Checklist · Cannabis

Cannabis Business Licensing and Compliance: A Practical Checklist

21 U.S.C. §§ 801

Type: Checklist
Jurisdiction: National
Date: 2025-02-05
Topic: Cannabis

Marijuana remains a Schedule I controlled substance under federal law, and every state cannabis license is therefore a permit to do something the federal government still calls a crime. This checklist is written for the operator, investor, landlord, and counsel who must live inside that contradiction. It walks the whole arc: entity formation and true-party-of-interest disclosure, the state license application, the local approval that quietly kills more applicants than the state ever does, facility and surveillance requirements, seed-to-sale tracking, testing and recalls, packaging and labeling, advertising limits, the banking and Bank Secrecy Act problem, Section 280E and the recordkeeping it demands, employment rules, insurance gaps, the illegality defense in contracts, brand protection without a federal trademark, real estate and forfeiture risk, the absolute bar on interstate movement, and license renewal and enforcement. It closes with the common mistakes, a consolidated one-glance checklist, and the primary authority. This document describes the law; it does not tell anyone how to violate federal law.

Cannabis Business Licensing and Compliance: A Practical Checklist

Cannabis > Cannabis Law | Published 5 February 2025 - Updated 3 July 2026 | UpLaw - uplaw.us

A state cannabis license does not make your business legal. It makes your business licensed. Those are different things, and the gap between them is where the tax bills, the closed bank accounts, the unenforceable contracts, and the forfeited buildings all live.

Keywords: cannabis licensing, marijuana compliance, Controlled Substances Act, Schedule I, Section 280E, seed-to-sale tracking, true party of interest, local opt-out, cannabis zoning, child-resistant packaging, cannabis advertising, Bank Secrecy Act, illegality defense, cannabis trademark, hemp

How to use this checklist

This is an operational document for people who have already decided to pursue a state cannabis license and now need to know, in order, what has to be true before they open the doors and what has to stay true afterward. For the doctrine underneath it — why the state–federal conflict exists, how preemption and the dormant Commerce Clause interact with it, and where the litigation is heading — start with Cannabis Law: A Comprehensive Guide to State Legalization and Federal Prohibition. For the full map of UpLaw's cannabis materials, see The Cannabis Law Toolkit.

Our running example is Sable Creek Cultivation Co., a fictional applicant founded by Nia Okafor and Teodor Vance. Sable Creek intends to cultivate and sell adult-use cannabis in a state that has legalized it. In Phase 3, Sable Creek will win its state license and then discover that the City of Fair Haven will not let it open. That is not a hypothetical failure mode. It is the single most common way a funded, well-lawyered cannabis applicant loses everything.

Two warnings that govern everything below

First: cannabis is federally illegal. Marijuana remains a Schedule I controlled substance under the Controlled Substances Act, 21 U.S.C. §§ 801–971. Cultivating, distributing, or possessing it with intent to distribute is a federal felony under 21 U.S.C. § 841 no matter what your state license says. Gonzales v. Raich, 545 U.S. 1 (2005), held that Congress's commerce power reaches even purely intrastate, non-commercial cultivation, and United States v. Oakland Cannabis Buyers' Cooperative, 532 U.S. 483 (2001), held there is no medical-necessity defense to the CSA. The Cole Memorandum, the Obama-era enforcement-priorities guidance, was rescinded in January 2018 and is not law and never was. The Rohrabacher–Blumenauer appropriations rider bars the Department of Justice from spending funds to prevent states from implementing their medical marijuana laws — see United States v. McIntosh, 833 F.3d 1163 (9th Cir. 2016) — but it must be re-enacted every appropriations cycle, it does not cover adult-use, and it is not a defense to anything else. Nothing in this checklist advises anyone to violate federal law; it describes what compliance with state law requires and what federal illegality does to the business.

Second: the operative rules are state and local, and they vary enormously. There is no national cannabis licensing regime. Canopy caps, residency rules, ownership-disclosure thresholds, security specifications, potency limits, packaging standards, advertising audience thresholds, and license-type structures differ from state to state and, within a state, from city to city. Every figure and rule in this document is illustrative. Verify your own state's statute and regulations and your own municipality's ordinance before acting. And verify the current federal status: rescheduling has been under active federal consideration for several years, and any change would alter the tax and regulatory analysis below.

