A cannabis banking risk assessment is only as useful as the assumptions behind it. For institutions that evaluated the market several years ago, many of those assumptions have changed.
Cannabis markets are larger and more mature. Federal cannabis and hemp policy is moving on several fronts. Hundreds of depository institutions are already managing marijuana-related BSA obligations. Specialized infrastructure has also changed the economics and operational requirements of launching or scaling a program.
None of this eliminates cannabis banking risk. It does mean that a decision based on the environment of five or six years ago may not reflect the environment institutions face in 2026.
Federal policy has moved in several directions at once
Perhaps the clearest reason to update a cannabis banking assessment is the amount of federal activity underway. An April 2026 Department of Justice final rule placed FDA-approved drug products containing marijuana and marijuana subject to state-issued medical-marijuana licenses in Schedule III. The rule represents a significant change, but it is narrower than broad federal marijuana rescheduling. Adult-use marijuana and marijuana activity outside the medical rule remain in Schedule I, and federal registration and control requirements continue to apply.
The rule also provides that the Section 280E deduction disallowance will no longer apply to qualifying state medical-marijuana licensees. That matters because 280E has historically prevented many cannabis businesses from deducting ordinary business expenses, significantly increasing their effective tax burden. Depending on the structure and activities of an individual business, that change could improve cash flow and potentially affect credit analysis.
A separate federal proceeding addressing broader movement of marijuana from Schedule I to Schedule III remains underway. The bipartisan SAFE Banking Act of 2026 also remains pending in Congress with support from the American Bankers Association.
At the same time, hemp policy is moving in the opposite direction in some respects. Public Law 119-37 narrows the federal definition of hemp beginning November 12, 2026, unless Congress intervenes. ABA has noted that some CBD and hemp-derived products currently sold around the country may no longer fall within the federal definition. That matters beyond institutions with formal cannabis programs because businesses selling, distributing or providing services to hemp-derived product companies may already exist within an institution's commercial portfolio.
Together, these developments make 2026 one of the more consequential periods for cannabis banking policy in recent years and make older cannabis and hemp risk assessments increasingly likely to need an update.
The underlying cannabis market is different too
Policy is only one part of the reassessment. The market itself has changed substantially.
At the beginning of 2020, 11 states and the District of Columbia allowed adult-use cannabis. Today, the National Conference of State Legislatures counts 24 states, three territories and D.C. allowing or regulating nonmedical adult use, alongside medical-use programs in 41 states, three territories and D.C. Whitney Economics projects U.S. legal cannabis revenue of $30.5 billion in 2026, up an estimated 4.9 percent from 2025.
Yet maturation has also brought consolidation and uneven performance. CRB Monitor counted 38,509 active cannabis business licenses in the United States during the first quarter of 2025 after a 13 percent decline during the prior two years. Those trends can coexist: the industry can grow overall while weaker operators exit, licenses consolidate and larger or better-capitalized businesses capture a greater share of activity.
For banks and credit unions, that reinforces the need for disciplined account selection, strong local-market knowledge and appropriate underwriting rather than treating cannabis businesses as a single risk category.
Banking access still trails commercial activity
Despite the expansion of state markets, access to financial services remains uneven. The American Bankers Association states that many state-licensed cannabis businesses continue to transact in cash without traditional banking access.
The impact extends beyond plant-touching businesses. Cannabis revenue moves through commercial landlords, accounting firms, attorneys, contractors, security businesses, payroll providers, technology companies and numerous other service providers. As a result, cannabis exposure can already be present in an institution's commercial relationships even if the board has never approved a formal cannabis banking program.
A current risk review therefore should not address only whether an institution wants to bank licensed cannabis businesses. It should also ask where cannabis and hemp exposure already exists.
More institutions are gaining experience
The competitive landscape has also developed. The latest FinCEN data available, covering activity through December 2024 and released in 2025, identified 507 banks and 182 credit unions filing Marijuana Priority or Marijuana Limited SARs. Another 127 non-depository institutions were also filing these reports. SAR activity is not the same as operating a dedicated cannabis banking program, but it demonstrates that hundreds of financial institutions are already managing marijuana-related BSA obligations.
Those institutions accumulate knowledge with each account review, examination, regulatory interaction and operating cycle. They learn which business profiles fit their risk appetite, refine due diligence and monitoring processes, understand where staffing pressures develop and become more familiar with the operators, advisers and businesses participating in their local cannabis markets.
Commercial relationships can become increasingly durable as well. Operating deposits may lead to cash management, payments, payroll and treasury services, while credit can deepen the relationship further. For institutions managing concentration limits, loan participations can offer another way to support financing needs by allowing a bank or credit union to retain the lead relationship and a portion of the credit while sharing some exposure with another institution.
The build-versus-partner decision has changed
Several years ago, the operational requirements of cannabis banking often created a substantial barrier to entry. Institutions needed specialized workflows for onboarding, enhanced due diligence, licensing verification, source-of-funds review, transaction monitoring, document collection and regulatory reporting. They also needed employees with enough cannabis-specific knowledge to execute those activities consistently.
Those requirements have not gone away. The difference is that an institution no longer necessarily needs to build every capability itself. Banks and credit unions can now use specialized infrastructure for specific functions, supplement internal teams through a co-managed model or rely on outside resources for a greater portion of day-to-day program operations.
Safe Harbor Institutional provides cannabis-specific personnel, technology-enabled workflows and operating infrastructure designed for financial institutions entering, expanding or restructuring cannabis banking programs. Institutions can select individual capabilities, use a co-managed approach or choose a more comprehensive structure. The financial institution continues to own the customer or member relationship, account and risk decisions, its BSA/AML program, regulatory relationships and overall governance, while Safe Harbor supports or manages defined activities under institution-approved policies depending on the engagement.
Safe Harbor has supported financial institutions serving cannabis-related businesses since 2015 and has processed more than $36 billion through regulated cannabis banking programs across 41 states and territories.
Program economics should be reviewed along with compliance
Compliance is central to cannabis banking, but it is not the only variable that deserves reconsideration. Program economics matter as well.
A cannabis relationship can produce operating deposits while creating opportunities for cash management, payments, payroll, treasury services and lending. Those revenues need to be evaluated against the actual costs of onboarding, monitoring, reporting, examination support, technology and specialized personnel.
That calculation changes depending on the operating structure. A program that requires substantial fixed specialized headcount before reaching scale has a different economic profile from one that can use variable external capacity as account and deposit volume grows. Variable pricing models can allow portions of the cost structure to track more closely with the size of the program, which can be relevant both to institutions evaluating market entry and to established cannabis banking programs looking to improve efficiency.
Examination expectations are clearer than they once were
Institutions also have more public information available to inform their approach. State licensing and reporting databases provide useful due-diligence information in many jurisdictions, although their quality and accessibility vary significantly.
The Conference of State Bank Supervisors' March 2025 examiner job aid provides a public window into areas state examiners may assess, including board oversight, program capacity, customer review, cash handling, reporting and contingency planning. FinCEN's 2014 marijuana banking guidance continues to serve as its published BSA guidance for financial institutions serving marijuana-related businesses.
These resources do not remove the need for institution-specific legal, regulatory and risk analysis. They do provide more context around what an institution should be prepared to demonstrate.
For institutions that last evaluated cannabis banking several years ago, the question is not whether the risk has disappeared. It has not. The question is whether the assumptions, operating model and economics behind that earlier decision still hold.
In 2026, enough has changed in federal policy, market structure, institutional experience and available infrastructure to warrant a fresh review. For some institutions, the answer may still be no. But it should be a decision based on the market and risk environment that exists today.