Keep your Dispensary Compliant: Advice from Former MED Investigators

Have you ever wondered how regulatory agencies think about cannabis compliance, or what it means to be investigated?

We sat down with Jim Vigland, CPA, Managing Partner at Vigland Advisors, and former financial investigator at the Colorado Marijuana Enforcement Division (MED), and Philip Martin, CEO of Copacetic Strategies, and also a former compliance investigator at the MED.

Jim’s role at the MED was vetting funds, including where they were coming from, and examining marijuana business structures to ensure they were as they appeared on paper.

Phil managed the data analysis unit. He applied anti-money-laundering techniques to identify potentially suspicious behavior in Metrc.

The following Q&A outlines common financial risks at dispensaries, what dispensary non-compliance means, what an investigation looks like, and tips for keeping your cannabis business in compliance.

**Editor’s note: This interview was conducted prior to the resurgence of the SAFE Banking Act, and thus we didn’t discuss that component of financial compliance.

What does financial non-compliance mean for dispensaries?

Jim: This can be organized into four categories: taxes, documentation, substance, and banking risk. Every cannabis dispensary must ensure that they are compliant across all of these at all times.

Taxation is the most common thing to consider with financial non-compliance. Cannabis businesses have to be up-to-date on taxes, including sales and use taxes, excise taxes (monthly), and income taxes (on profits quarterly or annually). This is the main area we see regulatory compliance issues. If you’re behind on taxes, it could hold up dispensary license renewal.

Taxation is the most common thing to consider with financial non-compliance.

Documentation is huge because if you didn’t document it, it basically didn’t happen. This includes having the process in place to properly calculate cannabis taxes and document that you paid it. This applies to every part of the business for financial reporting. Your annual financial statements must be clean, and you must have all your clean tax information from the past 7 years. This applies for dispensary standard operating procedures too, not just financially, so if someone asks how you do something, you can point them to a binder and say this is how we do it.

The financial component spills into legal as well; it’s important to consider the substance over the form. There are strict rules on who can own a cannabis business, where they reside, their percentage of ownership, etc., so it’s important to look at the bigger picture to make sure that what is on paper is actually applicable. Some state laws are loosening up on ownership requirements, but it still has to be properly disclosed.

Phil: Non-compliance from a bank’s perspective is a little bit different. Since marijuana is still federally illegal, banks have to do an additional item that they don’t for other business: validating the source of funds as they come into the bank.

This means that every time a dispensary owner goes to deposit money, whether cash or electronic funds, there needs to be some document that shows where the money came from. In CO, you can use Metrc and transfer records to prove the product and sales.

When a company loses their bank account due to non-compliance, that typically has something to do with the fact that they haven’t been able to get the bank all the documentation on their funds in a correct manner, or they’re depositing an amount with a variance compared to their documentation. Banks start to become curious with variance.

What are some indicators of non-compliance for dispensaries?

Jim: The high risk areas are cash, because it’s a cash-intensive business, and also plants, because they are a controlled substance.

Inconsistencies in documentation are generally looked at. It’s important to think about how your cannabis point of sale (POS) and Metrc record sales — they both record sales differently, so there are legitimate reasons why those wouldn’t match, but you need to be able to reconcile the two and consistently understand the differences, and which is right.

Another is any unexplained wealth. For example, if there’s a company hemorrhaging money and have been operating at a loss for years, but haven’t gone out of business, that’s something state regulators look at. Usually it means the company is getting loans or access to funds through investors, but it can lead to undisclosed relationships.

Phil: Complaints are another indication of non-compliance. One time we had a complaint — apparently a budtender was nasty to a customer and they complained to their state representatives. That rep called the MED and asked what’s going on. Within 12 hours, that business had lost their bank account simply because of the reputational risk that the bank runs when the government gets involved for any reason. The bank is already taking a big risk taking cannabis money without federally legalization.

Disorganization is when everything isn’t in order. If regulators can’t validate funds, or they don’t have SOPs, or have poor processes, it’s a really bad sign. Everything in legal cannabis is related to compliance and doing things in a consistent, documented way; you can tell if a business isn’t organized or isn’t well-run. That’s a huge indicator that there could be significant problems.

