The Lifecycle of Cannabis Business: Where Legal And Compliance Fit In

Most cannabis operators call a lawyer after something has already gone wrong. That is the most expensive possible moment to start. A licensed cannabis business needs legal and compliance guidance at three distinct stages: the beginning, when the entity, the license, and the first contracts are built; the middle, when the operation actually runs and the compliance program either matches reality or does not; and the end, when a business winds down, sells, or surrenders a license. Each stage creates the conditions for the next one. Problems that surface in the middle were usually built in the beginning, and problems that surface at the end were usually built in the middle.

This piece is a map of those three stages and what belongs in each. It is not a substitute for advice about a specific operation.

Why does the timing question matter more now?

For most of the last decade, a cannabis operator answered to a state regulator and a local jurisdiction. That was demanding, but it was a single system with a single set of expectations.

That is changing. Federal developments are shifting the posture for some operators, and a business that has only ever answered to a state agency may find itself dealing with a federal regulator as well. A second regulator is not simply more of the same work. It can mean a different set of records, a different inspection posture, and a different standard for what counts as an adequate answer.

Operators who built good habits early absorb that kind of change. Operators who have been improvising tend to discover the gap at the worst possible time, because a regulator arriving at the door does not grant a grace period for getting organized.

Stage one: the beginning

The startup stage is the most consequential period a cannabis business has, and it is the stage where operators are least likely to have counsel involved, because capital is tight and everything feels urgent.

This is where the decisions get made that everything else inherits:

• Entity structure. How the operating company, any property-holding entity, and any intellectual property sit relative to each other. This drives tax posture, liability exposure, and what a future sale or investment can even look like.
• Ownership and disclosure. Who is disclosed as an owner or financial interest holder, and whether the paperwork filed with the regulator actually reflects the deal the parties made. A mismatch between the cap table and the license file is a problem that grows quietly for years.
• Real property. Lease use clauses, compliance-with-law covenants, and landlord remedies. A lease drafted without cannabis in mind can become the thing that ends an operation that is otherwise doing fine.
• The first contracts. Distribution, supply, management, and consulting agreements signed before anyone fully understands what they are signing, often on paper supplied by the other side.
• The first compliance program. Standard operating procedures that are frequently borrowed from another operator or downloaded, describing a business that is not this one.

The reason this stage matters is not that these decisions are hard to make. It is that they are hard to unmake. Restructuring an entity after a license has issued, correcting an ownership disclosure after the fact, or renegotiating a lease from a position of need are all substantially more difficult and more expensive than getting it approximately right at the start.

Stage two: the middle

The middle is the longest stage and the one where the compliance program either stays connected to the business or quietly detaches from it.

Does the program still describe what you actually do?

Most compliance failures are not the result of an operator deciding to ignore a rule. They are the result of drift. The operation changes, adds a shift, adds a location, changes a vendor, changes a product line, and the written procedures stay where they were. Eventually the SOP describes a business that no longer exists.

That gap is a problem on its own terms, and it is a particular problem in an enforcement posture, because your own documents become the standard you are measured against. A written procedure that the operation does not follow is worse than a thinner one it does follow.

Does the program fit your scale?

A control that works at one location with ten people is not automatically a control at four locations with eighty. “Route all questions to the designated responsible party” is a good example. It is sensible for a small operation and it becomes fragile at scale, because it depends on that person being reachable, on site, and awake when someone walks in the door.

Borrowed compliance programs usually fail not because they are wrong but because they were built for a different size of operation. At scale, the answer typically shifts from “one person handles it” to a documented protocol every shift lead knows, which is a training problem more than a policy problem.

What happens when an enforcement matter starts?

Enforcement lands in the middle, and it lands on the record the middle created. Training logs, internal audits, corrective action documentation, and the SOPs themselves all become evidence of what the operation knew and when.

The work done in stages one and two is frequently the reason an inspection ends without an action. When an action does start, the same work determines how much room there is to respond. Two operators can face identical facts and have completely different outcomes based on whether the documentation supports them.

This is also the point where a state matter and a criminal or asset forfeiture matter can arise from the same set of facts, on separate timelines, in front of different decision-makers. Statements and records generated in one proceeding follow the facts into the other. That is a coordination problem, and it is one worth raising with counsel early rather than after positions have been taken.

