White Paper · Cannabis · Transactions

Cannabis Transaction Due Diligence in 2026: Operating Records, Federal Status, Tax Exposure, and Products That Change Classification

Approval rules decide whether a cannabis deal can close. Operating diligence decides what the buyer is getting: tracking and inventory records, recalls and testing, DEA registration status after April 28, 2026, section 280E exposure, banking relationships, and hemp-derived products whose federal status changes November 12, 2026.

By Lincoln Square Law · 8-minute read

Two kinds of diligence

A cannabis acquisition has to answer two sets of questions. The first is whether the deal can close: which approvals are required, what the regulator will see, and how control moves. Our briefing on ownership changes and M&A covers those rules in Illinois, Missouri, and at DEA. The second is what the buyer is acquiring. A license certificate shows that a license appears active. It does not show whether the business can prove compliance with its operating rules, what federal tax it owes, whether its products remain lawful, or whether its bank will keep the account. This briefing covers the second set.

Start with the license file

Request the original application, renewals, ownership charts and tables of organization filed with the regulator, social-equity or microbusiness eligibility materials, approved floor plans, security and operating plans, local approvals, inspection reports, notices of violation, corrective action plans, and correspondence with the regulator. Compare those documents with the facility and the corporate books. A mismatch between the approved record and current operations, such as a moved camera, a repurposed room, or an officer who left without notice, can matter more than a clean certificate. In Illinois, the Department of Agriculture classifies many such changes as alterations or modifications that require its review (8 Ill. Adm. Code 1300.130), and IDFPR requires approval before dispensary relocations and floorplan changes at a new site (68 Ill. Adm. Code 1291.225). Our briefing on change control explains those categories.

Ask about pending amendments and informal discussions with the regulator. A transaction often surfaces changes management planned to report later.

Test the tracking and inventory records

Seed-to-sale records are the regulator’s view of the business, and gaps in them are compliance findings. Sample complete chains: select packages and trace each through receipt, production, testing, transfer, sale, or destruction, and compare the system with tags, manifests, batch records, invoices, and point-of-sale data. Then reverse the test from physical inventory to the system.

The rules give specific things to request. Illinois dispensaries must reconcile daily, need Department approval before any inventory adjustment, must report an unexplained imbalance in writing if the cause is not found within two calendar days, and must report theft to IDFPR and the Illinois State Police within 24 hours (410 ILCS 705/15-75(d), 68 Ill. Adm. Code 1291.310). Missouri licensees must report discrepancies within 24 hours, report system failures within three hours, and file a monthly physical inventory report, and tracking violations can bring fines of up to $50,000 (19 CSR 100-1.130). Ask for the adjustment approvals, discrepancy reports, outage reports, and monthly reports, not only the policy. Illinois moved to Metrc in 2025, so earlier records may exist only as BioTrack exports. Our seed-to-sale guide explains the rules.

Recalls, testing, and product approvals

Request every recall, hold, failed test, remediation, and destruction record, along with product registrations and, in Missouri, design approval numbers. Illinois dispensaries must keep written recall procedures and give a 24-hour notice to three state agencies, and Missouri’s Division publishes recall notices (68 Ill. Adm. Code 1291.330, 19 CSR 100-1.100(4)(P)). Our recall guide explains both. Compare the target’s recall file with any notices the regulator has published. Check whether labels in inventory meet the Illinois fields due November 1, 2026, described in our guide to advertising and packaging. Unsellable inventory is a price issue.

Federal status after April 28, 2026

The April 28, 2026 rule moved marijuana under a state medical license into Schedule III and created a DEA registration pathway for state medical licensees (21 C.F.R. 1308.13(g), 1301.13(k)). For a target with medical licenses, diligence should establish whether each licensee has registered with DEA, applied, or not applied, the filing dates, and any DEA correspondence. A DEA registration is automatically suspended if the state license is suspended, revoked, or expires, and a registration cannot be assigned or transferred without DEA’s written consent (21 C.F.R. 1301.13(k), 1301.52). The deal structure should be tested against those rules before the buyer assumes a registration will survive closing.

Adult-use activity remains in Schedule I. A target that mixes medical and adult-use operations should show how it separates them in licenses, inventory, revenue, and costs, because that separation drives both its federal status and its tax position.

Section 280E exposure

Section 280E disallows deductions and credits for a business trafficking in Schedule I or II substances (26 U.S.C. 280E). Adult-use operations remain subject to it, and DEA’s April 28 preamble said covered medical licensees will no longer be subject to the disallowance while stating that the rule does not determine anyone’s tax liability. Treasury and the IRS have listed guidance under section 280E in the 2026-2027 Priority Guidance Plan with no completion deadline.

Diligence should cover filed returns and their section 280E positions, the method used for cost of goods sold and inventory, any examinations, amended returns or refund claims, how 2026 is being treated before and after April 28, and the Illinois and Missouri subtractions claimed. The purchase agreement should allocate pre-closing tax exposure and the benefit of any future relief, and say who controls audits and amended returns. Our briefings on Schedule III and section 280E and how section 280E works explain the issues.

Banking and payment relationships

Confirm every bank, credit union, payment processor, armored-car service, and lender, the entity that is the customer of record, and what the target has represented to each. Ask whether any account has been closed or restricted. A change of ownership is often a reason for a financial institution to refresh its diligence, and a closing that leaves the business without an account disrupts payroll, taxes, and vendors. Our briefing on cannabis banking explains what institutions review.

Hemp-derived products and the November 12 change

If the target sells, makes, or distributes hemp-derived products, determine how each product is classified under the amended federal hemp definition, which begins to apply in stages on November 12, 2026, and under the Illinois Hemp Act and Missouri’s intoxicating cannabinoid law, as applicable. Products that are hemp today may be outside the definition after that date. Illinois’s Part 1300 amendments also limit which hemp-derived inputs a cannabis licensee may incorporate and require them to be tracked and tested. Inventory, supply contracts, and revenue projections tied to products that change classification should be valued accordingly. Our briefings on the federal hemp changes and Missouri’s intoxicating cannabinoid law cover the rules.

Employees, agents, and credentials

Licensed cannabis businesses can only use credentialed staff in regulated roles. In Illinois, agents need Department-issued badges, and the Department of Agriculture’s Spring 2026 bulletin notes that agent badge fees still apply even though principal-officer changes no longer carry a processing fee. In Missouri, facility agents need agent identification cards, and an emergency amendment to 19 CSR 100-1.070 on criminal-history review for agent card applicants and renewals took effect September 30, 2026, according to the Department’s rules page.

Diligence should compare the employee roster with the credential records, confirm that every person in a regulated role holds a current credential, and identify renewals due near closing. It should also confirm who holds the inventory-control designation and the system administrator accounts, because those roles do not transfer automatically when management changes.

From findings to deal terms

Diligence findings should change the documents. A known remediation can become a closing condition, specific indemnity, escrow, covenant, or price adjustment. A pattern of weak records may justify a different structure, such as an asset purchase or a longer interim period. A representation that the seller is “in compliance” is less useful than specific representations: the tracking system reconciles, no unreported discrepancies or recalls exist, product approvals are current, DEA registration status is as described, tax positions are as disclosed, and no account has been closed or restricted. A buyer should not assume that an insurance policy for representations and warranties will cover a licensing defect that prevents lawful operation.