Rescinding FinCEN's 2014 Cannabis Memo: What Credit Unions Are Waiting On

August 24, 2026

Photo by Kadir Avşar via Pexels.

Open a credit union's BSA policy manual today and you'll find, buried in the cannabis section, a citation to a FinCEN memo dated February 14, 2014. That document was written to interpret a Justice Department enforcement memo from 2013 -- the Cole Memorandum -- for an industry selling a substance the federal government still classified, at the time, as having no accepted medical use and a high potential for abuse. It's mid-2026 now. The Cole Memo has been dead since January 2018. Marijuana itself partially left Schedule I in April 2026. And FIN-2014-G001 is still, word for word, the operative guidance every bank and credit union in the country uses to decide how to bank a cannabis dispensary.

That's not a clerical oversight -- it's a genuine legal paradox. Institutions are still required to file Marijuana Limited, Marijuana Priority, and Marijuana Termination Suspicious Activity Reports, a three-tiered system built entirely around the idea that cannabis proceeds are presumptively suspicious because the underlying activity was federally illegal under a framework that no longer fully applies. Nobody rescinded the guidance when the scheduling changed, because rescheduling and guidance rescission are two different regulatory acts, controlled by different agencies, on entirely different clocks. The result is a compliance gap with a body count measured in staffing hours and closed accounts, not headlines -- and it falls hardest on credit unions, which don't have the compliance budgets of a regional bank to absorb the ambiguity. This piece is about what that gap actually costs, why no one has closed it yet, and what happens the day someone finally does.

What FIN-2014-G001 Actually Requires, and Why It's Aging Badly

Photo by Mikhail Nilov via Pexels.

FIN-2014-G001 is a short document doing a lot of load-bearing work. FinCEN issued it in February 2014, about two months after the Cole Memorandum had been circulating as the Justice Department's statement of enforcement priorities for state-legal marijuana. The guidance essentially told banks: if you can verify a cannabis business isn't violating the eight Cole priorities -- diversion to minors, revenue to cartels, gun violence, and so on -- you can bank it, provided you conduct enhanced due diligence and file the right paperwork. The entire risk logic of the document assumes the Cole Memo's enforcement priorities are the reference point for what counts as an acceptable cannabis customer.

Jeff Sessions rescinded the Cole Memo in January 2018, during his brief tenure as Attorney General under the first Trump administration, explicitly to let U.S. Attorneys use their own discretion on marijuana prosecutions. FinCEN did not respond. It didn't revise the guidance, didn't withdraw it, didn't issue a clarifying update. Three administrations later -- Trump's first term, Biden's full term, and now Trump's second -- the same 2014 text still governs. That's an unusually long shelf life for a guidance document whose foundational citation has been gone for eight years.

The mechanics haven't changed either. Institutions still sort cannabis customers into Marijuana Limited (basic compliance, no red flags), Marijuana Priority (potential Cole violations present), or Marijuana Termination (account being closed), and they still layer on ongoing due diligence that treats cannabis funds as presumptively suspicious activity requiring a SAR regardless of whether anything is actually wrong.

Then came the Blanche Order, effective April 28, 2026, which moved FDA-approved marijuana products and marijuana grown under state medical licenses into Schedule III. That's a genuine, verifiable regulatory shift -- but it's a narrow one. Adult-use cannabis, which accounts for the large majority of state-legal retail commerce, stays on Schedule I pending a separate, broader DEA rescheduling hearing that hasn't concluded. As of July 1, 2026, none of FinCEN, the OCC, the FDIC, or the Federal Reserve had issued a single piece of cannabis-specific guidance acknowledging that split status exists. So the guidance banks rely on is built for a fully Schedule I product, applied to a product that is now partly Schedule III, and nobody in Washington has said out loud how those two facts are supposed to fit together.

The Numbers: How Many Institutions Are Actually Banking Cannabis

The number of banks and credit unions filing cannabis-related SARs rose steadily from 633 in mid-2019 to a peak of 998 in 2024/2025, before dropping to 825 by late 2025.

