As the Bank Secrecy Act (BSA) officer for a mid-sized bank in a state with legalized medicinal cannabis, I was open to the concept of banking cannabis. The bank has a strong BSA program with well-seasoned investigators who might be eager to tackle the challenge of a new type of due diligence. Due to the risk involved and the inevitable regulatory scrutiny, three thoughts immediately came to mind: (1) a policy update is needed to permit banking cannabis, (2) a pilot program of just a few customers is needed to determine if controls are adequate and (3) research needs to be done.

Starting out, BSA officers are likely solely thinking about their customer due diligence (CDD) and enhanced due diligence (EDD) controls and whether they are sufficient to handle the increased risk and increased customers. Certainly staffing may become an issue and then an update to risk assessment will be required. However, the process just mentioned is completely backwards. A comprehensive risk assessment must be completed first. This risk assessment will be presented to the community bank’s board for support of the recommended update to BSA policy. While undertaking the risk assessment, there will undoubtedly be much more to banking cannabis than staffing and mitigating control considerations.

Research, Research and More Research

Most BSA professionals are aware of the legal, regulatory and reputational risks associated with banking cannabis—those who are not should not be considering the prospect. The other risks uncovered during the research phase were unexpected, numerous and potentially insurmountable.

Immediately start a paper or an electronic file for research to footnote in the risk assessment. Highlight critical information, as it will save time later.

Cannabis is still a Schedule 1¹ drug, meaning the federal government perceives the drug to have no medical value and a high potential for abuse. The scheduling of cannabis makes any funds derived from the growth, harvesting, transportation, use and sale illegal and subject to suspicious activity reporting requirements under the BSA,² regardless of the drug’s legality in the state as explained in the Financial Crime Enforcement Network’s guidance (FIN-2014-G001) BSA Expectations Regarding Marijuana Related Businesses.³ The filing of a cannabis-related SAR is an admission of “probable criminal conduct” by the bank and could result in criminal action by the government. As a result of banking cannabis, fines and penalties—including criminal penalties—against the bank, its officers, directors and employees are possible.

As a result of banking cannabis, fines and penalties—including criminal penalties—against the bank, its officers, directors and employees are possible

However, running afoul of state law is a much bigger worry. If a bank’s cannabis account holder was found to be illegally transporting marijuana across state lines or selling to minors, it could lead to potential liability for the bank depending on how much it knew, how much it should have known and to what extent it was implicated in the crime.⁴ The implications for a financial institution considering accepting cannabis-related funds are profound. First, bankers must determine whether their insurance company will continue coverage if cannabis-related funds are accepted. In addition, banks should examine their insurance programs with this business segment in mind. As Terence Cawley, liability claims manager for ABA Insurance Services explains, “Coverage should be discussed with the bank’s agent or broker, the bank’s attorney and not least, with the bank’s insurers.”⁵

Do not forget to include the financial institution’s certified public accountant (CPA) in discussions. Banking cannabis-related businesses may result in a qualified audit report. “An auditor’s report is qualified when there is either a limitation of scope in the auditor’s work, or when there is a disagreement with management regarding application, acceptability or adequacy of accounting policies. For auditors an issue must be material or financially worth considering to qualify a report.”⁶ A qualified audit may affect a bank’s safety and soundness rating by failing to comply with applicable laws and regulations.⁷

Research Vendors

Having successfully retained insurance coverage and alerted its CPA, the bank must now check with each and every vendor who aids in processing transactions to ensure they will knowingly allow cannabis funds to run through their systems. Yes, they must contact the wire vendor, core system, automated clearing house, payroll processor and others. There are vendors who will not support the processing of cannabis funds. The Federal Reserve has denied applications for its Fedwire services to financial institutions serving the cannabis industry.⁸ In addition, Mastercard and Visa have refused to process cannabis purchases—even in legalized states—meaning no credit cards or debit cards bearing Mastercard/Visa logos can be used for cannabis-related businesses. So, even if some of the vendors do allow the processing of cannabis-related funds, not all deposit services can be offered to these clients.

Be Prepared for Ramifications to the Lending Program

Speaking of limiting the sale of services to cannabis-related clients, there are also serious risks associated with lending to these businesses. In short, banks may lose their collateral to seizure.

Under the Controlled Substances Act (CSA), real property including any right, title and interest used in whole or part to commit or facilitate a violation of the CSA is subject to asset forfeiture. Cash and real property securing loans to cannabis-related business could just disappear. “If you are selling mortgages on the secondary market, you may not be able to sell any [of the mortgages] you make to marijuana business owners or even their employees. You may be forced to portfolio those loans to avoid any concerns.”⁹ To add insult to injury, the Small Business Administration has barred loans to the cannabis-industry, so that lending path is gone. Deposit services are limited and lending is risky. Still interested in banking cannabis? Read on.

