Presentation to the Ohio Credit Union League -- July 14, 2017 Banking & Compliance Marijuana-Related Businesses Presentation to the Ohio Credit Union League -- July 14, 2017 Presentation to Ohio Credit Union League -- July 14, 2017

AGENDA Presentation to Ohio Credit Union League -- July 14, 2017

OHIO MEDICAL MARIJUANA CONTROL PROGRAM Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Medical Marijuana Control Program HB 523 was signed by Governor Kasich in June 2016, legalizing marijuana in Ohio for specific medicinal purposes. Effective Sept. 8, 2016 Ohio Revised Code, Chapter 3796 Ohio Administrative Code, Chapter 3796 O.A.C. 3796:1 Definitions O.A.C. 3796:2 Cultivators O.A.C. 3796:5 Administration and Enforcement Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Medical Marijuana Control Program Major components Licensure of cultivators, processors, and retail dispensaries (cultivators/processors by Commerce, dispensaries by Pharmacy). O.R.C. 3796.02. Registration of patients and caregivers (by Pharmacy). O.R.C. 3796.08. Licensure of labs for marijuana testing (by Commerce). O.R.C. 3796.09. Physicians must obtain certificates from State Medical Board in order to prescribe medical marijuana. O.R.C. 4731.30. Presentation to Ohio Credit Union League -- July 14, 2017

Cultivation and Sale of Medical Marijuana Holder of a valid cultivator license may cultivate medical marijuana and then sell to a licensed processor. O.R.C. 3796.18. The licensed processor then delivers/sells the processed medical marijuana to a licensed retail dispensary. O.R.C. 3796.19. The dispensary shall then sell to a verified patient presenting a recommendation from their physician. O.R.C. 3796.20. Presentation to Ohio Credit Union League -- July 14, 2017

Forms and Medical Conditions O.R.C. 3796.06 Forms: Oils, tinctures, plant material, edibles, patches Any form approved by Pharmacy Vaporization is permitted Smoking is prohibited O.R.C. 3796.01(A)(6) Medical Conditions: Only for the treatment of “qualified medical conditions” Includes: AIDS, Alzheimer’s, Crohn’s and Parkinson’s diseases, multiple sclerosis, cancer, chronic and severe pain, and others Presentation to Ohio Credit Union League -- July 14, 2017

Employer Provisions O.R.C. 3796.28 Employers: May prohibit employee’s use of medical marijuana May refuse to hire or take adverse employment action for a person’s use of medical marijuana May establish or enforce a drug testing policy Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Medical Marijuana Control Program By the numbers: 12 Level I Cultivators. O.A.C. 3796:2-1-01. 12 Level II Cultivators. O.A.C. 3796:2-1-01. 40 Processors. O.A.C. 3796:3-1-01. 60 Dispensaries. O.A.C. 3796:6-2-05. It is anticipated that demand will likely outstrip supply under current regulatory regime. Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Medical Marijuana Control Program What is happening now: June 30, 2017: 100+ Tier I Cultivator applications submitted September 2017: Final rules for processors, dispensaries, testing labs, patients, and caregivers Processor license – rules filed with JCARR (mirror cultivator rules) Dispensary license – rules in-process, not yet filed with JCARR Application deadlines: TBD September 2018: Full program will be operational Presentation to Ohio Credit Union League -- July 14, 2017

FEDERAL REGULATORY GUIDANCE FOR MRBs Presentation to Ohio Credit Union League -- July 14, 2017

Federal Regulatory Guidance for MRBs Background: Marijuana remains a Schedule I drug under the Controlled Substance Act Historically, federal government defers to states to prosecute local crimes, including marijuana drug crimes Federal comity: if the state has a strong and effective regulatory and enforcement system, the federal government is loathe to interfere Presentation to Ohio Credit Union League -- July 14, 2017

Federal Regulatory Guidance for MRBs Former Deputy Attorney General James M. Cole issued two DOJ Memorandums (“Cole Memos”) to outline guidance for all federal enforcement activity 2013 Cole Memo: addresses marijuana crime policy 2014 Cole Memo: addresses financial crime policy Presentation to Ohio Credit Union League -- July 14, 2017