The compliance paradox described above hasn't stopped institutions from entering the space -- it's just made entry slower and lumpier than a cleaner legal framework would. FinCEN's own SAR filing data gives a decent proxy for participation over time, since every bank or credit union banking cannabis has to file the specialized reports to stay compliant. In mid-2019, 493 banks and 140 credit unions were filing cannabis-related SARs, according to FinCEN's published figures -- a reasonable baseline for what guidance-only, no-statute banking looked like five years after the Cole Memo and five years into FIN-2014-G001.

By 2024, the credit union count had climbed to 182, and going into 2025 the bank count had reached 816. FinCEN data through late 2025 put the combined total somewhere in the 800-to-850 range for depository institutions filing cannabis SARs, up from roughly 700 to 750 in 2021. That's real, sustained growth -- but it's worth being precise about what it does and doesn't demonstrate.

What it demonstrates is that institutional appetite for cannabis banking has grown steadily even while the underlying legal uncertainty stayed constant. Nobody resolved the Schedule I question in that window; the Cole Memo had already been dead for a year by the 2019 baseline. So the growth curve is evidence that guidance-based tolerance, however imperfect, is enough to bring institutions in gradually -- not evidence that the legal gap has been closed or that growth would stop if it weren't.

What it doesn't demonstrate is parity between banks and credit unions. Credit unions have consistently made up a minority of total participating institutions -- roughly a fifth to a quarter of the combined count across this period. That gap matters structurally, not just numerically. Credit unions are member-owned cooperatives, typically smaller in asset base than the banks in this dataset, and BSA compliance costs -- specialized SAR categories, enhanced due diligence staffing, ongoing monitoring systems -- don't scale down proportionally with institution size. A compliance program that costs a regional bank a rounding error can represent a meaningful fraction of a small credit union's operating budget, which is the structural reason credit union participation has lagged even as overall numbers climbed.

NCUA's Balancing Act: Tolerant in Policy, Aggressive in Enforcement

Photo by RDNE Stock project via Pexels.

The National Credit Union Administration has been more explicit than any other federal depository regulator about where it stands on cannabis. NCUA has stated plainly that credit unions serving state-legal marijuana businesses under a sound BSA compliance program won't be sanctioned simply for the customer class they've chosen to serve. That's a meaningful policy signal -- it tells credit union boards the decision to bank cannabis isn't, by itself, an examination liability.

But that tolerance has a hard edge, and NCUA showed it in February 2021 with its first administrative cease-and-desist action against a depository institution over cannabis banking compliance, brought against Live Life Federal Credit Union. The order alleged failures in following FinCEN's guidance -- gaps in due diligence, documentation, or SAR practices, the specifics of which mattered less than the signal the action sent industry-wide: examiners are watching program quality, not the underlying business decision.

The lesson institutions took from that case is straightforward. NCUA isn't punishing credit unions for choosing to bank dispensaries. It's punishing them for doing it sloppily -- late SARs, thin documentation, due diligence programs that exist on paper but aren't actually followed in practice. That's a meaningfully different risk profile than an outright prohibition, and it changes what a credit union needs to invest in before entering the space: not legal cover, which NCUA has already offered, but genuine compliance infrastructure.

This dual posture -- permissive in stated policy, strict in actual enforcement -- isn't unique to cannabis. It closely mirrors how NCUA and the OCC handled money service businesses in the wake of the anti-money-laundering crackdowns of the 2000s, when regulators allowed banks to serve check-cashers and remittance companies but came down hard on institutions whose monitoring programs didn't match the risk level of the customer base. The precedent suggests the current posture toward cannabis is unlikely to shift toward blanket restriction; if anything, it's a template for how a high-risk-but-legal-in-part category gets normalized gradually through enforcement of program quality rather than through prohibition.

