Let’s not sugarcoat this.
Cannabis didn’t become legal. It didn’t suddenly become simple. And it didn’t become “just another industry.” What happened is more consequential than that. Cannabis, at least part of it, is now being pulled into the federal controlled substance system.
In April 2026, the Department of Justice, through the Drug Enforcement Administration, issued a final rule that treats state-licensed medical cannabis and certain FDA-approved cannabis products as Schedule III under the Controlled Substances Act. Everything else remains Schedule I and federally illegal. Both of those conditions exist at the same time.
This change applies to medical cannabis. Adult-use remains on a separate path for now, with different federal treatment still in place and ongoing policy discussions expected... so stay tuned.
Around the same time, the DEA launched a Medical Marijuana Dispensary Registration Portal. It is live. State-licensed medical cannabis operators can now apply for federal registration as controlled substance handlers.
This does not replace state licensing. It does not legalize cannabis at the federal level. It creates a pathway to operate within a federal framework that has long existed for other controlled substances. That framework is built on registration, reporting, and oversight. It is the system used for pharmaceuticals and other tightly regulated products. Cannabis is now entering that structure in a limited but meaningful way.
There is also a fee. Operators applying through the DEA portal must pay a $794 annual application fee. DEA instructions currently list ACH and PayPal as available payment methods.
The PayPal detail matters. PayPal’s Acceptable Use Policy states that its service may not be used for activities that involve certain “controlled substances.” Yikes!
Operators deal with accounts getting flagged, restricted, or closed, and providers stepping back from the category. Even fully licensed businesses still face issues accessing basic financial tools and payment solutions, yet those same rails now sit inside a federal process for the very same activity. Those same operators are now being asked to register with the federal government and, in some cases, use payment methods that have historically treated their businesses as restricted. It shows how uneven, and still unfinished, this transition is.
This does not mean PayPal, Venmo, Visa, Mastercard, or other mainstream payment systems are now open to medical cannabis. A DEA registration pathway does not change private network rules or risk policies overnight. It does not resolve the underlying tension between federal law, state law, and financial regulation.
For operators, the move toward Schedule III treatment introduces both opportunity and responsibility. There is potential relief from Section 280E for qualifying activity, along with a clearer path to federal recognition. At the same time, federal registration brings expectations around documentation, reporting, inventory tracking, and audit readiness.
Cannabis operators are not starting from scratch. The industry already operates under significant state-level compliance. The difference is that federal requirements may layer on top of an already complex framework.
It is not yet clear whether this simplifies operations or adds another layer. More likely, it introduces additional structure, with federal and state requirements sitting side by side. Some operators are already equipped for that. Others have built around fragmented systems and workarounds developed over years of operating in a gray area.
For banks and financial institutions, cannabis has been difficult to support because it has been hard to justify under federal law. A framework that includes federal registration and defined oversight provides something more concrete to evaluate. It does not remove risk, but it changes how that risk can be understood and managed.
This does not open banking overnight. It does not remove political sensitivity or operational complexity. What it does is begin to establish a foundation that financial institutions can assess with more clarity.
For years, cannabis has operated in a space defined by uncertainty. That is starting to shift toward a more formal, more documented model that looks closer to other regulated industries. It may get clearer, but it is unlikely to get simpler.
This is where Safe Harbor fits. We have spent years working between cannabis operators, financial institutions, and evolving regulatory expectations. As federal involvement increases, the need for structure, consistency, and translation between those groups becomes more important.
Cannabis did not become legal. It is being integrated, in part, into a federal system that defines how controlled substances are handled. That shift has implications for operators, for banks, and for how the industry develops from here.
If you are an operator, this is a moment to take a close look at how your business is structured and how prepared it is for a more formal compliance environment. If you are a financial institution, it is a moment to reassess how you view the category and whether the emerging framework changes your position.
Legal Disclaimer: This content is for informational purposes only and does not constitute legal, tax, or regulatory advice. Cannabis laws and regulations are evolving rapidly and vary by jurisdiction. Operators and financial institutions should consult qualified legal, tax, and compliance professionals before making decisions based on the topics discussed.