In an effort to increase loans and deposits and expand their customer base, smaller financial institutions and credit unions have been considering whether or not to work with cannabis-related businesses. It’s a decision that should not be taken lightly. Servicing this customer pool will in some cases greatly increase your institution’s risk profile. It also entails significantly more scrutiny around Anti-Money Laundering/Bank Secrecy Act (AML/BSA) compliance.

Whether or not you decide to bank a cannabis-related entity, before your institution can even open its doors to this emerging market, there are two elements of your AML compliance regime in particular that you need to focus on:

1. A thorough risk assessment
2. A rock-solid onboarding process from start to finish

Much regulatory, legal and reputational damage can be averted right from the beginning when you have access to intelligent data, can automate screening processes, and can combine this with good KYC policies and systems.

A Brief Overview of the Cannabis Business Industry

One of the biggest challenges of cannabis business banking is that the Cannabis industry itself as well as the rules that guide it are incredibly diverse and extensive. For starters, cannabis products actually fall into one of three categories: hemp, Cannabidiol (CBD) oil, and marijuana. Each one of these categories is treated differently from a legal and regulatory standpoint. Complicating matters, there are also differences in the rules and regulations from one state to another.

Here is a brief rundown of each type of Cannabis product, including its current legal and regulatory standing:

Hemp

Hemp is a variety of the Cannabis sativa plant species that is grown specifically for commercial use. Hemp produces a broad range of cannabinoids, including tetrahydrocannabinol (THC), the intoxicating chemical in marijuana. Hemp, however, does not contain enough THC to produce intoxicating effects.

Many countries differentiate hemp from marijuana by the amount of THC produced by the plant. In the US, industrial hemp must not contain more than 0.3% THC.

Hemp has a variety of uses. Hemp fibers can be used to make an assortment of products including paper, clothing, textiles, rope, building materials and compost. Hemp seeds and the oil produced from them, on the other hand, can be consumed as healthy, nutrient-rich, super food.

CBD Oil

CBD oil comes from the flower and leaves of the hemp plant. It is not the same as hemp seed oil, which comes from the seed and contains little to no CBD. Over the past few years, there has been a growing demand for CBD oil as a wellness supplement to such an extent it is a sub-industry all to itself.

Both hemp and products containing CBD oil are treated the same from a legal and regulatory standpoint. CBD is also subject to Food and Drug Administration (FDA) oversight with respect to how products containing CBD can be advertised.

According to the 2018 Farm Bill, growing, processing and selling hemp and hemp derivatives is legal at the federal level, and so is transporting hemp across state lines.

There are, however, many restrictions placed on such activities. For instance, all growers, processors and dealers must be approved, registered and/or licensed by the U.S. Department of Agriculture (USDA). Hemp that is not produced in accordance with the 2018 Farm Bill is designated as illegal marijuana.

For financial institutions in particular, the Financial Crimes Enforcement Network (FinCEN) recently issued their guidance regarding due diligence requirements under the Bank Secrecy Act (BSA) for hemp-related business clients.

Marijuana

Marijuana is the dried leaves and flowering tops of either the cannabis sativa or cannabis indica plant. Since marijuana contains a significant amount of the psychoactive substance THC, it is still considered a Schedule 1 substance under federal law. Many states, however, have legalized the cultivation and selling of medical and/or recreational marijuana.

This odd contradiction between federal and state law has brought about two indirect, yet consequential results:

1. Marijuana is primarily a cash-based industry since most payment networks will not process marijuana-related transactions.
2. Many big marijuana companies rely on the investments of foreign individuals and entities.

Marijuana-related businesses (MRBs) can also be classified into one of two tiers:

1. Tier I MRB- A company that is directly involved in cultivating or dispensing marijuana
2. Tier II MRB- A company that supports Tier I MRBs, such as hydroponic suppliers, packaging suppliers, licensing consultants, or marijuana software providers

Although cannabis business banking may be challenging in the current environment, it represents a potentially lucrative emerging industry for financial institutions. With total sales of cannabis in the states where it is legal expected to reach nearly $30 billion by 2025, a growing number of cannabis-related businesses are seeking access to mainstream financial products.

Moreover, cannabis products derived from Hemp and CBD are both federally legal and considerably less taboo. This means that institutions looking for untapped markets, could get their foot in the door with less risk and uncertainty.

