The creeping legalisation of cannabis: compliance lessons from the US ”green rush”

Written by Eversheds Sutherland on Friday September 28, 2018

Canada, Uruguay and several US states have voted to legalise recreational cannabis, creating an entirely new market of producers, distributors, investors and other persons demanding banking, finance, insurance and all the other business services required by a modern industry. With the US market alone estimated to be worth $8.5 billion, these questions are not going away any time soon.

Neither is this only an issue for compliance professionals in jurisdictions that have legalised cannabis: although recreational cannabis remains illegal in the UK, Lloyds of London has confirmed underwriters will be entitled to serve legal cannabis markets overseas. Similarly, asset managers from the US, Cayman Islands and Latin America have invested in Canadian cannabis investment funds. It is quite possible that ongoing debates around the laws on recreational and/or 'medical' cannabis[1] in the UK, Malawi, Ireland, Australia and New Zealand will result in one or more of those jurisdictions changing their laws.

We believe that in the coming years (regardless of personal opinions), many compliance professionals will have to wrestle with a simple question: what compliance challenges will my organisation or client face if cannabis laws are changed? This article considers the challenges US banks have experienced with the emergence of a huge and quasi-legal market for cannabis.

Inconsistent laws, political tension…

The production and sale of cannabis is almost entirely illegal under US federal law. However, in the last 20 years a number of individual states passed legislation that purported to legalise and license so-called 'marijuana-related businesses' (MRBs). The federal prohibition enjoys legal supremacy over the inconsistent state laws, and so the MRBs remain de jure illegal even in 'legal cannabis' states. In practice, states were hostile to federal prosecution of MRBs (not least because MRBs pay tax to the states), and state tax and law enforcement agencies were directed to treat MRBs like any other business.[2]

In 2013, the (federal) Department of Justice sought to dissipate tension between state and federal agencies by de-prioritising federal prosecutions of MRBs in the absence of aggravating factors such as gang activity and violence (these came to be known as the 'Cole Memo Priorities'). This modus vivendi came to an end in January 2018, when Attorney General Jeff Sessions re-prioritised cannabis prosecutions everywhere. It is not clear that federal prosecutions have materially increased under Sessions, and analysts suggest Trump does not support Sessions on this issue. Moreover, a federal bill that would limit federal action against MRBs is under consideration. In other words, Sessions’ January 2018 direction may not be the last word.

…and ambiguous banking regulation

Banks have faced both political pressure (to assist in tax collection) and commercial pressure (MRBs were desirable targets in the otherwise saturated SME banking market) to serve MRBs. But how would banks comply with AML requirements? Much as in the UK, US federal law obliges banks to monitor and report attempts to inject the proceeds of crime into the formal banking system. Suspicious transactions are to be reported by way of suspicious activity report (SAR) to the US Treasury’s Financial Crimes Enforcement Network (FinCEN). In February 2014, FinCEN issued formal guidance to banks on the issue: MRBs remain unlawful, but banks would be permitted to open and maintain accounts for MRBs under a special SAR regime.

Specifically, banks were expected to file SARs in respect of each MRB-related transaction. However, where the SAR was filed solely because the subject was a MRB and no additional suspicious activity was identified, then the SAR was to be coded as 'Marijuana Limited' – with the implication that such SARs would probably be ignored. Where the bank identified further suspicious activity (e.g. violations of state law or any Cole Memo Priorities), then a SAR containing all the details normally required and coded as 'Marijuana Priority' was to be filed. Finally, banks that closed MRBs’ accounts were to file a SAR describing the circumstances and coded as  'Marijuana Termination'. In Q2 2018, FinCEN received around 1500 Marijuana Limited SARs, around 500 Marijuana Priority SARs, and around 200 Marijuana Termination SARs.

FinCEN’s 2014 guidance remains in place, even though the Cole Memo Priorities were jettisoned by the Department of Justice in January 2018. In fact, US Treasury Secretary Steven Mnuchin said in February 2018 that he intended to ensure MRBs could access the formal banking sector and that new regulatory guidance was forthcoming. Consequently, banks now face not only inconsistency between state and federal laws, but also inconsistency between different federal agencies.

Transactions declined

Big US banks have decided not to (knowingly) do business with MRBs, particularly in light of their federal charters and reliance on the Federal Deposit Insurance Corporation. Likewise, major card issuers decline to serve MRBs. Banks that have courted MRBs are typically smaller institutions that operate only within a single state (and feel insulated from federal regulators) and have shareholders with high risk tolerance (e.g. community-owned Maps Credit Union or the family-controlled Century Bank).

However, as Tanya Hoke, MD of Galen Diligence (which advises investors in MRBs on integrity and licensing) notes 'the legality of MRBs isn’t the only consideration for banks. For some, the potential reputational backlash is significant. For now, some banks are more comfortable working with MRBs in the medical space, rather than in adult-use or retail. Their risk appetite will probably change as the industry becomes better understood'. Indeed, across the border in Canada, the Bank of Montreal has just lent (CAD) $245 million to Aurora Cannabis, a medical cannabis producer traded on the Toronto Stock Exchange.

High compliance costs for the banks that serve MRBs…

In practice, following FinCEN guidance on opening accounts for MRBs requires a positive examination of whether the MRB is compliant with the specifics of state law. In some cases, that examination goes as far as banks insisting on having direct access to the MRB’s point of sale software so that transactions can be monitored in real time. Moreover, both as a result of the FinCEN guidance and banks’ own cautiousness, the volume of SARs filed in the cannabis sector is unsurprisingly far higher than in mainstream businesses.