Phase 0 — Understand the baseline before you spend a dollar

[ ] Confirm in writing, with counsel, that the founders and investors understand the business is a federal felony and that a state license is not a federal defense.
[ ] Check the current federal status of marijuana under the CSA — including the state of any rescheduling rulemaking — rather than relying on memory or a news story.
[ ] Identify every participant whose personal exposure is different from the company's: non-citizen owners or employees (a controlled-substance offense or even admitted cannabis employment can trigger inadmissibility under INA § 212(a)(2) and defeat good moral character for naturalization), federal contractors, federal employees, licensed professionals, and anyone who lawfully possesses firearms (18 U.S.C. § 922(g)(3) bars possession by an unlawful user of a controlled substance; its constitutionality post-Bruen is contested and unsettled).
[ ] Confirm your lawyer's own position. There is no national rule of legal ethics. ABA Model Rule 1.2(d) — which forbids counseling a client to engage in conduct the lawyer knows is criminal — binds no one until a state adopts it, and the rules that actually govern a lawyer are the adopting jurisdiction's. Many states have addressed cannabis specifically by rule comment or ethics opinion, and their answers are not uniform; California's rules of professional conduct are numbered and worded differently from the Model Rules and must be consulted directly. Read your own jurisdiction's adopted rule and its ethics opinions before either the lawyer or the client relies on anything here. See Legal Ethics and Professional Responsibility: A Comprehensive Guide to the Model Rules.
[ ] Distinguish hemp from marijuana at the outset. The Agriculture Improvement Act of 2018 removed hemp — Cannabis sativa L. with not more than 0.3% delta-9 THC on a dry-weight basis, 7 U.S.C. § 1639o — from the CSA definition of marijuana. Everything above that line is still Schedule I. The statutory hemp definition and the treatment of intoxicating hemp-derived cannabinoids have been actively legislated; confirm the current text and effective dates.

Why it matters, and the traps. Founders routinely treat federal illegality as background noise — a risk that has been "priced in" because nobody they know has been prosecuted. That is a misreading. Federal prosecution is only one of the consequences, and it is not the one that usually bites. The ones that bite are structural and automatic: you will pay tax on gross profit rather than net income; your bank will close your account without explanation; your landlord's lender will call the loan; your contracts may be unenforceable in court; you cannot register your brand federally; you cannot file bankruptcy; and your investors cannot get a clean opinion letter. None of that requires a single DEA agent to show up. It happens by operation of law the day you open.

The immigration trap deserves its own line. A non-citizen who works in a state-licensed dispensary — even lawfully under state law, even in a purely administrative role — has repeatedly been found to have engaged in conduct that bars a finding of good moral character. Do not let a green-card holder sign as your compliance manager without independent immigration counsel.

Phase 1 — Entity formation, ownership, and the true-party-of-interest rules

[ ] Form the operating entity in the license state, and confirm it is a permitted form (some states bar certain structures or require a specific entity type per license).
[ ] Map every person and entity with an ownership interest, a financial interest, a profit-sharing right, a management right, or effective control — then map the layer above them, and the layer above that.
[ ] Identify your state's disclosure threshold (commonly a small percentage, sometimes any interest at all) and its definition of a "true party of interest" or "person with financial interest." These definitions are deliberately broad and typically reach lenders taking a revenue share, landlords taking percentage rent, consultants paid a share of profits, and holders of convertible instruments.
[ ] Collect the disclosure package for every disclosable person: fingerprints, criminal history, tax filings, source-of-funds documentation, residency proof where required.
[ ] Vet every dollar of capital. Many states require documentation of the source of funds and will deny a license for unexplained cash or for money traceable to a person who would not qualify.
[ ] Draft the operating agreement to include a regulatory transfer restriction: no equity, option, convertible note, or profit interest may be issued or transferred without prior regulator approval where the state requires it.
[ ] Build cap-table hygiene from day one. See Incorporating a Startup the Right Way: A Founder's Legal Checklist and Board Governance, Minutes, and Corporate Formalities: A Practical Checklist.
[ ] Choose the tax entity with § 280E in front of you, not after the fact — see Choosing a Tax Entity: A Practical Checklist and Business Taxation: A Comprehensive Guide to Entity Choice and Federal Income Tax.

