Myth #1: Cannabis is illegal in my state, so the risk is minimal and not of concern.
Fact: Risks exist in states where cannabis is illegal
If cannabis is illegal in a financial institution’s footprint, it does not mean it can be ignored. With talks of cannabis safe banking and legalization at the federal level heating up once again, banks and credit unions should be prepared if legalization happens in their state. Every state where cannabis is currently illegal borders at least two other states where it is legalized medically or recreationally. Financial institutions must understand how to handle transactions with cannabis-related businesses (CRBs) and know what to do if they discover a customer or member is operating a CRB or receiving income from a CRB in another state. The first step is staying up to date with all state and federal laws that may affect their clients and the decision on whether to provide cannabis banking services.
Myth #2: Institutions that do not service CRBs simply need to state their decision.
Fact: Even if a financial institution decides against offering services to CRBs, it must ensure BSA compliance with updates to policies and procedures and other actions.
When asked if they plan to offer cannabis banking services to CRBs, banks and credit unions cannot rely on a simple yes or no answer. Stating that they are or are not planning to service CRBs is only the first step in an extensive list of actions required to ensure compliance and perform proper due diligence. No matter their decision, banks and credit unions will have to update their policies and procedures to reflect it.
Questions for consideration if an institution does NOT provide financial services to cannabis-related businesses include:
- How will they handle an account that is found to be tied to a CRB?
- Will they offer banking services to indirect CRBs (those not “touching” the product?)
- Will they bank hemp-related businesses? CBD-related businesses?
- What extra customer due diligence will they implement to ensure an account isn’t tied to a CRB?
- What transaction monitoring will be performed to ensure there are no CRBs in the institution’s client base? How will they effectively identify and manage CRB-related risk?
Myth #3: All CRBs carry the same amount of banking risk.
Fact: Financial institutions should determine their tier of acceptance for cannabis banking.
There are multiple tiers to cannabis-related businesses. Steven Kemmerling, CEO of CRB Monitor, first introduced the idea of CRB tiers in 2016 to differentiate the types of marijuana-related businesses and their perceived risks.
The tiers are broken down as follows:
Tier 1 – Direct
This tier includes businesses that touch the actual cannabis plant at some point and those that have a financial or controlling interest in companies that do. This tier has the highest perceived risk for financial institutions.
Tier 2 – Indirect with “substantial” revenue from Tier 1
This includes companies that sell cannabis or CBD products and derive a majority of their profits from those products. The definition of “majority” or “substantial” is defined by each financial institution’s risk tolerance. This tier is of moderate risk to institutions.
Tier 3 – Indirect with “incidental” revenue from Tier 1
Companies that fall under this tier can include CPAs, payroll companies, cleaning companies, and other firms that service Tier 1 businesses. While these businesses earn some profit from Tier 1 companies, it is a nominal amount of their overall business. This tier is the lowest risk to financial institutions.
As BSA officers analyze each level of risk during the AML risk assessment process and decide their risk tolerance for banking cannabis, they should define how to handle the different tiers. While the tiers are not official regulations, they are a good industry standard to adopt when defining where a financial institution’s risk tolerance stands. This analysis is critical to the final decision-making process by the board of directors and executive management.
