerous, but time-consuming and inefficient. By providing financial services to these businesses, your financial institution is creating a more business-friendly environment. Therefore, your decision to bank cannabis will be entirely consistent with state and local initiatives to support businesses. Furthermore, by following the 2014 FinCEN guidance, your institution is providing valuable data to regulators and law enforcement agencies. Following the money trail is often the key to a successful regulatory or law enforcement investigation. The filings your institution makes and the financial records it has, provide regulators and law enforcement with key tools in their investigations. Related to this, by banking cannabis, your financial institution is incentivizing these businesses to be more fiscally accountable by creating a money trail of their revenues and expenses. Many financial institutions are worried that cannabis banking will bring reputational risk. It is important to remember that, if a financial institution decides to bank cannabis, it is not taking a position "for" cannabis itself. Rather, it is taking a position in favor of greater public safety, assisting law enforcement investigations, and sound regulation. A financial institution can be "for" cannabis banking while not necessarily being "for" cannabis. These are talking points to have with your employees and have ready at hand if any customers ask why your financial institution has decided to get into this space. At the financial institution where I previously worked, we found that banking cannabis was a reputational enhancement, not only with our cannabis customers but also with our non-cannabis customers. Chris Van Dyck is a partner at Cogent Law Group. He provides external general counsel services to financial institutions and specializes in cannabis banking. He may be reached at cvandyck@cogentlaw.co and at (207) 844-0196 .

The Corporate Transparency Act (CTA) introduces a new requirement for most business entities (corporations, LLCs, partnerships, etc.) to submit names, contact information, and identification for their beneficial owners to the Financial Crimes Enforcement Network of the U.S. Department of Treasury (FinCEN). The CTA has significant implications for entities falling under its scope and failure to comply can lead to fines and civil penalties. For more information regarding the CTA, please visit www.fincen.gov/boi . There are several exceptions, most notably, CTA reporting does not apply to any company that is registered with FinCEN. WHO NEEDS TO FILE: A Reporting Company must report its name, business address, jurisdiction of formation, and EIN. Additionally, the Beneficial Owner Information must be filed for anyone who exercises substantial control over the Reporting Company or owns at least 25% of the company. A Beneficial Owner is an individual who directly or indirectly through any contract, arrangement, understanding, relationship, or otherwise EITHER exercises Substantial Control over the Reporting Company or Owns at least 25% of the ownership interests of the Reporting Company. There are several exceptions for a Beneficial Owner that include: a Beneficial Owner cannot be a minor child, an individual acting as a nominee, intermediary, custodian, or agent on behalf of another individual, or an individual acting solely as an employee of the Reporting Company. DEADLINES: Generally, entities formed in 2024 have only 90 days to submit their information. However, entities formed before 2024 have until January 1, 2025 to file. As noted below, we recommend prompt and early action. IDENTITY THEFT/FRAUD ALERT: FinCEN has issued a warning that criminals are using the CTA in fraudulent efforts to obtain personal information. Fraudulent correspondence about CTA may be titled "Important Compliance Notice '' and may ask the recipient to click on a URL or to scan a QR code. These e-mails or letters are fraudulent. FinCEN does not send unsolicited requests for CTA information. You should not click on links, scan QR codes, or provide personal information or copies of identification documents to anyone unless you know who they are and have asked them to handle your FinCEN submissions. PENDING COURT CHALLENGE: A federal court decision in Alabama held the CTA exceeds the authority of Congress and is unconstitutional. The decision had limited scope. In response FinCEN is limiting enforcement of the CTA against the National Small Business Association and its members. Enforcement continues against all other entities. Although courts can and do issue surprising decisions, a long line of Supreme Court cases give the federal government significant power to regulate commerce and financial transactions and combat money laundering. Our prediction is that this decision will eventually be overturned and the CTA will continue in effect. WE RECOMMEND PROMPT ACTION: Even if your entity was formed before 2024 and has the whole year to file, we recommend starting the process sooner, preferably by June 15, to ensure timely and accurate reporting. Prompt action will avoid possible system overloads towards the end of 2024 as millions of companies and individuals realize they face an urgent deadline. OVERVIEW OF THE FILING PROCESS: Beneficial ownership information refers to identifying information about the individuals who directly or indirectly control a company. Definitions of “beneficial owner” are provided on the FinCEN site. There is no filing fee, and all submissions must be completed through FinCEN’s BOI E-Filing Website ( https://boiefiling.fincen.gov ). In general, the information needed for the entity is: Full legal name Any doing business as (DBA) Complete current US address Jurisdiction of formation For a foreign reporting company, jurisdiction of first registration IRS Taxpayer Identification Number (SSN or EIN as appropriate) The necessary information for each beneficial owner is: Full legal name Date of Birth Complete current address Unique identifying number and issuing jurisdiction from one of the following non-expired documents: (1) US passport; (2) identification document issued by a State, local government, or Indian Tribe issued for the purpose of identifying the individual; (3) State-issued driver’s license; (4) if none are available, a foreign passport; and A picture of the identifying document. HOW TO GET ASSISTANCE: if you have any questions or concerns, please reach out. Cogent Law Group stands ready to answer questions, and many clients are asking us to handle the CTA submission on their behalf. Naturally, we will not take any action without your instructions and specific authorization, so if we do not hear from you, we will assume that you are independently handling CTA compliance.