By Andy Montgomery | CEO and Founder of HDCS | Former Bank CEO

Is Banking Cannabis Safe?

It is very unlikely that the SAFE Banking Act for cannabis banking will get past the Senate this year and become law. Still, if you pay acute attention to regulators at the State and Federal level, you can hear a decided change in the tone of their voices regarding financial institutions that choose to provide services to cannabis related businesses. In nearly every speech she gives these days, FDIC Chairwoman, Jelena McWilliams, points out that member institutions would be fine with their regulators in banking cannabis if they adhere to the existing guidance. Chairman Hood of NCUA has been making those same comments about its member institutions for some time. And a few States have acted to provide statutory protections to financial institutions that provide services to the cannabis industry.

Are you Unintentionally Banking Cannabis?

The truth is that approximately $20 Billion goes from legal cannabis related businesses into financial institutions each year. That amount continues to grow and does not include the illegal or illicit cannabis business, some of which flows undetected through the financial services industry illegally. As there are a limited number of financial institutions across the nation openly accept cannabis deposits, a good portion of cannabis revenue is flowing into financial institutions without the institution’s knowledge, or, at least, without a risk-based program that identifies and mitigates that risk. And, as “best practices” get learned and implemented, more and more BSA/AML audits are uncovering hidden cannabis deposits.

What is Your Bank’s Risk Appetite?

We find in our outreach that financial institutions take one of three positions as it relates to cannabis:

1. The financial institution doesn’t want to bank cannabis now or in the future. This is the most common position. However, in presenting this risk policy, institutions need to ensure that their practices and deposit portfolio match their risk appetite statement.
   If the institution does not adjust current policies, training and oversight, not only could the institution ultimately be presented with the unwanted finding that they are banking cannabis, but because they don’t have enhanced due diligence in place they could find that it is banking illegal cannabis business.
2. The institution wants to be ready for cannabis when a SAFE Banking Act passes. We run into a surprising number of institutions in this category. Given the statements that regulators are making, one has to wonder if it makes sense to wait for congressional action.
   Cannabis businesses will be very loyal/sticky customers to the institutions that are early movers in the space and, as they have previously been shut out of the financial services industry, the businesses represent a number of cross-sell opportunities.
3. The institution is openly banking cannabis. This number is a small part of the industry. What is smaller still are those banks that have approached the industry with the intention to create safe and profitable programs. Our advice to these banks is to not have an ad-hoc program, but instead approach the business with the thoughtfulness and preparation that Is needed for what is the highest risk deposit industry.

SAFE Banking is on the Horizon

When a Federal cannabis “Safe Banking Act” is eventually passed, it will be accompanied by increased regulatory scrutiny and a tightening of standards for all institutions regardless of risk appetite for the industry. As of today, we do not have Federal guidance providing the governance and rules for banking cannabis related businesses. When FFIEC establishes the rules for institutions, each institution that is in a state in which cannabis is legal and flourishing will have to put controls and protocols in place to ensure that it is adhering to the new regulations, state and local laws, and the risk appetite that was established by its board of directors.

There is a Safe and Profitable Solution

At HDCS, one of the many things that separates us from our competitors is that we have an affordable solution for vetting your cannabis customers created by bankers for bankers.

We would be happy to meet with you to understand your objectives and risk appetite and share our view of the best practices involved in establishing a safe and profitable cannabis banking program. Use this link to schedule a video conference at a time that is convenient for you and your team, or email me directly at

a.montgomery@hdcompliance.com. Let us give you a tour of our data portal and demonstrate what a risk-focused and profitable cannabis banking program could look like for your financial institution.

Why Ask Why?

A few years back, as the head of a compliance department at a large money services business (MSB), I was asked why we needed to conduct an internal risk assessment again, considering over the past 10+ months the company completed an independent review and three state regulatory exams. The supervisor who asked the question said, in a half joking manner, “We’ve completed the last risk assessment 12 months ago and passed all our audits and exams this past year, how much risk could we really have?”

Assessing the Assessment

It was a good question. Over the past year, we had received very high marks on our audits and exams with only minor findings and recommendations. I decided I was going to use this as an educational opportunity and to teach my AML staff the importance of conducting a risk assessment on an annual basis, regardless if you think you need it or not.

I began the conversation, repeating the supervisor’s question and asked my staff how many of them agreed. It was about 50/50 (of a staff of 12) between agreeing that we needed an annual risk assessment and not needing one because of the recent successful exams. This was about what I expected since over half the staff had only been in the AML field for around a year or so.

