Compliance Management, Security Strategy, Plan, Budget

Is cannabis business banking a new financial opportunity or a huge security risk?

Financial and payments services is a potential greenfield opportunity for banks and credit unions, as well as the IT security that would be needed. (Photo by David Ryder/Getty Images)
Financial and payments services is a potential greenfield opportunity for banks and credit unions, as well as the IT security that would be needed. (Photo by David Ryder/Getty Images)

As cannabis sales become legal in an increasing number of states, the prospect of offering financial and payments services to these businesses appears as both a rare greenfield opportunity for banks and credit unions, and also a potential risk management landmine.

For many years, cannabis dispensaries — legal in states like Colorado, California and Washington — still dealt mostly in cash, since most financial institutions and payments providers would not do business with these businesses, which were still considered illegal in many states and on a federal level. Financial institutions that are federally chartered arguably could not work with these businesses, even if they wanted to. And the potential for network security malfeasance, from cyber-criminals that might see cannabis businesses as less secure and less likely to fight back if attacked, has also been an issue.

However, now that cannabis has been legalized for medical use in 39 U.S. states and the District of Columbia, and for recreational and medical use in 18 states and D.C., the prospect of working with the fast-growing businesses in this industry is often too appealing for many banks to turn down — especially since uncovering entirely new small business banking opportunities is not common these days.

One bank executive spoke about their bank’s effort to proactively reach out to cannabis businesses at a recent financial crime webinar hosted by Jack Henry, a service provider for the banking industry. Mel Barnes, cannabis program director at West Town Bank & Trust, pointed out that the beginning of any such program is a conversation with the bank’s board of directors about “whether we want to do this.”

Barnes, who has been overseeing cannabis banking programs for more than five years, was brought on by the Raleigh, North Carolina-based West Town Bank & Trust earlier this year to launch its cannabis business banking program, officially launched in April 2022. (The program’s slogan is “Bank with Higher Standards.”)

“It’s important to educate yourself, your management team and your board,” Barnes said. “We need to ask: ‘Why do we want to do this?’”

On the positive side, especially as more and more states legalize cannabis, there are still many of these businesses that remain “unbanked” due to a history of financial institutions and payments providers choosing not to work with them in the early days. On the other hand, aside from the potential compliance and legal issues, many traditional financial and payments companies feared the potential for drawing the attention of hackers, who might see these businesses as easy prey since they are relatively nascent and might be loath to fight back given their relatively new legal standing.

“There may still be a certain social stigma” to working with cannabis businesses, Barnes added.

“[Cannabis business] is growing and growing rapidly, and the regulations are ever-changing,” Barnes pointed out. “But banking and cannabis are two of the most regulated industries, so that can be very powerful and very overwhelming. ... It means that you have to be ready and willing to put the resources into a cannabis banking program ... making the balance between customer experience and compliance and security.”

As far as compliance concerns, Barnes admitted that financial regulatory auditors may have more questions for banks working with cannabis companies that they would for “the guy selling Nikes down the street.” While Barnes said these issues are beginning to dissipate, “they will never go away.”

West Town Bank & Trust works with a number of third-party technology partners, including IT security company RiskScout, in servicing its cannabis business customers.

“Legal cannabis businesses should be able to access the same financial services as other industries,” Barnes said in an April press release.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.