Emerging high risk industries call for enhanced due diligence

With great risk, comes great reward, and a greater burden of enhanced due diligence. Two industries that present the potential for reward are the newly emerging hemp industry and private ATM operations. Each of these industries presents a differing challenge to institutions providing services to entities as they each sit in a unique regulatory environment. Hemp-related entities are subject to a new and stringent regulatory environment, and private ATM owners are not subject to regulatory requirements that correspond to the level of risk they present.

The signing into law of the Agriculture Improvement Act of 2018—commonly referred to as the 2018 Farm Bill—federally legalized hemp and hemp derived products while providing the framework for the United States Department of Agriculture (USDA) to implement a joint federal and state regime for the regulation of commercial production of hemp. On Oct. 29, 2019, the USDA announced that they were formalizing the regulatory regime by publishing the interim final rule in the Federal Register. 1,2

With the publication of the interim final rule, it is important to keep abreast of potential guidance issued by your relevant regulators. Before the announcement of the interim final rule, the Federal Reserve, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), nor the Federal Credit Administration (FCA) had issued any specific guidance on hemp businesses. The National Credit Union Administration released interim guidance on Aug. 19, 2019, which states that the guidance will be revised and updated once the USDA finalizes their regulations and guidelines.3 Those agencies that have not yet released guidance related to hemp businesses may follow suit now that the regulatory regime is being formalized.

Enhanced due diligence considerations for hemp businesses:

The USDA’s framework for the commercial production of hemp provides two pathways for the licensing of hemp producers. The first pathway involves programs that are developed by State Departments of Agricultures, agencies representing nonstate territories, and Indian tribal governments that will be subject to approval by the USDA. The second pathway consists of licensing by a USDA hemp program and will be available to those producers who are in localities that do not have or intend to have a plan for a hemp program. Institutions that provide services to hemp producers should obtain evidence of their customer’s compliance with licensing. Institutions that maintain customers that are licensed under the USDA program must be cognizant that if the relevant jurisdiction for their customer’s locality decides to implement a hemp program, the license issued by the USDA will be invalid upon the jurisdiction issuing licenses under their own program.

• A major crux of the licensing requirements for hemp producers consists of THC, the active ingredient in marijuana, testing to ensure that the levels are under 0.03%. The 0.03% threshold also applies to hemp-derived products; however, there is currently no federal licensing requirement on hemp-derived products that provides an easy method of due diligence on this requirement. Institutions that provide services to entities involved in hemp-derived products should consider requiring those entities to provide independent testing of the THC in their products. In addition to the evidence of THC testing, institutions should consider obtaining information on the suppliers of the hemp utilized to produce the products in order to verify that the hemp is being derived from a lawful and licensed entity. 
• One further risk factor that institutions should take into account is the potential for the comingling of funds with marijuana-related businesses that may have a relationship with an entity involved in the hemp industry. Institutions should consider performing enhanced due diligence on the entity and other parties to the entity such as beneficial owners for potential ties to marijuana-related businesses. If the institution’s customer has ties with marijuana-related businesses, controls should be put in place to mitigate the potential risk for marijuana-related business activity to be conducted through accounts maintained by the hemp business.

Despite presenting significant multivector risk for criminal activity, private ATMs are not subject to regulatory scrutiny in the majority of states. This regulatory environment shifts a larger burden of due diligence onto the institutions that maintain relationships with private ATM owners, and the nature of private ATM operations presents a unique due diligence challenge. 

Enhanced due diligence considerations for private ATM owners:

• The most vital due diligence process for institutions providing services to private ATM owners is gaining an understanding of the cash procedures for the ATMs. As the size and risk of the private ATM operations increase, the difficulty of gaining a thorough understanding of the operations may increase as well. An institution that is conducting business with a large and/or higher-risk private ATM operation should consider requiring the private ATM owners to conduct and provide an independent audit of their operations.
• Aside from the risks presented by typical ATMs, institutions should consider the risk if their customers are operating ATMs that provide atypical services such as check cashing or cryptocurrency services. If their customers are operating ATMs that provide such services, an additional layer of due diligence is required to qualify as money service businesses. This is of particular concern when it comes to ATMs that provide cryptocurrency services—also colloquially known as bitcoin ATMs, due to the risk-averse nature of financial institutions when it comes to cryptocurrency entities. Operators of ATMs with cryptocurrency services may obscure the nature of their cryptocurrency activity in order to obtain access to financial services that may not be broadly available to them. To identify whether your customer’s ATM is a bitcoin ATM, there are online resources that provide the locations of these machines. The institution can use these resources to compare with the information obtained about the location of their customer’s ATMs.
• In an ideal world, institutions with private ATM owners would be able to perform site visits for all ATMs that are owned and operated by their private ATM owner customers. Unfortunately, we do not live in an ideal world and site visits for private ATM owners with a large footprint presents a significant resource challenge. To fill in potential gaps, institutions should look to leverage open source tools and capabilities. Utilizing even the simplest tools such as Google Maps and Google Street View can provide a portion of the due diligence that would be otherwise ascertained by a site visit to compile a more complete picture of the customer and their operations.

Something that institutions must always keep in mind is that enhanced due diligence is more than simply a regulatory check box. It is a tool that provides valuable leverage to the institution’s risk decision process—particularly with entities that present unique risk such as hemp businesses and private ATM owners. The time and effort put into enhanced due diligence processes are an investment with returns of assurance and more sound decisions.

1. USDA Establishes Domestic Hemp Production Program
   
   
2. Establishment of a Domestic Hemp Production Program
   
   
3. Serving Hemp Businesses