In April 2016, Governor Tom Wolf signed legislation that legalized certain medical marijuana-related activity. However, marijuana remains a Schedule I drug under the federal Controlled Substances Act (CSA)[1].  Therefore, Pennsylvania financial institutions have requested guidance to clarify regulatory expectations for financial institutions, specifically with respect to Bank Secrecy Act (BSA) obligations, related to customers engaged with state-legalized marijuana activities.

Guidance

The CSA makes it illegal under federal law to manufacture, distribute, or dispense marijuana. On February 14, 2014, the Financial Crimes Enforcement Network (FinCEN) released FIN-2014-G001: BSA Expectations Regarding Marijuana-Related Businesses (Guidance) providing direction on how financial institutions can interact with marijuana-related businesses. The Guidance assists financial institutions in meeting BSA obligations when providing financial services to marijuana-related businesses that are operating in accordance with state laws and regulations.

Marijuana-Related Businesses and Due Diligence

Marijuana-related businesses are divided into two categories: directly related and indirectly related. Directly related businesses include growers, processors and providers/dispensaries. Indirectly related businesses and ancillary businesses provide goods or services to growers/providers (e.g., a commercial landlord that leases property to marijuana-related businesses or a business that sells supplies to a provider). Financial institutions must act in accordance with this Guidance and existing FinCEN suspicious activity reporting (SAR) requirements and thresholds on activity involving marijuana-related businesses.

A comprehensive risk assessment and enhanced customer due diligence are critical aspects of making a decision to open, close, or refuse any particular account or relationship. Key elements of the due diligence process for marijuana-related businesses include verifying they are dealing with entities who are legally authorized to engage in the activity and developing an understanding of the expected scope of activity for the customer, including expected cash flow and related business. For direct marijuana-related businesses, financial institutions should verify the license authorizing the entity as a grower/provider through the Pennsylvania Department of Health. Financial institutions must monitor account behavior on an ongoing basis to identify red flags indicating that a marijuana-related business may be engaged in activity that violates state or federal law.

For well capitalized, well managed institutions that currently have strong BSA programs, the act of providing banking services to marijuana-related businesses in full compliance with the Guidance will not, in and of itself, prejudice an institution to adverse regulatory treatment from the Department of Banking and Securities, provided the institution establishes and adheres to robust policies and procedures around the handling of funds pertaining to the marijuana-related business activities and the previously mentioned FinCEN guidance.

Recommendations

Financial institutions evaluating whether to offer financial services to Pennsylvania licensed marijuana-related businesses should consider the following steps to ensure compliance with expectations of the Guidance:

• Perform a business risk assessment and document Board approval and all associated due diligence performed.
• Assess your institution's ability to comply.
• Perform a cost/benefit analysis.
• Ensure sufficient staff, resources and training are devoted to compliance.
• Ensure that the BSA Risk Assessment and applicable policies are updated, congruent with inherent risk, and reflect established practices.
• Perform appropriate due diligence on customers, including:
• Requesting all available business documents, including state licensing documentation.
• Establishing expected account activity.
• Identifying all related parties involved with the marijuana-related business consistent with Customer Identification Program requirements.
• Performing site visits.
• Perform enhanced ongoing monitoring for suspicious activity.
• Obtain periodic financial statements and tax returns.
• Monitor accounts for credit/debit and check transactions in addition to cash transactions.
• Monitor publicly available sources for adverse information.
• Perform periodic site visits.
• At a minimum, file SARs as required by the Guidance.
• Consider maintaining separate accounts or identification codes for the various operations of the marijuana-related business for ease of monitoring.
• Separate accounts could include payroll, ATM, expense, and tax payment accounts.

Financial institutions are expected to stay abreast of changes in state laws regarding marijuana-related businesses and to modify policies, procedures, operations, and account documents in light of such changes.  Furthermore, adequate resources and robust oversight will be needed to ensure compliance with BSA obligations. Finally, all financial institutions should assess the risk of inadvertently or unknowingly providing services to marijuana-related businesses. One way to avoid doing so is to question account names that include terms frequently associated with these businesses, such as "hydroponics" and "MMJ."

Financial institutions may contact the Department with any additional questions or clarifications about regulatory expectations when providing banking services to the medical marijuana industry in Pennsylvania. This is not legal guidance. Financial institutions should consult with their legal counsel for specific questions.

[1] Controlled Substances Act, 21 U.S.C. § 801, et seq.