Because the possession and sale of marijuana, or cannabis, is generally illegal under the federal Controlled Substances Act, depository institutions have been reluctant to provide financial services to cannabis-related businesses, even in states where the activities of such businesses are lawful.
Depository institutions have been justifiably concerned that serving such businesses would violate anti-money laundering laws that prohibit a depository institution from receiving the proceeds of an illegal activity. The tension between the federal prohibition and more permissive state laws has created significant uncertainty for financial institutions seeking to serve the cannabis industry, a state-legal market that is expected to exceed $23 billion by 2022.
Possible Reform: Secure and Fair Enforcement (SAFE) Banking Act of 2019
The SAFE Banking Act, which the U.S. House of Representatives passed on September 25, 2019, would clear the way for depository institutions to serve cannabis-related businesses in states where cannabis activities are legal. (Such businesses are defined as “cannabis-related legitimate businesses.”)
In particular, the SAFE Banking Act provides that proceeds from a cannabis-related legitimate business are not to be treated as proceeds from an illegal activity for federal anti-money laundering purposes. The act also protects depository institutions that provide services to cannabis-related legitimate businesses and their service providers from adverse action under federal law.
Thus, the SAFE Banking Act would allow depository institutions to lawfully provide financial services to cannabis-related businesses operating in compliance with state law, notwithstanding the general prohibition on marijuana use under the federal Controlled Substances Act. The SAFE Banking Act is on its way to the U.S. Senate where it is expected to face greater scrutiny and potential resistance.
Current Opportunities: What is Permitted in Virginia Today
Whatever the ultimate fate of the SAFE Banking Act, depository institutions should consider whether to serve cannabis-related businesses in Virginia under current law, particularly in light of recent developments relating to industrial hemp.  Of course, whether to serve any particular cannabis-related business, and the financial products and services that might be offered to any such business, is a business decision for an institution, based on its own risk management policies.
Industrial hemp activities are now authorized under both federal and state law. The Agriculture Improvement Act of 2018, commonly known as the 2018 Farm Bill, legalized the commercial production of hemp by removing hemp and its derivatives from the definition of marijuana under the federal Controlled Substances Act.
“Hemp” is defined under federal law as cannabis that contains no greater than 3% tetrahydrocannabinol (THC). THC is the psychoactive compound found in cannabis that produces the “high” sensation. While marijuana and hemp come from the same plant, Cannabis sativa, they are distinct in their use and chemical makeup. This distinction is critical: hemp is legal based on its low THC content, while marijuana is not.
Hemp and Virginia Legislation
The 2018 Farm Bill authorizes a state desiring primary authority for regulating and monitoring hemp production to submit a plan to the U.S. Department of Agriculture for approval. Under this authority, the 2019 Virginia General Assembly enacted legislation to conform Virginia law to the hemp provisions in the federal bill and establish a state framework for the regulation of industrial hemp activities. The Virginia legislation legalizes the production of “industrial hemp,” allowing a person to apply to the Virginia Department of Agriculture and Consumer Services (VDACS) for registration to act as an industrial hemp grower, dealer, processor, or an agent of a registrant.
Under the Virginia legislation, an applicant for an industrial hemp registration must include a written consent authorizing the state police and other law enforcement officials to enter the premises of the registrant to conduct inspections to ensure compliance with the law. In addition, a registrant must allow the VDACS to monitor and test the registrant’s industrial hemp for compliance with the THC limit (i.e., no greater than 0.3% THC). The VDACS may require the destruction of any cannabis grown, dealt, or processed that is tested and found not to satisfy the THC limit.
Hemp and the USFDA
While hemp is now legal under both federal law and Virginia law, the U.S. Food and Drug Administration (USFDA) maintains regulatory authority over cannabis or cannabis–derived compounds offered for human consumption, even if any such product is derived from industrial hemp and contains 0.3% THC or less. Thus the USFDA requires a cannabis product (hemp–derived or otherwise) marketed with a claim of therapeutic benefit, or other disease-related claims, to be approved by the USFDA before it is introduced into interstate commerce. It is uncertain when the UFSDA will provide a regulatory framework for cannabis-derived products intended for human consumption.
