Cannabis Banking Laws, Regulations, and Guidance: The Complete Reference

The complete reference for cannabis banking law: the CSA, BSA, FinCEN 2014 guidance, every regulator's position, SAFE Banking status, and the 2026 rescheduling.

Cannabis Banking

Cannabis banking sits at the intersection of federal drug law, anti-money laundering regulation, tax law, deposit insurance, and fifty state regulatory regimes. No single statute governs it; a lattice of laws, rules, guidance documents, and agency positions does. This guide assembles that lattice in one place: the controlling federal law, the operative FinCEN guidance, each regulator's position, the pending legislation, the history that explains how we got here, and the sources worth watching as the landscape moves.

The federal legal foundation

The Controlled Substances Act (CSA). Enacted in 1970, the CSA created the federal scheduling system. Marijuana sat in Schedule I, the most restrictive category, for over five decades. The April 2026 rescheduling order changed that for part of the market: FDA-approved marijuana products and marijuana products regulated under qualifying state medical licenses now sit in Schedule III, while adult-use marijuana remains Schedule I pending the outcome of the DEA's broader rescheduling proceeding. Because proceeds of Schedule I activity implicate federal money laundering statutes, scheduling is the root of every banking complication that follows.

The Bank Secrecy Act (BSA). The BSA and its implementing regulations require financial institutions to maintain AML programs, know their customers, monitor activity, and report suspicious transactions. Every cannabis banking obligation is, at bottom, a BSA obligation applied to a higher-risk customer class.

The key implementing rules. Four regulations do most of the work in a cannabis program: the customer identification program rule at 31 CFR 1020.220, the beneficial ownership rule at 31 CFR 1010.230, the currency transaction report rule at 31 CFR 1010.311, and the suspicious activity report rule at 31 CFR 1020.320.

The operative guidance: FIN-2014-G001

The single most important document in cannabis banking is FinCEN guidance FIN-2014-G001, issued February 14, 2014. It did not legalize anything. It told financial institutions how to serve state-licensed marijuana businesses consistent with their BSA obligations: perform customer due diligence that includes verifying state licensure, understand the business and its expected activity, monitor for red flags drawn from the 2013 Cole Memorandum's enforcement priorities, and file marijuana-specific SARs in three categories.

Marijuana Limited: the customer appears compliant with state law and no Cole priorities are implicated; filed and refreshed on a continuing basis.
Marijuana Priority: due diligence surfaces a red flag or a possible Cole priority violation.
Marijuana Termination: the institution exits the relationship for BSA-related reasons.

‍

The Cole Memorandum itself was rescinded by the Department of Justice in January 2018, but FinCEN's guidance, which incorporates its priorities, remains in effect and has now outlived three administrations. As of mid-2026 FinCEN has not revised it, even after the April rescheduling order.

Every regulator's position

FinCEN (U.S. Treasury). The AML rulemaker and SAR repository. Its 2014 guidance is the operating manual; its CDD Final Rule supplies the customer due diligence and beneficial ownership baseline; its quarterly marijuana banking data, built from SAR filings, is the closest thing to an official census of institutions serving the industry.

DEA and the Department of Justice. The scheduling authorities and criminal enforcers. The DOJ's posture has swung from the 2013 Cole Memorandum's enforcement restraint, to the 2018 rescission, to the December 2025 executive order directing expedited rescheduling, to the April 2026 order placing medical cannabis in Schedule III. The DEA's rescheduling actions page collects the Federal Register documents, and the June 2026 administrative hearing will shape whether adult-use marijuana follows.

FDIC. The FDIC has never prohibited insured banks from serving state-licensed cannabis businesses, and deposit insurance applies to cannabis business deposits the same as any other: $250,000 per depositor, per insured bank, per ownership category. Examination expectations run through the BSA framework rather than any cannabis-specific rule.

NCUA. The credit union regulator has been the most explicit of the depository regulators: credit unions that serve state-legal cannabis businesses under a sound BSA program will not be sanctioned for the customer class alone. Share insurance applies on the same terms as FDIC coverage, and many of the earliest and largest cannabis banking programs grew inside credit unions for exactly this reason.

OCC and the Federal Reserve. Neither prohibits national banks or member banks from serving the industry; both examine cannabis portfolios through standard BSA/AML and safety-and-soundness lenses. The absence of cannabis-specific guidance from these agencies is itself the message: the existing framework governs.

FFIEC. The interagency examination council's BSA/AML Examination Manual is the document examiners actually carry. Cannabis programs are tested against its customer due diligence, suspicious activity monitoring, and program governance sections, applied with the intensity a high-risk, cash-intensive portfolio invites.

IRS. Internal Revenue Code Section 280E denied ordinary business deductions to Schedule I and II traffickers, which for decades made effective cannabis tax rates punishing and shaped the industry's cash economics. The April 2026 Schedule III order lifts that limitation for qualifying medical activity. The IRS marijuana industry page maintains the agency's current positions on income reporting, cash payments, and 280E.

