Between the two of us, we have spent more than a decade inside financial institutions building cannabis banking programs from the ground up, overseeing these programs, auditing them, and advising boards on the risks and opportunities associated with them. The first lesson we share with every institution entering this space is the same. Cannabis banking is a program that only works when governance, compliance infrastructure, and commercial ambition work together as one team.
That alignment does not happen by accident. It starts with a board that has been educated, not just informed. It continues through a compliance framework built on the 2014 FinCEN Guidance. It then matures into a program that generates real revenue once the institution is ready to take the brakes off in the right places.
By the Numbers
- 12 years. Since the 2014 FinCEN Guidance first gave financial institutions a workable framework for banking cannabis.
- 3 major circles of risk. BSA and compliance, reputational, and legal.
- Quarterly board reporting. The minimum cadence we recommend for reporting an active cannabis program to the board.
- $50K to $75K. The typical range of initial unsecured cannabis lending we see institutions start with before moving into larger commercial loans.
The Board Conversation Has to Come First
The board conversation has to come first, particularly regarding the various risks associated with cannabis banking and the balance needed to sufficiently mitigate those risks while maintaining a sustainable and profitable program.
Before any account is opened, the board needs to understand what it is signing up for. That means a real risk appetite discussion is essential to balance compliance and growth in the cannabis industry. What do our cannabis regulators’ licensing processes look like, and how can they be used to meet financial institutions’ due diligence requirements? Are we starting in-state only, or eventually open to multi-state operators? What are we willing to say no to? Do we have an exit strategy if needed?
These conversations about cannabis banking solutions need to happen early, and they need to be documented in the board minutes, because those minutes are among the first things examiners ask to see.
When we frame the risks for a board, we describe three circles:
- BSA and compliance risk. The largest of the three. Failure to follow the FinCEN Guidance can drive a CAMELS BSA rating from satisfactory to unsatisfactory and drag the management rating down with it.
- Reputational risk. Smaller, and in our experience it continues to shrink every year. Standing behind the cannabis industry, particularly in agricultural communities, often generates more member loyalty than it costs.
- Legal risk. Again, a smaller risk. No federal or state prosecutor has ever gone after a financial institution solely for banking cannabis, and the policy arguments for banking the industry are pro-law enforcement.
Directors’ and officers’ insurance should still be confirmed at the outset, since cannabis remains federally illegal.
Take the Long View, Because Revenue Follows Infrastructure
Institutions that take the long view and are willing to adapt their programs are most likely to succeed in cannabis banking. When we first built these programs, revenue came almost entirely from fee income. Today, the picture has shifted. There is value in having cannabis deposits and in the liquidity those deposits provide. Furthermore, these depository relationships can form the basis for lending relationships that may follow.
That patience also unlocks the banking solutions that make a cannabis program sustainable. Early programs get built with “belts and suspenders.” Examples include monthly site visits to ensure compliance with banking regulations and regular collection of documents related to cash handling.
As the program matures, institutions learn which risks matter and which controls are generating paperwork without generating protection. There is nothing wrong with allowing your cannabis banking program to evolve, provided that your board approves those changes and you can support them with your examiners.
The 2014 FinCEN Guidance
The FinCEN Guidance is guidance, not regulation, but it shapes the landscape for cannabis-friendly banks. It tells institutions to file Marijuana Limited, Priority, and Termination SARs, and to include the right information in the narrative. What it does not do is define every term or provide official staff commentary, which means examiner interpretations have evolved over the last twelve years as best practices have emerged across institutions.
That is also where a dedicated cannabis auditor earns their keep. A general BSA auditor may touch a few Marijuana Limited SARs, but it will not provide a deep dive into areas such as onboarding, enhanced due diligence, ongoing monitoring, and cash controls with the depth that an active cannabis program demands. At this point, a standalone cannabis audit is industry best practice, not a premium add-on.
Authority, Accelerators, and Brakes
Every cannabis banking program carries a built-in tension between business development and BSA obligations. The business side wants more cannabis accounts to expand its reach. The BSA side wants to ensure full compliance in such a high-risk area. The structure that works best, in our experience, is a committee that brings together business development, finance, and BSA or risk leadership to review a cannabis banking program from all angles.
The BSA officer needs real independence on SAR decisions, particularly once lending is in the mix, because a termination filing against a cannabis borrower creates an obvious conflict between compliance obligations and the financial institution’s commercial interests. Policies should reflect that independence, and practice has to match the policy to mitigate risks associated with cannabis banking. Regulators will check.
Communication Is the Key
Annual reporting on cannabis banking services is not enough. Our view is that quarterly board reporting is the floor, with the ability to escalate when there is a regulatory, operational, or strategic development.
Reports should tell the board what the numbers actually mean in relation to a cannabis banking program. SAR counts alone do not convey direction. It is also important to report not just regulatory changes but industry trends to the board to ensure they have a real-time understanding of the current landscape.
The Bottom Line
Cannabis banking is no longer experimental, but it still requires patience and foresight to build and maintain a successful program. The programs that last have an engaged board, a BSA officer with real authority, a business development team that understands compliance is part of the product, and an audit function that knows what to look for.
Build the infrastructure first, let the revenue follow, and document every decision along the way. Good things come to those who wait, and in cannabis banking, they come only to those who build partnerships.
About the Authors
Ryne Cornacchia
Ryne Cornacchia is Manager of the Regulatory Compliance Services Group at Wolf & Company, where he supports the development and execution of compliance reviews for financial institutions and FinTech clients. He brings prior experience as a BSA Officer and Vice President of Risk Management at regional banks and a large credit union. He also serves as an adjunct university professor teaching banking fraud prevention and data analytics. His hands-on background makes him a trusted resource for institutions navigating the complexities of cannabis banking.
Chris Van Dyck
Chris Van Dyck is a Partner at Cogent Law, a regulatory attorney and former BSA Officer with nearly a decade of experience in cannabis banking. He has guided financial institutions through the process of launching and scaling compliant cannabis banking programs, advising on compliance frameworks, risk management strategies, and policy development aligned with the 2014 FinCEN Guidance. His unique background, on both the regulatory and institutional sides, gives him a practical, well-rounded perspective on what it takes to build a program that is both compliant and commercially successful.