Tag Archives: risk

Cannabis M&A: Take Care of the Due Diligence Essentials

By Michael G. Lux
No Comments

As the regulated cannabis industry matures, M&A activity is expected to continue accelerating. Whether they are existing licensed businesses looking for acquisition opportunities or new investor groups seeking to enter or expand their positions in the industry, investors should recognize the special due diligence challenges associated with cannabis industry transactions.

Above all, investors should avoid the temptation to omit or short-circuit long-established due diligence practices, mistakenly believing that some of these steps might not be relevant to cannabis and hemp operations. Despite the unique nature of the industry, thorough and professional financial, tax and legal due diligence are essential to a successful acquisition.

Surging M&A activity

Over the past few years, as the cannabis industry matured and the regulatory environment evolved, M&A activity involving cannabis and hemp companies has undergone several cycles of expansion and contraction. Today, the expansion trend clearly has resumed. Although the exact numbers vary from one source to another, virtually all industry observers agree that 2021 saw a strong resurgence in cannabis-related M&A activity, with total transactions numbering in the hundreds and total deal values reaching into billions of dollars. Moreover, most analysts seem to agree that so far, the pace for 2022 is accelerating even more.

Today, many existing cannabis and hemp multistate operating companies are in an acquisitive mood as they look for opportunities to scale up their operations, enter new markets, and vertically integrate. At the same time, the projections for continued industry growth over the next decade have attracted a number of investment funds and private equity groups, which were formed specifically for the purpose of investing in cannabis and hemp businesses.

These two classes of investors often pursue distinctly different approaches to their transactions. Unlike the largely entrepreneurial cannabis industry pioneers now looking to expand, the more institutional investors are accustomed to working with professional advisers to perform financial, tax and legal due diligence as they would for a transaction in any other industry.

Among both groups, however, there is sometimes a tendency to misunderstand some of the transactional risk elements associated with cannabis M&A deals. In many instances, buyers who are generally sensitive to potential legal and regulatory risks will underestimate or overlook other risks they also should examine as part of a more conventional financial and tax due diligence effort.

For example, since much of the value of a licensed cannabis operation is the license itself, investors often rely largely on their own industry understanding and expertise to assess the merits of a proposed acquisition, based primarily on their estimation of the license’s value. This practice provides acquirers with a narrow and incomplete view of the deal’s overall value. More importantly, it also overlooks significant areas of risk.

Because cannabis acquisition targets typically are still quite new and have no consistent earning records, acquirers also sometimes eschew quality of earnings studies and other elements of conventional due diligence that are designed to assess the accuracy of historical earnings and the feasibility of future projections.

Such assumptions and oversights often can derail an otherwise promising transaction prior to closing, causing both the target and the acquirer to incur unnecessary costs and lost opportunities. What’s more, even if the deal is eventually consummated, short-circuiting the normal due diligence processes can expose buyers to significant unanticipated risk down the road.

Recurring issues in cannabis acquisitions

The most widely recognized risks in the industry stem from the conflict between federal law and the laws of various states that have legalized cannabis for medical or adult recreational use. The most prominent of these concerns relates to Section 280E of the Internal Revenue Code (IRC 280E).

Although its use is now legal in many states, cannabis is still classified as a Schedule I substance under the federal Controlled Substances Act. IRC 280E states that any trade or business trafficking in a controlled substance must pay income tax based on its gross income, rather than net income after deductions. As a result, cannabis businesses are not entitled to any of the common expense deductions or tax credits other businesses can claim.

The practical effect of this situation is that cannabis-related businesses – including growers, processors, shippers and retailers – often owe significant federal income tax even if they are not yet profitable. Everyone active in the industry is aware of the issue, of course, and any existing operating company or investment group will undoubtedly factor this risk into its assessment of a proposed acquisition target.

The challenge can be exacerbated, however, by other, less widely discussed factors that also affect many cannabis businesses. These issues further cloud the financial, tax and regulatory risk picture, making thorough and professional due diligence even more critical to a successful acquisition.

Several of these issues merit special attention:

  • Nonstandard accounting and financial reporting practices. As is often the case in relatively young, still-maturing businesses, acquisition targets in the cannabis industry might not have yet developed highly sophisticated accounting operations. It is not uncommon to encounter inadequate accounting department staffing along with financial reporting procedures that do not align with either generally accepted accounting principles or other standard practices. In many instances, company management is still preparing its own financial statements with minimal outside guidance or involvement by objective, third-party professionals. Significant turnover in the management team – and particularly in the chief financial officer position –is also common, as is a general view that accounting is a cost center rather than a value-enhancing part of the management structure.

Such conditions are not unusual in young businesses that are still largely entrepreneurial in spirit and practice. In the cannabis industry, however, this situation is also a reflection of many professional and business services firms’ longstanding reluctance to engage with cannabis operators – a hesitancy that still affects some organizations.

When customary business practices are not applied or are applied inconsistently, acquiring companies or investors should be prepared to devote more time and attention – not less – to conventional financial due diligence. The expertise of professional advisers with direct experience in the industry can be of immense benefit to all parties in this effort.

  • Restructuring events or nonrecurring items in financial statements. Restructuring events and nonrecurring items are relatively common in many new or fast-growing businesses, and they are especially prevalent among cannabis operations. In many instances, such companies have engaged in multiple restructuring events over a short period of time, often consolidating operations, taking on new debt, and incurring various one-time costs that are not directly related to the ongoing operations of the business.

The inclusion of various nonrecurring items within the historical financial statements can make it much more difficult for a buyer or investor to accurately identify and assess proforma operating results, especially in businesses that have not yet generated consistent profits. Here again, applying previous experience in clearing up the noise in the financial statements can help improve both the accuracy and timeliness of the due diligence effort.

  • Run-rate results inconsistent with historical earnings or losses. A company’s run rate – an extraction of current financial information as a predictor of future performance – is a widely used tool for creating performance estimates for companies that have been operating for short periods of time or that have only recently become profitable. In cannabis businesses, however, run-rate estimates sometimes can be unreliable or misleading.

Because it is based only on the most current data, the run rate often does not reflect significant past events that could skew projections or recent changes in the company’s fundamental business operations. Because such occurrences are relatively common in the industry, the results of run-rate calculations can be inconsistent with the target company’s historical record of earnings or losses.

