Understanding Your Risks in Offering Services to the Cannabis Industry

1. Understanding Your Risks in Offering Services to the Cannabis Industry Presented by Karla Sasser, CPA, CITP, CIA

2. Learning Objectives • Understand what makes the cannabis industry unique • Understand what could go wrong if I’m just an accountant • Mitigating the risks of providing services to the cannabis industry

3. Understand what makes the cannabis industry unique

4. Cannabis History https://www.dailycal.org/2017/04/20/making-of-menace-abridged-history-marijuana/

5. States that have legalized some form of cannabis https://www.leafly.com/news/cannabis-101/medical-recreational-cannabis-legal-states

6. https://www.deadiversion.usdoj.gov/schedules/#define

7. https://www.fda.gov/news-events/press-announcements/fda-approves-first-drug-comprised-active-ingredient-derived-marijuana-treat-rare-severe-formshttps://www.fda.gov/news-events/press-announcements/fda-approves-first-drug-comprised-active-ingredient-derived-marijuana-treat-rare-severe-forms

8. Amendment X of the Constitution https://constitutioncenter.org/interactive-constitution/amendments/amendment-x

9. Article VI - Supremacy Clause https://www.heritage.org/constitution/#!/articles/6

10. Poling Question As of this webinar, which states have not legalized cannabis? • California and Colorado • Idaho, South Dakota, Nebraska, Kansas • All 50 • None of the above

11. What could go wrong, I’m just an accountant?

12. Money Laundering • According to the US Treasury Department: • Money laundering is the process of making illegally-gained proceeds (i.e., "dirty money") appear legal (i.e., "clean"). Typically, it involves three steps: placement, layering, and integration. First, the illegitimate funds are furtively introduced into the legitimate financial system. Then, the money is moved around to create confusion, sometimes by wiring or transferring through numerous accounts. Finally, it is integrated into the financial system through additional transactions until the "dirty money" appears "clean".

13. Money Laundering Methods • Structuring / smurfing – cash is broken into smaller deposits used to defeat suspicion and to avoid the AML reporting requirements. • Bulk cash smuggling – physically smuggling cash to another jurisdiction with greater bank secrecy and less rigorous money laundering enforcement • Cash-intensive businesses - a business expected to receive a large proportion of its revenue as cash uses its accounts to deposit criminally derived cash – examples include: parking structures, strip clubs, tanning/nail salons, car washes/laundromats, arcades, bars, restaurants, and casinos. • Trade-based – under- or over-valuing invoices • Transaction Laundering - When a merchant unknowingly processes illicit credit card transactions for another business.

14. Bank Secrecy Act The Bank Secrecy Act (BSA), also known as the Currency and Foreign Transactions Reporting Act, is legislation passed by the United States Congress in 1970 that requires U.S. financial institutions to collaborate with the U.S. government in cases of suspected money laundering and fraud • requires banks to report transactions involving more than $10,000 in cash from one customer as a result of a single transaction or two or more related transactions that occur within a 24-hour period • also requires banks to report suspicious activity that might indicate possible money laundering or fraud. An activity is considered to be suspicious if it involves $5,000 or more in funds or assets that the financial institution suspects may indicate profit from illegal activity or transacted in order to hide illegal activity. https://searchfinancialsecurity.techtarget.com/definition/Bank-Secrecy-Act-BSA

15. Impact on Businesses and Employees • Employees of Cannabis Businesses in Danger of Being Denied Bankruptcy Protection - May 17, 2019 by Ken Pickering  • Federal bankruptcy courts – bankruptcy courts are federal, not state – cannot offer bankruptcy protection to debtors whose business activities constitute a federal crime.  • In recent years, bankruptcy cases have focused on individuals or entities that lease space or sell equipment or supplies to those involved in the production, distribution or sale of marijuana. However, it now seems possible that employees that work for organizations related to the marijuana industry could be denied bankruptcy protection as well.  • Congress enacted the Bankruptcy code to aid “honest but unfortunate debtor[s].  In order for a debtor’s bankruptcy plan to be confirmed it must be proposed in good faith, and not be “forbidden by law.”  • Businesses that do not directly grow or distribute products containing cannabis can also be denied bankruptcy protection if their revenue is the result of sales to marijuana businesses.  https://www.cannabisbusinessexecutive.com/2019/05/employees-of-cannabis-businesses-in-danger-of-being-denied-bankruptcy-protection/?utm_source=CBE+Master+List&utm_campaign=1519840b03-Policy+%26+Legal+Issue+%2363+11%2F30%2F17+Custom+Vault+Exc&utm_medium=email&utm_term=0_1f64189714-1519840b03-264248989

16. AICPA Weighs In • What, if any, is the position of my state board of accountancy on CPAs providing services to marijuana growers/distributors? • What are the legal risks of providing services to these businesses in my state? • Is there a risk of prosecution to a CPA firm that provides services to marijuana-related businesses? • What is the likelihood that the Drug Enforcement Administration (DEA) or the Department of Justice is going to prosecute this marijuana-related business? • How are other CPAs in my state currently offering services to state-recognized medical marijuana dispensaries? • How will providing the contemplated services affect my malpractice insurance? How will it affect my professional liability insurance? (See page 11 for more information on professional liability insurance.) • What is the likelihood that I may be disciplined, sanctioned or lose my license by providing services to these businesses? • What procedures/policies should I consider in order to assess whether the prospective client understands the laws of his or her state concerning marijuana-related businesses and if the client is following those rules? https://www.aicpa.org/Advocacy/State/DownloadableDocuments/MarijuanaCPAsIssueBrief.pdf

