The sale of adult-use cannabis has been legalized in 24 states in the United States. But this does not mean there are no other legal impediments to the cannabis industry in those jurisdictions. For example, cannabis dispensaries can still have a difficult time establishing banking relationships. More important, cannabis dispensaries have not been able to take full advantage of modern payment methods, such as virtual wallets, because major credit card networks have viewed cannabis sales as illegal transactions and therefore prohibit cannabis payment processing. Market participants over the years have come up with workaround solutions intended to enable cannabis dispensaries to take noncash payments without violating card network rules. This blog reviews the background of the crackdown on the “cashless ATM” approach by Visa and Mastercard, outlines the risk mitigants that we recommend cannabis businesses and payment intermediaries consider implementing, and discusses alternative solutions for cannabis retailers.
The Challenge of Providing Payment Processing and Financial Services to the Cannabis Industry
Despite progress in numerous US states to authorize the distribution and use of cannabis for both medical and adult-use purposes, cannabis is still federally illegal under the Controlled Substances Act (CSA). For financial services providers, this means that transactions involving proceeds generated by cannabis activities may form the basis for prosecution under anti-money-laundering statutes and the Bank Secrecy Act (BSA). Therefore, banks and money transmitters risk criminal liability when they are involved in certain financial and monetary transactions with proceeds derived from unlawful activities, including proceeds from cannabis-related conduct under the CSA. However, providing financial services to the cannabis industry is not strictly prohibited. The Department of Justice issued guidance in 2013 and 2014 (the “Cole Memo”) setting forth eight priority enforcement areas against cannabis-related conduct.1 Prosecutors are expected to apply the eight enforcement priorities when determining whether to charge individuals or institutions based on cannabis-related violations of the CSA. The Cole Memo stated that if a financial institution or individual offers services to a cannabis-related business whose activities do not implicate any of the eight priority factors, prosecution for these offenses may not be appropriate. Although the Cole Memo was later rescinded by then-Attorney General Jeff Sessions, the current attorney general has indicated that the Department of Justice under his leadership would not prioritize criminal enforcement of cannabis activities legalized by states.2
The Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) issued guidance to clarify how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations as well as to align the information expected in BSA reports with federal and state law enforcement priorities.3 FinCEN expected the guidance to “enhance the availability of financial services for, and the financial transparency of, marijuana-related businesses.”4 Despite FinCEN’s explicit guidance, many financial institutions choose to not provide services to cannabis businesses to avoid undertaking the additional compliance risks and costs. All the major payment card networks deem cannabis purchases and sales to be illegal transactions in the US region, and typically, customers cannot purchase cannabis using their network-branded credit or debit cards as they would in a grocery store. For example, the Visa rules prohibit merchants from submitting transactions for the “purchase of products that claim or imply a similar efficacy as prescription drugs, controlled substances, or recreational/street drugs, irrespective of claims of legality.”5 Mastercard prohibits any illegal or brand-damaging transactions, which includes the “sale or offer of sale of a product or service other than in full compliance with law then applicable to the Acquirer, Issuer, Merchant, Cardholder, Cards, or [Mastercard].”6
As a result, cannabis businesses have traditionally relied on cash payments. Not only do cash payments fail to provide the most convenient and modernized customer experience, but they also create public safety concerns and invite increased criminal activity. Operating in cash also makes it impracticable to scale up business operations and further complicates the tracking of funds and collection of tax payments.
The Cashless ATM Workaround and the Crackdown
Market participants have used the “cashless ATM” model to circumvent the restrictions on card payments in the context of cannabis retail businesses. To do so, a cannabis dispensary would set up a payment device that was registered as an ATM. A customer would insert their debit card, enter their PIN, and select a dollar amount that covered the sales price of cannabis and transaction fee, rounded up to the whole dollar. After the transaction was authorized, the dispensary would hand over the product to the customer and give the customer change in cash. The transaction was reported and coded as an ATM withdrawal for the card network. In theory, the economic substance of a cashless ATM transaction is equivalent to a transaction in which the customer withdraws cash from an ATM placed on the dispensary’s premises and uses that cash to purchase the cannabis (which is not prohibited by any network rule), except that in a cashless transaction, the withdrawal and purchase transactions are settled simultaneously without cash changing hands.
The card networks have raised concerns that cashless ATM transactions are simply disguised illegal cannabis transactions. At the end of 2021, Visa issued a warning to banks that the cashless ATM scheme being deployed at merchant outlets may operate in violation of the Visa rules and threatened enforcement actions. Although the Visa statement did not name the cannabis industry specifically, many acquiring banks and payment processors have pulled back from supporting cashless ATM sales.7 Similarly, in summer 2023, Mastercard instructed financial institutions that offer payment services to cannabis merchants and connect them to Mastercard to terminate the activity.8
Risks for Merchants and Payment Processors and Ways to Mitigate
Whether a permissible way of using cashless ATM exists and whether it should be viewed as a simultaneous cash withdrawal and cash purchase is debatable, but the card networks have discretion to decide whether a transaction has violated network rules or is damaging to the reputation of the network. Cannabis dispensaries and payment processors that continue to facilitate cannabis sales via the prohibited cashless ATM methods assume the risk that their respective businesses could be shut down or fined by card networks. In addition, they might be contractually liable to the acquiring bank for knowingly submitting illegal transactions. A payment processor may also be liable to the bank for failure to implement a sufficient anti-money-laundering compliance program.
