Cannabis Banking: Risk Considerations

With 37 states and counting having legalized marijuana for adult and/or medical use, cannabis banking is quickly becoming a competitive space for financial institutions to serve an underbanked industry.

Yet, because “the possession, distribution or sale of marijuana remains illegal under federal law,” the American Bankers Association (ABA) points out in its position statement on cannabis banking, “any contact with money that can be traced back to state marijuana operations could be considered money laundering and expose a bank to significant legal, operational and regulatory risk.”

This thorny legal status causes many large institutions to steer clear of the industry. However, Bloomberg reports that the number of smaller banks and credit unions providing banking services to cannabis companies has been accelerating. A report from the Financial Crimes Enforcement Network (FinCEN) sets the number depository institutions actively serving marijuana-related businesses (or MRBs) at just over 700 as of June 2021, with marked growth over the last few years.

Compliance Risk

In 2014, FinCEN released guidance to clarify how financial institutions can provide services to MRBs consistent with their Bank Secrecy Act (BSA) obligations. The guidance requires institutions to conduct due diligence on customers engaged in a marijuana-related business, including verifying licenses and registration with appropriate state authorities and requesting information about the business from state licensing and enforcement agencies.

FinCEN guidance also mandates suspicious activity report (SAR) filings when institutions provide financial services to MRBs. Emphasizing that “the obligation to file a SAR is unaffected by any state law that legalizes marijuana-related activity,” FinCEN outlines three distinct types of marijuana-related SARs to address the conflict between state and federal laws.

This additional regulatory burden and increased reporting requirements may elevate compliance risk for institutions that choose to serve MRBs. For teams managing BSA/AML compliance, many processes can be automated through software and watchlist screening, but someone will still need to be responsible for filing SARs and responding to screening flags. Financial institutions may need to invest in their team, technology, or both to ensure adequate risk and compliance management.

Cannabis Banking Risk Management

Cannabis banking, while unique in some of the types of risks it presents compared to typical business accounts, at its core is still a product. As such, sound risk management practices apply:

• Identifying the business processes that support the product or service
• Conducting risk assessments on the identified processes across applicable risk categories
• Evaluating existing controls and analyzing the need for new or enhanced controls

In short, financial institutions should understand the challenges and potential risks before getting involved in a new line of business just like they would for any other type of product or service they choose to provide to their customers or members.

The Future of Cannabis Banking

Ballotpedia is tracking more than 20 legalization initiatives in nine states for 2022, but federal legislation remains an open question. Currently, Congress is voting on the Secure and Fair Enforcement (SAFE) Banking Act, where it has passed in the House several times, but is stalled in the Senate.

If enacted, the SAFE Banking Act would:

• Prohibit federal banking regulators from penalizing depository institutions for providing banking services to legitimate cannabis-related businesses
• Exclude proceeds resulting from transactions with legitimate MRBs from being classified as unlawful activity and subject to anti-money laundering laws
• Protect depository institutions against liability or asset forfeiture for providing a loan or other financial services to a legitimate cannabis-related business

Even if an institution has no plans to provide financial services to the cannabis industry, serving customers tangentially related to MRBs — such as vendors, suppliers, landlords, and employees — still poses legal risk. The ABA observes that “indirect connections to marijuana revenues are hard, if not impossible, for banks to identify and avoid.”

As the landscape continues to shift for this issue, it’s fair to assume that all financial institutions face the potential of increased risk exposure. Without a proactive approach to risk and compliance management, banks and credit unions may find themselves struggling to meet regulatory obligations and reporting requirements.