FEDERAL DEPOSIT INSURANCE CORPORATION 

 

FDIC Advisory Committee on 

Community Banking

October 10, 2019 

Depository Institutions and 

Hemp Customers 
 

 

 

 

 

 FEDERAL DEPOSIT INSURANCE CORPORATION 

Hemp Definitions 

2 

 The Agricultural Act of 2014 (2014 Farm Bill) defined 

Industrial Hemp as “the plant Cannabis sativa L. and any 

part of such plant, whether growing or not, with a delta-9 

tetrahydrocannabinol concentration of not more than 0.3 

percent on a dry weight basis.” 

 The Agricultural Improvement Act of 2018 (2018 Farm Bill) 

defined Hemp as “the plant Cannabis sativa L. and any part 

of that plant, including the seeds and all derivatives, 

extracts, cannabinoids, isomers, acids, salts, and salts of 

isomers, whether growing or not, with a delta-9 

tetrahydrocannabinol concentration of not more than 0.3 

percent on a dry weight basis.” 
 

 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

2014 Farm Bill Details 

3 

 The 2014 Farm Bill allowed for an institution of higher 

education or a state department of agriculture to grow or 

cultivate industrial hemp as part of a pilot program or 

other agricultural or academic research in states where it 

was legalized. 

 The 2014 Farm Bill established an agricultural pilot 

program as the framework to study the growth, 

cultivation, or marketing of industrial hemp in states that 

permit its growth or cultivation. 

 Pilot programs require that sites used for growing or 

cultivating industrial hemp be certified by, and registered 

with, the state department of agriculture. 
 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

2018 Farm Bill Details 

4 

 The 2018 Farm Bill excluded hemp with 0.3 percent or less 

THC as a controlled substance. 

 The 2018 Farm Bill allowed broad hemp cultivation, across 

state lines with no restrictions on the sale, transport, or 

possession subject to USDA, state, territory, and tribal 

regulations and oversight. 

 The 2018 Farm Bill requires that hemp production be subject 

to a plan and requirements established by the USDA. 

 The 2018 Farm Bill authorizes state departments of 

agriculture (including agencies representing D.C., any other 

territory or possession of the U.S., and tribal governments) 

to submit regulatory plans to the USDA for approval. 
 

 

 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

Status of USDA Guidance and 

Regulatory Requirements 

5 

 The USDA issued a legal opinion and guidance interpreting 

the 2018 Farm Bill and is expected to issue regulations by

year-end 2019 to accommodate the 2020 planting season. 

 USDA regulations are expected to address sampling 

procedures, testing requirements, licensing, compliance, 

and other procedures that production facilities and 

overseeing agencies need to employ to receive a license. 

 According to the USDA, hemp may be produced by properly 

licensed hemp producers in accordance with the 2018 Farm 

Bill only after the USDA issues regulations and guidance for 

the commercial production of hemp. 
 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

Important Aspects of the 

2018 Farm Bill 

6 

 USDA regulations must become effective before hemp may 

be produced in accordance with the 2018 Farm Bill. 

 Research and development initiatives authorized under the 

2014 Farm Bill remain in effect. 

 A state or tribal government may enact or continue to 

enforce laws prohibiting the production of hemp, even 

though it is legal under federal law. 

 The 2018 Farm Bill did not preempt state or tribal laws 

regarding the production of hemp that are more stringent 

than federal law. 
FEDERAL DEPOSIT INSURANCE CORPORATION 

Onboarding and Maintaining 

Hemp Customers 

7 

 Depository institutions providing, or planning to provide, 

services to hemp customers may wish to consult 

qualified legal counsel. 

 Obligations include suspicious activity monitoring and 

reporting (as appropriate) as well as risk-based customer 

due diligence for all customer relationships including 

participants in the hemp industry. 

 Depository institutions are required to establish 

reasonably designed procedures to ensure compliance 

with Bank Secrecy Act/anti-money laundering 

regulations. 
 

A l I ovvs cullt 'ivat:ion of hemp -for 

com rn e r cial, resea r ch or p i I 01: 

progr ams 

Does not a 11 ovv cu lt i vation o-f hemp. 

 

 

 

 

Landscape of Hemp Industry 

8 

Each state, territory or tribal agency’s plan will provide details on 

practices and procedures that enable hemp producers in their 

jurisdiction to operate according to their individual regulatory 

program and in compliance with federal laws. 