Therefore, we recommend that cannabis dispensaries and payment processors carefully review the cashless ATM model to mitigate their risk exposure. For a payment processor, it is important to perform thorough due diligence on the cannabis merchant and the owners that receive the payment services. We recommend that the diligence confirms, for example, the physical dispensary location, evidence that the operation of the cannabis business is fully compliant with local and state laws and regulations, information about the dispensary owner’s background and criminal records, whether the dispensary has safeguards in place to prevent diversion, and whether the dispensary has been banned by any payment network or its relationship terminated by any bank. We recommend that the payment processor be fully transparent about the plan with the acquiring bank and seek approval from the bank. Transparency with partners early on when establishing these partnerships can help both parties better evaluate the potential risks associated with a processor’s payment solution.
It is also important to ensure transaction data in the merchant’s records are accurate. For example, the registered address of the ATM terminal should match the physical location of the cannabis dispensary, and all transaction details required to be disclosed or reported should be disclosed and reported truthfully. Some payment processors provide a cash vault to better support the argument that the transaction is an ATM transaction and not an illegal purchase. Providing customers with the option to obtain cash can support an argument that a true ATM transaction has occurred, separate from the cash purchase of cannabis. A payment processor may also consider adopting a short-term referral model in which it simply refers cannabis merchants to acquiring banks without undertaking the screening and monitoring obligations.
For a cannabis merchant, it is important to understand the risks and benefits of using cashless ATM at checkout as well as the effects on future business operations if it is to be shut out from a payment network or an acquiring bank. Merchants have options when evaluating potential payment processor partners. We recommend that merchants evaluate whether the partner can offer true ATM transactions transparently as opposed to a workaround that is not fully compliant with the network rules and applicable law. The merchant should always make sure the information it provides to the payment processor and the acquiring bank is complete and true, and the merchant should fully cooperate with requests to provide additional documentation or information. Meanwhile, we recommend that merchants explore alternative payment methods such as those discussed below as an exit strategy if cashless ATM is to be completely banned.
Alternative Payment Solutions
Other than cash payment, Automated Clearing House (ACH) payment is generally permissible in the context of cannabis sales. We recommend that merchants consider collaborating with payment providers that support ACH processing at the point of sale. For example, some providers offer mobile apps in which a customer links their bank account as the payment method, and when paying at the store with the app, the linked account will be charged via ACH.
Payment service providers looking to serve the cannabis industry may consider offering a “preloaded” payment method for customers, leveraging their state money transmitter licenses. Similar to the way people can top up and spend their PayPal account balance, a customer can top up a cannabis-friendly payment account using their preferred payment method and later spend the balance at participating cannabis merchants.
Last, cannabis merchants are allowed to take payments in virtual currency. Due to the volatile nature of virtual currencies, however, the better course of action is to accept only stablecoins and convert them to fiat currency afterward. The challenge is that not every customer owns virtual currency or is willing to go out of their way to procure it. A payment service provider that provides a seamless crypto on-ramp process would prove helpful in this situation by allowing a customer to purchase cannabis using virtual currency with a few clicks on their phone, for example.
Goodwin’s Fintech Team
We practice in every fintech vertical, including lending, alternative finance (e.g., merchant cash advances, earned wage access, and factoring), payments, deposits, insurance, broker-dealers, and investment advisors. In addition to doing product and service development regulatory work, we assist our fintech clients that choose to deliver their solutions through banks in entering into bank partnership and platform agreements.
1 These are: (i) preventing the distribution of marijuana to minors; (ii) preventing revenue from the sale of marijuana from going to criminal enterprises, gangs, and cartels; (iii) preventing the diversion of marijuana from states where it is legal under state law in some form to other states; (iv) preventing state-authorized marijuana activity from being used as a cover or pretext for the trafficking of other illegal drugs or other illegal activity; (v) preventing violence and the use of firearms in the cultivation and distribution of marijuana; (vi) preventing drugged driving and the exacerbation of other adverse public health consequences associated with marijuana use; (vii) preventing the growing of marijuana on public lands and the attendant public safety and environmental dangers posed by marijuana production on public lands; and (viii) preventing marijuana possession or use on federal property. James M. Cole, “Guidance Regarding Marijuana Related Financial Crimes,” US Department of Justice, February 14, 2014.2 See “Responses to Questions for the Record to Judge Merrick Garland, Nominee to be United States Attorney General,” Senate Committee on the Judiciary, February 28, 2021; Sam Reisman, “Garland Tells Lawmakers DOJ’s Approach to Pot Unchanged,” Law360, April 26, 2022.
3 "BSA Expectations Regarding Marijuana-Related Businesses,” FinCEN, February 14, 2014.
4 Id.
5 “Visa Core Rules and Visa Product and Service Rules,” Visa, October 14, 2023, §§ 1.10.2.2; 10.1.2.1.
6 “Mastercard Rules,” Mastercard, June 6, 2023, § 5.12.7.
7 Steve Gelsi, “Visa Cracks Down on Cashless ATMs at Cannabis Dispensaries,” MarketWatch, updated January 25, 2022; Will Yakowicz, “What Visa’s Warning about ‘Cashless ATMs’ means for the Cannabis Industry,” Forbes, December 20, 2021.
8 Dario Sabaghi, “Mastercard Cracks Down on Marijuana Transactions on its Debit Cards,” Forbes, July 27, 2023 https://www.forbes.com/sites/dariosabaghi/2023/07/27/mastercard-cracks-down-on-marijuana-transactions-on-its-debit-cards/?sh=544c0d9a7d67.
This informational piece, which may be considered advertising under the ethical rules of certain jurisdictions, is provided on the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin or its lawyers. Prior results do not guarantee a similar outcome.
Contacts
- /en/people/t/tang-ximeng
Ximeng (Sammy) Tang
Partner