Recent NCUA Enforcement Action Underscores Ongoing Importance of Compliance with FinCEN Guidance for Banking Marijuana Related Businesses

The Secure and Fair Enforcement Banking Act (“SAFE Banking Act”)¹ — that would make it easier for interested financial institutions to provide banking to marijuana-related businesses (“MRBs”) — is currently making its way through Congress yet again.²  While many expect it will finally pass, a recent enforcement action in Michigan reminds financial institutions why it is essential that institutions banking in the cannabis space comply with Financial Crimes Enforcement Network’s guidance (“FinCEN Guidance”) governing banking with MRBs, as well as any forthcoming regulatory guidance issued after the SAFE Banking Act is passed.

Background
As of the date of this writing, cannabis, in one form or another, is legal in all but two states.³  Despite the fact that the majority of states have legalized cannabis in some way, it remains illegal at the federal level.  Because cannabis is still illegal federally, financial institutions that bank with MRBs may run afoul of federal anti-money laundering laws and the Bank Secrecy Act. Due to these risks, many financial institutions have declined to work with companies that are operating in this space, whether those companies directly touch the plant or operate in the margins. 

In order to address the growing number of “state ballot initiatives that legalize [cannabis] under state law,” in 2013, the Department of Justice (“DOJ”) released the First Cole Memo, which outlined the DOJ’s eight enforcement priorities with respect to marijuana.⁴ In 2014, the DOJ released a Second Cole Memo which discussed how the Bank Secrecy Act and other money laundering laws applied to financial institutions banking with MRBs.⁵  In the Second Cole Memo, the DOJ stressed that financial institutions banking with MRBs must comply with the guidance issued by FinCEN.⁶

The FinCEN Guidance was released concurrently with the Second Cole Memo⁷ and requires that banks and other financial institutions comply with a multitude of due diligence and reporting obligations in order to bank with MRB clients. Specifically, the FinCEN Guidance requires financial institutions to conduct extensive customer due diligence, including confirming that the MRB has all the proper state licenses.⁸ Further, financial institutions must continuously monitor businesses for suspicious activity, and must file Suspicious Activity Reports (“SAR”) for any transaction involving MRBs.⁹ If the transaction specifically implicates one of the priorities identified in the First Cole Memo, then the financial institution is required to provide a different and more detailed narrative description in the SAR.¹⁰ Former Attorney General Jeff Sessions rescinded both the First and Second Cole Memos in January 2018.¹¹ However, the FinCEN Guidance was left undisturbed. 

NCUA’s Enforcement Action Against Live Life Credit Union
In February 2021, the National Credit Union Administration (“NCUA”) initiated the first administrative cease and desist action of its kind against a depository institution for allegedly failing to comply with the FinCEN Guidance.¹² The consent order between NCUA and Live Life Credit Union (“Live Life”) is silent as to the facts that gave rise to the enforcement action.¹³ But, Karla Haglund, Chief Executive Officer of Live Life, confirmed that the action arose from Live Life’s inability to keep up with the reporting requirements necessary to provide financial services to MRB’s under the current FinCEN guidance.¹⁴ Ms. Haglund explained that, after joining the cannabis banking space at the end of 2018, Live Life acquired 254 new clients, 150 of which were MRBs.¹⁵ Despite Live Life’s fast growth, it failed to employ sufficient individuals to handle the sudden influx of clients.¹⁶

NCUA’s cease and desist order requires Live Life to:

• Implement an automated system to monitor for suspicious activity;
• Engage a third party to validate the suspicious activity monitoring system;
• Immediately file SARs and develop a system to ensure all SARs are accurate, complete, and timely filed;
• Develop and implement a system to ensure all Currency Transaction reports are filed accurately;
• Cease opening new MRB accounts;
• Cease its Money Services Business (“MSB”) program; and
• Engage a qualified third party to retroactively review the MSB activity and determine whether any additional SAR filing is necessary.¹⁷

