My state has published a list of companies issued a license to sell CBD products, and some of my customers are on it.

My concern is that an examiner will allege (falsely?) that a CBD oil seller is a "marijuana-related business" as defined by FinCEN.

I don't see the term "CBD" in existing FinCEN guidance on MRBs. Does anyone have a link that will explain where (or if) CBDs fit into medical or recreational marijuana policies or MRB guidance?

Thank you!

They don't and FinCEN has not expanded any guidance to cover CBD Oils.

The "magic" number for a CBD product to be considered marijuana is a THC level of more than 0.3%. If you choose to bank CBD Oil customers, you examiner will want to know what due diligence you have performed to verify that your customer's product complies with state licensing requirements and that it's THC levels are below required thresholds.

You may also want to consider the FDA's position that CBD is not approved as an additive to food or beverage and that it cannot be marketed as a cure for any disease. Marijuana guidance aside, if your due diligence concludes that your customer is deriving revenue from the sale of an illegal product, then you have to decide if the activity should be considered suspicious and result in a SAR. Here's a good place to start...

https://www.fda.gov/news-events/fda...committed-sound-science-based-policy-cbd

OP here: I've spent some more time researching and thinking about this.



Well, true, so, why do BSA officers waste time thinking about it? I mean since the guidance doesn't cover hemp or CBD, why is it even up to examiners to decide to attempt to arbitrarily wrap in CBD and hemp into the BSA exam? Since the guidance is silent on CBD and hemp, that means CBD and hemp sellers are not "marijuana-related businesses."



Why would we do any due diligence to confirm the state permit requirements were met for a business that has been issued a state permit? What I mean is, this is a compliance loop (or compliance hamster wheel?), that I hear my fellow bankers creating for themselves:
1. State publishes list of companies with CBD permits.
2. Bank panics and asks customer to prove it qualifies for a CBD permit (e.g., to send documentation that the state licensing requirements were met, including that the product info was submitted to the state and the products are below the state's required thresholds for THC content)
3. But.....if the customer does not qualify for a CBD permit, why would the state have issued them one? We have proof of #2 by reason of #1's existence.

Why are we inserting ourselves between the state and the CBD supplier as a regulator? The state is the regulator. The state determined that the business qualified for a permit, and issued them one. Why would I then, as their banker, want to go back and satisfy myself that I believe the state did its job correctly?

Trusting the government to do its job in such a way that their failure puts your job and institution on the line is not very smart based on the track record of the government.
I personally hate having to act like I'm a bloody detective just to satisfy BSA requirements but I have found no other alternative.

Think of it the same way we treat MSB's and Casinos with ATMs. They are already subject to regulation but I don't know any banks that don't do additional due diligence on them.

So are you proposing not to perform any due diligence on these customers because there is no guidance? Since CDD requires that we understand the normal and expected activity of all our customers including things like source of funds, I could not in good conscience turn a blind eye to an industry that is potentially higher-risk given its close proximity to the marijuana industry.

You may not be the CBD merchant's regulator, but you do have reporting obligation under the BSA to identify funds deposited through your institution that are derived from illegal activity. Your institution's risk tolerance and policy/procedure will have to determine what documentation you will require for you to determine a legitimate source of funds.

To your other questions:

1. Verifying the permit through the state website is due diligence so, fine don't ask the customer for the permit.
2. The fact that the business has a permit to sell CBD does not guarantee that the suppliers from whom they obtain product are appropriately licensed or that the product complies with state law.
3. No, you don't.

Example. Here in the fine state of Illinois, the Department of Agriculture has stated that it will be regulating hemp growers. The law states that products require inspection and testing for CBD levels. Illinois is broke so we have maybe three inspectors. Thus they are allowing the business to self-test and destroy product, "on the honor system."

If I have a customer who abuses the honor system, and I am not filing SARs because I didn't bother with due diligence, I'm sure my regulators will understand.

At a minimum, if you know you have them, make sure your BSA Risk Assessment speaks to them and that your policy and procedures address how you will handle them.

BrianC, how would you suggest a bank go about determining whether a CBD customer's product complies with state law?