2013 Cole Memo “Applies to all federal enforcement activity, including civil enforcement and criminal investigations and prosecutions, concerning marijuana in all states.” A “guide to the exercise of investigative and prosecutorial discretion.” Does not alter federal law and the criminality of marijuana at federal level distribution of marijuana to minors funding of criminal enterprises diverting of legal marijuana to states where it is not legal using marijuana activity as pretext for other criminal activity illegal use of firearms or violence in cultivation and distribution of marijuana drugged driving and other adverse public health consequences the cultivation of marijuana on public lands and the use or possession of marijuana on federal land 14 Presentation to Ohio Credit Union League -- July 14, 2017

2013 Cole Memo: Preconditions Preconditions for deference to state authorities requires legal marijuana regulatory regime. Dept. of Justice more likely defer to state law, IF The state has a strong and effective regulatory and enforcement system to control cultivation, distribution, sale, and possession of marijuana. The state administers the system in compliance with the state’s laws and regulations. The state does not interfere with eight federal priorities. Presentation to Ohio Credit Union League -- July 14, 2017

2013 Cole Memo: Eight Federal Priorities 2013 Cole Memo seeks to prevent the: Distribution of marijuana to minors Funding of criminal enterprises Diverting of legal marijuana to states where it is not legal Using marijuana activity as pretext for other criminal activity Illegal use of firearms or violence in cultivation and distribution of marijuana Drugged driving and other adverse public health consequences; The cultivation of marijuana on public lands The use or possession of marijuana on federal land Presentation to Ohio Credit Union League -- July 14, 2017

2013 Cole Memo: Comity and Deference “The federal government has traditionally relied on states and local law enforcement agencies to address marijuana activity.” Federal authorities should “focus their enforcement resources and efforts, including prosecution, on persons or organizations whose conduct interferes with any one or more of these priorities, regardless of state law.” Presentation to Ohio Credit Union League -- July 14, 2017

2014 Cole Memo: Financial Institutions Addresses financial crimes where marijuana-related crimes are a predicate: BSA Money laundering Unlicensed money transmitter Financial institutions exposed to civil or criminal liability under federal law for banking marijuana- related activity. Presentation to Ohio Credit Union League -- July 14, 2017

2014 Cole Memo: Financial Institutions Applies 2013 Cole Memo guidance to financial institutions Investigations and prosecutions of financial institutions guided by eight federal priorities “In determining whether to charge individuals or institutions with any of these offenses based on marijuana related violations . . . prosecutors should apply the eight enforcement priorities described in the [2013 Cole Memo].” Presentation to Ohio Credit Union League -- July 14, 2017

2014 Cole Memo: Prosecution Appropriate Specifically spells out application of guidance If provide banking services to a MRB knowing Legal marijuana is being diverted to prohibition states Funds are being used to conduct other criminal activity Alternatively, if “willfully blind” to such activity By failing to conduct customer due diligence Prosecution may be appropriate Presentation to Ohio Credit Union League -- July 14, 2017

2014 Cole Memo: Prosecution Inappropriate Also, specifically spells out where prosecution is inappropriate. If a financial institution offers services to a MRB whose activities: “Do not implicate any of the eight priority factors, prosecution for these offenses may not be appropriate.” Presentation to Ohio Credit Union League -- July 14, 2017

2014 Cole Memo: Scope of Guidance Cole Memos do not: Change federal legal status of marijuana Bar investigation or prosecution even absent one of the federal priorities But guidance repeatedly, and specifically, directs federal enforcement where the eight federal priorities are affected. Presentation to Ohio Credit Union League -- July 14, 2017

Rohrabacher-Farr Amendment Limits DOJ’s spending relating to enforcement activity targeting legal marijuana state regulatory regimes “None of the funds made available in this Act to the [DOJ] may be used . . . to prevent [states] from implementing their own [ ] laws that authorize the use, distribution, possession, or cultivation of medical marijuana.” Ohio is an enumerated state in recent Amendment. Consolidated Appropriations Act, 2017, Pub. L. No. 115–31, § 537 (2017). Presentation to Ohio Credit Union League -- July 14, 2017