Why it matters, and the traps. In ordinary corporate practice, a convertible note is a financing instrument. In cannabis, it can be an undisclosed ownership interest that voids your license. Regulators built the true-party-of-interest concept precisely because operators kept trying to hide control behind debt, management agreements, and consulting fees. The penalty for getting it wrong is not a fine — it is denial, revocation, or a finding of misrepresentation that follows the founders to every other state they ever apply in.

The second trap is the SAFE, the option pool, and the standard startup equity toolkit. Every one of those instruments creates a person who may need to be disclosed and background-checked, and a routine 409A option grant to a new hire can, in some states, be a reportable change of ownership. Build a rule: no equity instrument leaves the company without a regulatory check.

Sable Creek's version. Nia and Teodor take a $600,000 convertible note from a family friend who lives out of state, with a 20% revenue-share kicker until conversion. In their state, both the convertible interest and the revenue share make the friend a true party of interest, and the state has a residency requirement for license holders. They have created a disclosure obligation and a potential disqualification in the same document. Discovered before filing, it is a restructuring. Discovered by the regulator afterward, it is a material misrepresentation.

Phase 2 — The state license application

[ ] Read the statute and the regulations and the current application window rules. Application windows are often short, scored, and non-reopening.
[ ] Confirm eligibility: residency requirements (where they still exist), disqualifying convictions, financial-capacity minimums, and license-type limits or canopy caps.
[ ] Determine whether the license is merit-scored, lottery, or first-come. Each demands a completely different preparation strategy and budget.
[ ] Assemble the substantive plan documents the application scores: security plan, standard operating procedures, cultivation or retail plan, diversion-prevention plan, waste-disposal plan, community-benefit plan, labor-peace agreement (required in several states).
[ ] Determine whether you qualify for a social-equity license and, if so, whether the state's ownership and control requirements for equity applicants (often 51%+ ownership and real control) are genuinely satisfied — not merely papered.
[ ] Verify site control before filing. Most states require a lease, deed, or option for the specific premises at application.
[ ] Have the application reviewed by someone who did not write it, against the scoring rubric, line by line.

Why it matters, and the traps. Residency requirements are the live constitutional fault line. The First Circuit held in Northeast Patients Group v. United Cannabis Patients & Caregivers of Maine, 45 F.4th 542 (1st Cir. 2022), that Maine's residency requirement for medical marijuana dispensary officers violated the dormant Commerce Clause, reasoning that the interstate market in marijuana, though illegal, still exists for constitutional purposes. Other courts have refused to apply the dormant Commerce Clause to a market Congress has outlawed. The question is genuinely unsettled and the answer differs by circuit and by state. Do not assume a residency rule is invalid because you read that one was struck down — and do not assume it is valid either.

The social-equity trap is the "predatory partnership." A well-capitalized operator recruits a qualifying equity applicant, gives them nominal majority equity, and takes back control through a management agreement, a licensing fee, a supermajority veto, and a call option. States have gotten very good at spotting this, and the consequences run to license revocation and, in some states, criminal fraud exposure. If the equity holder does not actually control the business, the application is false.

Phase 3 — LOCAL approval: the veto that kills most applicants

[ ] Confirm the municipality has opted in. In most states a city or county may ban cannabis businesses outright, and many have.
[ ] Obtain the local ordinance and read it against the zoning map: permitted zones, conditional-use requirements, buffer distances from schools, parks, daycares, churches, and other cannabis businesses.
[ ] Measure the buffers the way the ordinance measures them — property line to property line, door to door, or as the crow flies. The method changes the answer.
[ ] Confirm whether the locality caps the number of licenses and whether it runs its own merit or lottery process on top of the state's.
[ ] Calendar the local process: planning-commission hearing, council vote, appeal windows, and any development-agreement or community-benefit negotiation.
[ ] Confirm the building can actually be permitted: occupancy classification, odor control, HVAC and electrical capacity, fire suppression, and ADA access.
[ ] Make your lease or purchase contingent on both state and local approval, with a walk-away and a rent-abatement period through licensure.
[ ] If the site is close but not compliant, evaluate a variance or special-use permit early — see Obtaining a Zoning Variance or Special Use Permit: A Practical Checklist and Land Use and Zoning Law: A Comprehensive Guide.
[ ] If the site is in Indian country, stop and get specialized counsel. A tribe is a separate sovereign, not a subdivision of the state, and tribal law is not a subset of state law. Whether the state's cannabis code reaches the parcel at all, which government licenses the activity, whose court hears a dispute, and whose taxes apply are threshold jurisdictional questions with their own body of federal Indian law. Nothing in this checklist answers them.

