In an effort to increase loans and deposits and expand their customer base, smaller financial institutions and credit unions have been considering whether or not to work with cannabis-related businesses. It’s a decision that should not be taken lightly. Servicing this customer pool will in some cases greatly increase your institution’s risk profile. It also entails significantly more scrutiny around Anti-Money Laundering/Bank Secrecy Act (AML/BSA) compliance.

Whether or not you decide to bank a cannabis-related entity, before your institution can even open its doors to this emerging market, there are two elements of your AML compliance regime in particular that you need to focus on:

1. A thorough risk assessment
2. A rock-solid onboarding process from start to finish

Much regulatory, legal and reputational damage can be averted right from the beginning when you have access to intelligent data, can automate screening processes, and can combine this with good KYC policies and systems.

A Brief Overview of the Cannabis Business Industry

One of the biggest challenges of cannabis business banking is that the Cannabis industry itself as well as the rules that guide it are incredibly diverse and extensive. For starters, cannabis products actually fall into one of three categories: hemp, Cannabidiol (CBD) oil, and marijuana. Each one of these categories is treated differently from a legal and regulatory standpoint. Complicating matters, there are also differences in the rules and regulations from one state to another.

Here is a brief rundown of each type of Cannabis product, including its current legal and regulatory standing:

Hemp

Hemp is a variety of the Cannabis sativa plant species that is grown specifically for commercial use. Hemp produces a broad range of cannabinoids, including tetrahydrocannabinol (THC), the intoxicating chemical in marijuana. Hemp, however, does not contain enough THC to produce intoxicating effects.

Many countries differentiate hemp from marijuana by the amount of THC produced by the plant. In the US, industrial hemp must not contain more than 0.3% THC.

Hemp has a variety of uses. Hemp fibers can be used to make an assortment of products including paper, clothing, textiles, rope, building materials and compost. Hemp seeds and the oil produced from them, on the other hand, can be consumed as healthy, nutrient-rich, super food.

CBD Oil

CBD oil comes from the flower and leaves of the hemp plant. It is not the same as hemp seed oil, which comes from the seed and contains little to no CBD. Over the past few years, there has been a growing demand for CBD oil as a wellness supplement to such an extent it is a sub-industry all to itself.

Both hemp and products containing CBD oil are treated the same from a legal and regulatory standpoint. CBD is also subject to Food and Drug Administration (FDA) oversight with respect to how products containing CBD can be advertised.

According to the 2018 Farm Bill, growing, processing and selling hemp and hemp derivatives is legal at the federal level, and so is transporting hemp across state lines.

There are, however, many restrictions placed on such activities. For instance, all growers, processors and dealers must be approved, registered and/or licensed by the U.S. Department of Agriculture (USDA). Hemp that is not produced in accordance with the 2018 Farm Bill is designated as illegal marijuana.

For financial institutions in particular, the Financial Crimes Enforcement Network (FinCEN) recently issued their guidance regarding due diligence requirements under the Bank Secrecy Act (BSA) for hemp-related business clients.

Marijuana

Marijuana is the dried leaves and flowering tops of either the cannabis sativa or cannabis indica plant. Since marijuana contains a significant amount of the psychoactive substance THC, it is still considered a Schedule 1 substance under federal law. Many states, however, have legalized the cultivation and selling of medical and/or recreational marijuana.

This odd contradiction between federal and state law has brought about two indirect, yet consequential results:

1. Marijuana is primarily a cash-based industry since most payment networks will not process marijuana-related transactions.
2. Many big marijuana companies rely on the investments of foreign individuals and entities.

Marijuana-related businesses (MRBs) can also be classified into one of two tiers:

1. Tier I MRB- A company that is directly involved in cultivating or dispensing marijuana
2. Tier II MRB- A company that supports Tier I MRBs, such as hydroponic suppliers, packaging suppliers, licensing consultants, or marijuana software providers

Although cannabis business banking may be challenging in the current environment, it represents a potentially lucrative emerging industry for financial institutions. With total sales of cannabis in the states where it is legal expected to reach nearly $30 billion by 2025, a growing number of cannabis-related businesses are seeking access to mainstream financial products.

