Agree with John. Because there are no regulations or guidance to lean on, you need to define MRBs in your cannabis banking or BSA/AML policy. The way we suggest is that plant touching businesses are defined as "direct MRBS" and then businesses who derive substantial income from MRBs, say 51% ore more, are defined as "indirect MRBs".
Defining the portion of this CRE customer's revenue which is obtained from MRB will help you define your risk, and subsequently what efforts you need to take under your cannabis banking or BSA/AML policy in terms of monitoring.
You do not need to file marijuana SARs on indirect businesses, but need to potentially file if there is anything suspicious occurring under standard FinCEN guidance.