Tag Archives: BSA

Cannabis Banking: The Ins, the Outs & the Unknowns

By Tamara L. Kolb, Amy Bean, Caitlin Strelioff
No Comments

As the legal cannabis market expands, banks and nonbank financial institutions (NBFIs) across the United States continue to explore how to safely provide banking and other financial services to cannabis-related businesses (CRBs) and other CRB ecosystem players. At the same time, these organizations are taking into account changes they might need to consider relative to their Bank Secrecy Act ( BSA), anti-money laundering (AML) and related compliance programs. 

Regulatory conundrum

The Controlled Substances Act (CSA) identifies the cannabis plant and all its derivatives as a Schedule 1 controlled substance. Schedule 1 controlled substances have a “high abuse potential with no accepted medical use,” and they cannot be “prescribed, dispensed, or administered.” Because cannabis remains classified as a Schedule 1 controlled substance, the CSA “imposes strict controls on possession, manufacturing, distribution, and dispensing” of cannabis.

Under the Money Laundering Control Act of 1986 (MLCA) and the BSA as amended, covered banks and NBFIs are prohibited from providing financial services to businesses that are engaged in illicit activities. Because federal law prohibits the distribution and sale of cannabis, financial transactions involving CRBs are therefore deemed to be transactions that involve funds derived from illegal activities.

As of Feb. 3, 2022, 18 states, two territories, and the District of Columbia have enacted legislation to regulate cannabis for adult use. Thirty-seven states, the District of Columbia and four territories have approved comprehensive, publicly available medical and cannabis programs. Eleven states allow for the use of low-THC, high-CBD substances for medical reasons in limited situations or as a legal defense.

The growing divide between federal prohibition and state legalization of the cannabis industry creates a precarious position for federally regulated banks and NBFIs with the main concern involving exposure to legal, operational and regulatory risk. The situation begs the question: How might the federal government and regulators pursue and prosecute players in the legal cannabis industry?

The current economic trajectory predicts that retail sales of legal cannabis products in the U.S. will surpass an estimated $41.5 billion annually by 2025, and many banks and NBFIs are eagerly awaiting the federal green light to do business with CRBs without fear of prosecution or legal ramifications.

From 2018 forward, Congress has made several attempts to pass legislation that would protect CRBs when cultivating, distributing, marketing, and selling cannabis products in their state-legalized form. These efforts to declassify cannabis-related activity as a specified unlawful activity have thus far been unsuccessful.

The House passing the MORE Act back in 2020

Passage of the Secure and Fair Enforcement Banking Act of 2021 (SAFE Banking Act) and the Marijuana Opportunity Reinvestment and Expungement Act of 2021 (MORE Act) would enable banks and NBFIs to provide financial services to CRBs. The SAFE Banking Act would provide a safe harbor for banks and NBFIs that provide financial services to CRBs. The MORE Act would deschedule cannabis from the CSA entirely.

Questions to ask

Banks and NBFIs interested in providing financial services to CRBs should ask these questions:

  • Do we adequately understand our risk, and what are the implications for our organization? How should we augment our risk assessment process and our controls?
  • To what extent are we willing to accept the risk of banking CRBs? Do we have the ability to identify CRB customers, and if so, do we have any?
  • How should we advise the board of directors about setting risk appetite?
  • What customer due diligence (CDD) and enhanced due diligence (EDD) will we need to safely continue with existing customers and onboard new ones?
  • How will we monitor for unusual and suspicious activity? What will be the alerting and judgmental criteria?
  • How will our resource needs change so that we stay abreast of new processes and controls?

Risk appetite considerations

In order to determine whether to accept or prohibit CRBs, banks and NBFIs should identify the level of acceptable risk they are willing to take on. Several key components need to be considered, such as:

  • The board of directors’ stance on legal cannabis, given that good governance recommends and regulators expect that the board sets risk appetite
  • Cannabis laws in states within the customer footprint and the impact on customers’ communities
  • Risk profile, customer base, geographic location, products, and services
  • Relationship with regulators and any recent deficiencies or weaknesses in the BSA and associated compliance programs
  • Ability to implement appropriate controls and staffing

 Developing a strategic road map

If the decision is made to bank CRBs, banks and NBFIs should perform an assessment of compliance maturity for existing BSA/AML program processes and controls to identify potential gaps and develop a strategic road map that helps the organization achieve its vision for future state compliance and sustainable operations. 

