Cannabis Payments: What the Banking and Card Rules Actually Require

By Cannible Editorial

2026-08-10

As of August 20, 2026, the central federal guidance describes expectations placed on financial institutions that choose to serve marijuana-related businesses—not a retailer-software compliance checklist. A financial institution must make its own risk-based decision about opening, maintaining, or refusing an account or relationship, perform customer due diligence, monitor for suspicious activity, and file required reports. Nothing in the evidence guarantees that a cannabis business will obtain or keep payment acceptance. The position can change after August 20, 2026, and a payment provider’s own policy is not federal law. 1 2

This article is general information, not individualized legal, medical, business, or compliance advice. Whether any of it applies to a particular person, product or business depends on the facts and on applicable state law; consult a qualified professional.

The financial institution’s decision

The federal financial-crime guidance is directed to financial institutions seeking to provide services to marijuana-related businesses. It explains how those institutions can provide services consistently with Bank Secrecy Act obligations, while emphasizing that each institution decides whether to open, close, or refuse a particular account or relationship. That decision may depend on the institution’s business objectives, the risks of the product or service, and its capacity to manage those risks. 1

For an operator, this means platform availability is not universal eligibility. A service being available in one setting does not establish that every cannabis retailer qualifies, or that a particular provider must accept the business. The evidence establishes institutional discretion and risk assessment; it does not establish guaranteed approval, continued acceptance, or a universal payment channel. 1 2

The guidance also reflects the conflict between federal and state law. Federal law identified in the guidance prohibits the manufacture, distribution, or dispensing of marijuana, while states may legalize certain marijuana-related activity. State authorization therefore does not remove the financial institution’s federal reporting obligations. 1

What due diligence the institution is expected to perform

The institution’s customer due diligence is expected to be thorough and risk-based. The evidence lists specific areas the institution should examine before and while providing services. 1

Verify with the appropriate state authorities that the business is duly licensed and registered, and review the license application and related operating documentation. 1

Request available information from state licensing and enforcement authorities about the business and related parties. 1

Understand the business’s normal and expected activity, including the products it intends to sell and whether its customers are medical, recreational, or both. 1

Monitor publicly available sources for adverse information about the business and related parties, and monitor transactions for suspicious activity and listed red flags. 1

Refresh customer-due-diligence information periodically and in proportion to the risk. 1

Consider whether the business implicates a federal enforcement priority or violates state law. The listed priorities include distribution to minors, diversion to other states, revenue reaching criminal enterprises, violence or firearms, drugged driving and other public-health consequences, activity on public lands, and possession or use on federal property. 1

The evidence describes these activities as the institution’s due-diligence and monitoring responsibilities. A software feature is not, by itself, legal compliance, and automation is not human or legal review. The material does not establish that inventory software, transaction automation, artificial intelligence, or any other tool can substitute for the institution’s required assessment, ongoing monitoring, or reporting judgment. 1

Inventory recordkeeping and regulatory approval are also different things. The federal tax material says good records can help monitor transactions, track deductible expenses, and substantiate items reported on tax returns. Separately, the financial institution is expected to verify licensing with state authorities. A recordkeeping system therefore does not itself constitute state licensing or federal regulatory approval. 1 3 4

Suspicious-activity reporting does not disappear with state authorization

A financial institution that provides services to a marijuana-related business is required to file suspicious activity reports under the guidance. The obligation is unaffected by a state law legalizing marijuana-related activity. A report is required when the institution knows, suspects, or has reason to suspect that a transaction involves illegal proceeds or an attempt to disguise them, is designed to evade Bank Secrecy Act regulations, or lacks a business or apparent lawful purpose. The guidance states that, because federal law prohibits marijuana distribution and sale, transactions involving a marijuana-related business would generally involve funds derived from illegal activity. 1

The guidance distinguishes reporting categories according to what the institution’s due diligence reasonably indicates. Those categories are obligations for the financial institution, not instructions that a retailer can satisfy by selecting a particular software setting. 1

A Marijuana Limited SAR applies when the institution reasonably believes the business does not implicate a listed enforcement priority and does not violate state law. Its content is limited to identifying and address information for the subject and related parties, the fact that the filing is solely because the subject is engaged in a marijuana-related business, and the fact that no additional suspicious activity was identified. 1

