Cannabis, we have a problem. Legalizing adult use cannabis in California caused the demand for high-potency cannabis to increase dramatically over the last several years. Today, many dispensary buyers enforce THC minimums for the products that they sell. If smokeable flower products don’t have COAs proving the THC levels are above 20% or more, there is a good chance many dispensaries won’t carry them on their shelves. Unfortunately, these kinds of demands only put undue pressure on the industry and mislead the consumer.
Lab Shopping: Where the Problems Lie
Lab shopping for potency analysis isn’t new, but it has become more prevalent with the increasing demand for high-potency flower over the last couple of years. Sadly, many producers submit valid, certified COAs to the California Bureau of Cannabis Control (BCC), which show two to three times the actual potency value.
At InfiniteCAL, we’ve purchased products from dispensary shelves and found significant discrepancies between the analysis we perform and the report submitted to the BCC by the producer. So, how can this happen? Several factors are creating the perfect storm in cannabis testing.
Problems with Potency
Many consumers still don’t understand that THC potency is not the only factor in determining quality cannabis, and they are unwittingly contributing to the demand for testing and analysis fraud. It is alarming for cultivation pioneers and ethical labs to see producers and profit-hungry testing facilities falsifying data to make it more appealing to the unaware consumer.
Basically, what’s happening is growers are contacting labs and asking, “I get 30% THC at this lab; what can you do?” When they see our COA reporting their flower tested lower than anticipated, they will go to another lab to get higher test results. Unfortunately, there are all too many labs that are willing to comply.
I recently saw a compliant COA that claimed that this particular flower was testing at 54% THC. Understanding cannabis genetics, we know this isn’t possible. Another product I reviewed claimed that after diluting an 88% THC distillate with 10-15% terpenes, the final potency test was 92% THC. You cannot cut a product and expect the potency to increase. Finally, a third product we reviewed claimed 98% total cannabinoids (while only looking at seven cannabinoids) with 10% terpenes for a total of 108% of the product.
These labs only make themselves look foolish to professionals, mislead laymen consumers and skirt under the radar of the BCC with basic mathematical errors.
The Pesticide Predicament
Frighteningly, inflating potency numbers isn’t the most nefarious testing fraud happening in the cannabis industry. If a manufacturer has 1000 liters of cannabis oil fail pesticide testing, they could lose millions of dollars – or have it retested by a less scrupulous lab.
As the industry continues to expand and new labs pop up left and right, cultivators and manufacturers have learned which labs are “easy graders” and which ones aren’t. Certain labs can miss up to ten times the action level of a pesticide and still report it as non-detectable. So, if the producer fails for a pesticide at one lab, they know four others won’t see it.
In fact, I’ve had labs send my clients promotional materials guaranteeing compliant lab results without ever receiving a sample for testing. So now, these companies aren’t just tricking the consumer; they are potentially harming them.
An Easy Fix
Cannabis testing is missing just one critical factor that could quickly fix these problems – checks and balances. The BCC only needs to do one of two things:
Verifying Lab Accuracy
InfiniteCAL also operates in Michigan, where the Marijuana Regulatory Agency (MRA) has already implemented a system to ensure labs are maintaining the highest testing standards. The MRA will automatically flag all COAs which test above a certain percentage and require the product to be retested by multiple labs.
Labs are required to keep a back stock of material. So, when test results come back abnormally high from Lab A, then Labs B, C and D are commissioned to retest the material to compare data. If Lab A reports 40% THC, but the other labs all report 18%, then it’s easy to see Lab A has made an error.
By simply buying products off the shelves and having them blind-tested by other labs, it would be simple for the BCC to determine if the existing COA is correct. They already have all the data in Metrc, so this would be a quick and easy fix that could potentially solve the problem overnight.
For example, at InfiniteCAL, we once purchased 30 samples of Blue Dream flower from different cultivators ranging in certified COA potencies from 16% to 38%. Genetically, we know the Blue Dream cultivar doesn’t produce high levels of THC. When we tested the samples we purchased, nearly every sample came back in the mid-teens to low 20% range.
Labs Aren’t Supposed to Be Profit Centers
At InfiniteCAL, we’ve contacted labs in California where we’ve uncovered discrepancies to help find and flush out the errors in testing. All too often, we hear the excuses:
- “If I fix my problem, I’ll lose my clients.”
- “I’m just a businessman who owns a lab; I don’t know chemistry.”
- “My chemist messed up; it’s their fault!”
If you own a lab, you are responsible for quality control. We are not here to get rich; we are here to act as public safety agents who ensure these products are safe for the consumer and provide detailed information about what they choose to put in their bodies. Be professional, and remember you’re testing for the consumer, not the producer.
The cannabis industry’s advancement towards legalization continues to dominate national headlines, from the stance of incoming Attorney General Merrick Garland to deprioritize enforcement of low-level cannabis crimes, Senate Majority Leader Chuck Schumer’s continued advocacy, to the recent passing of legislation in New York, New Mexico and Virginia (the first in the South) to authorize adult-use cannabis. While these updates are likely to intrigue customers and investors alike, they are also sure to draw the attention of cyber criminals who could look at the relative youth of the industry, as well as its rapid growth, as a prime target of opportunity for nefarious acts.
