Local & State Regulations

Licensees must comply with both local and state cannabis regulations and must recognize that some local jurisdictions may not allow commercial cannabis activity within their borders. Prop. 64 grants broad authority to local government to regulate cannabis within its jurisdiction, including the discretion to prohibit commercial cannabis activity altogether or to only allow certain license types.

While a consolidation is planned for July 2021, three separate state agencies currently regulate and license cannabis companies in California:

1. Bureau of Cannabis Control (“BCC”)
2. Department of Food and Agriculture (“CDFA”)
3. Department of Public Health (“CDPH”)

State Regulations

Bureau of Cannabis Control Regulations

Department of Food and Agriculture Regulations

Department of Public Health Regulations

Definitions

“Cannabis”

The terms “cannabis” and “cannabis law” are ambiguous without reference to Delta-9 Tetrahydrocannabinol (“THC”) concentration. Federal law distinguishes between two varietals of the Cannabis Sativa L. plant: “Hemp” and “Marihuana”:

Cannabis with less than 0.3% THC is considered “Hemp,” and cannabis with greater than 0.3% THC is considered “Marihuana.”

California law substitutes the term “Cannabis” for “Marihuana,” but distinguishes between “Cannabis” and “Hemp” based on the same 0.3% THC benchmark utilized by federal law. This guide also uses the term “cannabis” rather than “marijuana” or “marihuana” due to the history and origin of the latter terms. Practically speaking, if you hear the term “cannabis” in everyday conversation, the speaker is likely referring to cannabis with greater than 0.3% THC. If you hear the term

“Cannabidiol” aka “CBD”

In the same way amino acids act as the “building blocks” of protein, cannabinoids are a key component of the cannabis plant. Cannabidiol (“CBD”) is one of many cannabinoids found in the cannabis plant and can be extracted from the plant via manufacturing techniques and incorporated into various products.

The term “CBD” without reference to its source is also ambiguous CBD can be extracted from both Hemp and Cannabis. This is significant for two reasons:

1. Many states, including California, do not allow hemp or hemp-derived products to enter the Cannabis supply chain (i.e. hemp-derived CBD products cannot be sold Cannabis dispensaries.
2. Cannabis-derived CBD products remain illegal under federal law.    

The Farm Bill did not legalize hemp-derived CBD products, and 15 companies just learned that the hard way by receiving warning letters from the FDA. Rather, the Farm Bill expressly reserved authority to the FDA to regulate certain manufactured hemp products (including many CBD products). Marijuana-derived CBD products, on the other hand, remain illegal under federal law. They are regulated by both state and local government in states that have legalized manufactured marijuana products.

Despite marijuana (cannabis with greater than 0.3% Delta-9 THC) being illegal under federal law, states across the United States have decriminalized and/or legalized marijuana for commercial use.

Despite marijuana (cannabis with greater than 0.3% Delta-9 THC) being illegal under federal law, states across the United States have decriminalized and/or legalized marijuana for commercial use.

In the commercial context, state marijuana laws typically also empower local governmentsto establish and enforce marijuana regulations in their jurisdiction within the parameters set by state law. Even if marijuana is legal at the state level, therefore, a local government may not allow commercial marijuana activity at all, or may only allow certain types of commercial marijuana activity (i.e. only allow certain license types to operate). For more information about licensing at the state and local level, check out our licensing course here.

“Hemp”

“Hemp” is defined by federal law as having less than .3% Delta-9 THC, whereas “marijuana” is defined as having higher concentrations of Delta-9 THC.

Because marijuana is a Schedule I drug under the Controlled Substances Act (“CSA”), CBD extracted from Marijuana remains illegal under federal law. Conversely, the 2018 Farm Bill removed Hemp from the CSA which theoretically opened the door to legal CBD products so long as they are derived from hemp.

Expanding the Definition of Compliance

“Compliance” is a cannabis industry buzzword, and rightfully so given how heavily regulated the industry is across the United States. When business owners and ancillary service providers hear the term, however, their focus typically zeros in on the state and local cannabis regulations that govern a given license type. However, a singular focus on state and local cannabis regulations is recipe for disaster.