The SAFE Banking Act
The timing of NCUA’s enforcement action is noteworthy because it comes at a time when, given the current makeup of the Senate and broad bipartisan support, it appears increasingly likely that the SAFE Banking Act may get passed into law.¹⁸  The SAFE Banking Act was reintroduced in the House on March 18, 2021.¹⁹A week later, on March 23, 2021, a bipartisan team of senators introduced a nearly identical version of the SAFE Banking Act to the Senate.²⁰  On April 21, 2021, the House passed the SAFE Banking Act by a vote of 321-101.²¹

If passed, the SAFE Banking Act will help reduce some of the current risk associated with banking in the cannabis industry and encourage more financial institutions to consider venturing into this space. However, while the SAFE Banking Act will make it easier to bank with MRBs, financial institutions will still be obligated to comply with updated FinCEN and/or regulatory guidance issued after the Act’s passage. 

The current version of the SAFE Banking Act pending before the House provides a “safe harbor” for financial institutions²² banking with MRBs²³ and further prohibits “federal banking regulator[s]” from:

• Taking any adverse actions against a financial institution “solely because” the institution provides financial services to MRBs;²⁴
• Prohibiting, penalizing, or otherwise discouraging a financial institution from providing financial services to MRBs;²⁵
• Recommending, incentivizing, or encouraging a financial institution to not offer financial services on the basis of an account holder’s involvement with an MRB;²⁶
• Taking any adverse or corrective supervisory action on a loan made to an MRB or individual involved with an MRB solely based on the fact that the business or individual is or works for an MRB;²⁷  and
• Prohibiting or discouraging a financial institution from “engaging in a financial service for” an MRB.²⁸

Further, the SAFE Banking Act shields MRBs and ancillary businesses doing business with MRBs, such as real estate owners, accountants, or other vendors from money laundering and other federal laws solely because of their involvement with the cannabis industry.²⁹

Importantly, the SAFE Banking Act directs FinCEN to issue updated guidance within 180 days of the Act’s enactment.  FinCEN’s guidance may require institutions to submit SARs, however, any requirement for the same must be consistent with the “purpose and intent”³⁰ of the SAFE Banking Act and may not “significantly inhibit the provision of financial services to” MRBs.³¹  The Act also requires that within 180 days of enactment, the Financial Institutions Examination Council must develop guidance and examination procedures for depository institutions providing financial services to MRBs.³²

Key Takeaways
The SAFE Banking Act is likely to provide some much needed relief to financial institutions who are currently banking the cannabis industry or are interested in doing so in the future, as well as MRBs who are desperate for the services these institutions provide. However, while banking in this space will become easier after the SAFE Banking Act is passed, financial institutions need to be aware that this space is likely to remain heavily regulated by forthcoming FinCEN and regulatory guidance. NCUA’s enforcement action against Live Life demonstrates that the regulators are keeping a close eye on financial institutions banking with MRBs. The Live Life consent order also underscores the importance of complying with both current FinCEN guidance, as well as any guidance issued after the SAFE Banking Act is enacted. 

As a best practice, financial institutions looking to bank with MRBs should:

• Continue to strictly comply with FinCEN guidance and closely monitor any developments in connection with the SAFE Banking Act.
• Continue to carefully select, monitor, and report the MRBs with whom it chooses to do business. Even after the SAFE Banking Act becomes law, an MRB must be in compliance with state law in order for the Act’s protections to apply to the financial institution.  Therefore, thorough due diligence of a potential customer is essential. 
• Develop robust policies and procedures to comply with current FinCEN guidance, as well as any forthcoming FinCEN or regulatory guidance.
• Develop and maintain policies and procedures for analyzing whether SAR reporting is necessary and to ensure that any required SARs are complete, accurate, and timely filed.

Cannabis banking is an exciting and potentially lucrative new frontier for financial institutions.  But navigating the waters can be confusing and tricky.  We are here to help. 

* Abigail Lyle is a partner in the financial services litigation and compliance practice group in the Dallas office of Hunton Andrews Kurth LLP. Abigail’s practice focuses on regulatory compliance and defending financial institutions in enforcement actions and litigation related to consumer protection laws.  She can be reached at +1 214 979 8219 or alyle@HuntonAK.com.

** Aliza Malouf is an associate in the financial institutions corporate and regulatory practice group in the Dallas office of Hunton Andrews Kurth LLP. Her practice focuses on defending financial institutions in litigation related to consumer protection laws. She can be reached at +1 214 979 8229 or amalouf@HuntonAK.com.

