White Paper · Cannabis · Banking

Cannabis Banking After the April 28, 2026 Rule: What Changed, What Did Not, and the File a Bank Will Ask For

Moving state medical marijuana to Schedule III did not change the federal banking guidance that financial institutions still use for marijuana businesses, and adult-use activity remains in Schedule I. Banking access still turns on the institution’s risk decision and on records the operator can produce on request.

By Lincoln Square Law · 11-minute read

Where cannabis banking stands in late 2026

A licensed cannabis operator in Illinois or Missouri that wants a bank or credit union account is asking that institution to take on a customer whose activity federal law treats in more than one way. Since April 28, 2026, marijuana handled under a state medical marijuana license, or contained in an FDA-approved product, has been a Schedule III substance (21 C.F.R. 1308.13(g)). Our briefing on Schedule III and section 280E describes the rule’s scope. Adult-use marijuana and other marijuana outside those categories remain in Schedule I. Many operators hold both kinds of license, often under common ownership.

The federal guidance that banks use for these customers did not change on April 28. FinCEN’s February 14, 2014 guidance, FIN-2014-G001, remains posted on FinCEN’s website without a notice of rescission or revision. Congress has not changed the law either. The SAFE Banking Act of 2026 was introduced in the Senate on June 24, 2026 as S. 4942 and referred to the Committee on Banking, Housing, and Urban Affairs. As of this writing, the official bill record shows no committee action beyond that referral. CRS identifies H.R. 9471 as the identical House bill, which has been referred to a subcommittee.

This briefing explains what the 2014 guidance asks of a financial institution, how the April 28 rule and the November 2026 hemp changes bear on that review, and the records an operator should have ready.

What FinCEN’s 2014 guidance asks the institution to do

FIN-2014-G001 does not direct any institution to serve marijuana businesses. It says the decision to open, close, or refuse a particular account or relationship should be made by each financial institution based on its own business objectives, its assessment of the risks, and its ability to manage those risks.

For an institution that does provide services, the guidance lists customer due diligence it should perform. That includes verifying with state authorities that the business is licensed and registered, reviewing the license application and related documents, requesting available information about the business and related parties from state licensing and enforcement authorities, developing an understanding of the normal and expected activity for the business, monitoring public sources for adverse information, monitoring for suspicious activity, and refreshing the diligence periodically in proportion to the risk.

The guidance also describes three categories of suspicious activity report. A “Marijuana Limited” report is filed when the institution reasonably believes the business does not implicate the federal enforcement priorities the guidance describes and does not violate state law. A “Marijuana Priority” report is filed when the institution believes it does. A “Marijuana Termination” report is filed when the institution ends the relationship to maintain an effective anti-money laundering program. Currency transaction reports apply in the ordinary way, and the guidance states that a marijuana business may not be treated as a non-listed business for exemption purposes.

The guidance rests on a Justice Department memo that has been rescinded

FIN-2014-G001 was written around the Justice Department’s August 29, 2013 enforcement memorandum, often called the Cole memo, and the related February 14, 2014 memo on marijuana-related financial crimes. On January 4, 2018, the Attorney General issued a memorandum to all U.S. Attorneys stating that previous nationwide guidance specific to marijuana enforcement was unnecessary and was rescinded. Both of those memos are among the rescinded documents it lists.

FinCEN did not withdraw its 2014 guidance when the Justice Department memos were rescinded, and the guidance remains posted. Institutions still use its diligence and reporting framework, but the prosecution policy it was built on is no longer in effect. That is one reason an operator should not treat an existing account as a settled federal position. The relationship rests on the institution’s own continuing judgment.

What the April 28 rule changes for a bank’s review

The rule changes the federal status of activity under a state medical marijuana license. It also lets state medical licensees apply for DEA registration (21 C.F.R. 1301.13(k)), and a registration under that pathway depends on the state license remaining in effect.

For a financial institution, that creates new facts to diligence. The questions now include which entity holds a state medical license, whether that entity holds or has applied for a DEA registration, and whether its revenue comes from medical activity, adult-use activity, or both. As of this writing, we have not located FinCEN guidance addressing how institutions should treat Schedule III medical activity, how the three report categories apply to it, or how to handle a customer with both medical and adult-use revenue. Until FinCEN speaks, each institution decides for itself, and operators should expect the answers to differ from bank to bank.

The rule did not move adult-use marijuana. DEA’s broader proposal to move marijuana generally to Schedule III went to a separate formal hearing (91 Fed. Reg. 22777), and as of this writing no final rule from that proceeding has been published that we have found. Proceeds of adult-use sales are therefore still proceeds of Schedule I activity under federal law, whatever the state license says.

