In a previous post, we discussed lessons drawn from recent compliance challenges in the cannabis industry that highlight some of the consequences that arise without thorough due diligence on cannabis-related business partners (CRB). In this post, we provide a checklist of six key issues to consider when conducting due diligence on partners in the industry. While not intended to be comprehensive, this list is a sound foundation and will help identify areas requiring deeper due diligence.
Issue 1: Location of the business
In some countries, cannabis is legal for medicinal use. In others, it is legal for medicinal and recreational use. In still others, it carries the death penalty. In the U.S., the law also varies from state to state. Therefore, it is essential to understand exactly where a business is operating – what countries, what states, where it is incorporated, where it operates, where it ships, where it sources – as well as the applicable law in each relevant jurisdiction.
Issue 2: Nature of the business
The risks presented by a CRB are, to a large extent, a function of the nature of its business. In general, so-called “plant-touching” businesses (i.e. cultivators and processors) are at more risk than ancillary businesses (such as providers of agricultural equipment or point-of-sale software). Companies in recreational cannabis present greater risk than companies that work exclusively in the medical space. Companies working exclusively in hemp, assuming they are compliant with the 2018 Farm Bill, should present only minimal risk.
When considering the nature of the business, it is important to remember that many companies in the industry have multiple lines of business. For example, dispensaries often serve both medical and recreational markets where permitted by state law, and licensed recreational sellers may sell hemp-based products as well in some states. Therefore, it is important to understand all of the company’s business lines, including those of its subsidiaries and affiliates.
Issue 3: Ownership
A company is only as good as the people who run it. Therefore, it is crucial to identify the business’ ultimate beneficial owners and key executives, and to vet them carefully. In most states, cannabis companies are required to disclose ownership information as part of the licensing process, so they should be able to provide a list of individuals already vetted by regulators. In the case of a publicly-traded company, information about key executives should also be readily accessible through required public filings. Independent background investigations on these individuals is crucial, and the scope and depth of those investigations should be appropriate for the risk profile of the business.
If the company is already licensed, it may be possible to rely on the background checks completed by state regulators during the licensing process. However, some state background checks involve little more than a criminal history review. Therefore, one should not rely on what a state licensing agency has done without a thorough understanding of the scope of the regulatory background check and comfort that that scope is sufficient for internal risk management needs.
Some of the industry’s most experienced operators may have criminal records for cannabis-related crimes that pre-date legalization. Therefore, a cannabis-related criminal record, while noteworthy, should not be treated as automatically disqualifying. Rather, it is important to consider exactly what the conviction was for (trafficking in heroin is different than cannabis possession, especially in the eyes of state regulators), the date of the conviction (generally, older is less problematic), the legal regime in effect at the time of the conviction, and the relevant jurisdiction’s current approach to licensing those with prior convictions. Any indications that an individual paid bribes to obtain a license, participated in a scheme to defraud investors, has a disregard for financial controls, or has failed to comply with current regulations should be treated especially seriously.
Issue 4: Licenses
Every state has its own licensing regime for cannabis and hemp businesses. For each state in which the company operates, it is important to verify (1) what licenses are required and (2) possession of the relevant licenses. Licenses should be independently verified with the relevant regulator. The business should be asked to provide its license information (such as a license number, and the name of the licensed entity) for each relevant state regulator; that license information should then be corroborated through direct contact with the issuing regulator. In some states, like California, this information can be easily accessed through state websites; in others, like Arizona, this information is not generally released to the public and it is therefore necessary to call or email the regulator.
If the company is operating through affiliates or management contracts in a particular state, and does not own a license in that state, it is important to confirm that the arrangement complies with state regulations. The only way to do this is to speak directly with the relevant regulatory body.
The cannabis licensing process is vulnerable to bribery and corruption, primarily due to the many layers of approval required for the licensing process from the municipal level to the state level. As discussed in Part 1, federal law enforcement appears to be aggressively investigating potential corruption in the state licensing process. Therefore, when vetting a potential partner, it is important to look for any indicia that the license was obtained through improper means. This can be done through:
- reviewing media reporting on the licensing process in the relevant state, county, and/or city for any allegations of corruption;
- reviewing media reporting on the individuals involved in granting the licenses to see if they have been the subject of any other allegations, unrelated to marijuana licensing;
- asking the company if any consultants, lobbyists, or middlemen advised them on the application process, especially at the local level;
- if so, attempting to determine whether they were paid above market rates and doing public source research to determine whether they have been the subject of any allegations.
Issue 5: Outside Relationships: Banks, Auditors, Lawyers
It is often said that you can judge people by the company they keep. This is also true in the cannabis industry. A cannabis company that is working with a bank or credit union is likely to have undergone extensive vetting by the financial institution prior to onboarding, and will have various controls in place relating to cash handling and anti-money laundering. If the company is banked, make sure that it has adequately disclosed the nature of its business to the bank. It is never a good idea to do business with someone who lied to get a bank account (or anything else for that matter).
As with a banking relationship, the retention of an outside auditor is also some evidence that the company is committed to best practices in financial management and compliance. However, it is important to determine whether the auditor has experience in the cannabis industry, and whether the audit firm is of a size that gives confidence that it is able to adequately supervise the company. It is also important to remember that a successful audit is not a guarantee of full compliance. Auditors evaluate the integrity of a company’s books and records; they do not evaluate compliance with state licenses or conduct background checks on management.
Similarly, the retention of a reputable outside law firm with expertise in cannabis law is also a good sign that the company is committed to compliance with the law. A good outside law firm can also expedite the due diligence process by answering questions about the company’s licenses and compliance with relevant law and can also help in obtaining compliance representations, warranties and covenants.
Issue 6: Compliance Program and Culture
As we noted in Part 1, the mere possession of a license is no guarantee of consistent compliance with the license. Therefore, it is always important to evaluate the company’s commitment to compliance. This can be done by asking the following questions, among others:
- Does senior management “get” compliance?
- Do they understand their license obligations, as well as all relevant laws, including the Food, Drug and Cosmetic Act and FDA regulations on hemp derived products?
- Do they understand the science of cannabis compliance and best practices for testing and handling cannabis?
- Do they understand the Cole Memorandum priorities and are they committed to complying with them?
- Does the company devote adequate resources to compliance? For example, is there a senior executive whose primary responsibility is compliance?
- Do they do background checks on employees?
- Have there been any enforcement or regulatory actions involving the company or its employees?
- Will the company sign compliance certifications?
This checklist is not exhaustive and due diligence must always be tailored to the specific client and case. But following these guidelines can help companies better understand the risks associated with potential CRB partners and make informed decisions about whether they want to work with them.
