Skip to main content

Looking for Valuant? You are in the right place!

Valuant is now Abrigo, giving you a single source to Manage Risk and Drive Growth

Make yourself at home – we hope you enjoy your new web experience.

Looking for DiCOM? You are in the right place!

DiCOM Software is now part of Abrigo, giving you a single source to Manage Risk and Drive Growth. Make yourself at home – we hope you enjoy your new web experience.

IFSLeaseWorks is now part of Abrigo.

Diversify your portfolio and earn additional interest income. End-to-end lease origination and administration automation make it possible.

Read the press announcement

Looking for TPG Software? You are in the right place!

TPG Software is now part of Abrigo. You can continue to count on the world-class Investment Accounting software and services you’ve come to expect, plus all that Abrigo has to offer.

Make yourself at home – we hope you enjoy being part of our community.

AML/CFT Financial Crime

Cannabis Enforcement Actions: What Financial Institutions Need to Know About Illegal Cannabis

Kimberly Harrison, CAMS
May 29, 2026
0 min read

What financial institutions need to know about illegal cannabis

Illegal cannabis activity is no longer confined to hidden grow operations. Increasingly, it is embedded in otherwise legitimate businesses such as vape shops, CBD retailers, and even licensed cannabis dispensaries.

This article covers these key topics:

Why this risk is increasing

For financial institutions, the cannabis gray area creates a nuanced and growing risk. Recent cannabis enforcement actions across the United States make one thing clear. Illegal activity is evolving, and traditional due diligence alone may not be sufficient to detect it. 

Businesses that appear compliant on the surface may be operating outside regulatory boundaries in ways that are not immediately visible through standard onboarding or monitoring processes.While cannabis policy continues to shift, marijuana remains illegal at the federal level, and state regulations vary significantly. This inconsistency creates an opportunity for both compliant businesses and those operating outside the law. It also creates complexity for financial institutions that must navigate conflicting legal structures while maintaining effective compliance programs.

Recent enforcement actions highlight connections between illegal cannabis activity and broader financial crime risks, including:

  • Organized crime networks
    • Illicit trafficking involving drugs, weapons, and cash
    • Unlicensed or non-compliant retail operations

For banks and credit unions, the risk is not always obvious. Many of these businesses maintain professional storefronts, active websites, and seemingly legitimate operations. This makes it easier for illicit activity to move through the financial system undetected, particularly when controls rely heavily on initial customer due diligence rather than ongoing monitoring.

Need help with Day 1 or Day 2 accounting in a credit union deal?

Connect with an expert

The evolving hemp landscape

Recent changes and clarifications around hemp laws are adding another layer of complexity for financial institutions. The Agriculture Improvement Act of 2018, commonly known as the 2018 Farm Bill, legalized hemp by removing it from the Controlled Substances Act and defining it as cannabis containing no more than 0.3 percent tetrahydrocannabinol (THC) on a dry weight basis. While this created a legal pathway for hemp products, it also introduced a regulatory gap that has been widely exploited.

Hemp-derived cannabinoids such as delta-8 THC, delta-10 THC, and other synthetic or semi-synthetic variants have rapidly expanded in the market. These products are often marketed as legal alternatives to marijuana, yet their legal status remains inconsistent. The DEA’s 2020 Interim Final Rule clarified that synthetically derived tetrahydrocannabinols remain illegal as a controlled substance. However, inconsistent enforcement and differing interpretations across jurisdictions have created uncertainty for businesses and financial institutions alike.

At the state level, regulators are increasingly moving to address these gaps. Throughout 2024 and 2025, multiple states have enacted or proposed restrictions on intoxicating hemp products, including bans on certain THC variants, potency limits, and stricter licensing requirements. This evolving patchwork of rules increases the likelihood that businesses may, intentionally or unintentionally, sell products that are not compliant with their jurisdiction's laws.

For financial institutions, this means the risk is no longer limited to traditional cannabis businesses. Hemp, CBD, and vape retailers may present similar or even heightened risk, particularly when product lines include intoxicating or ambiguously regulated compounds. Without a clear understanding of what is being sold, institutions may unknowingly provide services to businesses operating outside legal boundaries.

 

Identifying risk

Financial institutions can enhance existing due diligence processes with relatively simple but effective steps.

Leverage open-source intelligence

  • Review Google listings and customer photos
    • Examine business websites for product inconsistencies
    • Monitor social media for product promotion and branding

Monitor enforcement activity

  • Track local and national news
    • Cross-reference business names and ownership with your customer base
    • Identify geographic areas or industries with increased enforcement activity

Apply enhanced due diligence when warranted

  • Conduct additional verification for higher-risk customers
    • Consider site visits where appropriate
    • Implement ongoing monitoring rather than relying solely on onboarding reviews

Importantly, illegal products are not always visible. Some businesses intentionally limit access or visibility, underscoring the need for layered, continuous due diligence.