  • Historical tax and structuring risks new owners must assume. Like many other new businesses, cannabis operations often face cash flow and financing challenges, which owners can address through alternative strategies such as debt financing, stock warrants, or preferred equity conversions. Such approaches can give rise to complex tax and financial reporting issues as tax authorities exercise their judgment in interpreting whether these items should be reported as liabilities or equity derivatives. The situation is often complicated further by various nonstandard business practices and the absence of sophisticated accounting capabilities, as noted earlier.

As a consequence, financial statements for many cannabis companies – including a number of publicly listed companies – often contain complex capital structures with numerous types of debt warrants, conversion factors and share ownership options. Although an acquisition would, in theory, clean up these complications, buyers nevertheless must factor in the risk of previous noncompliance that might still be hidden within the organization – a risk that can be identified and quantified only through competent and thorough due diligence.

Not as simple as it seems

On the surface, the fundamentals of the cannabis industry are relatively straightforward, which is one reason it appeals to both operators and investors. For example, participants at every stage of the cannabis business cycle – growing and harvesting, processing and packaging, shipping and distribution, and ultimately marketing and retailing – can readily apply well-established practices from their counterparts in more conventional product lines.

The major exception to this rule, of course, is the area of regulatory compliance, which is still shifting and likely will continue to do so for the foreseeable future. Outside of this obvious and significant exception, however, most other aspects of the industry are relatively predictable and manageable.

When viewed in this light and in light of the continued growth of the industry, it is easy to see why cannabis-related acquisitions are so appealing to existing business operators and outside investors alike. It is also easy to understand why buyers might feel pressure to move quickly to take advantage of promising opportunities in a fast-changing industry.

As attractive as such opportunities might be, however, buyers should take care to avoid shortcuts and resist the urge to sidestep established due diligence procedures that can reveal potential accounting and financial statement complications and the related compliance risks they create. The unique nature of the cannabis industry does not make these practices irrelevant or unnecessary. If anything, it makes professional financial, tax, and legal due diligence more important than ever.

Crowe Disclaimer: Qualified organizations only. Independence and regulatory restrictions may apply. Some firm services may not be available to all clients. Given the continued evolution and inconsistency of various state and federal cannabis-related laws, any company should seek competent legal advice relating to its involvement in the cannabis industry, including when considering a potential public offering as a cannabis-related company.

Cannabis Banking: The Ins, the Outs & the Unknowns

By Tamara L. Kolb, Amy Bean, Caitlin Strelioff
No Comments

As the legal cannabis market expands, banks and nonbank financial institutions (NBFIs) across the United States continue to explore how to safely provide banking and other financial services to cannabis-related businesses (CRBs) and other CRB ecosystem players. At the same time, these organizations are taking into account changes they might need to consider relative to their Bank Secrecy Act ( BSA), anti-money laundering (AML) and related compliance programs. 

Regulatory conundrum

The Controlled Substances Act (CSA) identifies the cannabis plant and all its derivatives as a Schedule 1 controlled substance. Schedule 1 controlled substances have a “high abuse potential with no accepted medical use,” and they cannot be “prescribed, dispensed, or administered.” Because cannabis remains classified as a Schedule 1 controlled substance, the CSA “imposes strict controls on possession, manufacturing, distribution, and dispensing” of cannabis.

Under the Money Laundering Control Act of 1986 (MLCA) and the BSA as amended, covered banks and NBFIs are prohibited from providing financial services to businesses that are engaged in illicit activities. Because federal law prohibits the distribution and sale of cannabis, financial transactions involving CRBs are therefore deemed to be transactions that involve funds derived from illegal activities.

As of Feb. 3, 2022, 18 states, two territories, and the District of Columbia have enacted legislation to regulate cannabis for adult use. Thirty-seven states, the District of Columbia and four territories have approved comprehensive, publicly available medical and cannabis programs. Eleven states allow for the use of low-THC, high-CBD substances for medical reasons in limited situations or as a legal defense.

The growing divide between federal prohibition and state legalization of the cannabis industry creates a precarious position for federally regulated banks and NBFIs with the main concern involving exposure to legal, operational and regulatory risk. The situation begs the question: How might the federal government and regulators pursue and prosecute players in the legal cannabis industry?

The current economic trajectory predicts that retail sales of legal cannabis products in the U.S. will surpass an estimated $41.5 billion annually by 2025, and many banks and NBFIs are eagerly awaiting the federal green light to do business with CRBs without fear of prosecution or legal ramifications.

From 2018 forward, Congress has made several attempts to pass legislation that would protect CRBs when cultivating, distributing, marketing, and selling cannabis products in their state-legalized form. These efforts to declassify cannabis-related activity as a specified unlawful activity have thus far been unsuccessful.

The House passing the MORE Act back in 2020

Passage of the Secure and Fair Enforcement Banking Act of 2021 (SAFE Banking Act) and the Marijuana Opportunity Reinvestment and Expungement Act of 2021 (MORE Act) would enable banks and NBFIs to provide financial services to CRBs. The SAFE Banking Act would provide a safe harbor for banks and NBFIs that provide financial services to CRBs. The MORE Act would deschedule cannabis from the CSA entirely.

Questions to ask

Banks and NBFIs interested in providing financial services to CRBs should ask these questions:

  • Do we adequately understand our risk, and what are the implications for our organization? How should we augment our risk assessment process and our controls?
  • To what extent are we willing to accept the risk of banking CRBs? Do we have the ability to identify CRB customers, and if so, do we have any?
  • How should we advise the board of directors about setting risk appetite?
  • What customer due diligence (CDD) and enhanced due diligence (EDD) will we need to safely continue with existing customers and onboard new ones?
  • How will we monitor for unusual and suspicious activity? What will be the alerting and judgmental criteria?
  • How will our resource needs change so that we stay abreast of new processes and controls?

Risk appetite considerations

In order to determine whether to accept or prohibit CRBs, banks and NBFIs should identify the level of acceptable risk they are willing to take on. Several key components need to be considered, such as:

  • The board of directors’ stance on legal cannabis, given that good governance recommends and regulators expect that the board sets risk appetite
  • Cannabis laws in states within the customer footprint and the impact on customers’ communities
  • Risk profile, customer base, geographic location, products, and services
  • Relationship with regulators and any recent deficiencies or weaknesses in the BSA and associated compliance programs
  • Ability to implement appropriate controls and staffing

 Developing a strategic road map

If the decision is made to bank CRBs, banks and NBFIs should perform an assessment of compliance maturity for existing BSA/AML program processes and controls to identify potential gaps and develop a strategic road map that helps the organization achieve its vision for future state compliance and sustainable operations. 

