“Compliance” is a cannabis industry buzzword, and rightfully so given how heavily regulated the industry is across the United States. When business owners and ancillary service providers hear the term, however, their focus typically zeros in on the state and local cannabis regulations that govern a given license type. However, a singular focus on state and local cannabis regulations is recipe for disaster.

Focusing only on state and local cannabis regulations ignores potential local, state, and federal law that may apply to a cannabis business. Many state and local cannabis regulations either fail to mention relevant sources of outside law entirely or make cursory mention of them.

What’s key to understand, therefore, is that the term “compliance” encompasses more than just state and local cannabis regulations.

While the Cannabis Law Hub predominantly focuses on cannabis regulations, do not stop at your state and local cannabis regulations when developing a compliance program.

“Compliance” also includes local, state, and federal statutes and regulations that aren’t spelled out in the cannabis regulations. These statutes and regulations include, but aren’t limited to:

Taxes
Health and Safety
Marketing
Labor & Employment

The Current State of “Cannabis Law”

Now that we are on the same page that we must consider law outside of state and local cannabis regulations, let’s establish a baseline understanding of cannabis law at the federal, state, and local level(s).

At the federal level, “marihuana” is found on Schedule One of the Controlled Substances Act (“CSA”) and is defined as “all parts of the plant Cannabis sativa L., whether growing or not; the seeds thereof; the resin extracted from any part of such plant; and every compound, manufacture, salt, derivative, mixture, or preparation of such plant, its seeds or resin .” Title 21, United States Code (USC), Controlled Substances Act. In addition to excluding specific parts of the Cannabis sativa L. plant, (stalks, seed oil, etc.), the definition of “marihuana” explicitly excludes hemp.

If hemp is excluded from the definition of “marihuana,” then what is the difference between the two? In answering this question it’s important to remember that we are talking about varietals of the same cannabis plant. The distinction between the two varietals, therefore, is more of a legal distinction than a biological one. Hemp was removed from the CSA altogether by the 2018 Farm Bill, and is defined similarly to “marihuana,” except hemp is limited to containing 0.3% Delta-9 Tetrahydrocannabinol (“THC”). H.R.2 – Agriculture Improvement Act of 2018.

The legal distinction between “marihuana” and hemp, therefore, comes down to whether a given cannabis plant has more than 0.3% Delta-9 THC. If a cannabis plant has more than 0.3% Delta-9 THC, it is considered “marihuana” by the federal government. Less than or equal to 0.3% Delta-9 THC, and it’s considered hemp.

Decriminalization vs. Legalization

Decriminalization of marijuana refers to the removal or reduction of criminal penalties related to the possession, consumption, cultivation, distribution, or sale of marijuana. Legalization of marijuana also refers to the removal of criminal penalties, but additionally opens the door to commercial marijuana businesses and expanded consumer consumption and cultivation rights. Whether you find yourself in a decriminalized or legalized jurisdiction, here are two things to remember:

You can still be charged with a cannabis crime in Federal Court since Federal Law “wins” when it conflicts with State Law, and
There still may be conduct related to cannabis possession, consumption, cultivation, distribution, or sale of marijuana that could result in civil or criminal penalties.

In the commercial context, state marijuana laws typically also empower local governments to establish and enforce marijuana regulations in their jurisdiction within the parameters set by state law. Even if marijuana is legal at the state level, therefore, a local government may not allow commercial marijuana activity at all, or may only allow certain types of commercial marijuana activity (i.e. only allow certain license types to operate).

State and Local Cannabis Statutes and Regulations

State and local governments across the United States have legalized cannabis. State regulations typically establish a commercial market that utilizes a dual licensing structure that requires an entrepreneur to obtain state and local approval prior to opening their business. Moreover, local government typically has the option to “opt-in” or “opt-out” when it comes to allowing commercial cannabis activity in its jurisdiction.

State law similarly distinguishes between “marihuana” (however, the term “marijuana” or “cannabis” is typically used by state and local regulators) and hemp by THC percentage, and establishes two separate regulatory and licensing scheme(s) for the two varietals of the cannabis plant.

Whether an entrepreneur is able to sell both “marihuana” and hemp products in a retail store or otherwise operate in both industries concurrently, depends on the jurisdiction finds itself in. For example, cannabis dispensaries are currently prohibited from selling hemp products in California whereas this may be an option for entrepreneur in other states such as Massachusetts.

Conflict Between Federal & State Cannabis Law

Confusion tends to set in when entrepreneurs realize that federal and state/local cannabis law conflict. Who “wins” when federal and state/local cannabis law conflicts? The Supremacy Clause of the U.S. Constitution provides the general rule of thumb:

If federal law conflicts with state/local law, federal law generally “wins.”

Put another way, if federal cannabis law conflicts with state/local cannabis law, federal cannabis law preempts state/local cannabis law . Since “marihuana” is “illegal” under federal law, and federal law preempts conflicting state/local, isn’t “marihuana” still illegal in state/local jurisdictions that have legalized?

The answer? While the preemption issue presented by the conflict between federal and state cannabis law is a complicated one, the oversimplified answer is “yes.” State and local governments across the United States have not been able to “legalize” cannabis because of any clever legal theory or loophole, therefore.