Why it matters, and the traps. State legalization is permission, not preemption of local control. The California Supreme Court held in City of Riverside v. Inland Empire Patients Health & Wellness Center, Inc., 56 Cal. 4th 729 (2013), that a municipality may ban cannabis dispensaries entirely notwithstanding state law authorizing them, and that structure — state authorization plus local veto — is the norm across legalized states. Winning the state license and losing the city is a complete loss.

Sable Creek's disaster. Sable Creek scores well, wins a state cultivation license, and signs a five-year lease on a warehouse in Fair Haven, paying $18,000 a month while it builds out. Then it learns three things in one week. Fair Haven's ordinance requires a conditional-use permit, which the planning commission has discretion to deny. The 1,000-foot school buffer is measured property line to property line, not building to building, and the vacant parcel behind the warehouse is owned by the school district. And the council, facing an election, has just imposed an eighteen-month moratorium on new cannabis conditional-use permits. Sable Creek holds a valid state license it cannot use, a lease it cannot escape, and a state clock requiring it to be operational within twelve months or forfeit the license.

Every element of that was knowable before the lease was signed. Local diligence is not a step after the state application. It is a step before it.

Phase 4 — Facility, security, and surveillance

[ ] Build to the state's security specification, not to a generic commercial standard: perimeter and interior video coverage, retention period (often 30–90 days, sometimes longer), frame rate and resolution minimums, alarm system with monitoring, panic buttons, and commercial-grade locks.
[ ] Define and physically segregate limited-access areas; log every entry.
[ ] Install vault or secure storage meeting the state spec, and a separate quarantine area for product on hold, failed testing, or awaiting destruction.
[ ] Badge every employee and every visitor; keep a visitor log the regulator can read.
[ ] Write and drill the diversion, robbery, and after-hours-alarm response procedures.
[ ] Confirm that camera placement and audio recording comply with employee-privacy and wiretap law — audio is treated differently from video, and consent rules are state-specific. See Cameras, Consent, and the Law of Recording People.
[ ] Confirm whether armed security is permitted; remember 18 U.S.C. § 922(g)(3) and the federal-firearms problem for anyone who is also a cannabis user.

Why it matters, and the traps. The surveillance rules are not window dressing — in most states, a camera outage is itself a reportable violation, and an outage during an inventory discrepancy converts a paperwork problem into a suspected-diversion investigation. The recurring trap is retention: operators install a system that overwrites at 14 days in a state that requires 45, and the day a regulator asks for footage of a specific transaction, the footage does not exist. Buy storage for the legal retention period plus a margin, and audit that the cameras are actually recording, weekly, in writing.

Phase 5 — Seed-to-sale tracking and inventory reconciliation

[ ] Integrate with the state's mandated track-and-trace system (Metrc, BioTrack, or the state's chosen platform) before you take possession of a single plant.
[ ] Tag every plant and every package with the state-issued identifier at the point the rule requires it.
[ ] Reconcile physical inventory to the system on a defined, frequent cadence — daily for high-value SKUs, weekly at minimum — and document every reconciliation.
[ ] Set an internal variance threshold below the state's reportable threshold, so you catch discrepancies before they become violations.
[ ] Record waste and destruction with the required witnesses, method, and documentation.
[ ] Assign a single named owner of the track-and-trace account; control credentials; log every manual adjustment and who made it.
[ ] Preserve records for the state's retention period (commonly three to seven years) — and remember that your § 280E position depends on these same records.

