Are Unregistered Cannabis Businesses at Risk of Federal Enforcement?

By Ryan Kocot, cannabis attorney licensed in CA, NY & MA — DEA registration and federal compliance for state-licensed cannabis operators.

The short answer: The safest assumption is that an unregistered cannabis business has no federal protection. But assumption and observation are different things: I have yet to see federal enforcement against a state-licensed marijuana business (registered or not) since the registration window closed. And when you look at how the spending rider is actually written, there’s a reason the sky hasn’t fallen. The honest framing isn’t “you’re protected” or “you’re exposed.” It’s that enforcement against unregistered operators may be a “when” question rather than an “if” question, and nothing I’ve seen says we’re at “when” yet.

What the spending rider actually protects

Since 2014, Congress has attached a rider to DOJ appropriations, commonly known as Rohrabacher-Blumenauer, barring the Department of Justice from spending funds to prevent states from implementing their medical cannabis laws. Courts, most prominently the Ninth Circuit in United States v. McIntosh, have read it to protect conduct in strict compliance with state medical cannabis law.

Two things matter about that language:

1. It’s medical only. Adult-use businesses don’t have rider protection. Their shield has always been enforcement discretion, not law.
2. It says nothing about DEA registration. The rider predates the 2026 rescheduling. It contemplates state-law compliance; it does not contemplate a registered/unregistered distinction, because until this year that distinction didn’t exist.

The new question rescheduling created

The April 2026 rescheduling and the registration pathway split state-licensed medical operators into two classes federal law had never distinguished: registered and unregistered. So the question everyone is circling: did rider protection quietly narrow to registered businesses only?

One could argue “yes”—that once a federal registration pathway exists, “strict compliance” implies taking it. A state like Oklahoma might support that argument, since OBN mandated registration for its licensees. If a state folds federal registration into its own regulatory expectations, an unregistered operator’s state-compliance argument gets weaker.

But that reads like a stretch against the broader landscape. Most states have taken a hands-off approach to their operators’ federal registration decisions. The rider’s text hasn’t changed. And a court asked to find that protection evaporated for unregistered medical operators might be a stretch.

The problem with enforcement

If DOJ wanted to move against unregistered operators, it would face a strange targeting map:

• Unregistered medical operators still hold the strongest colorable claim to rider protection.
• Adult-use operators have no rider protection, but in many jurisdictions, the operational difference between a medical and an adult-use business is thin to nonexistent.

Going after adult-use businesses while leaving functionally identical unregistered medical businesses alone would be an odd exercise of discretion, and going after unregistered medical head-on invites the rider fight DOJ has historically lost. Neither is impossible. Both are awkward. Awkward enforcement tends to wait for better facts or clearer law.

So what changes the answer?

• Rider language changes. The rider renews each appropriations cycle. A single clause adding “registered” would resolve the question overnight against unregistered operators.
• More states follow the Oklahoma model and fold registration into state licensure. That erodes the strict-compliance argument state by state.
• A test case. The first enforcement action against an unregistered state-licensed operator tells us which theory DOJ is running and which one a court buys.
• DOJ/DEA guidance signaling a registration-forward enforcement posture.

What I tell operators in the meantime

1. Plan from the safe assumption. Build your posture as if no federal protection applies.
2. Don’t confuse quiet with safety. No observed enforcement is a fact about the present, not a promise about next year. The registration pathway’s existence is itself the writing on the wall.
3. Make registration a decision, not a default. The standard pathway remains open. The right move depends on your channels, your state, and your risk tolerance, but it should be a decision made on purpose, with the readiness work done either way.

FAQ

Kocot Law advises state-licensed cannabis operators on DEA registration and federal compliance. This article is attorney advertising and general information, not legal advice; reading it does not create an attorney-client relationship.