The market for cannabidiol (CBD) products is expected to exceed $20 billion in sales in the coming years, and banks and payments companies have noticed. Pushing against this opportunity, however, is a hazy legal environment.
While hemp, and products derived from hemp, such as CBD, are no longer controlled substances, it can still be a challenge to provide banking or payments services to CBD merchants.
Wait, Is CBD Even Legal?
Given the hype surrounding CBD, it may come as a surprise that the question of its legality continues to generate debate. What isn’t up for discussion, however, is that the legality of CBD is complicated, with the product sitting at the intersection of numerous federal and state laws.
The big change came in 2018, when Congress passed the Agriculture Improvement Act of 2018 (2018 Farm Bill) and amended the Controlled Substances Act (CSA) to exclude “hemp” and hemp derivatives from the definition of marijuana, provided the hemp or the hemp derivative contains 0.3% or less tetrahydrocannabinol (THC).
The 2018 Farm Bill requires hemp to be produced in accordance with either a state hemp regulatory plan (State Plan) or the federal hemp regulatory plan (Federal Plan), as applicable in a particular state or tribal territory. If a state or tribal territory wants regulatory authority over hemp production in its jurisdiction it must first have its State Plan approved by the Department of Agriculture (USDA). Hemp production in a jurisdiction without an approved State Plan will be subject to the Federal Plan being developed by the USDA.
On Oct. 29, the USDA published a draft, interim rule for hemp production that will take effect once published in the Federal Register. Although the interim rule will establish a Federal Plan and will have procedures for approving State Plans, the USDA has not yet implemented a Federal Plan or approved any State Plans.
Setting aside the 2018 Farm Bill, there are also numerous other federal (as well as state) laws that implicate the sale of hemp and CBD.
First, the Food and Drug Administration retains authority to regulate hemp pursuant to the Federal Food, Drug, and Cosmetics Act (FDCA). The FDA’s public position is that the legality of a product containing hemp or a hemp derivative depends on the type of product at issue. While a cosmetic containing CBD may not violate the FDCA, the FDA’s position is that a dietary supplement, food, or drug containing CBD violates the FDCA, unless the FDA has specifically approved an application or regulation authorizing the marketing of such product.
Second, there are federal and state laws that prohibit unfair or deceptive advertising and marketing practices, such as making false or unsubstantiated claims about the benefits of CBD. The FDA and Federal Trade Commission have, for example, warned purveyors of CBD oil that any claims that their product can prevent, treat, or cure human disease are required to be backed by reliable scientific evidence.
On July 22, the FDA sent a warning letter to Curaleaf, Inc. because the company’s CBD products were determined to be unapproved new drugs that were being misbranded under the FDCA. Not long after, on Sept. 10, the FTC issued warning letters to three unidentified CBD sellers, advising of the need for scientific evidence to support their advertising claims.
Third, while most states have taken steps to legalize CBD from hemp, a handful of states continue to prohibit or limit the sale or use of CBD. In California, the California Department of Public Health has taken the position that state law bans hemp-derived CBD in food products (including dietary supplements), even though California has otherwise legalized the use of marijuana.
There’s a Chance to Minimize Risks With CBD
Given the current legal framework, it can be a challenge to provide banking or payments services to merchants that manufacture, distribute, or sell CBD. Navigating this complex industry requires banks and payment processors to implement compliance programs tailored for CBD businesses, including controls governing customer onboarding, due diligence, monitoring, and reporting of suspicious activities.
As part of the application process, the bank or payments company should capture information on the type of products the merchant is selling; determine whether the merchant has obtained any required licenses and is operating in compliance with applicable laws and regulatory requirements; review how the merchant is marketing, advertising, and selling its products; and determine whether the products raise any consumer protection concerns.
Once the USDA fully implements the 2018 Farm Bill, the initial due diligence also should include verification of compliance with a State Plan or the Federal Plan, as applicable.
The due diligence should require the merchant to provide information showing that its CBD products comply with federal laws related to the marketing and sale of legal drugs, food, and dietary supplements.
In many ways, the most immediate risk to banks and processors providing services to CBD merchants is the possibility that the merchants are engaging in deceptive marketing practices or making claims that are likely to draw the attention of federal and state consumer protection authorities.
Finally, the compliance program must include policies and procedures for monitoring the activities in each account and tracking each merchant’s regulatory status (e.g., licensing). For payments providers, monitoring for chargebacks and returns is critical to identifying signs of fraud and other risks.
CBD Is a Higher Risk Vertical
The legal and regulatory framework for CBD has changed rapidly and will continue to evolve as states develop their regulatory programs based on the USDA’s interim rule.
What seems clear, however, is that banks and processors should continue to treat CBD as a higher risk vertical. Before your bank or processor decides to take on this risk, make sure you have an appropriate compliance program in place.
This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.
Author Information
Andrew Bigart is a partner in Venable’s Washington, D.C., office, where he helps banks and non-banks navigate the regulatory environment governing payments and financial services.
Matthew Bornfreund is an associate in Venable’s Washington, D.C., office, where he advises banks and non-banks on bank regulatory matters.