We have a customer that owns two nutrition stores that sell CBD oil. Is CBD oil legal if it is hemp-derived and has a tetrahydrocannabinol (THC) level at or below 0.3%? Can we continue to bank this customer? If so, are we required to file suspicious activity reports (SARs) on all of its activities?

See CQ 2022-153 for our most recent guidance on banking a CBD or hemp-related business.

Ultimately, it will be legal to sell CBD oil if contains no more than 0.3% THC and is derived from hemp that was grown in adherence with state and federal regulations. However, in our view, banking a customer that sells CBD oil currently would require heightened monitoring and BSA/AML responsibilities, including increased suspicious activity report (SAR) filing responsibilities. Consequently, we believe the question of whether to continue banking this customer will be a business decision for your bank.

With the passage of the Agriculture Improvement Act of 2018 (the 2018 Farm Bill), hemp and hemp-derived CBD oil no longer are illegal controlled substances under the federal Controlled Substances Act. Similarly, Illinois enacted legislation in 2018 (the Industrial Hemp Act) that removed industrial hemp from the state’s general prohibition against manufacturing, delivering or possessing “cannabis.” Under both federal and Illinois law, “hemp” and “industrial hemp” mean “the plant Cannabis sativa L. and any part of that plant . . . with a delta-9 tetrahydrocannabinol [THC] concentration of not more than 0.3 percent on a dry weight basis.”

However, the 2018 Farm Bill also provides that “it shall be unlawful to produce hemp” without a license issued by the United States Department of Agriculture (USDA) or by a state that has been approved by the USDA to issue licenses for the production of hemp. The USDA’s website states that it will not review or approve any state hemp licensing programs until it finalizes its own regulations later in 2019 or 2020. Accordingly, the USDA’s position is that during the 2019 planting season, hemp growers may obtain licenses only under a 2014 Farm Bill program — such as Illinois’ Industrial Hemp Pilot Program, which permits only institutions of higher learning or state agricultural departments to grow hemp — and such hemp must be grown exclusively for research purposes. Considered together, our view is that Illinois may not issue licenses to grow hemp sold for commercial purposes, such as for CBD oil retail sales, until the USDA finalizes its regulations and approves the Illinois licensing program.

Nonetheless, the Illinois Department of Agriculture already is issuing licenses to commercial hemp growers based on the 2014 Farm Bill, its rationale apparently being that it may delegate its research authority to private growers and presumably learn from their experiences (hence meeting the “research” component of the federal law). As indicated above, we believe this reasoning is specious and that the sale of CBD oil derived from commercially produced hemp without USDA-approval for the state-issued license technically remains illegal at this time. Additionally, without federally approved guidelines for monitoring commercial hemp production, it might be questionable whether your bank can appropriately determine if your customer’s CBD oil is an illegal controlled substance (exceeding the 0.3% THC concentration threshold) on an ongoing basis.

However, we note this situation is temporary, as the USDA’s final regulations will be forthcoming relatively soon, and retail sales of hemp-derived CBD products already are widespread in Illinois. Should you choose to continue banking this customer, we recommend taking a conservative approach, which would be to file SARs for deposits relating to its CBD oil sales, with ongoing monitoring and continuous SAR filings made for each subsequent 90-day reporting period until such time as the USDA has issued its final hemp regulations and approved the Illinois licensing program, or you can verify that your customer’s CBD oil is being sourced from a USDA-approved hemp cultivator. It is less clear under FinCEN’s 2014 Guidance whether such SARs should be marijuana-related SARs or standard SARs, but again, the more conservative approach would be to use the former.

For resources related to our guidance, please see:

FinCEN SAR Rules, 31 CFR 1020.320(a)(2) (“A transaction requires reporting under the terms of this section if it is conducted or attempted by, at, or through the bank, it involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect that (i) The transaction involves funds derived from illegal activities . . . as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation; . . . ”)

Controlled Substances Act, 21 USC 802(16) (“(A) Subject to subparagraph (B), the term ‘marihuana’ means all parts of the plant Cannabis sativa L. . . . (B) The term ‘marihuana’ does not include

(i) hemp, as defined in section 1639o of Title 7; or

(ii) the mature stalks of such plant, fiber produced from such stalks, oil or cake made from the seeds of such plant, any other compound, manufacture, salt, derivative, mixture, or preparation of such mature stalks (except the resin extracted therefrom), fiber, oil, or cake, or the sterilized seed of such plant which is incapable of germination.”)

