Cannabis Banking: A Banker's Guide to Serving Marijuana and Cannabis-Related Businesses

Banking cannabis is permitted, not prohibited. What regulators require is a documented, risk-based BSA/AML program: know your customer, verify state licensing, monitor activity against expected behavior, and file the marijuana SARs and CTRs that FinCEN guidance requires.

Cannabis Banking

Cannabis banking is the practice of providing deposit, payment, and lending services to state-licensed marijuana-related businesses (MRBs) and the cannabis-related businesses (CRBs) that support them, under a Bank Secrecy Act (BSA) compliance program built specifically for the industry's federal-illegality risk. Because marijuana that is neither an FDA-approved product nor a state-licensed medical product remains a Schedule I controlled substance under federal law, every dollar that touches a cannabis account is potentially proceeds of federally unlawful activity, and the institution must document that it knows this and is managing it.

Done correctly, cannabis banking is a legitimate, examinable, and profitable line of business. Done casually, it is an existential BSA/AML risk. This guide explains the framework, the obligations, and where the rules stand in 2026.

Why cannabis banking exists as a specialty

Most marijuana businesses operate legally under state law but illegally under federal law. That conflict makes mainstream institutions wary: handling the proceeds of a Schedule I substance can implicate money-laundering statutes, and the cash-intensive nature of the industry creates safety and structuring risk. The result is a chronic shortage of banking access, which in turn drives demand for institutions willing to serve the sector under a purpose-built compliance program.

The foundational federal framework is FinCEN guidance FIN-2014-G001, issued February 14, 2014. It does not make marijuana legal; it tells financial institutions how to file suspicious activity reports and conduct due diligence if they choose to bank MRBs, and it incorporates the enforcement priorities originally articulated in the 2013 Cole Memorandum as a red-flag framework. Although the Cole Memo was formally rescinded by the Department of Justice in January 2018, FinCEN's 2014 guidance, which incorporates its priorities, remains in effect, and examiners and institutions continue to use those priorities (preventing diversion to minors, interstate trafficking, cartels, and so on) as the practical due-diligence checklist.

What changed in 2026: the Trump administration, Schedule III, and the adult-use hearing

Cannabis rescheduling moved quickly in 2026. After President Trump issued an executive order in December 2025 directing the Attorney General to expedite rescheduling, Acting Attorney General Todd Blanche issued the April 2026 rescheduling order placing FDA-approved marijuana products and state-licensed medical marijuana products into Schedule III of the Controlled Substances Act, published in the Federal Register on April 28, 2026. The DEA's marijuana rescheduling regulatory actions page tracks the underlying Federal Register documents.

The broader question, whether all marijuana including adult-use should move to Schedule III, went to an expedited DEA administrative hearing that convened June 29, 2026, and that proceeding is ongoing, with post-hearing briefs and a final rule still ahead. Until a final rule takes effect, adult-use (recreational) marijuana and any product not tied to an FDA approval or a state medical license remains Schedule I.

Bankers should understand the limits of all this. Rescheduling does not by itself change a financial institution's BSA obligations: FinCEN guidance FIN-2014-G001 and the marijuana SAR framework remain in force, although FinCEN's exceptive relief issued February 13, 2026 did ease certain marijuana-related filing requirements, and institutions should map that order against their own procedures. The most tangible near-term effects are tax (Section 280E relief for medical operators), expanded research access, and the prospect of updated federal banking guidance, not an automatic green light to relax controls. Treat 2026 as a year of fast-moving signals, not settled law.

SAFE Banking and SAFER Banking: where reform stands in 2026

The SAFE Banking Act, and its prior iteration the SAFER Banking Act, would protect federally regulated institutions from being penalized solely for serving state-sanctioned cannabis businesses and would bar regulators from terminating or limiting deposit or share insurance on that basis alone. It would also extend protection to ancillary cannabis-related businesses.

After years stalled in the Senate, a bipartisan group reintroduced the SAFE Banking Act of 2026 on June 25, 2026, on the eve of the adult-use rescheduling hearing. Senator Jeff Merkley leads the Senate bill with bipartisan cosponsors including Lisa Murkowski, Steve Daines, and Elizabeth Warren, and Representative Dave Joyce is leading the companion in the House. Earlier versions passed the House seven times between 2019 and 2022 but never cleared the full Senate, so reintroduction signals momentum, not enactment.

