What Cannabis Related Businesses (CRBs) need to know about banking cannabis
Financial Institutions have a reputation for being cautious when it comes to taking on risk, and for good reason. They are involved in one of the most highly regulated industries in the U.S., subject to numerous financial laws and regulations. In addition, they are subject to periodic examinations by their prudential regulators who examine all aspects of their business, following which they are presented with a kind of report card, providing ratings for the following categories: capital adequacy, asset quality, management, earnings, liquidity, and sensitivity. A rating of one is considered the best, and a rating of five is considered the worst. As part of their examination, examiners take a close look at how financial institutions are fulfilling their obligations under the Bank Secrecy (BSA) and its corresponding regulations. The BSA work that financial institutions perform include “knowing your customer” (or KYC), which includes initial and ongoing due diligence as well as filing Currency Transaction Reports and Suspicious Activity Reports. Failure by a financial institution to carry out its BSA obligations can result in a downgrade in its management rating, something no financial institution wishes to see.
The BSA work financial institutions carry out has always been considered high-risk. The work is often labor intensive, and regulators can impose hefty fines and sanctions against financial institutions – and their employees – if they determine the financial institution’s BSA work is unsatisfactory.
While BSA work is considered high-risk, this risk is amplified if a financial institution decides to offer financial services to a cannabis-related business. Why is this? First, because cannabis is still listed as a Schedule 1 substance under the Controlled Substances Act, there is a technical argument that a financial institution is “aiding and abetting” in the commission of a federal crime when it offers financial services to a cannabis related business. Second, while the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (or FinCEN) issued guidance for financial institutions electing to bank cannabis-related businesses in 2014, the guidance is less than clear in certain areas. Unlike most regulations, there are no definitions or staff commentary to guide BSA Officers or attorneys in interpreting the guidance. Because of this lack of clarity, there is a risk that examiners may interpret the FinCEN Guidance inconsistently from one exam cycle to the next or from one financial institution to the next. Furthermore, the guidance is just that: guidance. It is not codified in statute or regulation.
What financial institutions need to know about CRBs
The days of the “stoner-owner” are long gone. Like financial institutions, CRBs are subject to some of the strictest regulatory compliance regimes faced by any industry. Prior to receiving licensure, CRBs must be able to demonstrate that they can and will comply with the regulations to which they are subject. They therefore understand the risks and pitfalls associated with operating in a highly regulated environment and that the risks and time spent in avoiding these pitfalls come at a cost. Examples of the requirements CRB’s are subject to are as follows:
(a) Seed-to-Sale Tracking
Most states require cannabis businesses to use seed-to-sale tracking software, such as METRC, to track the cannabis through all stages of growth, processing and sale. Each plant is tagged with a unique identifier once it reaches a certain stage of growth. After that, everything that happens to that plant – harvest, drying/curing, packaging, transportation, and retail sale – is recorded in the seed-to-sale tracking software. This makes diversion of product very difficult. Being subject to seed- to-sale reporting requires CRBs to acquire a level of administrative sophistication.
(b) Surveillance/Security requirements
Financial Institutions may be hesitant to work with CRBs due to the perception that these businesses are not physically secure. There may be a concern that these businesses may be targets for criminals. In fact, CRBs are required by regulation to adopt effective security measures. The exact requirements vary by state. For example, in Massachusetts, which has a robust regulatory regime, cameras are required everywhere there is cannabis or cannabis products. Destruction of unusable cannabis must be filmed and must involve at least two employees. Security cameras are also required to record any nearby activity outside of the facility, and must be powerful enough to capture a person’s face in the dark from several yards. This video footage must be stored for 90 days and made available to regulators upon request.
(c) Record-keeping Requirements
CRBs often must keep certain documents at their office headquarters – employee files, background check results, financial documentation. These records must be available for inspection by the state agency at any time.
(d) Product Testing
Nearly all state programs require some testing of the product, whether by the business that produced it or an independent laboratory. This helps to ensure that consumers are not harmed by consumption of the product.
(e) License Renewal Applications
Final CRB licenses are issued for a period of one year or more. To renew a CRB license, CRBs are required to provide information on its operations and compliance with the agency’s regulations. There is also typically a fee involved. This renewal process ensures that the state agency “checks in” on the CRBs periodically, and that the CRBs are mindful of the fact that they will have to submit certain information each year.
Misplaced concerns about CRB Owners
Many outside the cannabis industry wrongly believe that cannabis business owners wish to disregard the rules which their businesses are subject to, and consider these rules as nothing but a burden. Rather, the individuals who work in the cannabis industry – particularly those who may have had origins in the unregulated market – strongly desire to operate a state-legal business, and understand that compliance with regulation is part and parcel of having that status.
Operating in the unregulated market carries many grave risks, from both a legal and financial perspective – and CRB owners know this. The risk of getting robbed or not getting paid is ever present. Random violence or incarceration are also real risks. As such, the ability to operate a CRB without those risks is so highly valued that the vast majority of CRB owners will do what the regulators require of them in order to operate, not because they have to, but because they know these requirements make sense for their businesses.
Abiding by these regulations also carries an additional – and very important – benefit for CRB’s: the ability to operate their business, like any other business, using a bank or credit union. Having access to banking services is extremely desirable, due to the security risks and administrative complications of running a cash-only business. The vast majority of cannabis business owners will very willingly comply with what financial institutions require of them because they know that these financial institutions have chosen to operate in a very risky and highly regulated space.
Adrienne Dean is a partner at Cogent Law Group specializing in cannabis law. She may be reached at
(978) 770-8163 and at
adean@cogentlaw.com . Chris Van Dyck is a partner at Cogent Law Group specializing in cannabis banking law. He may be reached at
(207) 844-0196 and at
cvandyck@cogentlaw.com.
Phone: 202-644-8880
Email: info@cogentlaw.co
Address: 2001 L Street Northwest Suite 500 Washington, DC 20036