Dec 18, 2025

Cannabis Rescheduling 2026: Schedule III, the DEA Hearing, and What It Means for Banks and Credit Unions

Where cannabis rescheduling stands in July 2026: the Schedule III order, the DEA adult-use hearing, and why bank BSA obligations have not changed.

by Robert Baron, CAMS

Key takeaways

The April 2026 rescheduling order placed FDA-approved marijuana products and qualifying state-licensed medical marijuana in Schedule III. Adult-use marijuana remains Schedule I.
A DEA administrative hearing on rescheduling all marijuana convened June 29, 2026 and is in progress, with a final rule and likely court challenges still ahead.
Nothing in rescheduling changed a financial institution's Bank Secrecy Act obligations. FinCEN's 2014 guidance and the marijuana SAR framework remain in force, unrevised.
What rescheduling does change is the market: more institutions will enter, pricing will compress, and manual compliance programs that survived on scarcity economics will not survive competition.
The institutions that win this market will be the ones that can verify, screen, and monitor cannabis customers at scale, at a defensible cost per account.

‍

Where cannabis rescheduling stands as of July 2026

The past seven months produced more federal movement on cannabis than the previous fifty years combined. The sequence matters, because each step changed something different.

December 18, 2025. President Trump signed an executive order directing the Attorney General to expedite the rescheduling of cannabis. The order set the process in motion; it did not itself move marijuana out of Schedule I.

April 23, 2026. Acting on that directive, the Department of Justice issued the rescheduling order, effective upon Federal Register publication on April 28, placing two categories into Schedule III of the Controlled Substances Act: marijuana products approved by the FDA, and marijuana products regulated under qualifying state medical licenses. Law firm analyses from Holland & Knight and Gibson Dunn walk through the order's mechanics. The underlying Federal Register documents are collected on the DEA's marijuana rescheduling regulatory actions page.

June 29, 2026. The broader question, whether all marijuana including adult-use should move to Schedule III, went to an expedited DEA administrative hearing at DEA headquarters. The agency designated seven participants, all opposed to rescheduling, and called an FDA scientist as its first witness. Coverage from Forbes and Cannabis Business Times captures the tenor of the proceeding. As of this writing the hearing is ongoing, with post-hearing briefing, a final rule, and probable litigation still ahead, as Ropes & Gray's analysis outlines.

June 25, 2026. On the eve of the hearing, a bipartisan Senate group reintroduced the SAFE Banking Act of 2026. The Congressional Research Service maintains a useful legal primer on marijuana banking and the SAFE(R) Banking Acts. The bill is not law, and earlier versions passed the House seven times without clearing the Senate.

The bottom line: medical cannabis regulated under state licenses is now Schedule III, adult-use cannabis is still Schedule I, and the biggest question is sitting in an administrative courtroom in Arlington.

What Schedule III actually changes

For medical operators, the April order is significant. Schedule III status lifts the Internal Revenue Code Section 280E limitation for qualifying activity, restoring ordinary business deductions that had constrained operating liquidity across the industry. It also opens research pathways that Schedule I status foreclosed for decades.

For financial institutions, the honest answer is that Schedule III changes very little on paper and a great deal in practice.

What does not change: the compliance framework

Every Bank Secrecy Act obligation that applied to cannabis banking in March 2026 applies today. FinCEN guidance FIN-2014-G001, issued in February 2014, remains the operative framework for banking marijuana-related businesses, and FinCEN has not revised it following the April order. The Marijuana Limited, Marijuana Priority, and Marijuana Termination SAR categories still apply, anchored in the suspicious activity reporting rule at 31 CFR 1020.320. Examiners still test cannabis programs against the FFIEC BSA/AML Examination Manual, and the Bank Secrecy Act's customer due diligence, beneficial ownership, and monitoring expectations are untouched by scheduling.

Institutions should expect updated federal banking guidance eventually. They should not build programs that assume it. Mixed operators serving both medical and adult-use markets remain, for banking purposes, exactly what they were before April: customers whose activity spans two federal postures and whose accounts demand the full due diligence framework.

What changes everything: the economics

Since 2014, cannabis banking has been permissible but expensive. The institutions that served the market could charge premium fees because so few competitors existed. Those fees subsidized manual compliance: hand-verified licenses, spreadsheet onboarding, episodic site visits, periodic reviews that fell behind operational reality.

Rescheduling removes the subsidy. Clearer federal posture lowers institutional resistance, more banks and credit unions enter, and cannabis banking shifts from a scarcity-driven niche to a competitive commercial segment. Cannabis businesses will compare institutions on onboarding speed, fee structures, and service reliability, the same way any commercial customer does. Elevated fees that previously covered inefficient compliance processes become unsustainable.