For a small credit union weighing whether to enter cannabis banking today, that history offers a genuinely useful takeaway: the enforcement risk isn't in the decision to serve the industry. It's in underfunding the compliance program that decision requires.

Why Rescheduling Alone Didn't Move FinCEN

Photo by Mark Stebnicki via Pexels.

It's tempting to assume rescheduling should have automatically triggered a FinCEN update -- the two seem like they should move together. History says otherwise. FinCEN's own 2014 guidance took over a year to follow the Cole Memo it was built on; agencies routinely decouple scheduling or enforcement-policy changes from the banking guidance meant to interpret them, because the two live in different offices, follow different rulemaking or guidance-issuance procedures, and answer to different institutional risk calculations.

The Blanche Order compounds that lag with a substantive complication. It reschedules FDA-approved marijuana products and state medical-license marijuana into Schedule III -- but adult-use cannabis, which represents the overwhelming majority of state-legal retail commerce and therefore the overwhelming majority of the cannabis SARs currently being filed, remains Schedule I pending the outcome of a separate, broader DEA rescheduling hearing. From FinCEN's perspective, that's not a small technicality: most of the deposits flowing through cannabis-banking relationships still touch product that hasn't been rescheduled at all. Rewriting guidance now, before that hearing resolves, risks drawing a line that the DEA itself might redraw within the same year.

That's the conservative case for delay, and it's not a weak one: if FinCEN rescinds the guidance now and the broader adult-use rescheduling effort stalls -- which has happened before, notably when the 2016 DEA rescheduling petition was denied outright after years of review -- banks and credit unions would be left with no framework whatsoever, which is a worse position than an outdated one. Regulators tend to weigh that asymmetry heavily: an imperfect guardrail beats no guardrail.

The case for urgency is just as real, though. Every quarter that passes without revised guidance means institutions keep filing Marijuana Priority SARs on transactions tied to product that is, in the medical-license and FDA-approved segments, no longer even Schedule I. That's compliance cost being generated without a corresponding, current risk justification -- enhanced due diligence resources spent monitoring a threat level the scheduling change already partially answered.

Both arguments are legitimate, which is probably why neither Treasury, FinCEN, nor NCUA has offered any rescission timeline as of mid-2026. Nobody has said no. Nobody has said when.

SAFE Banking's Long Road and What It Would Add on Top of Rescission

Photo by Mark Stebnicki via Pexels.

While FinCEN has stayed quiet, Congress has kept trying the legislative route, with roughly the same result it's gotten since 2019. Senator Jeff Merkley (D-OR) reintroduced the SAFE Banking Act as S. 4942 on June 24, 2026, with Representative Dave Joyce (R-OH) filing the House companion the following day. The bill carries bipartisan cosponsorship from Senators Lisa Murkowski (R-AK) and Elizabeth Warren (D-MA) -- an unusual pairing that reflects how cannabis banking has scrambled the normal partisan lines, uniting red-state agricultural and financial-access arguments with blue-state harm-reduction and small-business arguments.

The House has passed some version of this bill seven times since 2019. It has never once gotten a floor vote in the Senate. The closest the effort has come was its retooled version, the SAFER Banking Act, which cleared the Senate Banking Committee by a 14-9 vote in September 2023 -- a genuine milestone -- before stalling out with no further floor action.

The coalition that produced that committee vote just lost a key piece. Montana Senator Steve Daines, one of the most visible Republican advocates for a cannabis banking safe harbor, has announced he won't seek a third term. That's one vote gone, but more importantly it's an advocate gone -- someone who spent political capital building Republican support for a bill that otherwise reads, to a lot of GOP members, as soft on drug policy. Replacing that kind of internal party champion isn't automatic.