A well-developed and well-articulated strategic road map visualizes what actions or key outcomes are needed to help organizations achieve their long-term goals. When creating the road map, banks and NBFIs need to demonstrate a keen understanding of their desired strategy, outcomes, markets, and products for onboarding and banking CRB customers. Specifically, banks and NBFIs need to define and explain how desired outcomes and business strategies create risk and exposure.

In addition to a road map, banks and NBFIs should develop and document a detailed risk-based approach that is aligned to the organization’s risk tolerance to determine necessary compliance steps when banking CRB customers.

Specifically, the following activities should be considered when developing a CRB banking program that meets regulatory expectations:

  • Identifying BSA/AML control gaps related to CRB risk identification and mitigation and formulating a plan to address them
  • Updating a board-approved policy framework
  • Updating detailed operating policies and procedures
  • Planning for capacity, developing job descriptions, and onboarding new personnel
  • Training for all three lines of defense, senior management, and the board
  • Developing and documenting a phased or full approach to acceptance of CRB customers
  • Developing and documenting a CRB program oversight policy

CRB risk framework

A three-tiered CRB risk framework first proposed in 2016 has quickly become the cannabis industry standard. The framework has evolved and expanded comprehensively to consider many types of CRBs, and evolving legal systems continue to refine the framework.

This framework is intended to help banks and NBFIs differentiate types of CRBs and their corresponding risks, and it separates CRBs into three tiers and details risks for each tier. The following exhibit summarizes the approach:

Risk framework by tier

Level Risk
Tier 1 Direct
Tier 2 Indirect with substantial revenue from Tier 1
Tier 3 Indirect with incidental revenue from Tier 1

Source: CRB Monitor

Even the most conservative of risk appetites equivalent to outright prohibition is not devoid of significant risk considerations. Residual risk frequently encompasses a large number of indirect connections in the total CRB ecosystem. Common examples are printers, lawyers, accountants, landlords, and even utilities and taxing authorities, and all of these are subject to regulatory scrutiny and, importantly, visibility to law enforcement. Also, policies to prohibit or restrict will be audited and examined for compliance, and exceptions will require explanations.

This panorama necessitates expertise and prudence in identifying and evaluating risks within the many layers of CRBs. For example, consider a bank or NBFI that banks a CRB’s employee or vendor. If a bank fails to properly implement controls that would allow it to identify and mitigate risk associated with banking CRBs, it will be susceptible to severe violations of the BSA, including civil money penalties, criminal penalties, and regulatory enforcement actions. 

Implementing necessary precautions

A well-developed road map should consider and implement the following activities:

  • Understanding the most current state and federal cannabis laws and regulations to ensure the bank or NBFI’s compliance
  • Understanding the local, state, or tribal program to ensure CRB customers are compliant with the program
  • Implementing a CRB risk assessment
  • Implementing executive approval practices for direct CRBs
  • Developing adequate risk ratings (possibly through a risk-based, tiered approach) and corresponding monitoring for CRB customers that includes:
    • Integrating various customer onboarding and AML solutions at both onboarding and periodic levels
    • Scheduling regular reviews to include recurring enhanced due diligence, site visits, and transaction monitoring
    • Monitoring for suspicious activity, including red flags, via open sources for adverse information about the CRB customers and related parties such as beneficial owners
  • Performing adequate CDD and EDD that will validate that the CRB-offered products, services, and programs are compliant with most current state laws and regulations by:
    • Collecting appropriate documentation as evidence of compliance, perhaps including a comprehensive onboarding questionnaire, beneficial ownership information, and contracts for the growing, harvesting, transporting and processing of the product
    • Reviewing applications and supporting documentation used to obtain a legal cannabis state license
    • Understanding the normal and expected activity of the organization’s CRB customers and their product usage
  • Developing adequate training programs and governance and oversight programs to address this customer type by:
    • Updating existing policies and procedures to review inherent risk presented by banking CRB customers
    • Updating annual training for employees
  • Auditing initial program design and periodic operational effectiveness

Moving forward cautiously

The ins, outs, and unknowns of cannabis banking are complex, and they require banks and NBFIs to be extremely vigilant with current policy and aware of new developments. Overall, the idea of creating a cannabis program might seem like a daunting task, but with appropriate guidance and care, organizations can provide services in compliance with laws and regulations.

Crowe disclaimer: Qualified organizations only. Independence and regulatory restrictions may apply. Some firm services may not be available to all clients. Given the continued evolution and inconsistency of various state and federal cannabis-related laws, any company should seek competent legal advice relating to its involvement in the cannabis industry, including when considering a potential public offering as a cannabis-related company.

Petri dish containing the fungus Aspergillus flavus

Salmonella & Aspergillus: Controlling Risk in Your Supply Chain

By Cameron Prince
No Comments
Petri dish containing the fungus Aspergillus flavus

Risk management is the process of identifying potential hazards, assessing the associated risk, then implementing controls to mitigate those risks. With Salmonella and Aspergillus being two of the leading causes of cannabis contamination that can occur throughout the supply chain, applying upstream risk management strategies can keep supplier contamination issues from impacting your products.

Salmonella enteritidis

In recent months cannabis products have been recalled for Salmonella and/or Aspergillus contamination in several states, including California, Arizona, Michigan, Florida, as well as Canada. While the recalls impacted retail products, in most cases, the contamination occurred farther back in the supply chain, as evidenced by recalls that impacted several dispensaries or other sales locations.

For example, the November 2021 Arizona recall caused multiple establishments and dispensaries to recall product due to possible contamination with Salmonella or Aspergillus; the Michigan recall of an estimated $229 million in cannabis products due to “inaccurate and/or unreliable results of products tested.” While a lab lawsuit against the recall released some of the product to market, the companies faced significant impact – in both removing and returning the product.

