Managing the High-Risk Cannabis Industry

The risks associated with banking hemp companies versus hemp-derived cannabidiol (CBD) companies versus marijuana-related businesses (MRBs) all differ tremendously; for each, the risk posed by a deposit account differs greatly from the risk posed by a loan. To understand why, the legal and regulatory status of hemp, CBD and marijuana must first be understood, as well as other factors that could challenge the value of collateral on a loan if the collateral is hemp- or marijuana-related. Before considering the risks involved with banking hemp, CBD or marijuana, the three products and their differences will be reviewed, as this will help bankers determine their risk strategy. Banking these companies is not only doable, but can be profitable as well when done properly.

Hemp vs. CBD vs. Marijuana


Hemp is cannabis with a total tetrahydrocannabinol (THC) level of 0.3% or less. Hemp is a versatile plant grown for the following three main uses:

  1. Fiber
  2. Grain and seed
  3. CBD oil (from the flower)

In addition, extremely high-quality hemp flower is now being grown for smokable hemp.

Once certain restrictions are met, growing, processing and selling hemp is legal at the federal level, as is transporting hemp across state lines, thanks to the 2018 farm bill. That same farm bill removed hemp from being a Schedule 1 substance under the Controlled Substances Act, but none of the above means that hemp can be grown in backyards the same way green beans are grown. The many restrictions mentioned above are detailed in either a state or federal program (Program) as follows:

  • If grown under a state-run or tribe-run Program approved by the U.S. Department of Agriculture (USDA),1 growers, processors and dealers (depending on the state/tribe) must be registered and/or licensed. The USDA recently began approving hemp Programs.
  • If grown in a state with no state-run Program, then hemp is grown under a federal program and the USDA will issue licenses to producers through its own program (provided that the producer is in a state which has not banned hemp production).

Hemp that is not produced consistent with the 2018 farm bill is illegal marijuana.


CBD is oil that is derived from the flower of the hemp plant. This is different from hemp seed oil, which comes from the seed and contains little to no CBD. The same laws that pertain to hemp also pertain to CBD and products that contain CBD. CBD is also subject to Food and Drug Administration (FDA) oversight with respect to how products containing CBD can be advertised. Note that CBD can also come from the marijuana plant but for the purposes of this article, CBD is used to describe hemp-derived CBD.


Marijuana is frequently described as the dried leaves and flowering tops of the cannabis sativa or cannabis indica plant. Marijuana contains active chemicals such as THC, which is the psychoactive ingredient that gets one high. Marijuana is still considered a Schedule 1 substance under federal law, but many states have legalized the cultivation and selling of medical and/or recreational marijuana. However, the fact that marijuana remains illegal at the federal level has forced two things that increase risk: it has forced a cash-based industry in that most payment networks will not process marijuana-related transactions and it has also forced a great deal of investment in large marijuana companies to come in from foreign investors.

With respect to marijuana customers, the industry seems to have settled on the following common definitions:

  • Tier I MRB: A company that is directly involved in cultivating or dispensing marijuana. Some include “transporting” in this definition, but for the most part this tier is describing direct involvement.
  • Tier II MRB: A company that services Tier I MRBs. 2

What Does This Mean to Bankers?

Banking hemp, CBD and marijuana customers creates different risks for bankers in general, and within each category of customer, risk differs depending on whether the customer has a deposit account or a loan. The risks involve not only know your customer (KYC) risks, but credit and concentration risks as well. Just as bankers have addressed other high-risk accounts, they should also develop an onboarding process and questionnaire designed to flesh out the nuances of the particular customer. The following risks will help bankers ask the right questions on the questionnaire.

Risks Involved With Banking Hemp

Whether or not an institution chooses to bank hemp or CBD customers, or the extent to which they do so, is a risk-based business decision. The following are some risk considerations for the decision-making process, along with some strategies for mitigating the risk.

Deposit Accounts

Regardless of whether a deposit account is for a hemp farmer, processor, dealer or a CBD oil company, the two greatest risks described below are the same. With respect to hemp testing labs, the risks differ slightly.

Farmers, Processors, Dealers and CBD Companies

The greatest risk in banking hemp is that either:

  1. The hemp involved is actually marijuana and bankers do not know it.
  2. The hemp or CBD company has not followed any of the other Program requirements, such as having the correct licenses and registrations, or growing the hemp outside of the tract of land previously described.

