Recent SEC AML Enforcement Against Securities Firms Engaged in Cannabis Sector

On February 14, 2014, FinCEN issued its Marijuana Bank Secrecy Act (“BSA”) Guidance (the “BSA Guidance;” see FIN 2014 G001), which is explicitly based on a 2013 Department of Justice guidance commonly referred to as the “Cole Memo,” issued by James Cole, a Deputy Attorney General during the Obama Administration. The positions contained in the Cole Memo were explicitly non-binding, and, in any event, it was rescinded by U.S. Attorney General Jeff Sessions in 2018. However, in June 2020, FinCEN released the Hemp BSA Guidance (FinCEN Guidance, FIN-2020-G001; see below), which confirmed FinCEN’s position that the BSA Guidance remains in effect, notwithstanding the fact that it explicitly relies on the Cole Memo as its basis and authority for much of the guidance.

FinCEN recommends that, in conducting customer diligence on marijuana-related customers, financial institutions focus diligence efforts on whether the conduct of the customer in question implicates one of the enforcement priority areas identified in the Cole Memo. As noted above, while the Cole Memo itself was rescinded, FinCEN advised financial institutions to utilize the six priorities mentioned below for enforcement of the Controlled Substances Act (“CSA”) set forth in the Cole Memo to identify customer activity related to cannabis business that financial institutions must report to law enforcement as part of their BSA compliance obligations.

Specifically, the following areas of conduct constitute priorities for dealing with marijuana restrictions:

1.  The distribution of marijuana to minors,

2.  Using revenue generated from legal marijuana businesses to finance criminal enterprises or engage in the trafficking of other drugs,

3.  Engaging in violent activity,

4.  Distributing marijuana to states where such sale is illegal,

5.  Exacerbating adverse public health consequences associated with marijuana use (e.g., “drugged” driving), and/or

6.  Growing marijuana on public lands.

FinCEN attempted to clarify expectations for financial institutions seeking to provide services to marijuana-related businesses. The BSA Guidance sought to address how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations (“. . . This FinCEN guidance should enhance the availability of financial services for, and the financial transparency of, marijuana related businesses.”).

FinCEN instructed financial institutions to assess the risk of providing services to marijuana-related businesses by conducting due diligence, including: (1) verifying and reviewing state licensure and application documents; (2) developing an understanding of the normal and expected activity for the business, including the types of products to be sold and the types of customers to be served (e.g., medical versus recreational); (3) ongoing monitoring of publicly available sources for adverse information about the business and related parties; and (4) ongoing monitoring for suspicious activity.

Most importantly, FinCEN said this:  “Because federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity. Therefore, a financial institution is required to file a [Suspicious Activity Report (“SAR”)] . . . on activity involving a marijuana-related business (including those duly licensed under state law) in accordance with this guidance and FinCEN’s suspicious activity reporting requirements and related thresholds.”

FinCEN established different types of SARs required by financial institutions choosing to provide services to marijuana-related businesses, depending on whether the institution believes the business is violating one of the Cole Memo priorities or state law. However, in no uncertain terms, an investment firm or bank must file an SAR whenever it conducts a transaction with a marijuana-related business.

Marijuana-Related Suspicious Activity Reports

The BSA requires financial institutions to identify and file an SAR for “any suspicious transaction relevant to a possible violation of law or regulation.” Financial institutions are required to file an SAR with FinCEN within 30 days of providing financial services to a marijuana-related business. Within 120 days of filing the SAR, a continuing activity report must be filed if the institution continues to provide service to the business. FinCEN instructs financial institutions to keep filing continuing activity reports if the business remains a customer of the institution and remains engaged in marijuana-related activities. Per the BSA Guidance, “Because federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity.”

“Marijuana Limited” SAR:  Compliant with State Law and Cole Memo Priorities

If the financial institution reasonably believes, based on its due diligence, that the customer follows state law and does not implicate one of the Cole Memo priorities, the BSA Guidance provides that financial institutions file a “Marijuana Limited” SAR, which requires the financial institution to report only the following:

1.  The identity and address of the customer and related parties,

2.  That this filing is only being made because the customer is a marijuana-related business, and

3.  That no suspicious activity has been identified.

“Marijuana Priority” SAR:  Violation of State Law or Cole Memo Priorities

If at any point a financial institution reasonably believes that a customer’s marijuana-related activity is either in violation of state law or implicates one of the Cole Memo priorities, the BSA Guidance suggests the filing of a “Marijuana Priority” SAR, which instructs financial institutions to include comprehensive details relevant to law enforcement in the SAR, including:

1.  Identifying information about the customer, including its address,

2.  The Cole Memo priorities implicated by the customer’s conduct, and

3.  The dates, amounts, and other relevant details of the financial transactions triggering the suspicious activity.

FinCEN requests that financial institutions include the term “MARIJUANA PRIORITY” in the narrative section of such an SAR, in capital letters.

“Marijuana Termination” SAR

If a financial institution decides to end a relationship with a customer engaged in marijuana-related activities in order to maintain an effective Anti-Money Laundering (“AML”) compliance program, the Marijuana BSA Guidance instructs financial institutions to file a Marijuana Termination SAR, noting the reason it is terminating the relationship. FinCEN requests that financial institutions include the term “MARIJUANA TERMINATION” in the narrative section of the SAR. If a financial institution becomes aware that a terminated marijuana-related customer is seeking to open an account with a new financial institution, FinCEN urges the first financial institution to voluntarily share information with the second financial institution. This should be done if such information qualifies for the safe harbor to protect the reporting of potential money laundering, pursuant to Section 314(b) of the US PATRIOT Act, to alert the second financial institution of potential illegal activity.

