Cannabis Banking Today

We are helping build out another cannabis banking program here in Oregon. My law firm has done a series of these for credit unions (“CU”s) and other financial institutions (“FIs”) going back to 2014. We have also handled a good bit of hemp banking work– mostly in 2019 and 2020 before that industry cratered. In this post, I’ll sketch out some considerations for FIs looking at banking marijuana-related businesses – or, as they are known in the common parlance, “MRBs”. And I apologize in advance for all the acronyms. That’s banking.

MRB defined

The term “MRB” is used pervasively in cannabis banking, yet this term is not defined in the moldering 2014 Financial Crimes Enforcement Network “FinCEN” Guidance. It’s also not defined in the 2020 National Credit Union Administration Guidance on banking hemp-related business (“HRB”s) (which we helped create) or the 2020 FinCEN Guidance on that related topic.

The lone federal definition we have is from a 2018 Small Business Administration (“SBA”) Policy Notice, as revised, which categorizes MRBs as “direct marijuana businesses”, “indirect marijuana businesses”, and “hemp-related businesses.” Here is my shorthand:

• “Direct Marijuana Business.” A business that grows, produces, processes, distributes or sells marijuana or marijuana products. Applies to personal and medical use activity.
• “Indirect Marijuana Business.” A business that derived any of its gross revenue for the previous year from sales to Direct Marijuana Businesses. Examples include testing labs and sellers of grow lights or smoking devices.
• “HRB” A business trafficking in hemp which “can demonstrate that its business activities and products are legal under federal and state law.” Examples given are paper, rope and clothing companies.

I have opined on this blog that “all businesses are marijuana businesses” in the MRB context. In that piece, I also explained that FIs don’t really use the SBA definitions set forth above. Instead, early, state-chartered CUs began using a three-tiered system to analyze potential MRB clients within the FinCEN framework. That system was first expounded in 2016 by Steve Kemmerling of CRB Monitor, before “hemp” was removed from the definition of “marihuana” under federal law. The CRB Monitor system involved the following categories (which SBA probably referenced):

• ‍Tier I MRB: “Plant touching” businesses licensed by the state. Cannabis dispensaries, cultivators, processors and testing facilities all fall under this definition. These are the highest risk businesses for banks and constitute the majority of suspicious activity report (“SAR”) filings.
• Tier II MRB: Businesses that rely on Tier I MRBs for the majority of their revenues and play a large role supporting the industry. See: equipment suppliers, consultants and industry associations. These businesses are lower risk for banks than Tier I. However, banks target them for enhanced KYC (“know your customer”) protocols.
• Tier III MRB: Businesses that service Tier I businesses, but do not rely on the cannabis industry for their primary source of revenue. Classic examples include lawyers, accountants, property management firms and utility companies.

It’s worth noting that CRB Monitor revised and further parsed its definitions in 2020, but in my experience, most FIs keep it simple with the legacy framework or something similar. It isn’t a legal framework, after all. It’s just an expedient model that has been adopted widely by FIs given the federal leadership vacuum.

The bottom line here is that any FI looking at banking MRBs – or HRBs, for that matter – needs to come up with definitions and criteria for what an MRB or HRB actually is and does. Those criteria can be shared with potential clients, or not, during the screening and ongoing KYC processes for industry accounts. In my experience, drawing lines around indirect marijuana businesses / ancillary businesses / Tier III MRBs is the most challenging area here.

Ownership tracking parameters

Inside and outside the MRB context, FinCEN requires FIs to track and report “beneficial owners” of the businesses they bank. Beneficial ownership reporting is a core banking requirement, with a new rule coming down the pike January 1, 2024, in fact. A “beneficial owner” for FinCEN purposes is anyone who: (a) has significant responsibility to control, manage or direct a legal entity customer; or (b) directly or indirectly owns or controls 25% or more of a company’s equity. (Again, my shorthand.)

In the MRB context, FIs often hold clients to a heightened disclosure standard. This isn’t merely due to the nature of the industry. Most state marijuana programs have ownership disclosure standards which require disclosure of anyone: (a) with control over the cannabis business, or (b) who owns equity in a cannabis business. The thresholds tend to be lower than the “beneficial owner” numbers– sometimes 20%, 10%, or even lower. Disclosure doesn’t always mean vetting, but the names must be surrendered.