A Marijuana Priority SAR applies when the institution reasonably believes the business implicates a listed enforcement priority or violates state law. It should include comprehensive detail, including the relevant priority, the parties involved, and the dates, amounts, and other relevant details of the transactions. 1

If the institution terminates the relationship to maintain an effective anti-money-laundering program, it should file a SAR explaining the basis for termination and use the term Marijuana Termination in the narrative. 1

The guidance says red flags are possible signs, not conclusive proof, and not an exhaustive list. They must be considered in the context of other facts and the institution’s customer-due-diligence knowledge. Examples include unexplained revenue, cash inconsistent with reported marijuana revenue, rapid movement of funds, third-party deposits without an apparent connection, commingling with personal or unrelated business accounts, inconsistent financial statements, inability to document licensing or lawful operations, concealment of marijuana involvement, adverse information about related parties, state or local enforcement action, interstate or international activity, and activity involving federal property. 1

Cash reporting: bank reports and business tax reports

Currency reporting is separate from whether a provider accepts card or other electronic payments. Financial institutions and other persons subject to the financial-crime regulations must report currency transactions connected with marijuana-related businesses under the same existing rules and thresholds used in other contexts. Banks and money services businesses must file Currency Transaction Reports for a person’s receipt or withdrawal of more than $10,000 in cash in one day. A marijuana-related business may not be treated as a non-listed business eligible for the specified exemption from a bank’s CTR obligations. 1

The business itself can have a separate Form 8300 obligation. A person in a trade or business that receives more than $10,000 in cash in one transaction or related transactions must file Form 8300 within 15 days after receiving payment. That is a reporting obligation tied to receiving large cash payments; it is not a guarantee of banking or card acceptance. 3

Card-security standards are not federal cannabis approval

The card-security standards body described in the evidence develops, maintains, disseminates, and supports security standards and resources for payment account data. Its standards are intended for entities that store, process, or transmit payment account data, entities accepting or processing payment transactions, and developers and manufacturers of software and devices used in those transactions. 2

The evidence does not supply a technical checklist for a cannabis retailer, so it does not support adding specific requirements about encryption, authentication, device configuration, network design, or data retention. It does establish that the standards body does not enforce compliance or monitor implementation. Whether an entity must comply with or validate compliance is left to organizations that manage compliance programs, such as a payment brand, acquirer, or another entity. 2

Accordingly, card-security standards and financial-crime reporting are different layers. Meeting a card-security standard, where a payment program requires it, does not establish that a cannabis business is licensed, satisfies the financial institution’s due diligence, avoids suspicious-activity reporting, or qualifies for acceptance. Conversely, a provider’s internal acceptance policy is not federal law, and the evidence does not establish that compliance with a card-security standard guarantees acceptance. 1 2

Federal tax obligations remain a separate track

Federal tax filing and payment obligations are separate from payment acceptance. The evidence states that income from any source is taxable and taxpayers generally must report that income on a tax return. It also states that businesses trafficking marijuana in contravention of federal or state law are subject to the limitations of Internal Revenue Code Section 280E. Cash transactions must be reported like other forms of payment, and good records should summarize business transactions and support items reported on tax returns. 3

A payment processor, bank, or card channel does not replace tax reporting. Nor does a retailer’s recordkeeping feature establish tax compliance, licensing, regulatory approval, or payment eligibility. Decisions involving the application of federal tax rules, state licensing rules, and the institution’s risk requirements should be evaluated with a qualified professional because the evidence covers those regimes separately rather than creating one combined approval standard. 1 3 4

State rules still apply independently

The evidence about California describes one state’s framework and should not be generalized to every jurisdiction. California’s cannabis businesses operate under state statutes and Department of Cannabis Control regulations, as well as city and county ordinances. Those rules address matters including licensing, operating requirements, packaging and labeling, testing, and track-and-trace requirements. Local ordinances apply only in the city or county that adopted them. 4

For an operator, the practical dividing line is clear: state licensing and local operating rules are not the same as a financial institution’s federal due diligence, SAR obligations, CTR obligations, card-security program requirements, or federal tax duties. The evidence establishes these as separate regimes; it does not establish a single approval, software feature, or payment platform that satisfies all of them. 1 2 3 4