Agriculture Marketing Act of 1946, 7 USC 1639o(1) (“The term ‘hemp’ means the plant Cannabis sativa L. and any part of that plant, including the seeds thereof and all derivatives, extracts, cannabinoids, isomers, acids, salts, and salts of isomers, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.”)

Illinois Cannabis Control Act, 720 ILCS 550/3 (“‘Cannabis’ includes marihuana, hashish and other substances which are identified as including any parts of the plant Cannabis Sativa . . . ‘Cannabis’ does not include industrial hemp as defined and authorized under the Industrial Hemp Act.”)

Illinois Industrial Hemp Act, 505 ILCS 89/5 (“‘Industrial hemp’ means the plant Cannabis sativa L. and any part of that plant, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis that has been cultivated under a license issued under this Act or is otherwise lawfully present in this State, and includes any intermediate or finished product made or derived from industrial hemp.”)

Agriculture Marketing Act of 1946, 7 USC 1639q(c)(1) (“In the case of a State or Indian tribe for which a State or Tribal plan is not approved under section 1639p of this title, it shall be unlawful to produce hemp in that State or the territory of that Indian tribe without a license issued by the Secretary under subsection (b).”)

Agriculture Marketing Act of 1946, 7 USC 1639q(a)(1) (“In the case of a State or Indian tribe for which a State or Tribal plan is not approved under section 1639p of this title, the production of hemp in that State or the territory of that Indian tribe shall be subject to a plan established by the Secretary to monitor and regulate that production in accordance with paragraph (2).”)

Agricultural Marketing Act of 1946, 7 USC 1639p(a)(1) (“A State or Indian tribe desiring to have primary regulatory authority over the production of hemp in the State or territory of the Indian tribe shall submit to the Secretary, through the State department of agriculture (in consultation with the Governor and chief law enforcement officer of the State) or the Tribal government, as applicable, a plan under which the State or Indian tribe monitors and regulates that production as described in paragraph (2).”)

USDA website, Hemp Production Program (“For the 2019 planting season, the 2018 Farm Bill provides that States, Tribes, and institutions of higher education can continue operating under authorities of the 2014 Farm Bill. USDA provided additional guidance to these programs in the August 2016 multi-agency Statement of Principles on Industrial Hemp (FR 53395). The 2018 Farm Bill extension of the 2014 authority expires 12 months after USDA has established the plan and regulations required under the 2018 Farm Bill.”)

Industrial Hemp Pilot Program, 720 ILCS 550/15.2(a)(1) (“Pursuant to Section 7606 of the federal Agricultural Act of 2014, an institution of higher education or the Department of Agriculture may grow or cultivate industrial hemp if . . . the industrial hemp is grown or cultivated for purposes of research conducted under an agricultural pilot program or other agricultural or academic research.”)

Final Order, Placement in Schedule V of Certain FDA-Approved Drugs Containing Cannabidiol, 83 Fed. Reg. 48950, 48952 (September 28, 2018) (“As further indicated, any material, compound, mixture, or preparation other than Epidiolex that falls within the CSA definition of marijuana set forth in 21 U.S.C. 802(16), including any non-FDA-approved CBD extract that falls within such definition, remains a schedule I controlled substance under the CSA. Thus, persons who handle such items will continue to be subject to the requirements of the CSA and DEA regulations relating to schedule I controlled substances.”)

FinCEN SAR Rules, 31 CFR 1020.320(a)(2) (“A transaction requires reporting under the terms of this section if it is conducted or attempted by, at, or through the bank, it involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect that (i) The transaction involves funds derived from illegal activities . . . as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation; . . . ”)

FFIEC BSA/AML Manual, Suspicious Activity Reporting (“FinCEN’s guidelines have suggested that banks should report continuing suspicious activity by filing a report at least every 90 calendar days. Subsequent guidance permits banks with SAR requirements to file SARs for continuing activity after a 90 day review with the filing deadline being 120 calendar days after the date of the previously related SAR filing. Banks may also file SARs on continuing activity earlier than the 120 day deadline if the bank believes the activity warrants earlier review by law enforcement.”)

FinCEN Guidance, FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses (February 14, 2014) (“Because federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity. Therefore, a financial institution is required to file a SAR on activity involving a marijuana-related business (including those duly licensed under state law), in accordance with this guidance and FinCEN’s suspicious activity reporting requirements and related thresholds.”)

FinCEN Guidance, FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses (February 14, 2014) (Outlining three marijuana-specific SARs for marijuana-related business customers and when to file them)