Step 1: Ask bank counsel to review state law to determine what is required as far as licensing, permits, etc.
Step 2: If your state has a website that lists this information, review it to see if your customer is on it.
Step 3: Ask the customer to provide any documentation that its suppliers provided to demonstrate compliance.
Step 4: Review marketing and packaging materials as needed to ensure there are no misleading statements that may run afoul of FDA requirements.
Step 5: Document your conclusion in your CDD/EDD file.

Until there is firm guidance, regulatory risk elevates which leads me to want to ask for more documentation, not less.

Thanks, that seems reasonable, although I question Step 4. IMO it is not the bank's responsibility to monitor its customers product for FDA compliance.

Based on this thread - I assume that there is a recommendation to ask business clients if they are or will be selling CBD oil? In other words, add a question to a "New Business" Questionnaire on CBD Oil.

Just to be clear - You are suggesting a certain alleviated level of Customer Due Diligence on any customer that is involved in the sale of CBD oil if the bank has knowledge.

OP here: What I"m suggesting is no due diligence is triggered by the customer having a state license to sell CBD products. I don't even need to search the permit list and see which of my customers are on it - because, there is nothing I can do with that information. CBD is not subject to FinCEN's existing guidance; and neither is hemp. We need not invent complex, onerous compliance burdens for ourselves where none exist.

If the state doesn't do the necessary steps to determine a permit is allowable before issuing a permit (or fails to regulate it in some way; for instance they issue a permit but fail to ensure the customer sells and continues to only sell legally permissible products) that's not putting the "bank on the line." That's the state's failings. If they have 3 inspectors and need 300, that's not my problem.

An analogy: Many of my customers (such as grocery stores, restaurants, and bars) ave a license to sell alcohol. I do not ask any of them to prove to me that they qualify for the license or permit; that's the state's job. The permitting/licensing process, and the number of inspectors the state employs, is none of my concern. I don't have to ask the customer where they get their alcohol, what kind it is, or what the chemical composition of each product may be. They might be selling, in addition to beer, something else like absinthe or moonshine or wine laced with antifreeze, but that's not the role of the bank to detect. I don't have to visit the store and read all the product labels, and go behind the bar and into the storeroom to look for hidden product. And yet, that's what some banks seem to want to do with CBD products. I have banker friends who actually do site visits when they learn that their grocery store customer sells a CBD product; their reaction is based on panic and blind fear of enforcement of nonexistent requirements.

It is wholly absurd to suggest that a bank should be responsible for determining that a customer complies with permit requirements when a permit has already been issued by the government. My BSA policy/procedures say so. If someone suggests that they need to be changed, I'll happily consent when they show me the written regulatory requirement.

OP again:
As was suggested above, you’d need to read your state’s CBD permitting law (or have counsel do it) but the below is based on my state’s CBD law. Your mileage may vary.

BSA Policy/Procedures Excerpt:

FinCEN’s FIN-2014-G001, BSA Expectations Regarding Marijuana-Related Businesses, does not make the claim that CBD is a marijuana product. Thus, a business dealing in hemp or CBD products does not fall under FinCEN’s definition of marijuana-related business.

Our state requires that sellers of CBD products should obtain a permit to sell CBD, and that no permit will be issued unless the CBD is either derived from hemp or contains less than 0.3% THC. Thus, any retailer appearing on the list of permitted businesses is authorized to sell what the permit covers, which are products defined as legal by the state and the permitting process. For this reason it would be futile for the bank to attempt to become the regulator of the CBD industry by attempting to become aware of the source, supplier, or chemical structure of any our customer’s products. The state is the regulator, and requires sellers to submit labeling and product information directly to the state. If any of our customers are issued a license to sell CBD, then obviously the customer has met the state’s requirements for the license, including labeling and product information which had to be reviewed by the state in order for the permit to be issued.

At this time, any business customer which has been issued a permit by the state to sell CBD products is considered “low risk” as to any supposed CBD-related risks to the bank (much like how a license to sell alcohol does not add BSA risk to a customer’s profile). Since the state is monitoring and permitting these products, there is no additional enhanced due diligence required on the part of the bank. The bank is not required to keep a list or inquire which of its customers have a permit to sell CBD, since having that information would not supply the bank any additional useful information or create any additional due diligence requirements on the part of the bank.