In order to understand risk mitigation best practices across a wide spectrum of private sector industries, this article will first identify the current security environment in order to understand the threats, briefly highlight specific case studies and assess the risks and identify methods that individual organizations, as well as the cannabis industry as a whole, can take action to enhance security and preparedness and to develop resiliency against future attacks.
Understanding the Threats
For an industry that has operated in a largely cash-based system for much of its existence, the idea of security is not foreign. Typically, these concerns focused on physical security implementation. The topic has received plenty of coverage, including a recent article in this journal articulating Important Security Considerations When Designing Cannabis Facilities. While an audit of physical security measures is a valuable part to any all-hazards threat assessment, securing a growing online network – from email to online finances to connected devices within cannabis facilities – can pose more unfamiliar challenges. When consulted for this article, Patten Wood, a former VP of marketing for a prominent west-coast cannabis retail brand noted: “While the topic of cybersecurity is critically important to customers, businesses, and the industry at large, it isn’t top of mind for many of the cannabis companies that I’ve experienced.” Understanding what risks are present is the first step to mitigating them, so we must first discuss several common cyber threats for the cannabis industry.
- Phishing: Phishing happens when cybercriminals impersonate a trusted individual or entity, typically through email. The goal in this instance is to get the target to share confidential information or download software that can allow unauthorized access into an organization’s network. Phishing is one of the most common types of cyberattacks as it is relatively easy to conduct and surprisingly effective.
- Ransomware Attacks: Ransomware attacks are used to gain access to a computer network and then lock and encrypt either the entire system or certain sets of high-value files, which can compromise important business information, and impact client and vendor privacy. A ransom is then demanded for restoring access, but paying the ransom comes with its own risk as it doesn’t guarantee the files will be restored.
- Cyber Extortion: Similar to ransomware attacks in their design, cyber extortion typically deals with a threat of leaking personal information and will generally demand payment in cryptocurrency in order to maintain their anonymity.
Remote Access Threats: As 2020 has forced organizations to rethink how they conduct business and shift to more remote operations than they had in the past, it can open up several new threats. According to a survey by IT social network SpiceWorks.com, six out of every ten organizations allow their employees to connect their company-issued devices to public Wi-Fi networks. Utilizing unsecured Wi-Fi networks opens the user up to man-in-the-middle attacks, allowing hackers to intercept company data. Unsecure Wi-Fi also brings the threat of malware distribution. An additional consideration with remote workers is the uptick in cyber attacks against remote access software referred to as remote desktop protocol (RDP) attacks. According to Atlas VPN, RDP attacks skyrocketed 241% in 2020 and we’ve seen numerous RDP attacks against critical infrastructure throughout the pandemic and across all industries.
- Internet of Things (IoT) Leaks: With IoT devices running everything from security systems to automated growing operations, the convenience has been a huge boost for the industry. Unfortunately, many IoT devices don’t have sophisticated built-in security. Another common problem is the tendency of users to keep default passwords upon installation, which can make devices easy for cyber criminals to access. Once they are inside the system, malware can easily be installed, and the actors can move laterally throughout the network.
- Personal and Medical Record Security: Many cyberattacks expose some level of personal data, whether that be customer, employee or vendor information. An extra consideration for retail operations that either treat medical patients, or medical and adult-use customers, is the additional information they must store about their clients. Medical facilities will maintain protected health information (PHI), which are much more valuable on the dark web than personally identifiable information (PII). But even adult use facilities may keep government-issued ID or other additional information above that of a typical retailer, which makes the potential value of their information much more intriguing for a cybercriminal.
Assessing the Risks
Depending on where your organization lies in the seed to sale chain, you will have different levels of risk for various types of attacks. We briefly discussed ransomware attacks earlier. Ransoms can range widely depending on the size of the organization that is attacked, but the ransom alone isn’t the only risk consideration. Businesses must also factor in the cost of downtime (an average of 18 days in 2020) caused by the ransomware when evaluating the impact to business operations, as well as reputation. While small – medium businesses are absolutely at risk, especially given their relative lack of cybersecurity resources and sophistication, a recent trend involves “Big Game Hunting” where cybercriminals are targeting larger organizations with the potential for bigger paydays. Criminals understand that big business can rarely afford major delays, and may be more able and willing to pay, and pay big, for a return to normal operations.
Below are several examples of attacks which have either directly impacted the cannabis industry, or have valuable lessons the industry can learn from.
GrowDiaries: In October 2020 researcher Bob Diachenko discovered that 3.4 million records including passwords, posts, emails and IP addresses were exposed after two open-source application Kibana apps were left exposed online. As a platform for cannabis growers around the world (who are not all growing legally), this type of exposure puts the community at great risk, and can lower user confidence in the product, as well as putting them at personal risk of harm or legal ramifications. The applications being left open is a prime example of either a lack of good cybersecurity policies, or not following through on those policies.
Aurora Cannabis: On December 25th, 2020 Canadian company Aurora Cannabis suffered a data breach when SharePoint and OneDrive were illegally accessed. Included in the data that was compromised was credit card information, government identification, home addresses and banking details. The access point coming through Microsoft cloud software is a prime example of some of the challenges facing businesses who have an increasingly remote workforce yet still need that workforce to access critical (and usually highly sensitive) information.