An FI should want to know at least as much about the ownership of its member or customer as state cannabis regulators–  especially in the absence of federal industry regulation on that topic. Typically, the FI will shortcut this inquiry by requiring the MRB to produce its application and license records with the state. And the FI will not open an account until the state has actually issued a marijuana regulatory license, in most cases. Which brings me to my next point.

Working with state regulators

FIs that wish to bank MRBs need to request and receive records from state regulators on a regular basis. This ties into KYC considerations, which include not relying on the customer (or member) representations to the FI. In the cannabis context, FIs have an obligation via FinCEN to double-check state regulators’ work, essentially.

Most (maybe all) state regulators publish basic information on their licensees: the company name, type of license it holds, license number, and sometimes published decisions or disciplinary proceedings. However, I don’t know of any state that publishes information on the ownership structure of its cannabis licensees. This means that information which isn’t statutorily subject to redaction (e.g. social security numbers, site security plans) will be available only via a public records request.

Public records requests can be time-intensive and expensive. From experience, cannabis regulators may struggle to fulfill them regardless of legal requirements. Thus, FIs that wish to bank MRBs generally enter into information-sharing agreements with the relevant state regulator(s). At this point, many state agencies are accustomed to such arrangements.

Forms

FIs will have various intake forms for all potential members and customers. These forms must be tailored for MRB and HRB applicants, and supplemented to boot. Here’s a typical universe of forms an FI will send to any cannabis industry applicant:

• Enhanced Monitoring Account (EMA) Cannabis Industry Certification
• EMA Supplemental Agreement
• CRB or HRB and Ancillary Business (AB) Supplement
• CRB or HRB or AB Attestation
• Consent to Release Form (for state regulators, see supra)

The forms, in turn, will require various submissions by the applicant, from regulatory license packets on down. Here at the law firm, I expect we will revisit many of these forms for FI clients in the near future, owing to changes in the hemp space under the new Farm Bill (likely delayed until next fall). And then again with respect to marijuana, if it is moved to Schedule III.

Transaction monitoring, detection and reporting

The federal government has put FIs in a truly awkward position on MRBs. Bank Secrecy Act / Anti-Money Laundering (“BSA/AML”) compliance is a significant undertaking for FIs even outside the cannabis space. However, the FinCEN Guidance bumps things up a level by essentially deputizing FIs as federal law enforcement auditors. FinCEN requires FIs to monitor their MRB customers and members perpetually, including what they sell and to whom, and to watch for indicia of adverse information.

These FI obligations commence immediately and ensue perpetually. Specifically, the FI is required to file an initial SAR within 30 days of onboarding. The FI must also file continuing SARs every 90 days after that, in addition to “marijuana limited”, “marijuana priority” and “marijuana termination” SAR filings, as needed, based on any number of events – or suspected events – set forth in the 2014 FinCEN Guidance. To say nothing of all the currency transaction reports (“CTRs”).

These filing obligations, and all of the software and training that goes with them, are frequently cited by FIs as a primary justification for the increased fees paid by MRBs. Law enforcement may hardly be acting on them, but FIs need to comply regardless.

Services to offer

Most FIs that work with MRBs offer limited services, or basic depository accounts. That said, we’ve worked with a couple of CUs that offer a full suite of banking and lending services. There are limits, of course, to what even the most enterprising FIs can do. They cannot offer bank card transaction processing for cannabis purchases (at least, not anymore). If the FI is smaller, like many state-chartered CUs, it will be limited in its deposit carrying capacity; this makes for an awkward constraint in a cash-laden industry.

Many FIs that get into cannabis banking are pulled into the space by one or two high-net-worth customers. Then, they will slowly branch out to a wider client base and often a wider suite of offerings. Others are more intentional, and set out to target the industry. These FIs tend to offer more comprehensive financial products and services.

Regulatory dynamism

I mentioned the Farm Bill is up for renewal, directly affecting banking for HRBs, and that “marijuana” may also move to Schedule III sometime in 2024. In addition, the specter of legislative reform is forever hanging about the industry (via the SAFE Banking Act, though I’ve called it oversold). Locally, new state cannabis programs continue to come online. This sometimes results in modest state-level legislation to insulate FIs from local prosecution for banking cannabis, even if such changes do not create a federal safe harbor or touch on BSA/AML strictures.

Overall, any FI that moves into this space should be prepared to roll with some changes over the next couple of years. Those changes are happening, however, because the cannabis industry is growing. It’s not a bad time to get in right now. It’s probably better than ever, in fact.