White Paper · Cannabis · Banking

Cannabis Banking and Cash Management: Build the Diligence File Before the Bank Asks

Cannabis banking works best when the operator can explain its licenses, ownership, expected activity, cash controls, and transaction flows before an institution’s review begins. FinCEN guidance makes diligence and ongoing monitoring central to the relationship.

By Lincoln Square Law · 8-minute read

Banking access is a diligence problem before it is a cash problem

A cannabis operator may experience banking as an operational constraint, but the financial institution sees a regulatory risk relationship. FinCEN’s 2014 marijuana guidance begins from that perspective. It does not direct a bank or credit union to serve marijuana-related businesses. It says the institution should decide whether to open, close, or refuse a relationship based on institution-specific objectives, risk assessment, and capacity to manage the risk. If it serves the business, customer due diligence and ongoing monitoring become central to the relationship.

That makes the operator’s first task accuracy. The institution should not have to reconcile inconsistent names, ownership percentages, license records, facility addresses, revenue descriptions, or product categories across documents. A controlled banking file should match the legal entity records, regulator records, tax records, accounting system, and contracts that explain the flow of funds.

Prepare the diligence file before the institution asks

FIN-2014-G001 identifies diligence that may include verifying state licensure and registration, reviewing license applications, obtaining available information from licensing authorities, understanding expected business activity, monitoring public sources, monitoring suspicious activity, and refreshing information periodically. An operator can make that process easier by maintaining a current package rather than assembling one during an account review.

The package should ordinarily include the organizational chart, ownership information, active licenses, approved locations, principal business activities, expected monthly inflows and outflows, key counterparties, cash-handling procedures, tax-payment process, and explanations of affiliated entities. The exact materials depend on the institution and relationship. The legal function should verify that the package describes the regulated business accurately and does not overstate what a license permits.

Material changes should trigger a banking review. New owners, a new facility, a major acquisition, a change in product lines, a substantial increase in transaction volume, a new state, or a change in the way cash is collected can alter the facts on which the institution’s diligence was based. Waiting for the bank to discover the change through transaction monitoring is a poor substitute for controlled disclosure.

Understand what marijuana-related SAR reporting means for the relationship

FinCEN’s 2014 guidance describes marijuana-related suspicious activity reporting categories and expects a financial institution serving a marijuana-related business to file SARs consistent with the guidance. The existence of a banking relationship therefore should not be interpreted as a conclusion that the institution treats the activity like an ordinary non-cannabis account. The relationship operates within the institution’s BSA compliance program.

For the operator, the practical lesson is not to attempt to manage the bank’s SAR decisions. It is to keep records that make activity explainable: deposits that tie to point-of-sale and inventory records, vendor payments that tie to legitimate invoices, payroll that matches staffing, intercompany transfers supported by agreements, and owner distributions supported by governing documents and accounting entries. Clear records reduce avoidable ambiguity even though they do not control the institution’s reporting duties.

Separate marijuana and hemp legal assumptions

FinCEN’s June 2020 hemp guidance addresses federally lawful hemp-related businesses and explains a risk-based BSA/AML diligence approach. It expressly states that it does not replace or supersede the prior marijuana guidance.

Operators with both marijuana and hemp activity should therefore avoid assuming that one product category’s banking treatment automatically applies to another.

The business should be able to identify which entity sells which products, under what authority, and how proceeds are recorded. If a company operates distinct regulated marijuana and hemp lines, commingled contracts, merchant accounts, or accounting classifications can make diligence harder. Separate operational records do not necessarily require separate legal entities in every case, but the company should be able to demonstrate the legal basis and transaction path for each line.

Cash controls should be designed for auditability

Where cash remains significant, the control objective is a complete chain from sale to deposit. That normally means defined register closeout procedures, dual verification for high-risk cash movements, documented safe counts, controlled access, deposit logs, transport records where used, discrepancy thresholds, and prompt reconciliation to the accounting system and regulated point-of-sale or inventory records.

Management should not permit unexplained cash differences to accumulate in a suspense account. Each discrepancy should have an owner, investigation path, adjustment authority, and resolution record. Repeated small discrepancies can be more informative than a single large error because they may reveal process weaknesses, training gaps, skimming risk, or integration problems.

Cash controls also need segregation of duties. The same person should not routinely control sales closeout, safe access, deposit preparation, accounting entry, and reconciliation without an independent review. Smaller organizations may not have enough employees for perfect segregation, but compensating controls such as owner review, camera review, independent reconciliations, deposit confirmation, and periodic surprise counts can reduce concentration of authority.

Do not hide the cannabis nature of a transaction

A banking strategy should not depend on vague entity names, misleading transaction descriptions, or routing funds through affiliates to make regulated activity less visible. That approach undermines the diligence relationship and can create additional legal and contractual risk. The operator should instead provide a truthful description of the business and maintain a documented explanation for legitimate intercompany transactions.

Payment processors, merchant-acquiring arrangements, armored-car services, cash vaults, and other financial vendors should be diligenced with the same discipline. Review what the vendor is actually authorized to provide, how funds move, which entity is the customer of record, what representations the operator makes, what termination rights apply, and what happens if the service is suspended.

Plan for account interruption before it occurs

A cannabis operator should assume that banking relationships can change. A continuity plan should identify backup accounts where lawful and available, payroll contingencies, tax-payment methods, vendor-priority rules, cash-storage limits, emergency authorization levels, and who communicates with the institution. The plan should not encourage evasive activity. Its purpose is to keep lawful obligations functioning if a provider changes risk appetite or requests additional diligence.

Key contracts should also be reviewed for banking dependencies. Loan documents, leases, supply agreements, and payroll arrangements may contain automatic-payment requirements or default provisions that become difficult if an account is frozen or closed. Knowing those dependencies in advance gives management time to negotiate workable notice and cure provisions.

Use a quarterly banking-compliance review

A quarterly review can compare licenses, ownership, facility addresses, expected activity, actual transaction patterns, material contracts, tax status, major vendors, and bank disclosures. It should document changes since the prior review and decide whether the financial institution should receive updated information. The review should also reconcile cash-management policies with what employees actually do.

The goal is not to guarantee banking access. No legal review can require a private institution to accept a relationship that falls outside its risk appetite. The goal is to make the operator’s financial activity transparent, traceable, and consistent with its licenses and records so that preventable diligence failures do not become the reason the relationship breaks down.

Reconcile the bank narrative to the accounting narrative

Financial diligence becomes difficult when the story told to the institution differs from the books. The operator should reconcile gross sales, taxes collected, cash deposits, electronic receipts, intercompany transfers, management fees, rent, debt service, owner distributions, and unusual one-time payments. Differences may be legitimate, but they should be explainable from source records. A monthly control can compare bank activity with the general ledger, point-of-sale records, state inventory records where applicable, and tax filings. Material reconciling items should be documented rather than carried forward indefinitely.

Legal and accounting teams should also review agreements that create recurring transfers between affiliates.

Management fees, shared-service charges, intellectual-property royalties, loans, reimbursements, and centralized payroll arrangements should have written support and match the actual flow of funds. That documentation helps the institution understand why money moves between related companies and gives management a cleaner record if a regulator, auditor, lender, or tax adviser later asks the same question.