THSuite: A database owned by seed to sale Point-Of-Sale (POS) software provider THSuite was discovered by researchers in December 2019. The database contained PHI/PII for 30,000 people, with over 85,000 files being exposed. The information that was left accessible included scanned government IDs, personal contact information and medical ID numbers. Clearly this gets into HIPAA territory, which can result in fines of up to $50,000 for every exposed record.
Door Dash: As cannabis delivery apps become more prevalent, it’s good to reference how similar businesses in other industries have been targeted. In May of 2019 nearly 5 million user records were accessed by an unauthorized third party, exposing PII and partial payment card information.
On an organizational level, employee training, password hygiene and malware protection are some of the basic and most important steps that should be taken by all organizations. But, if “knowledge is power,” the best defense for any organization against cyber threats is a well-informed organization- including leadership down to the front-line employees. Excellent tools to assist in this are Information Sharing & Analysis Centers/Organizations (ISACs/ISAOs). ISACs were established under a presidential directive in 1998 to enable critical infrastructure owners and operators to share cyber threat information and best practices. The National Council of ISACs currently has over 20 member ISACs including Real Estate, Water, Automotive and Energy. ISAOs were created by a 2015 executive order to encourage cyber threat information sharing within private industry sectors that fall outside of those listed as “critical infrastructure”. Christy Coffey, vice president of operations at the Maritime and Port Security ISAO (MPS-ISAO) says information sharing enabled by the executive order is critical. “We need to accelerate private sector information sharing, and I believe that the ISAO is the vehicle.”
According to Michael Echols, CEO of the International Association of Certified ISAO’s (IACI) at the Kennedy Space Center, security experts have long understood that threat information sharing can allow for better situational awareness and help organizations better identify common threats and ways to address them. “On the other side, hackers in a very documented way are already teaming up and sharing information on new approaches and opportunities to bring more value (to their efforts).” The ongoing crisis surrounding the Microsoft Exchange Server Vulnerability demonstrates that different cybercriminal groups will work simultaneously to abuse system flaws. As of March 5th it was reported that at least 30,000 organizations in the U.S. – and hundreds of thousands worldwide – have backdoors installed which makes them vulnerable to future attacks, including ransomware.
Below are several links to recent products that have been shared by various ISACs/ISAOs, which are provided as an example of the type of information that is commonly shared via these organizations.
- Joint Cybersecurity Advisory- Compromise of Microsoft Exchange Server
- Health-ISAC’s Hacking Healthcare Weekly Report
- Ford Foundation- Cybersecurity Assessment Tool
If organizations are interested in learning more about enhancing their cybersecurity resiliency through private-sector led information sharing, please reach out to the newly formed Cannabis ISAO at firstname.lastname@example.org
What is “hemp”?
The word “hemp” has many meanings. Historically the term has been used as the common name for the Cannabis sativa L. plant. Just like other plants, the cannabis plant has two names, a common name, hemp, and a scientific name, Cannabis sativa L. After the ratification of the UN Single Conventions on Narcotic Drugs and Psychotropic Substances, in 1961 and 1972 respectively, the term started to be used to distinguish between resin producing varieties of the cannabis plant and non-resin producing varieties of the cannabis plant. Nowadays the term is generally used to refer to cannabis plants with a delta-9-tetrahydrocannabinol (d9-THC), a controlled substance, content equal to or less than the maximum allowable limit defined by each marketplace.
In the United States and Canada, the limit is defined as 0.3% on a dry weight bases, and until November 2020, in the European Union, the limit was defined as 0.2%. After years of effort the “hemp” industry in Europe was successfully able to get the limit raised to 0.3% to be in line with the United States and Canada – creating the largest global trade region for hemp products. But there exist several marketplaces around the world where, either through the consequences of geographic location or more progressive regulations, the d9-THC content in the plant can be substantially higher than 0.3% and still considered “hemp” by the local authority.
To address these variances, ASTM International’s Technical Committee D37 on Cannabis has been working on a harmonized definition of hemp, or industrial hemp, depending on the authority having jurisdiction, through the efforts of its Subcommittee D37.07 on Industrial Hemp. The following is a proposed working definition:
hemp, n—a Cannabis sativa L. plant, or any part of that plant, in which the concentration of total delta-9 THC in the fruiting tops is equal to or less than the regulated maximum level as established by an authority having jurisdiction.
Discussion: The term “Industrial Hemp” is synonymous with “Hemp”.
Note: Total delta-9 THC is calculated as Δ⁹-tetrahydrocannabinol (delta-9 THC) + (0.877 x Δ⁹-tetrahydrocannabinolic acid).
This definition goes a long way to harmonize the various definitions of hemp from around the world, but it also defines “hemp” as a thing rather than as a classification for a type of cannabis plant or cannabis product. This is a concept rooted in the regulatory consequences of the UN Single Conventions, and one I strongly disagree with.
The definition also leaves the total d9-THC limit open-ended rather than establishing a specified limit. An issue I will address further in this series.
Can “hemp products” only come from “hemp plants”?
If you are an invested stakeholder in the traditional “hemp” marketplace, you would say, yes.