Moreover, cannabis products derived from Hemp and CBD are both federally legal and considerably less taboo. This means that institutions looking for untapped markets, could get their foot in the door with less risk and uncertainty.

With MRBs, currently 36 states have legalized the distribution of medicinal and/or recreational marijuana. The largest draw for both banks and credit unions in this high-risk market is the vast untapped potential. Like any business, MRBs need access to financial services in order to survive and expand. The MRB industry, however, is expected to reach a staggering $57 billion by 2027, yet a majority of MRBs (70 percent in total) remain unbanked or under-banked.

Understanding Cannabis Business Banking Risk

Whether or not your financial institution chooses to bank hemp, CBD, or MRB customers, your will be making a risk-based business decision. There are three main areas of risk to consider right from the start:

The Risk Posed by the Cannabis Business

As mentioned above, the risks associated with banking hemp companies versus CBD companies versus MRBs all differ tremendously. Not only would you potentially need to stay updated with the current legal and regulatory status of hemp, CBD and marijuana businesses across several different regions, but there are serious know your customer (KYC) risks, too.

The big risk in banking hemp or CBD companies is that either:

• The hemp involved is actually marijuana
• The hemp or CBD company has not followed all legal requirements, such as having the correct licenses and registrations, or it is growing the hemp in a tract of land that has not been approved.

Support services provided by third parties to cannabis businesses, such as hemp testing facilities, may also put financial institutions at risk for money laundering schemes. These types of companies, however, generally do not pose the same amount of risk as direct cannabis businesses, such as farmers, processors, and dealers.

With cash-oriented MRBs, financial institutions face the real risk of legal action for money laundering and aiding and abetting in drug trafficking. But, that’s not all. Some legal MRBs are committing fraud or opening up shell companies just to gain access to the services of a financial institution. For example, an MRB may list itself as a “pharmacy”, “nursery” or “wellness center” in order to get through the onboarding process.

Risk Posed by the Beneficial Owner

Aside from the typical risk associated with politically exposed persons (PEP) or those with a criminal background, one of the biggest risks surrounding the beneficial owners of a cannabis-related business is figuring out who they are in the first place. The challenge is even greater when determining the true beneficial ownership of marijuana companies due to the prevalence of foreign investment and the prolific use of management agreements and shell companies in the industry.

Risk Posed by the Financial Product

The final area of risk to consider is that posed by the desired financial product(s). The risk to offer a deposit account differs greatly from the risk of providing a loan. Once you’ve determined the risk of the cannabis business itself and of the beneficial owner, making this decision depends on your institution’s risk appetite.

Mitigating the High Risk of Cannabis Banking from the Beginning

A great deal of mitigating the risk of cannabis business banking happens at the beginning, before a client has completed the onboarding process. There are two key steps and areas of focus your financial institution should be concerned about:

Conducting a Risk Assessment

After becoming familiar with the relevant laws and regulations across your institution’s entire footprint, you should conduct a cannabis-risk assessment and set your institution’s risk appetite for the industry. The risk assessment process with the aid of AML Compliance tools and consulting will provide an opportunity for your financial institution to see if cannabis business banking products and services truly fall within the scope of its strategy and risk appetite.

A significant part of your institution’s risk management starts with good KYC practices and systems. Thus, the risk assessment process should confirm whether there is adequate infrastructure and support in place in your AML compliance program. For instance, how is your institution scanning watchlist data, which alternative data sources will you be consulting, and how will matches be sorted and verified?

When evaluating any higher risk activities, the legal and regulatory impact should also be considered in terms of both AML/BSA compliance and potential exposure to litigation.

