Compliance and the Cannabis Conundrum

By Robert Rowe

By now, every banker knows that the Controlled Substances Act of 1970 makes it illegal to possess or distribute marijuana. When Congress adopted the law, they determined that, “the illegal importation, manufacture, distribution, and possession and improper use of controlled substances have a substantial and detrimental effect on the health and general welfare of the American people.” To protect the public, the statute imposed a series of restrictions in the form of five different levels or schedules, starting with Schedule I. Drugs classified on Schedule I are substances which have been determined to be the most dangerous or those with a high potential for abuse but which lack accepted medical use. “Marihuana,” as it’s spelled in the statute, is listed between LSD and mescaline on Schedule I.

Subscribe to ABA Bank Compliance
This is the cover story from the September/October 2018 issue of ABA Bank Compliance. To read the full issue and receive future issues, subscribe today.
Despite the federal prohibition, states began to take a different approach to marijuana and now nine states permit marijuana use by adults. Unfortunately, as any law student can tell you, the different approaches between the federal government and the various states sets up a classic conflict of laws. And even more unfortunate, bankers are caught in the middle.

An attempted balancing act

One by one, states have adopted laws that permit the use of marijuana for medical purposes, particularly to control seizures, ease glaucoma, and combat the loss of appetite caused by chemotherapy or AIDS. As more states allowed medical use, the conflict between state and federal laws increased. As you can imagine, federal prosecutors were reluctant to prosecute someone suffering from a terminal disease or other serious medical conditions, but they also felt obligated to uphold federal law. To help federal prosecutors, the Department of Justice issued a series of memos starting in 2009.

Overall, the DOJ issued four different sets of guidelines between 2009 and 2014. Collectively, the guidelines are often referred to as the Cole Memo, named for the author of the last three, Deputy Attorney General James Cole. The guidelines reflect two common themes. First, the goal is to help federal prosecutors balance the availability of limited resources against the need to investigate and prosecute activities the federal government has criminalized. To make those decisions, the memos put forth a series of factors for federal prosecutors to consider. The other common theme running throughout the DOJ memos is that, “Congress has determined that marijuana is a dangerous drug and that the illegal distribution and sale of marijuana is a serious crime that provides a significant source of revenue to large-scale criminal enterprises, gangs and cartels.” Ultimately, the decision rested with individual federal prosecutors.

In 2011, due to the significant increase in commercial cultivation caused by the demand for medical marijuana, then-Deputy Attorney General Cole updated the 2009 guidance. Again reminding federal prosecutors about the need to make wise use of limited resources in exercising prosecutorial discretion, Cole stressed that the notion of compassionate use by patients and their caregivers was not designed as a shield to large commercial enterprises.

It wasn’t long after the first Cole memo that Colorado and Washington states both passed ballot initiatives that permitted the use of marijuana for other than purely medical needs, further changing the state-federal dynamic. Once again, the DOJ responded. In late August 2013, the deputy attorney general updated the guidelines, but again made it clear that, “marijuana remains an illegal drug under the Controlled Substances Act and that federal prosecutors will continue to aggressively enforce this statute.” To help federal prosecutors, the memo identified eight specific priorities that should serve as the basis to take action while also stressing that states needed to adopt strict regulatory schemes to address these eight priorities. The priorities identified by the DOJ at that time were:

  1. Preventing distribution to minors
  2. Keeping proceeds out of the hands of gangs and cartels
  3. Stopping marijuana from crossing state lines
  4. Not letting marijuana be used as a cover for other illegal activities
  5. Preventing violence and the use of firearms in cultivation and distribution of marijuana
  6. Preventing drugged driving and other adverse health consequences
  7. Not allowing marijuana to be grown on public lands
  8. Preventing possession or use on public property

The DOJ also added something new with the 2013 guidance, in part prompted by the growth in the number of states that had legalized marijuana use at the state level. The DOJ placed a new emphasis on the importance that state and local governments implement strong and effective regulatory and enforcement systems to address possible threats to public safety, public health, and other law enforcement interests associated with marijuana activity. Once again, though, federal prosecutors were reminded to exercise appropriate discretion on a case-by-case basis, considering all available evidence, including whether local activities complied with state law, when deciding whether to act.

By this point, banks were increasingly being caught in the middle between the conflict of state and federal laws. Producers and dispensaries, like any other business, wanted to have bank accounts for their operations, but opening these accounts would violate the federal prohibition. And, all banks are subject to federal mandates, through deposit insurance and through access to the federal payment system. As more states adopted laws that permitted the possession and use of marijuana, more banks were faced with the conflict. As the DOJ acknowledged, the cultivation and growth of marijuana plants and the expansion of dispensaries and retailers were creating new challenges. And, state officials were becoming increasingly concerned about the fact that many of these businesses operated on an all-cash basis since banks could not serve these businesses without running afoul of federal law.