But are there such things as “hemp plants” or are there only cannabis plants that can be classified as “hemp”? (The definition for hemp clearly states that it is a cannabis plant…)
There is no distinction between the cannabinoids, seeds, and fibers derived from a cannabis plant that can be classified as “hemp” and those derived from a cannabis plant that cannot. The only difference is the word: “cannabis,” and the slew of negative connotations that come along with it. (Negative connotations that continue to be propagated subconsciously, or consciously, whenever someone says the “hemp plant” has 50,000+ uses, and counting, and will save the world because it’s so green and awesome, but not the “cannabis plant”, no that’s evil and bad, stay away! #NewReeferMadness)
The declaration that “hemp products” only come from “hemp plants” has some major implications. “Hemp seeds” can only come from “hemp plants”. “Hemp seed oils” can only come from “hemp seeds”. “Hemp fibers” can only come from “hemp plants”. Etc.
What does that really mean? What are the real-world impacts of this line of thinking?
Flat out it means that if you are growing a cannabis plant with a d9-THC content above the limit for that plant or its parts to be classified as “hemp”, then the entire crop is subjected to the same rules as d9-THC itself and considered a controlled substance. This means that literal tons of usable material with no resin content whatsoever are destroyed annually rather than being utilized in a commercial application simply because a part or parts of the plant they came from did not meet the d9-THC limit.
It is well known that d9-THC content is concentrated in the glandular trichomes (resin glands) which are themselves concentrated to the fruiting tops of the plant. Once the leaves, seeds, stalks, stems, roots, etc. have been separated from the fruiting tops and/or the resin glands, then as long as these materials meet the authority having jurisdiction’s specifications for “hemp” there should be no reason why these materials could not be marketed and sold as “hemp”.
There are several reasons why a classification approach to “hemp plants” and “hemp products” makes more long-term sense than a bifurcation of the “cannabis” and “hemp” marketplaces, namely from a sustainability aspect, but also to aid in eliminating the frankly unwarranted stigma associated with the cannabis plant. #NewReeferMadness
That said, say you are a producer making shives from the stalks of cannabis plants that can be classified as “hemp” and then all of a sudden, the market opens up and tons of material from cannabis plants that cannot be classified as “hemp,” that was being sent to the landfill, become available for making shives. Would you be happy about this development? Or would you fight tooth and nail to prevent it from happening?
In this segment, we looked at the history of the term “hemp” and some of the consequences from drawing a line in the sand between “cannabis” and “hemp”. I dive deeper into this topic and provide some commonsense definitions for several traditional hemp products in Part 2 of Defining Hemp: Classifications, Policies & Markets.
Despite President Biden’s reticence in tackling cannabis reform, Senate Democrats led by Chuck Schumer of New York have insisted that they intend to move forward with descheduling and decriminalizing cannabis with or without the President. This begs the question, what could brands across the legal cannabis industry look like as the federal regulatory environment evolves? As part of this, will interstate restrictions come down and allow for efficient regional and even national brands or will the structure continue to require a state-by-state strategy and rollout?
Currently, state borders set boundaries that dictate supply, distribution and sale, setting strict regulations on cannabis industry operations. As of today, many companies throughout the U.S. cannabis industry are structured as multi-state operators (MSOs), in which the companies own products or dispensary brands that are available in multiple legal state markets but operate in virtual silos from one another. This poses an interesting challenge that may need to evolve with federal legislative changes that could determine redrawing of these supply chains both on a regional and national level.
Brands like Korova, a popular edibles and flower brand based in California, with operations in Oregon and licensees in Oklahoma and Arizona, must keep its operations entirely separate, even if it operates under the same name in different states. Moreover, cannabis flower and extract sourced from California cannot legally be shipped to Oregon or other states. Thus, the MSO often creates vertical operations in each state in which it operates. It creates an entirely distinct process from cultivation to extraction to retail facilities. This difference in operation, even slight, can affect brand quality and consistency across markets if not managed carefully.
When federal cannabis legislation changes, these types of decisions will most likely be left to the states. I view it as similar to how the alcohol industry operates. In this case, states want to work to protect tax revenue and jobs. Whatever new federal legislation materializes, it is likely that states will retain considerable control over their borders and will have little to no immediate change in terms of vertical operations or the supply chain. The industry is still very nascent, and today’s companies have already developed competitive moats.
On the other hand, if federal barriers are abruptly lifted, we head into a massive free for all. In this scenario, massive consolidation and disruption will occur across the industry, and companies with larger footprints, either in large, important states or across states, will likely be merged together or acquired outright, by either larger MSOs or consumer packaged goods companies that enter the cannabis industry. Along the way, smaller, private companies would go out of business. This would have a massive impact on the industry, with considerable local or state-level disruption to tax revenues and employment. No politician wants to be responsible for something like this, especially during this time of economic turmoil.
If the federal government goes all in on legalization and offers interstate commerce and travel across state lines, companies will no longer have to operate within their own states, nor will MSOs need to create separate vertical operations in different states with hopes that brands maintain consistency. If this occurs, it will ease major strains that presently exist for corporations throughout the industry. Large operators will certainly have an advantage if movement is freed for brands. However, challenges will most likely persist for smaller operators looking to make a splash in the market and the likelihood of this happening for the reasons stated above is low.
