Tag Archives: penalties

Cannabis Banking: The Ins, the Outs & the Unknowns

By Tamara L. Kolb, Amy Bean, Caitlin Strelioff
No Comments

As the legal cannabis market expands, banks and nonbank financial institutions (NBFIs) across the United States continue to explore how to safely provide banking and other financial services to cannabis-related businesses (CRBs) and other CRB ecosystem players. At the same time, these organizations are taking into account changes they might need to consider relative to their Bank Secrecy Act ( BSA), anti-money laundering (AML) and related compliance programs. 

Regulatory conundrum

The Controlled Substances Act (CSA) identifies the cannabis plant and all its derivatives as a Schedule 1 controlled substance. Schedule 1 controlled substances have a “high abuse potential with no accepted medical use,” and they cannot be “prescribed, dispensed, or administered.” Because cannabis remains classified as a Schedule 1 controlled substance, the CSA “imposes strict controls on possession, manufacturing, distribution, and dispensing” of cannabis.

Under the Money Laundering Control Act of 1986 (MLCA) and the BSA as amended, covered banks and NBFIs are prohibited from providing financial services to businesses that are engaged in illicit activities. Because federal law prohibits the distribution and sale of cannabis, financial transactions involving CRBs are therefore deemed to be transactions that involve funds derived from illegal activities.

As of Feb. 3, 2022, 18 states, two territories, and the District of Columbia have enacted legislation to regulate cannabis for adult use. Thirty-seven states, the District of Columbia and four territories have approved comprehensive, publicly available medical and cannabis programs. Eleven states allow for the use of low-THC, high-CBD substances for medical reasons in limited situations or as a legal defense.

The growing divide between federal prohibition and state legalization of the cannabis industry creates a precarious position for federally regulated banks and NBFIs with the main concern involving exposure to legal, operational and regulatory risk. The situation begs the question: How might the federal government and regulators pursue and prosecute players in the legal cannabis industry?

The current economic trajectory predicts that retail sales of legal cannabis products in the U.S. will surpass an estimated $41.5 billion annually by 2025, and many banks and NBFIs are eagerly awaiting the federal green light to do business with CRBs without fear of prosecution or legal ramifications.

From 2018 forward, Congress has made several attempts to pass legislation that would protect CRBs when cultivating, distributing, marketing, and selling cannabis products in their state-legalized form. These efforts to declassify cannabis-related activity as a specified unlawful activity have thus far been unsuccessful.

The House passing the MORE Act back in 2020

Passage of the Secure and Fair Enforcement Banking Act of 2021 (SAFE Banking Act) and the Marijuana Opportunity Reinvestment and Expungement Act of 2021 (MORE Act) would enable banks and NBFIs to provide financial services to CRBs. The SAFE Banking Act would provide a safe harbor for banks and NBFIs that provide financial services to CRBs. The MORE Act would deschedule cannabis from the CSA entirely.

Questions to ask

Banks and NBFIs interested in providing financial services to CRBs should ask these questions:

  • Do we adequately understand our risk, and what are the implications for our organization? How should we augment our risk assessment process and our controls?
  • To what extent are we willing to accept the risk of banking CRBs? Do we have the ability to identify CRB customers, and if so, do we have any?
  • How should we advise the board of directors about setting risk appetite?
  • What customer due diligence (CDD) and enhanced due diligence (EDD) will we need to safely continue with existing customers and onboard new ones?
  • How will we monitor for unusual and suspicious activity? What will be the alerting and judgmental criteria?
  • How will our resource needs change so that we stay abreast of new processes and controls?

Risk appetite considerations

In order to determine whether to accept or prohibit CRBs, banks and NBFIs should identify the level of acceptable risk they are willing to take on. Several key components need to be considered, such as:

  • The board of directors’ stance on legal cannabis, given that good governance recommends and regulators expect that the board sets risk appetite
  • Cannabis laws in states within the customer footprint and the impact on customers’ communities
  • Risk profile, customer base, geographic location, products, and services
  • Relationship with regulators and any recent deficiencies or weaknesses in the BSA and associated compliance programs
  • Ability to implement appropriate controls and staffing

 Developing a strategic road map

If the decision is made to bank CRBs, banks and NBFIs should perform an assessment of compliance maturity for existing BSA/AML program processes and controls to identify potential gaps and develop a strategic road map that helps the organization achieve its vision for future state compliance and sustainable operations. 