As a brief aside, there have been attempts to create closed loop systems or special state banks to serve the needs of marijuana businesses. The problem that these schemes face, though, is that there will come a point when any of closed systems need to tap into the federal payment system for access to the mainstream economy. Federal law still prevents any way to bridge that gap.

Meanwhile, lack of access to bank accounts creates two critical problems for the states that continue to be a serious problem. First, by operating on an all-cash basis, marijuana businesses become attractive targets for armed robbers, creating a risk to public safety. Second, and equally important, states dislike and, in some cases ban, the use of large cash sums to pay state taxes and licensing fees. Operating strictly in cash also means that typical bank records that document transactions for audit purposes no longer exist, making it simpler to divert funds to improper use.

In all this time, banks were struggling with no guidance, particularly respecting how to handle reporting of suspicious activity for transactions legal under state law but illegal under federal law. And so, in early 2014, the Departments of Justice and Treasury issued new guidance, in part to help the banking industry. The two memos were issued on February 14 as a sort of Valentine’s Day gift. The updated DOJ guidance re-iterated many of the points made the previous August, again stressing the eight priorities, the illegality of marijuana at the federal level, and the need for federal prosecutors to exercise appropriate discretion. However, for the first time the DOJ acknowledged that violation of the Controlled Substances Act had implications for money laundering and the Bank Secrecy Act and that, “financial institutions that conduct transactions with money generated by marijuana-related conduct could face criminal liability under the BSA for, among other things, failing to identify or report financial transactions that involved the proceeds of marijuana-related violations of the [Controlled Substances Act].” This laid the foundation for the companion guidance from the Department of Treasury through the Financial Crimes Enforcement Network.

The FinCEN guidance

The FinCEN guidance was published to reconcile compliance expectations under the BSA with the federal-state law conflict on marijuana. The guidance is intended to clarify “how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations, and aligns the information provided by financial institutions in BSA reports with federal and state law enforcement priorities.” It does not create a safe harbor nor does it attempt to legalize an otherwise illegal activity.

Just as the DOJ guidelines consistently stressed, the FinCEN guidance clearly states that the Controlled Substances Act “makes it illegal under federal law to manufacture, distribute, or dispense marijuana.” Although the DOJ has since rescinded its guidelines that served as the foundation for the FinCEN guidance, the FinCEN guidance is still in effect and the steps that banks should take still apply. And so, what does the FinCEN guidance do? While stressing that banks should consider the same eight priorities that federal prosecutors should take into account when determining whether an activity was acceptable, FinCEN emphasized a key point: it is up to each individual bank whether to bank any customer but customer due diligence is a “critical aspect” when deciding whether to maintain a banking relationship.

One of the first challenges with the FinCEN guidance is that it addresses “marijuana-related businesses” but does not define what those businesses are. The general consensus seems to be that it applies to those businesses that deal directly with the plant in some way, such as growing or retailing. However, it’s a challenge that continues to haunt banks and there have been discussions and requests for Congress to address this issue.

To assess the risk associated with a marijuana-related business, the guidance recommends bankers take a number of steps, such as verifying whether the business is properly licensed, reviewing the license application, obtaining any available information about the business from appropriate state authorities, and developing an understanding about the normal day-to-day activity of the business including products sold and customers served. The bank also should be prepared to monitor the company for possible negative news or possible suspicious activity and should have in place systems and procedures to keep all information on the company up-to-date. A key part of that process is ensuring that none of the eight DOJ priorities are negatively implicated by what the company is doing. Overall, though, the risk associated with these businesses means they require enhanced due diligence and the close scrutiny by banks that goes along with hit.

Once the bank has implemented the diligence that is due, it then has to comply with its BSA reporting obligations. Assuming the bank decides to bank the business, it will have to file a Suspicious Activity Report because, no matter what state law says, there is a violation of federal law. Recognizing that federal prosecutors were balancing the conflict of state and federal law, the FinCEN guidance created a new three-tier SAR filing system for marijuana-related businesses. While the authority for this reporting isn’t entirely clear, it’s designed to balance the need for reporting against the needs of law enforcement.

