Cannabis Banking Risk Assessment Tips from the 10-D Hotbox

Something is definitely in the air with the SAFE Banking Act being passed by the House and on its way to the Senate; but before you hit your Board up to have a discussion on cannabis banking, you’ll want to complete a Cannabis Banking Risk Assessment. The risk assessment should give the Board a blunt view of the risks to assist in determining whether cannabis banking goes on the back burner or ignites a spark at your financial institution.

The risk assessment should be inclusive of marijuana, hemp and CBD products and services. The assessment should identify inherent risk and mitigating controls to determine the residual risks as well as the direction of the risk. Make sure all the right people are at the table for this process to ensure all details are covered, gaps are identified, and action items are documented. This should not be a high- level exercise.

Below are brief descriptions of some of the risk components to consider. An acronym hint to keep in mind is that while all MRBs (marijuana related business) are CRB (cannabis related business), not all CRBs are MRBs:

Legalization

• Federal Legal Risk – Marijuana remains a Schedule I substance and federally illegal; however, in states where marijuana is legal, enforcement actions and regulator criticism of banking CRBs has only been focused on institutions that don’t have a sound infrastructure with appropriate controls to manage the associated risks of cannabis banking.
• The 2018 Farm Bill legalized industrial hemp. CBD is a derivative of hemp and is regulated by the FDA. It’s not illegal to provide banking services to Hemp or CBD businesses when THC levels are below 0.3%. Other regulatory guidance controls include:
• February 2014 FinCEN memo addressing – expectations regarding marijuana related businesses
• The Cole Memo
• 2021 Appropriations Bill with cannabis protections
• SAFE Banking Act
• The More Act
• 2018 Farm Bill
• The USDA Hemp Final Rule
• FDA - Review FDA marketing of cannabis related products
• State Legal Risk – Consider legality of cannabis products within your state. Discuss your program or plan to bank CRBs with your state examiner.

Market/Financial Opportunities

• Banking CRBs Nationwide – FinCEN data indicates that the majority of nationwide financial institutions are not offering financial services to CRBs, however, the number of marijuana related SARs has been steadily increasing along with the number of states that have legalized marijuana. Do your research, consider the propensity for enforcement actions.
• Banking CRBs in Market – There is no known centralized database of financial institutions that are servicing the cannabis industry. Utilize industry contacts and associates in your area to assist in identifying financial institutions who may be serving the cannabis industry.
• Competition – Is your market saturated with banks offering services to this industry or would banking this industry give you a competitive edge? Will you offer deposits and loans to MRBs?
• Revenue Potential – Analyze the potential revenue but also consider if other revenue could be lost. Will you be able to maintain these customers if the SAFE Banking Act is passed?
• Liquidity Potential – How would these deposits effect your loan to deposit ratios? What would the effect be if the bank had to exit this line of business?

Defining Customer Types

• Direct MRB Businesses directly related to seed-to-sale activities such as; cultivators, processors and dispensaries. Aside from the initial and ongoing due diligence, consider the operational issues such as the kush, ooops, I mean cash. Consider operational processes related to dealing not only with legacy cash, but the security, storage and safety issues involved with the increased volume of cash.
• Indirect MRB – This group does not generally touch cannabis but their focus is to provide services products and services to the cannabis industry (e.g. Security firms, suppliers, advertisers, landlords, professional service providers, etc).
• Legal Hemp – A business or farm investing in, cultivating, processing or distributing hemp products that contain less than 0.3% THC, assuming they are in compliance with all criteria established by the state’s legal hemp program. These businesses are not considered MRBs.
• Hemp Derived Substances – CBD, Delta-8, etc.

Suitability

• Regulatory Health – Best practices indicate the financial institution should have a “2” or better component and composite rating. What is your institution’s history on remediating audit findings?
• Enforcement Action Activity Is your financial institution under an enforcement action or is there any type of enforcement action pending? What is the enforcement action environment in the industry?
• BSA/AML Audit Results Consider the results of your last exam, how many medium or high-risk findings were identified?
• Capital Levels – Consider the regulatory definition of healthy capital levels for your bank.
• Strategic Initiatives – Are there other strategic initiatives planned that would have competing resources?
• Board Buy-In – Has your board been educated on the risks? Are they ready to jump in or would they prefer to avoid banking the cannabis industry?
• Expertise and Staffing Does your institution currently employ enough staff with the appropriate skill level to manage and oversee the level of cannabis banking services your institution is planning to offer? This impacts not just compliance staff but account opening, operations, and lending staff as well.
• Technology – Is current technology sufficient to monitor cannabis banking activity? Is your institution willing to invest in newer, more specialized technology to administer the cannabis banking program?
• Program Components Does your institution have a well-established program and risk assessment process? What process changes will need to be implemented and what changes may be necessary to the frequency and content of board reporting?
• Suspicious Activity and Currency Transaction Reporting – Are you prepared to handle the increased volume of regulatory filings?
• MRB Non-Compliance – This inherent risk will be high. How will you monitor for non-compliance? Are there processes in place to escalate non-compliance issues that include both filing Marijuana Priority/Marijuana Termination SARs and reporting such to the board.
• Reputation – What is the acceptance level of cannabis in your area for the general public? What about shareholders or other well-established clients?

Training

• Board Level – Has the board been sufficiently trained to make an informed decision on whether to enter this line of business?
• BSA/AML and Compliance Officers – Have they received the appropriate amount of CRB specific training to ensure compliance requirements are consistently met?
• Other Staff Training – Have all necessary staff been thoroughly trained on processes to identify businesses engaged in CRB activity? How often is training performed? Has curriculum been updated?

Audit

• BSA/AML Audit Expertise – Does your bank have the appropriate level of internal audit expertise to audit your CRB Program or do you need to seek external CRB specific audit experience.
• BSA/AML Audit Scope – Does the current scope of the BSA/AML audit include an assessment of your CRB Program? If not, it will likely be more costly to expand the scope accordingly.
• Frequency of Audit – Will the frequency of the BSA/AML audit need to be adjusted if banking CRBs?
• Response to Audit Findings – Will banking CRBs require changes to how the institution deals with remediation of audit findings?

This is a very long list of items to consider when completing your Cannabis Banking Risk Assessment. There are resources available to assist you in completing your cannabis risk assessment, such as the Sterling Compliance Risk Assessment from CBANC, which was used as a reference guide in writing parts of this blog. Your examiner will expect this to be a detailed document that the board can use as a tool to determine at what level your institution wants to engage in this line of business. If the Board decides to move ahead with this new line of business, the risk assessment should also play a primary role in developing your Cannabis Banking Program.

Authored By: Melanie Fletcher CRCM, CAMS, CCBIA, CCBP, AAP

  Download Blog