The largest exit of cannabis product from the track and trace system is customer sales.
Jurisdictions attempt to limit the risk of diversion by limiting the amount of cannabis product a customer is able to purchase over a specified time frame. However, the number of licensed consumer sales locations, large number of legitimate customers, and ability to spread purchases out over time makes it difficult to detect diversion through consumer sales.
Risk Factors
As with many other industries, commercial cannabis has its offenders that, undeterred, could cause significant loss of reputation to the commercial cannabis industry and brands through their actions. As a result, criminals may try to divert cannabis product by getting around the legal purchase limit through a process called looping.
Looping is the practice of evading legal cannabis purchase limits by procuring cannabis products at or below the legal limit repeatedly during a limited time period to obtain an illegal amount of cannabis product.
The cannabis product is then deposited elsewhere and the criminal “loops” back to make another purchase. The process can be repeated multiple times within the same day, or even the same hour. Looping isn’t always obvious to identify because it is covert in nature and may involve multiple transactions by a single customer, multiple customers working together, multiple locations, and/or inside collusion.
Red Flags
The following should be considered red flags for looping
- A customer is reluctant to provide necessary identifying information required for POS tracking, or is reluctant to procced with a transaction after learning that identifying information is required to complete the transaction
- A customer or group tries to persuade employees from performing proper identification or required recordkeeping
- Employees are overheard telling customers how to evade the recordkeeping requirements
- After-hours sales activity occurs
Risk Mitigation
Risk mitigation for looping falls into two key control activities: inventory management and ethics and whistleblowing.
Inventory Management
Commercial cannabis businesses should establish or enhance the internal control environment, risk assessment, control activities, information and communication, and assurance for inventory management.
- Assign a qualified individual to monitor for looping
- Enhance the risk assessment to identify the commercial cannabis business’s customer base, products and services, and geographic location to assess possible looping exposure
- Establish processes and procedures for identifying potential looping and establishing monitoring thresholds to identify potentially suspicious activity
- Conduct periodic monitoring to identify any control failures specific to looping, and report the results to management
- Implement risk-based enhanced procedures and processes for deterring looping
- Implement risk-based enhanced self-reviews where looping is suspected
Ethics and Whistleblowing Risk Mitigation
Commercial cannabis businesses should establish or enhance the internal control environment and training for ethics and whistleblowing.
- Enhance the policy to formalize the commercial cannabis business’s intent to prevent diversion
- Provide employee training for:
- Detecting unusual transactions that give the appearance of looping
- How to report looping concerns directly to the risk officer or other responsible person.