With MRBs, currently 36 states have legalized the distribution of medicinal and/or recreational marijuana. The largest draw for both banks and credit unions in this high-risk market is the vast untapped potential. Like any business, MRBs need access to financial services in order to survive and expand. The MRB industry, however, is expected to reach a staggering $57 billion by 2027, yet a majority of MRBs (70 percent in total) remain unbanked or under-banked.

Understanding Cannabis Business Banking Risk

Whether or not your financial institution chooses to bank hemp, CBD, or MRB customers, your will be making a risk-based business decision. There are three main areas of risk to consider right from the start:

The Risk Posed by the Cannabis Business

As mentioned above, the risks associated with banking hemp companies versus CBD companies versus MRBs all differ tremendously. Not only would you potentially need to stay updated with the current legal and regulatory status of hemp, CBD and marijuana businesses across several different regions, but there are serious know your customer (KYC) risks, too.

The big risk in banking hemp or CBD companies is that either:

• The hemp involved is actually marijuana
• The hemp or CBD company has not followed all legal requirements, such as having the correct licenses and registrations, or it is growing the hemp in a tract of land that has not been approved.

Support services provided by third parties to cannabis businesses, such as hemp testing facilities, may also put financial institutions at risk for money laundering schemes. These types of companies, however, generally do not pose the same amount of risk as direct cannabis businesses, such as farmers, processors, and dealers.

With cash-oriented MRBs, financial institutions face the real risk of legal action for money laundering and aiding and abetting in drug trafficking. But, that’s not all. Some legal MRBs are committing fraud or opening up shell companies just to gain access to the services of a financial institution. For example, an MRB may list itself as a “pharmacy”, “nursery” or “wellness center” in order to get through the onboarding process.

Risk Posed by the Beneficial Owner

Aside from the typical risk associated with politically exposed persons (PEP) or those with a criminal background, one of the biggest risks surrounding the beneficial owners of a cannabis-related business is figuring out who they are in the first place. The challenge is even greater when determining the true beneficial ownership of marijuana companies due to the prevalence of foreign investment and the prolific use of management agreements and shell companies in the industry.

Risk Posed by the Financial Product

The final area of risk to consider is that posed by the desired financial product(s). The risk to offer a deposit account differs greatly from the risk of providing a loan. Once you’ve determined the risk of the cannabis business itself and of the beneficial owner, making this decision depends on your institution’s risk appetite.

Mitigating the High Risk of Cannabis Banking from the Beginning

A great deal of mitigating the risk of cannabis business banking happens at the beginning, before a client has completed the onboarding process. There are two key steps and areas of focus your financial institution should be concerned about:

Conducting a Risk Assessment

After becoming familiar with the relevant laws and regulations across your institution’s entire footprint, you should conduct a cannabis-risk assessment and set your institution’s risk appetite for the industry. The risk assessment process with the aid of AML Compliance tools and consulting will provide an opportunity for your financial institution to see if cannabis business banking products and services truly fall within the scope of its strategy and risk appetite.

A significant part of your institution’s risk management starts with good KYC practices and systems. Thus, the risk assessment process should confirm whether there is adequate infrastructure and support in place in your AML compliance program. For instance, how is your institution scanning watchlist data, which alternative data sources will you be consulting, and how will matches be sorted and verified?

When evaluating any higher risk activities, the legal and regulatory impact should also be considered in terms of both AML/BSA compliance and potential exposure to litigation.

Developing a Thorough Onboarding Process

The Onboarding process starts with the onboarding request, followed by data capture and initial CDD/CIP, and then enhanced due diligence (EDD) for KYC. This is where much of your risk management and AML compliance happens in practice.

After conducting a risk assessment, you then need to set the risk-rating criteria and processes for risk-rating new customers. Here are a few important considerations:

• Use a comprehensive application and onboarding questionnaire to understand the nature of the business and its financial activity and to secure the necessary documentation, such as the business’ registration and license information. Because banking hemp or CBD is different from marijuana businesses, it’s good practice to have different onboarding questionnaires for each of the three types of cannabis products.

• Invest in automated onboarding technology powered by artificial intelligence and machine learning. These technologies can help your institution conduct enhanced due diligence and deep web searches for automating EDD. You’ll have better insight into the background of each business and its beneficial owners. Moreover, automated platforms such as our own DecisionIQ will not only screen for sanctions, PEP, criminal records, negative news media and more, but create an intelligent scoring engine that reduces manual processes and False Positives.

• Developing an onboarding process that reflects your risk appetite should always be considered a work in progress that you periodically return to and adjust where needed. This reevaluation process will also help your institution conduct its ongoing monitoring for suspicious activity.