A well-developed and well-articulated strategic road map visualizes what actions or key outcomes are needed to help organizations achieve their long-term goals. When creating the road map, banks and NBFIs need to demonstrate a keen understanding of their desired strategy, outcomes, markets, and products for onboarding and banking CRB customers. Specifically, banks and NBFIs need to define and explain how desired outcomes and business strategies create risk and exposure.

In addition to a road map, banks and NBFIs should develop and document a detailed risk-based approach that is aligned to the organization’s risk tolerance to determine necessary compliance steps when banking CRB customers.

Specifically, the following activities should be considered when developing a CRB banking program that meets regulatory expectations:

  • Identifying BSA/AML control gaps related to CRB risk identification and mitigation and formulating a plan to address them
  • Updating a board-approved policy framework
  • Updating detailed operating policies and procedures
  • Planning for capacity, developing job descriptions, and onboarding new personnel
  • Training for all three lines of defense, senior management, and the board
  • Developing and documenting a phased or full approach to acceptance of CRB customers
  • Developing and documenting a CRB program oversight policy

CRB risk framework

A three-tiered CRB risk framework first proposed in 2016 has quickly become the cannabis industry standard. The framework has evolved and expanded comprehensively to consider many types of CRBs, and evolving legal systems continue to refine the framework.

This framework is intended to help banks and NBFIs differentiate types of CRBs and their corresponding risks, and it separates CRBs into three tiers and details risks for each tier. The following exhibit summarizes the approach:

Risk framework by tier

Level Risk
Tier 1 Direct
Tier 2 Indirect with substantial revenue from Tier 1
Tier 3 Indirect with incidental revenue from Tier 1

Source: CRB Monitor

Even the most conservative of risk appetites equivalent to outright prohibition is not devoid of significant risk considerations. Residual risk frequently encompasses a large number of indirect connections in the total CRB ecosystem. Common examples are printers, lawyers, accountants, landlords, and even utilities and taxing authorities, and all of these are subject to regulatory scrutiny and, importantly, visibility to law enforcement. Also, policies to prohibit or restrict will be audited and examined for compliance, and exceptions will require explanations.

This panorama necessitates expertise and prudence in identifying and evaluating risks within the many layers of CRBs. For example, consider a bank or NBFI that banks a CRB’s employee or vendor. If a bank fails to properly implement controls that would allow it to identify and mitigate risk associated with banking CRBs, it will be susceptible to severe violations of the BSA, including civil money penalties, criminal penalties, and regulatory enforcement actions. 

Implementing necessary precautions

A well-developed road map should consider and implement the following activities:

  • Understanding the most current state and federal cannabis laws and regulations to ensure the bank or NBFI’s compliance
  • Understanding the local, state, or tribal program to ensure CRB customers are compliant with the program
  • Implementing a CRB risk assessment
  • Implementing executive approval practices for direct CRBs
  • Developing adequate risk ratings (possibly through a risk-based, tiered approach) and corresponding monitoring for CRB customers that includes:
    • Integrating various customer onboarding and AML solutions at both onboarding and periodic levels
    • Scheduling regular reviews to include recurring enhanced due diligence, site visits, and transaction monitoring
    • Monitoring for suspicious activity, including red flags, via open sources for adverse information about the CRB customers and related parties such as beneficial owners
  • Performing adequate CDD and EDD that will validate that the CRB-offered products, services, and programs are compliant with most current state laws and regulations by:
    • Collecting appropriate documentation as evidence of compliance, perhaps including a comprehensive onboarding questionnaire, beneficial ownership information, and contracts for the growing, harvesting, transporting and processing of the product
    • Reviewing applications and supporting documentation used to obtain a legal cannabis state license
    • Understanding the normal and expected activity of the organization’s CRB customers and their product usage
  • Developing adequate training programs and governance and oversight programs to address this customer type by:
    • Updating existing policies and procedures to review inherent risk presented by banking CRB customers
    • Updating annual training for employees
  • Auditing initial program design and periodic operational effectiveness

