Cannabis Banking in 2027: Federal and State Regulatory Landscape
6/28/2026
Two things were unresolved at drafting and must be verified before publication: (1) the federal scheduling of marijuana under the Controlled Substances Act, which was the subject of an administrative rescheduling proceeding, and (2) federal cannabis banking legislation (introduced in successive Congresses as the SAFE and later SAFER Banking Act), which had not been enacted. Do not describe either as settled, and do not state that any legislation provides a safe harbor unless it has actually become law.
State law varies enormously and changes frequently. This post deliberately describes no individual state's regime. Any state-specific content added must be verified and dated.
Recommendation: have counsel review before publication, and consider retitling away from a specific year.
---
Cannabis banking is the clearest example in American financial regulation of a business that is lawful under state law and unlawful under federal law, with banks caught in the gap. Every decision an institution makes here follows from understanding that gap precisely.
The Conflict
Marijuana has been a Schedule I controlled substance under the federal Controlled Substances Act, meaning federal law treats its manufacture, distribution, and possession as criminal offenses. A rescheduling proceeding was underway at drafting and its outcome must be verified.
Meanwhile, a substantial number of states have legalized cannabis for medical use, adult use, or both, and license businesses to operate.
For a bank, the consequence is that proceeds from a state-licensed cannabis business are, under federal law, proceeds of unlawful activity. That single fact drives everything else:
- Handling those proceeds implicates federal money laundering statutes
- Property involved may be subject to forfeiture
- The BSA obligation to report suspicious activity is triggered, not excused, by the customer's state licensure
Critically, state legalization does not change federal law. A bank operating in a state with a mature regulated market still holds federal exposure. This is the point institutions most often blur, sometimes because a customer or a state regulator has told them otherwise.
What FinCEN's Guidance Actually Does
FinCEN issued guidance in 2014 — FIN-2014-G001 — clarifying BSA expectations for institutions providing services to marijuana-related businesses. It remains the operative framework.
What it does: describes the due diligence FinCEN expects, and establishes three SAR categories for reporting activity involving marijuana-related businesses.
What it does not do: make cannabis banking lawful, provide immunity, or relieve any federal criminal exposure. It is guidance about how to satisfy BSA reporting obligations while serving such a customer. An institution that reads it as permission has misread it.
The guidance was issued alongside a Department of Justice memorandum setting enforcement priorities — the Cole Memo — which was rescinded in 2018. The FinCEN guidance survived that rescission; the prosecutorial-restraint framing around it did not.
The three SAR categories
Marijuana Limited. Filed where the institution reasonably believes the business does not implicate the enforcement priorities and is not violating state law. It is an abbreviated filing indicating the institution is serving a marijuana-related business and has no additional suspicious activity to report.
Marijuana Priority. Filed where the institution believes the business implicates one or more enforcement priorities or is violating state law. It requires detail on which priority or violation is implicated.
Marijuana Termination. Filed where the institution decides to terminate the relationship in order to maintain BSA compliance.
Two operational points. These filings are ongoing rather than one-time — an institution serving such a customer files continuing reports on the applicable schedule, which is a permanent workload rather than an onboarding cost. And the category is a judgment the institution must document, because filing Limited where Priority was warranted is a substantive failure rather than a coding error.
Due Diligence FinCEN Expects
The guidance sets out expectations beyond ordinary customer due diligence, including:
- Verifying state licensure with the relevant state authority, not merely accepting the customer's documentation
- Reviewing the license application and related documentation the business submitted to the state
- Understanding the normal expected activity of the business, including products, customers, and suppliers
- Ongoing monitoring for activity inconsistent with that expectation, and for any indication the business is violating state law or implicating enforcement priorities
- Periodic refresh of the information, including confirming the license remains in good standing
- Monitoring adverse information about the business and its owners
In practice this is a materially more intensive program than standard enhanced due diligence, and the institutions that do it well treat it as a specialty function rather than an addition to an existing officer's caseload.
Adjacent and Indirect Exposure
The harder question for most community banks is not whether to bank a dispensary. It is what to do about businesses connected to the industry.
A commercial landlord leasing to a licensed dispensary. An accounting firm with cannabis clients. A security company, an equipment supplier, a packaging manufacturer, a staffing agency, a utility. An employee of a dispensary depositing a paycheck. A hemp business, which is regulated differently from marijuana following federal farm legislation and is a genuinely distinct category that institutions frequently conflate.
None of these has a clean answer, and an institution needs a documented position on each category rather than a case-by-case improvisation. The absence of a written policy is what produces inconsistent treatment, which is itself an examination and fair-treatment problem.
The Decision Framework
Whether to serve this industry is a board-level decision, not a compliance decision. It should be made explicitly and recorded.
If the institution decides not to serve it, that decision needs a written policy, a means of identifying such customers at onboarding and in the existing portfolio, a procedure for exiting relationships discovered later, and consistent application. Institutions that decline informally end up serving some and not others, with no recorded basis.
If the institution decides to serve it, the requirements are substantial: board approval with documented risk acceptance, a dedicated program covering the FinCEN due diligence expectations, staff with specialized training, monitoring calibrated to the industry, a SAR process handling continuing filings, pricing that reflects the true cost of the program, legal counsel engaged, and confirmation that the institution's insurance and correspondent relationships accommodate the activity.