Interstate cannabis commerce will be the game changer. While it remains unlikely, in my view, that there will be interstate commerce allowed in any legislation we see out of this Congress, it will happen eventually, just as interstate alcohol laws have also evolved overtime. Having ownership of good assets and brands in important markets and building a strong revenue base is key to both short and long-term success as the industry continues it consolidation, a measure which will only be accelerated with more federal legislation. For Terra Tech, which is acquiring Korova and other brands, it is a fundamental part of our strategy.
So how does a company identify the strongest brands and best operations to work with in our incredibly fragmented industry with no national brands? While there are companies trying to move in that direction, none of them have national brand stature at this point, providing an opening. The brands most likely to succeed are the ones that are more likely to resonate with consumers across various markets. These brands tend to have higher quality and potency at a good perceived value, and which have history in the community of delivering consistent products.
When it comes to choosing markets to get involved in, some choose to do it regionally and others seek out available markets regardless of geography or marketing segments. Unlike many leaders of multi-state operations, I don’t prefer to buy smaller operations in a bunch of states. In my experience, organizing our operations by region increases our efficiency and profitability. I’m very firmly in support of creating one larger brand than smaller regional brands. It’s easier to develop with marketing and advertising.
As the cannabis industry — now estimated to be worth more than USD 200 billion — continues to erupt around the world, Europe is about to take off.
This draws a parallel with the watershed legislative events of November 2012, when Colorado Amendment 64 and Washington Initiative 502 were implemented. These two bills kicked off a wave of medical and adult use acceptance in the United States. Europe’s medical referendums which started in 2017-2018 and the recent December 2020 United Nations acceptance of medical attributes of cannabis will do the same in that continental marketplace. Europe is following science and studying popular opinion about cannabis, just like the United States nearly a decade ago.
In many ways, the American “medical” market has been a political ploy, while the European market is truly medical in every way. Distribution through pharmacies and mainstream channels is the wave of the future. This method of distribution will both increase access and taxable bases quicker than the U.S. “medical” dispensary model. People who truly need cannabis should not be hindered by any rules or regulations to get the medicine, and the U.N. has paved the way for access while the U.S. still awaits rescheduling.
The road to medical cannabis in Europe is more stringent than that of the U.S. and Canada. This is because most European markets have strict medical standards and medicines must be produced in European Union Good Manufacturing Practices (EU GMP) certified pharmaceutical manufacturing facilities. This is the same standard that all medical Active Pharmaceutical Ingredient (API) producers are held to.
Both Canadian companies, who have just launched extraction with Canada’s “Cannabis 2.0”, and American manufacturers alike are unfamiliar with pharmaceutical API production. Some argue that food-grade GMP standards are the most similar to already-existing systems in the U.S. and Canada. However, the meaning of “medical” is clear in Europe — it means medical. Improving access for patients to products will be the central challenge for Europe over the next few years as patient growth increases.
Europe is also embracing its potential adult use markets. First came Denmark, then Luxembourg, and now the Netherlands are all beginning to engage with the question of adult use cannabis legalization. We expect Portugal will soon join this list. After all, in a post-coronavirus world, every country will be looking for a means to grapple with a devastated economy and to boost employment to widen its taxable base.
The United States was supposedly founded by Puritans escaping gregarious Europeans. Now it’s likely America will legalize cannabis within the year and Europeans will be left asking, “Why them and not us?” And it will become harder to explain why such potential for growth in employment and increased tax revenue isn’t being taken advantage of as Europe begins to emerge from lockdown. It would be shrewd to expect a wave of European adult use kick-offs in 2022.
It is clear that 2021 is setting a blistering economic pace: from mergers and acquisitions to monster capital raises, to increased debt raises to the hot special purpose acquisition companies (SPACs) London Stock Exchange (LSE) up listings and initial public offering (IPO) fever. This year will be a cannabis-fueled explosion that Europe will not be able to ignore. With Canada, the U.S. and Mexico all likely to legalize cannabis in the near future, how long will it be before South and Central America follows suit? And then, how long for this wave to reach Europe?
The real answer is, it’s already here. Early adopters of cannabis overbuilt as the Canadians were given more money than they deserved, while the U.S. market was largely fueled by private equity and proved that it could be the biggest and best-run model. Europe will follow its own path by acknowledging the failures and successes of these markets, blending them to form its own unique European model.
The American dispensary will eventually pop up in Europe in a form similar to the current social clubs of Barcelona and coffee shops of Amsterdam. Possibly specialized pharmacies will carry more cannabis products, but it’s too early to call — countries are only just beginning to figure out how cannabis rules might be shaped to fit their needs and values.
There are greater issues people are dealing with in the age of COVID-19, but that will change. Economic recovery, the need to provide medicine more quickly and affordably, social reform, green projects and many more pressing issues will become thematic of a post-COVID world; a set of themes for which a cannabis-shaped solution checks many of the necessary boxes.
There is a certain misrepresentation of cannabis as a panacea, able to cure every medical ailment and remedy every social problem if only it were legalized more broadly. While cannabis certainly is not a cure-all, it can fix many issues facing governments today. People were grateful for cannabis during these troubled times with cannabis stockpiling and usage through the roof in the early stages of the pandemic. As a result, 2021 has the potential to shatter old establishment perceptions as more consumers speak out.
Now, it is only a question of how the individual and collective European nations choose to regulate expansion across the continent. And the power to create a truly world-beating cannabis model is in their hands; without the international market differences and troubles that plague the North American sector, there will be virtually no limits to cannabis expansion throughout Europe if those in charge believe it to be so.