A well-developed and well-articulated strategic road map visualizes what actions or key outcomes are needed to help organizations achieve their long-term goals. When creating the road map, banks and NBFIs need to demonstrate a keen understanding of their desired strategy, outcomes, markets, and products for onboarding and banking CRB customers. Specifically, banks and NBFIs need to define and explain how desired outcomes and business strategies create risk and exposure.

In addition to a road map, banks and NBFIs should develop and document a detailed risk-based approach that is aligned to the organization’s risk tolerance to determine necessary compliance steps when banking CRB customers.

Specifically, the following activities should be considered when developing a CRB banking program that meets regulatory expectations:

  • Identifying BSA/AML control gaps related to CRB risk identification and mitigation and formulating a plan to address them
  • Updating a board-approved policy framework
  • Updating detailed operating policies and procedures
  • Planning for capacity, developing job descriptions, and onboarding new personnel
  • Training for all three lines of defense, senior management, and the board
  • Developing and documenting a phased or full approach to acceptance of CRB customers
  • Developing and documenting a CRB program oversight policy

CRB risk framework

A three-tiered CRB risk framework first proposed in 2016 has quickly become the cannabis industry standard. The framework has evolved and expanded comprehensively to consider many types of CRBs, and evolving legal systems continue to refine the framework.

This framework is intended to help banks and NBFIs differentiate types of CRBs and their corresponding risks, and it separates CRBs into three tiers and details risks for each tier. The following exhibit summarizes the approach:

Risk framework by tier

Level Risk
Tier 1 Direct
Tier 2 Indirect with substantial revenue from Tier 1
Tier 3 Indirect with incidental revenue from Tier 1

Source: CRB Monitor

Even the most conservative of risk appetites equivalent to outright prohibition is not devoid of significant risk considerations. Residual risk frequently encompasses a large number of indirect connections in the total CRB ecosystem. Common examples are printers, lawyers, accountants, landlords, and even utilities and taxing authorities, and all of these are subject to regulatory scrutiny and, importantly, visibility to law enforcement. Also, policies to prohibit or restrict will be audited and examined for compliance, and exceptions will require explanations.

This panorama necessitates expertise and prudence in identifying and evaluating risks within the many layers of CRBs. For example, consider a bank or NBFI that banks a CRB’s employee or vendor. If a bank fails to properly implement controls that would allow it to identify and mitigate risk associated with banking CRBs, it will be susceptible to severe violations of the BSA, including civil money penalties, criminal penalties, and regulatory enforcement actions. 

Implementing necessary precautions

A well-developed road map should consider and implement the following activities:

  • Understanding the most current state and federal cannabis laws and regulations to ensure the bank or NBFI’s compliance
  • Understanding the local, state, or tribal program to ensure CRB customers are compliant with the program
  • Implementing a CRB risk assessment
  • Implementing executive approval practices for direct CRBs
  • Developing adequate risk ratings (possibly through a risk-based, tiered approach) and corresponding monitoring for CRB customers that includes:
    • Integrating various customer onboarding and AML solutions at both onboarding and periodic levels
    • Scheduling regular reviews to include recurring enhanced due diligence, site visits, and transaction monitoring
    • Monitoring for suspicious activity, including red flags, via open sources for adverse information about the CRB customers and related parties such as beneficial owners
  • Performing adequate CDD and EDD that will validate that the CRB-offered products, services, and programs are compliant with most current state laws and regulations by:
    • Collecting appropriate documentation as evidence of compliance, perhaps including a comprehensive onboarding questionnaire, beneficial ownership information, and contracts for the growing, harvesting, transporting and processing of the product
    • Reviewing applications and supporting documentation used to obtain a legal cannabis state license
    • Understanding the normal and expected activity of the organization’s CRB customers and their product usage
  • Developing adequate training programs and governance and oversight programs to address this customer type by:
    • Updating existing policies and procedures to review inherent risk presented by banking CRB customers
    • Updating annual training for employees
  • Auditing initial program design and periodic operational effectiveness

Moving forward cautiously

The ins, outs, and unknowns of cannabis banking are complex, and they require banks and NBFIs to be extremely vigilant with current policy and aware of new developments. Overall, the idea of creating a cannabis program might seem like a daunting task, but with appropriate guidance and care, organizations can provide services in compliance with laws and regulations.