That last item is easy to overlook and can be decisive. A correspondent bank, a core processor, or a card network may have its own position on cannabis-related activity, and an institution can find its program constrained by a counterparty rather than by regulation.
What Was in Motion
Verify each before publication:
Federal rescheduling. An administrative proceeding to move marijuana to a different schedule under the Controlled Substances Act was underway. A change in schedule would alter the federal legal analysis substantially but would not by itself resolve the banking question, and its status must be confirmed.
Federal banking legislation. Bills addressing financial services for state-licensed cannabis businesses have been introduced in successive Congresses without enactment. Until such legislation is law, no safe harbor exists — and describing a pending bill's protections as available would be a serious error.
State expansion, continuing on its own timeline and irrelevant to the federal analysis.
Structured coverage of the underlying compliance framework is available through our BSA training, AML training, and the Certificate in BSA and AML Compliance.
Why Institutions Get This Wrong
Four recurring errors, each traceable to a specific misunderstanding.
Treating state licensure as federal authorization. It is not, and a customer's state license is evidence for the due diligence file rather than a resolution of the legal question.
Reading FinCEN guidance as permission. It describes how to report while serving such a customer. It does not make the underlying activity lawful.
Relying on a rescinded memorandum. The Cole Memo's enforcement-priority framing is still cited in industry conversation years after its rescission.
Assuming pending legislation is protection. A bill that has not been enacted provides nothing, and this is the error with the largest downside.
The common thread is that each substitutes a comfortable proposition for the actual legal position. For a compliance officer, the useful discipline is to be able to state the federal position accurately in one sentence, and then to describe the institution's decision as a deliberate acceptance of that risk rather than as an absence of risk.
The Operational Reality: Cash
Whatever an institution decides about the legal question, the industry's defining operational characteristic is cash volume, and it deserves separate treatment because it drives both the risk and the cost.
Businesses that cannot obtain conventional banking operate in currency, and a dispensary's daily deposits can reach amounts that would be extraordinary for a comparable retail business. That creates several concrete problems for a bank that accepts them.
Currency transaction reporting at scale. Deposits routinely exceed the reporting threshold, generating continuous CTR filings alongside the continuing marijuana SARs. The volume is predictable and the administrative load is permanent.
Cash handling logistics. Counting, verifying, and transporting large currency volumes requires vault capacity, armored carrier arrangements, and staff time. Several institutions serving this industry have found the physical handling more constraining than the compliance program.
Verification difficulty. Confirming that currency deposits reconcile to a business's licensed sales requires access to state seed-to-sale tracking data or point-of-sale records, and the reconciliation is the core monitoring control. Without it, the institution is accepting cash it cannot tie to lawful activity — which is precisely the condition the BSA exists to address.
Employee safety. Businesses holding large cash balances are robbery targets, and so are the branches receiving them.
Structuring risk. A business trying to reduce reporting friction may deposit below thresholds, and the institution must monitor for it in a customer whose legitimate activity is already cash-intensive.
The corollary is a pricing conversation. An institution running a genuine program for this industry incurs real costs — dedicated staff, specialized monitoring, legal counsel, continuing filings, cash logistics — and institutions that price the relationship as ordinary business banking are subsidizing it. Those that do this sustainably charge accordingly, and are explicit with customers about why.
For an institution deciding whether to enter, the cash question is worth answering before the legal one. A bank without vault capacity, carrier arrangements, and access to reconciliation data cannot run the monitoring the guidance expects, regardless of how its board feels about the federal exposure.
Frequently Asked Questions
Is it legal for a bank to serve a state-licensed cannabis business?
The activity remains unlawful under federal law where marijuana is a Schedule I controlled substance, regardless of state licensure, so proceeds are federally treated as proceeds of unlawful activity. Some institutions serve the industry with extensive programs and documented board risk acceptance; the decision is an acceptance of federal exposure rather than a determination that the exposure does not exist. A rescheduling proceeding was pending at drafting and its status must be verified.
Does FinCEN's 2014 guidance make cannabis banking permissible?
No. It clarifies BSA expectations — the due diligence FinCEN expects and three SAR categories for reporting — for institutions that choose to serve marijuana-related businesses. It provides no immunity and does not alter federal criminal law. Institutions that read it as authorization have misread it.
What are the three marijuana SAR categories?
Marijuana Limited, where the institution reasonably believes the business does not implicate enforcement priorities and is not violating state law; Marijuana Priority, where it believes a priority is implicated or state law is being violated; and Marijuana Termination, filed when the relationship is being ended for BSA compliance reasons. Filings are continuing rather than one-time.
What due diligence does FinCEN expect?
Verifying state licensure directly with the state, reviewing the license application materials, understanding the business's expected activity including products, customers, and suppliers, ongoing monitoring for inconsistent activity or state law violations, periodic refresh including license standing, and monitoring adverse information about the business and its owners.
What about businesses that only serve the cannabis industry?
Landlords, accountants, suppliers, security firms, staffing agencies, and employees depositing paychecks all present indirect exposure with no clean answer. An institution needs a written, consistently applied position on each category. Hemp is a genuinely distinct regulatory category that institutions frequently conflate with marijuana.
Has federal legislation resolved cannabis banking?
Bills addressing financial services for state-licensed cannabis businesses have been introduced in successive Congresses without enactment as of drafting. Until such legislation becomes law, no safe harbor exists, and treating a pending bill's protections as available is the most consequential error an institution can make in this area.
