As cannabis legalization expands to 42 states and DC, financial institutions are increasingly evaluating whether to provide banking services to cannabis-related businesses (CRBs), which includes marijuana-related business (MRB) and hemp-related businesses.
While the opportunity may appear attractive due to fee income and deposit growth, CRB banking remains one of the most complex and risk intensive programs an institution can undertake.
Senior management and boards of institutions must thoroughly assess governance structures, regulatory demands, operational readiness and risk-reward analyses to drive the decision to pursue the sector. This article outlines key regulatory considerations, associated risks and risk management strategies within CRB banking services.
The Regulatory Nuances Within the CRB Sector
Financial institutions should understand distinctions within the CRB industry since regulatory expectations and guidance may differ. Cannabis-related businesses is a newer, overarching term referring to both direct and indirect activities, some of which are declared illegal on the federal level.
MRBs more narrowly focuses on federally illegal activities and carry escalated regulatory expectations and requirements pertaining to the Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) implications. There are also different tiers of MRBs in both legality and risk.
The differences between these initial definitions underscore the importance of working alongside advisors who understand the nuances of the growing sector when building your CRB banking program.
Planting the Seeds for a Solid Foundation: Governance and Board Oversight
Strong governance and active board oversight are foundational to any cannabis-related business banking program. Regulators may expect the board to approve a formal CRB banking risk assessment, in addition to a comprehensive policy or program framework.
This includes determining the institution’s risk appetite, defining permissible activities and ensuring appropriate controls are established before onboarding the first customer. Ongoing upward reporting from BSA or compliance functions is also critical, enabling the board to monitor program growth, emerging risks and any issues that arise during implementation and operation.
In addition to board oversight, some institutions engage a cannabis-related business banking expert and discuss with others who have launched programs to share best practice to build their own framework with efficiency. Although external perspectives can be helpful, consultants can be an added expense, and other institutions may be hesitant to share the rationale behind their successes.
Risk vs. Reward Considerations
Many financial institutions enter cannabis-related business banking with the expectation that fee income will justify the effort and risk. However, senior management and boards must realistically assess whether anticipated revenue will offset the significant costs associated with staffing, system enhancements, independent testing and external consulting.
Ongoing compliance obligations and regulatory scrutiny can further erode profitability. Therefore, a disciplined risk-reward analysis should be completed and approved by the board before moving forward.
Reputational Risk
Reputational risk remains a critical consideration. Boards should evaluate whether existing customers, communities or stakeholders may react negatively to the introduction of a CRB banking program. Even when programs are compliant with state law, public perception can influence customer behavior and brand reputation. Management should consider whether reputational concerns align with the institution’s strategic objectives and values.
Industry Talent Acquisition, Retention and Development
Attracting and retaining industry talent is a persistent issue facing the broader financial institutions industry, one the CRB banking sector is certainly not immune to either. In addition to formalizing the program, boards and management must assess whether there is sufficient staffing to account for the increase in activities across BSA, compliance and branch operations functions, such as:
- Onboarding and approval processes for new CRBs
- Large cash deposit intakes
- Increased currency transaction report (CTR) filing
- Increased initial and continuous suspicious activity report (SAR) filings due to MRB filing requirements
- Transaction monitoring and alert review may require special tuning and alert parameters changes depending on the customer type
- Enhanced due diligence monitoring and periodic reviews
- Determining frequency and MRB-specific due diligence criteria, including transaction activity and volume, registration and Secretary of State filings and negative news
- Annual account performance metrics
Regulators expect personnel overseeing these programs to be properly trained and industry certified, knowledgeable in state licensing requirements and capable of identifying cannabis sector-specific red flags.
Depending on program size, some institutions designate a specialized cannabis-related business banking team to build expertise and verify consistency in operations. Board-level training may also be necessary to ensure directors fully understand the risks associated with the program.
Growing With Guardrails: Regulatory Demands and Supervisory Scrutiny
The cannabis-related business banking sector operates within a heightened regulatory environment. Regulators consistently emphasize that an institution’s BSA and AML program has proven to be strong and free of material deficiencies before launching a CRB banking program.
Institutions with unresolved issues from recent exams, audits or internal testing may invite increased scrutiny by adding a CRB banking program. Banks should also expect more intensive examination and testing once a program is in place, and they are encouraged to communicate proactively with regulators both prior to development and throughout the life of the program. Additionally, management must understand and comply with varying state requirements, including licensing hurdles, as cannabis-related business banking programs may differ significantly across jurisdictions.