It's worth being clear about what a statute would actually add on top of a FinCEN rescission, because the two solve overlapping but distinct problems. SAFE Banking would create a broad federal safe harbor, removing liability exposure for institutions and their examiners across the board, regardless of what any single agency's guidance says. FinCEN rescission, by contrast, would only retire the specific SAR categories and the presumptive-suspicious framing embedded in FIN-2014-G001 -- narrower, agency-specific relief. Realistically, full normalization probably needs both: a statute for durable legal certainty, and a guidance rewrite for day-to-day compliance mechanics. The historical pattern from money service business regulation suggests statutory clarity tends to arrive years after informal regulatory tolerance has already been operating on the ground -- not before it, and not instead of it.

What Formal Rescission Would Actually Unlock for Credit Unions

Photo by Vitaly Gariev via Unsplash.

Assume, for a moment, that FinCEN does formally rescind FIN-2014-G001 within this article's mid-term window. What actually changes on a credit union's compliance floor?

The most immediate effect would be structural: eliminating the Marijuana Limited, Priority, and Termination SAR categories would let credit unions fold cannabis accounts into standard commercial due diligence workflows instead of maintaining a parallel, cannabis-specific compliance track. Several credit union trade groups have already identified that specialized staffing requirement as the single largest barrier keeping smaller institutions out of the space -- not legal risk, but the cost of running two compliance systems side by side.

Ending presumptive-suspicious treatment of cannabis proceeds would compound that effect by reducing the enhanced due diligence workload attached to each account. That's a real, if not yet quantified, cost reduction -- and it would land hardest, in relative terms, on credit unions under roughly $500 million in assets, which is exactly the segment that has been most conspicuously absent from the SAR-filing numbers discussed earlier.

The grounded, near-term projection follows directly from that math: lower marginal compliance cost per account should let more of the roughly 4,000-plus federally insured credit unions in the U.S. follow the path the 182 current filers have already taken. That's a reasoned extrapolation from the cost structure NCUA and trade associations have already described, not a guess pulled from nowhere.

The more speculative read goes further. If FinCEN rescission happens alongside, or shortly after, full adult-use rescheduling or SAFE Banking passage, credit unions -- which already specialize in underbanked and rural markets -- could become the default banking partner for smaller state-licensed operators that larger banks continue to avoid on reputational grounds. That's plausible, given credit unions' existing market niche, but it's speculation, not a forecast anchored in current data.

There's a real counter-case worth taking seriously, too. Multiple credit unions already banking cannabis cite correspondent banking access -- Federal Reserve master accounts, and the willingness of larger correspondent banks to process their transactions -- as their actual operating bottleneck, not SAR paperwork. If that's the binding constraint, rescinding FIN-2014-G001 without resolving deposit-insurance posture and correspondent relationships might reduce compliance cost without meaningfully increasing the number of institutions willing to enter the market at all.

Nobody should expect a single clean reset here. The realistic mid-term path looks incremental and asynchronous: partial rescheduling that already happened in narrow form via the Blanche Order, then possibly SAFE Banking or SAFER Banking clearing the Senate in some future session, and only after that -- probably with a lag measured in a year or more, based on how long the 2014 guidance itself took to follow the Cole Memo -- FinCEN actually rewriting FIN-2014-G001 to match whatever legal landscape exists by then. Each piece depends on the others resolving first, and none of the relevant agencies has shown urgency to jump the queue.

Credit unions occupy an unusual spot in that sequence. NCUA has already told them, in plain policy language, that the customer class isn't the problem -- which is more than the OCC or the Federal Reserve has said about banks. That means credit unions are arguably better positioned to move first once the compliance math improves, provided correspondent banking access holds up as the guidance simplifies. Whether that access holds is the open variable nobody can currently answer with confidence.

If you want an early read on FinCEN's next move, don't watch FinCEN. Watch two dates instead: the resolution of the broader DEA adult-use rescheduling hearing, and whatever the Senate ultimately does -- or doesn't do -- with S. 4942. Those two outcomes will tell you more about when the guidance changes than anything Treasury or FinCEN has said on the record so far, which as of mid-2026 is nothing at all.