Cannabis Payments Part l - Can you be a cannabis company, accept payments other than cash, and still be compliant?
Can you be a financial institution, provide cannabis payments processing, and still be compliant?
With a well-formulated plan created by industry experts and a whole heck of a lot of paperwork, you most certainly can. But we’ll get into that in a minute.First, it's important to understand why providing services to cannabis businesses is so difficult. Understanding these barriers is the first step towards overcoming them. This way, we can serve the industry without undermining the federal government.
Once you understand this, it's easy to see that most of the payment processing solutions out there for cannabis payments aren’t actually compliant solutions.
Overview: Federally regulated payment system and an illegal product.
These are all things we all already know, but we're going to go over it anyway! (If you already get it and just want to learn how you can accept cannabis payments in a compliant way, get more info below!)
Our banking systems and payment railways are all regulated at the federal level. Money deposited into most banks must be FDIC insured. Any deposits from cannabis businesses are profits gained from “illegal activity”.
Since cannabis is illegal at the federal level, any funds that result from its sale are "illegally" gained proceeds. Under the statutes of the AML (Anti-Money Laundering), it's a federal crime to knowingly engage in financial transactions where the money was gained from unlawful activity. If you do, it would be money laundering.
Money laundering is the process of taking illegally gained money and putting it through a series of banking deposits and transfers with the intention of concealing the original source of the money. If a bank were to deposit those funds and then let the depositor withdraw, transfer, or otherwise use those funds, they would be committing money laundering.
Serving businesses in the cannabis industry can put banks in danger of both civil and criminal liability. And can put them in danger of being charged with “aiding and abetting” a federal crime.
Overview of banking requirements to meet Anti-Money Laundering compliance.
In order to fight money laundering, the federal government enlisted financial institutions and banks to be the front line.
They did this through the Bank Secrecy Act (BSA), also known as the Anti-Money Laundering (AML) law, passed in 1970. Provisions of the Act require financial institutions and government agencies to work together to fight money laundering in America.
The Act established regulations that financial institutions can follow to meet BSA/AML compliance. The regulations outline the type of detailed information banks must record about each transaction. They also require banks to report any suspicious activity. By following these regulations, banks help government agencies combat money laundering and fulfill BSA requirements.
The Bank Secrecy Act (BSA) outlines the main requirements for Anti-Money Laundering compliance:
- The Act requires banks to create an “effective compliance program”.
- A Currency Transaction Report must be completed for any transactions over $10,000.
- A Suspicious Activity Report (SARs) must be filed for any suspicious transactions that might signal criminal activity.
- Must be able to properly identify parties conducting the transactions.
- Must maintain a detailed paper trail through accurate record keeping of all financial transactions.
The Bank Secrecy Act established compliance and enforcement avenues.
Obviously, the government is not just going to trust banks to follow the regulations. There must be checks-and-balances to ensure compliance. They must be sure banks are able to comply with the regulations, and they needed an entity to enforce that compliance.
So they created a bureau within the Treasury Department to create and administer compliance program guidance for banks. And they tasked them with enforcement of the BSA AML compliance.
To make sure banks were able to successfully comply with regulations, the BSA established guidance through what is internationally known as the “5 pillars of BSA AML compliance”.
These 5 pillars serve as the foundation of an effective compliance program:
- Development of Internal Controls - the establishment of internal policies and procedures.
- Designation of a compliance officer with the education to manage the program effectively.
- Creation of BSA AML employee training program, periodic updates to the program, maintaining detailed records of staff who received training.
- Third party testing of the compliance program to prove the internal controls are effective.
- Procedures for conducting Customer Due Diligence and monitoring- KYC (Know Your Customer) and now KYCC (Know Your Customers Customer).
The BSA mandates the establishment of a bureau to enforce BSA AML compliance.
Another BSA mandate was the establishment of an enforcement unit to “implement, administer, and enforce” compliance with the Act. The Financial Crimes Enforcement Network (FinCEN), established in 1990 by the US Treasury Dept., is that enforcement unit.
FinCEN’s primary goal is to protect the financial system and combat money laundering through the “detection and deterrence of financial crime”. But it is also tasked with helping financial institutions achieve compliance.
To bridge the gap between federal regulations and state marijuana laws, FinCEN developed a set of rules and best practices for banks. These rules create a pathway for banks to be able to work with MRBs.
Banks were already required to conduct a certain level of customer due diligence. But the due diligence and ongoing monitoring required under FinCEN guidance is considerably more far reaching.
Banking the cannabis industry is a challenging issue for the FDIC. They’re not allowed to condone banks serving the industry. All they can ask is that if you are going to provide services to the industry, please adhere to FinCEN Guidelines.
Banking cannabis complicates BSA AML laws.
The BSA laws were created to help detect and deter criminal activity and money laundering. In other words, catch the bad guys. It didn't take into account State’s Rights to legalize something that the federal government deems illegal. As I'm sure you can see, this puts banks in a bind.
