SUBJECT MATTER OF PROPOSED REGULATIONS: Authorization and release of applicant information to financial institutions pursuant to Business and Professions Code (BPC) section 26260.
SECTIONS AFFECTED: Title 16, California Code of Regulations (CCR), sections 5037.1 and 5037.2.
Required Notice of Proposed Emergency Action
Government Code (Gov. Code) section 11346.1(a)(2) requires that, at least five working days prior to submission of the proposed emergency action to the Office of Administrative Law (OAL), the adopting agency provide a notice of the proposed emergency action to every person who has filed a request for notice of regulatory action with the agency. After submission of the proposed emergency to the OAL, the OAL shall allow interested persons five calendar days to submit comments on the proposed emergency regulations set forth in Gov. Code section 11349.6.
This document provides the required notice that the Bureau of Cannabis Control (Bureau) will submit a proposed emergency action to the OAL to implement allowance of cannabis businesses to permit licensing authorities to share licensee application and regulatory information, including track-and-trace data, with financial institutions as defined in BPC section 26260(c)(3). (Hereinafter any reference to financial institutions is as they are defined in BPC section 26260(c)(3)).
As required by subdivisions (a)(2) and (b)(2) of Gov. Code section 11346.1, this notice includes and incorporates the following: (1) the specific language of the proposed regulations and (2) the Finding of Emergency, including specific facts demonstrating the need for immediate action, the authority and reference citations, the informative digest and policy statement overview, and required determinations.
Specific Facts Demonstrating the Need for Immediate Action
On September 29, 2020, Governor Gavin Newsom signed California Assembly Bill 1525 by Assembly Member Jones-Sawyer. This chaptered bill, known as Information Sharing with Financial Institutions, AB 1525, (Jones-Sawyer, Chapter 270, Statutes of 2020), creates a safe harbor under state law for financial institutions and accountants that provide services to the cannabis industry. This also allows cannabis businesses to permit licensing authorities to share licensee application and regulatory information, including track-and-trace data, with financial institutions.
This law becomes effective January 1, 2021. Regulations are necessary to implement California AB 1525 consistent with Governor Gavin Newsom’s signing statement directing the cannabis licensing authorities to promulgate regulations necessary to implement the provisions in a manner that protects confidential and proprietary data. BPC section 26013 grants the Bureau the authority to adopt emergency regulations to implement the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) and deems such regulations as an emergency and necessary for the immediate preservation of public peace, health, safety, or general welfare.
Additionally, commercial cannabis businesses have difficulty obtaining traditional financial services; thus, requiring many of them to conduct business primarily on a cash basis, which is a public safety concern. Therefore, it is necessary to expediently create a process for providing licensee information to financial institutions to facilitate the provision of financial services to commercial cannabis licensees, while ensuring that the Bureau is only providing confidential information as authorized by the licensee.
Authority and Reference
The Bureau proposes adopting 16 CCR sections 5037.1 and 5037.2. BPC sections 26012, 26013, and 26260 authorize the Bureau to prescribe, adopt, and enforce the emergency regulations governing the information sharing with financial institutions. These emergency regulations will implement, interpret, make specific, or reference BPC section 26260.
Informative Digest
Existing Law
The Bureau gathers substantial information related to licensees, including application materials, licensee information, financial information, and regulatory information. Much of this information is protected from disclosure under the California Public Records Act (PRA), Information Practices Act, and other legal provisions, including the various statutes and regulations under which the Bureau operates. Therefore, this information is only provided in very specific circumstances. Newly added BPC section 26260 allows the sharing of this information with financial institutions, when authorized by the licensee.
Existing law requires the Department of Food and Agriculture (CDFA), in consultation with the Bureau, to establish a track-and-trace program for reporting the movement of cannabis and cannabis products throughout the distribution chain. Information received and contained in records kept by the Bureau or licensing authorities pursuant to the track-and-trace program are confidential and exempt from disclosure pursuant to the PRA, except as necessary for authorized employees of the State of California or any city, county, or city and county, to perform official duties pursuant to MAUCRSA or a local ordinance.
Further, upon the request of a state or local law enforcement agency, licensing authorities shall allow access to or provide information contained within the database to assist law enforcement in their duties and responsibilities.
Policy Statement
Regulation Objectives
The Bureau has developed this emergency regulation to further clarify or make specific sections of MAUCRSA pertaining to information sharing with financial institutions. The regulations will:
- Address the obligation of the Bureau to allow information sharing with financial institutions, including information that is otherwise not subject to public disclosure.
- Establish a regulatory process for licensees to request and permit the licensing authorities to share financial information with their financial institution(s).
- Establish a regulatory process for financial institutions to request and permit licensing authorities to share financial information of a licensee for the purposes of facilitating the provision of financial services.
