The objective of cash management is to maintain control over the cash position, which is the most valuable liquid asset.
The significance of cash rests on the fact that it is used to pay and propel business operations and is crucial for a business’s financial stability. As sales generate cash, the cash will be disbursed (Business Jargons, 2016).
Financial institutions that provide services to commercial cannabis businesses are subject to stricter requirements and material regulatory risk, depending on the jurisdiction. Given these limitations, financial institutions are cautious when establishing a relationship with a commercial cannabis business. In addition, financial institutions that service commercial cannabis businesses require extensive documentation or restrict their services to certain commercial cannabis industry sectors. As a result, commercial cannabis businesses may not be able to establish a working relationship with a financial institution and are forced to operate without traditional banks as part of the cash management process. When the commercial cannabis business uses a non-bank vendor as part of its cash management process, it must implement the CRMF. If a financial institution was involved, these controls would be provided within the banking relationship as regular deposits and withdrawals are made from the account.
Risk Factors
The banking system leverages best practices that have been designed and implemented by many financial institutions and the banking system is held accountable to a high standard in account controls. In addition, the banking system is responsive to regulations that provide additional controls on the system. Banks have expertise in identifying and controlling the risks of cash handling, transaction auditing, fraud, and system access abnormalities. The volume of bank customers that have similar needs allows a substantial increase in the bank’s breadth and maturity of controls because the expense can be spread across many customers with similar risk profiles. If a commercial cannabis business does not have a formal banking relationship, it creates an opportunity for money launderers to exploit the internal cash management practices of the commercial cannabis business.
Money launderers are attracted to cash-intensive businesses due to the diminished financial audit trail. The complex system of storing cash, cash flow from receivables and vendors, and transporting cash has many vulnerabilities. Money launderers may infiltrate cash management processes by preying on commercial cannabis businesses through employees and vendor relationships.
The risk that employees may be forced or coerced into fraud or embezzlement is increased when a commercial cannabis business assumes increased internal responsibility for cash management. Money laundering risk is present in all instances of cash management processes and is magnified when the controls have single points of failure due to the lack of dual control and segregation of duties. Banks operate a risk model that emphasizes dual control and segregation of duties, which is expensive and complex to operate outside of the bank environment.
When paying or receiving payments in cash, the risk that vendors may be owned or controlled by money launderers increases. The ability of a vendor to conceal the identities of its owners and the rudimentary financial audit trail left by cash transactions make this type of relationship a higher money laundering risk.
The following should be considered red flags regarding internal cash management:
- Increasing accounts payable and account receivable balances
- Employee exhibiting a lavish lifestyle that cannot be supported by his or her salary
- Employee is reluctant to take a vacation
- Employee regularly disregarding policies and procedures related to segregation of duties, dual control, or overrides
- Employee taking a significant interest in business processes he or she is not responsible for performing or has any need to understand
- Payments by or to vendors in large, round dollar amounts
- Payments by or to vendors do not fluctuate in frequency or size
- Payments by or to vendors are significantly higher or lower than expected in their contract or history
Risk Mitigation
Due to the nature of internal cash management, risk mitigation falls into three key control activities: cash management, vendor risk management, and ethics and whistleblowing. The following sub-sections provide mitigations for each. The following are a sample of risk mitigations that should be considered:
Cash Management Risk Mitigation
Commercial cannabis businesses should establish or enhance control activities, training, and assurance for internal cash management.
- Formalize cash management control activities that include handling, receiving, safeguarding, transporting, depositing, and accounting of all commercial cannabis cash assets; these may include:
- Implementing dual control for cash counting, cash withdrawal, cash replacement, and cash transportation
- Implementing segregation of duties between the recording of cash activities and approval of the record
- Requiring mandatory vacation for cash management employees that requires one full week of vacation each year
- Implementing risk-based controls over cash vault access and audit trail/cash register logging of employee activity
- Conducting periodic risk-based reconciliation of cash management transactions
- Conduct periodic monitoring of overrides involving the cash-handling procedures, such as evaluating unusually high or low levels of overrides by specific employees or specific business locations
- Provide risk-based training for employees to detect and report unusual employee activity
- Conduct periodic monitoring of cash management activities using business-defined risk metrics
- Implement periodic risk-based monitoring and testing of cash management processes
Vendor Risk Management Risk Mitigation
Commercial cannabis businesses should establish or enhance control activities, and training for vendor risk management.
- Formalize control activities for vendor risk management that establish procedures to assess vendor risk, conduct initial due diligence, and conduct ongoing monitoring; these may include:
- Implementing due diligence procedures that identify and risk rate vendors who pay or receive cash
- Establishing the expected cash payments by size and frequency throughout the contract or twelve-month period
- Implementing risk-based procedures to evaluate a vendor’s controls for cash management
- Implementing risk-based procedures for the termination of the vendor relationships that fall outside of the risk tolerance
- Require contract terms and conditions based on the risk associated with a vendor
- Provide for the right to audit
- Increase termination options
- Require vendor participation in training provided by the commercial cannabis business
- Enhance or create onboarding and ongoing risk-based training for vendor risk management to detect and report unusual cash management activity
- Conduct periodic monitoring of high-risk vendors; these may include:
- Confirming contract terms are market appropriate
- Verifying that products, services, and contractual conditions have been rendered
Ethics and Whistleblowing Risk Mitigation
Commercial cannabis businesses should establish or enhance training on ethics and whistleblowing control activities in cash management.
- Enhance or develop employee training to detect and report unusual internal cash management activity
- Implement vendor training on ethics and whistleblowing to detect and report unusual internal cash management activity
