US

The Challenge of Assessing and Mitigating Risk in the Cannabis Industry

The fact that cannabis is illegal under federal law is not the only reason why the industry is high risk. The vertical nature of the cannabis industry means that a business may perform activities in multiple sub-industries such as agriculture, pharmaceutical manufacturing and testing, food manufacturing, distribution, transport, retail, and medical sales. Each of these industries poses unique risks to a business. So how is a cannabis business supposed to understand and assess its risk?

Understanding risk is key to establishing an effective risk and compliance framework that protects the organization and its shareholders. A business must understand where the land mines are hidden, and ensure that they fail to detonate.

This involves assessing the organization’s daily activities and processes to determine the types of events, that if they occurred, would stop business operations, prompt regulators to investigate, cause unfavorable headlines, or make consumers avoid your brand.

Senior leaders in the organization should be familiar with these issues and articulate them to operations or compliance so that mitigating controls or processes can be implemented. This risk assessment process can be documented, and controls can be aligned with the associated risks to ensure completeness.

Rigorous controls should be designed for the highest areas of risk, and the controls should be tested on a periodic basis. By testing the controls, the company can ensure that they are well designed and work as intended.

Risk and control frameworks can help protect an organization from catastrophic consequences of a data breach, product or food recall, internal fraud or other events that happen in every type of an organization. An organization should consider how it will respond if something does happen. Incident response plans can help the firm practice how it will manage the situation rather than reacting to the situation.

In the end, belts and suspenders can create good practices that protect an organization and its shareholders. If something does happen, knowing how the company will respond can help the company navigate the stormy waters to a full recovery.

DOJ Issues Guidance on a Well Designed & Effective Corporate Compliance Program

The Department of Justice (DOJ) updated its guidance to help prosecutors to evaluate corporate compliance programs.  Prosecutors rely on this guidance when evaluating business organizations during an investigation, determining whether to bring charges or when entering into a plea agreement.

The DOJ guidance asks prosecutors to answer three questions about the organization’s compliance program including:

  1. Is it well designed?

  2. Is it applied effectively so that it mitigates risk identified during a risk assessment process?

  3. Does the compliance program work in practice?

Well Designed: The DOJ’s guidance provides that the organization’s compliance program is well designed if the organization periodically performs a risk assessment process to identify and understand the organization’s risks, and maintains policies and procedures that incorporate processes that mitigate those risks. The policies and procedures should “incorporate the culture of compliance in its day-to-day operations.”

Effective: The DOJ’s guidance recommends that prosecutors assess the compliance program’s effectiveness. The “tone at the top” that is set by senior management should establish an ethical environment and culture of complying with the law. Appropriate governance should be established with independent board members to ensure that there is appropriate oversight, including auditing and well financed compliance function.

Does the Compliance Program Work? The DOJ’s guidance indicates that prosecutors should evaluate how the organization detects misconduct and the good faith effort utilized in performing remediation including the performance of a root cause analysis to understand how the misconduct occurred. The compliance program should be continuously monitoring the organization for new risk and improving the internal control system. The compliance program should include a testing program to identify any weaknesses in high risk areas, and to ensure that controls work. The organization should also investigate and remediate the root cause of misconduct.

The DOJ’s guidance provides insight on best practices that all businesses should follow. The compliance program can be customized to address an organization’s size, risk profile and strategic goals.

Want to Sell Your Business or Go Public? Embrace Compliance

Entrepreneurs start businesses to make money. At some point, the entrepreneur may want to sell or go public, for a variety of reasons. A company that has an inadequate risk and compliance program may find it difficult to do so.

Bankers, investors and potential partners want to understand the risk associated with the company that may negatively impact the company's future value and the partner's reputation. These risks include, among others, illegal activity, fraud, enforcement actions, intellectual property infringement, litigation or the threat of litigation, a consumer safety issue, or employee lawsuits.

A company, as part of what is known as “due diligence”, must disclose these risks and demonstrate control frameworks that prevent them from occurring. Otherwise, no one will be interested in doing a deal.

The cannabis industry poses a higher risk to investors as compared to other industries, which means that sophisticated investors or investment banks will perform extra levels of due diligence. These extra levels are designed to uncover illegal activity, compliance failures, a lack of a culture of compliance, and determine whether a company’s risk and control programs are on par with industry best practices.

If due diligence uncovers evidence of risky business, the valuation of the business and the ability to enter the public market will be negatively impacted. Between two similarly situated acquisition targets, an institutional player will select the business that mitigates risks facing the business, and embraces a culture of compliance. In the cannabis industry, compliance is a competitive advantage.

It is not too late to take a step back and understand how you can implement a risk and compliance program expected of a public company. There are small steps that can take you a long way including:

  • Hire a compliance officer and provide them with sufficient resources to create an effective risk and compliance program. The risk and compliance program can be customized to the company’s size, risk, and strategic goals.

  • Create a culture of compliance. The internal threats posed by employees is one of the greatest risks that can quickly erode a business’ valuation or opportunity to go public.