Developing a Thorough Onboarding Process

The Onboarding process starts with the onboarding request, followed by data capture and initial CDD/CIP, and then enhanced due diligence (EDD) for KYC. This is where much of your risk management and AML compliance happens in practice.

After conducting a risk assessment, you then need to set the risk-rating criteria and processes for risk-rating new customers. Here are a few important considerations:

• Use a comprehensive application and onboarding questionnaire to understand the nature of the business and its financial activity and to secure the necessary documentation, such as the business’ registration and license information. Because banking hemp or CBD is different from marijuana businesses, it’s good practice to have different onboarding questionnaires for each of the three types of cannabis products.

• Invest in automated onboarding technology powered by artificial intelligence and machine learning. These technologies can help your institution conduct enhanced due diligence and deep web searches for automating EDD. You’ll have better insight into the background of each business and its beneficial owners. Moreover, automated platforms such as our own DecisionIQ will not only screen for sanctions, PEP, criminal records, negative news media and more, but create an intelligent scoring engine that reduces manual processes and False Positives.

• Developing an onboarding process that reflects your risk appetite should always be considered a work in progress that you periodically return to and adjust where needed. This reevaluation process will also help your institution conduct its ongoing monitoring for suspicious activity.

In short, banking cannabis-related companies raises the level of risk for any financial institution. But your institution can mitigate the high risk in cannabis business banking by getting your onboarding process, systems and procedures in line with your risk appetite and financial goals.

.

.

Over the past few years complying with anti-money laundering (AML) regulation has become increasingly difficult for many credit unions in the United States and Canada. With the rapid expansion of new technologies, industries, business models and cross-border transactions, regulators have ramped up their AML compliance demands.

While big banks have their own AML departments and are investing big bucks in their digital infrastructure, smaller credit unions generally lack the funds and other resources to keep up with it all. This shortfall in turn becomes a major impediment to complying with AML/CFT regulations.

In this three-part series we are going to take a closer look at AML/CFT compliance among credit unions. Specifically, we’ll examine the current cost of not being able to comply, some new compliance challenges and threats, the most essential elements that today’s credit union AML/CFT compliance programs need to have, and the easiest, most cost-effective solutions to actualize such changes.

The High Cost of AML/CFT Compliance

In a recent survey by CU Service Network of over 60 executives from credit unions ranging in size from $30M to $1.6B in total assets, a whopping 98% identified compliance as being their primary operational concern.

It’s not hard to see why. According to another study, this time from the Government Accountability Office (GAO), US credit unions spent up to 2.4% of their total 2018 operating expenses on AML/BSA compliance.

For smaller credit unions that percentage is likely higher since they do not have the same economies of scale or investment in IT infrastructure that bigger credit unions enjoy.

Yet, these numbers still don’t accurately reflect the true cost of compliance among credit unions.

At KYC2020, we offer consulting services to our clients to help them develop and employ a customized AML compliance program. During the risk assessment and workflow analysis, we will consider numerous indirect costs that may increase risk while reducing efficiency. For example:

• When first-line staff are tasked with duties related to regulation, reporting and record-keeping requirements that add to their regular responsibilities. This takes them away from their regular jobs and makes them less efficient.

• When compliance programs rely heavily on manual and repetitive procedures. This increases the chance of errors and omissions. Even small errors, such as incorrectly labeling a document, can lead to fines and costly downtime.

• When the credit union’s senior leaders are pouring majority of their time and money into cybersecurity and compliance rather than strategic initiatives and goals. This lack of strategic focus can lead to missed opportunities.

On the other hand, when credit unions are unable to prevent fraud and money laundering activities, they will inevitably suffer from declining revenues, lack of customer satisfaction, debilitating fines, and damage to their reputation.

It doesn’t have to be this way! There are proven methods for credit unions to get back all the wasted time and money.

