I've participated in a few webinars and the topics have been discussed at training I attended, however i'm not going to lie i'm still confused on the basic level of hemp and CBD products. I think I've read too much and things are clear as mud but here goes....

if a retail business of ours now carries hemp infused products what are my obligations?

I am still looking through and learning what the MN state agencies have indicated, to use them as the first level of guidance.

I'll take a stab at getting you started, but you're on the right track with state agencies. Your state bankers association may have some resources or guidance as well.

I think it's easier to think about hemp and hemp-derived CBD separately. Hemp is now legal to produce, as long as it's produced under the guidelines of a state-sanctioned hemp growing program. Hemp stops being hemp and starts being marijuana when the THC levels exceed 0.3%. There are examples out there of purported hemp seeds testing high (hot hemp) due to environmental conditions, and if this happens it must be destroyed, so some of this is not only a BSA concern but potential have collateral/repayment/income/legal concerns.

The state has to submit their plan for regulating hemp to the USDA for approval before they implement it. Any hemp produced outside of this would be produced under the 2014 Farm Bill guidelines, which are far more strict. Ideally, if it's produced legally, you'll be able to obtain something from the state demonstrating so. Beyond that if you'd like to serve hemp producers you'd have to consider what appropriate amount of due diligence you think is appropriate to verify that they aren't doing something illegal (like growing marijuana).

CBD is, in my opinion, far more complicated. First, CBD is not exclusive to hemp, and can be derived from marijuana. Which plant it's extracted from determines it's federal legality. Next, the FDA has not issued a ruling on whether CBD is safe. In the most general sense, the FDA has stated that CBD can not be sold for human or animal consumption, and must not suggest in advertising or packaging that it has any health benefits. More information is here, and is updated fairly frequently: https://www.fda.gov/news-events/pub...rived-products-including-cannabidiol-cbd

Again, if you chose to bank CBD producers or sellers, you'd need to determine the appropriate level of due diligence so that you and your regulator are comfortable that your customers aren't doing something illegal and/or reportable.

ColoradoAML thank you for your time and response. I am starting first with Hemp and then coring down through the federal then state and then state agencies for their legal definitions. I know management's stance is to not bank hemp or marijuana customers, and they have made that statement in our policy; however in a recent webinar it was recommended to rather state "the bank will not knowingly bank...". they will think i'm jumping the gun on the amount of time I'm spending on this but our state already offers a hemp pilot program and medicinal marijuana is legal so my thought is we should demonstrate a more robust understanding of the two, complete with a risk assessment of each.

the grey area is - a current business customer who sells a CBD hemp derived product at their business? what is our obligation?
we also found a customer who rents their land to someone who grows industrial hemp. what is our obligation in this circumstance?

we are currently in the middle of an FDIC SNS exam - though their questionnaire touches on hemp and marijuana - I still plan on asking them their experience with examining other banks who have customers and what they haveseen in the way of policy and procedures.

follow up to our FDIC examiners being asked about their exposure to other FIs hemp / marijuana programs and explaining what we are currently doing.
their response was not much in the way of what other FIs have done but that our approach sounds solid: federal and state understanding of the laws pertaining to each, a risk assessment on each, recommend revisions to the current program statements, then channel it all up to senior management.

No regulator feels comfortable saying it - and I can't claim any special knowledge of their thinking - but I truly believe that they just don't care about CBD SARs. The problem is that they can't make a defensible public statement to that effect, because there's a key distinction between what's a *predicate* for money laundering (SUAs) and what's a *predicate* for SAR filing (any suspected federal violation). With few exceptions, selling CBD is a federal crime; therefore, by the letter of the law you must file a SAR. With that being said, it's in your best interest to try and get written guidance from FinCEN and your regulators saying that no SAR is needed - it may not work but it's worth a shot!

In the absence of that, here's a possible risk-based way to approach decision-making. Segment CBD sellers into different risk categories:

1. Direct/Primary CBD Sellers and Manufacturers: Anyone that's business is entirely CBD. This includes producers, processors, online retailers, and those "nothing but CBD" shops that seem to be cropping up everywhere. The conservative approach here is to file SARs on these types of customers. If you don't want to file - which is understandable since nobody outside the FDA cares - then you should discuss this with your regulators to determine their stance. From what I've heard, they probably won't take a stance either, so you'll end up needing to continuing SAR filing.