At the state level, however, the Northam Administration has directed the VDACS to treat hemp-derived extracts intended for human consumption as approved food additives and to place qualifying registered hemp-derived industrial hemp processors under food inspection safety so that approved processors can manufacture such hemp-derived extracts.
Hemp and Banking Virginia
What does the recent hemp legislation mean for banking in Virginia? While there has been helpful regulatory guidance for credit unions from the National Credit Union Administration, there has been little in the way of guidance from the federal banking agencies, despite letters from federal lawmakers and industry trade groups urging the agencies to provide such guidance.
Nevertheless, since hemp-related activities are now lawful under both federal and state law, a depository institution providing financial services to a registered hemp business operating in compliance with the law would not run afoul of federal anti-money laundering laws since it would not be receiving the proceeds of an illegal activity.
Of course, as discussed below, the most important issue for a depository institution is ensuring that any such business is operating, and will continue to operate, in compliance with applicable law.
Virginia law permits a medical practitioner to issue a written certification for the use of CBD oil or THC-A oil for the treatment of an individual’s diagnosed condition or disease. In this regard, CBD oil has become quite popular for its therapeutic benefits.
Under Virginia law, CBD oil must be at least 15% CBD and no more than 5% THC. THC-A oil must be at least 15% THC-A and no more than 5% THC. In December 2018, the Virginia Board of Pharmacy awarded conditional approval to five pharmaceutical processors for the purpose of cultivating cannabis for the production of CBD oil and THC-A oil.
The possession of CBD oil or THC-A oil for medical purposes is an affirmative defense to a prosecution for possession of marijuana under Virginia law. Thus, Virginia law does not legalize the use of medical marijuana, but instead provides an affirmative defense to its use. Of course, if the CBD oil or THC-A oil is derived from industrial hemp and satisfies the THC limit of 0.3%, that product is legal under Virginia law.
With respect to federal law, CBD oil and THC-A oil remain illegal under the Controlled Substances Act unless it is derived from industrial hemp. In addition, CBD oil offered for medical use must be approved by the USFDA even if it is produced from industrial hemp. Again, it is uncertain when the USFDA will provide a regulatory framework for cannabis-related products intended for human consumption.
Federal Guidance and Enforcement
Importantly, however, after the so-called “Cole Memo” adopted during the Obama Administration, the U.S. Department of Justice adopted a hands-off approach to cannabis enforcement in states where marijuana has been legalized. While Attorney General Jeff Sessions rescinded the Cole Memo on January 4, 2018, current Attorney General William Barr signaled his intention to follow the Cole Memo and not target cannabis-related businesses operating in compliance with state law.
In addition, on February 14, 2014, the Financial Crimes Enforcement Network (FinCen) issued its own guidance regarding cannabis-related businesses in conjunction with the Cole Memo. The FinCen guidance provides instruction for depository institutions on their due diligence requirements in serving cannabis-related businesses and the filing of Suspicious Activity Reports (SARs) while the activities of such businesses remain illegal under federal law.
Finally, the Rohrabacher-Blumenauer Amendment, a rider to federal spending bills since 2014, prohibits the use of federal funds to prevent states from implementing their own laws authorizing the use, distribution, possession, or cultivation of medical cannabis.
Medical Marijuana and Banking in Virginia
What does the current state of the law relating to medical marijuana mean for banking in Virginia? Importantly, medical marijuana remains illegal under federal and state law unless it is qualifies as hemp. (Note, again, Virginia has not legalized the use of medical marijuana, but simply provided an affirmative defense to its use in a criminal marijuana prosecution.) Thus, depository institutions should understand the risks of providing financial services to those engaged in medical cannabis activities in Virginia.
Based on the apparent position of the current U.S. Attorney General and the dictates of the Rohrabacher-Blumenauer Amendment as described above, federal enforcement action in states where medical marijuana use is permitted appears generally unlikely. Moreover, the 2014 FinCen Guidance implicitly indicates from a regulatory standpoint, serving such businesses is permitted if the enhanced due diligence standards are followed. It is unclear, however, how these would apply in Virginia since the state has not “legalized” medical marijuana but simply established an affirmative defense in connection with its use.