Why it matters, and the traps. Track-and-trace is the regulator's ledger of your business, and an unexplained variance is treated as presumptive diversion — the one thing that reliably triggers both license revocation and federal attention. The trap is the manual adjustment. An employee who "fixes" a count in the system to make it match the shelf has, in the regulator's eyes, falsified a state record. Make manual adjustments a two-person, logged, reason-coded event, and reconcile before you adjust, never after.

Phase 6 — Testing, potency, contaminants, and recalls

[ ] Route all required samples to a state-licensed testing laboratory (typically ISO/IEC 17025-accredited) on the state's required panel: potency, pesticides, heavy metals, residual solvents, microbials, mycotoxins, and water activity as applicable.
[ ] Quarantine every batch until it passes. Do not move, sell, or transfer product on hold.
[ ] Document the remediation and retest rules — and never re-sample a failed batch simply to shop for a passing result. "Lab shopping" is a fraud theory, not a strategy.
[ ] Verify that label potency matches tested potency within the state's tolerance.
[ ] Write a recall SOP before you need it: batch traceability, customer notification, regulator notification timelines, retrieval, and destruction. See Managing a Product Recall: A Practical Checklist.
[ ] Understand your product-liability exposure. Federal illegality is not a defense to a state tort claim by an injured consumer — see Defending a Products Liability Claim: A Practical Checklist.

Why it matters, and the traps. Potency inflation is the industry's endemic integrity problem, and it is also a textbook consumer-fraud and false-advertising claim. A lab that reports the number the client wants is a lab that will eventually be decertified, taking every batch it ever certified with it. Diversify labs, keep retains, and treat a surprising result as a reason to investigate, not to celebrate.

Phase 7 — Packaging and labeling

[ ] Use child-resistant packaging meeting the standard your state incorporates — most reference the Poison Prevention Packaging Act testing protocol at 16 C.F.R. § 1700.20 — and confirm re-sealable child resistance for multi-serving products.
[ ] Ensure the packaging is not attractive to children: no cartoons, no mimicry of existing candy or snack brands (which is also a trademark problem, and a fast route to a cease-and-desist).
[ ] Include every mandated element: the state universal THC symbol, THC and CBD content per serving and per package, serving size, net weight, batch/lot number, license number, harvest or production date, ingredients and allergens, and the state's exact statutory warning text.
[ ] Make no health claims. A cannabis or CBD product marketed as treating, curing, or preventing disease is an unapproved new drug and misbranded under the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. §§ 331, 343, 355 — the basis for FDA's long run of warning letters to CBD sellers.
[ ] Submit packaging for pre-approval where the state requires it, and re-submit on every change.

Why it matters, and the traps. The copycat-candy package is the most reliably punished mistake in cannabis. It draws a state enforcement action, an FTC or state consumer-protection theory, and a Lanham Act suit from the brand owner all at once. The second trap is the "wellness" claim smuggled into marketing copy: the words anti-inflammatory, relieves anxiety, or treats insomnia on a label or website convert a lawful state-licensed product into a misbranded, unapproved drug in the FDA's eyes.

Phase 8 — Advertising and marketing

[ ] Confirm your state's audience-composition rule — most states permit advertising only where a defined supermajority of the audience is reasonably expected to be 21 or older. The threshold percentage varies; look it up.
[ ] Age-gate the website and every social channel; retain the audience-composition data that proves compliance.
[ ] Eliminate anything that appeals to minors, depicts consumption, depicts a person who appears under 21, or promotes overconsumption.
[ ] Remove all therapeutic and health claims from every channel, including influencer copy you did not write.
[ ] Substantiate every objective claim you do make (potency, purity, "organic," "pesticide-free") before it runs — see Substantiating Advertising Claims: A Practical Checklist and Advertising Law: A Comprehensive Guide to the FTC Act and Lanham Act.
[ ] Observe location-based restrictions: billboards near schools, transit advertising, and event sponsorships are commonly restricted or banned.
[ ] Include the state's mandated advertising disclaimer where required.

Why it matters, and the traps. FTC Act § 5, 15 U.S.C. § 45, applies to cannabis advertising the same way it applies to everything else — the FTC has brought deception cases in this space — and state cannabis regulators layer their own, far stricter, content and audience rules on top. The trap is the affiliate: an influencer's "cures my migraines" post is your health claim, on your ticket, because you paid for the placement. Contract for it, monitor it, and terminate for it.

