Filing Suspicious Activity Reports (SARs) for Marijuana and Cannabis Businesses

Every MRB relationship requires a SAR. Choose the category that matches your due-diligence findings, file the initial SAR within 30 days of the activity that triggers it, and file continuing-activity SARs at least every 90 days for the life of the relationship.

Cannabis Banking

Financial institutions that bank marijuana-related businesses must file a suspicious activity report (SAR) on every such customer, because the activity involves funds derived from a business whose product remains federally controlled. Following the April 2026 rescheduling order, FDA-approved and state-licensed medical marijuana products sit in Schedule III, but adult-use marijuana remains Schedule I, and the SAR obligation attaches to marijuana-related activity across the board. FinCEN guidance FIN-2014-G001 establishes three marijuana SAR categories, Marijuana Limited, Marijuana Priority, and Marijuana Termination, and the institution selects the category that reflects what its due diligence has found. This is the single most distinctive obligation of cannabis banking: SAR filing is mandatory and continuous, not exception-based.

The 2026 reform wave has adjusted the edges without changing the core. FinCEN issued exceptive relief on February 13, 2026 easing certain marijuana-related filing requirements, and institutions should map that order's specific relief against their own procedures, but FIN-2014-G001 remains the operative guidance and the marijuana SAR framework remains in force. Neither the Schedule III medical rescheduling, nor the adult-use rescheduling hearing that convened June 29, 2026 and is still ongoing, nor the SAFE Banking Act reintroduced June 25, 2026 (not enacted) changes that framework, and currency transaction reports (CTRs) apply to cannabis cash exactly as they do elsewhere. Until a final rule or a new law takes effect, file as you do today.

The three marijuana SAR categories

Marijuana Limited

File a Marijuana Limited SAR when due diligence indicates the MRB is operating in compliance with state law and does not implicate any of the Cole Memo red-flag priorities. The Cole Memo itself was rescinded by the Department of Justice in January 2018, but its priorities live on in FinCEN's 2014 guidance, which remains in effect. The narrative documents that the institution is providing services to a marijuana business and that nothing beyond the inherent federal-controlled-substance risk has been identified. This is the baseline filing for a clean, compliant relationship.

Marijuana Priority

File a Marijuana Priority SAR when due diligence indicates the MRB may implicate one or more Cole Memo priorities or may not be fully compliant with state requirements, while the institution is still providing services. The narrative must describe the specific red flags observed, such as apparent diversion, undisclosed ownership, or activity inconsistent with the license.

Marijuana Termination

File a Marijuana Termination SAR when the institution decides it must end the relationship to maintain BSA/AML compliance. The narrative explains the basis for termination. Where appropriate, FinCEN encourages noting whether the customer may be seeking to move funds to another institution, which supports industry-wide vigilance.

Filing timelines that matter

Initial SAR: 31 CFR 1020.320 requires filing within 30 calendar days of initial detection of the facts that constitute a basis for filing.
Continuing activity SAR: for ongoing relationships, file at least every 90 days to report continuing activity, with the running total of transactions for the period.
Marijuana relationships are, by definition, continuing-activity filings: because the underlying activity persists, the institution keeps filing on the 90-day cycle for as long as it banks the customer.

‍

Build the SAR calendar into your program so the 90-day clock never lapses. A missed continuing SAR on a known MRB is among the easiest findings for an examiner working from the FFIEC BSA/AML Examination Manual to make.

Writing a defensible SAR narrative

A strong marijuana SAR narrative answers who, what, when, where, why, and how. For cannabis specifically, it should identify the business and its state license, state which SAR category applies and why, summarize the due diligence performed, and quantify and report the activity for the period.

Identify the MRB, its license number, and licensing state.
State the category (Limited, Priority, or Termination) and the supporting rationale.
Summarize transaction volume and dollar totals for the reporting period.
Note any red flags and the institution's response.

‍

CTRs and the cash dimension

Currency transaction reports are separate from SARs and are not optional. Under 31 CFR 1010.311, any cash transaction or aggregated same-day cash activity exceeding $10,000 by or on behalf of one person requires a CTR (FinCEN Form 112). Because MRBs are cash-intensive, CTR volume is high and accuracy matters. Watch closely for structuring, deposits deliberately kept under $10,000 to evade reporting, which is itself a SAR-reportable red flag and a federal crime under the Bank Secrecy Act.

Aggregating cash deposits across multiple visits, locations, or related accounts is essential; modern monitoring tools automate this aggregation and flag patterns a manual process would miss. For the physical side of moving and counting that cash, see the program's cash management and logistics controls.

Common SAR program failures

Treating marijuana SARs as exception-based rather than filing on every MRB.
Filing Marijuana Termination SARs for accounts voluntarily closed without suspicious activity.
Letting the 90-day continuing-activity clock lapse.
Selecting Marijuana Limited when red flags warrant Marijuana Priority or Marijuana Termination.
Missing CTRs or failing to aggregate related cash activity.

‍

Frequently asked questions

Do you have to file a SAR on every cannabis customer?

Yes. Because the activity involves funds from a federally controlled business, FinCEN guidance requires a SAR on every marijuana-related business relationship, filed in the appropriate category and continued on a 90-day cycle for as long as the relationship lasts. FinCEN's February 2026 exceptive relief eased certain filing mechanics, but it did not eliminate the marijuana SAR framework.

What are the three marijuana SAR types?

Marijuana Limited (compliant MRB, no red flags), Marijuana Priority (possible red flags or compliance concerns while still banking the customer), and Marijuana Termination (the institution is ending the relationship to stay BSA-compliant).

How often must continuing-activity SARs be filed for an MRB?

At least every 90 days. The initial SAR is due within 30 days of detection, and because marijuana activity is ongoing, the institution files continuing-activity SARs every 90 days thereafter.

Are CTRs still required for cannabis cash after rescheduling?

Yes. CTRs apply to cash transactions over $10,000 regardless of rescheduling. Structuring deposits to avoid the threshold is a federal crime and a SAR-reportable red flag. CTR exemptions are not permitted for MRB/CRBs.