Keep medical, adult-use, and hemp revenue traceable

Because the rule splits a single enterprise into federally different activities, the most useful thing an operator can do for its bank is to make each revenue stream traceable on its own. Each entity’s licenses should be listed with their type. Point-of-sale data should distinguish medical from adult-use sales where the state system already does so. Intercompany transfers, management fees, and shared-service charges between medical and adult-use affiliates should be supported by written agreements and should match what the books show.

Hemp adds a third category. An amended federal hemp definition takes effect November 12, 2026, so some products sold as hemp today may fall outside it. The timing is explained in our federal hemp briefing. FinCEN issued separate guidance for hemp-related businesses in June 2020, distinct from the marijuana guidance. An operator that sells hemp-derived products should expect its bank to ask how those products are classified after November 12, and the answer should come from the product’s testing and the amended definition, not from its prior label.

The diligence file to keep current

A financial institution can ask for information at onboarding, at periodic review, or after transaction monitoring raises a question. An operator that keeps a current file answers faster and more consistently. The file should ordinarily include:

• The legal name and organizational chart of each entity, with direct and indirect owners and their percentages.
• Each state license, its type (medical, adult-use, or both), its licensed address, and its expiration date.
• DEA registration status for each medical licensee: registered, application pending with its filing date, or not applied.
• A description of each entity’s products and services, including any hemp-derived products and how they are classified.
• Expected monthly deposits, cash and electronic, and expected payments by category.
• Major counterparties, including landlords, lenders, management companies, and payment processors.
• Cash-handling procedures and the most recent reconciliation results.
• Tax filing status and the method used to pay state and federal taxes.
• Copies of intercompany agreements and any management services agreement.

The legal function should review the file before it goes to the bank. Each statement about licenses and activity should match the regulator’s records, and nothing in it should describe a license as permitting more than it does.

Report changes before monitoring finds them

Diligence goes stale when the business changes. A new owner, a new location, an acquisition, a change in product mix, a move into hemp-derived products, a large change in transaction volume, a new DEA registration, or a lapse in a state license can each change the facts the institution relied on. The operator should decide, with counsel, which changes it will report to the institution and when. Telling the bank before its monitoring finds the change is usually better for the relationship, and some account agreements require it.

Ownership changes deserve particular care because they also require regulatory approval. In Illinois, a dispensing organization must obtain IDFPR approval before a change of ownership, and the rule defines that term to include changes in control and certain financing and management arrangements (68 Ill. Adm. Code 1291.210). Our briefing on cannabis ownership changes covers those rules in both states.

Cash controls the institution can test

Cash remains a large part of many cannabis businesses. An institution reviewing deposits will want to see that cash deposited ties to recorded sales. The control objective is an unbroken chain from register closeout to deposit, with dual verification of high-risk movements, documented safe counts, restricted access, deposit logs, transport records, discrepancy thresholds, and prompt reconciliation to the general ledger and the state inventory system.

Illinois requires dispensaries to keep five years of records of each bank deposit and withdrawal when they maintain a bank account (410 ILCS 705/15-75(e)). Unexplained differences should not accumulate in a suspense account. Each one should have an owner, a cause, and a dated resolution. Where staffing does not allow full separation of duties, compensating controls such as owner review, camera review, independent reconciliation, and surprise counts reduce the risk that one person controls the whole cash cycle.

Describe the business accurately to every financial provider

A banking strategy should never depend on vague entity names, misleading transaction descriptions, or routing funds through affiliates to make cannabis activity less visible. That approach undermines the institution’s diligence and can create separate legal and contractual exposure for the operator and its owners. The same accuracy applies to payment processors, armored-car services, cash-vault providers, and lenders. For each provider, the operator should know what service is actually offered, which entity is the customer of record, what the operator has represented, and what happens if the service is suspended.

Plan for an account to close

Institutions change their risk appetite, and a closure can follow a regulatory change, an acquisition of the bank, or a review the operator never sees. A continuity plan should identify backup accounts where lawful and available, payroll contingencies, tax-payment methods, vendor priorities, cash-storage limits under the security plan, and who speaks to the institution. Loan documents, leases, and supply agreements should be reviewed for automatic-payment and default provisions that a frozen or closed account would trigger, so notice and cure periods can be negotiated before they are needed.

Federal actions that would change a bank’s review

Watch for FinCEN guidance addressing Schedule III medical activity, action on S. 4942 or H.R. 9471, a final rule from DEA’s broader rescheduling hearing, and federal hemp implementation after November 12, 2026. Each would change what an institution asks for, and none should be assumed before it is published.