They write in their press release….. The NACB is proud to announce the adoption of its National Standards on Security. In the cannabis industry, the vast majority of cash and product diversion is caused by internal actors. Though state regulations have comprehensive technical requirements for video and alarm systems, they lack strong requirements for policies and procedures that limit attempts by employees, visitors and customers to divert product or cash as well as those that try to surpass legal purchase limitations (otherwise known as looping). The NACB Security Standards are designed to protect consumers and demonstrate to regulators and the public that NACB members operate at the highest levels of ethics and responsibility, especially when it comes to the safety and quality of their products.
This is the fourth set of National Standards adopted by the NACB, adding to standards relating to Advertising, Packaging and Labeling and Product Integrity. To create each set of standards, the NACB takes input from their members along with government and subject matter experts, in addition to referring to other highly regulated industries. Once drafted and approved by members, the NACB receives feedback that is discussed and considered. After that, the Standard may be revised and finally voted on and adopted by NACB members.
The National Standards on Security are available here. They include:
- Employee and Visitor Access Control
- Customer Access Control
- Cash Management
- Looping (attempting to exceed legal purchase limitations) and Loitering
Definitions
- “Customer” means any individual within a Retail Area or seeking entry into a Retail Area who is not a state-licensed owner of the Cannabis Establishment, state-licensed employee of the Cannabis Establishment, or government official on premises for an official purpose.
- “Limited Access Area” means any area on the premises of a Cannabis Establishment that is not open to the public.
- “Looping” means any method by which a customer attempts to surpass their legally-set purchase limitations, most commonly by returning multiple times per day to the same establishment.
- “Personal Health Information” means information, such as prescriptions, medical records, or insurance information that identifies an individual and is used to determine appropriate health care.
- “Personal Information” means any non-public information collected by a Cannabis Establishment that directly identifies an individual, including their name, address, email, phone number, payment card number, social security number or other identifying number or code.
- “Retail Area” means the area within a retail Cannabis Establishment that is open to the public and where cannabis is displayed and/or transferred.
- “Visitor” means any individual within a Limited Access Area who is not a state-licensed owner of the Cannabis Establishment, state-licensed employee of the Cannabis Establishment, or government official on premises for an official purpose.
Standard 5.01. Employee and Visitor Access Control
- A Cannabis Establishment shall conduct initial and annual assessments of the minimum number of persons required to have access to each Limited Access Area (“LAA”) for efficient operation of the Cannabis Establishment, and only provide access to that minimum number of persons for each LAA; any increase in the number of persons with access to a given LAA shall require an additional assessment.
- All visitors to the LAA shall be required to:
1) receive permission from an owner or manager of the cannabis establishment prior to entry to a LAA;
2) sign the premise’s visitor log;
3) present a government-issued photo ID, which shall be compared to the name given in the visitor’s log;
4) be accompanied at all times while in the LAA by an employee of the cannabis establishment, who shall not have more than five visitors accompanying him or her at any given time.
A) A. State-approved vendors whose contracts with a Cannabis Establishment require regular access to a LAA shall be exempt from the requirements of Standard 5.01(b)(4). - All doors and windows providing entry to or exit from an LAA shall always be closed and locked when not in immediate use or such frequent use as to render locking between uses impracticable.
- All keys and/or access credentials shall be kept in the possession of the designated persons with access to that area or secured in such a manner as to prevent procurement by non-designated persons
- If any of a cannabis establishment’s facilities has more than 20 persons with access to its LAA(s), such facilities shall utilize an electronic access control system, and either:
1) All persons with LAA access shall be provided with access credentials, such as keycards or access codes, and be required to use such credentials to access a LAA, or
2) Certain persons with LAA access shall be provided with access credentials and shall be required to use such credentials to access a LAA.
A) Such persons will be held responsible for supervising any other person that they provide with access to a LAA.
Standard 5.02. Customer Access Control
- A retail Cannabis Establishment shall conduct initial and annual assessments to determine the maximum number of Customers and maximum ratio of Customers to employees that will be allowed within a Retail Area at any given time.
1) These assessments shall be based upon the size and layout of the Retail Area, and upon security considerations such as whether emergency response procedures would be less effective with higher numbers of Customers.
2) Under no circumstances shall the ratio of Customers to employees present in a Retail Area exceed 10-to-1. - If the maximum allowed ratio of Customers to employees present in the Retail Area exceeds 5-to-1, then prior to entry, each Customer must present identification and be evaluated by an employee, who must make the following findings prior to allowing a Customer entry to the Retail Area:
1) The Customer’s identification is valid and unexpired.
2) The Customer is not visibly belligerent or otherwise presenting a safety threat.