OFAC. Sanctions screening through the Office of Foreign Assets Control applies to cannabis customers, owners, and counterparties exactly as it does everywhere else, and matters more than average in an industry with documented cartel-adjacency risk.

State regulators. Every legal market runs its own licensing regime, seed-to-sale tracking system, and enforcement apparatus. State license status is the hinge of the entire federal framework: FIN-2014-G001's protections attach to state-licensed activity, which is why license verification and monitoring sit at the center of every compliant program.

A short history of cannabis banking law

1970: The Controlled Substances Act places marijuana in Schedule I.
1996: California's Proposition 215 opens the state-legal medical era.
2012 to 2014: Colorado and Washington legalize adult use; the 2013 Cole Memorandum sets federal enforcement priorities; FinCEN issues FIN-2014-G001, creating the compliant banking pathway.
2018: The DOJ rescinds the Cole Memorandum; FinCEN's guidance stays in force. The Farm Bill removes hemp from the CSA, splitting hemp banking from marijuana banking.
2019 to 2022: The SAFE Banking Act passes the House seven times and dies in the Senate each time.
2023: HHS recommends rescheduling to Schedule III; the SAFER Banking Act advances out of Senate committee but no further.
2024: The DOJ publishes a proposed rescheduling rule; administrative proceedings begin and stall.
December 2025: A presidential executive order directs expedited rescheduling.
April 2026: The rescheduling order places FDA-approved and state-licensed medical marijuana in Schedule III, analyzed in depth by Holland & Knight and Gibson Dunn.
June 2026: The DEA's expedited hearing on rescheduling all marijuana convenes June 29; a bipartisan Senate group reintroduces the SAFE Banking Act days before. Legal challenges are expected whatever the outcome.

‍

Pending legislation: SAFE and SAFER Banking

The SAFE Banking Act (and its SAFER iteration) would create a federal safe harbor: regulators could not penalize institutions solely for serving state-sanctioned cannabis businesses, could not terminate deposit or share insurance on that basis, and protections would extend to ancillary businesses. The Congressional Research Service maintains the best neutral legal summary in Marijuana Banking: Legal Issues and the SAFE(R) Banking Acts. Two things are consistently misunderstood about the bill: it has never been enacted, and it would not eliminate BSA obligations. Due diligence, monitoring, and SAR filing survive any version of the legislation. What it removes is the institutional fear of serving the class at all.

Best practices: the program the rules require

The regulatory materials above translate into an operating discipline covered across this Knowledge Center: a documented risk assessment that sizes the program; initial due diligence anchored on license and ownership verification; continuous monitoring across transactions, licenses, ownership, media, and enforcement actions; disciplined SAR filing; cash logistics controls; independent audit; and pricing built on real cost data. Institutions building or scaling a program can pair those playbooks with StandardC's cannabis banking advisory services and the platform modules for CRB screening and license monitoring, continuous KYC screening, and transaction monitoring.

Sources to watch as the law moves

The landscape is moving faster than at any point since 2014. The primary feeds worth monitoring: the DEA rescheduling actions page for Federal Register documents and hearing outcomes, FinCEN's newsroom for any revision to the 2014 guidance, Congress.gov and CRS for SAFE Banking movement, and the trade and legal press, including Forbes' cannabis policy coverage and Cannabis Business Times, for hearing-room developments between official publications.

Frequently asked questions

Is it legal for banks to serve cannabis businesses?

Yes. No federal law prohibits it. FinCEN's 2014 guidance defines how to do it consistent with BSA obligations, and federal banking regulators examine such programs rather than forbid them. The decision is a risk-appetite and capability decision.

What is the main regulation governing cannabis banking?

There is no cannabis banking statute. The controlling framework is the Bank Secrecy Act and its implementing rules, applied through FinCEN guidance FIN-2014-G001, with examination expectations set by the FFIEC BSA/AML Examination Manual.

Did the 2026 rescheduling legalize marijuana?

No. The April 2026 order moved FDA-approved and state-licensed medical marijuana to Schedule III, a controlled-substance classification. Adult-use marijuana remains Schedule I while the DEA's rescheduling proceeding continues, and BSA obligations were not changed for either category.

Is the SAFE Banking Act law?

No. It was reintroduced in June 2026 with bipartisan sponsorship after passing the House seven times in earlier Congresses without clearing the Senate. If enacted it would provide a regulatory safe harbor but would not remove due diligence, monitoring, or SAR requirements.

Are cannabis business deposits insured?

Yes. FDIC deposit insurance and NCUA share insurance apply to cannabis business accounts on the same terms as any other deposit: $250,000 per depositor, per institution, per ownership category.

What is the Cole Memo and does it still matter?

A 2013 DOJ memorandum setting federal enforcement priorities for state-legal marijuana. It was rescinded in January 2018, but its priorities live on inside FinCEN's 2014 guidance as the red-flag framework institutions still monitor against.