While microbial contamination can occur throughout the supply chain, Aspergillus is ubiquitous in soil and the flower, leaves, roots of the cannabis plant are all susceptible to such contamination. The mold also can colonize the bud both during growing and harvesting. Salmonella can be introduced during growing through, untreated manures, direct contact with animal feces, or contamination of surface water used for irrigation. However, the plant matter also can be compromised during drying, storage and processing from environmental contamination.

Petri dish containing the fungus Aspergillus flavus
Aspergillus flavus

Supply chain risk management. To prevent a supplier’s contamination issues from becoming your problem to deal with, each facility at each step of the chain should develop a supply chain risk management program to assess and approve each of its upstream providers. Following are 5 key steps to assessing and managing risk in your supply chain:

  1. Conduct a hazard analysis. A complete supply chain assessment should begin with a hazard assessment of all the ingredients, products or primary packaging you receive. There are two essential steps involved in conducting a hazard analysis: that is the identification of potential hazards – considering those related to the item itself, as well as the supplier environment and process as well as item – and an evaluation to determine if each hazard requires control based on its severity and likely occurrence.
  2. Evaluate the risks. Based on the hazard analysis, the next step is to determine the associated risk. As defined by the European Food Information Council (EUFIC), “a hazard is something that has the potential to cause harm while risk is the likelihood of harm taking place, based on exposure to that hazard.” For example, the higher the exposure, the higher the risk.
  3. Ensure risk control. Once risk is determined, it is critical to ensure that it is being controlled, who is controlling it and how it is being done. Depending on the risk, that control may need to be conducted by the supplier, by you or even by a downstream customer.
  4. Require documentation. No matter which step in the chain is controlling the risk, it is essential that all be documented with records easily accessible – including the controls, any out-of-compliance events and corrective actions. The adage, “If it’s not documented, it didn’t happen,” is very applicable here, particularly should a problem arise and an inspector appear at your door.
  5. Use only approved suppliers. Implementation of the above steps enable the development of a supplier approval program focused on quality, safety and regulatory compliance. Use of only suppliers who have been assessed and found to meet all your standards will help to protect your product and your brand.

Salmonella and Aspergillus contamination can occur throughout the supply chain, but implementing a supply chain risk assessment and management program will enable you to determine where the greatest risks lie among your ingredients and suppliers, allowing you to allocate resources based on that risk.

Top Five Insurances Cannabis Businesses Need in 2022

By Eric Rahn
No Comments

Cannabis remains one of the fastest growing industries with no signs of slowing down. According to a recent article in Forbes Magazine, the legal cannabis market is poised to grow 20-30% per year to the tune of $50 billion by 2026.[1]With great opportunity comes numerous risks. Claims and lawsuits against cannabis businesses are increasing in frequency and magnitude. As an insurance broker who specializes in the cannabis industry and works with a wide variety of cannabis, hemp and CBD businesses in every state where cannabis laws are established, our recent analysis has unveiled the top five insurances your cannabis business needs in 2022.

  1. General Liability

General liability is the most essential coverage your business needs to protect you from a variety of claims including personal injury, bodily harm, property damage and other situations that may arise including slander, libel, copyright infringement and more.

Since general liability is not always required to obtain a cannabis license, many businesses are tempted to forgo the expense. This is one of the biggest mistakes you can make as one single lawsuit has the potential to cripple your business. With a comprehensive, cannabis-specific general liability insurance policy in place, your insurance company, not you, will pay medical expenses and property damage claims from third parties, in addition to hefty legal fees and fines.

  1. Property & Casualty Insurance
P&C insurance is an important part of your security and protection plan.

If you own a dispensary, grow operation, warehouse, testing facility or any other type of cannabis business with inventory, you need to protect your assets from potential loss or damage. Property & casualty (P&C) insurance safeguards your business against common and costly perils such as a fire, lightning, explosion/implosion, and even less common – but still possible – risks like riots, strikes and terrorism.

P&C insurance not only pays for damages to your business property resulting from a covered loss but it also covers the contents within your place of business, including office furniture, computers, inventory and other assets essential to your business operations. There are policies that will also provide the funds required to keep your business afloat until the damages from the loss are repaired. Any cannabis business with a physical property and location(s) should have a comprehensive property and casualty P&C policy in place.

  1. Product Liability/Product Recall

Recently, we’ve seen a dramatic influx of product liability claims, and in particular, product recalls. Lawsuits have ranged from a single plaintiff seeking damages for personal injuries to class action lawsuits where a defective product is tied to an entire group of claimants.

control the room environment
Preventing contamination can save a business from extremely costly recalls. Having the right insurance can prevent a recall from becoming costly in the first place.

As a cannabis business owner, you can be sued for any damage resulting from products that cause harm to others, this includes false advertising, mislabeled or defective products. No matter where you are in the supply chain, your business could be held liable. The process of defending litigation or reaching a settlement agreement can completely drain a company’s resources. You’ll have to deal with regulatory compliance, producing and distributing product warnings, recalling products, claim investigation, product testing and additional risk assessment.

Product liability insurance is often overlooked, especially by small to mid-size businesses. However, your cannabis business needs this type of coverage if you sell any goods or products that end up in the hands of the public. In fact, your business may be contractually obligated to have product liability insurance. One such lawsuit is enough to fold a business due to costly legal fees and fines, as well reputation damage beyond repair.

Product liability insurance is designed to protect your cannabis company from claims that can happen anywhere along the supply chain, including product contamination, mislabeled products, false advertising or defective products. With proper coverage, your insurance company will pay for damages and legal expenses if you are sued, up to your policy limits. Your product liability policy will also cover any medical expenses for those who are harmed by your business. Making sure your insurance policy includes product liability insurance should be a top priority in 2022.

  1. Cyber Defense/Data Breach Insurance

Cyber fraud and data breaches are two of the greatest risks facing cannabis companies in 2022. With so much cash pouring into the space, cannabis businesses of all sizes are bulls-eye targets for cybercriminals. Even the smallest of cannabis businesses are at risk of data breaches because they are part of a larger interconnected network of seed to sale vendors. These types of crimes can have detrimental effects on your business in numerous ways. In the case of a data breach resulting in the disclosure of a third party’s private information, the third party could sue your business. The SEC could also find your company negligent in cyber fraud cases and impose significant fines.

By forgoing cyber defense & data breach insurance, your business will be solely responsible for expensive legal bills, significant revenue losses and hefty fines and penalties from regulators. Cyber defense & data breach insurance is a must-have coverage in 2022, and beyond, to protect your business from cybercrimes.

