In what appears to be the first penalty levied against a financial institution banking commercial cannabis businesses, Live Life Federal Credit Union has entered into an administrative order with the National Credit Union Administration (NCUA) for failures related to its cannabis banking program. The order, which was made public in February, listed several actions to be taken by the Credit Union regarding its Marijuana-Related Business (MRB) customers, along with other general Anti-Money Laundering (AML) deficiencies that must be addressed. Among them, developing a system to ensure that all Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) are filed accurately and timely, implementing an automated suspicious activity monitoring system and engaging a third-party to validate its effectiveness, and ceasing the Money Services Business (MSB) program. To learn more about the Live Life Federal Credit Union enforcement action, view the administrative order here.
Let’s dig a little deeper into some of the critical components of this consent order, and the lessons learned.
Elevate Your Due Diligence
Any risk professional tasked with determining whether a cannabis banking program makes sense for his or her institution knows the challenges. To efficiently understand the MRB’s risk profile, the financial institution needs to get information from the customer or other sources that adds friction to the onboarding process. Obtaining too little information at initial onboarding can increase the cost of maintaining the accounts and leave you with less information to decision unusual activity. Asking for too much information can lead customers to go to another financial institution. The large cost associated with ongoing monitoring of higher-risk accounts and limited resources are hard to balance. Live Life CEO Karla Haglund acknowledged this as a set-back in managing the Credit Union’s MRB portfolio. It is a challenge every compliance team faces, be it at a small credit union or a large multinational bank.
In the Live Life administrative order, the NCUA specifically called out several actions they expect the Credit Union to take by April 30th, 2021 to enhance ongoing monitoring of their MRB portfolio. This includes the requirement to implement an automated suspicious activity monitoring system that supports compliance with FinCEN requirements for MRBs. There were five distinct points made within the order, including systematic monitoring of unusual Automated Clearing House (ACH) or wire activity from MRB accounts, and monitoring of the red flags outlined in FIN-2014-G001 BSA Expectations Regarding Marijuana-Related Businesses. We are highlighting the remaining three requirements as follows because they are noteworthy:Â
- Reconciliation of MRB Point of Sale, METRC, or accounting system data relative to member deposits
- Ongoing monitoring of adverse public information affecting MRBs
- Timely verification of changes in licensure status, including notification of a lapse in an MRB’s state licensure
Lesson #1 – Reconciliation of POS and METRC Data
The Live Life administrative order is the first time we have seen a regulator specifically mandate that a financial institution must reconcile MRB Point of Sale, METRC, or accounting system data relative to deposits. In the past, this was simply a best practice implemented by financial institutions looking for a way to understand the expected transactions of their MRB customers, and identify deviations. Now, it appears that financial institutions should be looking at the track and trace data in their normal due diligence to build a stronger link between cash deposits and cannabis product sales.
As part of a risk-based approach, consider how your financial institution can integrate track and trace data for this higher-risk customer type. Formalize the approach to:
- How the data will be used to reasonably predict future transactions
- Training staff to understand how to interpret track and trace data
- When it is appropriate to use non track and trace data to validate a deposit
Track and trace data helps MRB customers provide transparency, and allows a quantitative way for financial institutions to mitigate risks associated with banking MRB customers. Further, reviewing track and trace data allows for access to supply chain data that can help spot possible inversion or diversion. Viewing data at various stages of the supply chain will give insight into many data points, such as how many harvests a customer might have per year, how many strains they may be managing at one time, size of operation, at what stage they pay taxes, etc. Most importantly though, there is no one-size-fits-all approach to reviewing track and trace data for unusual activity. If you choose to use track and trace data, remember that this information crosses the entire industry. Cultivators may look similar to each other, as manufacturers may, but the data for each sector or sub-sector must be understood by the financial institution to correctly identify suspicious activity.
Lesson #2 – Ongoing Monitoring of Adverse Public Information
Initial and continuous monitoring for adverse public information is a due diligence approach many financial institutions already take. This usually happens at account onboarding, throughout the life of the account, and as part of unusual activity monitoring. It can take the form of sanctions and other various watch lists, Politically Exposed Person (PEP) databases, internet search alerts, and other media monitoring, for example.
As part of a risk-based approach, consider how your financial institution can integrate ongoing monitoring of adverse public information for this higher-risk customer type. Formalize the approach to:
- Adverse public information that should be monitored specific to the commercial cannabis industry, such as enforcements issued by the regulator
- Reputational issues that you intend to find, like cannabis product recalls
- How to escalate any local status updates the relationship manager becomes aware of
- When to terminate a banking relationship based on adverse public information
Lesson #3 – Timely Verification of Changes in License Status
Financial institutions will generally gather license information as part of their CIP documentation. In higher risk customer relationships, like non-bank financial institutions, you would also recheck the documentation on a risk-based approach during ongoing due diligence and unusual activity monitoring.
As part of a risk-based approach, consider how your financial institution can integrate timely verification of changes in licensure status for this higher-risk customer type. Formalize the approach to:
- Verification at onboarding
- Verification by the expiration date
- Verification at every Limited SAR filing
You Can’t Go it Alone
Cannabis bankers need succinct answers to their most pressing cannabis-specific questions. This is still unchartered territory, and we need to build a community where emerging trends can be discussed and knowledge can be shared among risk experts. When I was working for a large financial institution contemplating the addition of an MRB portfolio, we were left trying to decide what form due diligence would take, how ongoing monitoring would be handled, and who would shoulder the cost of the additional responsibilities. It can feel overwhelming. This administrative order has proven that the various components we considered, such as adverse public information monitoring and license verification, are no longer best practices, but regulatory expectations. It has also proven that it is possible to maintain a cannabis banking program, as long as the proper controls are in place. As Live Life Federal Credit Union emerges from this administrative order, and more lessons are learned, cannabis bankers will be more empowered to make the appropriate risk-based decisions when it comes to managing their MRB portfolios.
The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.
Click here more information on how ACCCE can help our members in cannabis banking.