The first type of SAR is a “marijuana limited SAR.” A bank files a marijuana limited SAR to report the transactions and activity of the business but reaffirms that the activity is consistent with state law and does not violate any of the eight DOJ priorities, such as sales to minors. However, this expectation reverses the normal approach to suspicious activity and imposes a new level of obligation on banks. For example, when a bank has a customer that is a tavern or restaurant which serves alcohol, the bank is not expected to determine whether the business is serving minors. Clearly, state laws prohibit serving alcohol to minors, but the bank can rely on state liquor control authorities to ensure those standards are followed. When it comes to marijuana-related businesses, though, the FinCEN guidance implies that it is the bank that is responsible for ensuring marijuana is not distributed to minors, a subtle but highly critical distinction that places a new level of burden on banks. And that’s just one of the eight priorities. And then assuming the bank does open an account for a marijuana-related business and does file an initial marijuana limited SAR to alert FinCEN and law enforcement that it is serving the business, the bank will have to continue to report as long as the account stays open because each transaction is possible money laundering.

The second type of SAR that FinCEN created for the marijuana industry is the “marijuana priority SAR.” If the bank decides that one of the DOJ priorities has been violated, or that the business is not in full compliance with state law requirements, then it files a SAR that identifies the wrongful activity.

Finally, there is the “marijuana termination SAR.” Even though the business may be operating in compliance with state law and satisfying all eight priorities set forth by the Department of Justice, a bank might not feel comfortable maintaining a relationship with the business. Or, as FinCEN puts it in the guidance, the bank might decide to terminate a relationship “in order to maintain an effective anti-money laundering program.” (This might be the only situation where FinCEN acknowledges derisking as acceptable for managing AML risk.) If the bank does end its relationships with the business, then it reports that to FInCEN using the marijuana termination SAR. If the bank knows that the company has moved to another bank, FinCEN also encourages the bank to take advantage of the 314(b) information sharing process to notify the successor bank that it terminated its relationship with the business.

With the 2014 guidance, FinCEN included a number of red flags for banks to consider when conducting due diligence on a marijuana-related business. None of the red flags are conclusive of illegal activity but each one merits further evaluation. Among the red flags FinCEN identifies: activity or revenue inconsistent with the business or its competitors, excessive cash deposits or withdrawals, structuring, rapid movement of funds, deposits by third parties unrelated to the business, excessive commingling of funds with other accounts of the owners, or a sudden surge in activity.

The FinCEN guidance raises two key questions. If, as the consensus seems to believe, that the guidance applies to businesses that deal directly with the plant, then what of the landlords, suppliers and employees of these businesses? This second tier of businesses and individuals are deriving a substantial portion of their income from activity that is still illegal at the federal level, meaning that their funds are tainted. The FinCEN guidance doesn’t explain how to file a SAR on this activity. What should a bank do?

The second, and more important question raised by the FINCEN guidance is what it means for federal bank supervisors. When an examiner evaluates the safety and soundness of a bank, it considers whether the bank is operating in accordance with laws and regulations. Despite state law, if a bank is allowing customers to launder money through its accounts, does that call into question its safety-and-soundness? The federal banking regulators have said nothing about the challenges banks face when it comes to banking marijuana-related businesses. Informally, when bankers raise the question during meetings with representatives of state delegations, the banking regulators indicate that the FinCEN guidance is the “gold standard” for compliance in this area. And so, for the time being, the FinCEN guidance is all banks have to follow.

The definitional challenge

As pointed out, the question that faces every bank is how to identify whether or not a business is a marijuana-related business. FinCEN didn’t provide an answer and neither have the federal banking agencies. Is it, as the consensus suggests, only those businesses that deal directly with the plant? Or does it include their employees? Their landlords? Their vendors or suppliers? One approach might be to consider the income stream of the business and whether a certain percentage of its income is derived from marijuana processing or production.

However, resolving this problem is important. For example, one banker suggested that a bank that operates in a state that has legalized marijuana for both medicinal and adult use could have up to 90 percent of its customers affected by this one-step removed calculation. And, even if a bank operates in one of the states that has not legalized marijuana in any form, the chances that it has customers that are suppliers to a marijuana business operating in another state, or that it has a customer that is deriving his or her income from a state-legal marijuana enterprise continues to grow. To further compound the problem, companies that derive their primary income from marijuana businesses are starting to trade on the United States securities exchanges. What does a bank do if its customer is an active investor who also happens to invest in one of these securities?

