The coronavirus pandemic has added another wrinkle to navigating state versus federal regulations when it comes to gaining access to banking services by marijuana-related businesses.

Before the pandemic, more than half the states in the U.S. had authorized some form of legalized marijuana use. In response to the coronavirus, most of these states with legalized cannabis have declared marijuana sales to be “essential,” and said those businesses should remain open, or at least offer delivery or curbside pickup.

Despite this classification, programs created by the coronavirus relief bill, like the Paycheck Protection Program meant to help small businesses, do not extend to marijuana-related businesses, as well as many indirect marijuana businesses.

Over the past few years, states have accelerated the legalizing of adult-use cannabis. Today, 33 states have legalized marijuana for medical use and, of those, 11 have legalized adult use.

There are four states with ballot initiatives in 2020 to legalize medical or adult use, or to expand from medical-only use to a recreational use (down from more than a dozen due to suspended signature gathering given COVID-19).

Because of the cash-intensive nature of the business, policymakers, regulators, tax authorities and law enforcement have stressed the need for moving cash from marijuana sales into the traditional banking system. Treasury Secretary Steven Mnuchin recently testified that marijuana businesses’ lack of access to banking services is problematic and places IRS workers at risk.

Marijuana-related businesses are inherently high risk, but so are other industries like money-services businesses, which have faced “de-risking” for years.

The Financial Crimes Enforcement Network provided guidance in 2014 to help financial institutions assess and manage risks tied to banking marijuana-related businesses. It also laid out the process for filing suspicious activity reports for customers engaged in marijuana-related activity.

Notwithstanding this guidance, many bankers still fear the reaction from their examiner if they bank marijuana-related businesses.

Last year, the House passed a bill (HR 1595) that attempted to resolve this problem by prohibiting the federal agencies from taking action against a bank simply for offering services to marijuana-related businesses that are legal under their state law. It also required federal financial regulators to issue clearer guidance and exam procedures for banks servicing such businesses. However, the bill remains pending in the Senate.

In the absence of federal guidance, states including California, New York and Washington have offered some clarity on providing banking services to marijuana-related businesses. And a number of states have incorporated a job aid developed by the Conference of State Bank Supervisors.

But the guidance to date mostly focuses on a bank’s evaluation of the risks associated with offering services to marijuana-related businesses. It does not outline what constitutes a strong program for serving such businesses.

The uncertainty has led to inconsistency in oversight and expectations from state and federal examiners, which only increases during a crisis.

But there are ways to develop a strong internal program to satisfy examiner expectations.

First, a financial institution’s risk assessment needs to provide an in-depth, all-encompassing review of the risks associated with marijuana-related businesses. At minimum, that includes addressing any state and federal guidance. The institution must also identify the controls necessary to bring the inherent risk into alignment with the risk tolerance of the bank.

Secondly, a stand-alone policy on servicing marijuana-related businesses will not suffice. As with many other risks, banking such businesses will touch operations across the bank including compliance, anti-money-laundering laws, deposit and payments operations, lending and audit. Banks need to ensure that the responsibility to manage the risks is shared across the organization.

Third, banks must develop enhanced due diligence for marijuana-related businesses, just like they would for other higher-risk customers. The FFIEC examination manual related to anti-money-laundering provides expectations regarding customer due diligence.

Training is also critical. Everyone from the board down needs to understand state law and regulations regarding cannabis, federal guidance and the cannabis industry in general. These are minimum expectations in order to mitigate the risks associated with serving marijuana-related businesses.

If staff do not have a strong understanding of what is “normal” activity, they will not be able to properly monitor for suspicious behavior. The board must also be actively engaged, requiring regular reporting and adjustments to the program as necessary.

The success of nearly any activity, and especially one that is high risk, requires active monitoring and robust oversight. This includes a strong three-lines-of-defense model, and testing for compliance with bank policies.

Lastly, regulatory technology has matured and is helping institutions manage compliance risks. By automating repetitive tasks such as filing SARs and flagging noncompliant activities, a bank can reduce the resources needed to run such programs.

This also frees up time to review customers or activities that pose the highest risk. And more important, it frees up bankers to focus on customers who need servicing the most during the pandemic.