17. Acts Discreditable • Rule 501 • A member shall not commit an act discreditable to the profession. • Interpretations under Rule 501—Acts Discreditable • 501-1—Response to requests by clients and former clients for records [Revised] • 501-2—Discrimination and harassment in employment practices [Revised] • 501-3—Failure to follow standards and/or procedures or other requirements in governmental audits • 501-4—Negligence in the preparation of financial statements or records [Revised] • 501-5—Failure to follow requirements of governmental bodies, commissions, or other regulatory agencies [Revised] • 501-6—Solicitation or disclosure of CPA examination questions and answers [Revised] • 501-7—Failure to file tax return or pay tax liability • 501-8—Failure to follow requirements of governmental bodies, commissions, or other regulatory agencies on indemnification and limitation of liability provisions in connection with audit and other attest services

18. Acts Discreditable https://nasba.org/mc/legislativesupport/marijuana-board-guidance/

19. Acts Discreditable https://www.aicpa.org/content/dam/aicpa/advocacy/state/downloadabledocuments/marijuana-state-board-positions.pdf

20. AICPA comments https://www.aicpa.org/content/dam/aicpa/advocacy/state/downloadabledocuments/marijuana-state-board-positions.pdf

21. Polling Question What do you believe is the single biggest risk is when working with cannabis companies? • BSA/AML and the risk of having our bank account closed? • My business and/or employees being denied federal protections, such as bankruptcy • My Board of Accountancy suspending my license for “acts discreditable.” • Don’t know / don’t see any risks

22. Can I mitigate the risks of providing services

23. Know Your Client (KYC) • The objective of KYC guidelines is to prevent banks from being used, intentionally or unintentionally, by criminal elements for money laundering activities. Best practice elements for KYC incorporate the following 4 elements: • Customer Acceptance Policy; • Customer Identification Procedures; • Monitoring of Transactions; and • Risk management.

24. Know Your Client (KYC) • KYC controls include: • Implementation of a Customer Identification Program (CIP). • Screening of identity particulars (PII) against global watch-lists to determine the status of public or political exposure and adverse media. • Determination of the customer's risk in terms of the tendency to commit money laundering, terrorist finance, or identity theft. • Creation and assessment of a 'Customer Profile' on the basis of a customer's transactional behavior • Monitoring of a customer's transactions against expected behavior and recorded profile as well as that of the customer's peers

25. Customer Identification Program The CIP must contain risk-based procedures for verifying the identity of the customer within a reasonable period of time. The verification procedures must use “the information obtained from the client. You need not establish the accuracy of every element of identifying information obtained, but it must verify enough information to form a reasonable belief that you know the true identity of the customer. • Verification Through Documents • Verification Through Nondocumentary Methods • Lack of Verification https://www.fdic.gov/regulations/examinations/bsa/FFIEC_CIP.pdf

26. Verification through Documents • Review unexpired government issued identification • Must provide customers nationality or residence • Must bear a photograph or similar safeguard • Encouraged to view more than one document because of the availability of counterfeit and fraudulent documents • For a “person” other than an individual (such as a corporation, partnership, or trust), obtain documents showing the legal existence of the entity, such as certified articles of incorporation, an unexpired government-issued business license, a partnership agreement, or a trust instrument, etc. https://www.fdic.gov/regulations/examinations/bsa/FFIEC_CIP.pdf

27. Verification through Nondocumentary Methods • Nondocumentary methods may include contacting a customer; independently verifying the customer’s identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; and obtaining a financial statement. • Nondocumentary procedures must also address: • an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; • the bank is not familiar with the documents presented; • the customer does not appear in person; or • is otherwise presented with circumstances that increase the risk that it will be unable to verify the true identity of a customer through documents. https://www.fdic.gov/regulations/examinations/bsa/FFIEC_CIP.pdf

28. Lack of Verification • Nondocumentary methods may include contacting a customer; independently verifying the customer’s identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; and obtaining a financial statement. • Nondocumentary procedures must also address: • an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; • the bank is not familiar with the documents presented; • the customer does not appear in person; or • is otherwise presented with circumstances that increase the risk that it will be unable to verify the true identity of a customer through documents. https://www.fdic.gov/regulations/examinations/bsa/FFIEC_CIP.pdf

29. MITIGATING RISKS - AICPA https://www.aicpa.org/content/dam/aicpa/advocacy/state/downloadabledocuments/marijuana-state-board-positions.pdf

30. Rohrabacher-Blumenaur Amendment The main legal instrument that protects state medical and recreational marijuana programs is the Rohrabacher-Blumenauer Amendment. This legislation, included in congressional omnibus spending bills since 2014, prohibits the DEA from spending funds to interfere with state medical cannabis laws. Consequently, cannabis companies, employees of those companies, and medical marijuana patients in those states are immune from federal prosecution. As Rohrabacher-Blumenauer is part of a congressional spending bill, it must be renewed for every congressional year.

31. Polling Question Do you believe the rewards in serving the cannabis industry outweigh the risks? • Yes • No • Don’t know

32. Questions?

33. Speaker Contacts Karla SasserConnect: www.linkedin.com/in/karlasassere-mail: karla@the-virtual-cfo.comPHONE: (805) 328-4523