  • Grow quickly but wisely. Sophisticated investors and investment banks care about the quality of the assets a company buys. Perform due diligence- otherwise, the investment may be worthless. Remember that a company’s sins are assumed by the buyer and do not go away.

  • Obey the laws and demonstrate how you do it. Always be prepared to show investors how the business complies with all applicable regulations.

At the end of the day, the companies that have effective risk and compliance programs will become the market leaders. Those that do not, will fall away. The risk to investors and investment banks in making a bad bet is too great for them to support companies that fail to mitigate risk or follow the rules.

US Government Says Pot Smokers Lack the Good Moral Character Required of US Citizens

The Department of Homeland Security (DHS) issued a policy statement notifying persons seeking US citizenship that the process is at risk if they use marijuana or engage in marijuana related business activities. The DHC policy explains that persons who are convicted of a marijuana charge or admit to engaging in marijuana activities do not exhibit the good moral character that is required of a US citizen.

The policy statement is the latest warning shot to persons applying for US citizenship. Denver recently issued a Marijuana Information Bullet to notify industry participants that the US Department of Justice (DOJ) has denied two applications for citizenship by persons who are employed in the cannabis industry. Denver has asked the marijuana industry to inform current and future employees about the negative impact that working for a cannabis company may have on an individual’s ability to become a US citizen or to stay in the United States. Persons who are impacted by this US DOJ policy should speak with an immigration attorney.


Municipal Risk: A Problem Without a Near Term Solution

State cannabis laws can provide counties or local jurisdictions with the ability to determine whether to permit cannabis activity, and to mandate the place, time and manner in which a cannabis business can operate. There is risk though, that a county or city can change its mind.

This occurred recently in Mountain View California. The new city council voted to repeal an ordinance that permitted four cannabis dispensaries. Over 130 local residents spoke at the four hour meeting. The new mayor lost the vote to repeal the cannabis ordinance. The city council’s action raises a red flag for businesses relying on a local jurisdiction for a cannabis permit. Ten businesses that were vying for the city’s four spots invested capital and time. The risk associated with starting a business in a city changes along with administration.

The power a city or county holds over a cannabis license was also highlighted in a recent court of appeals decision in Oregon. The state granted a production license, which could not be used due to local ordinances prohibiting cannabis production. The Oregon Appeals Court sided with Kittitas county, and indicated that under current Oregon law, a cannabis license is useless without a local zoning law permitting the activity.

Municipal risk can delay the application process at any stage with resulting litigation due to local scoring methodologies and transparency requirements. Cities are also increasing this risk by rethinking how social equity programs fit into the permit allocation process as they are handing out licenses using other methodologies. Businesses seeking permits should consider local politics, stability of past city councils, and formal process setting procedures when deciding where to spend capital on license applications. A safer approach may be to purchase a license holder in a city that has stabilized, and established a track record of supporting the cannabis industry.

The FDA Issues CBD Guidance: CBD is a Drug that Must Be Approved

Last week, the Food and Drug Administration (FDA) issued guidance on CBD that has widespread ramifications for the industry. In short, the FDA has determined that a CBD product marketed as offering therapeutic effects is a new drug that must be approved prior to sale.

The FDA also indicated that CBD products are not dietary supplements, and may not be sold on the internet as such. The FDA issued warning letters on March 28, 2019 to stop three CBD companies from selling products, including gummies, due to unsubstantiated health claims. The companies marketed the products as therapeutic remedies for arthritis and dementia and other ailments. The FDA stated that it will continue to monitor the marketplace for other product violations, and it will issue warning letters when necessary. The FDA responded to a question related to the availability of CBD products online by stating:

“FDA continues to be concerned at the proliferation of products asserting to contain CBD that are marketed for therapeutic or medical uses although they have not been approved by FDA. Often such products are sold online and are therefore available throughout the country. Selling unapproved products with unsubstantiated therapeutic claims is not only a violation of the law, but also can put patients at risk, as these products have not been proven to be safe or effective. This deceptive marketing of unproven treatments also raises significant public health concerns, because patients and other consumers may be influenced not to use approved therapies to treat serious and even fatal diseases.”

What does this mean for the CBD industry?

The CBD market raises complex issues with a new twist each week. There are many issues that remain outstanding including the sale of CBD products that do not claim therapeutic benefits. The FDA’s move may push the CBD industry off of the internet and into the state cannabis ecosystem. CBD retailers and manufacturers may need to replicate the THC model by creating vertically integrated markets in states where it can be legally produced and sold, and avoiding risk by selling products in licensed dispensaries. Producers should avoid transporting CBD across state lines until states provide guidance on how this can be done. Producers and retailers should also review marketing and product labels to ensure compliance with the FDA’s recent guidance.

