Beyond DEA: The Federal Agencies That Actually Control Cannabis Legalization

August 16, 2026

Photo by Greyerbaby via Pixabay.

Introduction

Everyone in the cannabis industry has been trained to watch the DEA. The rescheduling hearings, the administrative law judge's recommendation, the final decision from DEA Administrator Terry Cole, all of it feels like the main event. But the agencies that actually determine whether a cannabis company can open a checking account, deduct rent and payroll, or keep its products on shelves aren't in Arlington. They're on Constitution Avenue, and they move on their own timelines, shaped by their own statutory mandates, not by whatever the Department of Justice decides to do next. The IRS has always been the quiet enforcer of Section 280E, the tax code provision that bars businesses trafficking in Schedule I or II substances from deducting ordinary expenses. Rescheduling to Schedule III was supposed to fix that, but the fine print DOJ published in April 2026 carved out only a narrow slice of the industry, leaving most adult-use operators exactly where they were before. FinCEN's 2014 guidance on marijuana banking still governs whether a credit union in Colorado or Michigan is willing to take on a cannabis client, regardless of what schedule the plant sits on. The Department of Transportation reaffirmed in May that a state-issued medical card still does not count as a legitimate explanation for a positive drug test. And while Congress has yet to pass anything approaching broad legalization, the agencies that would actually run a regulated cannabis market, the FDA and the TTB, are already drafting the frameworks that would replace DEA oversight entirely. Understanding where cannabis policy actually stands in 2026 means looking past the headlines and into the paperwork that determines survival.

IRS and the 280E Question Nobody Has Actually Answered

Photo by Tara Winstead via Pexels.

Everyone in this industry has been trained to hate the DEA, and fair enough. But the agency that actually determines whether a cannabis company survives its next tax year isn't in Arlington, it's on Constitution Avenue. The IRS has always been the quiet enforcer of Section 280E, the tax code provision that bars businesses trafficking in Schedule I or II substances from deducting ordinary expenses like rent, payroll, or marketing. Rescheduling to Schedule III was supposed to fix that. It didn't, at least not cleanly, and the fine print DOJ published in its April 2026 order is where the real story is.

That order carves 280E out for a specific slice of the industry: operations tied to an FDA-approved cannabis drug product, or activity conducted under a state medical marijuana license that meets the narrower definitions DOJ used in drafting the rule. If your business fits inside that lane, you can now deduct the normal cost of doing business the way a bakery or a hardware store does. If you don't, nothing has changed. That's a much smaller carve-out than the blanket relief a lot of operators assumed rescheduling would deliver.

Treasury and the IRS acknowledged the confusion directly, announcing on April 23, 2026 that formal guidance is coming, including a transition rule that would apply the new rescheduling-based tax treatment across the entire taxable year rather than forcing companies to split their books at the effective date. That's a meaningful concession, since retroactively slicing a fiscal year into pre- and post-rescheduling deduction periods would have been an accounting nightmare. But announcing that guidance is coming is not the same as having it, and the agency gave no firm date.

Meanwhile, 280E still applies in full force to any plant-touching operator whose business doesn't fall into those qualifying categories, which right now describes most adult-use retailers and cultivators in states like California, Colorado, Michigan, and Illinois. Nothing about their tax exposure has shifted. They're still calculating cost of goods sold as narrowly as possible and deducting almost nothing else, exactly as they have since the Obama administration.

The practical problem is timing. Quarterly estimated taxes for 2026 are due on the normal IRS schedule regardless of when final guidance lands, which means finance teams are being asked to estimate liability without knowing which deductions the agency will actually honor. Guess too aggressively and you're looking at penalties and interest later. Guess too conservatively and you're starving the business of cash it may not have needed to part with. Talk to a CPA who specializes in cannabis before making that call, and don't assume last year's treatment still applies.

FinCEN Still Runs Cannabis Banking, Not the DEA

Photo by https://kaboompics.com/ via Pexels.