  1. Directors & Officers Insurance

If you are looking to secure venture capital or funding from investors in 2022, and/or attract and retain qualified leadership, you need directors & officers (D&O) Insurance. D&O protects corporate directors and officers, as well as their spouses and estates, from being personally liable in the event your company is sued by investors, employees, vendors, competitors, customers, or other parties, for actual or alleged wrongful acts in managing the company. In the event of litigation, your D&O insurance will cover legal fees, fines, settlements and other expensive costs.

D&O is often the most overlooked coverage because many cannabis businesses are independently run, and no one foresees the potential for operational failures and mismanagement. However, businesses with any sort of vision for growth should make D&O a top priority. It not only protects your current executives and board members but is critical in attracting leading talent in the space, as well as drawing in new investors to scale up your business. In fact, we’re seeing more prospective investors and board members requiring D&O insurance prior to engaging with a company to ensure they are fully protected in the event of litigation.

When it comes to mitigating risk in this business, the stakes are sky high. Cannabis companies that have not incorporated risk management into their business/operational plans will need to in 2022. It all boils down to the THREE P’s: being “Proactive, Prepared and Protected.”

2022 Cannabis Industry Outlook: Your Business’ Future Depends on its Risk Management

No Comments

Cannabis risks have always outpaced the availability of insurance, in large part because of its status as a federally illegal substance and the dangers in extraction and production. But it now shares many of the same risks as other industries — catastrophic crop damage, cyber risk and a shortage of skilled workers.

With legalization becoming more common, the industry is positioned for enormous growth despite these challenges. However, enterprises that will benefit the most are those best positioned to manage risk.

Here are four obstacles to growth in the industry in 2022 and how enterprises can combat them:

Cybercrime will be the top manufacturing risk

Both cybercrime and cannabis have experienced major booms since the start of the COVID-19 pandemic. Cannabis companies watched as healthcare and pharmaceutical organizations were hit hard by cybercriminals in 2020, and now the threat could be headed their way.

For retailers, the vulnerability often lies in their POS tech

For cannabis retailers, the vulnerability lies in their dependence on point-of-sale tech, while the threat for cultivators exists within their strong use of intelligent automation to manage the grow environment. Across the industry, the lack of sophisticated IT security systems is like a beacon for bad actors.

Nearly 60% of cannabis businesses say they haven’t taken the necessary steps to prevent cyberattack, but the winds are changing. Due to these concerns and the growing attention on cybercrime in the industry, cyber coverage is expected to rise 30% or more in 2022, which puts the onus on risk management practices that will help prevent cyberattacks and ensure coverage from insurers concerned about risk.

Barriers to business growth may result in more M&A

As of summer 2021, 18 U.S. states have legalized adult use and 37 states have legalized medical cannabis.

While this is opening opportunities for many cannabis businesses, the U.S. remains a complicated market. Federal regulations continue to hinder even more cannabis industry growth by restricting lending to the industry from traditional banking and financial institutions. While it’s not illegal to do service with the cannabis industry, many institutions stay away due to its high risk.

Smaller cannabis companies are impacted most heavily by this barrier and await passage of the Secure and Fair Enforcement (SAFE) Banking and Clarifying Law Around Insurance of Marijuana (CLAIM) Acts to allow easier access to capital. Together, these two acts of legislation will provide guidelines on how to work lawfully with legal cannabis businesses and prohibit penalizing or discouraging institutions from working with them.

In the meantime, M&A activity is expected to increase in 2022 as large cannabis businesses have the means to access capital and acquire these small companies. This includes Canadian cannabis companies, unburdened by federal restrictions, who are expected to increase their cross-border mergers and acquisitions.

Severe weather isn’t easing up

Extreme natural catastrophes are no longer rare, and they have only added greater uncertainty to the industry which has always had difficulties securing crop insurance.

NASA’s Aqua satellite took this picture of the smoke over California in 2017
Photo: NASA

For example, policies that transfer wind and hurricane damage risk in Florida or wildfire and smoke taint in California are virtually non-existent for cannabis — and for outdoor growers, a single weather event can wipe out an entire crop with no recourse.

One possible solution for cannabis companies that cannot secure traditional crop insurance is parametric insurance, which pays out in full when a weather element reaches a threshold, regardless of the actual damage.

Growers with indoor operations, or those considering moving that way, must cope with energy conservation initiatives. Measures like the one in California that would require indoor growers to use LED lighting by 2023 could cost the industry millions and present a direct threat to small operations’ viability. This makes it important for cannabis producers to institute conservation measures and undertake risk mitigation measures like improved safety measures at indoor growth facilities ahead of 2022 renewals.

As a continually emerging market, cannabis risks are great. Adding to these pressures is the growing impacts of climate change and cybercrime raising the bar even further. Growth for the cannabis industry in 2022 will depend upon strong risk management solutions and the ability for cannabis companies to implement them.

Nonprofits Focus Lens on Delta-8-THC

By Cannabis Industry Journal Staff
No Comments

On December 2, ASTM International, released a whitepaper called “Delta-8-Tetrahydrocannabinol and the Need to Develop Standards to Protect Safety of Consumers.” On the same day, the U.S. Pharmacopeia (USP) launched an expert panel, drafting commentary and providing recommendations to protect public health. The two organizations are working in tandem to better educate the public as well as regulators on the science behind the risks that delta-8-THC products pose to the public.

The chemical structure of Delta 8 THC.

ASTM has been working in the cannabis industry through their D37 committee since March of 2017. Soon after the D37 committee launched, they began crafting cannabis standards and have grown their membership and subcommittees considerably over the past few years. USP has also been involved in the cannabis space for quite some time, developing reference standards and offering guidance for the cannabis testing market.

The ASTM whitepaper details the current landscape for hemp-based products that contain delta-8-thc derived from CBD. It includes information on what the cannabinoid is, how it’s produced, the emergence of delta-8-thc in hemp markets and the need for better safety and performance standards.

David Vaillencourt, frequent CIJ contributor and ASTM International member, says they want to identify how we can maintain public safety when it comes to delta-8-THC. “Products containing delta-8-THC are widely available to consumers despite the known and unknown risks to consumer health and safety,” says Vaillencourt. “The topic is much deeper than simply the presence of delta-8-THC. Rather it is about defining how to label products containing potentially intoxicating cannabinoids and identifying what safeguards need to be in place to minimize the risk of impurities that can further impact consumer health.”