The most successful credit union leaders are those who seek to understand the role that effective compliance management plays in the institution’s overall strategy. They make an effort to consider the impact of compliance on operations as well as customer acquisition and retention. Finally, they recognize their unique needs and circumstances and then implement the most appropriate tools to help them optimize their compliance activity.

By doing so, these leaders will be best positioned to help their credit unions grow and prosper, now and in the future.

Rethinking Credit Union AML Compliance

As the financial services industry continues to evolve and expand and new compliance rules emerge, many credit unions have been content to simply make tweaks to their current compliance programs, policies and procedures. This only leads to greater inefficiencies over time.

Instead, senior leaders need to completely rethink how compliance happens along four key verticals:

1. Conducting an Audit and Risk Assessment

Risk assessment is a pillar of AML compliance and generally is a crucial first step in building an effective AML/CFT program. Yet, many senior management teams get derailed when they try to rubber stamp a solution or a mix of solutions on to their legacy systems.

The problem with this is that there is no one-size-fits-all solution to fulfilling compliance requirements. While each financial institution must fulfill certain legal obligations, it is essential that the program be tailored to their unique needs in addition to the identified risks and vulnerabilities of their clients and third party suppliers

In practice, this means that an AML/CFT program must take into account factors related to their product and service offerings, their size and geographic location of the branches, the business activities, and knowledge of its customers activities.

Finally, another often overlooked factor is the ability to scale and adapt as the credit union matures and grows. A credit union’s AML/CFT program should have the built-in flexibility to adapt to changes in compliance requirements, technology, and its target market while maintaining strict data security and information management controls.

2. Establishing Internal Controls

A credit union’s compliance obligations include not only federal and state laws, but also the expectations of regional, and at times, international regulators. For example, the General Data Protection Regulation (GDPR), which requires businesses to protect the personal data and privacy of European Union citizens, could apply to a credit union with members from multi-national businesses.

Few credit union leaders would fail to acknowledge that their AML/CFT compliance program should focus on internal controls and systems to detect and report financial crime. But at the same time, several other items should be taken into consideration based on the modern realities of AML/CFT programs today. These include:

• The increasing number of mobile payments that significantly reduce financial transaction times.

• The impact of customer experience and expectations on revenues and customer retention. A recent study conducted by Forrester, revealed that customer experience is the most highly valued quality consumers are looking for in a financial institution. Many studies show the same results for business customers too.

• Cybersecurity and financial fraud have grown in scope and complexity in recent years. Fraudulent activity is getting increasingly more difficult to recognize and contain. When suspicious activity is identified, the response needs to be data-driven, intuitive, and happen in real-time.

3. Providing Continual Employee Training and Education

AML/CFT compliance always extends to a credit union’s employees. In fact, employees tend to be the weakest link in data security and compliance procedures. Staff members need to be aware of their roles and responsibilities within the system. They should know how to conduct due diligence and navigate the various organizational policies and procedures that help to ensure on-going compliance.

But given that compliance should be a dynamic system, employee compliance training and the communication of new systematic threats must also be dynamic and dealt with swiftly before becoming too much to bear.

4. Monitoring the Results

Although AML/CFT compliance programs require and independent review, the credit union should also involve a regular internal review of compliance controls in order to measure their effectiveness not just in meeting compliance standards but in achieving strategic business goals. Identifying the institution’s strategic goals while focusing on compliance is a core competency that will drive success among today’s credit unions.

In short, today’s credit unions are in need of dynamic and customized AML/CFT compliance programs. Achieving such a goal is actually easier and more cost-effective than it seems given the rise in regulation technology (RegTech) and vendor based compliance solutions.

Before we can take a look at these vendor based solutions, we need a deeper understanding of the challenges credit unions are currently facing when it comes to AML/CFT compliance.

We’ll discuss that in part two of this series.