With the signing of the Cannabis Control Act (the Act) on April 21, 2021, Virginia became the first southern state to legalize adult use cannabis and just the fourth state to do so through the legislature. Legalizing adult use cannabis through the legislature, as opposed to through the ballot box, is not the typical route states have followed up to now. Eleven of the sixteen states and the District of Columbia have legalized adult use cannabis through the use of ballot measures. Virginia joins Vermont, Illinois, New York and New Mexico (which legalized after Virginia) as one of the few states that have gone the legislative route. Under Governor Northam’s administration, the path to legalization was swift, taking less than four months from introduction to passage.
Governor Northam added amendments to the already passed Senate Bill 1406 and the General Assembly voted to approve those amendments, with the Lieutenant Governor breaking the tie in the Senate’s vote. Upon signing, Governor Northam called the law a step towards “building a more equitable and just Virginia and reforming our criminal justice system to make it more fair.” This message and the opportunities to promote social equity through a legal cannabis industry have been consistent points of advocacy made by supporters as the bill advanced to becoming law.
Prior to the Governor’s amendments, the Act under consideration set July 1, 2024 as the date on which both legal possession and adult use sales would begin. The Governor decided to accelerate the date for legal possession to July 1 of this year, a decision believed to have been influenced by data showing that Black Virginians were more than three times as likely to be cited for possession, even after simple possession was decriminalized in the state a year prior. The regulated adult use market is still set to begin making sales on July 1, 2024; however, it remains possible that this date could be advanced through the legislature in the meantime. Nevertheless, Virginia is on track to becoming the first southern state with an operating regulated commercial cannabis market.
Creating an Administrative Structure for the Adult Use Program
This sweeping fifty-page law creates the Cannabis Control Authority to regulate the cultivation, manufacture, wholesale and retail sale of cannabis and cannabis product. The Act further lays the groundwork for licensing market participants and regulating appropriate use of cannabis; defining local control; testing, labeling, packaging and advertising of cannabis and cannabis products; and taxation. The Act also contains changes to the criminal laws of the Commonwealth. Companion to the Act are new laws addressing the testing, labeling and packaging of smokable hemp products and manufacturing of edible cannabis products. Additionally, the Cannabis Equity Reinvestment Board was created to address the impact of economic divestment, violence and criminal justice responses to community and individual needs through scholarships and grants.
While persons 21 years or older may possess up to one ounce of cannabis and cultivate up to four plants for personal use per household beginning on July 1, 2021, there are a host of regulations to be written in order to regulate the adult use market. These regulations will be the devil in the details of how the regulated market will work. Regardless, the Cannabis Control Act does establish the framework for adult use cannabis that is unique to Virginia and designed to promote and encourage participation from people and communities disproportionately impacted by cannabis prohibition and enforcement.
The Cannabis Control Authority (CCA) will consist of a Board of Directors, the Cannabis Public Health Advisory Council, the Chief Executive Officer and employees. The Board will have five members appointed by the Governor and confirmed by the legislature, each with the possibility of serving two consecutive five-year terms. The Board is tasked with creating and enforcing regulations under which retail cannabis and cannabis products are possessed, sold, transported, distributed, and delivered. It is expected that the Board will begin discussing regulations next year and that applications for licenses for cannabis cultivation facilities, manufacturing facilities, cannabis testing facilities, wholesalers, and retail stores will begin to be accepted in 2023. Importantly, a Business Equity and Diversity Support Team, led by a Social Equity Liaison, and the Equity Reinvestment Board, led by the Director of Diversity, Equity and Inclusion, are to contribute to a plan to promote and encourage participation in the industry by people from disproportionately impacted communities.
Regulating Participation in the Market
The Act empowers the Board to establish a robust and diverse marketplace with many entry opportunities for market participants. Up to 450 cultivation licenses, 60 manufacturing licenses for the production of retail cannabis products, 25 wholesaler licenses and 400 licenses for retail stores can be granted. These numbers do not include the four permits granted to pharmaceutical processors (entities that cultivate and dispense medical cannabis) under the Commonwealth’s medical program.
In addition to the sheer number of licenses that can be granted, the Act devises a unique approach to addressing concerns of a concentration of licenses in too few hands and a market dominated by large multi-state operators. At the same time, it sets up a mechanism to capitalize two cannabis equity funds intended to benefit persons, families and communities historically and disproportionately targeted and affected by drug enforcement through grants, scholarships and loans. Over-concentration and market dominance concerns are addressed by limiting a person to holding an equity interest in no more than one cultivation, manufacturing, wholesaler, retail or testing facility license. This eliminates the ability of companies to be vertically integrated from cultivation through retail sales operations. However, there are two exceptions to the impediment to vertical integration. First, the Board is authorized to develop regulations that permit small businesses to be vertically integrated and ensure that all licensees have an equal and meaningful opportunity to participate in the market. These regulations will be closely scrutinized by those looking to enter Virginia’s regulated market once they are proposed. Qualifying small businesses could benefit substantially from the economic advantages commensurate with being vertically integrated, assuming they have the access to the capital needed to achieve integration and operate successfully. The second exception allows permitted pharmaceutical processors and registered industrial hemp processors to hold multiple licenses if they pay $1 million to the Board (to be allocated to job training, the equity loan fund or equity reinvestment fund) and submit a diversity, equity and inclusion plan for approval and implementation. Consequently, Virginia is attempting to fund, in part, its ambitious social equity programs by monetizing the opportunity for these processors to participate vertically in the adult use market.