In order to make this an interactive learning environment, I pulled out a dry erase marker and had the staff call out to me, as I wrote every new product or service we offered in the past 12 months; all new AML monitoring typologies and best practices we developed; any new risk categories we created for Enhanced Due Diligence (EDD) / Know Your Customer (KYC) as well any current industry trends or news they could think of that might pose a risk to the business. After half an hour of having topics yelled out to me, we have an impressive list of over 30 items.

Light Bulb Moment

Next, I had the staff pull up the previous year’s risk assessment and compare how many of the items on our list were already covered and if so, what risk rating they were assigned. It was during this next half hour period that I could see the “light bulbs” go off over their heads. Each of my staff members began to realize that 20 or so items on our list were not included in last year’s risk assessment. They understood that the MSB world is incredibly fluid and new risk arise all the time. Just because we identified the risk as part of a suspicious activity review, wrote up a methodology on how to identify the activity and a procedure on how to work the problem, the risk was still there and needed to be memorialized. This, I told the “class” was why an annual risk assessment is so important.

“In order to protect your company from risk, you must first know what the risk is and how much danger it presents. Then you can work on mitigating the risk.”

Risk, I told them, can be mitigated down to low, but the risk never leaves. An annual risk assessment that incorporates new risk as well as reviews older existing risk is important to make sure that ALL Risks, not just Current Risks are always being reviewed. The example I used was, if a building sitting on a flood plain buys flood insurance, the risk is still present. All the insurance did was give peace of mind that if damage were to happen, the company would receive funds to rebuild. You still must review and rank the risk and determine your best estimate of the amount of damage the flood would create every year to know how much insurance to keep. The same goes for any other industry like MSBs, credit unions and banks. To protect your company from risk, you must first know what the risk is and how much danger it presents. Then you can work on mitigating the risk.

As I saw nods of understanding from the staff, I felt this was a good time to address the original question from the supervisor, “We’ve completed the last risk assessment 12 months ago and passed all our audits and exams this past year; how much risk could we really have?” I repeated the question aloud once and then a third time to the team. I encouraged the supervisor that it was a fair question and in my opinion a trap that a lot of compliance people can get themselves into. I asked my staff “Why have independent audits and regulatory safety and soundness exams if they don’t identify all the risk for you?” I of course received the typical, it’s required by law answer, but for the most part, the team did not have the years of experience to answer the question. So, I asked a different question “Why are we required to have an annual independent audit and regulatory exams by the states?” The staff knew these audits were required and if we failed our MSB license could be jeopardized, but they did not understand the true reasoning behind them. It was what I expected. So, I sat down and looked each person in the eye and told them my thoughts on the matter.

I said, the states require that we take steps to protect the citizens of those states from being scammed, from allowing fraud into our system and that we do our part in helping to stop the “bad guys” by filing suspicious activity reports. Furthermore, I told them, the states require that we be financially sound and have safeguards in place to protect the integrity of the financial system. In short, the purpose of the regulatory exams and the independent audit is to make sure we are compliant with laws and regulators first and foremost. However, we have to have a strong AML program to ensure that honest people can transmit their money safely and that we do our best to stop the dishonest ones is the reason why we have regulation in the first place, and the key tool that every AML department has to achieve this task is its risk assessment. Without knowing where our risk lie, how can be put in measures to reduce the risk and safeguard our customers?

“A risk assessment is not just an annual thing you do to get it over with. It is something that must be embraced and nurtured.”

 As the meeting was nearing the three-hour mark, I had one final parting bit of advice for my staff. I told them; I had been in the compliance industry for over 15 years. Some of you will get out of compliance after a few years and try a different industry, some of you will grow and become superiors and managers and possibly even BSA Officers. All of you, no matter what industry you go into or what level of management you achieve, will need to understand that regardless of the business you are in, and the department you work for, there will always be risk. Understanding that you need to identify those risk sooner rather than later and put a plan in place to mitigate the risk will ensure that you will be successful in your career. A risk assessment is not just an annual thing you do to get it over with. It is something that must be embraced and nurtured. The risk is never going to leave, and new risks are right around the corner. Reviewing and updating your risk assessment on a regular basis will ensure you stay on top of your risk. Plus it never hurts that having a strong risk assessment process will impress state regulators as well as your future manager. This is something that all of us should strive to do.

As the staff headed back to their desk, the supervisor who asked the original question came up to me. He told me that he appreciated how I answered his question and that I included the whole staff. He thought it was good that the knowledge I passed on reached every level of the staff. He appreciated that I could have just told him and him alone the answer, but that I included everyone. I thanked him for asking the question in the first place. It was a good opportunity for me to show case one of my core management beliefs, that “We all learn and adopt together.”

He looked at me with a inquisitive look, “We all learn and adopt together?” He asked. That is correct I replied, but that is a story for another time…

Chris Gunias
HDCS, Inc. / Chief Compliance Officer