Rescheduling to Schedule III gets all the headlines, but the agency that actually decides whether your dispensary can keep a checking account isn't the DEA. It's FinCEN — the Treasury Department's Financial Crimes Enforcement Network — and the rulebook it wrote back in 2014 is still the law of the land. FIN-2014-G001, the guidance memo issued jointly with the DOJ's now-defunct Cole Memo framework, never got rescinded. Rescheduling doesn't touch it. Banks serving cannabis accounts today are complying with an eleven-year-old document that assumes marijuana is still federally illegal, because in the eyes of the Bank Secrecy Act, it still functionally is until Congress or FinCEN says otherwise.

That guidance requires something most cannabis operators never see directly: continuous Suspicious Activity Report filings. Banks file Marijuana Limited SARs on customers who appear compliant with state law, Marijuana Priority SARs when something looks off, and Marijuana Termination SARs when they close an account. This isn't a one-time onboarding hurdle — it's a recurring compliance cost baked into every deposit, every transfer, every large cash pickup. A bank that stops filing these reports on a cannabis client isn't just being sloppy; it's exposing itself to regulatory action. That's why so few institutions bother.

FinCEN's own numbers tell the story. Through 2025, roughly 800 to 850 depository institutions nationwide report having cannabis-related accounts on their books. Sounds like decent coverage until you look closer: fewer than 100 of those offer actual commercial banking — business checking, lending, merchant services — to plant-touching operators. The rest are mostly handling ancillary businesses, or offering bare-bones deposit accounts with heavy restrictions. That gap is exactly why the industry stayed cash-heavy for a decade and, absent new legislation, will likely stay cash-heavy for a while longer.

SAFER Banking, the bill that would actually shield banks from federal penalties for serving state-legal cannabis businesses, still hasn't passed Congress. Rescheduling doesn't substitute for it. Moving marijuana to Schedule III changes tax treatment under IRC 280E and research access, but it does nothing to the Bank Secrecy Act filing obligations or the underlying money-laundering statutes that make banks nervous. Compliance officers know this even if headline writers don't.

Then there's OFAC. Every cannabis account — the business, its owners, its major counterparties — gets screened against sanctions lists, the same as any other banking customer. That matters more than people assume, given documented cases of cartel-linked cash and illicit-market crossover in parts of the gray and black market supply chain. A bank isn't just checking whether you're licensed; it's checking who's actually behind the money.

DOT Drug Testing Isn't Moving, Rescheduling or Not

Photo by R9 Media Photo Collective via Pexels.

If there's one part of the federal system that makes the disconnect between rescheduling and real-world consequences obvious, it's the Department of Transportation. On May 15, 2026, DOT reaffirmed something it has said in one form or another for years: a state-licensed marijuana product, whether it came from a dispensary in Denver or a medical program in New York, still does not count as a legitimate medical explanation for a positive drug test result. Not a valid prescription, not a doctor's note, not a state-issued medical card. If a DOT-regulated employee tests positive for THC, that's a positive test, full stop.

This applies to the people you'd expect: commercial truck drivers, airline pilots, rail workers, transit bus operators, pipeline workers, and anyone else classified as safety-sensitive under DOT's testing rules. These workers operate under a zero-tolerance framework administered through the Federal Motor Carrier Safety Administration, the FAA, the FRA, and other DOT sub-agencies, and none of them have signaled any intention to change course because of federal rescheduling talk. A positive test still means the same things it always has, including removal from safety-sensitive duties and a mandatory return-to-duty process through a substance abuse professional.

The reason this matters beyond the transportation sector is what it reveals about how rescheduling actually works. Moving marijuana from Schedule I to Schedule III under the Controlled Substances Act doesn't hand down a single, government-wide rewrite of workplace drug policy. DOT's testing regime isn't derived from where marijuana sits on the CSA schedule in the first place; it runs through its own set of regulations built around safety justifications that exist independent of scheduling status. Schedule III status wouldn't make marijuana legal under federal law anyway, but even if it did, DOT could still maintain its own zero-tolerance stance, the same way it has never carved out exceptions for state medical marijuana programs even in states where cannabis has been legal for over a decade.