Phase 9 — Banking and cash handling

[ ] Find a financial institution that knowingly serves cannabis businesses under a documented BSA program. Do not obtain an account by concealing the nature of the business — that is a separate federal crime.
[ ] Expect and cooperate with enhanced due diligence: license copies, ownership disclosures, source of funds, ongoing reporting, and the institution's Suspicious Activity Report obligations. FinCEN's guidance FIN-2014-G001 (Feb. 14, 2014) contemplates "Marijuana Limited," "Marijuana Priority," and "Marijuana Termination" SARs; a compliant relationship still generates SARs.
[ ] Budget for the fees. Cannabis banking is expensive by design; it prices the compliance burden.
[ ] Build a cash-handling SOP if you must handle cash: dual control, drop safes, armored transport, reconciliation, and CTR filing awareness — never structure deposits or payments to stay under a reporting threshold. Structuring is a federal felony, 31 U.S.C. § 5324, entirely independent of cannabis.
[ ] Never mischaracterize the business to a bank, a payment processor, or a lender. Misrepresentation converts a regulatory problem into bank fraud and money laundering exposure under 18 U.S.C. §§ 1956 and 1957.
[ ] Verify the current status of federal cannabis banking legislation before assuming relief is coming. Bills have repeatedly advanced and repeatedly failed.

Why it matters, and the traps. Cannabis proceeds are, under federal law, proceeds of a specified unlawful activity. That is why the banking problem exists and why it does not go away by being clever. The single worst thing an operator can do is get an account by lying — using a nondescript holding-company name and a vague NAICS code. When the bank finds out, it closes the account, files a termination SAR, and the operator now has a federal misrepresentation on the record. Boring, disclosed, expensive, and knowing is the only defensible posture.

Phase 10 — Tax: Section 280E and the recordkeeping it demands

[ ] Understand the rule. IRC § 280E denies all deductions and credits for a business trafficking in a Schedule I or II controlled substance. Marijuana businesses therefore pay federal income tax on gross profit, not net income.
[ ] Understand the one door that is open: cost of goods sold. COGS is not a deduction; it is a reduction in gross income, and Congress may not tax it away consistently with the Sixteenth Amendment. The Tax Court's decision in Californians Helping to Alleviate Medical Problems, Inc. v. Commissioner, 128 T.C. 173 (2007), confirmed both the reach of § 280E and the availability of COGS.
[ ] Know the limit. In its Harborside decision, the Tax Court held that a cannabis reseller computes COGS under the inventory rules of § 471 as they applied to it, and may not use § 263A to sweep otherwise-nondeductible selling and administrative costs into inventory. A cultivator's COGS is broader than a retailer's; neither can turn advertising into COGS.
[ ] Build the chart of accounts around the COGS/non-COGS line before year one, and make the operational allocation real: square footage, headcount, time studies, and job codes, documented contemporaneously.
[ ] Be realistic about "separate trade or business" structuring. CHAMP allowed an allocation between a dispensary and a genuinely distinct caregiving services business. Olive v. Commissioner, 792 F.3d 1146 (9th Cir. 2015), rejected the same theory where the second "business" was not separate in substance. The structure must be economically real, separately staffed, separately accounted, and separately priced — or it will fail.
[ ] Expect audit. Keep every record. See Handling an IRS Audit and Tax Controversy: A Comprehensive Guide and The Business Tax Toolkit.
[ ] Track state conformity separately — a growing number of legalized states decouple from § 280E for state income tax purposes.
[ ] Re-run the entire analysis if federal rescheduling occurs: § 280E reaches only Schedules I and II, so a move to Schedule III would change this phase fundamentally. Verify the current status.

Why it matters, and the traps. Section 280E is the reason profitable-looking cannabis companies fail. A dispensary with $10 million in revenue, $6 million in COGS, and $3.5 million in payroll, rent, marketing, and security has $500,000 of book profit — and roughly $4 million of federal taxable income. The tax can exceed the profit.