The other thing is incomplete items, or not being able to provide items the bank requests. This is an indication that a business isn’t comprehensively compliant, which makes regulators more curious and suspicious. If you’re not complying in all areas, banks will be suspicious about the other items.

What does a typical investigation look like?

Jim: I think the process is pretty similar for all cannabis regulators around the country, but ultimately applicants disclose all kinds of information. First, all the information is verified. Basically you have to be sure your application is complete and accurate because it will be looked at and there may be follow-up questions.

If it’s not complete, that's an area that is going to get followed up on. If any regulatory body sees risk, that’s where they’ll focus their time. Most regulators now are looking to some degree at the finances. Metrc was the first stage of this because Metrc holds sales data from the plant through transactions, but it’s getting to the point now where financial information is easier to find and detect anomalies.

If any regulatory body sees risk, that’s where they’ll focus their time.

Phil: Investigations really begin in the data, like Metrc. There are occasions where you have the data and you just have to go down to the shop and ask them to do what they normally do.

If the data is all messed up, something is going wrong. It’s likely they aren’t trying to be non-compliant or do something fishy, but it’s a process error somewhere. Sometimes the only real way to identify what’s going on is to do a site visit and ask the staff and business owners.

What happens if a marijuana dispensary is found to be non-compliant?

Jim: The consequences of non-compliance should be balanced with the severity of the non-compliance. Warning letters could be issued. If it’s something serious and there’s a lot of evidence for it, it might go to court or the business might settle to a fine.

After that, changes to the business model will be expected. Obviously it isn't the regulator's job to interfere with the private business model, but if your ownership isn’t compliant, for example, you’re going to have to change the ownership to fix that.

Then the worst in severity is license suspension or revocation.

Phil: Some of the consequences for dispensaries on the bank side is a shut down of bank access. In some instances, that’s the inventory funding mechanism.

There are quite a few businesses now using services to basically borrow on their inventory, so those avenues to financial services can dry up real quick if the bank or your financial provider detects any non-compliance.

What advice would you offer dispensaries for how to stay compliant?

Jim: The easiest way to stay compliant is to first know the rules. It’s a lot easier to do things the right way from the start rather than digging out of a hole later. Since rules change frequently, you need to stay on top of it. Knowing reporting requirements for your specific business or license type is really important.

The easiest way to stay compliant is to first know the rules.

Another way is reconciliations. There are a lot of places to get information, sales and inventory being most common. So knowing why certain areas report differently, like POS versus cash in the bank versus Metrc. Either they all are the same, which is ideal, or you need to know why they are different and have a paper trail behind that.

And then transparency. A big red flag for any regulator is when they ask something, you answer it, and they find out it’s wrong. Either the licensee was being lazy to shorten the process or they didn’t know the answer. So being completely transparent with regulators is important.

Phil: When financial institutions look at cannabis businesses, transparency means who owns it, who controls it, but also how well you’re controlling the risks you pose as a business.

In order to integrate into the financial system in a normal way, the cannabis industry needs to have risk management systems in place, like we see in any other corporation in the country.

Risk management as a business function is important to all companies, especially cannabis retailers. Document what you do to handle risk, identify potential risks, and document your process for handling or mitigating and what you’ll do should something happen.

In order to integrate into the financial system in a normal way, the cannabis industry needs to have risk management systems in place.

The industry really has to grow in this area. Banks specifically don’t know much about cannabis companies, they don’t understand seed-to-sale tracking systems, they don’t understand how much money you can make off of cannabis products.

Jim: There’s a very strong correlation between the risk that any entity sees and compliance burden you have to go through. Cannabis is so heavily regulated because it's cash-intensive and federally illegal, but every small thing you can do to minimize risk will minimize compliance burden.

It's important to have a dispensary POS that helps maintain compliance, like purchase limit trackers or safe-guards to reduce employee theft through activity registers. Once you aggregate data, you can start to see the anomalies, like one register always being off or things like that. And again, document everything.