Many commercial cannabis businesses, their vendors, and their business customers operate on a cash basis. There may be additional risk issues to consider depending on the physical location of the commercial cannabis business, their vendors, and their business customers.
Many jurisdictions, law enforcement, or government departments will identify financial crime areas of concern. The commercial cannabis business should consider when geographic locations lend themselves to financial crimes specific to the commercial cannabis industry. The identification of these areas can aid the commercial cannabis business with their risk-based approach to geographic risk.
Risk Factors
Criminals disguise illicit cash they have obtained and convert into funds that appear legitimate without arousing suspicion. The goal is to keep the ultimate beneficial owner(s) anonymous. Commercial cannabis businesses are at a higher risk of being subverted for money laundering due to their cash-intensive activities. While any commercial cannabis business could be at risk, those in geographic areas known for financial crimes are more likely to be compromised by money launderers.
Money laundering risk increases where material value or volume of cash transactions are present and the commercial cannabis business, vendors, or business customers’ locations overlap with high intensity financial crime areas.
The red flag for the geographic locations risk driver is determined by the location of the commercial cannabis business, their vendor, or their business customer in a high intensity financial crime area. The red flag for the geographic locations risk driver will elevate the money laundering risk where risk issues are present in the treasury services and third parties, customers, and employees risk drivers.
Examples of Geographic Areas Known for Financial Crimes
- High intensity financial crimes areas, which are areas designated in the 1999 National Money Laundering Strategy and conceived in the Money Laundering and Financial Crimes Strategy Act of 1998.
- Offshore Financial Centers identified by the International Monetary Fund (IMF);
- Un-cooperative Tax Havens identified by the Organisation for Economic Co-operation and Development (OECD);
- Major Drug Transit or Producing Countries identified by the President of the United States through the Department of State;
- Major Money Laundering Countries (Primary Concerns, Concerns, or Monitored) as identified by the U.S. Department of State in its International Narcotics Control Strategy Report (INCSR);
- Weak AML Legislation/Regulation Countries with respect to sixteen factors cited by the U.S. Department of State’s INCSR; and
- Worldwide Governance Indicators (Regulatory Quality, Rule of Law, and Control of Corruption) as determined by the World Bank.
Risk Mitigation
Risk mitigation for high intensity financial crime area risks fall into three key control activities: risk program enhancements for higher-risk relationships, vendor risk management, and ethics and whistleblowing. The following are a sample of risk mitigations that should be considered:
Risk Program Risk Mitigation
Commercial cannabis businesses should establish or enhance risk assessment, control activities, and assurance for the risk program.
- Create a geographic risk assessment that identifies high intensity financial crime areas
- Implement a mandatory one-week vacation each year for key employees in high intensity financial crime areas
- Implement risk-based controls for vendor and business customer contract acceptance when paying or being paid in cash
- Conduct periodic monitoring of cash payment activities in high intensity financial crime areas using business defined risk metrics
- Conduct periodic testing of cash payment and receipt processes in high intensity financial crime areas
Vendor Risk Management Risk Mitigation
Commercial cannabis businesses should establish or enhance control activities and training for vendor risk management to control and monitor higher-risk relationships in high intensity financial crime areas.
- Formalize control activities for vendor risk management that establish procedures to assess vendors and business customers in high intensity financial crime areas, conduct initial due diligence, and conduct ongoing monitoring; these may include:
- Evaluating vendors and business customers based on adverse public news or complaints
- Evaluating owners and controllers for negative news or complaints
- Evaluating the need for cash payment or receipt
- Establishing the expected cash payments by size and frequency throughout the contract or twelve-month period
- Implementing risk-based procedures for the termination of the cash-based vendor relationships that fall outside of the risk tolerance
- Require contract terms and conditions based on the risk associated with vendors in high intensity financial crime areas
- Increase termination options
- Require notification of changes in ownership or control
Ethics and Whistleblowing Risk Mitigation
Commercial cannabis businesses should establish or enhance control activities and training for ethics and whistleblowing.
- Provide employee training to detect and report:
- Unusual transactions in high intensity financial crime areas
- Employee exhibits a lavish lifestyle that cannot be supported by his or her salary or a disregard for company controls
- Employees that have substantial debt that is suddenly resolved
- Employees that have a significant interest in business processes that they are not responsible for performing or have any need to understand
- Vendor’s or business customer’s employee exhibits a lavish lifestyle that cannot be supported by his or her perceived salary
- Vendor or business customer requests payments come from an unrelated individual(s) or entity; payments go to a separate individual(s), or entity, an unusual or uncustomary way to facilitate the transaction, or is secretive or evasive about the reason the transaction must be paid or received in cash
- Provide vendors and business customers in high intensity financial crime areas training on ethics and whistleblowing reporting procedures