We discovered that one of our customers is employed by a marijuana grower from whom the customer receives regular ACH payroll deposits. What is our responsibility with respect to this customer?

In our view, it would be prudent for your bank to treat a customer employed by a marijuana-related business (MRB) as it would treat an “indirect MRB,” since the customer provides services to the MRB (in the form of labor) and receives monies from the MRB that are derived from its federally-prohibited activities.

The FinCEN Guidance does not specifically define MRBs but indicates that such businesses generally are directly involved in growing, distributing or dispensing marijuana. The guidance also does not specifically define indirect MRBs but recognizes that many banks provide financial services to customers who themselves provide goods or services to MRBs, and those generally speaking are indirect MRBs (for example, “a commercial landlord that leases property to a marijuana-related business”). According to the FinCEN Guidance, whether a bank wishes to accept deposits from and provide other financial services to indirect MRBs is a risk-based decision. If a bank knowingly does so, it generally should look to the rules for filing standard SARs, as opposed to the three types of marijuana-specific SARs required by the guidance for direct MRBs.

As part of your risk assessment for this customer, your bank may wish to conduct a limited due diligence to ensure that your customer’s employer is operating its business pursuant to a license issued by the state. The FinCEN Guidance provides that conducting due diligence on a direct MRB customer should include, among other things, verifying whether the MRB is duly licensed under state law, and this currently can be accomplished on these State of Illinois websites: https://idfpr.illinois.gov/profs/medcan.asp for dispensaries and https://www2.illinois.gov/sites/agr/Plants/MCPP/Pages/default.aspx for cultivation centers.

If your bank chooses to continue its relationship with this customer, the most cautious approach would be to file a standard SAR for all payroll deposits that aggregate at least $5,000, with ongoing monitoring and continuous SAR filings made for each 90-day reporting period thereafter, for as long as your customer receives deposits from the MRB. However, we are not suggesting that this is necessary.

In light of Illinois’ recent legalization of marijuana for personal use by adults, the burden of filing SARs on all of your indirect MRB customers — which could include landlords, seed and equipment suppliers, attorneys, accountants, security firms, transportation companies, utility companies, and a host of other legitimate businesses — as well as on all individual customers who are employed by MRBs in Illinois, most likely would be untenable from an operational standpoint. Consequently, your bank may wish to consider adopting a policy that differentiates between circumstances under which it will or will not choose to file a SAR for a transaction involving an indirect MRB or an MRB employee. For example, your bank may choose to file SARs for transactions involving indirect MRB customers only when they derive a large percentage of their revenues from direct MRBs, and it may decide to not file SARs on employees of duly licensed MRBs.

Additionally, we note that while former U.S. Attorney General Jeff Sessions rescinded the “Cole Memorandum” (which generally provided that state and local law enforcement and regulatory bodies should remain the primary means of addressing marijuana-related activities), the FinCEN Guidance that was based on the Cole Memorandum remains in effect. Further, current U.S. Attorney General William Barr indicated during his confirmation proceedings that he does “not intend to go after parties who have complied with state law in reliance on the Cole Memorandum.”

Irrespective of whether your bank chooses to file SARs on indirect MRB customers or employees of MRBs, we strongly advise maintaining thorough records that document your bank’s decision-making process for each situation.

Finally, we reached out to FinCEN to inquire whether they agree with the above analysis; regrettably, we received a perfunctory response that simply referred us back to the FinCEN Guidance. We stand by our analysis, which is informed by the guidance while accounting for the realities of providing financial services to residents of an entire state in which indirect MRBs and MRB employees will soon become ubiquitous.

For resources related to our guidance, please see:

FinCEN Guidance, FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses (February 14, 2014) (“Similarly, a financial institution could be providing services to a non-financial customer that provides goods or services to a marijuana-related business (e.g., a commercial landlord that leases property to a marijuana-related business). In such circumstances where services are being provided indirectly, the financial institution may file SARs based on existing regulations and guidance without distinguishing between ‘Marijuana Limited’ and ‘Marijuana Priority.’ Whether the financial institution decides to provide indirect services to a marijuana-related business is a risk-based decision that depends on a number of factors specific to that institution and the relevant circumstances. In making this decision, the institution should consider the Cole Memo priorities, to the extent applicable.)