Catching money launderers should be an if-and-when kind of thing. They were planning on that happening every single day of the month all year long. Cannabis businesses are legal on the State level. But banks are bound by federal regulations. By assisting cannabis businesses in banking, deposits and payments, there is a lot of “suspicious activity” going on.
Banks have a fiduciary responsibility to not only ensure that funds received are appropriately reported, but that funds sent are appropriately reported. There must be a paper trail. And that means they must file SARs reports for every single transaction involving a marijuana related business.
Banking Cannabis requires increasing staff, robust protocols, and a bit of faith.
But cannabis clients bring a lot more paperwork than just SARs reporting. For example, banks must verify daily POS receipts against deposit amounts for every deposit for every cannabis client. They must complete in-depth customer due diligence, including ongoing monitoring.
The main goal is to “follow the money”. There must be complete transparency of where the money comes from and where it goes throughout its life. There must be a detailed and accurate paper trail so that any transaction can be traced back to the source at any time. This is in place to prevent black market money from being laundered through dispensaries.
These are just a couple examples of the additional traceability measures required to serve the cannabis industry. In addition to staff that manages normal BSA AML requirements, banks usually need to establish an entire team solely for their cannabis clients.
This creates a serious administrative burden for banks to make sure compliance programs are in place and the required federal reports are filed correctly. It also opens the bank up to the danger of incorrect filings. Especially when you consider the sheer number of SARs reports that would be filed for cannabis clients. In the event there were filings filled out incorrectly, it could subject the bank to incur severe penalties.
Following FinCEN and BSA AML guidelines, however, still does not grant immunity to financial institutions from federal prosecution. They take on the inconvenience of constant SARs report filing, risk of federal prosecution, and risk losing their federal charter. Banks that do choose to provide services to the industry just have to take a deep breath and have a little faith.
Credit card processing can not (yet) be a truly “compliant” cannabis payments solution.
Merchant accounts to accept Credit Cards do not have consistent compliance nor complete transparency.
*Credit card issuing banks such as Wells Fargo, Chase, and Citi are also FDIC-backed financial institutions. In order to gain FDIC insurance, the FDIC requires banks to “guarantee that they are not facilitating fraudulent or other illegal activity”.
*When the bank funds a customer’s credit card purchase, they are essentially giving that customer a loan. Then, they are sending those funds to the merchant's acquiring bank - money gained from a fraudulent activity per the Feds. Finally the those funds are sent onto the merchant's bank. National credit card issuing banks cannot fund cannabis payments and still guarantee complete transactional transparency. After all, how are they to know if the bank they're sending funds to is knowingly working with a cannabis business let alone also have confidence that the merchant's bank also has a compliant program in place?
*To process credit cards, business owners must have a merchant account and be assigned a merchant ID (MID). Most acquiring banks and processors cannot provide a Cannabis MID because there is no MCC or SIC code for credit card transactions to designate a business as being cannabis. Furthermore, they can't guarantee full transactional transparency. You can't have a compliant solution where all parties know what/who they’re working with when you don't have a correct MID.
The problem with merchant accounts and credit cards is that there is not complete transparency and consistent compliance with all entities involved. In addition to the merchant and the customer, you also have the merchant’s bank, the customer's card issuing bank, and the merchants account sponsoring bank. All of these parties need to have confidence that the other parties have compliant cannabis programs in place and are knowingly servicing the industry.
For the transactions to be “compliant” in cannabis payment processing, each entity would have to have an effective compliance program that meets BSA guidelines. Each entity funding or receiving money from the transactions would have to file SARs reports. And each entity would have to know and prove that the other entities each have a compliant program.
FinCEN guidelines, along with BSA AML laws, require detailed paper trials and robust tracing of every dollar and every transaction. Currently, that is just not possible for the entities involved in the credit card processing networks.
For this reason, all credit card payment solutions being advertised are not truly compliant cannabis payment solutions.
Compliant cannabis payment processing is achievable with the right partners.
It all comes down to KYCC, transparency, and traceability. This is the only way a federally regulated payment system can handle funds from the sale of a federally illegal product. By examining the issues with adhering to current FinCEN guidelines, as well as BSA AML laws, we’re able to begin to see what a “compliant” payment solution needs to look like.
In our next article, we’ll dive into what it took to build a compliant cannabis payment solution. We’ll show how, with the right partners, we’re able to create a solution where cannabis companies can accept payments in an honest and transparent manner.
Our goal was to create a foundational cannabis payments solution that can easily be expanded to credit cards in the future. And then to have that payment solution serve as a test case for the federal regulators to prove that cannabis payments can be done responsibly. That's exactly what we've accomplished.
If you can't wait for next week’s article “What Constitutes 'Compliant' Cannabis Payment Processing?”, feel free to jump to the website for more information now. Or, better yet, call us and talk to one of our ETA-Certified payments professionals. They’ll be happy to address your questions directly.