Instead, cannabis has been “legalized” without federal interference due to protections included by Congress in Spending Bills, as well as numerous political and logistical roadblocks that the Federal Government would face if it chose to enforce the CSA. Specifically, the federal government may not have the resources to enforce the CSA without state and/or local cooperation.

Alas, we arrive at an ironic realization when it comes to discussing expanding our definition of “compliance”: A business that enters the cannabis industry is violating federal law even if it maintains strict compliance with state and local regulations. Therefore, there is arguably no such thing as a “compliant” cannabis business.

The above statement may sound like semantics, but entrepreneurs must understand and appreciate the risk assumed by entering the cannabis industry. While strict compliance with state and local law is the best safeguard against federal enforcement, there is no such thing a complete safeguard against federal enforcement so long as “marihuana” remains a Schedule One drugs under the CSA.

Federal Cannabis Enforcement

The marijuana industry isn’t out of the woods when it comes to Federal enforcement. Federal authorities aren’t only interested in blatant illegal activity such as selling across state lines–they’ve also begun to take interest in violations of state and/or local marijuana law, particularly systematic and repetitive violations.

Businesses, therefore, must fully understand the risk they are taking due to marijuana’s status as a Schedule 1 drug under the Controlled Substances Act and protect themselves to the extent possible.

There’s no complete safeguard against Federal enforcement, but at a bare minimum, marijuana businesses must maintain strict compliance with state and local law. It’s important to remember that state and local marijuana regulations set the floor when it comes to compliance, not the ceiling.

Creating a Cannabis Compliance Program

Compliance programs can be broken into two main phases:

Planning Phase, prior to operations commencing
Implementation Phase, after operations commence

Planning Phase: Risk Assessment

Cannabis companies should start with a risk assessment. Risk assessments are a compliance staple in many other industries and represent the first step towards creating a compliance program in the cannabis industry. A business must first establish the risk it faces to know what to address in its compliance program.

A risk assessment is not a mechanical exercise wherein a cannabis business simply lists out all the risks it may face, however. All risk is not created equal. Risk assessments should zero in on the most serious risks and their likelihood of occurring and associated punishment or other exposure. To get the ball rolling, the following five questions should be considered:

Who will be responsible for implementing and monitoring the compliance program?
Which cannabis license(s) will the business hold and what is the associated regulatory landscape?
Is it a private or public company?
How many employees?
Does the intended location present any unique safety and/or security issues?

After a business considers risk from a high level, it should consult state and local cannabis regulations. While regulations typically have sections devoted to individual license types, entrepreneurs should read through regulations in their entirety since there are often sections that apply to all licensees.

Businesses also should search far and wide for any disciplinary guidelines published by state or local regulators. Disciplinary guidelines are typically either included within a jurisdiction’s regulations or published as a stand-alone document.

Compliance inspection checklists should also be requested at the state and local level in an effort to prioritize compliance concerns. State and local inspectors will often be provided with a checklist that outlines what an inspector should be on the lookout for when inspecting a licensee’s operations. While they are not always available, inspection checklists can be invaluable in assessing risk.

Risk assessments are skipped all too often by companies attempting to craft cannabis compliance programs. Do not be one of them. Think of risk assessments in the same way a writer thinks about organizing and outlining key points and issues before they start writing a book or article.

And most of us (Author included) have personally experienced the positive impact that this approach can have: think about the difference in work product when comparing a research paper written the night before it was due vs. a paper that was thought through before pen was put to paper. Similarly, taking time to assess risk before putting a compliance together will result in businesses receiving a better “grade” from state and local compliance inspectors in the long term.

At this point, the question often becomes:

“Do I need to hire an attorney and/or consultant?

The answer to this question boils down to the marijuana business owner’s overall operational and compliance experience with their chosen license type. Owners should consider they have successfully written and implemented marijuana SOPs in the past, and what level of operational experience they bring to the table. If experience is minimal, it may be worth bringing in an attorney or consultant that has experience writing and implementing SOPs for a business’s specific cannabis license type.

Regardless of whether a marijuana business owner decides to hire outside help, state and local marijuana regulations set the parameters within a business must operate. Therefore, regulations are where businesses should start when determining crafting SOPs and their overall compliance program.

After establishing a baseline knowledge of relevant regulations, marijuana entrepreneurs should consider the unique challenges presented by the business’ property and overall business model and how to best comply with the regulations given those circumstances.

By the end of the planning phase and prior to a marijuana business opening its doors, a thorough compliance binder should be created and cover the following topics:

Security
Safety
Inventory
Transportation
Quality Control
Cash Management
Track and Trace
Other procedures specific to a business’s operations

Employee training on the policies and procedures contained in the compliance binder should occur prior to operations (and ideally with onsite situational walk-throughs), if possible.

Implementation Phase

All too often, marijuana companies spend a significant amount of time and money creating their compliance program, but don’t put the same amount of effort implementing the program they paid for and/or created. How does a marijuana business avoid making this all too common mistake?

By training employees early and often.