Crowe disclaimer: Qualified organizations only. Independence and regulatory restrictions may apply. Some firm services may not be available to all clients. Given the continued evolution and inconsistency of various state and federal cannabis-related laws, any company should seek competent legal advice relating to its involvement in the cannabis industry, including when considering a potential public offering as a cannabis-related company.

Clearing Up the Haze Surrounding Cannabis Product Liability Risks

By Susan Preston, T.J. Frost
1 Comment

When a thriving cultivator purchased additional cannabis from a wholesale grower to meet the 5,000 pounds he was short, he was left holding the bag. A customer complained of a strong sulfur taste, and soon it was discovered that the wholesaler had applied the wrong pesticide concentration, rendering the cannabis unusable. The cultivator had to pull contaminated cannabis product from the shelves, a move that cost the company $3.5 million.

This story is not unique. When running short on product, cannabis businesses will often turn to other suppliers and partners to help them fulfill their orders. Unfortunately, improper vetting and a lack of understanding and compliance with state regulations and other requirements may lead to a loss of product integrity and costly product liabilities. Product liability can include more than just the cannabis itself, such as the equipment – vape cartridges, batteries, and lighters. This can quickly inflate the risk and, of course, the cost of a product liability claim. It is possible to transfer some of these cannabis risks to product liability insurance.

Top Three Product Liability Exposures Facing Cannabis Cultivators and Distributors

Three key areas of product liability exposure face cannabis business owners. It’s important to understand how each will affect your business.

  1. Product contamination.When cannabis is sold in an edible form, business owners could face claims of food poisoning or illness. If the product is smoked, there are exposures to contamination, product mislabeling or misrepresentation, and possible health hazard claims related to long-term exposure to potential contaminants.
  2. First party claims. Claims made in the event of an accident, injury or loss, whether caused by the business owner or someone else, will create another set of exposures, including manufacturing defects, failure to warn users on potential product usage hazards, improper labeling, or any product-related defect such as mold or odor.
  3. Third party claims. Cannabis business owners could be liable for claims stemming from the use of their cannabis product that result in a DUI, property damage, loss of wages, medical expenses and bodily injury.

It is possible to transfer some of these cannabis risks to product liability insurance. While there are multiple lines of product liability insurance, you’ll want to make sure you choose one designed specifically for the cannabis industry. These policies may provide coverage for the following exposures:

  • Product contamination
  • Bodily injury damages
  • Fines and penalties for non-compliance with state regulation
  • Bodily or property injury caused to others by product misuse, or by a third party
  • Manufacturing or product-related defects

While product liability insurance covers a number of cannabis risks, it doesn’t cover them all. Cannabis operations require a variety of coverage – property, crime, general liability, worker’s compensationand crop insurance. Insurance carriers will differ in definitions, policy exclusions and coverage language for each policy.

Because designated cannabis product liability and business operations coverage is fairly new and the marketplace features a wide range of options, make sure to work with a broker who understands the fine print of your policies, and your unique needs. The right broker can provide advice and loss control to help you reduce product liability exposures, make product and risk management recommendations that best mitigate your exposures to prevent loss, and ensure the proper coverage to address potential claims.

5 Compliance Reporting and Notification Requirements That You May Not Know About

By Anne Conn
1 Comment

New cannabis businesses must demonstrate proof of compliance to myriad laws and regulations as part of the initial license application process. And once a license is issued, it is easy to prioritize day-to-day business operations over ongoing compliance reporting requirements especially when sales are booming and compliance requirements are multi-layered, vague or obscured in non-cannabis specific programs and regulations.

But seemingly benign neglect of some minor reporting requirements can have major consequences to new and established businesses alike.

This article explores five compliance reporting requirements that cannabis businesses may not know about, and suggests ways to maintain a strong compliance posture across all regulatory agencies.

Pesticide Reporting

All licensed growers are required to prove compliance to state pesticide usage regulations. However, expectations on how and when to provide that proof of compliance vary greatly from state to state.  Furthermore, the responsibility of education and enforcement for pesticide usage in the cannabis industry often falls to non-cannabis specific agencies such as state departments of agriculture or environmental compliance.

For example in California, cultivators must report detailed monthly pesticide use reports via the State’s Agriculture Weights/Measures Division reporting portal, while Washington State regulators simply expect cultivators to keep records locally on site and provide them when requested.