Rohrabacher-Farr Amendment Lack of monetary support strictly limits DOJ enforcement activity vis-à-vis medical marijuana Affects every federal law enforcement agency DEA, ATF, FBI, US Marshals Service Affects federal agencies that depend on law enforcement agencies to assist in regulatory matters FinCEN The Amendment expires annually (Sept. 30, 2017) and must be reauthorized each year. Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance with Banking MRBs Intended to be comprehensive Financial institution obligations Enhanced due diligence Regulatory structure specific to MRBs Additional filing requirements Financial institution must develop BSA/AML compliance system that accounts for MRB guidance from DOJ Eight federal priorities from Cole Memos Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Customer Due Diligence “Thorough customer due diligence is a critical aspect of making this assessment.” A financial institution should include CDD that includes: Verifying business is duly licensed and registered Reviewing state license application for MRB Requesting available information from state licensing and enforcement authorities Developing an understanding of the normal and expected activity for the business, including the types of products to be sold and the type of customers to be served Ongoing monitoring for adverse information about the business and related parties Ongoing monitoring for suspicious activity, including for any of the FinCEN red flags Refreshing information obtained as part of customer due diligence on a periodic basis and commensurate with the risk Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: SARs Generally In 2014 Guidance, FinCEN notes that Suspicious Activity Reports need to be filed when financial transactions: Involve funds derived from illegal activity or is an attempt to disguise funds derived from illegal activity or Are designed to evade regulations promulgated under the BSA or Lack a business or apparent lawful purpose. Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Legal MRBs Legal MRB transactions still required to have a SAR But SARs are a regulatory tool designed to help federal and local law enforcement Monitor use of financial system to help uncover crime Help law enforcement focus limited resources on activity that government actually wants to prevent State legal marijuana is not a target of interest to law enforcement at federal, state, or local level What is a regulator to do? Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: MRB SARs Suspicious Activity Reports meet MRBs Marijuana-Limited SAR Does not implicate a federal priority Marijuana-Priority SAR Credit Union reasonably believes violates a federal priority Marijuana-Termination SAR Should indicate type of Marijuana SAR in ALL CAPS Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Marijuana-Limited SAR Marijuana-Limited SARs should be limited to the following content: Identifying information of the subject and related parties; Addresses of the subject and related parties; The fact that the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and The fact that no additional suspicious activity has been identified. Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Marijuana-Priority SAR Marijuana-Priority SARs should include the following content: Identifying information of the subject and related parties; Addresses of the subject and related parties; Details regarding the enforcement priorities the financial institution believes have been implicated; and Dates, amounts, and other relevant details of financial transactions involved in the suspicious activity. Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Marijuana-Termination SAR Filed where the financial institution believes it can no longer maintain an effective BSA/AML compliance program by servicing the MRB. Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance: Red Flags FinCEN provides guidance on how to categorize between the three MRB SARs. Generally includes the following categories: Use of a state-licensed MRB as a front for criminal activity Insufficient documentation to demonstrate that it is engaged in a lawful MRB business Based on public searches, principals or MRB are currently or have engaged in bad acts Concealment of activity Hiding MRB activity Activity inconsistent with size and type of business, nature of business, or banking activity Presentation to Ohio Credit Union League -- July 14, 2017

FinCEN Guidance Detailed and robust FinCEN has touted success of guidance FinCEN Marijuana Banking Update through Q1 2017 Presentation to Ohio Credit Union League -- July 14, 2017

In real time . . . 368 Institutions and 28,651 SARs from 50 states Data as recent as March 31 2017 50 + District of Columbus and Puerto Rico “Marijuana Banking Update,” FinCEN, March 30, 2017, available at https://www.fincen.gov/sites/default/files/shared/Marijuna_Banking_Update_Through_Q1_2017.pdf Presentation to Ohio Credit Union League -- July 14, 2017

20,288 Marijuana-Limited SARs filed As of March 2017… 20,288 Marijuana-Limited SARs filed 2,007 Marijuana-Priority SARs filed 7,326 Marijuana-Termination SARs filed FinCEN Marijuana Banking Update through Q1 2017 Presentation to Ohio Credit Union League -- July 14, 2017

In real time . . . A few examples: Salal Credit Union Partner Colorado Credit Union Maps Credit Union Numerica Credit Union Obee Credit Union Presentation to Ohio Credit Union League -- July 14, 2017

OHIO REGULATORY GUIDANCE Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Regulatory Guidance Division of Financial Institutions OAC 3796.27 safe harbor from criminal prosecution. As long as banking MRB is compliant with HB 523 and has paid applicable Ohio taxes. Includes credit unions. O.R.C. 3796.27. Presentation to Ohio Credit Union League -- July 14, 2017

Ohio Regulatory Guidance Credit Union may ask Commerce or Pharmacy for: Status of MRB’s license Affiliated businesses or individuals Copy of application Information relating to sales and volume of product Compliance with or past/pending violation of Ohio Medical Marijuana Program Presentation to Ohio Credit Union League -- July 14, 2017

BSA/AML COMPLIANCE PROGRAMS Presentation to Ohio Credit Union League -- July 14, 2017