In short, banking cannabis-related companies raises the level of risk for any financial institution. But your institution can mitigate the high risk in cannabis business banking by getting your onboarding process, systems and procedures in line with your risk appetite and financial goals.

.

.

• Financial Industry Regulatory Authority (FINRA)
• Financial Crimes Enforcement Network (FinCEN)
• Federal Financial Institutions Examination Council (FFIEC)

Financial Industry Regulatory Authority (FINRA)

FINRA is a private corporation in the United States that acts as a self-regulatory authority. It became the successor of the National Association of Securities Dealers in 2007 shortly after the SEC approved its formation. Since then, FINRA grew to over 3,400 employees working primarily out of Washington, D.C. and New York, NY with 20 other regional offices throughout the United States.

FINRA’s overall responsibilities revolve around regulating member brokerage firms and exchange markets, one part of which is ensuring AML compliance. With these responsibilities, the 3,400 employees oversee approximately 4,250 brokerage firms, 154,000 branch offices, and 625,000 registered representatives. As a part of these responsibilities, FINRA holds periodic regulatory exams for all member firms they oversee. These reviews help FINRA determine where they see room for improvement within these institutions for more streamlined compliance.

Despite being a private corporation, the Securities and Exchange Commission granted FINRA approval to discipline registered representatives and member firms. They also license individuals, admit firms to the industry, and create the rules that govern their behavior. In 2018 alone, FINRA levied approximately $61 million in fines and another $25 million in restitutions. This makes them one of the primary organizations you will have to deal with to achieve AML compliance if you are dealing in securities. They set the rules and regulate them, so be sure to pay attention to everything they do.

Financial Crimes Enforcement Network (FinCEN)

FinCEN was formed in 1990 with the goal of combating domestic and international money laundering, terrorist financing, and other financial crimes. They’re a bureau of the United States Department of Treasury that analyzes information about financial transactions. They are one of 147 Financial Intelligence Units (FIUs) that make up the Egmont Group of Financial Intelligence Units. FinCEN’s director summed up their mission through a statement in 2013 as, “safeguard the financial system from illicit use, combat money laundering and promote national security.” They accomplish this mission through following any financial trails that might lead to a case of money laundering, terrorist financing, or other financial crimes.

One of FinCEN’s primary responsibilities revolve around data collection and data use. They created the FinCEN Query which allows other Financial Intelligence Units to search the mass amounts of data FinCEN collects on all financial transactions. The search engine operates similar to Google making it easy for any of the Financial Intelligence Units to find any information they need. They also create four yearly reports:

• Suspicious Activity Report
• Currency Transaction Report
• The Designation of Exempt Person
• Registered Money Service Business

These reports contain their findings on various threats and indicators facing the United States when it comes to combating money laundering, terrorist finance, and financial crime

Through the use of the extensive data they collect on financial transaction, they conduct investigations into at risk individuals and organizations. This puts anyone not following AML regulations at risk of an expensive investigation that could halt your business entirely. So, to avoid a nasty letter from FinCEN, make sure you follow all financial requirements and regulations to ensure you do not participate in money laundering, terrorist financing, or any other financial crimes.

Federal Financial Institutions Examination Council (FFIEC)

The FFIEC was established in 1979 through the Financial Institutions Regulatory and Interest Rate Control Act of 1978. They are composed of five banking regulators that create uniform guidelines and standards that every financial institution must follow. The five banking regulators that make up the FFIEC include:

• Federal Reserve Board of Governors
• Federal Deposit Insurance Corporation
• National Credit Union Administration
• Office of the Comptroller of the Currency
• Consumer Financial Protection Bureau

In recent times, one of the top priorities of the FFIEC became protecting financial institutions from cyber-attacks. They achieve this through creating guidelines and standards for cyber security that every financial institution must follow. As part of their effort to help financial institutions combat cyber-attacks, they released the Cybersecurity Assessment Tool. Regulators of the FFIEC use the results of this tool as part of their examination into any financial institution.

Another helpful resource the FFIEC released to simplify compliance with the Bank Secrecy Act and Anti-Money Laundering is their BSA/AML info base. Within this infobase you can find guidelines to help you achieve AML compliance, examination manuals, and a range of other resources to help you maintain compliance. Since their overall goal surrounds helping financial institutions combat financial crimes, they aim to teach appropriate standards you should follow to maintain compliance. You can also use this database to see exactly what the FFIEC looks for during compliance examinations of your organization. This helps ensure you pass your examination when that time inevitably comes. You should look to the FFIEC to help you create procedures and maintain compliance with all BSA and AML regulations.

