The movement to legalize certain marijuana-related activities across nearly half the states in the nation has rapidly advanced a current stalemate between the marijuana industry and the financial services industry. Federal anti-money laundering (AML) laws prohibit financial institutions from facilitating activities that may be linked to the illicit growth, sale, and possession of marijuana,1 and as a result many financial institutions, unwilling to invite regulatory scrutiny, are refusing services to the newly legitimized marijuana industry (herein referred to as “Cannabusiness”) even in states where the business is legal.
What’s more, uncertainty stemming from the dichotomy between state and federal laws has led numerous financial institutions, particularly banks and credit card companies, across the country to shut down Cannabusiness owners’ existing accounts, often including their personal accounts. This expulsion has forced some Cannabusinesses to operate exclusively in cash and others to seek alternative methods to access the financial services industry, including disguising the source of their funds in various ways.
Banks are not unaware of Cannabusinesses’ untapped potential as customers. The Cannabusiness industry is estimated to earn nearly US$11 billion in profits by 2018, and as much as US$17.4 billion annually thereafter.2 A Cannabusiness requires start-up capital (e.g., cost of licensing fees, compliance program spend, product inventory, etc.), a basic small business banking deposit account, credit card processing services, agricultural loans, commercial space leasing, employee payroll service, etc. The estimates for illicit marijuana profits are even higher – nearly US$36 billion.3 Much of this money is already funneling through the financial system, in various ways designed to disguise its source. While banks are watching the legal Cannabusiness activities with interest and awaiting clearer guidance from regulators, they are just as keen on avoiding the risk of becoming a potential channel for the much larger illegal stream.
The challenge of complying with regulations while staying competitive and profitable is familiar to banks, and taking calculated business risks is the way financial institutions make money, but never before has sound business-risk management involved the possibility of engaging in potentially illicit activity. The newly legitimized Cannabusiness industry is facing a similar conundrum: Denied direct access to the financial system, it is forced to seek out indirect alternatives such as virtual currency, underground banking networks set up by unnamed high net-worth financiers, use of pseudonyms and fictitious business names to take advantage of newly popular “individual” card readers, and the use of personal accounts to conduct business activity. In addition, Cannabusiness customers may resort to methods of money laundering currently used to disguise illicit drug fund sources.
Challenges and Opportunities
The Department of Justice and Department of the Treasury took notice of the issues surrounding Cannabusiness’ access to the financial system after the financial services industry expressed concerns over the risk of potential non-compliance with AML laws if it were to provide services to the newly legitimized business sector. In 2013, Cannabusiness industry advocates proposed legislation to limit regulatory enforcement at the federal level and to provide certain protection to banks.4 Finally, on February 14, 2014, the Financial Crimes Enforcement Network (FinCEN) issued formal guidance aimed at clarifying the expectations for financial institutions to comply with AML laws and regulations while
providing services to Cannabusinesses. However, while a potential catalyst for steering further discussions, this guidance does not address all of the concerns of the financial services industry.
The FinCEN guidance attempts to clarify how financial institutions can provide services to Cannabusinesses within the context of regulatory expectations and requirements. The guidance addresses expectations for customer due diligence (including establishing the legitimacy of the business under state law). It also establishes requirements for the filing of Suspicious Activity Reports (SARs) aimed at distinguishing legitimized marijuana-related activities (which would require a “Marijuana Limited” SAR) from illicit marijuana-related activities (in legalized states) or activities that implicate one of the enforcement priorities established by the Justice Department in the so-called “Cole Memo.”5 (Such illicit activities in legalized states would require a “Marijuana Priority” SAR.) The guidance provides examples of “red flags” that may be indicative of one or more of the Cole Memo priorities. It also precludes providing Currency Transaction Reporting (CTR) exemptions to marijuana-related businesses.
Other than that, the guidance provides no further information on expectations from a regulatory enforcement standpoint. It does, however, indicate that financial institutions have an affirmative obligation to be able to distinguish “good” marijuana-related activities from “bad,” and to enforce the Cannabusiness industry’s compliance with states’ marijuana laws and regulations. It does not offer any additional guidance on what this means for a financial institution’s AML program and certainly provides no safe harbor even if banks comply with the FinCEN guidance.
Thus, even with the FinCEN guidance, the quandary for the financial services industry remains. The main questions are, how rigorous must an institution’s AML program be, and what enhancements to the program are required in order to accept Cannabusinesses as customers and not unduly jeopardize the institution’s reputation? The current regulatory attitude toward money laundering has been unforgiving, and the last 18 months have brought an unprecedented increase in AML enforcement actions. As a result, financial institutions – large and small – are expending considerable time and resources to remediate their AML compliance programs to meet regulatory expectations. Given these enforcement trends and the ever increasing cost of compliance, financial institutions remain reluctant to engage in any business activity that might heighten scrutiny of their AML compliance programs. It is unlikely that they will do an about-face with regard to their AML compliance until formal guidance includes a reasonable assurance they will not be penalized.