About the Author

KYC2020 is a Chicago-based global regulation technology company.  KYC2020’s team of CAMS certified AML specialists have combined next-generation technology with their deep understanding of Banks, MSBs, Credit Unions, and Cryptocurrency operations to deliver compliant AML solutions that are low friction and cost effective. KYC2020 is recognized as one of the world’s most innovative regulation technology solution providers by RegTech Analyst magazine.  To learn more about the author, visit www.kyc2020.com

Spreadsheets for Everything

While an RA is the foundation for a good risk-based AML Regime, it is often marginalized by many non-bank financial firms.  It is done in a superficial manner, using tools that are convenient and free, but ill-suited for the job. Spreadsheets are generally the tool of choice to input, track, and manage the annual risk assessment compliance requirement. As one can imagine, this approach is rather ineffective. It lacks proper controls, is prone to human-errors, difficult to audit, share, or track revision history. Moreover, as banks enhance their KYC regimes, they require annually updated formal AML Risk Assessment documentation.  The inherent limitations of spreadsheets for RA reporting and management is obvious.

Alternatives to Spreadsheets

So then, what are the alternatives to spreadsheets? The challenge once again for most SMEs and FinTech innovators is Cost, Availability, Competence, and Convenience. In our search for alternatives, we could not find a competent RA tool that met our basic requirements, was available at low-cost, was easy to get started, and convenient to use.

When we introduced our FREE Watchlist Curator Tool, we made the following statement:

“At KYC2020, we could have invested in writing a blog and talked about why “over-screening” is an expensive problem…  Instead, we decided to have our CAMS AML specialists build a tool to help you identify what Sanction, PEP, and watchlists you should be screening based on your company’s risk profile. And we decided to make our watchlist builder available free of charge.”

KYC2020 Free AML Risk Assessment Tool

For our AML Risk Assessment Tool, we decided not to be so lazy. We not only built a tool that we could make available for FREE, but also forced our CAMLO, Joseph Iuso, CAMS, to write a Blog on the What, Why, and How’s of an AML Risk Assessment. Between the information and wisdom of Joseph’s blog and the competence and convenience of our RA tool, I believe we have got you covered. Of course, we have the standard disclaimers, and you should already know that a tool cannot replace the advice of your in-house Compliance Officer.

Get started by clicking below.

KYC2020 AML Risk Assessment Tool benefits heavily from the Federal Financial Institutions Examination Council’s (FFIEC) Risk Assessment guidelines, as well as the Conference of State Bank Supervisors (CSBS) BSA/AML Self Assessment tool.  The tool considers five (5) main categories to arrive at an aggregate risk score for your business. These are: 1) Products and Services, 2) Customers, 3) Geography, 4) Operations, and 5) Agents. For each category, you have the opportunity to specify the High, Medium, and Low Risk definitions inherent to the business. For the inherent risk definitions you then specify your controls and mitigation measures to arrive at the residual risk; the risk that still remains after application of your counter-measures. This residual risk is then scored and aggregated across all categories to complete your risk assessment.

Who said it would be Easy

Sounds complicated? That’s because it is. Even for AML specialists working on a low-risk profile business, this is a minimum 2+ hour investment of time. It is for this reason the tool has the ability to save work and complete the assessment over multiple sessions. With a little bit of study, watching our Get Started Video, and rolling up your sleeves you can get through with your risk assessment on your own and for FREE!

Need Help with your RA?

For those who need a little bit of help completing, we offer some reasonably priced paid options to speed up your risk assessment process and follow best practices. These include, access to business specific templates that can be customized to speed up the assessment, different consulting packages to help prepare, review, and/or audit your Risk Assessment by our CAMS or VSKILLS certified AML specialist.

Once again, there is no catch. The tool is no obligation and we do not take any payment information. We do hope you might take the time to see what awesome and affordable AML compliance solutions we offer, from Global Watchlist Data to Sanction Screening to AML compliance consulting services. Chat with us online now, email us, or just use the tool. Our aim is to help you reduce the cost and friction of AML compliance.