FEDERAL DEPOSIT INSURANCE CORPORATION 
 

.~·. ,.. ' 

... 

Stat,e Cannabis P'r,ograms 

Vf;fl o f. adult use law signed Jan. :n. 2018. E~·c"' · c Jul ,. 1. 2018 

l itniled , dull ptissessk>n and growi n.g allow~d, no re_g,ullaled ,,rod'i.1c1ion or s~l~s : DC, VT 

■ Adull & medical u ·e regulated 

ironram 

I /J duil e only oo ed1 I 

,egula ed progra 1 

Cm preh , ··ive medical 

Ill na n1ut na i O!J am 

□ CB[) I OV:. I IC r.1ro g1 am 

□ No public marijuana 

_ _ ______ ) rog mm __ 

As ,r ·,,1a :i, ;,o 9 

s 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

Landscape of Cannabis Industry 

9 

 Marijuana/Cannabis is still illegal under federal law. 

 FinCEN’s 2014 guidance, BSA Expectations Regarding MarijuanaRelated Businesses, is applicable. 
 

 

 

 

 

 

 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

Industry Hemp Questions 

10 

 When will the USDA and states (including territories 

and tribal entities) issue rules related to hemp 

sampling procedures, testing requirements, licensing, 

compliance, and other procedures that production 

facilities and overseeing agencies need to employ to 

receive a license? 

 Where does CBD oil fit into the regulatory structure? 

 Do I need to file a SAR on these businesses? 

 Does the FDA also have a role? 
FEDERAL DEPOSIT INSURANCE CORPORATION 

Possible Guidance Regarding 

Hemp-Related Businesses 

11 

 Consider issuing guidance to provide clarity for 

depository institutions considering providing banking 

services to hemp-related businesses, which: 

• addresses the current legal status of hemp 

production, 

• describes the authority for state departments of 

agriculture, including agencies representing the 

District of Columbia, any other territory or possession 

of the United States, and tribal governments, to submit 

regulatory plans to the USDA for approval, and 

• includes regulatory obligations regarding any 

customer type, including hemp-related businesses. 
FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

October 10, 2019 

IT Strategies: Examiner Observations and 

Recommendations 
 

 

 

 

FEDERAL DEPOSIT INSURANCE CORPORATION 

How Do Examiners Analyze IT 

and Cybersecurity?* 

2

Example: 

Evaluate the adequacy of the short- and long-term IT 

strategic planning and budgeting process. Consider the 

following: 

 Involvement of appropriate parties 

 Identification of significant planned changes 

 Alignment of business and technology objectives 

 Ability to promptly incorporate new or updated 

technologies to adapt to changing business needs 

 Coverage of any controls, compliance, or regulatory 

issues which may arise or need to be considered 

* Information Technology Risk Examination procedures available on FDIC.gov 
FEDERAL DEPOSIT INSURANCE CORPORATION 

What Do Examiners Observe & 

Recommend? 

3 

 Board oversight 

 Use of IT security audits to guide resource allocation 

 Increased consideration of business continuity 

 Use of standard assessments to guide increasing 

cybersecurity maturity 

 Improved vendor management 

 Better identification of the IT changes necessary to 

support strategic objectives 
 

--------------------------------~ 

usiness Continuity update coming ... 

1XFFIE,C 

IT EXAMIINATIONI 

HANDBOOK INFOBASE 

Recent & Upcoming... 

4 

Ask a Question Get answers from experts \:;;, 

FF.DER \I fl \ CI.\I I STITI TIO . F.. ·.\\111'.\.TIO COi CIL 

~;..::.,,.;,f' Prolfftllin,: unifi1rmill ond nHol,unc, In ,,.~ )Jlprr1nw11 of flndnt i11 I imliJuJiom 

About the FFIEC 

Contact Us 

Search 

Press Releases 

Enforcement Actions 

What's New 

Consumer Compliance 

Reports 

Consumer Help Center 

Financial Institution Info 

Examiner Education 

Supervisory Info 

Cybersecurity 

Awareness 

Federal Register 

Freedom of Information 

Act 

EGRPRA (Economic 

Growth and Regulatory 

Paperwork Reduction 

Act of 1996) 

Industry Outreach 

Press Release 

For Immediate Release August 28, 2019 

FFIEC Encourages Standardized Approach to Assessing Cybersecurity Preparedness 

The Federal Financial Institutions Examination Council (FFIEC) members today emphasized~--

the benefits of using a standardized approach to assess and improve cybersecurity 

preparedness. 