If this were to happen, examiners could cite the institution for not knowing their customer or their customer’s program well enough. In addition, if the hemp is really marijuana that went unnamed, then the financial institution (FI) could be cited for failure to file a marijuana-related suspicious activity report (SAR). Essentially, hemp that exceeds 0.3% total THC or that does not follow growing regulations is considered marijuana, even if the banker was not aware of it. Although site visits are a good control, a banker cannot tell the difference between hemp and marijuana just from viewing it during a site visit. Bankers also cannot tell what is in a bottle labeled “CBD oil” without having the contents tested.

The risk to farmers that a hemp crop is considered “hot” (a term used by those in the industry to describe when the total THC level exceeds 0.3%) actually increased under the USDA interim final rule because the 0.3% limit on hemp is now based on total THC instead of just delta 9 THC (total THC is the sum of the THC and THCA content). Farmers say they will have to harvest early to keep their crops at or under the new limit. Crops that test between 0.3% and 0.5% must be destroyed and crops that test over 0.5% could result in farmers being prosecuted for a drug crime.

Hemp Testing Labs

From a deposit account perspective, there are no special risks associated with hemp testing labs. They are not growing, processing or selling product; they are just testing it, so there are few KYC risks. Many have gone bankrupt in the last 12 months, but that is more of risk from a lending perspective than from a deposit perspective. Note that the USDA interim final rule specifies that hemp must be tested at a laboratory regulated by the U.S. Drug Enforcement Administration (DEA). This ruling could put other testing labs out of business.

Banking hemp, CBD and marijuana customers creates different risks for bankers in general, and within each category of customer, risk differs depending on whether the customer has a deposit account or a loan


In addition to the same KYC risks discussed for deposit accounts, there are credit risks associated with lending to the hemp and CBD industries. These risks can differ depending on whether institutions are lending to the farmer, processor/dealer, the company selling CBD oil or the hemp testing lab. Farmers and processors experience the same perils with hemp as they would with any other crop, such as a shortage of labor to harvest and process the crop, but they also experience hemp-specific perils, such as ending up with male plants (no flower, no CBD) or having the crop confiscated by law enforcement for mistakenly believing the product is marijuana. CBD oil companies could run afoul of FDA advertising regulations or could be found selling a product that is inconsistent with its labeling. Hemp testing labs, which must be certified by the DEA, could be found to have lax controls and incorrect testing results and thus could lose their DEA certification.

Hemp-related companies also face the risk of fraud. As with any new industry, there are always fraudsters trying to take advantage of people who do not know the industry as well as they should. The risks described above for hemp-related companies create risk of loss for them, and this creates repayment/collateral risk for the banker holding the loan for the customer. Essentially, the banker ends up owning the risk.

How to Reduce Risk

  • Use a comprehensive onboarding questionnaire that documents the business’ registration/licensure, the coordinates of the tract of land where the hemp crop is grown and the business owner’s experience in the hemp industry.
  • Obtain the Certificate of Analysis (COA) from customers for the hemp in question and save this to the due diligence file. The COA document will indicate the percentage of CBD and the percentage of total THC, among other indicators.
  • Obtain all contracts for growing, harvesting, processing, storing, drying and transporting the crop or its derivatives.
  • Ask CBD oil companies about traceability. Can they confirm with certainty where the hemp that made the CBD oil came from and whether it was grown in a compliant manner?
  • Have a conversation with the customer to review the questionnaire.

Risks Involved With Banking MRBs

The considerations below pertain mostly to Tier I MRBs, but the lending risks could be posed by Tier II MRBs as well, depending on the percentage of a Tier II business that comes from Tier I customers. For example, if that percentage is 100% and a significant event were to impact the marijuana industry, then that Tier II MRB could face the same impact.

Deposit Accounts

The fact that marijuana remains illegal at the federal level exposes institutions to legal risk, along with reputational risk, regulatory risk and financial risk when banking any business that grows, processes or sells marijuana, medical or otherwise. From a legal perspective, FIs that bank marijuana growers and dispensaries face the threat of a Racketeer Influenced and Corrupt Organizations (RICO) Act lawsuit—that is, being named as a defendant in a RICO lawsuit against a customer. There have been many RICO lawsuits against marijuana companies over the past few years, with some being settled out of court, others progressing in the courts and even one that was dismissed. Type “RICO lawsuits in marijuana industry” into any search engine and the results will tell the entire story. The possibility of a RICO lawsuit gives rise to reputational risk as well as legal risk.

From a regulatory perspective, examiners are not keen on FIs engaging in illegal activities, and Tier I MRBs (and their associated cash) are considered an illegal activity. This results in the FI and its Tier I MRB customers being deemed money launderers. While it is true that state-chartered institutions might face less scrutiny, it is unlikely they face no scrutiny at all. Regulators will caution institutions to consider all marijuana banking risks, encourage the assembly of a robust marijuana-risk management program and remind institutions to file appropriate SARs. Adding to regulatory risk is the challenge when determining true beneficial ownership of marijuana companies due to foreign investment and the prolific use of management agreements and shell companies in the industry.