Moving forward cautiously

The ins, outs, and unknowns of cannabis banking are complex, and they require banks and NBFIs to be extremely vigilant with current policy and aware of new developments. Overall, the idea of creating a cannabis program might seem like a daunting task, but with appropriate guidance and care, organizations can provide services in compliance with laws and regulations.

Crowe disclaimer: Qualified organizations only. Independence and regulatory restrictions may apply. Some firm services may not be available to all clients. Given the continued evolution and inconsistency of various state and federal cannabis-related laws, any company should seek competent legal advice relating to its involvement in the cannabis industry, including when considering a potential public offering as a cannabis-related company.

Current Trends in Banking for Cannabis-Related Businesses

By Paula Durham, CFE, CCCE
No Comments

Cannabis is still federally illegal and is included on Schedule 1 of the Controlled Substances Act (CSA), along with such other substances as heroin, fentanyl and methamphetamines.1 It is a federal crime to grow, possess or sell cannabis.

Despite being federally illegal, 36 U.S. states and the District of Columbia have legalized the sale and use of cannabis for medical and/or adult use purposes,2 and both direct and indirect cannabis-related businesses (CRBs) are growing at a rapid rate. Revenue from medical and adult use cannabis sales in the US in 2019 is estimated to have reached $10.6B-$13B and is on track to reach nearly $37B in 2024.3

Because the sale of cannabis is federally illegal, financial institutions face a dilemma when deciding to provide services to CRBs. Should they take a significant legal risk or stay out of the market and miss out on a significant revenue opportunity? So far, the vast majority of financial institutions have been unwilling to take the risk, resulting in a dearth of options for CRB’s. Until recently, cannabis business operators had few options for financial services, but times are changing.

This piece will discuss current trends in banking for cannabis-related businesses. We will cover differences in legality at state and federal levels, complexities in dealing in cash versus digital currencies, Congressional actions impacting banking and CRBs and how banking is changing. The explosion of state legalization of cannabis over the past several years has had a strong ripple effect across the US economy, touching many industries both directly and indirectly. Understanding the implications of doing business with a CRB is both challenging and necessary.

Feds Versus States

Money laundering is the process used to conceal the existence, illegal source or illegal application of funds.4 In 1986 Congress enacted the Money Laundering Control Act (MLCA), which makes it a federal crime to engage in certain financial and monetary transactions with the proceeds of “specified unlawful activity.”5 Therefore, CRB transactions are technically illegal transactions under the MLCA.

Financial institutions therefore face a risk of violating the MLCA if they choose to do business with CRBs, even in states where cannabis operations are permitted. In addition, financial institutions could also face criminal liability under the Bank Secrecy Act (BSA) for failing to identify or report financial transactions that involve the proceeds of cannabis businesses operating legally under state law.6

Federal authorities continued to aggressively enforce federal cannabis laws

In short, because cannabis is illegal at the federal level, processing funds derived from CRBs could be considered aiding and abetting criminal activity or money laundering. States, however, began legalizing cannabis in 1996, and by 2009, thirteen states had laws allowing cannabis possession and use.7 Despite this legislation, federal authorities continued to aggressively enforce federal cannabis laws.8 That changed under the Obama administration when, shortly after being elected, President Obama stated that his administration would not target legal CRB’s who were abiding by state laws.[9] In an attempt to provide clarity in this murky environment, beginning in 2009, the Department of Justice (DOJ) issued three memos designed to guide federal prosecutors in this area. However, none of the DOJ memos issued from 2009 through 2013 addressed potential financial crime related to the legal sale or distribution of cannabis in states allowing the use of medicinal or recreational cannabis.

