The legal landscape of banking marijuana businesses

Banks are caught in the between state and federal laws on marijuana. Like any other business, marijuana producers and dispensaries need bank accounts to avoid the costly and dangerous consequences of all-cash dealings. They risk violating numerous federal laws by providing banking services to marijuana-related businesses. Banks are required by the Bank Secrecy Act to implement programs reasonably designed to detect, prevent and report money laundering conducted though their institutions. Moreover, federal money laundering laws criminalize the knowing receipt of more than $10,000 in proceeds of marijuana sales. It is therefore unsurprising that businesses in the marijuana industry have historically had great difficulty opening bank accounts and maintaining banking relationships.

When states first began legalizing medicinal and recreational marijuana, banks that did serve the marijuana industry struggled with a lack of guidance on how to handle these relationships. Among other difficulties, banks struggled with the application of suspicious activity reporting requirements. As background, banks must file suspicious activity reports (SARs) on any transaction or series of transactions that, among other things, aggregates to at least $5,000 and involves funds derived from illegal activities. If taken literally, this requirement would result in reporting nearly all transactions in a producer's or dispensary's account, causing a drain on limited compliance resources and a large volume of SARs that are not useful to law enforcement.

Recently, there have been a number of legal developments aimed at alleviating the burden and uncertainty faced by banks serving marijuana businesses.

The 2014 DOJ and FinCEN Guidance

As noted in our earlier piece, in February 2014, the Department of Justice issued a second memo to clarify that prosecutors would follow Cole memo (named after former Deputy Attorney General James Cole) priorities when making decisions about prosecuting banks under the BSA and money laundering statutes. At the same time, the U.S. Department of Treasury's Financial Crimes Enforcement Network (FinCEN), which administers the BSA, issued guidance intended to clarify expectations regarding banking businesses in the marijuana industry. Together, these provide a framework designed to enable banks to provide services to the marijuana industry without running afoul of FinCEN and the DOJ.

FinCEN's 2014 guidance, titled "BSA Expectations Regarding Marijuana-Related Businesses," clarifies how banks can provide services to "marijuana-related businesses"(MRBs) in a manner consistent with their BSA obligations. The guidance also creates a reporting structure meant to align SAR filing with federal law enforcement priorities set out by the DOJ.

The FinCEN guidance emphasizes that, when considering whether to open and maintain an account for a MRB, banks should consider whether the MRB implicates any of the enforcement priorities cited in the Cole memo in order to act consistently with their BSA obligations.

These priorities are: preventing distribution of marijuana to minors; preventing marijuana revenue from going to criminal enterprises; preventing diversion of marijuana to states where it is not legal; preventing state-authorized marijuana activity from being used as a cover for other illegal activity; preventing violence in the cultivation and distribution of marijuana; preventing drugged driving; preventing the growing of marijuana on public lands; and preventing marijuana possession or use on federal property.

Similarly, in its 2014 supplement to the Cole memo, the DOJ clarified that these priorities should guide prosecution decisions under the BSA, money laundering statutes, and unlicensed money transmission statutes. Thus, if a bank were to take reasonable precautions to avoid banking MRBs implicating the Cole memo priorities, it could expect to avoid unwanted attention from DOJ and FinCEN.

The FinCEN guidance provides a roadmap of what these precautions look like. FinCEN emphasized that, while the decision to provide services to any particular MRB should be based on the risk tolerance and other factors unique to each institution, "thorough due diligence" is "critical" to serving MRBS in a manner consistent with FinCEN's expectations. FinCEN spelled out a number of steps that this diligence "should" include: verifying the MRB is duly licensed and registered with state authorities; reviewing the state license application and related documentation; requesting information about the MRB and related parties from state licensing and enforcement authorities developing an understanding of the normal and expected activity of the business (e.g., medical vs. recreational customers); developing an understanding of the normal and expected use of the account; conducting ongoing monitoring of publicly available sources for adverse information about the MRB and related parties; conducting ongoing monitoring for suspicious activity; and updating due diligence information on a periodic basis and commensurate with the particular risks posed by the customer.

Given the number of steps that FinCEN expects banks to take, it is a safe inference that, overall, FinCEN generally views risks associated with MRBs as high and MRB relationships as warranting enhanced scrutiny and monitoring. Consistent with this approach, FinCEN's 2014 guidance contains a list of 23 "red flags" of financial activity that may be indicative of a Cole memo priority, and, as described below, may warrant further investigation for purposes of determining whether to file a SAR. If banks do choose to serve MRBs, they may wish to consider in advance whether and how to monitor the MRBs' activities for these red flags.

Regarding SARs, FinCEN was careful to clarify that the CSA "makes it illegal under federal law to manufacture, distribute, or dispense marijuana." FinCEN also clarified that "[t] he obligation to file a SAR is unaffected by any state law that legalizes marijuana-related activity," and that "[b]ecause federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity." As a result, SARs must be filed on activity involving MRBs, even if licensed under state law. However, one of the BSA's purposes is to require the filing of reports that are highly useful in criminal investigations and proceedings. To the extent law enforcement is focusing prosecution on persons implicating Cole memo priorities, filing on all activities of a MRB would contravene this purpose and impose unnecessary burden on banks.