For employers operating in DOT-regulated industries, the practical lesson is simple: don't let headlines about rescheduling do your compliance work for you. If you run a trucking fleet, a charter operation, or a transit agency, your testing obligations don't shift because news broke about DEA scheduling changes. Confirm directly with DOT or your Designated Employer Representative before adjusting any policy, and treat every other agency's rules as separate questions with separate answers, not one automatically covered by another.

FDA and TTB: The Agencies That Would Actually Run Legal Cannabis

Photo by Pixabay via Pexels.

Everyone fixates on the DEA rescheduling docket because it's the drama unfolding right now, but the more consequential fight is happening in a quieter corner of federal policy: what happens if Congress actually removes cannabis from the Controlled Substances Act entirely. Under bills like the Cannabis Administration and Opportunity Act, first introduced by Senate Democrats and revised in various forms since, the DEA doesn't just lose some authority over cannabis, it loses jurisdiction altogether. That authority would move to two agencies most cannabis operators have never had to think about: the FDA and the Alcohol and Tobacco Tax and Trade Bureau, better known as the TTB.

The FDA piece is the one worth paying attention to. The draft legislation would create something called a Center for Cannabis Products inside the agency, a dedicated division built to handle labeling requirements, potency caps, serving-size standards, and manufacturing practices for everything from flower to edibles to vape cartridges. The model isn't food regulation, it's tobacco. FDA already runs a Center for Tobacco Products that oversees things like nicotine limits, marketing restrictions, and premarket review for new tobacco products, and the cannabis version would borrow heavily from that playbook. That means potential premarket notification requirements, restrictions on marketing to minors, and standardized testing protocols that don't currently exist at the federal level. Meanwhile, TTB would handle taxation and permitting the way it already does for alcohol, which explains why industry lawyers keep describing legal cannabis as headed toward an alcohol-tobacco hybrid regulatory model rather than anything resembling how pharmaceuticals get approved.

None of this is imminent. CAOA and its successor drafts have circulated in Congress for years without a floor vote, and nobody serious is predicting passage on a specific timeline. But the bill's structure matters because it's the clearest signal available of where federal regulatory authority is headed if broader legalization ever clears Congress, and operators building compliance infrastructure today would be smart to watch FDA's tobacco-oversight moves as a preview.

There's a nearer-term wrinkle too. USDA's hemp definition under the Farm Bill is scheduled to change effective November 12, 2026, and that shift will ripple directly into how marijuana gets defined under the Controlled Substances Act, effectively reclassifying a huge swath of hemp-derived THC products that currently exist in a gray market. Anyone selling delta-8 or other hemp-derived intoxicants should be tracking that date closely, since state law will vary on how it's treated in the meantime.

Congress Is Already Trying to Slow This Down

Photo by Michael D Beckwith via Pexels.

While most of the industry's attention has been fixed on the DEA's rescheduling docket, a quieter fight has been playing out on the appropriations side of Capitol Hill, and it matters just as much. On April 29, 2026, the House Appropriations Subcommittee on Commerce, Justice, Science approved a funding bill that includes a rider blocking the Department of Justice from spending any money to actually reschedule marijuana. No debate about the merits of moving cannabis from Schedule I to Schedule III, no vote on legalization itself, just a line item that would freeze DOJ's ability to act even if the administrative law judge and DEA Administrator Terry Cole eventually greenlight the move.

That's a useful reminder for anyone who has been treating rescheduling as a straight-line executive branch process. It isn't. DEA can rule, DOJ can sign off, and the whole thing can still stall if appropriators decide to withhold the funding needed to implement it. This is the same tactic Congress has used for years with the Rohrabacher-Farr rider protecting state medical programs from DOJ prosecution, except this version cuts the other direction, aiming to prevent forward movement rather than protect the status quo. The subcommittee vote doesn't guarantee the rider survives to a final appropriations bill, but it shows there's an organized bloc in the House willing to use the power of the purse as a backstop against rescheduling, regardless of what the executive branch ultimately decides.

