part 3

Banking MRBs – Creating an MRB Banking Policy (part 3)

This is the third in a five-part series of articles on Banking Marijuana Related Businesses (MRBs). This installment focuses on creating an MRB banking policy.

The first step in banking the cannabis industry is creating a marijuana banking policy specifically designed for serving these businesses.

MRB banking policy: Where to start?

Financial institutions often ask if there is an MRB banking policy template which has gone through both legal and regulatory review they can utilize.

Unfortunately, there isn’t a “proven” MRB banking policy template. Even if such a policy did exist it would only serve as a framework.

Differences in state marijuana laws and in how each financial institution interprets the patchwork of regulatory guidance mean you would need re-write most of the policy.

Having reviewed a number of MRB banking policy manuals, we have seen both ends of the spectrum: some were extremely well crafted with a great deal of detail while other policies were merely a minor extension of the institution’s existing BSA/AML policy.

You need a dedicated MRB banking policy

Banking MRBs is so unique, a detailed dedicated policy – not just a few tweaks to your current BSA/AML policy – is a must.

Your current banking technology platforms weren’t designed for the unique requirements of banking MRBs so you need to develop procedures outside your primary systems specific to serving these businesses.

Your MRB banking policy should address how you will fill the gaps between the capabilities of your current banking systems and the requirements of banking MRBs.

Types of MRB’s

There are several types of MRBs with vastly different levels of risk and your policy should address any procedurals difference for the various types.

MRBs are broken down into the following tiers:

Tier I MRB

Businesses that generally manufacture, distribute or dispense marijuana (i.e., they touch the plant) and are generally a state-licensed marijuana business. Examples include:

  1. Marijuana dispensaries
  2. Marijuana cultivation (growers)
  3. Marijuana oil (THC and CBD) extractors
  4. Marijuana infused product producers (edibles)


Businesses that are still considered marijuana businesses but are typically not a state-licensed marijuana business because they don’t touch the plant. These businesses are specifically focused on providing products and services to Tier I MRBs. Examples include:

  1. Sellers of products related to growing marijuana (lights, watering systems, fertilizer)
  2. Sellers of products for consuming marijuana (vape pens and cartridges, pipes, bongs)
  3. Industry associations
  4. Payroll providers
  5. Advertising and media providers
  6. Some software providers


Businesses not specifically focused on providing services to Tier I MRBs (selling to Tier I MRBs is incidental to their overall business and revenue). These businesses are typically professional service firms. Examples include:

  1. Consultants – accountants, lawyers, registered agents
  2. Commercial property owners
  3. Some software and technology providers

Bear in mind that technically, anyone that derives income from the cannabis industry becomes an MRB so it’s wise to include provisions in your policy to cover accounts of owners and employees as well.

Educate Yourself

Given the importance of MRB accounts staying in compliance with state cannabis laws, procedures to ensure this must be part of your MRB policies.

You should establish a deep understanding of how your state cannabis licensing works and the requirements and capabilities of license holders. You should understand things like:

  1. who can own a hold a license
  2. does a license entitle holders to open multiple locations
  3. what type of license is needed for a retail operation vs. a cultivator
  4. are there any requirements covering employees of licensees

Educate yourself on the industry. Understand the different product types (flower, extracts, edibles) and different business types (retail, cultivation/grow facilities, extraction, marijuana infused product (MIP) producers, etc.).

Creating an MRB banking policy

There are two approaches to creating an MRB banking policy:

  1. A stand-alone MRB policy
  2. An addendum to your existing BSA/AML policy

Either way, you should start with a strong BSA/AML program with experienced compliance staff and a history of examinations without any significant findings. Any BSA deficiencies should be rectified prior to boarding MRB accounts as they will be amplified by serving MRBs.

MRB banking policy framework

The scope of this article is not to outline every possible detail to include in your MRB banking policy but rather to provide an outline you can build on with details specific to your institution and appropriate to your MRB program.

Recommended sections of an MRB banking policy include:

Governing laws

This section of your policy should contain or summarize the specific state laws and federal guidance (Cole Memo, FinCEN guidance, etc.) that surround banking MRBs in your state. Any county or local rules should be included here as well.

This is also a good place to set forth definitions that will be utilized throughout your policy.

BSA requirements

Your policy should address the three specific types of MRB SAR filings as well as the requirements, triggers and red flags for those filings. Specific policy statements for recurrent SAR’s should be included in this section.

Initial due diligence

This section should include all typical new account documentation, plus MRB specific documents and information such as:

  1. State cannabis licenses
  2. County or local municipality cannabis permits, if applicable
  3. Leases, or title information if the property is owned, for all business locations
  4. Beneficial ownership (pay extra attention to this area as it’s drawing increasing regulatory scrutiny)
  5. Anticipated deposit activity (used to help establish baseline activity for the merchant)
  6. Business balance sheet, P&L statement and tax returns
  7. Personal financial statements
  8. A firm understanding of how the business operates, including products, major vendors, and all sources of revenue

Ongoing due diligence

This section should include steps your staff should perform on an ongoing basis to ensure MRB clients remain in compliance with state laws and your institution’s policies.

This section should include any documents and information to obtain from your MRBs on an ongoing basis and how often this information should be obtained.

Your policy should require you to maintain current copies of all necessary state and local cannabis licenses and permits.

This section should also include steps to ensure MRB account 314(a) and OFAC compliance.

Activity monitoring

This section should include policies and procedures including:

  1. Matching deposits to sales data
  2. Comparing actual sales data to baseline levels
  3. Monitoring the source and destination of account activity
  4. Case management processes to track resolution of abnormal or suspect activity
  5. Comparing financial statement and sales data to income, sales and excise tax payments and tax returns
  6. Ensuring deposits were derived from permissible state-legal marijuana transactions

Ensuring compliance with tax obligations is especially important in cash intensive industries and highly taxed industries like cannabis, so your policy should include tax compliance procedures.

Physical site examinations

This section should include your physical site examination requirements including how often physical site inspections should be performed and what should be performed during each inspection.

Frequency of site inspections can be based on the risk rating you assign each merchant and are typically performed monthly, quarterly, semi-annually or annually.

Physical site visits serve to confirm a business is operating according with their operating manuals, charters, etc. and consistent with information they have provided to you.

Risk analysis and ratings

This section should include your process for primary and secondary risk analysis and scoring for  MRBs and the individuals involved.


We recommend your MRB policy include covenants that all MRB clients must agree to prior to opening their bank account.

Your covenants should include items such as:

  • Volume limits
  • Requirements to provide documentation that is either recurrent or that requires updating
  • Notification of changes to management or beneficial ownership
  • Non-disclosure agreement
  • Any other rules you deem necessary to properly bank these clients

Your covenants should not contain any rules that could be construed as attempting to circumvent BSA reporting requirements, such as requiring cash deposits be under $10,000.

Legacy MRB cash

Your policy should address how you will treat legacy cash.

Legacy cash is cash that was earned or generated prior to a client opening an account at your institution.

Some institutions accept legacy cash but as a general rule we recommend not accepting legacy cash. A compromise is to have an independent accounting firm conduct a full forensic study to ensure the source of the cash was bona fide state-legal marijuana transactions before accepting legacy cash.

The other articles in this 5-part series on banking MRBs are:

Part 1 – Banking MRBs – Should Your Institution Do It?

Part 2 – Banking MRBs – Regulatory Guidance

Part 4 – Banking MRBs – Transaction Monitoring

Part 5 – Banking MRBs – Technology Solutions

Get our

Strategic Guide to 

Cannabis Payments