Initial Due Diligence Requirements for Cannabis Banking

Initial due diligence is the onboarding investigation a financial institution performs before opening an account for a marijuana-related business, and FinCEN's 2014 guidance (FIN-2014-G001) makes it the foundation of the entire cannabis program. The institution must verify that the business is properly state-licensed, understand who owns and controls it, confirm the nature and purpose of the relationship, and establish the expected activity profile against which all future monitoring will be measured. Everything downstream, SAR categorization, monitoring thresholds, risk rating, depends on getting onboarding right.

Cannabis onboarding is enhanced due diligence by default. A clean intake file is the single best defense in an examination.

Verify state licensing first

No license, no account. Obtain the business's state and, where applicable, local cannabis licenses, confirm they are active and in good standing directly with the issuing regulator, and record the license type, number, scope, and expiration. The license defines what the business is legally permitted to do, which in turn defines what activity should look like in the account.

• Confirm the license directly against the state regulator's records, not just the applicant's copy.
• Match the license scope (cultivation, manufacturing, retail, distribution) to the stated business model.
• Record expiration dates to drive the renewal-tracking element of ongoing due diligence.

‍

Identify beneficial owners and control persons

Apply the FinCEN customer due diligence (CDD) rule: identify and verify each individual owning 25% or more of the legal entity, plus one individual who exercises significant control. Cannabis ownership structures are often layered through holding companies and management entities, so trace ownership to the natural persons behind them.

Note a 2026 development: FinCEN issued an exceptive relief order on February 13, 2026 that removed the requirement to re-identify and re-verify beneficial owners every time an existing customer opens a new account. Verification is still required at first account opening, when facts call prior information into question, and as your risk-based procedures dictate. For higher-risk MRBs, prudent programs continue to refresh beneficial ownership on a defined cadence regardless.

Confirm source of funds and business legitimacy

Understand where the money comes from and confirm the business is what it claims to be. Collect formation documents, ownership charts, the state license application where available, financial statements or projections, and information about principals' backgrounds. Screen owners and key persons against sanctions lists maintained by the Office of Foreign Assets Control (OFAC) and against adverse-media sources. For plant-touching MRBs, understand the supply chain: who they buy from and sell to, since those counterparties carry their own risk.

• Entity formation and good-standing documents.
• Ownership and management structure traced to natural persons.
• Source-of-funds and source-of-wealth information for principals.
• Sanctions, PEP, background, and adverse-media screening on owners and control persons.
• In-person or virtual site visit to confirm the business physically operates.

‍

Review the Cole Memo red flags at intake

Even though the Cole Memo was rescinded by the Department of Justice in January 2018, its priorities remain the practical screening lens that FinCEN's 2014 guidance, which is still in effect, points to. At onboarding, assess whether anything suggests diversion to minors, interstate movement, involvement of criminal enterprises, use as a cover for trafficking other drugs, violence, or activity on federal land. Document the assessment; it both informs the risk rating and supports the SAR category you will assign.

Build the expected-activity baseline

Onboarding must produce a documented expectation of normal activity: anticipated monthly deposit volume, cash vs. non-cash mix, number and size of typical transactions, and the geographies and counterparties involved. This baseline is what ongoing monitoring compares actual behavior against. Without it, monitoring has no reference point and alerts become meaningless.

Tie the baseline to verifiable inputs where possible, such as state seed-to-sale (track-and-trace) reporting and point-of-sale data, so deposits can later be reconciled to reported sales.

Document the due diligence and approved decision to bank the customer

Cannabis onboarding should culminate in a documented approval consistent with the institution's risk appetite, often requiring senior or committee sign-off for plant-touching MRBs. The approval memo ties together the licensing verification, ownership, risk rating, and expected activity into one defensible record. Examiners will evaluate the file against the customer due diligence expectations in the FFIEC BSA/AML Examination Manual, so build it to be read.

Frequently asked questions

What documents does a bank need to open a cannabis business account?

At minimum: active state (and local) cannabis licenses verified with the regulator, entity formation documents, an ownership chart traced to natural persons, beneficial-ownership identification for 25%+ owners and a control person, source-of-funds information, and sanctions/adverse-media screening. Most programs also require a site visit and senior approval.

What is the beneficial ownership threshold for cannabis accounts?

The FinCEN CDD rule requires identifying each individual who owns 25% or more of the entity plus one individual who controls it. A February 2026 FinCEN order eased re-verification at each new account opening, but initial verification and risk-based refresh still apply.

Do you need to verify a cannabis license at onboarding?

Yes, and directly with the issuing state regulator. The license must be active and in good standing, and its scope should match the stated business model. License status drives both the risk rating and ongoing renewal tracking.

Authoritative Sources

• FinCEN, BSA Expectations Regarding Marijuana-Related Businesses (FIN-2014-G001)
• FinCEN, Customer Due Diligence (CDD) Final Rule
• FinCEN, The Bank Secrecy Act
• FFIEC BSA/AML Examination Manual
• U.S. Treasury, Office of Foreign Assets Control (OFAC)
• U.S. Department of Justice, Justice Department Issues Memo on Marijuana Enforcement (January 2018)

‍

Related Reading

• Cannabis Banking: A Banker's Guide to Serving Marijuana and Cannabis-Related Businesses
• Ongoing Due Diligence Requirements for Cannabis Banking
• Ongoing Monitoring Needs for Cannabis Accounts
• Filing Suspicious Activity Reports (SARs) for Cannabis Businesses
• Risk Assessment Principles for a Cannabis Banking Program