Recently, the Small Business Administration did tackle the definitional issue. Under SBA standard operating procedures, any activity that is illegal under federal, state, or local law is ineligible for SBA financial assistance. Even though this guidance is limited to eligibility for SBA assistance, it should be taken into consideration. The SBA has made the determination that marijuana-related businesses not only include those that deal directly with the plant, but also include hemp products and any indirect business, including those that derive any revenue from a business that deals directly with the plant. The SBA includes vendors such as those that provide testing services, grow lights and hydroponic equipment. The SBA takes a very broad interpretation that goes far beyond direct relationship to the plant. The unknown question is whether this application will become more widespread.

The attorney general drops a bombshell—or does he?

Shortly after recreational or adult use became legal in California, the attorney general of the United States took steps that altered the landscape. And his action got a lot of attention in the press. What, then, did the attorney general do?

First, Attorney General Jeff Sessions rescinded all the prior guidance that had been issued to help federal prosecutors determine when and if to investigate or prosecute a case involving state-legal marijuana, including the eight priorities. While the DOJ press release emphasizes the “return to the rule of law,” it still emphasizes the discretion that individual prosecutors have when determining how to apply the Department’s finite resources. What is interesting, though, is that since prosecutors exercise their own discretion in making the determination whether to proceed, the prior guidance was deemed “unnecessary.” And so, federal prosecutors continue to exercise discretion as they always have, only without the guidelines that were in place to help them make those decisions.

Clearly, the attorney general changed the tone. Does this mean more federal prosecutors will start enforcing the Controlled Substances Act, state law notwithstanding? Many federal prosecutors report they have their hands full handling the opioid crisis which has been given a high priority with the DOJ. The real question is whether the change in guidance from the DOJ will impact what’s happening at the state level. And, do individual federal prosecutors want to get into conflicts with the states? Only time will tell.

This raises another question that banks often ask about marijuana and banking. When a bank processes transactions for a customer where the proceeds come from marijuana, the bank technically is laundering money. Bankers often ask whether there are examples of cases when a bank has been prosecuted. While the answer appears to be no, the real question banks should be whether the bank is willing to be the first test case.

Pending legislation in Congress

Over the years, different representatives in Congress, generally from states where marijuana has been legalized, have introduced a variety of bills to address the challenges that banks face. One, which has actually been adopted and renewed, prohibits the DOJ from using its funding to interfere with state-legal medical marijuana activity.

The draft bills take different approaches to help banks offer services to businesses involved with marijuana. However, there is a growing recognition on Capitol Hill that a solution is needed. Banks can’t solve the problem and neither can any regulatory agency. Unless every state rescinds all the state laws that permit possession and distribution of marijuana, a prospect that is extremely unlikely, it will take an act of Congress to resolve the conflict. And until Congress acts, banks will continue to be caught in the middle between state laws that permit marijuana use and federal law that bans it.

Where that leaves bankers

According to FinCEN, by the end of the third quarter 2017, it had received nearly 40,000 SARs reporting activity associated with a marijuana-related business. The great majority of those were marijuana limited SARs, indicating that the industry continues to offer some level of services to the cannabis industry. No one knows, though, how extensive those offerings are or what kinds of banking relationships do exist. Anecdotal reporting suggests it is very limited.

Banks confront a serious risk when they bank a marijuana business. Granted, banks are in the business of assessing, controlling, and mitigating risks, however, to control risks, banks have to be able to understand and identify them. Currently, that’s extremely difficult when it comes to the cannabis industry. But if a bank offers products and services to a marijuana-related business, it must take careful steps to address each and every one of those risks. Because the risks are high, it requires enhanced due diligence to understand the business and closely monitor its activities. And, it requires careful attention to a very fluid situation.

Until Congress changes federal law, possession and distribution of marijuana is illegal. When banks process transactions associated with the business, they are laundering the proceeds of an illegal activity. Will they be prosecuted for it? That’s the great unknown. Drivers don’t always obey the speed limit and they don’t always get caught…but there’s always that first time.

Finally, consider this: for many years, state lotteries were frowned upon and only one state, New Hampshire, had a state lottery. One-by-one, states began to offer lotteries as they discovered the tremendous source of revenue that lottery programs had to offer. Despite the objections of critics who saw gambling as the first step on the road to moral degradation, income from lotteries and the use of those funds to support beneficial programs (such as school funding, environmental assistance programs or crime control) won out. Now, states that have legalized marijuana are earning substantial revenue from licensing and taxing marijuana businesses. At a time when states are strapped for cash, that income can be extremely attractive. The income stream coupled with changing attitudes among the general population means that a change in federal law is nearing a tipping point. For the banking industry caught between state and federal law, a change can’t come soon enough.

About Rob Rowe

Rob Rowe
Rob Rowe is vice president and associate chief counsel for regulatory compliance at ABA.
More from Rob Rowe >