Address the Cash Elephant in the Room

Currently the cannabis industry is heavily cash-intensive. Consider the implications of handling that cash. Processes must be developed to get the cash to the bank. Some armored car carriers cannot,¹⁰ or will not, accept cannabis-related money. Assuming the bank and its customer are fortunate enough to secure the services of armored transit, the cash has to be counted. For a community bank whose branches do not typically deal in cash of the volumes generated by the cannabis industry, having the manpower to count the cash and the room to store the cash is troublesome. Do not forget about the unmistakable aroma of marijuana infused into the currency. That aroma may permeate branches and their employees. Really! Certainly, a viable alternative is to eliminate the branch in the cash-counting process by having the funds delivered directly to the Federal Reserve or have the armored car company count the currency, assuming it is willing to do so.

Plan to Increase Support Staff

Speaking of manpower, in addition to potentially needing people to count hundreds of thousands of dollars in currency, think about back-end operations. Currency transaction reports will need to be filed as these customers will not be exempt. In addition, suspicious activity reports will need to be filed every three months. Consideration should be given to creating a separate staffing unit dedicated to cannabis customers for at least two reasons. First, it might be possible to limit the legal exposure to a few individuals. Second, one can build expertise and understanding of expected activity by having the same individuals monitoring the accounts. Unexpected activity is likely to be uncovered much faster by an analyst intimately familiar with the financials and transactions of a cannabis-related customer than by someone who has never investigated the customer.

Analyze Existing Controls and Processes

Due diligence efforts, like automated transaction alerts, will undoubtedly increase due to the increased cash deposits. Are current alert parameters sufficient for this new line of customers? If the system permits automatic closure of alerts, will alerts from these customers be permitted to auto-close? The answer here should be “No.” Cannabis-related businesses are higher-risk customers, earning some extra attention under the EDD program. Is the EDD program prepared to support the type of analysis needed? Some financial institutions spread the cannabis customer’s financial reports to determine if funds not supported by the financials are deposited in the financial institution in an effort to uncover illegal sales or tax evasion. Certainly, community bankers would want to determine what financial reports are available to their team.

When conducting this research, one will undoubtedly come across another fun fact. Many cannabis-related businesses are vertically integrated, meaning banks will likely not be banking solely a dispensary or a cultivator. Many of these businesses own the process from seed to sale. When scouting for potential customers, go into the search with the understanding that many types of cannabis-related businesses could be banked simply by accepting one customer. One customer may actually be the cultivator, transporter, retailer and baker of infused edibles. Separate accounts may be required for each line of business. At least one financial institution contacted for this article requires the accounts be non-interest bearing to permit the institution a larger profit spread.

Contact the State Regulator for the Cannabis-Related Business

In many states, it is up to the Department of Financial Institutions to determine what reports the cannabis-related business must file with them. Ensure the cannabis customer makes these reports available. Though the Cole Memo¹¹ is no longer valid,¹² determining whether a Cole Memo priority has been violated by the customer is still necessary to determine the type of suspicious activity report (SAR) to be filed.¹³ Determining the reasonableness of the amount of cash being deposited may not be simple—requiring calibration of deposited amounts to amounts the customer reported to the state, and/or calculations of average customer sale multiplied by number of customers. This level of analysis takes an experienced analyst and lots of time that when combined, results in what would likely be a significant increase in human resource expenses for a community bank.

Also, ask the cannabis business regulator about site visits. I was surprised to learn that the state cannabis regulator in my state strictly regulates who can enter a cannabis business property and they would not permit our financial institution to perform periodic site visits.

Prepare for Blowback

As the BSA officer, banking cannabis-related funds means anticipating the unimaginable every step along the way

The cannabis odor lingering in branches has (a) angered some customers, (b) made some customers sick or (c) both—pick any answer and the result is not good. Create a marketing campaign designed to assure existing customers that entering into the cannabis market is not going to alter the bank’s culture or negatively affect their service. Just for giggles, poll a handful of people over 60 years of age on their thoughts about marijuana—the results likely will not be surprising. Consider now that the elderly hold much of the wealth in the U.S., as underscored by the dramatic increase of elder financial abuse reports and losses. It is inevitable that a community bank may lose some clients solely from accepting these new cannabis-related clients. Competitors will be pleased. Well, maybe not. Some banks will not accept the cannabis-related checks from other banks. It is true.¹⁴ Be proactive in explaining the decision to customers, employees and the public. Enlist the assistance of local law enforcement and U.S. Congress representatives. For a different type of marketing for institutions, engage a public relations company who specializes in this type of campaign.