 

Key red flags

Incorporate these indicators into monitoring and investigation workflows:

  • Products that appear inconsistent with state cannabis laws
    • Elevated or unexplained cash activity
    • Rapid growth that does not align with the business model
    • Customer feedback referencing high-potency or questionable products
    • Connections to multiple entities, states, or prior enforcement actions

Individually, these indicators may not be conclusive. However, when combined, they can signal increased risk and warrant further review.

 

Strengthening risk management

To mitigate exposure, financial institutions should take a proactive and risk-based approach.

Reassess risk ratings
Businesses adjacent to cannabis, such as vape and CBD retailers, may warrant higher risk classification based on evolving enforcement trends.

Validate licensing and compliance
Use state resources to confirm licensing status and understand product limitations. Do not assume that licensing alone indicates full compliance.

Enhance transaction monitoring
Look for patterns that may indicate illicit sales or distribution, including unusual cash activity or inconsistencies with the stated business purpose.

Incorporate ongoing review processes
Risk in this space is dynamic. Periodic reviews are essential to maintaining an accurate, up-to-date risk profile.

 

The bottom line

Cannabis enforcement actions are signaling a clear shift. Illegal activity is becoming both more sophisticated and more visible. For financial institutions, the challenge is not only identifying licensed cannabis businesses but recognizing when otherwise legitimate customers may be operating outside regulatory boundaries.

A proactive, risk-based approach grounded in enhanced due diligence and ongoing monitoring can help institutions identify exposure earlier, strengthen compliance programs, and stay ahead of this evolving threat.

 

 

Whitepaper

Ahead of the curve: A banker’s podcast – Data quality, AI, and the future of financial crime compliance

Read More
Webinar

Telegram fraud exposed: Inside the cybercrime economy fueling financial fraud

Read More
Webinar

Hot topics in AML & fraud: What to watch in 2026

Read More

FAQs

Why should financial institutions be concerned about illegal cannabis?

Illegal cannabis-related activity is increasingly being found in businesses that appear unrelated to the cannabis industry, including vape shops, smoke shops, CBD retailers, and hemp product sellers. These businesses may market or sell products containing intoxicating cannabinoids or THC levels that exceed legal limits, creating compliance and reputational risks for financial institutions. As a result, institutions should evaluate cannabis-related risk beyond licensed dispensaries and apply appropriate due diligence to adjacent industries.

Does a state-issued cannabis or hemp license guarantee that a business is operating compliantly?

No. Recent enforcement actions have demonstrated that some licensed businesses continue to sell non-compliant or illegal products despite holding valid licenses. Licensing should be viewed as one component of a broader risk assessment rather than proof of ongoing compliance. Financial institutions should verify licensing status, understand applicable product restrictions, and conduct ongoing monitoring to identify potential violations that may arise after onboarding.

What are some practical ways financial institutions can identify potential illegal cannabis activity?

Financial institutions can strengthen detection efforts by combining traditional due diligence with ongoing monitoring and open-source intelligence. This may include reviewing business websites and social media pages, monitoring customer reviews, tracking local enforcement actions, and analyzing transaction activity for unusual patterns. Red flags such as unexplained cash volume, rapid growth inconsistent with the business model, sales of potentially non-compliant products, or links to multiple entities and jurisdictions may warrant additional review.

How often should financial institutions review customers operating in cannabis-adjacent industries?

Risk associated with cannabis, hemp, CBD, and vape-related businesses can change quickly as regulations evolve and enforcement priorities shift. Rather than relying solely on customer due diligence performed during onboarding, financial institutions should conduct periodic reviews based on the customer's risk profile. Ongoing monitoring of licensing status, product offerings, transaction activity, and enforcement developments can help institutions identify emerging risks early and maintain a more accurate assessment of potential exposure.

About the Author

Kimberly Harrison, CAMS

Senior Financial Crimes Investigator
Kimberly (Kim) Harrison began her career in the financial services industry in 2012. She started as a teller and worked her way into customer service, then loans, before settling into the BSA/AML department. She was responsible for BSA/AML investigations, SAR filing, customer risk rating, enhanced due diligence processes, foreign customer

Full Bio

About Abrigo

Abrigo enables U.S. financial institutions to support their communities through technology that fights financial crime, grows loans and deposits, and optimizes risk. Abrigo's platform centralizes the institution's data, creates a digital user experience, ensures compliance, and delivers efficiency for scale and profitable growth.

Make Big Things Happen.