In January, three California cannabis agencies finalized their regulations. The Bureau of Cannabis Control (“BCC,” regulator of retailers and distributors), California Department of Food and Agriculture (“CDFA,” responsible for cultivators) and California Department of Public Health (“CDPH” responsible for manufacturers). Previously we wrote about disclosure requirements applicable to a licensee’s directors, executives, 20% shareholders, and other figures who exercise management, direction or control (defined as “Owners” by the BCC and CDFA). In this article, we discuss changes to the regulations dealing with disclosure and ongoing reporting requirements; privacy for investors; and, confidentiality for company trade secrets and proprietary information.

Ongoing Disclosure Requirements.

Summary: Licensees will make ongoing disclosures to regulators, probably at least monthly; information most frequently disclosed will be bank account balances and changes to any information contained in an annual application; any changes to lists of shareholders or participants in a profit-sharing plan, and for public companies, any new five percent (5%) shareholders. Because of this ongoing requirement, companies will schedule time every month to harvest and report the new data points.

After receiving its annual license, cannabis businesses must promptly report certain events to BCC, CFDA and CDPH. In some cases, the same event is reported to different regulators at different speed: for instance, CDFA (Cultivators) requires notice of a new Financial Interest Holder (e.g., a new shareholder) within 10-days, while Bureau of Cannabis Control (Distribution and Retail) requires notice within 14-days.

Most Common Reportable Events

Change of Owners (BCC: 14 days; CDPH: 10 days)

Change of Financial Interest Holder (BCC: 14 days; CDFA: 10 days; CDPH: 10-days)

Change to Any Information in Annual Application (CFDA: 10 days)

Change to Contact Information, Bank Accounts and Bank Account Balances, Investments, Loans, Insurance (BCC: 14-days)

Reportable Events for Owners

Civil Penalty or Judgement against Owner (BCC: 48-hours; CDPH: 48-hours)

Labor Law Sanctions / Administrative Orders (All: 48-hours);

Labor Law Civil Judgements (BCC: 48-hours)

Punishment for Violation of Labor Standards (BCC: 48-hours; CDFA: 48-hours)

Bankruptcy or Assignment for Benefit of Creditors (CDFA: 10-days)

Death, Incapacity, Insolvency (BCC: 14-days)

Security-Related Reportable Events

Track-and-Trace System Failure or Non-Resolution (BCC: Immediately)

Significant Discrepancy in Inventory (BCC: Immediately)

Diversion, Theft, Loss, Criminal Activity (BCC: 24-hours)

Security Breach (BCC: 24-hours)

Loss or Unauthorized of Records (BCC: 24-hours)

Elimination of Privacy Shield.

Summary: Previously, investors could shield identities by holding investments through a LLC or other business entity, but the final regulations eliminated this option. Now, licensees must disclose the human being(s) who are the end owners of each person with a financial interest in the cannabis business – with very few exceptions, even very minor and indirect investors must be disclosed to regulators.

Previous iterations of regulations allowed for an investor to hold its financial interest through an investment vehicle, such as a limited liability company. While the limited liability company’s name and some identifying information was reported as a financial interest holder, the end-owner of the LLC was not reported. Final regulations eliminated this provision.

Now, for all three agencies, whenever a financial interest holder is a business entity, licenses must disclose which human beings own or control that business entity: “all individuals who are owners of that entity shall be considered financial interest holders of the commercial cannabis business.” (16 CCR 5004(d); substantially similar requirement at 3 CCR 8103(c)-(d)). A business’s annual application must list every shareholder, lender, investor, participant in a profit-sharing plan and person with a right to receive profits. Final regulations compel disclosure of every individual with a direct or indirect financial interest in the business, meaning that the full name, address and information from government-issued identification is required. For an investor unwilling to have its name reported to regulators, the only exceptions to reporting come if the financial interest holder is commercial lender, if the investment is held by a blind trust or mutual fund, if the final interest is limited to a lien or encumbrance, or if the licensee is a public company and the holder owns fewer than five percent (5%) of its shares. Some information may not be available to a licensee: for instance, this requirement means that public licensees must report all 5% shareholders to BCC and CDFA, in some cases including social security numbers and government-issued identification (3 CCR 8103(j)). A business anticipating a public listing should consult with its listing or transfer agent to ensure this information can be obtained.

Remaining Confidentiality Protections.

Summary: Despite eliminating the privacy shield, some confidentiality protections remain available, and with some careful planning, companies should be able to protect their investors from public disclosure. But nothing can prevent disclosure of investor-identities to regulators.

All information delivered to regulators on an annual application is treated as a public record. This means applications are subject to public review and disclosure. Different regulators are allowing different levels of access; one regulatory allowed our client’s entire application to be photocopied by its competitor. Because the disclosure rules default to public access, all applicants should aggressively protect their most proprietary information. The new regulations and the Government Code each provide one path to protect proprietary information. Along with counsel, applicants should identify protections available to different sections of an application: For example, manufacturers can prevent disclosure of standard operating procedures and other manufacturing plans based on 17 CCR 40131(m) (confidential manufacturing protocols). Cultivators should argue for non-disclosure of identifying information and social security numbers of financial interest holders based on analogous exemptions in Government Code Section 6276.40 (limits disclosure of social security information in four situations). Each company’s most sensitive information is its capitalization table – this information is of enormous value to identity thieves, competitors, potential acquirers and anyone interested in securities fraud. We are working with regulators to create a default treatment of financial interest holders, but until that time, an applicant should argue that its entire capitalization table qualifies as a Trade Secret under Civil Code Section 3426.1(d) and/or one of the exemptions in Government Code Section 6276.18 or 62746.44.