By Alan Hanson
There are many articles written about the issues surrounding banking Marijuana-Related Businesses (MRBs), but there are very few that discuss how banks can actually do this. And there are even fewer written by someone who has successfully helped a bank do it! As general counsel and compliance officer for an Oregon credit union, I created and managed one of the largest cannabis banking programs in the nation. The program was successfully reviewed by both state and federal regulators and it serves as a model for examiners when evaluating other cannabis banking programs.
Creating a cannabis banking program begins just like any other decision to create a new product line. Because most financial institutions already have the resources to create new product lines, this article will focus on how cannabis impacts that analysis.
Why Bank Cannabis
Why would a financial institution take the risks associated with serving a federally illegal product? The typical risks associated with cannabis for banks are (1) Legal Risk; and (2) Reputational Risk. The Legal Risks are because cannabis is federally illegal under the Controlled Substances Act (CSA). While there are several federal laws that may be implicated by banking MRBs, the two most relevant bodies of law are the CSA and the Bank Secrecy Act (BSA). When a bank or credit union is considering banking MRBs, each federal act must be addressed.
Does a financial institution violate the CSA? Under the CSA, it is illegal to produce, dispense, distribute, or possess marijuana. No financial institution engages in any of these activities, so the only way to prosecute is under the theory of aiding and abetting. I question if someone is aiding and abetting if they are regularly reporting the illegal conduct to law enforcement. At the time of publishing, no U.S. financial institution has been prosecuted for banking a state-legal marijuana-related business.
Does a financial institution violate BSA?
No, absolutely not. In 2014, FinCEN (Financial Criminal Enforcement Network) issued its guidance on banking marijuana-related businesses. The very first paragraph of the guidance states that by following the FinCEN guidance a financial institution meets its obligations under BSA.
The largest legal risk to financial institutions does not come from the Department of Justice, but from anti-cannabis organizations and individuals. The RICO Act gives individuals a private right to action for racketeering activities. A few lawsuits have been filed against state legal marijuana and banks that serve those businesses. To date, these suits have not resulted in a judgment against a bank, but this is a risk that must be understood.
Most financial institutions that serve MRBs have done so quietly with non-disclosure provisions in the account agreement. Despite the attempt to conceal its involvement in the industry, it will become known at some point in the future. When my credit union was ‘outed,’ there was a big article in the local newspaper and to our surprise, the comments were overwhelmingly positive. In fact, we received more negative comments for a minor change to our online banking program than we did for our cannabis activities. In the states that have legalized some form of marijuana, the people understand that legal businesses should have access to legal banking.
The Benefits of Cannabis Banking.
The primary benefit is the financial reward. At my credit union, the fee income for the cannabis program was on par with the income generated from their credit card portfolio. This may not be the case at every financial institution, but if a program is properly priced there is a very large upside. In addition, there is not currently substantial competition and the first mover advantage will retain these accounts long after large financial institutions enter the arena.
Community safety is another very important benefit. With such large cash-based business, criminal activity is inevitable. There have been many robbery attempts on cannabis businesses, some ending in injury or death. The businesses are also carrying backpacks full of cash to purchase money orders or to pay taxes. Large quantities of cash will always result in crime and injury and the cannabis industry requires a banking solution for the benefit of the community.
Another benefit is the financial institution’s involvement in policing the industry. One of the major components of the compliance requirements is the Suspicious Activity Reporting (SAR). These reports require that a financial institution monitor the business activity and if there is any suspected illegal activity, such activity is highlighted in the SAR. Additionally, financial institutions provide financial records to law enforcement that would not be available in a cash only industry.
How to Bank Cannabis
Cannabis businesses are generally only offered limited deposit and transactions accounts, so there is nothing unique about the accounts. The compliance requirements are what make these accounts difficult. There are four main components of compliance:
- initial due-diligence;
- on-going due-diligence;
- SAR reporting;
- and Cole Memo priorities.
Wait a minute, wasn’t the Cole Memo revoked? The Cole Memo was revoked, but the FinCEN guidelines incorporated the Cole Memo priorities into its requirements. Also, in revoking the Cole Memo, AG Sessions didn’t negate any of the priorities but said that there were existing DOJ policies in place to guide the local prosecutorial discretion. In May 2018, the U.S. Attorney for Oregon issued his priorities to prosecute cannabis activities. And his priorities were consistent with the Cole Memo priorities. He is the only U.S. Attorney who has issued a statement on the issue, but it is unlikely that a U.S. Attorney would reject the Cole Memo priorities.
The initial due-diligence requirements are essentially BSA “Know Your Customer” requirements plus the assessment of the Cole Memo priorities and verification of state licensing status. The on-going due-diligence requirement are effectively a repeat of the initial due-diligence plus a review of account activities. While trying not to bore you with the granular details, the key to monitoring is having a cannabis business banking expert on staff in order to assess each account and recognize what is normal business activity.
Standard Currency Transaction Reports (CTR) are required and cannabis businesses are not exempt. The FinCEN guidelines create three classes of marijuana specific SAR reports:
- and Termination.
The timing for filing these SARs is the same as traditional continuing activity SARs, but the initial SAR is filed at the time of account creation and ongoing SARs are filed every subsequent 90-120 days. These marijuana SARs are only utilized when you have a cannabis banking program, they are not used when you discover a marijuana account and terminate it because you do not bank MRBs.
The marijuana-limited SAR is both the easiest and the most rigorous SAR. It is the easiest in the fact that you provide a basic narrative that it is a marijuana limited SAR and you attach the account activity during the SAR period. It’s the most rigorous because you are certifying that you have completed the required due-diligence and you found no suspicious activities.
The marijuana priority is similar to a traditional SAR in the way you fully describe the activity that you suspect is in violation of state law or the Cole Memo priorities. The marijuana termination is used when terminating the account due to activity that prevents compliance with the requirements of the cannabis banking program.
There are other operational issues that are involved in cannabis banking beyond compliance. Ironically, one of the main issues is that most financial institutions are not set-up to handle large cash deposits. It is not uncommon to receive multiple deposit in excess of $100,000 in a single day. With slow money counters and dual custody requirements, these deposits can create a significant burden on branch operations.
There are many third-party services available to help develop effective cannabis banking programs. In this nascent industry, new businesses are created daily, so it is essential to fully vet any potential vendor relationship. I have a special warning surrounding third-party vendors that offer compliance related services. Regulators have made it clear that the responsibility for compliance cannot be outsourced. Vendors can be used to provide compliance functions, but the ultimate responsibility remains with the financial institution. For example, a vendor can perform on-site inspections, but the financial institution must establish the requirements for the inspection and they must make the determination if that business passes the inspection. With critical compliance functions such as SAR filing, it may not be possible to establish adequate controls to justify outsourcing to a vendor.
While cannabis banking is not for everyone, there are many examples of financial institutions who are openly and successfully banking the industry. Regulators recognize the necessity for state legal businesses to have access to banking. They require strict compliance with BSA and FinCEN guidelines, but they are allowing financial institution with strong compliance programs to serve the industry. Those institutions are being financially rewarded and are also rewarded with industry loyalty. The community is also served an important and required service.