The intersection of state-legal cannabis operations and federally regulated banking has long been one of the most challenging compliance environments for financial institutions. Despite California’s legalization of recreational cannabis under Proposition 64, the majority of cannabis-related businesses have historically operated as cash-only enterprises—not because they prefer it, but because most banks remain unwilling to accept the federal regulatory exposure that comes with servicing marijuana-related businesses.
The Problem That Won’t Go Away
Cannabis companies face a banking crisis that has persisted for years. Under federal law, marijuana remains a Schedule I controlled substance. That classification means financial institutions chartered under federal law—or insured by federal agencies—face potential liability under the Bank Secrecy Act (BSA) and other federal statutes when they accept deposits or extend credit to cannabis operators. The fear of federal enforcement, even in states where cannabis is legal, has kept most large banks and many community banks out of the cannabis banking market entirely.
The practical result is an industry generating hundreds of millions of dollars annually that operates almost entirely in cash. Cash-heavy businesses attract crime, create public safety hazards, and make tax compliance more difficult. State regulators and law enforcement have an obvious interest in changing this dynamic.
The DFPI Steps In
California’s Department of Financial Protection and Innovation (DFPI)—formerly known as the Department of Business Oversight before its rebranding and expanded authority in 2020—has worked to help state-chartered financial institutions navigate cannabis banking compliance through a structured questionnaire process.
The DFPI developed a comprehensive Marijuana Related Business (MRB) compliance questionnaire to assist state-chartered banks and credit unions that are evaluating or operating cannabis banking programs. The questionnaire is organized around the federal FinCEN framework, which was issued in 2014 to clarify Bank Secrecy Act obligations for financial institutions that choose to serve cannabis businesses. That FinCEN guidance incorporated priorities originally outlined in the U.S. Department of Justice’s Cole Memorandum—a policy document that, while rescinded in 2018, continues to define the practical compliance framework that regulators use to evaluate cannabis banking activity.
The DFPI has also published survey data from licensed cannabis businesses to serve as a resource for financial institutions developing or refining their cannabis banking programs.
Structure of the DFPI’s MRB Compliance Questionnaire
The DFPI questionnaire is organized into five substantive sections, each targeting a distinct compliance concern.
1. Program Governance
This section examines whether the institution has established a formal risk management framework for its cannabis banking program. Key questions include whether the institution has conducted a comprehensive risk assessment of the business line, whether legal counsel has reviewed applicable federal and state statutes, how the institution monitors third-party intermediaries involved in cannabis transactions, and how identified risks are escalated and mitigated.
2. File Review
The file review section focuses on documentation. It asks institutions to describe their due diligence processes for cannabis license verification, business operations review, and periodic monitoring for changes in the regulatory environment that might affect a customer’s compliance status.
3. Account Testing and FinCEN Red Flag Identification
This section draws directly from FinCEN’s published guidance on suspicious activity indicators. Institutions are asked whether they have procedures to detect circumstances such as a cannabis business receiving revenue significantly in excess of what state licensing limits would allow, or a business depositing cash in amounts inconsistent with its reported marijuana-related revenue. Other indicators of potentially illegal operations—such as signs of product diversion or relationships with unlicensed operators—are also addressed.
4. Cole Memorandum Priorities
Although the Cole Memo was rescinded in 2018, the DFPI’s questionnaire retains eight of its enforcement priorities as a continuing compliance framework. Institutions are asked whether they monitor for transactions that may indicate: distribution of cannabis products to minors; revenue being funneled to criminal enterprises; product diversion across state lines into jurisdictions with different legal frameworks; use of cannabis as cover for trafficking other controlled substances; firearms in the distribution chain; impaired driving; cannabis cultivation on public lands; and cannabis use on federal property.
5. FinCEN Filing Practices
The final section asks institutions whether their due diligence processes are sufficient to support a reasonable belief that their cannabis banking relationships do not implicate any of the Cole Memorandum priorities. This section is closely tied to the BSA’s Suspicious Activity Report (SAR) filing requirements, which the DFPI expects institutions to manage appropriately.
The DFPI’s Regulatory Position
The DFPI has stated that it will not pursue regulatory action against state-chartered financial institutions solely for providing banking services to state-licensed cannabis operators—provided those institutions comply fully with FinCEN’s BSA requirements. The DFPI has also made clear that it is available to consult with licensed institutions developing cannabis banking programs.
This is a meaningful assurance. It tells state-chartered institutions that their California regulator will not penalize them for taking on cannabis clients, as long as the compliance program is robust. The remaining concern is federal exposure, which state regulators cannot address.
The Federal Legislative Landscape
The Secure and Fair Enforcement Banking Act (SAFE Banking Act) has been introduced and passed by the U.S. House of Representatives multiple times, but has faced ongoing obstacles in the Senate. The bill would provide a federal safe harbor for financial institutions serving state-licensed cannabis businesses, effectively resolving the core compliance problem by removing the federal legal exposure that keeps most banks out of the market.
Until federal legislation is enacted, state-chartered financial institutions operating cannabis banking programs must navigate the gap between state legality and federal prohibition through careful compliance program design—exactly the kind of work the DFPI’s questionnaire framework is designed to support.
What This Means for Private Lenders
Private lenders considering exposure to cannabis-related real estate transactions—whether through lending against dispensaries, cultivation facilities, or other cannabis-adjacent properties—face similar compliance questions. Understanding how regulators think about cannabis-related business risk, and building due diligence processes that address FinCEN’s framework, reduces legal exposure and supports defensible underwriting decisions.
Geraci LLP advises lenders on cannabis-adjacent financing and compliance questions. Contact our team at (949) 403-3488 or visit us at 90 Discovery, Irvine, CA 92618.