Focusing only on state and local cannabis regulations ignores potential local, state, and federal law that may apply to a cannabis business. Many state and local cannabis regulations either fail to mention relevant sources of outside law entirely or make cursory mention of them. For example, California cannabis regulations require licensees to complete a Cal-OSHA 30-hour general industry outreach course but do not otherwise require licensees to comply with Cal-OSHA regulations. Similarly, the California Department of Public Health merely mentions Proposition 65 Warning compliance on labeling checklists and a link to the California Office of Environmental Health Hazard Assessment rather than detailing comprehensive regulations for licensees to follow.

The above examples are not presented as a criticism of the cannabis regulatory agencies in California, or any other state agencies that regulate cannabis. Local, state, and federal law outside of cannabis-specific regulations are often independently regulated and enforced, thereby limiting the information that state and local cannabis regulatory bodies can provide. Rather, the examples are presented as a warning to businesses and service providers alike:

Do not stop at your state and local cannabis regulations when developing a compliance program.

The Current State of Cannabis Law

Now that we are on the same page that we have to consider law outside of state and local cannabis regulations, let’s now establish a baseline understanding of cannabis law at the federal, state, and local level(s). At the federal level, “marihuana” is found on Schedule One of the Controlled Substances Act (“CSA”) and is defined as “all parts of the plant Cannabis sativa L., whether growing or not; the seeds thereof; the resin extracted from any part of such plant; and every compound, manufacture, salt, derivative, mixture, or preparation of such plant, its seeds or resin[RK1] .” In addition to excluding specific parts of the Cannabis sativa L. plant, (stalks, seed oil, etc.), the definition of “marihuana” explicitly excludes hemp[RK2] .

If hemp is excluded from the definition of “marihuana,” then what is the difference between the two? In answering this question it’s important to remember that we are talking about varietals of the same cannabis plant. The distinction between the two varietals, therefore, is more of a legal distinction than a biological one. Hemp was removed from the CSA altogether by the 2018 Farm Bill, and is defined similarly to “marihuana,” except hemp is limited to containing 0.3% Delta-9 Tetrahydrocannabinol (“THC”).  The legal distinction between “marihuana” and hemp, therefore, comes down to whether or not a given cannabis plant has more than 0.3% Delta-9 THC.[RK3]  If a cannabis plant has more than 0.3% Delta-9 THC, it is considered “marihuana” by the federal government. Less than or equal to 0.3% Delta-9 THC, and it’s considered hemp.

State and Local Cannabis Law

States and local governments across the United States have legalized cannabis. While each state that has promulgated its own unique cannabis regulations, there are more similarities than differences from state to state. State legalization regulations typically establish a commercial market that utilizes a dual licensing structure that requires an entrepreneur to obtain state and local approval prior to opening their business. Moreover, local government typically has the option to “opt-in” or “opt-out” when it comes to allowing commercial cannabis activity in its jurisdiction.

State law similarly distinguishes between “marihuana” (however, the term “marijuana” or “cannabis” is typically used by state and local regulators) and hemp but THC percentage, and establishes two separate regulatory and licensing scheme(s) for the two varietals of the cannabis plant. Whether an entrepreneur is able to sell both “marihuana” and hemp products in a retail store or otherwise operate in both industries concurrently, depends on the jurisdiction finds itself in. For example, cannabis dispensaries are currently prohibited from selling hemp products in California. Conversely[RK4] , 

Conflict between Federal and State/Local Law

Confusion tends to set in when entrepreneurs realize that federal and state/local cannabis law conflict. Who “wins” when federal and state/local cannabis law conflicts? The Supremacy Clause of the U.S. Constitution provides the general rule of thumb:

If federal law conflicts with state/local law, federal law “wins.”

Put another way, if federal cannabis law conflicts with state/local cannabis law, federal cannabis law preempts state/local cannabis law[RK5] . Since “marihuana” is “illegal” under federal law, and federal law preempts conflicting state/local, isn’t “marihuana” still illegal in state/local jurisdictions that have legalized?

The answer?  Technically, yes.  State and local governments across the United States have not been able to “legalize” cannabis because of any clever legal theory or loophole.  Instead, cannabis has been “legalized” without federal interference due to protections included by Congress in Spending Bills which currently protect States with medical cannabis programs (proposals to extend this protection to adult-use cannabis programs have also been introduced[RK6] ), as well as numerous political and logistical roadblocks that the Federal Government would face if it chose to enforce the CSA. Specifically, the federal government likely does not have the resources to enforce the CSA without state and/or local cooperation.