- Establish a regulatory process for licensees to withdraw a request for sharing licensee financial information at any time.
Anticipated Benefits to the Public
Providing a safe harbor, under state law, for financial institutions and accountants will allow more banks to conduct cannabis related business. For example, financial institutions may be more likely to grant capital for business development (loans, lines of credit, etc.) for cannabis entrepreneurs. This will expand the limited funding for cannabis entrepreneurs, whereas individuals currently rely upon their own funding and/or investors, limiting the cannabis industry’s ability to expand. Secondly, normalizing access to banking services for cannabis entrepreneurs will help ensure that financial institutions and accountants, as well as cannabis producers, distributers, retailers, and other licensees, are in compliance with the state’s laws, thus removing the threat of criminal penalties that previously existed. This could have a positive impact on the industry and lead to more stable business decisions.
This law, and in turn the proposed implementing regulations, could positively magnify California’s economy with the removed threat of criminal penalties for financial institutions and accountants, the availability of capital for cannabis entrepreneurs, and cannabis operations being able to become transparent regulated tax-paying businesses.
Additionally, access to banking is important for worker safety, as it eliminates a cannabis business’ need to maintain a large amount of cash, on its premises, which can make the business a target for criminal activity. This is particularly important for retailers that are open to the public.
Add 16 CCR 5037.1. Licensee Request to Release Data to Financial Institutions
The Bureau proposes adopting 16 CCR 5037.1, which provides the process for which a licensee may authorize the Bureau to provide information to a financial institution for purposes of facilitating the provision of financial services, which designated information the Bureau will release, what information the Bureau will not release, and how a licensee may withdraw the authorization for the release of information. It is necessary to specify the process for which a licensee may authorize release of designated information regarding the licensee from the Bureau to a financial institution pursuant to BPC section 26260. Such information may be confidential and not subject to public disclosure; thus it is necessary for the Bureau to provide a licensee with the ability to designate the specific information the licensee is authorizing for release, and the specific financial institution(s) they are authorizing to receive the information. It is also necessary to establish a process that allows the withdrawal of the authorization to ensure that licensees may control when and how their confidential information is released to financial institutions. Lastly, this regulation is necessary to ensure that the Bureau releases only the specific information that is authorized by the licensee to the specific financial institution(s).
Proposed subdivision (a) provides that a licensee may authorize the Bureau to provide a financial institution with specified information of the licensee and that the authorization requires the licensee make the authorization, in writing, on a form prescribed by the Bureau. This is necessary so that the Bureau has an accurate record of the authorization. The form is necessary to ensure that the authorization has all of the components necessary for the Bureau to provide the information. Proposed subdivision (a) also requires the authorization contains the following information:
(1) The name of the licensed business for which the licensee is authorizing the release of information;
(2) The business’s license number(s);
(3) The financial institution authorized to receive information;
(4) The name, phone number, email address, and signature of the owner submitting the authorization;
(5) The categories of information authorized for release; and
(6) An acknowledgement that the authorization to release information includes information that is otherwise protected from disclosure, and waiving privilege and confidentiality is strictly for purposes of disclosure to the financial institution.
The name of the licensed business and license number are necessary for the Bureau to identify proper licensee and ensure an accurate record of the authorization to release confidential information. Identification of the financial institution is necessary to ensure the confidential information is only released to the correct institution and that there is an accurate record of the authorization to release information. The name, contact information, and signature of the owner authorizing the release of confidential information is so the Bureau may confirm this is a proper person to make the authorization, contact the owner if necessary, and ensure there is an accurate record of the authorization to release information.
The identification of categories of information authorized for release is necessary because BPC section 26260 allows for the release of confidential information and this provision will allow the person to whom the information pertains to control what confidential information is provided. Additionally, the acknowledgement is necessary to ensure the person understanding that they are waiving confidentiality and privilege for this information for purposes of the financial institution.
Proposed subdivision (b) provides that after receiving the authorization, the Bureau will release the information designated by the licensee. The information includes:
(1) The license application(s), including renewal applications, excluding information required to be kept confidential pursuant to Penal Code section 11105 and confidential personal information of individual owners of the licensed business;
(2) Information captured in the track-and-trace system established pursuant to BPC section 26067, including, but not limited to, aggregated sales or transfer information, as applicable;
(3) Documents issued to the licensee pursuant to disciplinary or enforcement proceedings.
Including applications in the information available for financial institutions is necessary as this information is included in the statute, and specifically referring to renewal applications provides clarity as to the applications available. Additionally, it is necessary to clarify that criminal history information and personal information about owners that are otherwise protected by law cannot be provided. Additionally, including track and trace information is necessary because it is also referenced in the statute as information available to be released, and the type of financial information contained in the system has been included for clarity. Further, regulatory documents are also referenced in the statute and it is necessary to clarify the documents the Bureau will provide.