To assist financial institutions in navigating potential financial crime implications of banking CRBs, the Financial Crimes Enforcement Network (FinCen) issued guidance in 2014 that clarified how financial institutions could conduct business with CRBs and maintain compliance with their Bank Secrecy Act requirements (2014 Guidance).9 According to the 2014 Guidance, financial institutions may choose to interact with CRBs based on factors specific to each institution, including the institution’s business objectives, the evaluated risks associated with offering such services, and its ability to manage those risks effectively.

The 2014 Guidance requires those who choose to provide services to CRBs to design and implement a thorough customer due diligence review that includes, in part, analyzing the licensing of the entity, developing an understanding of the business operations of the entity, and ongoing monitoring of the entity.9 In addition, financial institutions are required to file a Suspicious Activity Report (SAR) for every transaction they process for a CRB, should they choose to accept the business.

Although the 2014 Guidance does outline a path for financial institutions to engage with CRBs, it does not change federal law and, therefore, does not eliminate the legal risk to financial institutions.10 By its very nature, the 2014 Guidance was a temporary fix, subject to changing views of different administrations, evidenced by the fact that all three of the DOJ guidance documents noted above were rescinded by then Attorney General Jeff Sessions on January 4, 2018.12 The DOJ enforcement posture could change once again in a Biden administration. Biden is on record as favoring decriminalization, and Attorney General candidate Merrick Garland has stated that if confirmed he will deprioritize enforcement of low-level cannabis crimes. Garland also believes using limited government resources to pursue prosecution of cannabis crimes states where cannabis is legal does not make sense.12

Because of the uncertainty and high risk, most banks remain unwilling to serve CRBs. Those that do serve CRBs charge exorbitant fees (fees of $750-$1,000 or more per account per month are not uncommon), pricing many smaller operators out of the financial services market.

Cash is King – Or Is It?

Cannabis operators have discovered the old adage “cash is king” is not necessarily true when it comes to the cannabis space. Bank-less CRBs are forced to utilize cash to pay business expenses, which can be particularly difficult. Utility companies, payroll companies, and taxing authorities are just some of the providers that are difficult, if not impossible, to pay in cash. For example, cannabis operators have been turned away from IRS offices when attempting to pay large federal tax obligations in cash. Likewise, cannabis operators have been unable to utilize payroll processing companies to administer payroll and benefits for their businesses because the processors won’t take cash. CRBs can’t use Amazon or other online retailers because online providers cannot accept cash.

Because dealing in cash is so difficult, CRB operators look for workarounds such as using personal credit/debit cards to purchase business equipment and supplies. This doesn’t eliminate the cash problem, however, because the credit card holder will likely have to accept cash as reimbursement. Such transactions could be considered an attempt to hide the source of the cash, which is, by definition, money laundering.

CRBs often have large sums of money onsite

Some bank-less CRBs try to skirt the system by obtaining bank accounts in the name of management companies or other entities one step removed from the actual business. While operators often choose this route in an effort to streamline business and operate out of the shadows, it again runs afoul of banking laws. Transferring cannabis related financial transactions to another entity is actually the very definition of money laundering – which, as noted above, is defined as the process used to conceal the existence or source of “illegal” funds.

In addition to the difficulties in making payments or purchasing business supplies, operating in a cash-heavy environment poses significant safety risks for cannabis operators. CRBs often have large sums of money onsite and transport large sums of cash when purchasing product or paying bills, making them a target for robbery. In 2017, there was a spate of dispensary robberies across the Phoenix Metro area, including one at Bloom Dispensary that took place during operating hours.13

Managing all that cash increases the cost of doing business as well, in the form of increased labor, insurance, and security costs. Cash must be counted and double counted, which can be time consuming for staff, not to mention the time it takes to deliver physical cash payments to hither and yon. Ironically, lack of banking significantly decreases transparency and clouds the waters of compliance, as operating strictly in cash makes it easier to manipulate reported financial results.