3) Entry of the Customer would not cause the maximum number of Customers allowed within the establishment to be exceeded.
4) Entry of the customer would not cause the maximum ratio of Customers to Employees allowed within the establishment to be exceeded. - If the maximum allowed ratio of Customers to employees in the Retail Area does not exceed 5-to-1:
1) The evaluations listed in Standard 5.02(b)(1-2) may be made after entry, but prior to purchase, however the Customer shall be asked to leave immediately once a negative determination has been made.
2) Once the Retail Area is approaching the maximum number of Customers or ratio of Customers to employees, additional Customers shall be prevented from entering until sufficient Customers have left the Retail Area. - The Cannabis Establishment shall have sufficient staffing, appropriate training, and appropriate technology to implement the above standards. Customers who are denied entry or who are asked to leave the premises shall be dealt with lawfully and with concern for the safety of all Customers and other individuals in the area.
Standard 5.03. Cash Management
- A Cannabis Establishment shall conduct initial and annual assessments to identify cash management risks and determine which controls will be implemented to safeguard cash during each transaction, from its receipt to deposit or disbursal.
1) Specific procedures for a Cannabis Establishment are to be designed to enable the organization to track cash through each transaction and movement of cash. The specific procedures will vary depending on the type, size of the organization as well as the level of technology used by the organization to record financial activities. It will be important that an organization is able to be able to track cash through the entire operation and be able to easily to determine the employees that were involved at each step of the process. Senior management of the Cannabis Establishment should be involved (at some level) in the review of cash controls regardless of the size of the organization.
2) Such controls will be described in the Cannabis Establishment’s policies and procedures and enforced through disciplinary measures and regular audits.
3) Annual review of cash controls should be conducted to identify organizational changes that would cause the current cash procedures to be less effective.
4) Employee training should be a key part of the process so that each employee in the organization has a clear understanding of their responsibility related to the handling of cash. - When selecting which controls to utilize, a Cannabis Establishment shall endeavor to segregate the performance of the duties of receiving, depositing, recording, and reconciling cash among multiple individuals for each transaction.
1) Procedures should include the development of documents, spreadsheets or Point of Sale (POS) systems prepared contemporaneously that identify all cash activity (receipts, deposits, and disbursements that will management to go back review individual daily activity. Reconciliations of these documents and spreadsheets to cash should be performed weekly by individuals who were not involved in the initial preparation
2) If such a segregation of duties is impractical or unfeasible, alternative controls such as a periodic review of POS video recordings shall be implemented to mitigate the additional risk. - A Cannabis Establishment that utilizes a register at the POS shall conduct an initial and annual assessment to determine the maximum amount of cash that should be allowed in a register at any given time. When a register accrues more than that maximum amount in cash, a cash-drop shall promptly occur.
- All cash receipts should be recorded in total and should not be used for the payment of other types of disbursements. Preparation of a record that shows all cash receipts and a separate record that identifies cash that has been disbursed and the purpose of the disbursement.
- Cannabis products should never be used to replace cash payments. (i.e. employees receive cannabis products in lieu of cash payment for hours worked.
- All cash at a Cannabis Establishment’s licensed premised that is not in a register at the POS shall be kept in a safe while on the Cannabis Establishment’s premises.
- Access to the cash register(s) and to the safe(s) shall be limited to the minimum number of persons required for efficient operation of the cannabis establishment, that determination to be made at least annually.
- Cash collections must be reconciled daily to the POS system to ensure the completeness of receipts.
Standard 5.04. Contaminant Testing and Claims.
- Retail cannabis establishments and their employees shall not knowingly transfer cannabis or cannabis products to a Customer if it would cause the Customer to exceed state-imposed quantity limits, whether stated explicitly in the regulations for cannabis establishments, or implied by personal possession limits contained in other state laws or regulations
- Retail cannabis establishments must implement a looping prevention program, which shall include:
1) employee training;
2) written procedures requiring employees to monitor and track customers who transact more than once daily to assure they are not exceeding their personal limit;
3) progressive punishment for employees that repeatedly fail to adhere to the procedures in Standard 5.06(b)(2); and
4) enforced suspensions or bans for customers who continue looping despite warnings. - An individual who is not affiliated with the cannabis establishment and who is not actively engaged in a commercial activity contemplated and allowed by the state’s cannabis authority, shall not be allowed to remain on the premises, whether in a Retail Area or the exterior, for longer than 30 minutes.
1) For the purposes of Standard 5.04(c), commercial activity shall be deemed to include attendance at educational or other events held at the Cannabis Establishment for the benefit of the Cannabis Establishment’s customers and/or host community.