Create an Exit Strategy

“It perhaps is no surprise that many banks have failed to create a sustainable cannabis-banking program and have thus exited the arena. After all, when pressured by regulators or when facing overwhelming challenges, they found it simpler to abandon their efforts and move in a different direction. This could happen to you, too, meaning that it is a good idea to have an exit strategy.”¹⁵ BSA officers for some financial institutions have created exit strategies permitting them to exit all cannabis-related customers within two weeks from the time the decision is made.

Contact a Regulator

Upon having a comprehensive understanding of the risks and how to address them, contact a regulator. Consider taking this step only after preliminary approval from the board, attorney(s), CPA and insurance company. If any one of the people/entities in the preceding list denies the request to move forward with banking cannabis-related businesses, it will be a waste of time for the bank and the regulator. Be prepared for this discussion with the finalized risk assessment document in hand and information on mitigating controls. Be prepared to speak about each of the pillars—including independent review and training. Prior to the meeting, determine whether the independent reviewer has the expertise to audit for this risk, if not, develop a plan. Update the training plan for the board, business-line employees and BSA staff. Have an outline of reporting to be initiated, including key risk indicators.

Financial institutions banking cannabis-related businesses contacted for this article indicated an average four-to-six month timespan from board approval to onboarding the first customer

Be forewarned, the above steps will likely take at least three months to complete. Financial institutions banking cannabis-related businesses contacted for this article indicated an average four-to-six month timespan from board approval to onboarding the first customer. Be prepared to learn about things you never thought you would need to know (like bond coverage) and things you thought you knew (handling cash). At the start of the journey to bank cannabis-related businesses, one does not know what they do not know and that is scary for someone tasked with risk mitigation. By successfully securing the answer to one question, two unanswered questions appear. Be prepared to not being prepared.

Jean-Ann Murphy, CAMS, USA, editor@acams.org

1. “Drug Scheduling,” United States Drug Enforcement Administration, https://www.dea.gov/drug-scheduling
2. Electronic Code of Federal Regulations,” eCFR, March 14, 2019, https://www.ecfr.gov/cgi-bin/text-idx?SID=3d4fa1abb348937da6387da8c0c59e30&mc=true&tpl=/ecfrbrowse/Title31/31chapterX.tpl
3. “BSA Expectations Regarding Marijuana-Related Businesses,” Financial Crimes Enforcement Network, February 14, 2014, https://www.fincen.gov/resources/statutes-regulations/guidance/ bsa-expectations-regarding-marijuana-related-businesses
4. Aaron Gregg, “How a Maryland bank is quietly solving the marijuana industry’s cash problem,” The Washington Post, January 2, 2018, https://www.washingtonpost.com/local/md-politics/how-a-maryland-bank-is-quietly-solving-the-marijuana-industrys-cash-problem/2018/01/02/a6317088-e0ec-11e7-bbd0-9dfb2e37492a_story.html?noredirect=on&utm_term=.bf7f53f8b27f
5. Terence Cawley, “Community Banking and Marijuana Decriminalization,” ABA Insurance Services, December 2018, http://www.abais.com/banking-marijuana-decriminalization
6. Julie Davoren, “The Difference Between a Qualified & Unqualified Audit Report,” Chron, March 8, 2019, https://smallbusiness.chron.com/difference-between-qualified-unqualified-audit- report-66670.html
7. “Appendix A to Part 364—Interagency Guidelines Establishing Standards for Safety and Soundness,” Legal Information Institute, https://www.law.cornell.edu/cfr/text/12/appendix-A_ to_part_364
8. Richard P. Ormond, “Cannabis, Cash, and Crime,” Buchalter, July-August 2018, https://www.buchalter.com/publication/cannabis-cash-crime/
9. Sundie Seefried, Navigating Safe Harbor, Cannabis Banking in a Time of Uncertainty, April 20, 2016. 30.
10. Jennifer Oldman and Bloomberg News, “Legal marijuana sellers face quandary: No armored cars,” The Mercury News, August 29, 2013, https://www.mercurynews.com/2013/08/29/legal-marijuana-sellers-face-quandary-no-armored-cars/
11. James M. Cole, “Guidance Regarding Marijuana Enforcement,” Medical Marijuana ProCon.org, August 29, 2013, https://medicalmarijuana.procon.org/sourcefiles/cole-DOJ-memo-aug-2013.pdf
12. “Justice Department Issues Memo on Marijuana Enforcement,” The United States Department of Justice, January 4, 2018, https://www.justice.gov/opa/pr/justice-department-issues-memo-marijuana-enforcement
13. “BSA Expectations Regarding Marijuana-Related Businesses,” Financial Crimes Enforcement Network, February 14, 2014, https://www.fincen.gov/resources/statutes-regulations/guidance/ bsa-expectations-regarding-marijuana-related-businesses
14. Sundie Seefried, Navigating Safe Harbor, Cannabis Banking in a Time of Uncertainty, April 20, 2016.
15. Ibid.