Currency Transaction Reports

Financial institutions and other persons subject to FinCEN’s regulations must report currency transactions in connection with marijuana-related businesses to the same extent they would in any other context, consistent with existing regulations and with the same thresholds. However, “a business engaged in marijuana-related activity may not be treated as a non-listed business under 31 C.F.R. § 1020.315(e)(8) and, therefore, is not eligible for consideration for an exemption with respect to a bank’s currency transaction report obligations under 31 C.F.R. § 1020.315(b)(6).”

Recent SEC Enforcement Actions

Navy Capital (Navy Capital Green Management, LLC)

The U.S. Securities and Exchange Commission (the “SEC”) accused cannabis-focused hedge fund Navy Capital Green Management (“Navy Capital”) of misleading investors about its Anti-Money Laundering and Counter-Terrorism Financing (“AML/CFT”) policies and allowing a sanctioned Russian oligarch to invest in its private fund. Navy Capital agreed to pay $150,000 to settle the charges.

According to the SEC, between at least October 2018 and January 2022, Navy Capital represented to its fund investors that it “conducted specific AML due diligence on prospective investors and ongoing AML due diligence monitoring on existing investors,” including “confirming the identity of the investor and its principal beneficial owners.” The SEC alleged that Navy Capital’s actual AML/CFT due diligence policies were materially inconsistent with Navy Capital’s representations.

LPL Financial (LPL Financial LLC)

In 2003, the SEC and the Treasury Department jointly issued the Customer Identification Program (“CIP”) Rule. The CIP Rule is designed to prevent the use of the securities industry for money laundering and terrorist financing and requires broker-dealers to make and keep records related to the identification of their customers and to “establish, document, and maintain a written CIP appropriate for the broker-dealer’s size and business…” As part of its written CIP, a broker-dealer must generally collect, at a minimum, basic information about each of its customers, including each customer’s name, date of birth, address, and identification number. The CIP must include risk-based procedures for verifying the identity of each customer, to the extent reasonable and practicable, to enable the broker-dealer to form a reasonable belief that it knows the true identity of each customer.

On January 17, 2025, the SEC published an order instituting administrative and cease-and-desist proceedings, pursuant to Sections 15(b) and 21c of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and Section 203(e) of the Investment Advisers Act of 1940, as amended (the “Advisers Act”), Exchange Act Release No. 102224, and Advisers Act Release No. 6825, against LPL Financial LLC (“LPL”), a major broker-dealer and investment advisor, for certain AML program failures.

Broker-dealers must adopt “[a]ppropriate risk-based procedures for conducting ongoing customer due diligence,” which include (but are not limited to) “[u]nderstanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile” and “[c]onducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.”

The SEC found that LPL did not have a process for initiating the account closure process for customers that still had insufficient information about the identity of the account holders after 60 days. This led to thousands of accounts that failed LPL’s CIP but remained open after 60 days, in violation of LPL’s AML Policies. On October 12, 2022, LPL internal auditors identified 7,356 accounts that had not passed CIP but were allowed to remain open past 60 days, despite the AML Policies’ requirement to close such accounts after a 60-day period. LPL’s failure to accurately document its CIP procedures violated its own AML Policies.

Further, the SEC noted that LPL failed to close certain higher-risk accounts that its AML Policies had deemed prohibited. As early as May 2019, LPL’s AML Policies prohibited LPL from “doing business with any person or entity involved with marijuana [cannabis] production, distribution or other ancillary operations.” The policy applied to “new accounts established for such entities or persons” and noted that “[e]xisting accounts that are discovered after the fact to be involved in such activities will be addressed on a case by case basis.”

Despite its own policy prohibiting doing business with any person or entity involved, either on a direct or ancillary basis, with cannabis production or distribution, LPL nevertheless permitted numerous cannabis-related accounts to be opened and remain open for years. As of February 2023, approximately 1,400 accounts holding approximately $350 million in assets were deemed inconsistent with LPL’s AML Policies regarding cannabis-related businesses.

Despite repeated internal audits and assessments noting the failures in these areas, LPL continued to service cannabis accounts and foreign accounts in violation of LPL’s AML Policies and Foreign Accounts Policy regarding these accounts. As a result of the above, and in violation of LPL’s AML Policies and Foreign Accounts Policy, LPL failed to accurately document its ongoing Consumer Due Diligence procedures.

Staying Ahead of Cannabis Compliance

The ongoing regulatory scrutiny surrounding financial institutions’ handling of marijuana-related businesses underscores the importance of robust AML and due diligence procedures. Institutions in the investment industry, including securities brokerages, commodity futures intermediaries, and banks, must be constantly vigilant with respect to both regulatory guidelines and their internal policies. It is critical for such companies to assess and report suspicious activity, particularly for customers engaged in federally prohibited activities, such as in the cannabis sector. As the foregoing enforcement actions demonstrate, AML compliance failures can lead to significant legal and financial consequences.

Contact Lawrence Cohen or a member of the firm’s Cannabis, Hemp & CBD practice for questions or legal assistance.