Documents issued to the licensee pursuant to disciplinary action or enforcement proceedings are also identified as available to be provided, if authorized, because a formal determination has been made and these records are issued to the licensee, unlike pending investigations for which no determination of the licensee’s conduct has been made.
Proposed subdivision (c) of the regulation specifies that the licensee may withdraw the authorization, at any time, and that the request must be made in writing. Subdivision (c) also lists the information that must be included in the waiver:
(1) The name of the licensed business for which the licensee is withdrawing the authorization of the release of information;
(2) The business’s license number(s);
(3) The financial institution from which authorization to receive information is withdrawn; and
(4) The name, phone number, email address, and signature of the owner submitting the withdrawal.
This provision is necessary as the statute allows for the licensee to withdraw the authorization and control whether further information is provided to the financial institution. It is necessary for the withdrawal to be in writing, so that the Bureau has an accurate record of the withdrawal of authorization. The name of the business and the business’ license number is necessary to ensure the Bureau identifies the correct licensee and has an accurate record of the withdrawal. Identification of the financial institution is necessary for the Bureau to ensure information is not improperly withdrawn from an incorrect institution. Additionally, the name, contact information, and signature of the owner executing the withdrawal is necessary to ensure that it is the proper person making the request to withdrawal authorization, ensure an accurate record of the withdrawal, and to reach the owner with any questions.
16 CCR 5037.2. Financial Institutions Request for Licensee Information
The Bureau proposes adopting 16 CCR 5037.2, which provides a financial institution, as defined in BPC section 26260(c)(3), may request information from the Bureau related to a licensee for purposes of facilitating the provision of financial services to that licensee. The proposed regulation specifies the identifying information the financial institution is required to provide to request information, which information the financial institution is requesting, and the licensee for which they are requesting information on.
The financial institution is also required to identify the service for which they are requesting the information. The proposed regulation is necessary to specify how a financial institution can request and receive the information regarding a licensee that the licensee has authorized the Bureau to release to a financial institution. The proposed regulation is also necessary to ensure that information released, pursuant to a request from a financial institution, is being shared consistent with BPC 26260(e), which specifies that a financial institution may receive this information only for purposes of facilitating financial services to the licensee making the request.
The proposed regulation requires the request be on a form promulgated by the Bureau and include:
(a) The name of the financial institution;
(b) The name, phone number, email, and signature of the representative of the financial institution requesting information;
(c) The business name and license number of the licensee for which the financial institution is requesting information;
(d) The type of financial services for which the information is requested (including, but not limited to, establishment or maintenance of bank accounts, extending loans, and providing insurance) and whether the request is for consideration of a new service or maintenance of an existing service;
(e) The specific information requested as described in Section 5037.1 if authorized by the licensee; and
(f) An acknowledgment that use of the information is limited to that which is necessary for the provision of financial services.
It is also necessary to require the request be made, in writing, to ensure the Bureau has an accurate record of the request, and that it be on a form prescribed by the Bureau to ensure all necessary components are included. It is necessary to have the name of the financial institution to ensure there is an accurate record of the request and that the authorization is for that particular financial institution. The name and contact information for the financial institution is necessary in case the Bureau needs to reach the person that is processing the request for information. The name and license number of the licensee for which the information is requested is necessary so that the Bureau can ensure it releases information on the appropriate licensee.
The type of financial services, including whether the services are new or are continuing, are necessary to ensure the Bureau is complying with the statute that allows the release only for purposes of facilitating financial services. It is also necessary to require the financial institution to identify the specific information requested, as the financial institution may not need all of the categories of information that can be provided, especially if there are multiple requests at different times. This ensures that the Bureau is efficiently utilizing resources by gathering, preparing, and provided what is needed, as well as authorized. Additionally, it is necessary to require an acknowledgment that the information may only be utilized for the provision of financial institutions to ensure that the receiver is aware of this restriction and provide only that information which is necessary for the provision of financial services, as contained in statute.
Inconsistency with Federal Regulation Statute
The United States Drug Enforcement Administration (DEA) under the Controlled Substances Act lists cannabis as a Schedule 1 Drug. This means that commercial cannabis activity us illegal under federal law. However, California, through the MAUCRSA and other laws, has decriminalized the cultivation, sale, and possession of cannabis goods for persons aged 21 or older and for medicinal patients.
Consistency with Existing State Regulations
As required by Gov. Code section 11346.5(a)(3)(D), the Bureau has conducted an evaluation of these emergency regulations and has determined that they are not inconsistent or incompatible with existing regulations.