Alas, we arrive at an ironic realization when it comes to discussing expanding our definition of “compliance”:

A business that enters the cannabis industry is violating federal law even if it maintains strict compliance with state and local regulations. Therefore, there is arguably no such thing as a “compliant” cannabis business.

The above statement may sound like semantics, but entrepreneurs must understand and appreciate the risk assumed by entering the cannabis industry. While strict compliance with state and local law is the best safeguard against federal enforcement, there is no such thing a complete safeguard against federal enforcement so long as “marihuana” remains a Schedule One drugs under the CSA.

Now that we have a bit of context, let’s shift gears and talk about the areas of law that entrepreneurs should focus on complying with. Cannabis regulations often fail to mention federal, state, and local law that may impact a business. To define “compliance” in the cannabis industry, therefore, we must identify and define the sources of law cannabis businesses most comply with. While it’s impossible to provide a definitive list of cannabis compliance considerations that typically fall outside of state and local cannabis regulations, here are five areas to think about:

1. Federal Trade Commission (“FTC”) Act

Any cannabis business working with celebrities or influencers should look into FTC requirements. Businesses should similarly consider similar state consumer protection laws.

• Telephone Consumer Protection Act (“TCPA”)

Planning to use texting as a marketing channel? Check out the TCPA before you do.

• Health and Safety Regulations

Look into state and federal OSHA requirements, and make sure your business has all required plans (Injury and Illness Prevention Plan, Fire Prevention Plan, etc.) in place, and is complying with applicable training and recordkeeping requirements.

• Privacy and Data Law

Make sure your business’ website has a robust privacy and data policy that puts users on notice of their rights and otherwise complies with relevant law. 

• Securities Law

If a cannabis business is a public company or a private company raising money/issuing securities, it needs to consider relevant securities law and likely consult with a securities attorney.

Companies and service providers must ensure that compliance programs do not fall into the trap of only thinking about state and local cannabis regulations when defining “compliance.” Potential civil and criminal liability related to noncompliance with other relevant sources of law can be equally (if not more) crippling as enforcement actions related to cannabis regulations.

Creating a Compliance Program

After establishing a baseline understanding of the “universe” of law the industry must comply with, the question often becomes:

Where should a cannabis start in building a compliance program?

Cannabis companies should start with a risk assessment. Risk assessments are a compliance staple in many other industries and represent the first step towards creating a compliance program in the cannabis industry. A business must first establish the risk it faces to know what to address in its compliance program, after all.

A risk assessment is not a mechanical exercise wherein a cannabis business simply lists out all the risks it may face, however. Put another way, all risk is not created equal. Risk assessments should zero in on the most serious risks and their likelihood of occurring and associated punishment or other exposure. To get the ball rolling, the following five questions should be considered:

1. Who will be responsible for implementing and monitoring the compliance program?
2. Which cannabis license(s) will the business hold and what is the associated regulatory landscape?
3. Is it a private or public company?
4. How many employees?
5. Does the intended location present any unique safety and/or security issues?

After a business considers risk from a high level, it should consult state and local cannabis regulations. While regulations typically have sections devoted to individual license types, entrepreneurs should read through regulations in their entirety since there are often sections that apply to all licensees.

Businesses also should search far and wide for any disciplinary guidelines published by state or local regulators. Disciplinary guidelines are typically either included within a jurisdiction’s regulations or published as a stand-alone document. For example, the California Bureau of Cannabis Control’s disciplinary guidelines establish a three tier disciplinary structure and provide a list of compliance violations and the tier they fall into. The higher the tier, the more serious the punishment a licensee may face. Seek out the most serious compliance violations in your jurisdiction and craft your compliance program accordingly.

Compliance inspection checklists should also be requested at the state and local level in an effort to prioritize compliance concerns. State and local inspectors will often be provided with a checklist that outlines what an inspector should be on the lookout for when inspecting a licensee’s operations. While they are not always available, inspection checklists can be invaluable in assessing risk.

Risk assessments are skipped all too often by companies attempting to craft cannabis compliance programs. Do not be one of them. Think of risk assessments in the same way a writer thinks about organizing and outlining key points and issues before they start writing a book or article. And most of us (author included) have personally experienced the positive impact that this approach can have: think about the difference in work product when comparing a research paper written the night before it was due vs. a paper that was thought through before pen was put to paper. Similarly, taking time to assess risk before putting a compliance together will result in businesses receiving a better “grade” from state and local compliance inspectors in the long term. 