Meanwhile, the actual rescheduling proceeding grinds forward on its own separate timeline. Post-hearing briefs on the broader scheduling question are due to the administrative law judge by August 17, 2026, after which the judge issues a recommendation that goes to Cole, who holds final decision-making authority. That's a slow, procedural track running in parallel to whatever Congress does with funding bills.

The practical takeaway for operators: stop waiting for a single announcement to resolve everything. 2026 is shaping up as a year where DOJ/DEA scheduling, IRS tax guidance on 280E, and congressional funding fights all move independently, and any one of them can stall or redirect the others. Plan around that uncertainty rather than a clean finish line, and check with counsel in your state before assuming any federal change alters your obligations locally.

Rescheduling gets the headlines because it's the easiest story to tell: a plant moves from Schedule I to Schedule III, and suddenly the whole industry seems legitimate. But that's not actually the fight that decides whether a dispensary owner can open a checking account at a local bank or write off rent and payroll like any other small business. Those outcomes hinge on agencies that don't hold press conferences and rarely make it into a headline, yet quietly write the rules that determine whether a cannabis company survives its first audit or gets its account frozen without warning.

The IRS has been shaping this industry for years through guidance on Section 280E, and that guidance doesn't pause just because the DEA is holding hearings. FinCEN's suspicious activity report requirements determine, bank by bank, whether a credit union in Colorado or Michigan is willing to take on a cannabis client at all, regardless of what schedule the plant sits on. And USDA's definition of hemp under the 2018 Farm Bill has already created more day-to-day chaos for retailers, through intoxicating hemp-derived products, than the DEA has managed in a decade of foot-dragging on marijuana itself. These are the agencies with their hands actually on the levers of banking access, tax liability, and product legality, and they move on their own timelines, shaped by their own statutory mandates, not by whatever the DOJ decides to do next.

That's the real lesson for operators heading into 2026: watch the paperwork, not just the politics. A rescheduling announcement makes for a good news cycle, but it won't retroactively fix a 280E tax bill from three years ago or force a bank back to the table on its own. The agencies actually setting those terms are still writing new guidance, and some of it will shift again before this year is out.

None of this is a substitute for professional advice, and none of it should be treated as legal guidance in itself. Rules differ by state, banking relationships differ by institution, and federal guidance is genuinely in flux through 2026. Anyone making a real business decision, whether it's structuring a new entity, applying for a merchant account, or filing taxes, should be talking to an attorney or accountant who tracks these agencies specifically, not just reading the rescheduling news and assuming the rest will sort itself out.

Conclusion

The rescheduling process gets the headlines because it is the easiest story to tell. A plant moves from Schedule I to Schedule III, and suddenly the whole industry seems legitimate. But that is not actually the fight that decides whether a dispensary owner can open a checking account or write off rent and payroll like any other small business. Those outcomes hinge on agencies that do not hold press conferences and rarely make it into a headline, yet quietly write the rules that determine whether a company survives its first audit or gets its account frozen without warning. The IRS guidance on 280E is still incomplete, leaving finance teams to estimate tax liability without knowing which deductions the agency will actually honor. FinCEN's suspicious activity report requirements have not changed in over a decade, and banks still weigh compliance costs against revenue when deciding whether to serve cannabis clients. DOT's zero tolerance testing regime remains intact, and the congressional riders aimed at blocking rescheduling funding are a reminder that even if the DEA rules favorably, appropriators can still stall implementation. The deeper story is that cannabis policy in 2026 is not moving in a single direction. It is fragmenting across agencies, each with its own timeline, its own statutory constraints, and its own political pressures. For operators, that means planning around uncertainty rather than waiting for a clean finish line, and checking with counsel in their own state before assuming any federal change alters their obligations locally. The paperwork matters more than the politics, and the agencies writing that paperwork are not done yet.