The coronavirus pandemic has added another wrinkle to navigating state versus federal regulations when it comes to gaining access to banking services by marijuana-related businesses.
Before the pandemic, more than half the states in the U.S. had authorized some form of legalized marijuana use. In response to the coronavirus, most of these states with legalized cannabis have
Despite this classification, programs created by the coronavirus relief bill, like
Over the past few years,
There are four states with
Because of the cash-intensive nature of the business, policymakers, regulators, tax authorities and law enforcement have stressed the need for moving cash from marijuana sales into the traditional banking system. Treasury Secretary Steven Mnuchin recently
Marijuana-related businesses are inherently high risk, but so are other industries like money-services businesses, which have faced “de-risking” for years.
The Financial Crimes Enforcement Network provided
Notwithstanding this guidance, many bankers still fear the reaction from their examiner if they bank marijuana-related businesses.
Last year, the House passed a bill (
In the absence of federal guidance, states including California, New York and
But the guidance to date mostly focuses on a bank’s evaluation of the risks associated with offering services to marijuana-related businesses. It does not outline what constitutes a strong program for serving such businesses.
The uncertainty has led to inconsistency in oversight and expectations from state and federal examiners, which only increases during a crisis.
But there are ways to develop a strong internal program to satisfy examiner expectations.
First, a financial institution’s risk assessment needs to provide an in-depth, all-encompassing review of the risks associated with marijuana-related businesses. At minimum, that includes addressing any state and federal guidance. The institution must also identify the controls necessary to bring the inherent risk into alignment with the risk tolerance of the bank.
Secondly, a stand-alone policy on servicing marijuana-related businesses will not suffice. As with many other risks, banking such businesses will touch operations across the bank including compliance, anti-money-laundering laws, deposit and payments operations, lending and audit. Banks need to ensure that the responsibility to manage the risks is shared across the organization.
Third, banks must develop enhanced due diligence for marijuana-related businesses, just like they would for other higher-risk customers. The FFIEC
Training is also critical. Everyone from the board down needs to understand state law and regulations regarding cannabis, federal guidance and the cannabis industry in general. These are minimum expectations in order to mitigate the risks associated with serving marijuana-related businesses.
If staff do not have a strong understanding of what is “normal” activity, they will not be able to properly monitor for suspicious behavior. The board must also be actively engaged, requiring regular reporting and adjustments to the program as necessary.
The success of nearly any activity, and especially one that is high risk, requires active monitoring and robust oversight. This includes a strong three-lines-of-defense model, and testing for compliance with bank policies.
Lastly, regulatory technology has matured and is helping institutions manage compliance risks. By automating repetitive tasks such as filing SARs and flagging noncompliant activities, a bank can reduce the resources needed to run such programs.
This also frees up time to review customers or activities that pose the highest risk. And more important, it frees up bankers to focus on customers who need servicing the most during the pandemic.
