Managing Risk in a Shifting Landscape – Best Practices for Banking the Marijuana Industry

With the 2020 election in the books, you can add Arizona, Montana, New Jersey, and South Dakota to the tally of states that have legalized recreational marijuana. Although marijuana remains illegal under federal law, the vast majority of states and the District of Columbia have legalized the use of medical marijuana (with varying degrees of restriction), and now fifteen states and the District of Columbia have approved at least some degree of both recreational and medical use.

While most financial institutions (FIs) continue to avoid the industry, an increasing number of banks and credit unions have begun providing banking services to dispensaries, growers, and other marijuana-related businesses (MRBs) in states that have legalized its use or sale. Expect this trend to continue, and perhaps pick up in pace, with the legalization of recreational marijuana in Arizona, Montana, New Jersey, and South Dakota.

For those FIs that are interested in serving the industry, the starting point is implementing a compliance program that is tailored for the marijuana industry and consistent with state laws and the federal government guidance. In this article, we provide a brief refresher on the legal framework for providing banking services to MRBs and discuss some of the lessons we have learned from our experience in helping FIs serve the marijuana industry in a safe, sound, and responsible manner.

Overview of Legal Framework

The federal Controlled Substances Act (CSA) continues to make it illegal under federal law to manufacture, distribute, or dispense marijuana. Notwithstanding this prohibition, the federal government has issued (and partially rescinded) guidance related to FIs providing services to MRBs.

In August 2013, the U.S. Department of Justice's (DOJ) then-deputy attorney general, James M. Cole, issued a memorandum to all U.S. attorneys providing guidance on marijuana enforcement under the CSA. He issued another memorandum in February 2014, addressing application of federal law to financial institutions that deal with MRBs (together these are called the Cole Memos). At the same time that DOJ issued the second Cole Memo, the Financial Crimes Enforcement Network (FinCEN) issued guidance (based on the Cole Memos) advising FIs on how they could provide financial services consistent with their anti–money laundering (AML) compliance obligations (FinCEN Guidance).

Following a change in federal administration, then-attorney general Jefferson B. Sessions issued a January 2018 memorandum rescinding the Cole Memos (Sessions Memo). FinCEN, however, did not repeal the FinCEN Guidance, despite the fact that it no longer had the support of the DOJ. Despite the Sessions Memo, the Cole Memo and FinCEN guidance remain the clearest statement of federal policy with regard to FIs serving the marijuana industry.

Setting up a Robust Compliance Program

Our experience in representing FIs in this industry has been that federal and state regulators continue to advise FIs to follow the FinCEN guidance and the Cole Memos. In our view, however, this is only the starting point; regulators continue to view the marijuana industry as high risk and subject to heightened compliance requirements. It is, therefore, important for an FI to discuss with its regulators any plans to serve the industry before signing up MRB customers. A transparent process helps keep regulators informed and sets the groundwork for a constructive supervisory relationship.

From there, providing banking services to the marijuana industry requires a thoughtful approach and the implementation of a robust, tailored compliance program. Accordingly, an FI that is interested in serving the industry should commit to establishing a standalone MRB compliance program that leverages and builds upon its existing AML controls.

The following are some of the key issues to address when setting up a compliance program:

1. Determine the Scope and Limits of the Program – Providing banking services to MRBs is complicated and requires a significant amount of planning. An FI developing an MRB compliance program should first determine the scope of its proposed MRB product offering, including the size of the program (how many potential account holders) and the types of customers it will board (the degree of connection to the marijuana industry). An FI must also carefully consider the particular services it will offer its MRB customers. For example, will the FI make loans to MRBs; will it allow MRBs to send and receive interstate funds transfers through ACH and wires; and will the FI accept deposits at all branches, some branches, or only drop boxes? Determining the scope of the product offering is critical to establishing an MRB compliance program that contains the necessary personnel, monitoring capabilities, and controls.
2. Understand State Requirements – Many of the core functions of an MRB compliance program will be heavily influenced by state law, including the nuances of the state licensing regime and permitted and prohibited activities. An FI should make sure that its MRB compliance program is designed around these requirements and prohibitions.
3. Communicate with Your Partners – In addition to being transparent with regulators, an FI needs to make sure to reach out to key vendors, investors, and insurers to confirm that providing services to MRBs will not result in any unforeseen consequences. In our experience, FIs that fail to set expectations with these partners find themselves scrambling to avoid negative impacts on their operations, such as voiding the various insurance coverages.
4. Customer Due Diligence – An effective MRB compliance program must include an enhanced customer due diligence (CDD) process for classifying the risks presented by each MRB. This process must be comprehensive and will require the FI to have dedicated MRB compliance personnel and resources. CDD for an MRB should include, at a minimum, diligence of the MRB's business, state licenses, principals, premises, and operations. Based on the CDD, many FIs risk rate MRBs on two dimensions: into tiers depending on the degree to which the customer engages directly or indirectly in marijuana-related activities and into categories based on the projected volume of sales and number of licensed locations.
5. Monitor for Suspicious Activity – Once an MRB is boarded, it is critical to monitor its transactions and operations for suspicious activity. This process may include using traditional software programs to monitor for suspicious activity, but should also include tailored, frequent reviews of the MRB's transactions and business operations. An FI should scale the frequency of monitoring based on an MRB's risk rating and the types of transactions, and in some cases, FIs may require preapproval for every transaction, such as for any interest funds transfers. In terms of reporting, the FinCEN Guidance established unique suspicious activity reporting (SAR) procedures for MRB-related accounts, including the filing of limited, priority, and termination SARs, depending on specific circumstances.
6. Cash Reporting – Given the relative lack of financial services available to the marijuana industry, an FI's potential MRB customers likely conduct most transactions in cash. Once an FI decides to serve the marijuana industry, it should prepare for a significant increase in filing of currency transaction reports (CTRs) for any cash transactions at or through the bank in excess of $10,000. In addition, the FI will need to establish procedures to track cash deposits and match them to the MRB's sales, which are typically reported to a centralized state database.

* * * * *

As more states legalize marijuana, it is important for FIs to develop a plan for how they will handle marijuana-related funds or customers. Even FIs that do not want to serve the industry should have policies and procedures in place for determining whether existing merchant customers are engaged in marijuana-related activities. And for those FIs that decide to service the industry, doing so requires the implementation of a robust compliance program that is tailored for the nuances of the industry.

Any bank, credit union, savings association, or lending company that is interested in offering services to an MRB should contact the authors for advice on developing an MRB compliance program.

© 2020 Venable LLP. Using, distributing, possessing, and/or selling marijuana is illegal under existing federal law. Compliance with state law does not guarantee or constitute compliance with federal law. This informational overview is not intended to provide any legal advice or any guidance or assistance in violating federal law.