On-Site ATMs: Know Your Money Laundering Risks

Automated Teller Machines (ATMs) can be found in convenience stores, gas stations, train stations, sporting venues, and at a commercial cannabis business.

The commercial cannabis industry uses ATMs on-site to allow customers access to cash. In some jurisdictions, payment providers may restrict payment options other than cash to purchase cannabis products because of regulation or business decision.

Risk Factors

In many jurisdictions, bank-owned ATMs are not allowed on a commercial cannabis business’s premise. Privately-owned ATMs are those not owned by a regulated financial institution. Privately-owned ATMs provide advantages to commercial cannabis businesses, but they are known for being susceptible to money laundering. When an ATM is not owned by a financial institution, ownership and control may not be fully disclosed or properly documented, resulting in a lack of transparency. This lack of transparency may allow money launderers an access point to the financial system.

Private ATMs are generally owned by un-regulated businesses that operate with less oversight of controls and reduced record keeping. By exploiting weak controls and reduced record keeping prevalent in privately-owned ATMs, money launderers have historically used this access point to anonymously facilitate their money laundering scheme.

Red Flags Associated with ATMs on Premise

• The owner or controller of the ATM service is unknown
• Value and volume of ATM transactions significantly deviate from expectations
• ATM transactions occur when premised are not open
• High volume of ATM transactions occur when the store opens or is about to close

Risk Mitigation

Commercial cannabis businesses should establish or enhance control activities, training, and assurance for vendor risk management to control and monitor ATMs.

The following are a sample of risk mitigations that should be considered:

• Implement formal control activities for vendor risk management that establishes procedures to assess ATM risk, conduct initial risk-based due diligence, and implement ongoing risk-based monitoring. These may include:
  • Establishing the expected size and frequency of ATM transactions throughout the contract or twelve-month period for replenishment and customer use
  • Implementing risk-based procedures that appropriately identify the owners and controllers to determine if they have a criminal background or identified negative news
  • Implementing risk-based monitoring of the ATM transactions to determine if there are unusual transactions

• Require contract terms and conditions based on the risks associated with the ATM
  • Provide for the right to audit
  • Increase termination options
  • Require notification of change in ownership or control

• Implement risk-based procedures to terminate privately-owned ATM relationships that become unusual or suspicious
• Create risk-based training for employees in vendor risk management to detect and report unusual ATM activity

The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.

Click here for more information on how ACCCE can help our members at commercial cannabis businesses.