2. Ancillary CBD Sellers: Anyone whose main line of business isn't CBD, but sells CBD products considered illegal by the FDA. You should perform EDD to estimate their monthly CBD revenue and use that as the basis of your stance on SAR filing. If it does not project out to over $5,000 a quarter, then you can reasonably conclude that no SAR is warranted.

I *have* heard of some Banks openly and proudly saying "We're not filing any SARs on CBD, it's wasteful and utterly ridiculous" right in front of their regulators. And then, reportedly, having no issues in their subsequent examination. It's bold, but it's really the only intellectually honest stance one can take for not filing.

I'm not sure I agree that most CBD is sold illegally. I'd venture that if you were to review all of the CBD-based products at a CVS, for example, I bet they are all properly sourced from hemp and tested, are not to be consumed and don't market any claims of therapeutic or health benefits. That said, we have to know our customers and what they do, and who wants to have something as granular as that as part of an EDD? I do agree though that you're probably right about regulators having an unspoken apathy about CBD in general.

The approach Pat took regarding clearly labeling which CBD sellers are acceptable is very similar to what we've done, and I feel very confident with it.

Last point, I really appreciate your distinction between activities predicate to money laundering and activities predicate to SARs. That's something I've thought about for some time but haven't been able to put words to.

all of the above in immensely helpful. thank you.

following your two distinct categories, we have what would be considered ancillary CBD sellers: the products our customers are selling and I have read the product labels for, are hemp sourced / derived. Pending your suggestion to check with FINCEN, are you saying we should be filing SARs on the hemp sourced products?

2. only one place has edibles of CBD hemp sourced products. This too then would require filing SARs. Correct?

you could be either filing SARs or closing accounts and my guess is they would want to keep the businesses open because the little revenue actually coming from the CBD products. I mean your DOLGENs and pharmacies and chiropractors are good business relationships to have for the small Hemp derived chap stick they sell. Therefore I would lean towards your suggestion of getting some financial facts on how much of their business is CBD based v. there other areas.

think this will eventually show up on the CTR Exemption forms like the lottery sales?

I don't know that anyone can give you great guidance about whether or not to file a SAR many of these situations. I don't see why a lotion that doesn't market itself with health benefits that contains hemp-sourced CBD would require a SAR, for instance, but if this and every other thread on the topic highlight anything, it's that there is a lot of room for interpretation and you may likely have an examiner that understands things differently. If you aren't filing SARs for something, be prepared to defend yourself.

Regarding number 2, edible CBD, the FDA says that CBD cannot be added to food or marketed as a dietary supplement. One warning letter that the FDA sent out stated that because some CBD gummies were “delicious, edible CBD snacks," they are food and therefore not compliant. I infer from that that the FDA takes the stance that CBD just shouldn't be ingested, but that may be because I'm not terribly interested in trying to track down the definition of "food" under the FDA just to try and make a tenuous case why some edibles are legal.

On the other hand, is the FDA reading SARs? And is anyone who does read SARs going to do anything other than toss these SARs aside because they have better things to do?

In a nut shell, there's a lot of considerations regarding a lot of these products, and our conclusion was that the risks of getting it wrong and the time that would be required to do EDD isn't worth whatever benefit we'd get from these customers. We're just permitting those people with very low revenue from CBD in order to avoid getting caught saying we don't allow them then having an examiner find it in a gas station customer across the street. I don't intend to file SARs on those customers or to do anything more than cursory due diligence to determine that CBD is not a primary source of revenue.

These are great considerations, ColoradoAML and Pat Patriot Act. To me, the most interesting piece of this is the FDA conundrum as the FDA clearly says on their website that "it is currently illegal to market CBD by adding it to a food or labeling it as a dietary supplement" - meaning that the FDA seems to still be standing strong that CBD in food and as dietary supplements is illegal.

Yet, just last night I had an advertisement in my mailbox from a very large vitamin seller that had CBD supplements, drops, and creams all over the cover of their mail order catalog. So, apparently, even companies who are regulated by (and even had prior letters from) the FDA aren't that worried about the FDA's enforcement abilities.