The practical takeaway is unchanged: do not build a program that assumes a federal safe harbor is already in place. Build the program the current rules require, monitor the bill's progress, and treat passage as upside that would ease, but not eliminate, BSA/AML obligations.

The core obligations of a cannabis banking program

A defensible MRB/CRB program rests on a handful of pillars, each covered in depth elsewhere in this hub. Examiners will test the program against the expectations in the FFIEC BSA/AML Examination Manual, so each pillar needs documented evidence behind it.

Risk assessment that sizes the program and sets capacity limits before the first account opens.
Initial due diligence to verify state licensing, beneficial ownership, and the legitimacy of the business at onboarding.
Ongoing due diligence to re-verify licenses and refresh the customer profile on a risk-based cadence.
Ongoing monitoring that reconciles deposits to reported sales and surfaces red flags.
SAR and CTR filing, including the Marijuana Limited, Priority, and Termination SAR categories required under 31 CFR 1020.320 and FinCEN's marijuana guidance.
Cash management and logistics controls for a cash-intensive customer base.
Independent audit and testing to demonstrate the program works as designed.
Profitability analysis so the economics justify the compliance cost.

‍

A practitioner's perspective on managing the risk

The discipline described in this guide is not theoretical. StandardC's Robert Baron, a Certified Anti-Money Laundering Specialist who built and oversaw a credit union cannabis banking program serving more than 200 of the industry's largest companies and processing over $3 billion in annual transactions, described the reality of the work in his High Times op-ed, Confessions of a Cannabis Banker. Two of his observations frame the best practices that follow throughout this hub.

First, cannabis banking is permissible today, and the institutions that get hurt are rarely the ones that follow the published framework. His program banked billions in cannabis transactions under FinCEN's guidance without a fine, while penalties for KYC failures unrelated to cannabis ran into the billions across the industry in a single year. The risk is not the customer type. The risk is weak due diligence, and that risk exists in every portfolio.

Second, sustainable cannabis banking is a capacity and technology problem. Rigorous know-your-customer and know-your-customer's-customer work is expensive to deliver manually, which is why so few institutions serve the market and why demand concentrates on the largest applicants. Institutions that invest in technology-enabled due diligence, license monitoring, and sales-to-deposit reconciliation can serve the market profitably and defensibly; institutions that treat the program as a paperwork exercise should not enter it at all.

MRB vs. CRB: knowing who you are banking

A marijuana-related business (MRB) touches the plant directly: cultivators, processors, distributors, and dispensaries. A cannabis-related business (CRB) is an ancillary company that serves the industry without touching the plant, such as packaging suppliers, security firms, real-estate lessors, and law firms. The distinction drives risk tiering. Plant-touching MRBs warrant enhanced due diligence and marijuana SAR filing; many ancillary CRBs can be handled with elevated but less intensive controls, depending on how much of their revenue derives from the industry.

Frequently asked questions

Is it legal for a bank or credit union to serve cannabis businesses?

Yes. No federal law prohibits a financial institution from banking a state-licensed cannabis business. What the law requires is a risk-based BSA/AML program and compliance with FinCEN's 2014 guidance, including the marijuana SAR framework. The decision is a risk-appetite decision, not a question of permission.

Did Schedule III rescheduling make cannabis banking easier?

Only at the margins so far. The April 2026 rescheduling order moved FDA-approved and state-licensed medical products to Schedule III, which helps medical operators on taxes and research, but it did not change BSA obligations. Adult-use cannabis remains Schedule I while the broader rescheduling proceeding that convened June 29, 2026 is ongoing, and FinCEN's marijuana SAR requirements still apply.

Has the SAFE Banking Act passed in 2026?

No. A bipartisan group reintroduced the SAFE Banking Act of 2026 in both the House and Senate on June 25, 2026, but it has not been enacted. If it becomes law it would protect institutions from being penalized solely for serving state-sanctioned cannabis businesses, but BSA/AML obligations would still apply.

What is the difference between an MRB and a CRB?

An MRB is a plant-touching marijuana-related business such as a cultivator or dispensary. A CRB is a cannabis-related ancillary business that supports the industry without touching the plant. MRBs generally require the most intensive due diligence and trigger marijuana SAR filing.