All employees must be trained on all policies and procedures in the binder upon getting hired, and at regular intervals (weekly, monthly, quarterly, etc.) as the business progresses. Only training marijuana employees when they are first hired is a recipe for disaster.

With how heavily regulated the marijuana industry is, it’s simply impossible for an employee to retain all of the policies of procedures relevant to a marijuana business in a single training. Provide employees with compliance training as frequently as necessary and gradually decrease the amount of training sessions as employees become more comfortable with their role.

Technology Solutions

There are a number of technology solutions out on the market that offer compliance services that should be utilized to bolster existing compliance programs. Don’t get me wrong: automation and other technology solutions are undoubtedly the future when it comes to marijuana compliance. Just think about Microsoft Word/Excel and the difference in productivity when you started picking up on all the bells and whistles both programs offer.

However, while compliance technology solutions often provide helpful workflows and templates, operators shouldn’t solely rely on technology providers to develop or implement their compliance program. Rather, business owners must independently ensure that their compliance program is tailored to their jurisdiction’s regulations and the business’ specific set of circumstances.

Implementing a Compliance Program: Cannabis Compliance Binders

Successful marijuana compliance programs revolve around organization and consistency. A good way for any business to stay organized is to put a compliance binder together before operations begin. An ounce of prevention is worth a pound of cure when it comes to compliance.

What is a Cannabis Compliance Binder?

A compliance binder is an organized compilation of all the documents necessary to ensure a marijuana business’s strict compliance with all relevant law. It should be maintained in both digital and hard copy form and organized by category in folders/with tabs.

While printing the documents out may seem old school, the ability to simply hand a compliance inspector a binder with all the documents they’re looking makes for a much smoother experience for both your business and the inspector.

How do I decide which documents to include in my binder?

Which documents should be included within a compliance binder? Compliance binders should contain all documents that an inspector may ask to review. To determine which documents qualify, consider taking the following three steps:

Research your jurisdiction’s disciplinary guidelines. Disciplinary guidelines typically describe regulatory violations and associated punishments. The list of violations and punishments may shed light on your jurisdiction’s enforcement priories, as well as documents that you’ve overlooked.
Request a copy of the inspection sheets used by state and local inspectors. While some jurisdictions are resistant, many are willing to provide the checklist used in site inspections. Much like researching the disciplinary guidelines, an inspection checklist will provide insight into what your binder should emphasize.
Consult your jurisdiction’s record keeping requirements. These requirements should describe which documents should be maintained by a licensee, and for how long. Records related to taxes, inventory, transport, sales, security, employees, etc. should typically be maintained. Make sure to research both state and local requirements to make sure that you aren’t overlooking any local wrinkles.

In all likelihood, your jurisdictions state and/or local marijuana regulations will have a “Record Keeping” section that will describe which documents should be maintained by a licensee, and for how long.

Records related to taxes, inventory, transport, sales, security, employees, etc. should typically be maintained. and others. Make sure to research both state and local requirements to make sure that you aren’t overlooking any local wrinkles.

Auditing a Cannabis Compliance Program

The components of a cannabis compliance program must be audited at regular intervals. For example, a compliance binder might be reviewed and updated on a monthly basis, or at the very least, on a quarterly basis.

When auditing a cannabis compliance program, a business should consider whether any changes have been made to relevant regulations or to business.

For example, if a new employee has come on board since the last review, their information will in all likelihood need to be added to the binder and maintained (and possibly reported to state and local licensing agencies, but more on that in the “Disclosures” lesson). Be sure to also consider whether any SOP has changed, and be sure to document the operational change (and potentially disclose it) accordingly.

Cannabis Compliance Inspections

Here are three steps to consider taking when preparing for cannabis compliance inspections:

Review your compliance binder and update it, if necessary. Make sure any necessary SOP changes are included, and double check whether said changes need to be disclosed to regulators. Double check your jurisdiction’s disciplinary guidelines to make sure all your bases are covered.
Perform mock inspections. Put yourself in an inspector’s shoes and conduct a mock inspection, including a walkthrough of the licensed premises. Inspectors commonly utilize checklists when performing inspections. Reach out to the entity that issued your license and ask if you can get your hands on one.
Be prepared. Make sure all documentation required by your jurisdiction is organized and easily accessible to your client so that it isn’t a mad scramble when an inspector shows up.

Cannabis Compliance Services

Attorney Kocot offers cannabis compliance services in California, Massachusetts, and New York. He helps marijuana and hemp businesses create, implement, and audit their compliance programs.

As the former General Counsel and Director of Compliance for a multinational public cannabis company, Attorney Kocot gained day-to-day operational cannabis industry experience that now allows him to guide marijuana businesses from a start-up to a profitable business. Compliance services include, but are not limited to:

Drafting standard operating procedures that ensure strict compliance with all state and local regulations;
Packaging and labeling compliance;
Inventory procedures compliance;
Quality assurance compliance;
Transportation procedures compliance;
Compliance Auditing and Inspections;
License application review;
Marketing compliance; and
Much more!

Contact Kocot Law For a Consultation

Feel free to reach out directly with the form below if you have any cannabis compliance needs.