Commercial cannabis businesses that have cash service providers may have difficulty establishing a relationship with a financial institution.
“Only one in about 30 banks or credit unions across the United States accepts a [commercial] cannabis business as a customer. Those that do take on cannabis companies often charge them hefty monthly account and transaction fees, in part to help offset the extra costs they incur by doing so” (Hudak and Klein, 2019).
Financial institutions are required to implement robust anti-money laundering control activities that have been matured over decades. When a commercial cannabis business is required to operate largely in cash, it may rely on alternative cash service providers that do not have the same maturity of anti-money laundering control activities. The commercial cannabis business may unintentionally be linked to money laundering violations by these cash services.
When faced with the inability to establish a traditional banking relationship, commercial cannabis businesses may work strictly in cash. Cash-only transactions increase the complexity of managing payment flow, security, and financial forecasts. Large payments and inventory of cash require security logistics. The cyclical nature of accounts payable and accounts receivable creates logistical problems when assuring the business will have enough cash on hand to pay bills while not creating a significant surplus. Many commercial cannabis businesses contract a cash service provider to mitigate the risks of cash transactions. A cash service provider can take many forms, such as an individual providing the service, a company, or a licensed non-bank financial institution.
Risk Factors
Many commercial cannabis businesses handle large amounts of cash daily. Commercial cannabis businesses may be targeted like any other cash-intensive business, as money launderers are looking for vulnerabilities in cash-handling control activities. By law or regulation, commercial cannabis businesses are normally required to have reasonable control activities to assure they don’t assist in money laundering, whether or not with knowledge. The control activities normally require record keeping and identification of unusual activity.
The following should be considered red flags regarding cash service providers:
- Payments come from an unrelated individual(s) or entities
- Requests an unusual or uncustomary way to handle the transaction
- Unusual lack of concern regarding transaction costs
- Charges little to no fees to use their services
- Refusal to provide beneficial ownership and control information
- Unwilling to file government forms required for cash handling
- Transactions are higher or lower than expected based on contractual expectations or history
Risk Mitigation
Risk mitigation for cash service providers falls into three key control activities: monitoring, vendor risk management, and ethics and whistleblowing. The following are a sample of risk mitigations that should be considered:
Vendor Management Risk Mitigation
Commercial cannabis businesses should establish or enhance the internal control environment, information and communication, training, and assurance for vendor risk management.
- Appoint an employee who is qualified to monitor the vendor risk management function and provide him or her with the appropriate responsibility and authority
- Formalize control activities for vendor risk management that establish procedures to assess cash service provider risk, conduct initial due diligence, and conduct ongoing monitoring; these may include:
- Implementing due diligence procedures that identify and rate cash service providers based on risk criteria
- Establishing the expected cash transactions by size and frequency throughout the contract or twelve-month period
- Implementing risk-based procedures to evaluate the cash service provider controls for cash management
- Implementing risk-based procedures for the termination of the vendor relationships that fall outside of the risk tolerance
- Provide risk-based training for cash service providers to detect and report unusual cash management activity
- Require contract terms and conditions based on the risk associated with a vendor
- Provide for the right to audit
- Increase termination options
- Require vendor participation in training provided by the commercial cannabis business
- Require notification of changes in ownership or control
- Conduct periodic monitoring of cash service provider transactions using business-defined risk metrics
- Periodically have the appointed employee report the monitoring results to the risk officer
Ethics and Whistleblowing Risk Mitigation
Commercial cannabis businesses should establish or enhance training on effective ethics and whistleblowing control activities.
- Provide employee training to detect and report unusual cash service provider activity
- Provide vendor training on ethics and whistleblowing reporting
