Initial Due Diligence Requirements for Cannabis Banking

Initial due diligence is the onboarding investigation a financial institution performs before opening an account for a marijuana-related business, and FinCEN's 2014 guidance makes it the foundation of the entire cannabis program. The institution must verify that the business is properly state-licensed, understand who owns and controls it, confirm the nature and purpose of the relationship, and establish the expected activity profile against which all future monitoring will be measured. Everything downstream, SAR categorization, monitoring thresholds, risk rating, depends on getting onboarding right.

Cannabis onboarding is enhanced due diligence by default. A clean intake file is the single best defense in an examination.

Key Takeaway: At onboarding, verify the state license, identify and verify beneficial owners (25%+ and the control prong), confirm source of funds, review state regulator records, and build an expected-activity baseline. Document each step; the file is your examination defense.

‍

Verify state licensing first

No license, no account. Obtain the business's state and, where applicable, local cannabis licenses, confirm they are active and in good standing directly with the issuing regulator, and record the license type, number, scope, and expiration. The license defines what the business is legally permitted to do, which in turn defines what activity should look like in the account.

• Confirm the license directly against the state regulator's records, not just the applicant's copy.
• Match the license scope (cultivation, manufacturing, retail, distribution) to the stated business model.
• Record expiration dates to drive the renewal-tracking element of ongoing due diligence.

‍

Identify beneficial owners and control persons

Apply the FinCEN customer due diligence (CDD) rule: identify and verify each individual owning 25% or more of the legal entity, plus one individual who exercises significant control. Cannabis ownership structures are often layered through holding companies and management entities, so trace ownership to the natural persons behind them.

Note a 2026 development: FinCEN issued an exceptive relief order on February 13, 2026 that removed the requirement to re-identify and re-verify beneficial owners every time an existing customer opens a new account. Verification is still required at first account opening, when facts call prior information into question, and as your risk-based procedures dictate. For higher-risk MRBs, prudent programs continue to refresh beneficial ownership on a defined cadence regardless.

Confirm source of funds and business legitimacy

Understand where the money comes from and confirm the business is what it claims to be. Collect formation documents, ownership charts, the state license application where available, financial statements or projections, and information about principals' backgrounds. Screen owners and key persons against sanctions and adverse-media sources. For plant-touching MRBs, understand the supply chain: who they buy from and sell to, since those counterparties carry their own risk.

• Entity formation and good-standing documents.
• Ownership and management structure traced to natural persons.
• Source-of-funds and source-of-wealth information for principals.
• Sanctions, PEP, background, and adverse-media screening on owners and control persons.
• In-person or virtual site visit to confirm the business physically operates.

‍

Review the Cole Memo red flags at intake

Even though the Cole Memo is rescinded, its priorities remain the practical screening lens FinCEN guidance points to. At onboarding, assess whether anything suggests diversion to minors, interstate movement, involvement of criminal enterprises, use as a cover for trafficking other drugs, violence, or activity on federal land. Document the assessment; it both informs the risk rating and supports the SAR category you will assign.

Build the expected-activity baseline

Onboarding must produce a documented expectation of normal activity: anticipated monthly deposit volume, cash vs. non-cash mix, number and size of typical transactions, and the geographies and counterparties involved. This baseline is what ongoing monitoring compares actual behavior against. Without it, monitoring has no reference point and alerts become meaningless.

Tie the baseline to verifiable inputs where possible, such as state seed-to-sale (track-and-trace) reporting and point-of-sale data, so deposits can later be reconciled to reported sales.

Document the due diligence and approved decision to bank the customer

Cannabis onboarding should culminate in a documented approval consistent with the institution's risk appetite, often requiring senior or committee sign-off for plant-touching MRBs. The approval memo ties together the licensing verification, ownership, risk rating, and expected activity into one defensible record.

Frequently asked questions

What documents does a bank need to open a cannabis business account?

At minimum: active state (and local) cannabis licenses verified with the regulator, entity formation documents, an ownership chart traced to natural persons, beneficial-ownership identification for 25%+ owners and a control person, source-of-funds information, and sanctions/adverse-media screening. Most programs also require a site visit and senior approval.

What is the beneficial ownership threshold for cannabis accounts?

The FinCEN CDD rule requires identifying each individual who owns 25% or more of the entity plus one individual who controls it. A February 2026 FinCEN order eased re-verification at each new account opening, but initial verification and risk-based refresh still apply.

Do you need to verify a cannabis license at onboarding?

Yes, and directly with the issuing state regulator. The license must be active and in good standing, and its scope should match the stated business model. License status drives both the risk rating and ongoing renewal tracking.

‍