Stage three: the end

Almost nobody plans for the end, which is exactly why it tends to go badly.

Cannabis businesses close, sell, consolidate, and surrender licenses regularly, and a wind-down carries obligations that do not disappear because the operation stopped. Depending on the situation, that can include:

• Dissolution or the sale of the entity, and what happens to the license itself, whether it is surrendered, allowed to lapse, or transferred through an approved change of ownership.
• Final regulatory reporting and closing out track-and-trace obligations, including the lawful disposition of remaining inventory.
• Records retention and custody. Retention obligations typically outlive the business. Someone has to hold the records, and someone has to be able to produce them.
• Employee separation, final pay, and any notice obligations.
• Creditors, the landlord, and the allocation of remaining liabilities among owners.
• Preservation obligations if any enforcement, tax, or forfeiture matter is live or reasonably foreseeable. This is the one that most often turns a closed business into a personal problem.

A wind-down handled deliberately ends the business. A wind-down handled by simply stopping can leave individual owners exposed for years afterward, with no entity left to absorb it and no organized records to explain what happened.

What most operators actually do

The common pattern is a single engagement, in the middle, triggered by a letter, an inspection, or a deal that suddenly requires documents nobody has looked at in years.

That is not a criticism of operators. Good legal and compliance help has been expensive and slow, so people reasonably went without it until something forced the issue. But it means the profession has largely been available at the least useful moment, and the mistakes that take businesses out are rarely exotic ones. They are the paper nobody read after signing, the procedure that stopped matching the floor, and the record that did not exist when someone finally asked for it.

Those are preventable. Not all of them, and no lawyer can guarantee that any business survives, because plenty of things end a cannabis business that have nothing to do with its paperwork. But the obvious mistakes are avoidable, and avoiding them is most of what separates operators who get a fair shot from operators who do not.

Why the timing matters past the business itself

It is easy for a lawyer to get so far into leads, revenue, and pipeline that the point of the work disappears. So it is worth stating the downstream effect plainly.

A licensed operator that stays open, stays compliant, and does not lose its license is part of how a patient gets consistent, tested, regulated product. When a business fails over something preventable, the shelf it supplied does not simply refill itself. Supply gets less reliable, less predictable, and less regulated, and the people at the end of that chain have fewer options and less information about what they are getting.

Whether cannabis is the right choice for any particular person is that person’s decision to make with their own medical providers. Nothing here says otherwise. But that decision only exists where there is a functioning, regulated, well-run business to make it from. Keeping those businesses on the right side of their obligations is a small and unglamorous part of protecting that choice, and it is the part a compliance lawyer can actually do something about.

Frequently asked questions

When should a cannabis business first talk to a lawyer?

Before the entity is formed and before the first substantive contract or lease is signed. The startup stage sets the structure everything else inherits, and those decisions are considerably harder to unwind after a license has issued.

How often should a cannabis compliance program be reviewed?

At minimum annually, and additionally whenever the operation materially changes: a new location, a new license type, a significant change in volume or staffing, a new product line, or a regulatory change affecting your activities. The purpose of the review is to confirm the written program still describes what the business actually does.

Can the same attorney handle both an administrative matter and a related criminal matter?

Sometimes, and sometimes separate counsel is the right answer. What matters is that the two tracks are coordinated, because they run on different timelines and what is said in one can follow the facts into the other. That question should be asked at the outset of a matter rather than after positions have been taken.

Do compliance obligations end when a cannabis business closes?

Not automatically. Recordkeeping and retention obligations commonly survive the operation, final reporting may still be required, and preservation duties can attach if a matter is live or reasonably foreseeable. A wind-down should be handled as its own project rather than as the absence of one.

Does a federal registration change what a state-licensed operator has to do?

It can. Answering to a second regulator can mean a different set of records and a different inspection posture on top of existing state obligations. Whether and how it applies depends on the specific operation, and it is an area that is actively changing, so it is worth confirming your current posture rather than assuming it carries over.

About the author

Ryan Kocot is a cannabis attorney licensed in California, New York, and Massachusetts. He works with licensed operators on entity structuring and contracts, compliance programs and audits, and administrative and enforcement matters, including the criminal and asset forfeiture issues.

Attorney advertising. This article is not legal advice. Contacting Kocot Law does not create an attorney-client relationship, and no confidential information should be sent until an engagement is confirmed in writing.