Regulatory Risks

As previously mentioned, the best place to start in evaluating regulatory risk in the cannabis industry is with a jurisdiction’s disciplinary guidelines. Disciplinary guidelines are often distributed by licensing agencies and describe regulatory violations and their associated fine and punishment. For example, here’s a link to the California Bureau of Cannabis Control’s disciplinary guidelines. California’s disciplinary guidelines that factors considered in determining penalties and establishes a three-tiered disciplinary structure;  the higher the tier, the more serious the offense[RK1] :

• Tier 1 discipline is used for violations which are potentially harmful
  • Minimum Punishment: Revocation stayed (lawyer talk for “delayed if and until you screw up”), 5 to 15-day suspension, a fine as determined by the “Fine Formula,” or a combination of a suspension and fine
  • Maximum Punishment: Revocation of license
• Tier 2 discipline is used for violations with a serious potential for harm and/or violations which involve greater risk and disregard for public safety
  • Minimum Punishment:  Revocation stayed, 15 to 30-day suspension, a fine as determined by the “Fine Formula,” or a combination of a suspension and fine
  • Maximum Punishment: Revocation of license
• Tier 3 discipline is used for violations involving knowing or willful violation of laws or regulations pertaining to commercial cannabis activity and/or fraudulent acts relating to the licensee’s commercial cannabis business 
  • Minimum Punishment:  Revocation stayed, 45-day suspension, a fine as determined by the “Fine Formula,” or a combination of a suspension and fine
  • Maximum Punishment: Revocation of license

If a business is located in California and governed by the Bureau of Cannabis Control, therefore, it should read through the guidelines and the violations most likely to impact its business. The focus should be on the most serious violations that impact a license type.

Legal Risks

“Legal Risks” refer to rules, regulations, and law outside of what is typically contained in cannabis regulations. Examples include human resources, marketing and advertising, charitable and political contributions.

Third-Party Relationships

Cannabis businesses should have an onboarding process in place that evaluates third-party relationships before they are formalized. Similarly, a business should also regularly monitor their third-party relationship with an eye towards ensuring that any third party maintains their license in good standing, if applicable. Prior to creating an onboarding process, a business should evaluate risk related to current or future third-party relationships.

CONTRACTS: Observing sound contract drafting principles is critical, but do not overlook relevant state and local regulations when drafting a contract.  Cannabis regulations typically outline ownership and financial interest parameters which may affect how owners structure a business, as well as place limitations on returns, re-testing product that has failed regulatory compliance testing, etc. that should be contemplated when drafting vendor contracts. Save yourself the headache down the road and take the time to properly memorialize cannabis deals.

Employees and Independent Contractors

It’s impossible for any cannabis business to anticipate all risk as operations will undoubtedly reveal risk that was not previously anticipated. Compliance programs, therefore, are not static and should be updated on a consistent basis. Since RAs are the basis for any compliance program, they should be conducted by cannabis businesses at monthly, quarterly, or annual intervals.

Compliance Binders

A compliance binder is an organized compilation of all the documents necessary to ensure a cannabis business’s strict compliance with all relevant law. It should be maintained in both digital and hard copy form. While printing the documents out may seem overboard, the ability to simply hand a compliance inspector a binder with all the documents they are looking makes for a much smoother experience for both your business and the inspector.

Which documents should be included within a compliance binder? Compliance binders should contain all documents that an inspector may ask to review. To determine which documents qualify, consider taking the following three steps:

1. Research your jurisdiction’s disciplinary guidelines. Disciplinary guidelines typically describe regulatory violations and associated punishments. The list of violations and punishments may shed light on your jurisdiction’s enforcement priories, as well as documents that you’ve overlooked.
2. Request a copy of the inspection sheets used by state and local inspectors. While some jurisdictions are resistant, many are willing to provide the checklist used in site inspections. Much like researching the disciplinary guidelines, an inspection checklist will provide insight into what your binder should emphasize.
3. Consult your jurisdiction’s record keeping requirements. These requirements should describe which documents should be maintained by a licensee, and for how long. Records related to taxes, inventory, transport, sales, security, employees, etc. should typically be maintained. and others. Make sure to research both state and local requirements to make sure that you aren’t overlooking any local wrinkles.