More generally, many banks have struggled with the inherent risks of dealing with entrepreneurs in a newly-legalised industry: people already within the industry will find it difficult to document their source of funds and experience on the market. (KYC360 readers will be unsurprised to learn that the illicit substances sector does not place a high priority on accurate books and records). Conversely, new investors from outside the cannabis industry are often 'flamboyant' and cash-rich, with a history of investing in high risk sectors in the US and elsewhere.

As a consequence of all the above, banks and other financial institutions typically face greater compliance costs when serving MRBs. To offset these increased costs, some banks demand higher fees from MRBs (perhaps as much as 5,000 pcm for a single store). Financial institutions with an experience of onboarding and monitoring MRBs, such as Safe Harbor Credit Union in Colorado, have offered their expertise to other banks as (effectively) an outsourced service. In California, a new state-owned 'cannabis bank' has been proposed to correct this 'market failure' – but no final decision has been taken.

…and also those who don’t

Unsurprisingly, some MRBs have given up searching for a bank willing to knowingly accept their money, and have instead sought to open accounts by misrepresenting the true origin of the funds. Naturally, this creates an elevated compliance risk for banks, particularly around traditionally-problematic businesses such as laundromats, salons and car washes. Moreover, as Tanya Hoke observes, 'you can’t grow or retail marijuana without real estate, and that’s a sector that’s long posed an elevated risk of money laundering'. Interestingly, prices of both residential and commercial real estate in counties that have legalised retail MRBs have risen far quicker than similar real estate in other counties. We speculate that this is at least partly due to a desire by MRB owners to diversify their investments – or, as federal prosecutors might describe it, 'money laundering'.

These challenges are posed only to US banks: some US MRBs will certainly attempt to transfer funds through foreign banks, particularly Canadian and Mexican banks. Equally, overseas investors (from China, Colombia and elsewhere) will presumably seek to repatriate their profits in due course, which will involve banks in their home countries.

Hopefuls…and hucksters?

One final issue has arisen precisely because many traditional providers shun MRBs: a proliferation of start-ups and fringe operators promising to provide MRBs with lawful non-cash payments solutions. Solutions have included cannabis cryptocurrencies, in-store ATMs, and alternative card payment processing solutions.

Whether these will stand the test of time and regulatory scrutiny remains to be seen. Anecdotally, there are reports that card transactions in retail MRBs are simply being recorded as being for completely different goods in completely different places. Neither card issuers nor prosecutors will be pleased to discover such practices.

Conclusion

It is clear from the volume of MRB-related SARs filed that the quasi-legalisation of cannabis by some US states have resulted in some compliance challenges for financial institutions. To the extent that some licensed MRBs have been unable to find a bank willing to serve them and/or are unwilling to bear the increased cost of MRB-related accounts, these challenges will be posed to financial institutions that seek to serve MRBs and those that seek to avoid them.

The position in the US is clearly aggravated by the inconsistency of state and federal laws, such that MRBs exists in a twilight zone of legality. We suggest that that difficulty will be replicated in jurisdictions like the Netherlands or Portugal where consumption is legal, decriminalized or tolerated, but commercial production and/or sale remains unlawful. Canada will shortly legalise, license and tax the production and sale of recreational cannabis: we will monitor the situation to see whether this model poses fewer AML risks to banks and will be more effective in displacing criminal activity.

Globally, the illegal and legal cannabis trade is worth more than $87 billion. The California cannabis market could be worth $5 billion in 2019, and there are suggestions that more cannabis will be sold than beer. In the UK, the Institute of Economic Affairs has suggested that a legal cannabis market could be worth £2.6 billion, of which the state could take as much as £690 million as tax revenue. In post-Brexit Britain, that may be a revenue stream that no Chancellor can resist. In that light, we believe the AML and financial crime dilemmas posed to banks and other financial institutions are unlikely to disappear any time soon.

[1] In this article we discuss only the strain of cannabis sativa which has a psychoactive effect and purported medicinal uses. We do not deal with industrial hemp that is commonly used for textiles, paper etc and is widely grown across the US and EU (outside the UK). Neither do we comment on the supposed medical efficacy of cannabis or whether its legalisation is desirable.

[2] Naturally MRBs had to comply with complex state-imposed licensing requirements, but so do locksmiths, hair stylists and lawyers.

This article forms part of the Big Compliance Conversation and has been submitted by guest contributors Greg Brandman and Viv Jones of Eversheds Sutherland. 

About the authors

Greg Brandman is a Partner in the Financial Services Disputes & Investigations practice of Eversheds Sutherland in London. A former regulator at the Financial Conduct Authority, he advises banks on how to enter new markets and respond to changing regulatory obligations. Viv Jones is a Principal Associate in the Corporate Crime & Investigations team of Eversheds Sutherland in London. A former corporate investigator, Viv advises financiers and investors on ethics and integrity issues at the nexus of business, law and politics. Eversheds Sutherland’s 2,800+ lawyers practice law globally from 66 offices across 32 countries; to sign up for our Corporate Crime & Investigations global newsletter, please click here.

If you would like to take part in the ICA’s Big Compliance Conversation and contribute to a like-minded community, please get in touch at contributions@int-comp.org