5 minutes
Serving marijuana-related businesses requires giving careful attention to BSA and suspicious activity reporting.
Today’s hemp, marijuana and marijuana-related businesses continue to grow as once-limited markets gain favor nationwide. As more states update their laws on how these products are regulated, MRBs are being established as respectable businesses in local communities—ones that require banking services. As a result, more credit unions now find themselves in a position to serve these local businesses but are learning that successfully navigating often evolving regulatory requirements that govern the industry can still be very tricky—especially as it relates to the Bank Secrecy Act and suspicious activity reporting.
Credit unions looking to do business in this arena need to know some key things about the industry they will be serving. Marijuana, hemp and industrial hemp are considered subspecies of cannabis. Industrial hemp has been removed from the list of “Schedule 1” substances and is technically legal from a federal standpoint. However, there is still some degree of the unknown at play as hemp can only legally contain 0.3% THC (tetrahydrocannabinol, the principle psychoactive constituent of cannabis) or less. Depending on the licensing of the farm, the plants may need to be destroyed.
Credit unions entering this space should do their homework to understand the industry and the associated risks. Some things to consider when deciding to bank MRBs are: Will the credit union service hemp and marijuana, or hemp only? What will the credit union do if it later finds an existing member is involved in an industry the credit union has chosen not to service? What types of products and services will be offered? Will the credit union have the infrastructure, like adequate staffing, to handle the monitoring of these high-risk accounts? These are just some of the considerations the board must consider when determining if it is willing to accept the risk in servicing MRBs. In addition, related policies and procedures should be drafted that address which types of MRBs the credit union will do business with.
Once a decision has been made to enter the MRB space, appropriate monitoring of these members is a must. FinCEN guidance on marijuana banking provides common sense guidance and should be included in the due diligence policies and procedures for monitoring these types of high-risk members. Some of these due diligence practices include: no distribution to minors, no ties to cartels, no diversion of marijuana to states where it is illegal, etc.
Just as credit unions currently use monitoring systems to support their BSA programs, the degree of monitoring on these accounts will need to be expanded due to the increased level of risk these accounts may present. With the increased monitoring, credit unions will likely require additional personnel who are knowledgeable about the marijuana industry and BSA. All credit unions have an established “getting to know your member” process, but when it comes to a potentially higher risk member like an MRB, that process will be more intensive, including site visits for onboarding, determining source of funds, and requiring detailed, initial and ongoing financial data. Some credit unions are even requiring the entire banking relationship be within their institution, including personal banking accounts along with business accounts, just to maintain that higher level of visibility and due diligence.
Another consideration is how the credit union is going to handle such a cash-intensive business. Often these businesses are making regular, large cash deposits. Some institutions have discovered that the cash that comes in from MRBs often retains the smell of marijuana and must be separated and quarantined until the smell dissipates before it is dispersed to members. Before getting into this business, it is also important to maintain transparency with applicable service providers, such as bond insurers and armored car services, as these vendors may have their own policies and procedures related to doing business with MRBs.
Credit unions that choose hemp-only members because of the perception that the risk is lower need to know that it is just as important to perform due diligence on a hemp-only business as on any high-risk member. The due diligence should include an understanding of the industry, the services and products provided to customers, obtaining and assessing proper licenses, and THC test results. As mentioned earlier, though hemp is federally legal, if the product contains more than 0.3% THC, it is considered marijuana, which is federally illegal.
Another potential risk factor is with CBD (cannabidiol) oils. Though much of these oils are hemp-based, they can also be marijuana-based, so it is important for the credit union to understand the origin of these products. Often a primarily hemp-based business will have the infrastructure to process marijuana, so without performing due diligence, a credit union could be unknowingly working with marijuana businesses.
Given the added operational burden, why would credit unions be interested in serving this market? The short answer is growth opportunity. Currently, 33 U.S. states (plus Washington, D.C.) have legal medical marijuana markets and 12 of those states (including Washington, D.C.) have legal recreational markets. The industry is projected to grow by more than 14% over the next six years and is projected to reach more than $30 billion by 2025, assuming more states follow suit and legalize. To date, fewer than 200 credit unions are providing banking services to MRBs.
For those credit unions interested in entering this market, the “Secure and Fair Enforcement Banking Act of 2019 (H.R. 1595)” has passed from the U.S. House of Representatives to the U.S. Senate for consideration and debate.
While there is still a disconnect among federal, state and local regulations on the marijuana industry, the reality is that these products now represent a legitimate business enterprise that will need to be served. Credit unions should start considering how to respond when a long-time member business decides to diversify its business portfolio by adding an MRB and comes to the credit union to support that.
At this point, most credit unions are still on the sidelines—either due to geography or because they are waiting until there is more clarity from regulators on how to provide banking services to this burgeoning yet still controversial industry. If the past few years are any indication, this market will continue to grow quickly and exponentially, and credit unions should be proactive in assessing what their role will look like now or they may find themselves lamenting a lost opportunity in the future.
Alison J. Herrick, CPA, is a partner with Wipfli LLP, providing external and internal audit services to credit unions and banks, including evaluating lending programs, auditing compliance, conducting internal control studies, and consulting on generally accepted accounting principles. She leads the credit union internal audit practice and specializes in developing audit plans and providing credit unions with regulatory compliance audits and internal audit outsourcing and co-sourcing. Herrick regularly speaks at seminars throughout the Northeast on such topics as the Bank Secrecy Act, supervisory committee training and internal controls.