BSA/AML Compliance Programs Risk Assessment Four Pillars of a Successful Program Customer Identification Program (CIP) New FinCEN Rule – 2018 Compliance & MRBs Avoiding Pitfalls Presentation to Ohio Credit Union League -- July 14, 2017

Risk Assessment An effective BSA/AML program must be risk-based and tailored to the specific credit union. 2 step process: Identify specific risk categories Conduct detailed analysis Starting point for examiners What would you prefer – assessment crafted by credit union or by examiners? Presentation to Ohio Credit Union League -- July 14, 2017

Four Pillars of BSA/AML Compliance Program BSA compliance officer Policies, procedures & controls Training Independent testing Presentation to Ohio Credit Union League -- July 14, 2017

Pillar 1: BSA Compliance Officer Purpose: Oversight Experience matters! Deep understanding of BSA/AML regulations Manages communications with regulators Keys: Appointed by board Direct line of communication to the board/senior management Presentation to Ohio Credit Union League -- July 14, 2017

Pillar 2: Internal Policies, Procedures & Controls Developing a “culture of compliance” Requirements Written Approved by board Noted in board minutes Conforms to BSA/AML risk profile Presentation to Ohio Credit Union League -- July 14, 2017

Pillar 3: Training For ALL personnel whose duties require BSA knowledge Should be: Specifically tailored Annual Documented Frequently updated Orientation and continued training General compliance and MRB specific Presentation to Ohio Credit Union League -- July 14, 2017

Pillar 4: Independent Testing Goal: assess adequacy/effectiveness of BSA/AML compliance program Keys to success: Completed by someone outside the credit union Annual Results reported directly to the board Review all pillars of compliance program Presentation to Ohio Credit Union League -- July 14, 2017

Customer Identification Program (CIP) Part of the USA Patriot Act Keys: Approved by board Specifically tailored Customers must be informed Presentation to Ohio Credit Union League -- July 14, 2017

Goals of Successful CIP MUST: Obtain basic identifying data Verify customer identity Retain records used to verify identity Include check of key government lists (e.g., SDN) Additional aspects: How to handle discrepancies Terms for banking while ID is verified What to do if credit union believes ID is unknown Presentation to Ohio Credit Union League -- July 14, 2017

New FinCEN Due Diligence Rule May 2018 Designed to help in: Identifying & verifying customers Identifying & verifying beneficial owner Understanding nature & purpose of customer relationship Conducting ongoing monitoring Presentation to Ohio Credit Union League -- July 14, 2017

Compliance & MRBs Enhanced due diligence (EDD) Going above and beyond FinCEN Guidance on customer due diligence Going above and beyond Working with regulators Risk v. reward Presentation to Ohio Credit Union League -- July 14, 2017

Avoiding Pitfalls Document, document, document! Ensure sufficient resources Consult counsel (internal and external) Show thoughtfulness in compliance steps Remain vigilant Put yourself in regulator’s shoes Presentation to Ohio Credit Union League -- July 14, 2017

IS IT RIGHT FOR YOU?

Is it right for you? Big market opportunity But reward must be balanced against increased risks and costs Reputational risk of banking MRBs Marijuana use and sale remains a federal crime Financial transactions for MRBs can form the basis of a civil or criminal violation under the BSA and related AML statutes Banking for MRBs will require very strict adherence to federal guidance and BSA/AML reporting requirements specific to MRBs Presentation to Ohio Credit Union League -- July 14, 2017

Is it right for you? Does your leadership want to be involved? Does your constituency want to be involved? Is it right for your credit union? Presentation to Ohio Credit Union League -- July 14, 2017

Is it right for you? Can you invest the resources? Assess current compliance program Requires building a new MRB-compliance program Important to monitor MRBs on an ongoing basis Update as guidance and regulation changes Closely follow Ohio and federal legislative and administrative authority regarding financial services for MRBs Additional regulatory scrutiny Presentation to Ohio Credit Union League -- July 14, 2017

Thank You! QUESTIONS? The presentation represented herein is intended for general information purposes only and does not and is not intended to constitute legal advice. Presentation to Ohio Credit Union League -- July 14, 2017

Albert G. Lin ICE MILLER LLP 250 West Street Columbus, OH 43215 Albert.Lin@icemiller.com (614) 462-2233 Steven D. Forry ICE MILLER LLP 250 West Street Columbus, OH 43215 Steven.Forry@icemiller.com (614) 462-2254 Presentation to Ohio Credit Union League -- July 14, 2017