There’s little doubt that passage of the Secure And Fair Enforcement Banking (SAFE) Banking Act by Congress would be an enormous step forward for the cannabis industry. For those unfamiliar, the bill, introduced by Colorado Congressman Ed Perlmutter earlier this year, would prevent the federal government from penalizing banks that knowingly serve state-legal cannabis businesses.

If passed, the measure would increase cannabis businesses’ access to financial services.

But accepting funds from cannabis businesses will remain a high-risk activity for banks. Banks serving the industry will continue to conduct meticulous due diligence and monitoring on cannabis-related accounts, perhaps even to a higher degree than they currently do. Accordingly, it will be more critical than ever for cannabis businesses seeking financial services to be able to demonstrate their compliance with state laws and the federal government’s enforcement priorities.

Banks’ current reluctance to serve the cannabis industry stems from two sets of laws concerning money laundering.  First, federal criminal law prohibits the act of money laundering, which includes knowingly transacting in the proceeds of specified federally illegal activities, such as the distribution of cannabis. Second, the Bank Secrecy Act requires banks to implement measures reasonably designed to prevent money laundering.

Regardless of federal enforcement priorities, a bank technically commits money laundering under federal criminal law every time it accepts a deposit from a cannabis business. In doing so, the bank leaves itself at risk of devastating consequences including revocation of its charter, loss of deposit insurance, and even criminal charges.  The SAFE Banking Act would remedy the issue created by federal criminal law by preventing the government from penalizing banks for knowingly serving state-legal cannabis businesses.

So, the SAFE Banking Act makes banking cannabis businesses easy, right?  Not quite.  While more banks will serve the industry, banks will still require cannabis to demonstrate their compliance with state law and federal enforcement priorities to obtain an account. That’s because the SAFE Banking Act will not relieve banks of their obligations under the Bank Secrecy Act to implement anti-money laundering controls. Among other requirements, banks must conduct “know your customer” due diligence designed to understand the identifies and business activities of their customers, as well  as monitor accounts for suspicious activity.

Banks’ anti-money laundering procedures are risk-based, meaning that banks use different means of preventing money laundering depending on the type of customer.

For example, a personal checking account for a U.S. citizen typically poses a low risk, so a bank might only verify a person’s identity and address before opening his or her account. In contrast, the same bank would more closely scrutinize and monitor higher-risk accounts, such as accounts for casinos, foreign politicians, or cannabis businesses.  The SAFE Banking Act will not change cannabis businesses’ high-risk classification, nor will it change banks’ responsibility to detect undeclared marijuana business accounts.

When monitoring high-risk accounts, banks must take into consideration industry-specific factors. The Financial Crimes Enforcement Network (“FinCEN”), which is part of the Department of Treasury, issued guidance in February 2014 outlining how banks that choose to serve cannabis business can meet their obligations under the Bank Secrecy Act.

FinCEN’s Guidance directs banks to “consider whether a marijuana-related business implicates one of the Cole Memo priorities or violates state law.”  To achieve that aim, the guidance prescribes many steps that banks should take, including “developing an understanding of the normal and expected activity for the business,” and conducting “ongoing monitoring for suspicious activity.”

The guidance goes on to provide examples of the types of suspicious activity or “red flags” that banks should be able to detect. Examples of red flags that banks are expected to identify when banking cannabis businesses include revenue that is out of line with norms for the market, deposits from out of state, deposits that do not align with financial statements or tax filings.

One additional red flag outlined in FinCEN’s guidance is attempts to disguise or conceal cannabis-related business activity, possibly through opening accounts with a supposed “holding” or “management” company.

Even if Congress passes the SAFE Banking Act, banks’ legal obligations under the Bank Secrecy Act will remain. Banks that fail to meet their anti-money laundering obligations under the Bank Secrecy Act can face severe penalties, such as $97 million penalty imposed upon Citigroup, according to the New York Times; or the $1.2 billion penalty imposed upon HSBC in 2012. Penalties can also be imposed upon banks that do not take sufficient steps to detect accounts which are ostensibly opened for non-cannabis businesses, but in reality are receiving revenues from a cannabis business.

Given the possible consequences, banks will be highly selective in determining which cannabis businesses to serve, if any. The banks that choose to serve the industry will likely only open accounts for businesses that can provide transparent and auditable evidence of their compliance with state law and the Cole Memo priorities.

Such evidence will include data tying all funds deposited to state-legal sales, financial statements, and tax filings. Banks are also likely to conduct regular audits of their cannabis business clients, as banks that currently serve the industry already do.  Moreover, as more banks begin serving the cannabis industry, they will become more adept at sniffing out non-compliant businesses and closing their accounts.

If passed, the SAFE Banking Act will open the door for more banks to provide sorely needed services to the cannabis industry. But cannabis businesses will only be able to take advantage of those services if they are able to demonstrate their compliance to banks.  It’s up to each business to be ready.