Potential Congressional Solutions

In recent years Congress has undertaken several efforts to pass legislation designed to address the state/federal divide on cannabis, which would likely clear the way for financial institutions to provide services to CRBs, including:

  • R. 1595 – Secure and Fair Enforcement Banking Act of 2019 (“SAFE Act”);
  • 1028 & H.R. 2093 – Strengthening the Tenth Amendment Through Entrusting States Act (STATES Act); and
  • 2227 – Marijuana Opportunity Reinvestment and Expungement Act of 2019 (MORE Act).

The climate in Washington DC, however, did not allow any of these initiatives to pass both houses of congress. Had any been sent to the White House, President Trump was unlikely to sign them into law.

The cannabis industry has new reason to believe reform is on the horizon with shift in political leadership in the White House and Senate. Newly anointed Senate Majority Leader Chuck Schumer recently committed to making federal cannabis reform a priority, and President Biden appears committed to decriminalization, reviving the hope of passage of one of these pieces of legislation.

The Changing Banking Landscape

Even though there is little in the way of formal protections for financial institutions, and with the timeline for a legislative fix unknown, an increasing number of banks are working with cannabis operators.

According to FinCen statistics, there were approximately 695 financial institutions actively involved with CRBs as of June 30, 2020. It is important to note that these statistics are based on SAR filings, which banks are required to file when an account or transaction is suspected of being affiliated with a cannabis business. However, some of these SARs may have been generated on genuine suspicious activity rather than on a transaction with a known cannabis customer.

Number of Depository Institutions Actively Banking
Cannabis-Related Businesses in the United States
(Reported in SARS)14

There are arguably more banking institutions offering services to CRBs than ever before. The challenges for CRBs are (1) finding an institution that is willing to offer services; (2) building/maintaining a compliance regime that will be acceptable to that institution; and (3) cost, given the high fees associated with these types of accounts. 

How CRBs Get Accepted by Banks

The gap between CRBs’ need for banking and the financial services providers’ sparse and expensive offerings to the sector has created an opportunity for third-party firms to intervene and provide a compliance structure that will satisfy the needs of the financial institutions, making it easier for the CRB to find a bank.

These third-party firms perform extensive BSA-compliant due diligence on applicants to ensure potential customers are following FinCen guidance required to receive banking services. After the completion of due diligence, they connect the CRBs with financial institutions that are willing to do business with CRBs and provide checking/savings accounts, check writing capability, and merchant processor accounts. These firms often provide additional services such as armored car and cash vaulting services. Some of these firms also offer vendor screening, pre-approving vendors before any payments can be made.

One such firm, Safe Harbor Private Banking, started as a project implemented by the CEO of Partners Credit Union in Denver, Colorado, who set out to design a cannabis banking program that would allow Partners to do business with Colorado CRBs.15 The program was successful and has since expanded into other states who have legalized cannabis. Other operators include Dama Financial and NaturePay.

While these services offer hope for many CRBs, the downside is cost. These services perform the operations necessary to find, open, and maintain a compliant bank account; however, the costs of compliance are still high, pricing some small operators out of the market.

Is Digital Currency an Answer?

 Digital currency is also making its way into the cannabis world. Digital currency, or cryptocurrency, is a medium of exchange that utilizes a decentralized ledger to record transactions, otherwise known as a blockchain. One of the largest benefits of blockchain is that it is a secure, incorruptible digital ledger used for, among other things, financial transactions.16 Blockchain technology offers CRBs a transparent and immutable audit trail for business and financial transactions. Several cannabis-specific cryptocurrencies have sprung up in the past several years, including PotCoin, CannabisCoin, and DopeCoin, to name a few.

In July 2019, Arizona approved cryptocurrency startup ALTA to offer services to the state’s medical cannabis operators.17 ALTA describes itself as a “digital payment club where cash-intensive businesses pay each other using digital tokens instead of cash.”18 ALTA members purchase digital tokens that are used to pay other members using a proprietary blockchain based system. The tokens are redeemable for US dollars at a stable rate of 1:1, and CRBs do not need a bank account to participate in the ALTA program.