Our Point of View
It is worthwhile for banks to develop a clear understanding of both the direct and indirect risks posed by Cannabusiness, and to adapt their AML compliance programs to fit within their established risk appetite. Some argue that state legalization doesn’t impact the way financial institutions need to manage their AML programs because these programs are already designed to identify “high-risk” customers and transaction activity “linked” to the proceeds of illicit drugs. While current AML laws prohibit financial institutions from facilitating activity “linked” to illicit activity, application and enforcement of these AML laws to peripheral Cannabusiness activities have yet to be established. It remains unclear whether enforcement authorities perceive accepting marijuana money from these peripheral sources differently than from Cannabusiness customers directly. An AML program evaluation in light of those risks and the FinCEN guidance is a prudent first step for banks operating in legalized jurisdictions.
Additionally, the FinCEN’s guidance makes clear that financial institutions considering engaging with Cannabusinesses will need to update their AML programs to monitor Cannabusiness’ compliance (e.g., so they can report instances of potential non-compliance in the “Marijuana Priority” SARs). AML programs’ transaction-monitoring capabilities will need to be enhanced to help distinguish the legitimate Cannabusiness activity from the illicit.
Even institutions choosing not to accept Cannabusiness customers must ensure that their AML programs are adequately designed to mitigate against the indirect risk exposures to that particular industry.
Questions that banks should consider include, but are not limited to, the following:
- Does your institution operate in a state or states where cannabis is legal or pending legalization? If so, does it mostly operate in legalized or non-legalized states?
- Does your institution maintain customer relationships with:
- Real estate leasing companies whose tenants may include cannabis-associated businesses?
- Companies that sell or lease equipment that may be used in the production or sale of cannabis?
- Third-party payment processing (TPPP) customers that facilitate cannabis-related transactions?
- Payroll service providers organized in states that have legalized marijuana?
- Money services businesses organized in or operating in authorizing states?
- High net-worth or private clients with entrepreneurial investment histories or located in legalized jurisdictions?
- ATM manufacturers or providers with operations in these jurisdictions?
- Does your institution maintain relationships with private security firms and armored car services located in legalized jurisdictions (note that these may also be potential customer relationships)?
- Does your organization invest in start-up businesses or provide services to private equity firms, venture funds or other customers that may invest in start-up businesses?
- Are the credit cards/debit cards offered by your institution being used to purchase legalized cannabis or being otherwise used in the operation of legalized marijuana activities?
For institutions that decide to accept Cannabusiness customers, the question to address is whether the additional AML controls will support the new obligations related to Cannabusiness customers, as well as handle the increased risk of indirect (illicit) access. These institutions also must ensure that their existing AML program remains prohibitive of access (either direct or indirect) in states where marijuana continues to be criminalized. The following are examples of Cannabusiness-related actions and AML program enhancements to be considered:
- Documenting and disseminating the institution’s policy on accepting Cannabusiness customers
- Designing and implementing a process to collect due diligence information that will enable identification of Cannabusiness customers
- Designing and implementing a process for identifying “red flags” to help spot instances of illicit dispensaries attempting to gain access to the institution under the guise of a legal entity
- Validating and enhancing customer risk scoring processes to ensure Cannabusiness customers’ risk is appropriately ranked
- Establishing processes for obtaining information on the number of dispensary licenses to be granted in the state, approval requirements for applicants, and thresholds for activity at the state level (versus the individual Cannabusiness customer)
- Implementing enhanced monitoring processes to identify activity exceeding the Cannabusinesses’ permitted volumes and to distinguish illicit activity above the legalized limit
How We Help Companies Succeed
Protiviti’s Anti-Money Laundering Team understands the risks and challenges that our clients face in developing and maintaining effective anti-money laundering compliance programs, particularly when it comes to addressing emerging risks such as the growing Cannabusiness industry. With delivery capabilities across the country, our AML experts can assist financial institutions with:
- Understanding the current, evolving regulatory landscape surrounding the provision of services to the Cannabusiness industry
- Updating risk assessment methodology to incorporate the direct and indirect risks of the Cannabusiness industry
- Incorporating pertinent information requests into the customer due diligence/ enhanced due diligence processes to enable identification of Cannabusiness customers and businesses associated with the Cannabusiness industry
- Developing “red flags” and enhancing monitoring procedures to help identify illicit marijuana- related activities
- Developing and conducting training on the risks of the Cannabusiness industry for compliance and internal audit personnel