The members note that firms adopting a standardized approach are better able to track their 

progress over time, and share information and best practices with other financial institutions 

and with regulators. 

Institutions may choose from a variety of standardized tools aligned with industry standards 

and best practices to assess their cybersecurity preparedness. These tools include the FFIE 

Cybersecurity Assessment Tool, the National Institute of Standards and Technology 

Cybersecurity Framework, the Financial Services Sector Coordinating Council Cybersecurity 

Profile, and the Center for Internet Security Critical Security Controls. 

FFIEC members welcome collaborative approaches to advance and support cyber 

preparedness and enhance the efficiency and effectiveness of the supervisory process Whil 

the FFIEC does not endorse any particular tool, these standardized tools support institutions 

their self-assessment activities. The tools are not examination programs and the FFIEC 

members take a risk-focused approach to examinations. As cyber risk evolves, examiners mf.. , 

address areas not covered by all tools. 

REFERENCES 

FFIEC Cybersecuri!',' Assessment Tool 

FSSCC Cybersecuri!',' Profile 

NIST Cybersecurity Framework 

Center for Internet Securi!',' Controls 

### 

B

FEDERAL DEPOSIT INSURANCE CORPORATION 
 

· t . 

FEDERAL DEPOSIT INSURANCE CORPORATION 

What Challenges Do You Face? 

5 
 

 

 

 

 

 

 

Federal Financial Institutions Examination Council 

3501 Pairfax Drive • Room 137081 a • Arling ton, VA 22226-3550 • (703) 516-5588 • r AX (703) 562-6446 • www.ffice.gov 

Press Release 

For Immediate Release August 28, 2019 

FFIEC Encourages Standardized Approach to Assessing Cybersecurity Preparedness 

The Federal Financial Institutions Examination Council (FFIEC) members today emphasized the 

benefits of using a standardized approach to assess and improve cybersecurity preparedness. 

The members note that firms adopting a standardized approach are better able to track their 

progress over time, and share information and best practices with other financial institutions and 

with regulators. 

Institutions may choose from a variety of standardized tools aligned with industry standards and 

best practices to assess their cybersecurity preparedness. These tools include the FFIEC 

Cybersecurity Assessment Tool, the National Institute of Standards and Technology 

Cybersecurity Framework, the Financial Services Sector Coordinating Council Cybersecurity 

Profile, and the Center for Internet Security Critical Security Controls. 

FFIEC members welcome collaborative approaches to advance and support cyber preparedness 

and enhance the efficiency and effectiveness of the supervisory process. While the FFIEC does 

not endorse any particular tool, these standardized tools support institutions in their selfassessment activities. The tools are not examination programs and the FFIEC members take a 

risk-focused approach to examinations. As cyber risk evolves, examiners may address areas not 

covered by all tools. 

REFERENCES 

FFIEC Cybersecurity Assessment Tool 

https://www.ffiec.gov/cyberassessmenttool.htm 

FSSCC Cybersecurity Profile 

https://www.fsscc.org/Financial-Sector-Cybersecurity-Profile 
 

 

 

 

 

 

 

 

 

 

NIST Cybersecurity Framework 

https://www.nist.gov/cyberframework 

Center for Internet Security Controls 

https://www.cisecurity.org/controls/ 

# # # 

The FFIEC was established in March 1979 to prescribe uniform principles, standards, and report forms 

and to promote uniformity in the supervision of financial institutions. It also conducts schools for 

examiners employed by the five federal member agencies represented on the FFIEC and makes those 

schools available to employees of state agencies that supervise financial institutions. The Council consists 

of the following six voting members: a member of the Board of Governors of the Federal Reserve System; 

the Chairman of the Federal Deposit Insurance Corporation; the Director of the Consumer Financial 

Protection Bureau; the Comptroller of the Currency; the Chairman of the National Credit Union 

Administration; and the Chairman of the State Liaison Committee. 

Media Contacts: 

Federal Reserve Darren Gersh (202) 452-2955 

CFPB Marisol Garibay (202) 435-7425 

FDIC Julianne Fisher Breitbeil (202) 898-6895 

NCUA John Fairbanks (703) 518-6336 

OCC Stephanie Collins (202) 649-6870 

SLC James Kurtzke (202) 728-5733