Legalized Marijuana, Part 2: Regulatory Guidance and CDD

In a previous post we looked at some of the challenges posed by the interplay between state and federal laws and the guidance that impacts how banks could service marijuana business that are legal at the state level but not at the federal level. Both the New York Times and the BBC have published pieces about these businesses’ challenges in obtaining banking services because financial institutions are hesitant to service them. Here we look at some more specific examples of what is in the guidance and how an institution could potentially serve this customer segment while managing the risk. The Wall Street Journal recently profiled a Washington-based business specifically focused on offering marijuana-based businesses with compliance services, indicating there is a solid business opportunity to provide a variety of compliance and banking services in this segment.

What does the guidance say?

There is a difference between the federal law, under which marijuana is illegal (schedule I, along with cocaine and LSD) and 20 states’ laws, which make it legal for medical or recreational use. What is less obvious is how financial institutions can apply FinCEN’s recent guidance to service this customer segment without running afoul of regulators or federal prosecutors.

There is some good news—the guidance is rather short and to the point yet clarifies the expectations on how to handle these businesses. In summary, institutions must do the following:

1. Perform enhanced due diligence (EDD) to ensure appropriate licensing and registration, including verifying with state authorities the documentation is correct and current
2. Establish a customer profile of expected business activity, including whether the business is serving medical or recreational customers
3. Monitor for suspicious activity, including red flags described in the guidance (and the institution’s own red flags beyond these)
4. Refresh CDD information, including license/registration status at least once a year or more frequently based on risk
5. File SARs as if the business is illegal (because it is illegal at the federal level), if possible using the simplified SARs for which the guidance makes provisions
6. File Currency Transaction Reports (CTRs), as these businesses are not eligible for CTR exemptions

This is a rather high-level summary, but it breaks down some basic anti-money laundering (AML) practices—CDD, transaction monitoring, and regulatory filing—and helps clarify how an institution would apply them to legal marijuana businesses.

Customer due diligence

Items one, two, and four are a part of the CDD program, so let’s start there. For many institutions, the expectations may not be much different than for other high-risk and/or regulated types of businesses.

As with many other businesses, ongoing CDD review is critical. While the guidance contemplates “refreshing information obtained as part of customer due diligence on a periodic basis and commensurate with the risk,” it is not clear what either “periodic basis” or “commensurate with the risk” really means. In most cases, “periodic basis” is taken to mean “at least annually,” but in some contexts, semiannually or quarterly is more appropriate, at least early in the customer relationship, or until normal business patterns are identified.

Similarly, “commensurate with the risk” can be a tricky topic but essentially refers to deviations from expected activity, often based on transaction monitoring or other factors, such as potential structuring, unusual or unexpected use of instruments, and unusual flow through. At first it will likely be a challenge for organizations to understand expected behavior at both the individual and sector/peer levels, which may mean more frequent reviews for only slightly atypical behavior compared to other more established industry sectors, such as money services business (MSBs). This could mean more short “spot checks” that may be valuable in the early days of the customer relationship.

Institutions would be wise to include a site visit in the due diligence process, not just to ensure the business actually exists but to have an understanding of the business’ likely volume potential. This is especially useful with a growing operation to understand what the expected output could be and more easily identify anomalies in the future.

In following post, Legalized Marijuana, Part 3: Transaction Monitoring we look at some of the other practical challenges and solutions in serving this business sector. This is the second post in a series on servicing marijuana-based businesses—find the first here.