Oregon Issues Warning About Criminal Charges for Shipping Hemp Across State Lines

The Oregon Department of Agriculture (DOA) has issued a warning related to the transport of hemp and hemp commodities across state lines. The DOA has indicated that states bordering Oregon are stopping trucks that are carrying hemp products, and charging the drivers with criminal violations. Oregon is reminding state businesses that other states may still consider hemp to be a Schedule 1 drug, which would be considered illegal possession of cannabis. Businesses involved in the cultivation, processing, transport or sale of hemp or hemp products should review state laws to determine where industrial hemp has been exempted from the state’s definition of cannabis or marijuana. Failure to do so could result in criminal or civil charges.

The US Government Must Allow Cannabis Banking: 3 Steps to Make it Happen

The cannabis industry continues to expand at record rates without a viable banking system to support capital investment or payment transmission. Current federal regulations prohibit banks from serving clients that are engaged in illegal activity, including the sale of marijuana.

Penalties include significant fines and criminal prosecution. The risk of criminal prosecution increased when, on January 4, 2018, Jeff Sessions rescinded a 2014 DOJ memo written by UnitedStates Deputy Attorney General James M. Cole (Cole Memo) that provided states with prosecutorial relief so long as the states met certain conditions. Although the US Treasury (FinCen)issued guidance that permitted banks to provide cannabis clients with services following the Cole Memo, the practical matter is that banks cannot rely on the guidance in such an uncertain regulatory environment.  The lack of an interstate banking system increases systemic risk in the nascent industry including the viability of businesses and increases the safety risk to business owners and employees hoarding large amounts of cash.

The exit of Jeff Sessions and Rep. Pete Sessions, and the Democratic control over the House provides the cannabis industry with a window to push banking reform forward.  The federal government has a responsibility to its citizens, investors and the business community to legalize marijuana and provide cannabis clients with access to banking services.  Initial steps that can help include 1) Congressional action to legalize interstate cannabis related services, 2)  the issuance of DOJ and FinCenguidance that allows banks to service cannabis clients, and 3) an agreement between the federal and state governments on the industry risks and enforcement priorities.

  • Federal Legalization:  Congress must set aside partisan politics and eventually legalize the possession and sale of cannabis. The risk to the business community, investors in cannabis businesses, consumers, employees, and state and local governments grows daily as stakeholders invest capital, cannabis businesses create jobs, generate revenues and pay taxes, and state and local governments become reliant on these taxes. Congress, not the states, will bear the responsibility of market failures caused by inadequate banking services and capital markets oversight.  Congress should demand that the DOJ and FinCen provide adequate relief to the banking industry and provide timelines for resolution.

  • DOJ and FinCen Authorization: The DOJ and FinCen should mitigate the outstanding risks caused by the revocation of the Cole Memo, and issue guidance on how banks can provide services to the cannabis industry. Failure to provide such guidance is irresponsible since the industry is becoming further entrenched every day, and both agencies can assess enforcement priorities through suspicious activity reports and monitoring account activity.

  • State and Federal Regulatory Collaboration:  The federal government can learn about the true risks associated with the cannabis industry from the state regulators that have forged the path forward. Historically, the states have been the laboratory of reform, and the federal government often adopts state frameworks. The federal government must work with the states to define the industry's risks and solutions so as not to disrupt the industry's innovation or growth.

The cannabis industry has established itself in the United States. The federal government must stop kicking the can down the road and address issues that, if left unaddressed, will hurt investors, consumers, employees, states and local governments. In three easy steps, the federal government can fulfill its obligations to the citizens of the United States and prevent further harm.

California Cannabis Distributor Sentenced to Prison for Federal Tax Evasion

The United States Department of Justice announced that California Realtor, Charles T. Woods, was sentenced to two years in prison for failing to pay federal taxes on over $1 million in cash that Woods received from distributing marijuana. Woods kept the cash in 25 bank accounts, which he hid from his tax preparers. The DOJ indicated that Woods filed tax returns from 2012 - 2014. Woods was also ordered to serve one year of supervised release and pay $466,707 in restitution.

Mexican National Faces Life in Prison for Illegal Cannabis Grow Operation in the Sequoia National Forest

The United States Department of Justices (DOJ) entered into a plea agreement with Mexican National, Alan Fernand Gomez-Paniagua 26, for illegally growing marijuana in the Sequoia National Forest. Enforcement authorities participating in the Forest Watch program found and confiscated 15,852 marijuana plants and over 1,000 marijuana seedlings. Gomez-Paniagua faces a minimum prison term of 10 years with a maximum of life along with a $10 million fine. Gomez-Paniagua also agreed to pay $3,826 in restitution for cleaning up the grow site, which was covered in trash, pesticide containers and irrigation lines. The grow operation also caused environmental damage including the cutting down of oak trees and damage to a hill side due to terracing.

In August, the DOJ announced the results of a year-long Forest Watch program that ended in September 2018. The program brought together federal, state and local authorities to identify and stop large illegal marijuana grow operations on public land, which negatively impacts the environment by contaminating water, causes deforestation and results in trash dumps. The efforts resulted in over 80 investigations, 77 arrests and the confiscation of over 140,000 pounds of equipment, illegal fertilizers and chemicals, 638,000 plants and 25,000 pounds of processed marijuana.