3 Pillars of Cannabis Banking Compliance
Few people will disagree that financial compliance isn’t the most exciting topic within the cannabis industry. But compliance is, and always will be, the engine grease to the legal cannabis market. Cannabis operators have the arduous task of dealing with multiple layers of compliance, both operational (maintaining and adhering to regulations enforced by the state licensing board) and financial. These compliance measures include managing everything from seed-to-sale systems for all plant-related activity to on-site requirements like facility access points and alarms systems to name a few.
With complex compliance requirements for the business, the last thing cannabis operators want to think about is financial compliance. We created Confia on this notion. Just as cannabis regulators impose the tracking of plants through the supply chain via a seed-to-sale system, we have developed a storyboard similarly designed to follow the money, which is the equivalent of a transaction-to-deposit system.
Having experience in regulatory technology, artificial intelligence and machine learning, we’ve been fortunate enough to work with some of the world’s largest banks across multiple countries. This experience has afforded us the luxury of working alongside regulators, chief compliance officers and chief risk officers, understanding how risk is perceived by financial institutions and how it ought to be mitigated. It was this access and knowledge that allowed us to effectively reform, enhance and improve the antiquated BSA programs with a technology-enabled process. Leveraging technology is a necessity, almost a requirement, for the cannabis industry as legalization nears and banking access begins to broaden.
Jamming cannabis requirements into an existing BSA program doesn’t scale well. BSA programs are very manual, descriptive and process oriented. So, we’ve taken our prior experience and success in banking to form Confia, distilling the complexities and simplifying the deliverables surrounding cannabis banking compliance. To best articulate cannabis banking requirements, I break it down into three pillars.
Pillar One: KYC-Enhanced Due Diligence
The first pillar is the client-onboarding bucket or KYC – Know Your Customer. In the complex world of cannabis banking, banks must know and understand their clients to great depths. It’s not enough to simply know that the client exists; you also have to understand whether or not that client could be a potential risk to the bank, and one step further, the financial system. Cannabis is a high-risk industry, so the KYC requirement is escalated to a deeper diligence and review, called Enhanced Due Diligence (EDD).
Banks need to know and understand their customers’ story, and all the key parties (officers, directors, and those with key decision-making powers or access to the bank accounts) within that organization. This includes reviewing personal, business, and legal history – not to mention watchlists and negative news presence. An initial onboarding review must then be followed with daily screening and monitoring of all watchlists and adverse media. Typically, banks do KYC refreshes every three years. In cannabis, a full refresh should be done annually with the daily monitoring systems in place.
The high-risk nature of the industry also requires a level of diligence on all parties to a transaction, even if one of the parties, whether a payer or recipient, is not a client of your bank. Unlike traditional banking sectors, reliance on other banks’ KYC programs is far less defensible in the cannabis industry.
Pillar Two: Transactional Monitoring & Detection
Tracking and monitoring the actual financial transactions comprises the second pillar required for cannabis banking. At Confia, we have focused on streamlining processes, so the cannabis operator can seamlessly support the compliance obligation for every transaction. A bank must demonstrate supporting documentation for every cannabis transaction, and gathering such information is a large undertaking in and of itself and can pose future issues if not done properly, see the pitfalls for lack of compliance. Banks are obligated to understand the nature and reason for each transaction, the source of funds, ensure cannabis licenses are in good standing for all parties, and collect evidence such as accounting records and seed-to-sale data.
Core to transaction monitoring in the traditional sense, is the overarching support through anomaly detection. Relying on information is important, but testing those inputs keeps everyone honest. It is important to evaluate transactions from a holistic point of view relative to peers and relative to the general contents of a transaction. This anomaly detection layer is your last line of defense, and as new information is collected, it continues to refine itself.
Pillar Three: Filing and Reporting Requirements
The third component to compliant cannabis banking is regulatory filing and reporting. Once a client is onboarded, the account requires an initial suspicious activity report or SAR-Initial within 30 days of that client being approved by the bank. Then, a report must be filed every 90 days after that for all the transactions of that cannabis operator. Banks must file the SAR-Initial and the Continuing-SAR reports for each cannabis client they have.
Solutions like Confia automate the filing process and support the filing with transactional data evidenced on our distributed ledger of record. This provides immutable audibility and simplifies the process for all parties involved.
Compliance Requirements After US Legalization
The anticipation of federal legalization and banking reform bills has many operators hoping for easier banking. Yet, in my opinion, regulatory oversight and audits will likely increase after such reform or legalization. As other financial institutions start to support cannabis, it will inadvertently create greater opportunity and expose the financial system to nefarious or illegitimate transaction activity. This is why cannabis banking will be carefully monitored by regulators, and more so, why banks will be slow and pragmatic in standing up their internal cannabis banking programs. Some banks may forever avoid the cannabis industry due to the known pitfalls of an industry specific program, while others may simply mitigate the possible exposure to reputational risk.
Choose Wisely: Pitfalls for Lack of Compliance
Financial compliance is the responsibility and duty of the banks, but the real losers and result of non-compliance always fall on the cannabis operators. Regulatory action against an institution may result in the bank shutting down its cannabis program or may require them to complete a remediation of all their cannabis transactions for a certain period from its clients. At the end of the day, regardless of action, the cannabis operator is the one being punished. Operators either lose their bank account and have business massively disrupted, or they are asked to provide all the compliance docs for a historic period, which is a huge undertaking and operational distraction, ultimately impacting business and productivity. So, choose your banking partner wisely.
Summarizing Key Banking Requirements
In summary, banking in the cannabis industry will undoubtedly remain a high-risk industry, with or without legalization. Although banking opportunities may expand as US policies change, there will be continued compliance and regulatory requirements for the foreseeable future.
- Onboarding and ongoing screening are critical
- Evidence for every transaction is a significant portion of compliance and must not be dismissed
- Evaluating activity with broader strokes is essential in mitigating against money laundering
- Managing the staggered filing timelines and due dates for each client
Compliance is the most crucial factor in cannabis banking at this point. It cannot be overlooked or taken for granted. Cannabis operators must take an active role in evaluating the compliance programs of their financial providers. To open a bank account is one thing, but the consideration and effort that goes into keeping a bank account is the difference that will protect your business in the long run.