Inspections

Compliance inspections may be minimal with everything going on with COVID-19, but rest assured that cannabis inspections will ramp up once restrictions are lifted. Let’s talk about how to prepare your clients for inspections:

1. Review your client’s compliance binder and update it, if necessary. Make sure any COVID-19 SOP changes are included, and double check whether said changes need to be disclosed to regulators. Double check your jurisdiction’s disciplinary guidelines to make sure all your bases are covered.
2. Perform mock inspections. Put yourself in an inspector’s shoes and conduct a mock inspection, including a walk through of the licensed premises. Inspectors commonly utilize checklists when performing inspections. Reach out to the entity that issued your license and ask if you can get your hands on one.
3. Be prepared. Chances are, your clients will have to handle an inspection on their own. Make sure all documentation required by your jurisdiction is organized and easily accessible to your client so that it isn’t a mad scramble when an inspector shows up.

Implementing a Compliance Program

Putting a compliance program down on paper is a step in the right direction. However, a compliance program is not worth the paper it is written on if it is never implemented. This chapter will discuss how to effectively implement a cannabis compliance program.

Before a compliance program is implemented, a business must decide who will be responsible for implementing and overseeing the program. Ideally, the individual or individuals chosen will have played a role in creating the program. The answer to this question will otherwise be predicated upon the size of the business and the resources it has to devote to compliance. Regardless of who is chosen, the individual or individuals must be empowered by company leadership to not only implement the program, but to also assess and modify the program where necessary.

There are a number of technology solutions that offer compliance services that should be utilized to bolster existing compliance programs. Technology solutions are not a substitute for creating and implementing a compliance program, however. Automation and other technology solutions are undoubtedly the future when it comes to cannabis compliance. Just think about Microsoft Word/Excel and the difference in productivity when you started picking up on all the bells and whistles both programs offer. However, while compliance technology solutions provide helpful workflows and templates, operators should not solelyrely on technology providers to develop or implement their compliance program.  Business owners must independently ensure that their compliance program is tailored to their jurisdiction’s regulations and the business’ specific set of circumstances.  

Implementation can be broken down into a three-step process:

Train

All employees must be trained on all policies and procedures in the binder upon getting hired, and at regular intervals (weekly, monthly, quarterly, etc.) as the business progresses. Only training employees when they are first hired is a recipe for disaster.With how heavily regulated the industry is, it is unrealistic to expect an employee to retain all of the policies and procedures relevant to the business in a single training. Provide employees with compliance training as frequently as necessary and gradually decrease the amount of training sessions as employees become more comfortable with their role.

Monitor

It is impossible to create a compliance program that anticipates every issue that may confront a cannabis business. Grey areas will inevitably arise, particularly when interpreting the cannabis regulations that govern a licensee’s business. A cannabis business must monitor its program, including its employee’s overall understanding of it, by maintaining an open dialogue with employees and seeking out feedback on challenges that are coming up in operations. Daily, weekly, bi-weekly, or monthly compliance calls should be considered. The frequency of the calls should be directly related to the “age” of the business—the “younger” the business, the more frequent the calls ought to be.

A business must also monitor changes in the law. Keeping up with regulatory updates can be challenging, particularly if you practice in multiple jurisdictions. Here are some tips to make sure you’re up to date:
1) Subscribe to the newsletter of any federal, state, or local agency that regulates your client’s hemp or cannabis business. Regulatory bodies regularly send out help notices about proposed regulations and other important updates that may impact your client’s operations.
2) Join your the cannabis section of your local or state bar association and network. Having a colleague who is also practicing in this space can be invaluable.
3) Join cannabis-related groups on Facebook and/or Linkedin. Members of these groups not only share helpful regulatory updates that you may have missed, but operators in these groups often share operational insight that may be helpful to a cannabis client as an added bonus.

Reassess and Modify

A compliance binder should be reviewed and updated on a monthly basis, or at the very least, on a quarterly basis. When reviewing the binder, a business should consider whether any changes have been made to relevant regulations or to business. For example, if a new employee has come on board since the last review, their information will in all likelihood need to be added to the binder and maintained (and possibly reported to state and local licensing agencies, but more on that in the “Disclosures” lesson). Be sure to also consider whether any SOP has changed, and be sure to document the operational change (and potentially disclose it) accordingly.