The regulatory burden, meanwhile, does not shrink. Rapid portfolio growth typically heightens examiner focus. So the institution's problem statement becomes precise: deliver the same regulatory outcomes at a lower unit cost, without weakening controls.

That is not a policy problem. It is an infrastructure problem.

The obligations that remain, and how to execute them at scale

Examiners will continue to assess the same foundational controls: customer identification and verification, beneficial ownership, nature and purpose of the account, expected activity baselines, enhanced due diligence for higher-risk customers, ongoing monitoring, suspicious activity reporting, and governance. What has to change is the execution model.

License verification cannot be a one-time onboarding step. It has to be event-driven: when a license changes, a location is added, or ownership shifts, the institution should know without waiting for the annual review. StandardC's CRB Screening & Monitoring module automates state license verification and renewal tracking across a portfolio.
Onboarding has to compress from months to days. Application flows that adapt to the business type, guided document collection, and completeness validation at intake are what make a 45-to-90-day cycle a 5-day cycle. That is the job of ApplyC.
Screening has to be continuous, not calendar-driven. Watchlists, adverse media, and risk-profile changes across owners, operators, and related parties need always-on coverage, which is what MonitorC provides.
Site verification has to scale without a travel budget. GPS-verified virtual inspections through VerifyC replace inconsistent physical visits with standardized, time-stamped evidence.
Activity has to reconcile to expectations. Aggregate transaction monitoring against each customer's expected profile is what turns "we monitor" into "we can show you the variance analysis."
Every step has to leave an examiner-ready record. Automated audit logging and StandardC AI's citation-backed review workflows produce the documentation as a side effect of doing the work, not as a separate project before the exam.

‍

Institutions building or expanding a program can also draw on StandardC's cannabis banking advisory services and the program-design playbooks in our Knowledge Center, starting with the banker's guide to serving marijuana and cannabis-related businesses.

Cannabis is still the banker's gateway drug

The deeper point survives every scheduling decision. Cannabis banking is a forcing function: cash intensity, layered licensing, and fast-moving regulation compress the margin for error until weaknesses that hide in other commercial portfolios become visible. Manual onboarding cannot scale. Self-reported information lacks reliability. Periodic reviews fall behind reality.

Institutions that treat cannabis as a catalyst modernize their entire commercial risk framework, and the capabilities they build, real-time verification, data integration, continuous monitoring, transfer directly to money services businesses, gaming, fintech partnerships, and every other complex segment. Cannabis is not the risk. Inefficiency is. Rescheduling just removed the last excuse for ignoring it.

Frequently asked questions

Is marijuana now legal under federal law?

No. The April 2026 order moved FDA-approved products and qualifying state-licensed medical marijuana to Schedule III, which is a controlled-substance classification, not legalization. Adult-use marijuana remains Schedule I while the DEA rescheduling proceeding continues.

Can banks and credit unions serve cannabis businesses today?

Yes, and they have been able to since FinCEN's 2014 guidance. The requirement is a risk-based BSA/AML program with enhanced due diligence and marijuana SAR filing, not special permission.

Did rescheduling eliminate marijuana SAR filing?

No. FinCEN has not revised the 2014 guidance or the SAR framework following the April order. Marijuana Limited, Priority, and Termination SARs still apply under 31 CFR 1020.320.

What happens when the DEA hearing ends?

The administrative law judge's record feeds a recommended decision, followed by a final rule, and legal challenges are widely expected regardless of outcome. Institutions should plan for an extended period in which medical and adult-use cannabis carry different federal classifications.

Would the SAFE Banking Act change BSA obligations?

Not materially. The SAFE(R) framework would protect institutions from being penalized solely for serving state-sanctioned cannabis businesses and would protect deposit and share insurance, but customer due diligence, monitoring, and SAR obligations would remain.

What should an institution entering the market do first?

Size the program with a risk assessment, build the due diligence and monitoring workflow on infrastructure that scales, and price from a real profitability analysis rather than legacy scarcity pricing.

Authoritative sources

‍

About the author

Robert Baron is a commercial banker and Certified Anti-Money Laundering Specialist (CAMS) with over 20 years of experience designing and operating BSA/AML programs, including building, managing, and advising multiple cannabis banking programs across the United States. He is the author of Confessions of a Cannabis Banker (High Times, 2021) and a leader in developing verification and audit-readiness technologies for financial institutions.