As with hemp companies, the risks associated with lending to marijuana companies are more numerous than the risks associated with deposit accounts. Due to these risks, most loans to marijuana companies come from private investment—much of it from foreign investors. In addition to the deposit account risks above, lending to businesses that grow, process or sell marijuana bears credit risk in that the business itself can be the subject of a RICO lawsuit, jeopardizing cash flow. All of the product risks described above for hemp also pertain to marijuana—it is a crop after all. But even if an institution is simply lending to a landlord whose building is being held as collateral for the loan and that building is housing a marijuana grower, processor or seller, the cash flow could be jeopardized by any number of risks to a marijuana company (theft, compliance issues with the state, selling a bad product, industry consolidation, etc.).

Because banking marijuana is different from banking hemp or CBD, institutions tend to have different onboarding questionnaires for each substance with industry-specific questions.

Cannabis (Hemp/Marijuana) Risk Management Strategy—Bringing It All Together

With respect to developing the risk management program, banks may choose to develop one cannabis-risk management program or develop separate programs for hemp and for marijuana. What is important is that all risks are addressed somewhere. Below is one approach to consider:

  1. Speak with the board of directors, senior management, risk management and compliance committee members, and lines of business managers to socialize the risks and obtain buy-in.
  2. Speak with regulators and share the risk management program with them.
  3. Finalize the bank’s risk appetite for the industry in terms of money laundering, fraud, credit and concentration risk—that is dollar limits on the cannabis-related book of business and whether out-of-footprint cannabis customers will be accepted.
  4. Know the hemp and marijuana state laws and regulations across the FI’s entire footprint.
  5. Learn the nuances of the industry by monitoring social media conversations, attending industry events and perhaps getting involved with cannabis endeavors at a local university (at least more so than in one’s college days).
  6. Complete the cannabis-risk assessment grid and narrative and issue a risk assessment report. Use this information to:
    1. Develop the new customer review and approval process.
    2. Build robust onboarding questionnaires.
    3. Implement a cannabis training program. Enjoy the jokes about Doritos and Pink Floyd CDs.
    4. Determine how to move the cash, if there is any.
    5. Develop monitoring and enhanced due diligence procedures, including transaction monitoring, product monitoring (such as monitoring the crop) and how often to refresh questionnaires.
    6. Determine the risk-rating criteria and processes for risk-rating customers.
    7. Determine what the monthly fees will be for banking these companies. This can be a profitable area for an institution.
    8. Determine what reports will be issued to update management and the board on the operations of the program and where risk resides with respect to the risk appetite.
  7. Be proactive in terms of documenting the cannabis-risk management program to make it auditable.

Overall, the full passage of H.R. 1595: Secure And Fair Enforcement Banking Act of 2019 (SAFE Banking Act of 2019) will lower the risk of banking cannabis companies in general for FIs, as it will provide protection from regulatory action for institutions. However, it in no way makes marijuana legal. Some of the risks described above will remain the same even with the passing of the 2019 SAFE Banking Act.

Know the hemp and marijuana state laws and regulations across the FI’s entire footprint

Is There an Upside?

The upsides to banking the cannabis industry include the following:

  • Bankers are getting the cash off the street.
  • Bankers could be seen as helping farmers and who does not want to help a farmer?
  • It provides an opportunity for FIs to increase low-cost deposits at the institution.
  • It provides an opportunity to increase income from onboarding fees and monthly monitoring fees.

Banking cannabis-related companies raises risk in an institution, but institutions can respond to this risk much the same way they respond to other high-risk customers—by managing the risks and balancing the risks with sufficient reward.

Sharon Blanchette, CAMS, SVP, director of the FIU, Atlantic Union Bank, Richmond, VA, USA,

  1. The USDA is responsible for issuing regulations surrounding hemp and on October 31, 2019, it published its interim final rule governing hemp production in the U.S. The rule was available for comment in the Federal Register until January 29, 2020. The final interim rule includes licensing requirements, testing procedures for total THC levels, compliance provisions and procedures for addressing violations.
  2. Steven Kemmerling, “Defining Marijuana-Related Businesses,” ACAMS Today, September 20, 2016,


  1. This is a very good article! Where do employees of a dispensary/cultivation center fall on the MRB Tier scale? I’ve never ran across this being discussed in any article.

Leave a Reply