Curating Sustainable Operations From Inception
With a complex regulatory landscape at play, success in the CRB banking sector hinges on an institution’s commitment to building and maintaining robust, scalable operations. Institutions must carefully design their onboarding, fee structuring and cash management processes to ensure long-term compliance and, of course, profitability.
Customer Onboarding, Documentation and Systems
Cannabis-related business banking requires enhanced onboarding processes and documentation standards. Institutions must develop detailed applications, disclosures, agreements and fee schedules, typically in coordination with legal counsel.
Customer due diligence (CDD) requirements are more extensive for CRBs and often supported by specialized onboarding and record retention systems to streamline documentation and facilitate ongoing monitoring. Initial CDD, which may vary depending on the type of CRB, may include collection of state license documentation, review of standard operating procedures, financial information and a site visit.
Any exceptions to standard onboarding requirements — such as for newly formed businesses lacking complete documentation — should be clearly documented in policy and procedures.
Fee Schedules and Structuring
Well-designed fee schedules of a sustainable CRB banking program help mitigate the elevated costs associated with initial onboarding, ongoing due diligence and transaction monitoring to ensure compliance with regulatory requirements and expectations. Fee structures should reflect:
- One-time application fees
- Regular monthly or quarterly account fees to support resources dedicated to continuous monitoring, reporting and regulatory engagement
- Volume or activity-based fees, such as cash handling, deposit verification or transaction monitoring fees to align with risk profiles and usage patterns
Senior management should determine whether initial application fees may be refundable in the event an application is denied or waived if requested by the customer. Overall, these should be structured with emphasis on transparency, consistency, compliance and board approval. Regular assessment is encouraged to ensure the program is experiencing continued profitability, meeting regulatory demands and accounting for changes in staffing needs.
Cash Management and Branch Operations
Cash intensive activity is inherent in cannabis-related business banking, particularly for dispensary customers. Financial institutions must determine how large cash deposits will be handled and whether daily cash limits will be imposed for in-branch deposits.
Some institutions designate specific branches or branch personnel for cannabis-related cash activity and implement additional physical security measures to protect employees and customers. These operational decisions should be carefully documented and aligned with the institution’s risk tolerance.
Transaction Monitoring and Enhanced Due Diligence
Transaction monitoring presents one of the most operationally challenging aspects of cannabis-related business banking. CRB and MRB activity often triggers higher alert volumes, increased SAR filings and the need for cannabis-specific monitoring parameters. Institutions must determine whether existing AML models are sufficient or whether a cannabis-specific model is required.
If a specialized model is used, regulators expect independent model validation, leading to additional cost. Enhanced due diligence, including periodic reviews of transaction activity, licensing status, registration filings and negative news, must be performed at a frequency commensurate with the risk.
Product Offerings and Transaction Restrictions
Most cannabis-related business banking programs initially focus on deposit-only products. Institutions should clearly define permissible account offerings, use cannabis-specific product or account codes for tracking, in addition to preestablished transparent fee structures.
Boards and senior management must also determine whether certain transactions will be restricted, such as outgoing wires, internal transfers between related entities or lending relationships. In particular, lending introduces heightened risk, as loans cannot be easily exited if a customer must be offboarded.
Pruning Operations for Longevity: Offboarding, Independent Testing and Ongoing Training
A clear offboarding and termination process is essential. Policies should define the circumstances under which a CRB account or relationship may be terminated, who can recommend terminating a cannabis relationship and who has approval authority.
Financial institutions may opt to engage an independent internal audit team to conduct a separate CRB banking audit to review the adequacy of the program’s policies and procedures, onboarding process and transaction monitoring system. An independent review may identify gaps and potential resolutions, and maybe more importantly, demonstrate commitment to compliance with regulators. Institutions should engage an audit team with sufficient experience in cannabis banking to ensure effectiveness.
Ongoing training for staff, including onboarding procedures, red flag identification and regulatory developments, is necessary to sustain program effectiveness over time. Staff assigned to oversee and monitor a CRB banking program should attend ongoing external training to ensure ongoing awareness of regulatory updates and expectations as well as industry trends.
Let Us Guide You Forward
The decision to launch a cannabis-related business banking program demands careful consideration by senior management, a disciplined governance framework and robust risk management approach.
Cherry Bekaert’s Financial Institutions and Risk Advisory practices leverage industry knowledge to collaborate with institutions looking to offer services to CRBs to educate them on the full risk profile.
If you have already enacted a cannabis-related business banking program, we can help you continue to meet evolving examiner demands in a heightened regulatory environment. From risk assessment and policy development to ongoing transaction and monitoring programs, our team has specialized knowledge to help your organization navigate the heightened regulatory expectations of CRB banking. Connect with an advisor today to learn more about our services.
Related Insights
