The Government Accountability Office released a report this month finding that most U.S. banks and credit unions still keep cannabis-related businesses at arm’s length, even though GAO found no case of a financial institution being penalized by federal regulators for serving one.
The report, “Banking Services: Cannabis Businesses Face Access Challenges” (GAO-26-107498), traces the caution to compliance cost rather than realized legal exposure. The Financial Crimes Enforcement Network issued guidance in 2014 laying out how banks can serve cannabis businesses while meeting Bank Secrecy Act requirements, and the number of institutions doing so grew steadily from 2015 through 2019 before flattening through 2024. Roughly 1,000 banks and credit unions, about 11% of insured depository institutions, filed cannabis-related suspicious activity reports in 2024. GAO’s own framing of the underlying hesitation: “Financial institutions may be reluctant to serve CRBs because, with certain exceptions, cannabis is a controlled substance under federal law.”
For fintechs and community banks weighing whether to enter cannabis banking, GAO’s finding reframes the calculation. The obstacle is not a documented enforcement risk, since the agency found none, but the cost of enhanced due diligence, ongoing suspicious activity report filing, and the uncertainty of state law shifting under a business that remains federally illegal regardless of state licensing. That distinction matters because it means the market is not actually closed by regulatory prohibition. It is closed by the economics of compliance, in an industry that still cannot access card networks directly: major card companies continue to block cannabis purchases outright, pushing the sector toward cash and pushing the specialized banking relationships that do exist toward premium pricing. The roughly 1,000 institutions already serving cannabis businesses, and charging accordingly for the compliance burden, look less like early movers into a legally ambiguous market and more like the only businesses that have correctly priced a market payment networks have historically treated as a restricted destination, long before regulators start enforcing after the fact rather than setting rules in advance.