Those devilish details of how this market will function, and how onerous compliance obligations will be, will emanate from those yet to be proposed regulations covering many areas and subject matters including:
- Outdoor cultivation by cultivation facilities;
- Security requirements;
- Sanitary standards;
- A testing program;
- An application process;
- Packaging and labeling requirements;
- Maximum THC level for retail products (not to exceed 5 mg per serving or 50 mg per package for edible products);
- Record retention requirements;
- Criteria for evaluating social equity license applications based on certain ownership standards;
- Licensing preferences for qualified social equity applicants;
- Low interest loan program standards;
- Personal cultivation guidelines; and
- Outdoor advertising restrictions.
Needless to say, the CCA Board has a lot work ahead in order to issue reasonable regulations that will carry out the dictates in the Act and encourage the development of a well-functioning marketplace delivering meaningful social equity opportunities.
Much work needs to be done before July 1, 2024 to prepare for its debutThe application process for the five categories of licenses will be developed by the Board, along with application fee and annual license fee amounts. It is not clear how substantial these fees will be and what effect they will have on the ability of less-well-capitalized companies and individuals to compete in the market. The Act dictates that licenses are deemed nontransferable from person to person or location to location. However, it is not entirely clear that changes in ownership will be prohibited. The Act contemplates that changes in ownership will be permitted, at least as to retail store licensees, through a reapplication process. Perhaps the forthcoming regulations will add clarity to the transferability of licenses and address the use of management services agreements as a potential workaround to the limitations in license ownership.
Certain requirements particular to certain license-types are worthy of highlighting. For example, there are two classes of cultivation licenses. Class A cultivation licenses authorize cultivation of a certain number of plants within a certain number of square feet to be determined by the Board. Interestingly, Class B licenses are for cultivation of low total THC (no more than 1%) cannabis. Several requirements specific to retail stores are noteworthy. Stores cannot exceed 1,500 square feet, or make sales through drive-through windows, internet-based sales platforms or delivery services. Prohibitive local ordinances are not allowed; however, localities can petition for a referendum on the question of whether retail stores should be prohibited in their locality. Retail stores are allowed to sell immature plants and seek to support the home growers, an allowance that is fairly unique among the existing legal adult-use states.
Taxing Cannabis Sales
Given the perception that regulated cannabis markets add to state coffers, it is little surprise that Virginia’s retail market will be subject to significant taxes. The taxing system is straightforward and not complicated by a taxing regime related to product weight or THC content, for example. There is a 21% tax on retail sales by stores, in addition to the current sales tax rates. In addition, localities may, by ordinance, impose a 3% tax on retail sales. These taxes could result in a retail tax of approximately 30%.
Changes to Criminal Laws
Changes to the criminality of cannabis will have long lasting effects for many Virginians. These changes include:
- Fines of no more than $25 and participation in substance abuse or education programs for illegal purchases by juveniles or persons 18 years or older;
- Prohibition of warrantless searches based solely on the odor of cannabis;
- Automatic expungement of records for certain former cannabis offenses;
- Prohibition of “gifting” cannabis in exchange for nominal purchases of some other product;
- Prohibition of consuming cannabis or cannabis products in public; and
- Prohibition of consumption by drivers or passengers in a motor vehicle being driven, with consumption being presumed if cannabis in the passenger compartment is not in the original sealed manufacturer’s container.
These changes, and others, represent a balancing of public safety with lessons learned from the effects of the war on drugs.
The Act contains myriad other noteworthy provisions. For example, the Board must develop, implement and maintain a seed-to-sale tracking system for the industry. Plants being grown at home must be tagged with the grower’s name and driver’s license or state ID number. Licenses may be stripped from businesses that do not remain neutral while workers attempt to unionize. However, this provision will not become effective unless approved again by the legislature next year. Banks and credit unions are protected under state law for providing financial services to licensed businesses or for investing any income derived from the providing of such services. This provision is intended to address the lack of access to banking for cannabis businesses due to the federal illegality of cannabis by removing any perceived state law barriers for banks and credit unions to do business with licensed cannabis companies.
The adult use cannabis industry is coming to Virginia. Much work needs to be done before July 1, 2024 to prepare for its debut. However, the criminal justice reforms and commitment to repairing harms related to past prohibition of cannabis are soon to be a present-day reality. Virginia is the first Southern state to take the path towards legal adult use cannabis. It is unlikely to be the last.
Commercial real estate took a dive last year as companies began to work from home, but changing regulatory environments have opened doors to a new industry in need of property: cannabis. Growing rapidly at both the medical and adult use levels, cannabis businesses have been eager to move into vacant buildings, quickly buying up space as more states adjust their laws regarding cannabis.
Cannabis businesses cannot go at it blindly, however. Legal cannabis firms of all sizes – from the smallest startup to the biggest enterprise – will face regulatory challenges, traceability requirements, process control standards and, ultimately, the right technology to keep them moving forward in this promising industry.