That said, the biggest concern I see for bankers (which ColoradoAML pointed out) is that some examiners are going to take a hard line stance based on the FDA's public prohibitions. Therefore, I believe the advise Pat Patriot Act gave about talking to regulators proactively is going to be the best solution to avoid potential criticism and arguments from examiners. One could always file to be safe (and take the conservative approach), but I'm not so sure every regulator would expect that every time.

THANK YOU BOTH
I found the way Adam and ColoradoAML explained their rational in my scenario to be the clearest direction I have been given regarding CBD products.
Talk with my regulators AND email FINCEN to cover my basis. share with management and then document the rational for why we do or do not file SARs.

so thought I would follow-up with everyone … I emailed my regulator, FDIC, and FINCEN, both the exact same questions:

I am looking for guidance and clarification on the requirements for filing a SAR on a customer who sells CBD HEMP derived / sourced products.
Do you file a SAR based on all CBD hemp derived/sourced products or only on the edible and ingestible products?
Do you file a SAR based on a percentage of revenue the CBD products contribute to the entire revenues earned from the overall business?
What if the product hasn’t marketed itself as having health benefits say CBD Hemp Chapstick at a Dollar Store; do you still file a SAR on that customer because of what they are selling?
What if the customer is a DBA a CBD representative of a company whose business model is a direct marketing company and the bank now has knowledge the only source of revenue is from the HEMP derived products; do you file a SAR?
You could either be filing SARs or closing existing accounts and my guess is the management would want to keep the business accounts open because the little revenue actually coming from the CBD products. I mean your DOLGENs and pharmacies and chiropractors are good business relationships to have for the small Hemp derived chap stick they sell. If that becomes the discussion I would lean towards obtaining some financial facts on how much of their business is CBD based v. there other areas.

FINCEN reply was refer to the Guidance:
https://www.fincen.gov/sites/default/files/2019-12/Hemp Guidance %28Final 12-3-19%29 FINAL.pdf
and
https://www.fincen.gov/sites/default/files/shared/FIN-2014-G001.pdf

Regulator reply: first be aware if your customers are selling CBD products. are they >.3%? Is the customer aware of what they are selling? Can the customer prove the level of THC in the products they are selling and can they attest to it? Include a section on our CIP account opening documents to include asking the questions regarding MRB and HRB. Have them sign. In absence of actual guidance "do what makes sense" and take a "common sense" approach as long as there are no red flags and no change in their operation.

so I guess going forward, I am going to document my knowledge of current customers and their CBD products. Maybe just use them as a template of sorts to help establish the R.A. and up-channel my findings so ultimately the board can make a decision to bank them or not.

Thanks for the follow-up. The regulator reply surprises me, it's awfully specific. Something about "Have them sign," seems contrary to risk-based guidance to me, but I suppose I'm just used to answers more in the line of "it's your job to design the program, it's our job to evaluate it," and I shouldn't be critical when they actually give an answer to a question that's asked.

ColoradoAML - my conversation with the regulator regarding a signature was taken more as a suggestion, similar to how we handled the Internet Gambling question at account opening.

To me, the guidance the FDIC examiner provided works for CDD and whether or not to have a relationship, but still doesn't address whether a SAR needs filed. If we go back to the hemp guidance that FinCEN referenced, there are still two considerations I see from this:

"Because hemp is no longer a Schedule I controlled substance under the Controlled Substances Act, banks are not required to file a Suspicious Activity Report (SAR) on customers solely because they are engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations."

1) The first consideration is, how do you know the hemp product was created legally (in compliance with USDA regulations)? If it wasn't, then the guidance implies the SAR exemption wouldn't apply.

2) The second consideration is that the hemp guidance doesn't address the FDA conundrum. Specifically, my point here is that when CBD is being sold in violation of the FDA's rules (like in supplements, food, etc), then it isn't "solely" due to "growth or cultivation of hem" and it certainly isn't "in accordance with applicable laws and regulations" (as it clearly violates FDA regulations, according to the FDA). Therefore, I just don't see it as black and white that a SAR isn't required - in fact, it seems to me there is more evidence to file one due to the violation of FDA rules - and more specifically, the FD & C Act. (Now, whether or not a SAR should be filed as a Marijuana SAR is a whole different discussion entirely).