Do You Need Help Achieving and Maintaining AML Compliance?

These organizations are only the tip of the iceberg when it comes to navigating the complexities of AML Compliance. There is the OFAC which regulates all foreign assets, the OCC, FDIC, FRB, CFPB, and then various state level oversight agencies. These organizations play an important role in ensuring you remain compliant with all AML regulations.

If you need help navigating the complexities of AML compliance, contact KYC2020 for a consultation today. They offer software tools to help you manage all aspects of AML compliance and streamline your AML Compliance Program to ensure efficiency. KYC2020 also supports a network of qualified CAMS certified AML Compliance Specialists to help answer any of your questions and guide you through the process of achieving AML compliance. AML compliance does not have to be costly or complicated, so let KYC2020 help you decide your next steps to achieving and maintaining AML compliance in a cost effective and efficient way.

Spreadsheets for Everything

While an RA is the foundation for a good risk-based AML Regime, it is often marginalized by many non-bank financial firms.  It is done in a superficial manner, using tools that are convenient and free, but ill-suited for the job. Spreadsheets are generally the tool of choice to input, track, and manage the annual risk assessment compliance requirement. As one can imagine, this approach is rather ineffective. It lacks proper controls, is prone to human-errors, difficult to audit, share, or track revision history. Moreover, as banks enhance their KYC regimes, they require annually updated formal AML Risk Assessment documentation.  The inherent limitations of spreadsheets for RA reporting and management is obvious.

Alternatives to Spreadsheets

So then, what are the alternatives to spreadsheets? The challenge once again for most SMEs and FinTech innovators is Cost, Availability, Competence, and Convenience. In our search for alternatives, we could not find a competent RA tool that met our basic requirements, was available at low-cost, was easy to get started, and convenient to use.

When we introduced our FREE Watchlist Curator Tool, we made the following statement:

“At KYC2020, we could have invested in writing a blog and talked about why “over-screening” is an expensive problem…  Instead, we decided to have our CAMS AML specialists build a tool to help you identify what Sanction, PEP, and watchlists you should be screening based on your company’s risk profile. And we decided to make our watchlist builder available free of charge.”

KYC2020 Free AML Risk Assessment Tool

For our AML Risk Assessment Tool, we decided not to be so lazy. We not only built a tool that we could make available for FREE, but also forced our CAMLO, Joseph Iuso, CAMS, to write a Blog on the What, Why, and How’s of an AML Risk Assessment. Between the information and wisdom of Joseph’s blog and the competence and convenience of our RA tool, I believe we have got you covered. Of course, we have the standard disclaimers, and you should already know that a tool cannot replace the advice of your in-house Compliance Officer.

Get started by clicking below.

KYC2020 AML Risk Assessment Tool benefits heavily from the Federal Financial Institutions Examination Council’s (FFIEC) Risk Assessment guidelines, as well as the Conference of State Bank Supervisors (CSBS) BSA/AML Self Assessment tool.  The tool considers five (5) main categories to arrive at an aggregate risk score for your business. These are: 1) Products and Services, 2) Customers, 3) Geography, 4) Operations, and 5) Agents. For each category, you have the opportunity to specify the High, Medium, and Low Risk definitions inherent to the business. For the inherent risk definitions you then specify your controls and mitigation measures to arrive at the residual risk; the risk that still remains after application of your counter-measures. This residual risk is then scored and aggregated across all categories to complete your risk assessment.

Who said it would be Easy

Sounds complicated? That’s because it is. Even for AML specialists working on a low-risk profile business, this is a minimum 2+ hour investment of time. It is for this reason the tool has the ability to save work and complete the assessment over multiple sessions. With a little bit of study, watching our Get Started Video, and rolling up your sleeves you can get through with your risk assessment on your own and for FREE!

Need Help with your RA?

For those who need a little bit of help completing, we offer some reasonably priced paid options to speed up your risk assessment process and follow best practices. These include, access to business specific templates that can be customized to speed up the assessment, different consulting packages to help prepare, review, and/or audit your Risk Assessment by our CAMS or VSKILLS certified AML specialist.

Once again, there is no catch. The tool is no obligation and we do not take any payment information. We do hope you might take the time to see what awesome and affordable AML compliance solutions we offer, from Global Watchlist Data to Sanction Screening to AML compliance consulting services. Chat with us online now, email us, or just use the tool. Our aim is to help you reduce the cost and friction of AML compliance.