Capitalizing on Risks & Returns: Risk Management Considerations for Cannabis Banking

Contributors: Mike Dempsey, Senior Manager, Risk & Accounting Advisory Services, Financial Services Risk Advisory Leader
Alex Cacanando, Senior Manager, Risk & Accounting Advisory Services

Rapid growth in the cannabis industry over the last few years has increased the risk-reward equation for banks and their cannabis banking products and services, which necessitates the need for a structured and disciplined enterprise-wide risk management approach for both the bank and the marijuana-related business (“MRB”). Cannabis banking is subject to heightened scrutiny around Anti-Money Laundering (“AML”) and Bank Secrecy Act (“BSA”) compliance as well as significant reputational risks given the legal ambiguity between federal and state laws. Collaboration is essential to understand the risk profile of an MRB business to identify opportunities to generate value.

Cannabis businesses can violate local and state regulations or get denied by investors because of a lack of sufficient controls around business-critical processes. In addition, the high volume of cash transactions makes them vulnerable to physical theft and fraud issues.

The pending passage of the Secure and Fair Enforcement (“SAFE”) Banking Act will help reduce this risk exposure, allowing financial institutions to work with cannabis companies and protect financial institutions from liability and federal prosecution arising from servicing cannabis-related businesses authorized under state law.

Developing a Strategic Business Plan to Identify Growth Opportunities and Mitigate Potential Risk Exposures

Banks who engage in cannabis banking as well as cannabis related businesses should ensure they have a clear and concise strategic business plan for growing their market share in a controlled manner considering key risks including:

• Legal and compliance risks (e.g., BSA / AML, Financial Crimes Enforcement Network due diligence violations, Federal and local violations)
• Geopolitical risk
• Operational risk (e.g., monitoring and oversight)
• Financial risk (e.g., concentration risk – value of fee income and deposits)
• Liquidity risk
• Reputational risk
• Fraud and cybersecurity risks

The strategic business plan should be linked to the bank’s risk appetite and communicated to internal and external stakeholders inclusive of customer-facing personnel. When a bank decides to offer banking services to cannabis businesses, the Board and executives should establish a method to determine which indirectly related businesses are MRBs and prepare for revisions to the method if regulators provide further guidance (e.g., FFIEC). Bank Boards should also determine whether their internal resources have the competence and expertise to develop and implement effective due diligence and other compliance-oversight functions.  An exit strategy should also be considered when terminating relationships from a Service-Level Agreement and legal perspective.

Keys to Limiting and Mitigating Reputational Damage, Risk Exposures, or Regulatory Issues:

1. Understanding Legal, Regulatory, and Reputational Risks: Banks need to be focused on reputational and legal risks with AML and “know your customer” requirements associated with the cannabis industry, specifically tracking the source and origin of funds. Support services provided by third parties to cannabis entities may also put banks at risks faced with closing existing accounts because of their connection to cannabis. Many MRB’s conduct cash-only transactions making them a big target for criminals. In setting up an MRB as a counterparty / client, a bank should develop an expected activity for the MRB, including type of products, expected volumes of sales of the products and type of customers to which products are sold.
2. Contingency Planning: Banks and MRB’s also incur a high degree of financial and liquidity risk if a client account closes prematurely so there is a need for careful contingency planning considerations to potentially replace deposits and collateral needs. Contingency funding plans should include the scenario of losing a large depositor and a strategy can be to place a maximum size and limit on the deposit account and maintain at least 90% of the deposit balance in-cash-on-hand allowing the relationship to be terminated instantly without exposure to liquidity risk.
3. Proper Training and Documentation is Important for Preparedness: Culture is paramount from a top-down perspective so there is a need for training on state, local, and Federal laws; and guidance addressing insurance coverage and possible exclusions for products; criminal, illegal or intentional acts; cannabis and controlled substance exclusions; health hazard exclusions; etc.
4. Oversight and Reporting is Critical: Monitoring and reporting should include key risk indicators and key performance indicators for Board and management to measure and monitor deposit concentration limits and thresholds in-line with risk appetite and provide incentive to reach goals. The Board must play a role in approving deposit concentration limits and industry type limits to demonstrate effective oversight.
5. Robust Policies, Procedures, and Controls are Key to Mitigating Risk: Leveraging effective governance processes for vetting cannabis related products or services amongst business owners and support functions impacting stakeholders can help determine if these high-risk activities fit well with your overall business plan, strategy, and risk appetite. If you use a third party to manage due diligence and risk assessment processes for an MRB, it is critical to understand you own the risks, so oversight and monitoring activities are key compensating controls to mitigate these risks. Significant due diligence should be done on each business, ultimate business owner, key personnel, and third-party vendors to prevent these products and services from being used for criminal and illegal activities. Tailoring and customizing policies and procedures to address cannabis related business matters (such as underwriting requirements, collateral considerations, customer due diligence and suspicious activity monitoring) is also necessary along with providing training to employees who will serve customers in the cannabis industry.

To learn more about safeguarding your bank’s risk exposure with proper due diligence, governance, and risk considerations within the cannabis industry, contact Mike Dempsey or Alex Cacanando, leaders in our Risk Advisory practice or speak to your Cherry Bekaert advisor.