 

¹ H.R. 1996, 117th Cong. (2021). 

² The SAFE Banking Act was initially introduced to Congress in 2017, but it did not receive a full vote or a hearing in either chamber at that time.  Caroline Banzali, The Safe Banking Act and the future of cannabis banking in the U.S., Baker Tilley (Feb. 1, 2021).

³ Some states, such as California and Colorado, have fully legalized cannabis for both recreational and medicinal use.  Other states, such as Maryland and Florida, have limited cannabis to medicinal use only.  Still other states, such as Texas, prohibit the use of cannabis containing THC, but allow for the sale and use of CBD.  And others, such as New Mexico and Illinois, have decriminalized cannabis altogether.  See Marijuana Laws by State in 2021: A Legal Weed Map and Short Guide to Regulation, last updated January 2021.

⁴ U.S. Department of Justice, Guidance Regarding Marijuana Enforcement (“First Cole Memo”) (Aug. 29, 2013).

⁵ U.S. Department of Justice, Guidance Regarding Marijuana Related Financial Crimes (“Second Cole Memo”) (Feb. 14, 2014). 

⁶ Id. at p. 2, n.1 and p. 3. 

⁷ Id. at p.2, n. 1; Department of the Treasury Financial Crimes Enforcement Network, BSA Expectations Regarding Marijuana-Related Businesses (“FinCEN Guidance”) (Feb. 14, 2014).

⁸ FinCEN Guidance at p. 2-3. 

⁹ Id. at p. 3-7. 

¹⁰ Id.

¹¹ Office of the Attorney General, Marijuana Enforcement (Jan. 4, 2018).

¹²  In the Matter of Live Life Federal Credit Union, Administrative Order, Docket No. 21-0105-ER (Feb. 22, 2021).

¹³ Id. 

¹⁴ Nina Zdinjak, Michigan-Based Credit Union Receives Cease-And-Desist Order Over Cannabis Banking, Benzinga.com (Apr. 7, 2021).

¹⁵ Id. 

¹⁶ Id. 

¹⁷ Id.

¹⁸ Christian Flemming, SAFE Banking Act, Protecting Financial Partners of Cannabis and Businesses, Likely to Become Law, JD Supra (Mar. 26, 2021).

¹⁹ Sam Reisman, Pot Banking Bill Gets New Introduction in Senate, Law360 (Mar. 23, 2021).

²⁰  Id. 

²¹   U.S. House of Representatives Approves Cannabis Banking Bill, Reuters (Apr. 19, 2021).

²² The SAFE Banking Act uses the term “depository institution” which means “(A) a depository institution as defined in section 3(c) of the Federal Deposit Insurance Act (12 U.S.C. § 1813(c)); (B) a Federal credit union as defined in section 101 of the Federal Credit Union Act (12 U.S.C. 1752); or (C) a State credit union as defined in section 101 of the Federal Credit Union Act (12 U.S.C. 1752).” 

²³ The SAFE Banking Act speaks in terms of “Cannabis-related legitimate business[es],” which is defined as “a manufacturer, producer, or any person or company that (A) engages in any activity described in subparagraph (B) pursuant to a law established by a State or a political subdivision of a State, as determined by such State or political subdivision; and (B) participates in any business or organized activity that involves handling cannabis or cannabis products, including cultivating, producing, manufacturing, selling, transporting, displaying, dispensing, distributing, or purchasing cannabis or cannabis products.”

²⁴ H.R. 1996, 117th Cong, §2(a)(1) (2021), .

²⁵25 Id. at §2(a)(2). 

²⁶ Id. at §2(a)(3).

²⁷ Id. at §2(a)(4). 

²⁸ Id. at §2(a)(5). 

²⁹ Id. at §§3 and 4. 

³⁰ The stated purpose of the SAFE Banking Act is “to increase public safety by ensuring access to financial services to cannabis-related legitimate businesses and service providers and reducing the amount of cash at such businesses.”  Id. at §1(c).

³¹ Id. at §6. 

³² Id. at §7.