With so many places to look, the best place to start your pesticide reporting requirement search is with your local agriculture department. They should be able to answer your questions and provide you with a list of resources to help you better understand how to comply with state pesticide usage and reporting regulations.

Hazardous Materials Reporting

Like pesticide use and reporting, hazardous waste handling and reporting requirements are complex and vary state to state. In fact, there may even be nuanced variations in handling requirements at the county level. The best approach to ensure compliance with a complicated set of regulations is to start by consulting your local county fire department. They will have the most specific set of rules for hazardous materials handling and reporting and can help you develop a site-specific compliance plan.

Two OSHA reporting requirements

Depending on how your cannabis business is classified, you may be required to keep injury and illness incident records and provide reports to the Occupational Health and Safety Organization (OSHA) for specific time periods.

Contact your business insurance provider’s loss prevention representative for more information about how your business is classified, which specific OSHA reporting requirements apply to you, and how to stay in compliance with applicable OSHA requirements.

Click here to learn more about how OSHA organizes reporting requirements by business type.

A note of caution here: OSHA non-compliance penalties can be steep and “I didn’t know I was supposed to do that” is not an acceptable defense when it comes to explaining any OSHA violations.

Labor Law Notification Requirements

Federal labor law requires that you notify employees of their rights. At a minimum, you post information regarding wages and hours, child labor, unemployment benefits, safety and health/workers’ compensation and discrimination in a conspicuous place where they are easily visible to all employees. Some states requires additional information be posted in a similar manner, so it’s important to be sure that those notices are posted along with the federal requirements.

This is a simple, yet easily overlooked, requirement for all businesses, regardless of industry. Ask your insurance provider for a copy of the notice to print and post right away (if you have not already) for a quick compliance win!

These five reporting and notification requirements may seem tedious, overly complicated and burdensome in the face of day-to-day business operations, but compliance to these requirements not only protects your business and employees, it also enhances the overall reputation of the industry. The good news is that regulatory agencies welcome a proactive approach and are happy to work with cannabis businesses to provide guidance and information for developing compliance plans.

Massachusetts Lawmakers Reach Compromise on Cannabis Bill

By Aaron G. Biros
No Comments

On Election Day last year, voters in Massachusetts approved a measure to legalize recreational cannabis. With recreational sales beginning in July of 2018, lawmakers have tried to get a bill through the state legislature to settle on, among other things, a tax rate and regulatory framework.

On Wednesday, multiple news outlets reported that the legislature has reached a compromise on a bill that would change the measure that voters passed to allow for lawmakers to implement higher taxes, a strategy on local bans and a regulatory framework, reports The Boston Globe.

mpp logo
MPP logo for the Regulate Marijuana Like Alcohol Campaign in Massachusetts

In a statement to supporters, Matt Schweich, director of state campaigns at Marijuana Policy Project (MPP), the biggest changes are in local control and taxation. “After weeks of persistent advocacy from Massachusetts residents, the Senate and House have reached a compromise that largely respects the will of the people,” says Schweich. “The legislation adjusts the local control policy, allowing local government officials in towns that voted “no” on the 2016 ballot initiative to ban marijuana businesses until December 2019. For towns that voted “yes” in 2016, any bans must be placed on a local ballot for voters to approve.” Therefore if a town wants to ban cannabis sales, they need to bring it to a vote for the people to decide. 72% of the population voted in favor of the ballot initiative. “The maximum tax rate — which depends on whether towns adopt optional local taxes — will increase from 12% to 20%,” says Schweich. “Under the bill, the state tax will be 17%, and the local option will be 3%.” A major push behind increasing the tax rates concerned lawmakers’ worries that the original 12% tax rate would not cover regulatory costs and government expenditures on the industry.

Boston, MA
Photo: Trenton Kelley, Flickr

The ballot initiative created the Cannabis Control Commission, the regulatory body overseeing the industry, with three board members. That agency will remain in the new bill, just with five board members that will write the rules on things like marketing, safety, fines and penalties and fair business practices.

Schweich says the MPP helped orchestrate over 1,000 calls to legislators, urging them to reject the House’s version of the bill, which some have called draconian. “The bill isn’t perfect, and we preferred the original language of the ballot initiative,” says Schweich. “However, given how problematic the House bill was, we are satisfied with the final compromise.”

The bill is expected to pass votes in both the House and Senate on Thursday and Governor Charlie Baker is expected to sign the bill that same day.