Cannabis Compliance - The Straight Dope
A budding market presents new risks. How should compliance professionals react?
What do cannabis and Myanmar have in common? On the face of it, not much. One is a plant that can be dried and smoked, the other is a country in Southeast Asia. Both, however, are multi-billion-dollar markets, and both were until recently largely inaccessible to institutional investors. Myanmar was sanctioned by the EU until 2012, and by the US until 2016, and the legalisation or decriminalisation of cannabis in certain jurisdictions has occurred over a similar timeframe.
Yet both markets still hold hidden risks that must be identified and mitigated before wading in. If Myanmar remains home to many sanctioned or otherwise unsavoury individuals and companies, cannabis producers are a similarly mixed bag. The majority are young companies with limited track records and wildly varying standards of corporate governance. Compounding matters, these inexperienced firms are operating in a fragmented regulatory landscape: the sale and use of cannabis is not legal everywhere, and regulators are giving mixed messages (or no message at all) regarding the legality of repatriating overseas cannabis earnings into countries where its use remains illegal.
One critical difference between Myanmar and cannabis lies in how compliance professionals have responded to these emerging, high-risk markets: in the case of Myanmar, banks and service providers already have sophisticated sanctions risk mitigation procedures in place to identify “high-risk” Myanmar deals. The same cannot be said of cannabis compliance, which remains something of a terra incognita. There is an urgent need for consensus and clarity on what the risks are and how they can be identified and mitigated by those seeking to invest in (or avoid) this new industry.
These open questions are addressed to all compliance professionals, and they cannot be dodged by simply avoiding direct dealings with cannabis producers. Millions of retail and institutional investors now have indirect exposure to the cannabis industry, either via funds or financial institutions. Royal Bank of Canada, for example, announced in April that it would begin advising on listings of cannabis producers on a “selective” basis, and there are already well over 300 cannabis-related firms listed on exchanges in the US, Canada, Australia and Switzerland.
Key risk metrics for cannabis companies
Not all cannabis producers and retailers are alike. So what differentiates a “high-risk” relationship from a “low-risk” one? Here are some questions to consider when assessing exposure to a cannabis-related business:
Does this company have a capable and reputable management team?
Does the company produce cannabis for recreational use, medical use, or both?
Does the company hold the necessary licenses to engage in this business?
Does the company have procedures to mitigate the risk of its products flowing into jurisdictions where they remain illegal?
Are your local regulators comfortable with the flow of cannabis-related profits into your accounts?
The last question is crucial for UK and US companies. Under the UK Proceeds of Crime Act, repatriating earnings from cannabis (the production or sale of which remains a criminal offence in the UK, subject to a maximum of 14 years’ imprisonment), can be considered money laundering, regardless of the legality of cannabis production in the target company’s home jurisdiction. In the US, the picture is much patchier, with varying provisions from state to state. Federal prosecutors’ key concern is the potential for cannabis to be sold wittingly or unwittingly to US consumers in states where it is still illegal. Multinationals active in the US or UK (i.e. most multinationals) must therefore gain a deep understanding of their cannabis-related counterparties and keep a close eye on their ongoing activities.
One final question to consider: are your investors comfortable with exposure to the cannabis industry? Some definitely will be. ETFs are being created today to cater to consumer demand for access to this potentially massive market. For mom-and-pop fund managers and blue-chip stocks, however, moving into a sector that was until recently largely illegal, and is still considered by some to be immoral, risks losing investors’ trust, and ultimately their capital.
What are investors already doing to manage these risks?
Institutional investors and service-providers are already taking some common-sense steps to understand the risks around relationships with cannabis producers, but more needs to be done. Proportionate, risk-focused due diligence remains the first step, but this must be accompanied by additional procedures that are tailored to the cannabis sector and aligned with regulators’ concerns.
UK investors in the cannabis sector, for example, are seeking advance permission from the National Crime Agency, the UK’s national criminal investigations body, before investing in Canadian producers. Almost 30,000 “Defence Against Money Laundering” (DAML) requests were submitted to the NCA in 2018, and over 90% were granted, but this permission comes with a crucial caveat. It is not an open-ended, indefinite approval for the relationship, but instead a signal that it is OK to proceed for now, without any promises regarding potential future enforcement actions. UK investors and service providers must continue to monitor the activities of their cannabis-related counterparties, taking stock whenever the relationship changes and filing SARs where appropriate.
US companies considering exposure to the cannabis sector have no such system for “asking first” and must assess the money-laundering risks alone. Prudent US firms are taking a holistic approach, based on their own risk tolerance and investors’ preferences, and focusing on avoiding any involvement in the illegal supply of cannabis products to US consumers.
What next?
Cannabis compliance need not be a leap into the unknown. The risks associated with the industry can be understood and mitigated, and value can be created in a responsible and sustainable manner. The key will lie in producers, investors, regulators and risk professionals working together to establish standards, and in compliance professionals asking the right questions to ensure that these standards are met. Likely outcomes include much-needed guidance from the NCA and other regulators, and a formalised cannabis compliance certification process. Such a process would be in everyone’s interest, giving cannabis producers a set of agreed standards to meet, and allowing investors and service providers to pick from only the best of the crop.