Plain English Requirement
Bureau staff prepared these emergency regulations pursuant to the standard of clarity provided in Gov. Code section 11349 and the plain English requirements of Gov. Code sections 11342.580 and 11346.2, subdivision (a)(1). The emergency regulations are written to be easily understood by the persons that will use them.
DISCLOSURES REGARDING THE PROPOSED ACTION
The Bureau has made the following initial determinations:
Local mandate: There will be no local mandate.
Cost to any local agency or school district requiring reimbursement pursuant to Gov. Code section 17500, et seq: None.
Any other non-discretionary cost or savings imposed upon local agencies: None.
Cost or savings to any state agency: The Bureau’s staff workload associated with the additional operational activities created by these regulations can be absorbed by existing staff.
Any costs or savings in federal funding to the state: None.
ECONOMIC IMPACT AND FISCAL IMPACTS
Business Impact
The Bureau of Cannabis Control (Bureau) currently has 2,564 licensees. The businesses impacted by the regulation are licensed commercial cannabis businesses including distributors, retailers, testing laboratories, event organizers, and microbusinesses.
Estimated Costs to Businesses
The proposed regulation requires licensees to complete and submit a form prescribed by the Bureau to request and permit the sharing of their financial information by the Bureau with licensees’ financial institution(s). If the form is submitted electronically, the Bureau has determined that licensees will be able to complete and submit the form electronically in a few minutes. As a result, no additional costs are anticipated. If the form is submitted by mail, licensees will still be able to complete the form in a few minutes, which is not anticipated to increase costs, but licensees will incur mail postage costs ranging from $0.55 (first class) to $3.55 (certified) per licensee. To the extent all 2,564 licensees opt to submit the form, the total economic impact would range from $1,410 (first class) to $9,102 (certified). However, based on current submission methods to the Bureau, it is anticipated that most licensees will utilize electronic submission.
Estimated Benefits of Regulation
AB 1525 specifies that a licensee may authorize a financial institution to receive specific information from the state licensing authorities. The Bureau anticipates that this sharing of data will increase the number of financial institutions willing to provide banking services to cannabis businesses. Access to banking is important for worker safety as it eliminates a cannabis business’ need to maintain a large amount of cash on the premises that can make the business a target for criminal activity.
Fiscal Effect on State Government
Although the proposed regulations will create a new workload process, there will not be additional costs to the Bureau’s operations. The proposed regulations would require Bureau staff to process requests submitted by licensees and financial institutions for licensee financial information. This includes verifying requesting entities are financial institutions, reviewing and analyzing application, license, and enforcement documents from the Bureau’s cannabis licensing system to determine disclosable information, redacting protected information, and preparing disclosable information for release to financial institutions.
The initial workload is expected to be 1 hour to compile application materials and redact per applicant. 15 minutes for verification of financial institutions per applicant. Based on the current number of licensees (2,564) and the expectation that approximately 50% will request to have their application materials shared with a financial institution, the total number of hours per year to complete the workload is 1,603 hours, or less than one PY.
The expected position level to complete the tasks is staff service analyst, which would result in costs of approximately $97,000. The Bureau has not requested staff for the workload because the Bureau intends to incorporate the tasks associated with the AB 1525 workload into the licensing process. This will increase efficiency and greatly reduce the workload associated with AB 1525. Until the process is developed into the licensing process, the Bureau’s analyst staff that are currently responsible for responding to requests under the Public Records Act will be absorbing the additional workload created by AB 1525.
CONSIDERATION OF ALTERNATIVES
No reasonable alternative to the regulatory proposal would be either more effective in carrying out the purpose for which the action is proposed or would be as effective or less burdensome to affected private persons and equally effective in achieving the purposes of the regulation in a manner that ensures full compliance with the law being implemented or made specific.
Set forth below are the alternatives which were considered and the reasons each alternative was rejected:
- Option 1: Not adopt the regulations. This alternative was rejected because AB 1525, as codified in BPC section 26260, requires the Bureau to provide information to financial institutions when authorized by the licensee. If the Bureau does not adopt regulations, there will be no specific process for licensees and financial institutions to follow to have the information disclosed.
- Option 2: Do not require a written request or waiver from a licensee. This alternative was rejected because AB 1525, as codified in BPC section 26260, requires that all requests and waivers for release of licensee information be submitted to the licensing authorities in writing. To ensure that the Bureau has appropriate authorization to disclose the information to particular financial institutions, it is necessary to adopt these regulations requiring written authorization. These regulations are also necessary to ensure accurate recordkeeping of each request received by the Bureau.
TECHNICAL, THEORETICAL, AND/OR EMPIRICAL STUDY, REPORTS, OR DOCUMENTS RELIED UPON
None.