In an attempt to reconcile the issue, FinCEN created a new SAR filing scheme specifically for MRBs that involves three types of SARs. Like account opening decisions, this scheme is largely based on whether a MRB's banking activities implicate a Cole memo priority.

Marijuana Limited SAR: In the event that a bank provides services to an MRB, but its due diligence indicates that none of the Cole memo priorities are implicated, it should file a marijuana limited SAR. The SAR should contain: identifying information and addresses of the subject and related parties; the fact that the SAR is filed solely because the subject is engaged in a MRB; the fact that no additional suspicious activity has been identified; and the term "MARIJUANA LIMITED" in the narrative (e.g., a place in FinCEN's SAR form where banks are required to provide a narrative description of why the activity at issue triggers SAR filing requirements).

In addition to the initial SAR filing, FinCEN has interpreted its SAR filing requirements to include an obligation to report continuing suspicious activity. FinCEN's guidance on the issue provides that, if suspicious activity continues, banks should review that activity for 90 calendar days after the initial SAR filing, with the subsequent filing deadline being 120 calendar days after the date of the previous SAR. Therefore, if the bank believes that a MRB's marijuana-related activities continue, it will be required to file a second marijuana limited SAR within 120 days of the initial filing. This timeframe would result in three SARs filed over a 12-month period on a MRB customer that continues its marijuana activities. The subsequent SARs should contain the same information as the initial SAR, plus the amount of deposits, withdrawals, and transfers in the account since the previous SAR.

Marijuana Priority SAR: If a bank reasonably believes that a MRB's activities implicate a Cole memo priority, it should file a "marijuana priority" SAR. The content of the SAR should follow existing requirements and guidance, but should also include: the term "MARIJUANA PRIORITY" in the narrative; identifying information and addresses of the subject and related parties; details regarding the Cole memo priorities implicated; and dates, amounts, and details of the suspicious financial transactions.

Because FinCEN's guidance instructs banks to consider whether a MRB implicates a Cole memo priority when making decisions about whether to open or maintain a MRB relationship, a bank that files a marijuana priority SAR may wish to consider the risk of continuing the relationship with the MRB customer.

Marijuana Termination SAR: If a bank terminates a relationship with a MRB for BSA-related reasons, it should file a SAR and note in the narrative the basis for the termination. Financial institutions should use the term "MARIJUANA TERMINATION" in the narrative section. If the bank becomes aware that the MRB seeks to move to a second financial institution, FinCEN urges the bank to use special information sharing mechanisms available under the BSA to inform the second institution of potentially illegal activity.

Implications of and Ambiguity in FinCEN's 2014 Guidance

The central ambiguity stemming from FinCEN's 2014 guidance is definitional: how to determine the businesses that qualify as MRBs. FinCEN did not provide a definition of MRB in its guidance. While businesses that deal directly with marijuana, such as producers or dispensaries, would clearly be covered, banks have struggled with indirect relationships. For example, what about a commercial landlord that leases property to a marijuana dispensary? FinCEN's limited answer appears in a footnote to the 2014 guidance, which states that, with respect to such relationships,

the financial institution may file SARs based on existing regulations and guidance without distinguishing between 'Marijuana Limited' and 'Marijuana Priority.' Whether the financial institution decides to provide indirect services to a marijuana-related business is a risk-based decision that depends on a number of factors specific to that institution and the relevant circumstances. In making this decision, the institution should consider the Cole memo priorities, to the extent applicable.

This limited guidance leaves banks free to make their own determinations as to which businesses should be considered MRBs.

A similar issue exists with respect to filing SARs on bank customers that are not themselves MRBs, but that conduct business with MRBs. For example, is a SAR required when a commercial landlord receives a $5,001 rent payment from a MRB into its account? Again, FinCEN's guidance leaves room for interpretation. On the one hand, FinCEN explicitly stated that the obligation to file a SAR is unaffected by state law, and that, because financial transactions of MRBs would generally be derived from illegal activities, SARs are required. On the other, FinCEN recognized that filing on all activity of a MRB would not be useful to law enforcement and contrary to one purpose of the BSA. If the MRB's own bank is not required to file a SAR on the MRB's rent payment, it would be odd and contrary to the purpose of the BSA to nonetheless require the landlord's bank to file a SAR on the receipt of the payment. The ambiguity leaves banks in a difficult position. If a bank takes the conservative approach and files on each of its customers' transactions with a MRB, it risks overburdening its limited compliance resources to submit reports that are unlikely to be useful to law enforcement. On the other hand, if it fails to do so, it risks regulatory criticism if its examiners take a contrary position. 