FinCEN Guidance, FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses (February 14, 2014) (Outlining three marijuana-specific SARs for marijuana-related business customers and when to file them)

FinCEN Guidance, FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses (February 14, 2014) (“In assessing the risk of providing services to a marijuana-related business, a financial institution should conduct customer due diligence that includes: (i) verifying with the appropriate state authorities whether the business is duly licensed and registered; (ii) reviewing the license application (and related documentation) submitted by the business for obtaining a state license to operate its marijuana-related business; (iii) requesting from state licensing and enforcement authorities available information about the business and related parties; (iv) developing an understanding of the normal and expected activity for the business, including the types of products to be sold and the type of customers to be served (e.g., medical versus recreational customers); (v) ongoing monitoring of publicly available sources for adverse information about the business and related parties; (vi) ongoing monitoring for suspicious activity, including for any of the red flags described in this guidance; and (vii) refreshing information obtained as part of customer due diligence on a periodic basis and commensurate with the risk.”)

FinCEN SAR Rules, 31 CFR 1020.320(a)(2) (“A transaction requires reporting under the terms of this section if it is conducted or attempted by, at, or through the bank, it involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect that (i) The transaction involves funds derived from illegal activities . . . as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation; . . . ”)

FFIEC BSA/AML Manual, Suspicious Activity Reporting (“FinCEN’s guidelines have suggested that banks should report continuing suspicious activity by filing a report at least every 90 calendar days. Subsequent guidance permits banks with SAR requirements to file SARs for continuing activity after a 90 day review with the filing deadline being 120 calendar days after the date of the previously related SAR filing. Banks may also file SARs on continuing activity earlier than the 120 day deadline if the bank believes the activity warrants earlier review by law enforcement.”)

Cannabis Regulation and Tax Act, Public Act 101-0027 (Illinois law that permits the personal use of marijuana for persons 21 years of age and older and the operation of a limited number of cultivation centers and craft growers for personal use marijuana, beginning January 1, 2020.)

Department of Justice, Memorandum Regarding Marijuana Enforcement (August 29, 2013) (“In jurisdictions that have enacted laws legalizing marijuana in some form and that have also implemented strong and effective regulatory and enforcement systems to control the cultivation, distribution, sale, and possession of marijuana, conduct in compliance with those laws and regulations is less likely to threaten the federal priorities set forth above. . . . In those circumstances, consistent with the traditional allocation of federal-state efforts in this area, enforcement of state law by state and local law enforcement and regulatory bodies should remain the primary means of addressing marijuana-related activity.”)

Sessions Memorandum — Rescinding Previous Nationwide Guidance Specific to Marijuana Enforcement (January 4, 2018) (“Given the Department’s well-established general principles, previous nationwide guidance specific to marijuana enforcement is unnecessary and is rescinded, effective immediately.”)

Forbes, “Trump Attorney General Pick Puts Marijuana Enforcement Pledge In Writing” (January 28, 2019) (“William Barr, President Trump's nominee to serve as the next U.S. attorney general, made headlines earlier this month when he pledged during his Senate confirmation hearing not to ‘go after’ marijuana companies that comply with state laws. Now, in response to written questions from senators, Barr is putting that pledge on paper, in black and white. . . . ‘As discussed at my hearing, I do not intend to go after parties who have complied with state law in reliance on the Cole Memorandum,’ he wrote, referring to Obama-era cannabis enforcement guidance that then-Attorney General Jeff Sessions rescinded last year. That said, Barr isn't committing to formally replacing the Cole Memo, which generally directed federal prosecutors not to interfere with state marijuana laws, with new guidance reiterating the approach.”)