ALTA proposes to pick up members’ cash and exchanges it for tokens, which are then used to pay other members for goods and services. Tokens may be redeemed for cash at any time.18 The company has been approved by the Arizona State Attorney General, and one of the first members they hope to enlist is the Arizona Department of Revenue (ADOR). Enlisting ADOR into the program would allow dispensary members to pay state taxes digitally rather than hauling large amounts of cash to ADOR offices.

Similarly, Nevada recently contracted with Multichain Ventures to supply a digital currency solution to the Nevada cannabis industry. Nevada Assembly Bill 466 requires the state create a pilot program to design a “closed loop” system like Venmo in an effort to reduce cash transactions in the cannabis sector. Like ALTA, Nevada’s proposed system will convert cash to tokens which can then be transacted between system participants.19

While both proposals are promising for Arizona and Nevada CRBs, the timeline as to when, or if, these offerings will come online is unknown. Action on cannabis reform at the federal level may render these options moot.

Looking to the Future

Although states are legalizing cannabis in one form or another in growing numbers, the fact that cannabis is still federally illegal poses a significant barrier to accessing the financial services market for CRBs. While most banks are still reluctant to offer services to this rapidly growing industry, there are more banks than ever before willing to participate in the cannabis industry. Recent changes in leadership in Washington DC offer a positive outlook for cannabis reform at the federal level.

As the “green rush” continues to envelop the country, financial services options available to CRBs are slowly growing. Many new options are now available to help CRBs find a bank, develop compliance programs, and manage the cash related problems encountered by most CRBs. However, these solutions may be out of reach for the budget-conscious small operator. Also, there are a number of cryptocurrency solutions designed specifically for CRBs; however, when, or if, these solutions will gain significant traction is still unknown.

References

  1. Controlled Substances Act, 21 U.S.C., Subchapter I, Part B, §812.
  2. “State Marijuana Laws”; National Conference of State Legislatures, February 19, 2021.
  3. “Exclusive: US Retail Marijuana Sales On Pace to Rise 40% in 2020, near $37B by 2024”. Marijuana Business Daily, June 30, 2020.
  4. Kaufman, Irving. “The Cash Connection: Organized Crime, Financial Institutions, and Money Laundering”. Interim Report to the President, October 1984.
  5. S. Code § 1956 – Laundering of Monetary Instruments.
  6. Rowe, Robert. “Compliance and the Cannabis Conundrum.” ABA Banking Journal, September 11, 2016.
  7. “History of Marijuana as a Medicine – 2900 BC to Present”. ProCon.org, December 4, 2020.
  8. Truble, Sarah and Kasai, Nathan. “The Past – and Future – of Federal Marijuana Enforcement”. org, May 12, 2017.
  9. FIN-2014-G001, BSA Expectations Regarding Marijuana-Related Businesses.
  10. Cannabis Banking Coalition Statement.
  11. Sessions, Jefferson B. “Memorandum for All United States Attorneys”. January 4, 2018.
  12. “Attorney General Nominee Garland Signals Friendlier Marijuana Stance”. Marijuana Business Daily, February 22, 2021.
  13. Stern, Ray. “Robbers Hitting Phoenix Medical Marijuana Dispensaries: Is Bank Reform Needed?” The Phoenix New Times, April 11, 2017.
  14. FinCen Marijuana Banking Update, June 30, 2020.
  15. Mandelbaum, Robb. “Where Pot Entrepreneurs Go When the Banks Just Say No.” The New York Times, January 4, 2018.
  16. Rosic, Ameer. “What is Blockchain Technology? A Step-by-Step Guide for Beginners.” com, 2016.
  17. Emem, Mark. “Marijuana Stablecoin Asked to Play in Arizona Fintech Sandbox.” CCN.com, October 25, 2019.
  18. http:\\Whatisalta.com\
  19. Wagner, Michael, CFA. “Multichain Ventures Secures Public Sector Contract with Nevada to Supply Tokenized Financial Ecosystem for the Legal Cannabis Industry”, January 26, 2021.