In addition to the technical information provided, ASTM’s whitepaper also discusses the risks of synthetic cannabinoids to public health and the regulatory landscape surrounding delta-8-THC. USP’s whitepaper discusses the chemical process that creates delta-8-THC, the unregulated market and offers guidance on how to regulate the cannabinoid with labeling and testing rules.

Dr. Ikhlas Khan, chairman of USP’s expert panel on cannabis, says we need a lot more research.  “The fact of the matter is that little is known about the products labeled as containing delta-8, so much so that the FDA and CDC have both released advisories about the products,” says Khan. “Depending on how the products are produced, unknown impurities may be introduced, including minor and synthetic cannabinoid compounds that are not naturally occurring in cannabis.”

Delta-8-THC is not inherently unsafe, says Dr. Nandakumara Sarma, Director of Dietary Supplements and Herbal Medicines for USP. But as we’ve covered this before, the methods that manufacturers use to produce delta-8-THC could have harmful byproducts present in final products. “Synthetically derived cannabinoids are not necessarily inherently unsafe if they are quality controlled and shown to be safe,” says Dr. Sarma. “By using public quality standards, we can help in controlling the quality of the products and set appropriate limits for impurities.”

The folks at USP and ASTM will host a presentation on the two papers during ASTM’s 2nd Global Workshop on Advancing the Field of Cannabis through Standardization, to be held virtually Dec. 14, 2021. Click here to register.

The Path Forward to a Safer Cannabis Industry

By Roshan Sebastian
1 Comment

Two decades ago, California became the first state to legalize the medical use of cannabis. In 2021, medical use of cannabis is legal is 36 US states, and 17 states allow adult (‘recreational’) use. This trend of rapid legalization of the cannabis industry, while encouraging for industry growth, attracts more attention from federal regulatory bodies such as the Occupational Safety and Health Administration (OSHA). Following a number of incidents and near misses, cannabis facilities have been increasingly frequented by OSHA visits, leading to a spike in citations and fines. A review of past OSHA citations reveals that the most common citations in the cannabis industry pertains to the employer’s lack of awareness about the hazardous nature of some operations and materials handled in the facility. This leads to an absence of a formal fire prevention plan, lack of proper hazardous chemical training, deficiency in proper documentation related to workplace injury and limited evaluation of required personal protective equipment (PPE).1

Cannabis industry data suggests that as of today, an incident is often followed by an OSHA inspection.  This naturally leads to the facility asking, ‘How do we prepare for an OSHA inspection and prevent future citations?’ The answer is a combination of identifying and mitigating risks in advance to avoid incidents and developing management systems that support the identification and risk mitigation efforts. Recent collaboration between cannabis business owners and organizations that write codes and standards have provided a framework in which to address the industry’s unique safety challenges to help reduce inherent risk to a facility. These codes and standards typically impact building construction/safety features and operation of the facility, however, additional risk mitigation can be drawn from the best practices already in place in process industries with similar hazards. These process industries have embraced process safety management (PSM) programs, which are built around principles flexible enough to be successfully implemented in the cannabis industry. Adopting such programs will serve the dual purpose of improving the overall safety record of the cannabis industry while enhancing company sustainability2 and help avoid events that lead to OSHA citations.

Figure 1. Risk Based Process Safety Management System

The risk-based process safety (RBPS) approach developed by the Center for Chemical Process Safety (CCPS)3 may prove to be the most effective framework to implement PSM programs in the cannabis industry. Unlike the prescriptive regulatory approach provided by OSHA 29 CFR 1910.119, the RBPS methodology recognizes that not all hazards and risks are equal. By assessing risk, an organization can develop an effective management system that will prioritize allocation of limited resources to address the highest risks. Figure 1 shows the four foundational blocks (pillars) of RBPS and the various elements that make up each pillar.

If a cannabis business owner were to develop programs on each of the pillars presented in Figure 1, a comprehensive safety program would be in place that delivers sustainable risk reduction and mitigation.  However, as with any industry, the elements can be prioritized and tackled over time, starting with the elements having the most influence on the overall safety of a given facility. For example, a given facility may have great procedures and practices, but may not consistently train or instill employee knowledge or competency. Conversely, a facility may have personnel with great knowledge of hazards and risks, but are less developed with regard to documenting procedures, safe practices or training for new hires. Focusing available resources on the less developed elements will lead to an overall improvement in facility risk, leading to a lower likelihood of an incident and OSHA inspection.

Figure 2. Still image from surveillance video of an explosion at New MexiCann Natural Medicine in July 2015.

As with any industry, positive and negative public perception is driven by the media, which tends to focus on attention-grabbing headlines. The majority of past incidents reported in the news for the cannabis industry were explosions that occurred during the extraction process. One such extraction explosion, shown in Figure 2, occurred in July 2015 at the New MexiCann Natural Medicine facility in Santa Fe, New Mexico. With a focus on the ‘hazard identification and risk analysis’ pillar of RBPS, future such events may be mitigated.

Of the twenty RBPS elements, hazard identification and risk analysis (HIRA) stands out as having the highest potential for immediate impact on the cannabis industry’s safety profile.

HIRA is a collection of activities carried out through the life cycle of a facility to ensure that the risks to employees and the public are constantly monitored to be within an organization’s risk tolerance. The four major areas to analyze are:

  • Hazards – What are the possible deviations from the design intent?
  • Consequences – What are the worst possible consequences (or severity) if any deviation occurs?
  • Safeguards – Are there safeguards in the system to reduce the likelihood of this event?
  • Risk – Is the risk within the tolerable level? If not, what steps are needed to reduce the risk? (Severity X Likelihood = Risk)
Figure 3. A simplified HIRA flow chart for an Extraction Process

Let us consider an example case where the extraction process utilizes propane or butane as the extracting solvent. Figure 3 shows a simplified HIRA flow chart for the extraction process.