Use data to keep track of plants, patients and regulations
As a highly regulated industry, cannabis companies could be investigated at any time. Regulatory authorities may, at the very least, request proof that they are compliant with state restrictions. Cannabis enterprises will only be able to quickly and easily provide that proof if they have immediate access to accurate historical data. With that information, they can generate the necessary reports at a moment’s notice and maintain a reliable audit trail.
Historical data is also useful for both growers looking to evaluate why certain plants are more successful than others and for sellers looking to improve their customer experience. By tracking everything from mother plants to clones, growers can build a strong genetics profile and gain a powerful competitive edge. Historical data also aids sellers, who can use it to enhance their digital storefronts and keep track of customer information, shopping history and other details that could improve the e-commerce experience.
In addition to customer details, sellers must also keep track of patient information when selling in a medical-only environment. Prescriptions need to be carefully managed to ensure that patients only receive products that they have been approved to purchase and use.
Utilize process control to foster scalable and repeatable processes
Process control is another vital component that every cannabis grower, manufacturer, processor and distributor must possess. They need scalable and repeatable processes to prevent steps from being bypassed, ensuring that every finished product matches the same high-quality standards. If there are no stopgaps in place, steps could be missed if employees are rushing to meet a deadline or simply think that a particular test or check isn’t needed. Those kinds of mistakes can be hugely detrimental to any cannabis company and may waste product, diminish profits and turn off customers.
Similarly, visibility and control over inventory is a top priority for any business, but it reigns supreme in the cannabis space. Managers should always, at all times, know where the product is as it moves throughout the warehouse, or risk costs and waste. By directly tying scanners and barcodes to the right technology, organizations can ensure that all product is accounted for and easily located using real-time data.
Build a foundation for scalability
Cannabis businesses don’t have the time to manually keep track of these aspects, and it wouldn’t even be possible as they grow and expand their operations. As they evolve, so too will the list of software requirements that are needed to operate smoothly, reliably and efficiently.
Cannabis processors have traditionally invested in seed-to-sale technology, relying on barcodes to track products throughout their lifecycle. While it is critical for cannabis enterprises to keep a strong level of control over lot tracking, this type of software is very limited. Cannabis firms would therefore be better served by an ERP solution with a single data source that provides centralized, real-time access to vital business information.
ERP technology can also help cannabis businesses better manage their production schedule, material requirements planning, accounting, purchasing, inventory management and document generation. The key, however, is to choose the right technology, avoiding ERP solutions that rely on customizations and bolt-ons, which will impede an organization’s ability to scale. Cannabis businesses should instead use technology that makes all of its features, enhancements and extensibility available to all customers, ensuring that every user has access to the same benefits.
Late last week, the American Association for Laboratory Accreditation (A2LA) granted ISO/IEC 17065 accreditation to Americans for Safe Access (ASA). This is the first accreditation ever issued to a product certification body in the cannabis market.
ASA is a member-based organization founded in 2002 that seeks to ensure safe and legal access to cannabis for medical purposes and research. Back in 2016, A2LA and ASA partnered on a collaboration to develop the Patient Focused Certification (PFC) program.
What started as a supplement to ISO 17025 for cannabis testing labs to demonstrate a dedication to patient safety, has grown into a more comprehensive certification and consulting program that offers training, business services, company certifications. With the ISO 17065 accreditation, ASA can now deliver PFC certifications that confidently identify reliable and high-quality medical cannabis products, business and services.
Jonathan Fuhrman, program manager at A2LA, says this is a big milestone for ASA’s platform. “ISO/IEC 17065 and product certification can play a decisive role in the evolution of cannabis as medicine,” says Fuhrman. “With its high standards for competence and impartiality, adopting ISO/IEC 17065 represents a major win for healthcare providers and patients.”
Heather Despres, the director of ASA’s Patient Focused Certification program, says she is thrilled to be the first cannabis compliance organization to attain the accreditation. “The PFC program was developed by ASA in an effort to continue our commitment to protect patients, many of whom are medically fragile, and consumers who may be seeking medicine outside of conventional medicinal channels,” says Despres. “There is no other process that can demonstrate that continued commitment more than achieving ISO 17065 accreditation.”
Canopy Growth Corporation, the Canadian cannabis powerhouse moving its way throughout international markets, has signaled another move into the United States to push their new CBD beverage line. The company inked a deal with Southern Glazer’s Wine & Spirits, a large U.S. alcohol distributor.
This follows the launch of their first CBD-infused beverage line sold in the United States, Quatreau. In the initial phase of the agreement, Southern Glazer’s will distribute the beverage line in seven states, with plans to expand that footprint considerably in the coming months.
Being a national distributor with a strong presence throughout the country, Southern Glazer’s will be moving Canopy’s beverage line in conventional retail stores. The press release seems to credit Canopy’s partnership with Constellation Brands as the catalyst for the new distribution deal. “The agreement also showcases the benefits of the company’s strategic relationship with Constellation Brands, the global beverage leader,” reads the release.
Back in 2018, Constellation Brands made a $4 billion bet on Canopy, but immediate profitability did not come to fruition. This new deal with Southern Glazer’s, as well as the launch of the Quatreau beverage line, seems to prove Constellation’s bet is beginning to pay off, or at least showing signs of a long term play for market share.