So, even while this FDIC examiner talked about due diligence and meeting the technical perspective of hemp (i.e. <0.3%), whose to say another examiner won't harp on a CBD product being in violation of the FDA's rules? Not to mention determining whether or not the CBD was created in accordance with USDA regulations?

The bottom line to me is that I just don't see enough evidence to not file a SAR when CBD is involved and, generally speaking, it also clearly violates FDA regulations. At this point, I think it is going to be almost impossible for most CBD (especially indigestible CBD and excluding certain topical/cream CBD) to not violate either 1) USDA regulations or 2) FDA rules. But the reality is that the guidance we have isn't enough, so proactively talking to regulators is the only thing that can be done, apart from just filing SARs.

Adam Witmer - you are correct, on both points; no clear answer from regulator on SAR filing; and SAR filing in the aspect of breaking or violating the FDA / USDA / FD &C Act.laws.

and so I will be in touch :-)

speaking with my regulators to clarify to file or not to file SARs based on CBD products.. a few points made were 1) hemp is legal, hemp derived CBD is legal and then 2) consider if it is the obligation of the FI to know if the person/business broke the law regarding the line of CBD products they may be selling. it is the FDAs problem to oversee and determine. However, if as a matter of course, FI is aware of customer and notice an uptick in the volume of business, an increase in cash deposits say, then filing a SAR at that $5k threshold might be considered. the main point stressed in summary was DOCUMENT, DOCUMENT, DOCUMENT within the SAR committee meetings the reason to file or not to file.

Thanks for sharing that information, JennKK2. I find it interesting that I keep hearing that hemp (as a general statement) is legal and CBD is legal. Maybe I am too conservative and I am certainly not a lawyer, but 1) isn't hemp illegal if it violates FDA rules (as the FDA certainly says it is) and 2) isn't hemp illegal if it is not grown in accordance with the USDA's regulations?

If the regulators didn't want us to file SARs on hemp at all, I'm not sure why they didn't just say that instead of saying that a SAR isn't required "solely because [a customer is] engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations," which to me isn't the same thing.

And this is exactly why I think it is important to have a conversation with your examiners so that you can defend what you do or don't do with hemp SAR filings.

Adam Witmer - I agree on your first paragraph. I'm my opinion, my regulator, in my opinion, leaned towards the not file side of the line, but footnoted the SAR committee's final determination to file or not would be key. I gathered the FI's job was not to do the FDA's job but IF YOU HAVE KNOWLEDGE does change the approach. I am taking the second statement to be if you have a hemp grower / cultivator as a customer and you have knowledge the hemp grower is not in accordance with the USDA because your due diligence determines as such, then a SAR filing would be warranted.

I too think it is interesting that FINCEN has not given a clear and precise directive, and yet the regulators seem to be. maybe because they are on the ground and seeing more hands on what is happening and how FI are formulating their policy and procedures, as well as up-channeling questions to FINCEN - maybe all of that will results in quantitative data and help FINCEN make a final determination.

Not every violation of law is a crime. You don't file a SAR on an employee that created an incorrect TIL disclosure, leading to a TILA violation, because the TILA violation is not a crime.

Growing hemp without the proper license under the state's program is a federal crime, just like growing marijuana. Selling CBD massage oil and claiming a health benefit may violate the FDA regulations, but is it a crime?

and they said as much - Is it Criminal?

I don't think so. Look at the FDA's warning letters to companies marketing CBD products. They threaten regulatory action, not criminal prosecution:

FDA warns 15 companies about CBD marketing

A big red flag I've seen is Hemp/CBD customers depositing large amounts of cash. Can someone please explain why Hemp and or CBD would be a cash intensive business? My only thought is that they are saying it is "Hemp" because no one can tell the difference without testing it.

I like the angle you're working here, but FinCEN has indicated in multiple guidance documents that the decision of law enforcement to prosecute or not prosecute a potential criminal violation has no bearing on the Institution's obligation to file a SAR.

The FDA issues warning letters first because the FDCA requires the government to establish intent to charge a felony. However, the FDCA does not require the government to establish intent to charge a misdemeanor violation of the FDCA. And they can issue criminal fines.

I've also inquired with the FDA on a similar line of questioning without getting a useful response, to no avail.

Thus far, the best bet is to continue engaging regulators and getting as much in writing as possible.