This systematic approach helps to understand the hazards and evaluate the associated risk. In addition, this approach highlights operator training as a crucial safeguard that can be credited to lower the overall risk of the extraction facility. Remember, lack of proper safety training (another element!) is one of the most cited OSHA violations in the cannabis industry. Another advantage to the HIRA methodology is that other safeguards that may be present can be identified, their effectiveness evaluated and additional risk reduction measures may be recognized. This will help business owners allocate their limited resources on the critical safeguards that provide the greatest risk reduction. Identifying, analyzing and solving for potential hazards is a key step in safe operation of a facility and avoiding OSHA citations.

While this article discusses only a single RBPS element, this example demonstrates how best practices from process industries can become a powerful tool for use in the cannabis industry. The “hazard identification and risk analysis” element of the RBPS approach is pertinent not only for the extraction process as discussed above, but also directly applicable to other aspects of the industry (e.g., dust explosions in harvesting and processing facilities, toxic impacts from fertilizers, hazards from the CO2 enrichment process in growing facilities, etc.).

References

  1. Top 5 OSHA Infractions for Cannabis Businesses
  2. The Business Case for Process Safety; 4th Edition; Center for Chemical Process Safety; 2018
  3. Guidelines for Risk Based Process Safety; Center for Chemical Process Safety: An AICHE Technology Alliance; published March 2007
  4. Video: Explosion rips through medical marijuana facility

Cannabis Recalls: Lessons Learned After Three Years of Canadian Legalization

By Steven Burton
1 Comment

Three years ago, Canada became one of the first countries in the world to legalize and regulate cannabis. We’ve covered various aspects of cannabis regulation since, but now with a few years of data readily available, it’s time to step back and assess: what can we learn from three years of cannabis recalls in the world’s largest legal market?

Labelling Errors are the Leading Cause of Canadian Cannabis Recalls

Our analysis of Health Canada’s data revealed a clear leader: most cannabis recalls since legalization in October 2018 have been due to labelling and packaging errors. In fact, over three quarters of total cannabis recalls were issued for this reason, covering more than 140,000 units of recalled product.

The most common source of labelling and packaging recalls in the cannabis industry (more than half) is inaccurate cannabinoid information. Peace Naturals Project’s recall of Spinach Blue Dream dried cannabis pre-rolls this year is a good example. Not only did the packaging incorrectly read that the product contained CBD, but the THC quantity listed was lower than the actual amount of THC in the product. The recall covered over 13,000 units from a single lot sold over 10 weeks.

In another example, a minor error made a huge impact. British Columbia-based We Grow BC Ltd. experienced this firsthand when it misplaced the decimal points in its cannabinoid content. The recalled products displayed the total THC and CBD values as 20.50 mg/g and 0.06 mg/g, respectively, when the products contained 205.0 mg/g and 0.6 mg/g.

Accurate potency details are not just crucial for compliance. For many customers, potency is a deciding factor when selecting a cannabis product, and this is especially important for medicinal users (including children), people who are sensitive to certain cannabinoids and consumers looking for non-psychoactive effects. In this case, at least six consumer complaints were submitted to Peace Naturals Project, the highest number for any cannabis recall in Canada.

Frequent, integrated lab testing, an effective and robust traceability system, smaller lot sizes during production and consistent quality checks could have helped Peace Naturals Project and We Grow BC limit the scope of their recall or avoid them altogether.

Pathogens are the #2 Cause of Cannabis Recalls in Canada

Pathogens are the second most common cause of recalls in Canada, claiming 18% of total cannabis recall incidents. And while that doesn’t sound like much compared to the recalls caused by labelling errors, it affects the highest volume of product recalled with over 360,000 units affected.

Canadian Cannabis Recalls – Total number of affected units and noted causes

A primary cause of allergens and microbiological contamination of cannabis products is yeast, mold and bacteria found on cannabis flower (chemical contaminants like pesticides can also be a major concern). Companies like Atlas Growers, Natural MedCo and Agro-Greens Natural Products have all learned this lesson through costly recalls.

These allergenic contaminants pose an obvious health risk, often leading to reactions such as wheezing, sneezing and itchy eyes. For people using cannabis for medical conditions and may be more susceptible to illness, pathogens can cause more serious health complications. Moreover, this type of cannabis recall not only drives significant cost since microbiological contamination of flower could easily affect several product batches processed in the same facility and/or trigger downstream recalls, but also affect consumer confidence for established cannabis brands.

Preventive control plan requirements for cannabis manufacturers mandate that holders of a license for processing that produce edible cannabis or cannabis extracts in Canada must identify and analyze the biological, chemical and physical hazards that present a risk of contamination to the cannabis or anything that would be used as an ingredient in the production of the edible cannabis or cannabis extract. Biological hazards can come from a number of sources, including:

  • Incoming ingredients, including raw materials
  • Cross-contamination in the processing or storage environment
  • Employees
  • Cannabis extract, edible cannabis and ingredient contact surfaces
  • Air
  • Water
  • Insects and rodents

To mitigate risks, addressing root causes with preventative measures and controls is essential. For instance, high humidity levels and honeydew secreted by insects are common causes of mold on cannabis flowers. Measures such as leaving a reasonable distance between plants, using climate-controlled areas to dry flowers, applying antifungal agents and conducting regular tests are necessary to combat such incidents.

control the room environment
Preventative measures and controls can save a business from extremely costly recalls.

Of course, placing all the necessary controls into action is not as simple as it may sound. Multiple facilities and a wide range of products in production mean more complexity for cannabis producers and processors. Any gaps in processing flower, extracts or edibles can result in an uncontrolled safety hazard that may lead to a costly cannabis recall.

These challenges are not just limited to cannabis growers. The food industry has been effectively mitigating the risk of biological hazards for decades with the help of food ERP solutions.

Avoid Recalls Altogether with Advanced ERP Technology

An effective preventative control plan with regular quality checks, internal audits and standardized testing is important to minimize the threats evident from Canada’s recall data. If these measures ever fail, real-time traceability systems play a pivotal role in the event of a cannabis recall by enabling manufacturers to trace back incidents to the exact point of contamination and identify affected products with surgical precision.

Instead of starting from zero, savvy cannabis industry leaders turn to the proven solutions from the food industry and take advantage of data-driven, automated systems that deliver the reliability and safety that the growing industry needs. From automated label generation to integrated lab testing to quality checks to precision traceability and advanced reporting, production and quality control systems are keys to success for the years ahead.