Legal and Regulatory Considerations
Depository institutions interested in serving cannabis businesses in Virginia must evaluate the risks of offering a particular product or service to any such business and how best to manage such risks. A thorough due diligence review of the business and an understanding of the laws applicable to its operations are a critical part of such an assessment.
An institution that makes the business decision to serve cannabis-related businesses should incorporate its risk assessment process into its Bank Secrecy Act policies and procedures.
With respect to serving hemp-related businesses, the critical issue for a depository institution is determining whether any such business is operating in compliance with the hemp provisions in Virginia law (compliance with Virginia law also constitutes compliance with federal law under the 2018 Farm Bill) and monitoring the business to ensure ongoing compliance.
In this regard, a depository institution should consider the following:
- review and record a copy of the current VDACS registration for such business;
- verify the registrant’s good standing through VDACS;
- obtain a certificate from the business as to its compliance with the law and require periodic updates as to the business’s ongoing compliance, particularly with respect to THC level requirements;
- develop an understanding of the normal and expected activity for the business, and, as appropriate, obtain a list of the business’s current suppliers and customers;
- require the business to provide testing results for THC levels;
- obtain an indemnification agreement to protect the institution against risks associated with the business’s non-compliance; and
- establish a process for ongoing monitoring of the business and its accounts.
(Note that the 2014 FinCen Guidance does not appear to apply to lawful hemp activities since these activities are legal under both federal and state law.)
Depository institutions serving hemp-related businesses should also be mindful of certain risks associated with relying on industrial hemp or hemp products as collateral. In particular, since Virginia law authorizes the VDACS to destroy any hemp that does not satisfy permissible THC levels, there is the risk that a depository institution’s collateral could be wiped out. In this regard, our understanding is that while hemp is now eligible for federal crop insurance, such insurance would not cover such destruction since the destruction would not be the result of “natural causes.” Also, to the extent any hemp product is offered for human consumption, a depository institution needs to assess any risks associated with USFDA requirements.
Serving Hemp and Medical Marijuana Business in Virginia: Summary
As long as a hemp business is operating in compliance with Virginia’s hemp laws, then a depository institution may provide that business with banking services without running afoul of the federal anti-money laundering laws since it would not be receiving the proceeds of an illegal activity. Accordingly, a depository institution is generally not required to file SARs in connection with serving such businesses.
With respect to serving businesses engaged in medical marijuana activities, a depository institution should understand that medical marijuana is not legal under federal and state law unless it is legal hemp (i.e., THC of 0.3% or less). While federal policy directives (Cole Memo, 2014 FinCen Guidance, and Rohrabacher-Blumenauer Amendment) are helpful, it is uncertain how these would apply in Virginia since the state has not “legalized” CBD oil and THC-A oil, but merely established an affirmative defense to their use. Any depository institution that seeks to serve businesses engaged in the production of CBD oil or THC-A oil should follow the due diligence requirements outlined in the 2014 FinCen Guidance. In addition, the depository institution should file SARs in connection with service to such businesses.
 21 U.S.C. §§801-971.
 According to the National Conference of State Legislatures, as of July 2019, eleven states and the District of Columbia have legalized marijuana for adult recreational use, and 33 states and the District of Columbia have legalized medical marijuana.
 Arcview Market Research & BDS Analytics, The State of Legal Marijuana Markets (SOLMM6) (6th Ed. 2018).
 H.R. 1595 (116th Congress).
 Under Virginia law, it is generally unlawful to sell, give, distribute or possess marijuana (with the intent to sell, give, or distribute such marijuana). Va. Code §18.2-248.1.
 Pub. L. 115-334.
 See Congressional Research Service Report RL32725, July 9, 2018.
 H.B. 1839 & S.B. 1692 (2019 Va. Gen. Assembly Session).
 “Industrial hemp” is defined under Virginia law as cannabis with a THC concentration no greater than allowed under federal law (i.e., .3%). Va. Code §3.2-4112.
 Regulatory Alert, Serving Hemp Business, No: 19-RA-02, August 2019. [pdf] The guidance states in pertinent part that federally insured credit unions may provide the customary range of financial services to lawfully operating hemp-related businesses and sets forth risk management considerations for serving such businesses.
 Va. Code §§18.2-250.1 & 54.1-3442.8.
 See 7 U.S.C. §1508(a)(1).