Schedule a Demo

Discover how solutions from Shield Compliance can power, protect, and scale your cannabis banking program.

Expert advice for compliant cannabis banking programs, straight to your inbox.

Cannabis and Compliance

Successful programs have cannabis compliance teams, solid technology, and buy-in from regulators.


This article was originally published by Bill Merrick in the Fall 2022 issue of Credit Union Magazine.


Serving cannabis-related businesses (CRB) brings significant growth potential for credit unions—along with challenging operational demands and complex regulations. But cannabis banking doesn't necessarily mean high-risk banking, says Tony Repanich, president/CEO and board member at Shield Compliance.


He believes successful credit unions develop cannabis banking specialists who understand the compliance requirements, embrace technology, and gain buy-in from regulators before starting their programs.


Repanich explains how he acclimates credit unions to this industry, details the risks and compliance challenges in doing so, and offers some compliance best practices.


Credit Union Magazine: What’s the state of legal cannabis today?


Tony Repanich (TR): At last count, 38 states have approved medical use for cannabis. That’s the start for most markets. As those markets get larger and have greater acceptance, they eventually move into an adult use market. Nineteen states and the District of Columbia have done that, which creates a bigger market. 


As these markets evolve, so does the demand for financial services.


How do you help credit unions serve CRBs?


TR: We look at a few factors. One is helping the management team and board do a risk assessment. They need to consider more than differences between state and federal law, including the additional work outlined in the Financial Crimes Enforcement Network (FinCEN) guidance.


Then, they must understand the impact this will have on their operations and some of the parties they work with, such as insurance providers and corporate credit unions. What will these parties think about their entrance into this market? And how do they manage that?


We partner with experts who can develop risk assessments and policies, and third-party providers. For example, the retail cannabis market is 75% cash. Many credit unions are consumer focused and haven’t worked with cash-intensive businesses. They need a plan for how they will handle this volume of cash. That’s why we partner with cash logistics companies that specialize in this area.


It’s a combination of understanding the risk and the business opportunity, the impacts on the institution, and what services or tools can be brought to bear on those issues.


What are the biggest risks involved in serving CRBs?


TR: At an enterprise level, one risk is understanding how this business activity will impact your balance sheet and ultimately your income statement. These businesses have a lot of activity, but only a portion of that will stay as balances within the credit union. How will that money movement and the work you’re doing benefit the credit union financially? And what expenses come with this line of business? 


On the member level, you also need to ensure the funds being deposited into these accounts, come from the legal market. CRBs must be appropriately licensed by the state, and that the deposits they’re making must correlate to the sales they’ve reported.


What compliance challenges arise when serving these businesses?


TR: The FinCEN guidance from 2014 requires financial institutions to understand the licensing the member has obtained from the state and the business they’re allowed to conduct. That’s part of the initial review of the member.


But throughout the life of the relationship, you must make sure those licenses remain in good standing and are properly renewed. You’re really managing the member’s authority to be in this line of business.


You also need to dive deeper into the underlying beneficial owners. Most credit unions have a policy that says they need to know about the owners who have an ownership stake greater than 20% or 25%.


Because there’s a risk of potentially undesirable parties being connected to these legal business operations, most credit unions we work with will interrogate the ownership at a degree of 10% or greater.


You’re looking at more owners, potentially, with every new business you bring in. And you’re generally looking deeper into the background of these owners. 


This requires understanding the business and the owners, and then tracking whether conditions have changed since you originally underwrote the member that could increase the risk of the relationship. This could include negative news or adverse media, so you  need to have a process in place to stay on top of this type of information.


Lastly, you’re obligated to file suspicious activity reports (SARs) on each of these members every 90 days. This is time consuming. SARs require a written narrative and a lot of calculations of the activity that occurred within the reportable period.


The tooling we provide streamline that activity for credit unions. We have a credit union client that serves nearly 1,700 CRBs, which means they’re filing 1,700 SARs every quarter. 


That’s a lot! Some credit unions that aren’t in this space may file a handful of SARs all year. It’s a big change.


Where do financial institutions tend to stumble in this process?


TR: Most financial institutions that get into this business understand the Bank Secrecy Act (BSA) and anti-money laundering (AML) risks. They can get into trouble when their appetite for this business is greater than their capacity to manage the compliance risk, and it becomes overweighted as a source of earnings or funding for the institution.


If you can’t keep up with the BSA/AML requirements and you’ve become overly dependent on it for earnings, you’ve backed yourself into a corner. You can’t get out of the business because it would be detrimental to your earnings.


Most of our clients have a limit in their policy—a percentage of assets or total deposits they’ll take on at any one time. Examiners like that. It communicates how fast or slow they intend to go as they enter this space.


Another potential issue credit unions face is not aligning policies and procedures with actual practices. Nothing makes an examiner crankier than when you say you’ll do something and then you don’t do it.


The FinCEN guidance gives examiners discretion to understand your program and to ask how you’re conducting certain activities.

That’s why you’ll want a good policy and procedures that clearly outline how you are mitigating this risk.


Are regulators comfortable with credit union involvement in this business?


TR: Generally, yes if you explain why and how you’re getting into this business, the vendors you’ve selected, and how you’ve evaluated the risk.


Don’t surprise your examiner with the fact that you’ve gone into cannabis banking after the fact. Engaging them early on will serve you well during an examination.


What other compliance best practices should credit unions follow?


TR: The most successful credit unions have a consolidated team. They’re not opening cannabis accounts in every branch, but rather they’re creating specialists or a team of people who know the business well, understand the compliance requirements, and work directly  with these businesses.


This level of expertise adds value through the entire process of onboarding and ongoing compliance management, and really lends itself to great compliance results and a great member experience.


There’s also a growing expectation that you have a purpose-built technology platform in place to manage the risks associated with these businesses, have repeatable processes and good reporting, and have strong management oversight for this area of risk. 


Look at technology to help you be efficient and compliant in this space.

Financial institutions that have gone down this path have paved the road by creating a set of tasks that need to be done to achieve compliant results. 


Because that road has been paved, there’s more acceptance from regulators and an understanding of what compliance looks like. The cannabis industry also understands better than ever the requirements to obtain a banking relationship.


You don’t have to start from scratch. A playbook exists for cannabis banking and you can lean into a community of pioneering cannabis bankers as you build your program.



This article was originally published in Benzinga.