3 Pillars of Cannabis Banking Compliance

By Mark Lozzi
No Comments

Few people will disagree that financial compliance isn’t the most exciting topic within the cannabis industry. But compliance is, and always will be, the engine grease to the legal cannabis market. Cannabis operators have the arduous task of dealing with multiple layers of compliance, both operational (maintaining and adhering to regulations enforced by the state licensing board) and financial. These compliance measures include managing everything from seed-to-sale systems for all plant-related activity to on-site requirements like facility access points and alarms systems to name a few.

With complex compliance requirements for the business, the last thing cannabis operators want to think about is financial compliance. We created Confia on this notion. Just as cannabis regulators impose the tracking of plants through the supply chain via a seed-to-sale system, we have developed a storyboard similarly designed to follow the money, which is the equivalent of a transaction-to-deposit system.

Having experience in regulatory technology, artificial intelligence and machine learning, we’ve been fortunate enough to work with some of the world’s largest banks across multiple countries. This experience has afforded us the luxury of working alongside regulators, chief compliance officers and chief risk officers, understanding how risk is perceived by financial institutions and how it ought to be mitigated. It was this access and knowledge that allowed us to effectively reform, enhance and improve the antiquated BSA programs with a technology-enabled process. Leveraging technology is a necessity, almost a requirement, for the cannabis industry as legalization nears and banking access begins to broaden.

Jamming cannabis requirements into an existing BSA program doesn’t scale well. BSA programs are very manual, descriptive and process oriented. So, we’ve taken our prior experience and success in banking to form Confia, distilling the complexities and simplifying the deliverables surrounding cannabis banking compliance. To best articulate cannabis banking requirements, I break it down into three pillars.

Pillar One: KYC-Enhanced Due Diligence

The first pillar is the client-onboarding bucket or KYC – Know Your Customer. In the complex world of cannabis banking, banks must know and understand their clients to great depths. It’s not enough to simply know that the client exists; you also have to understand whether or not that client could be a potential risk to the bank, and one step further, the financial system. Cannabis is a high-risk industry, so the KYC requirement is escalated to a deeper diligence and review, called Enhanced Due Diligence (EDD).

Cannabis is a high-risk industry so extra due diligence is needed

Banks need to know and understand their customers’ story, and all the key parties (officers, directors, and those with key decision-making powers or access to the bank accounts) within that organization. This includes reviewing personal, business, and legal history – not to mention watchlists and negative news presence. An initial onboarding review must then be followed with daily screening and monitoring of all watchlists and adverse media. Typically, banks do KYC refreshes every three years. In cannabis, a full refresh should be done annually with the daily monitoring systems in place.

The high-risk nature of the industry also requires a level of diligence on all parties to a transaction, even if one of the parties, whether a payer or recipient, is not a client of your bank. Unlike traditional banking sectors, reliance on other banks’ KYC programs is far less defensible in the cannabis industry.

Pillar Two: Transactional Monitoring & Detection

Tracking and monitoring the actual financial transactions comprises the second pillar required for cannabis banking. At Confia, we have focused on streamlining processes, so the cannabis operator can seamlessly support the compliance obligation for every transaction. A bank must demonstrate supporting documentation for every cannabis transaction, and gathering such information is a large undertaking in and of itself and can pose future issues if not done properly, see the pitfalls for lack of compliance. Banks are obligated to understand the nature and reason for each transaction, the source of funds, ensure cannabis licenses are in good standing for all parties, and collect evidence such as accounting records and seed-to-sale data.

Core to transaction monitoring in the traditional sense, is the overarching support through anomaly detection. Relying on information is important, but testing those inputs keeps everyone honest. It is important to evaluate transactions from a holistic point of view relative to peers and relative to the general contents of a transaction. This anomaly detection layer is your last line of defense, and as new information is collected, it continues to refine itself.

Pillar Three: Filing and Reporting Requirements

The third component to compliant cannabis banking is regulatory filing and reporting. Once a client is onboarded, the account requires an initial suspicious activity report or SAR-Initial within 30 days of that client being approved by the bank. Then, a report must be filed every 90 days after that for all the transactions of that cannabis operator. Banks must file the SAR-Initial and the Continuing-SAR reports for each cannabis client they have.

The high-risk nature of the industry requires a level of diligence on all parties to a transaction

Solutions like Confia automate the filing process and support the filing with transactional data evidenced on our distributed ledger of record. This provides immutable audibility and simplifies the process for all parties involved.

Compliance Requirements After US Legalization

The anticipation of federal legalization and banking reform bills has many operators hoping for easier banking. Yet, in my opinion, regulatory oversight and audits will likely increase after such reform or legalization. As other financial institutions start to support cannabis, it will inadvertently create greater opportunity and expose the financial system to nefarious or illegitimate transaction activity. This is why cannabis banking will be carefully monitored by regulators, and more so, why banks will be slow and pragmatic in standing up their internal cannabis banking programs. Some banks may forever avoid the cannabis industry due to the known pitfalls of an industry specific program, while others may simply mitigate the possible exposure to reputational risk.

Choose Wisely: Pitfalls for Lack of Compliance

Financial compliance is the responsibility and duty of the banks, but the real losers and result of non-compliance always fall on the cannabis operators. Regulatory action against an institution may result in the bank shutting down its cannabis program or may require them to complete a remediation of all their cannabis transactions for a certain period from its clients. At the end of the day, regardless of action, the cannabis operator is the one being punished. Operators either lose their bank account and have business massively disrupted, or they are asked to provide all the compliance docs for a historic period, which is a huge undertaking and operational distraction, ultimately impacting business and productivity. So, choose your banking partner wisely.

Summarizing Key Banking Requirements

In summary, banking in the cannabis industry will undoubtedly remain a high-risk industry, with or without legalization. Although banking opportunities may expand as US policies change, there will be continued compliance and regulatory requirements for the foreseeable future.

  • Onboarding and ongoing screening are critical
  • Evidence for every transaction is a significant portion of compliance and must not be dismissed
  • Evaluating activity with broader strokes is essential in mitigating against money laundering
  • Managing the staggered filing timelines and due dates for each client

Compliance is the most crucial factor in cannabis banking at this point. It cannot be overlooked or taken for granted. Cannabis operators must take an active role in evaluating the compliance programs of their financial providers. To open a bank account is one thing, but the consideration and effort that goes into keeping a bank account is the difference that will protect your business in the long run.