Start by Defining the Program
Cannabis banking carries risk. That should not be minimized. But risk is not the same as chaos. The question for a financial institution is whether the risk can be identified, measured, monitored, controlled, and reported.
A manageable cannabis banking program begins with scope. The institution should decide which customer types it will serve, which products it will offer, which markets it will enter, and which activities are outside its risk appetite. Without scope, the program can drift. With scope, the institution can build policies and procedures around actual decisions.
Due Diligence Is the Foundation
The next step is due diligence. FinCEN’s guidance lists key diligence expectations, including verification of state licensing, review of license materials, understanding expected activity, monitoring public information, monitoring suspicious activity, and refreshing customer information based on risk [1]. Those expectations are not optional background work. They are the foundation of the program.
Risk management also requires staffing and systems. A cannabis program cannot live inside one employee’s inbox. It needs documented procedures, file standards, review calendars, alerts, escalation paths, SAR decisioning, quality control, audit testing, and management reporting.
Govern Vendors and Test the Controls
Vendors matter too. Many institutions use outside technology, consultants, armored carriers, or monitoring tools to support cannabis banking. Federal banking agencies have emphasized that use of a third party does not remove the bank’s responsibility to operate safely and comply with applicable laws [3]. That means vendor due diligence and ongoing monitoring should be part of the program design.
The most important mindset shift is this: cannabis banking risk should be governed like a program, not handled like a series of exceptions. The FFIEC BSA/AML Examination Manual supports a risk-focused framework for assessing and supervising BSA/AML risk [2]. That same discipline applies here.
Cannabis banking risk is manageable when the institution builds the program before it grows the program. Start with policy. Add training. Document decisions. Monitor activity. Test the process. Report to leadership. Adjust when the market changes.
Risk does not disappear. But with the right structure, it can be understood and managed in a way that supports both compliance and business strategy.
---
Sources
1. [FinCEN, BSA Expectations Regarding Marijuana-Related Businesses (FIN-2014-G001)](https://www.fincen.gov/resources/statutes-regulations/guidance/bsa-expectations-regarding-marijuana-related-businesses)
2. [FFIEC BSA/AML Examination Manual](https://bsaaml.ffiec.gov/manual)
3. [FDIC, Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023)](https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html)
### Continue Learning
For practical risk-focused education, explore ACB’s [certification programs](https://the-acb.org/cannabis-banking-professional) and [live education calendar](https://the-acb.org/upcoming-webinars).
Original PDF: https://the-acb.org/s/Risk-Management-d5fd.pdf
ACB editorial note: This article adapts previously published content. Regulatory statements should be reconfirmed at the time of publication. The article is educational, not legal advice.