The traps are all documentation traps. Operators who fail § 280E audits are rarely the ones with an aggressive theory; they are the ones who had a defensible allocation and no contemporaneous evidence for it. If you tell the IRS that 62% of your building is cultivation space, you need the floor plan, the meter data, and the payroll codes that say so — measured then, not reconstructed later.

Phase 11 — Employment

[ ] Apply the ordinary federal employment statutes. They apply to you. The Tenth Circuit held in Kenney v. Helix TCS, Inc., 939 F.3d 1106 (10th Cir. 2019), that FLSA overtime protections cover employees of a state-legal cannabis business notwithstanding federal illegality. See Wage and Hour Law Under the FLSA: A Comprehensive Guide.
[ ] Run background checks lawfully. State cannabis rules require them; the Fair Credit Reporting Act governs how you run them and state ban-the-box and fair-chance laws govern what you may do with the results. See Running Background Checks Under the FCRA: A Practical Checklist.
[ ] Obtain and maintain the state's required employee agent cards, badges, or work permits.
[ ] Write the drug-testing and off-duty-conduct policy to your state's statute, which is the most volatile rule in this whole checklist. Compare Coats v. Dish Network, LLC, 350 P.3d 849 (Colo. 2015) (Colorado's lawful-off-duty-activities statute did not protect off-duty medical marijuana use, because "lawful" means lawful under both state and federal law) with Barbuto v. Advantage Sales & Marketing, LLC, 477 Mass. 456 (2017) (an employee terminated for lawful off-site medical marijuana use could pursue a state handicap-discrimination claim). Several states — California, New York, New Jersey, Connecticut, Nevada, Washington and others — have since enacted express off-duty-use or pre-employment-testing protections, with carve-outs. This is pure state law; look it up.
[ ] Preserve zero tolerance for impairment at work and for safety-sensitive roles. Federal safety-sensitive testing regimes (for example, DOT's rules at 49 C.F.R. Part 40) do not accept a state medical recommendation as an explanation for a positive test.
[ ] Note the ADA does not protect current illegal drug use, 42 U.S.C. § 12114 — but some state disability statutes require accommodation of off-site medical use.
[ ] Expect union organizing; several states require a labor-peace agreement as a licensing condition. Put the policy architecture in a real handbook — see Building a Legally Sound Employee Handbook.

Why it matters, and the traps. The trap is the copied handbook. An operator lifts a zero-tolerance, test-on-hire policy from a generic template and applies it in a state that now prohibits pre-employment THC screening for non-safety-sensitive roles. Every applicant screened out is a potential claim. Rebuild the policy state by state, and re-verify it annually.

Phase 12 — Insurance, contracts, IP, and real estate

[ ] Insurance. Place coverage with a carrier that knows it is insuring cannabis. Non-disclosure is a rescission defense waiting to happen. In Green Earth Wellness Center, LLC v. Atain Specialty Insurance Co., 163 F. Supp. 3d 821 (D. Colo. 2016), the court declined to void a policy on federal-illegality public-policy grounds where the insurer had knowingly issued it — but it also enforced the policy's exclusions. Read the exclusions: living plants, crop, product recall, and product liability are the usual gaps. See Insurance Coverage Law: A Comprehensive Guide for Policyholders and Tendering a Claim and Preserving Coverage: A Policyholder's Checklist.
[ ] Contracts and the illegality defense. Under Restatement (Second) of Contracts §§ 178–181, a promise may be unenforceable on public-policy grounds, and a counterparty who wants out of a cannabis deal will argue exactly that. Courts have split; several have enforced cannabis contracts, reasoning that the parties' expectations and the state's own legalization weigh against forfeiture, while others have refused. Draft defensively: choose the law and forum of a legalized state, sever the offending obligation, and consider an arbitration clause — arbitration keeps the dispute out of a federal court that may decline to enforce the deal. See Drafting an Arbitration Clause: A Practical Checklist.
[ ] Intellectual property. You generally cannot obtain a federal trademark registration for marijuana goods or services: the Lanham Act requires lawful use in commerce, and the TTAB has repeatedly refused registration for cannabis and cannabis-paraphernalia marks on that basis. Build the brand on (a) state trademark registrations, (b) common-law rights, (c) federal registrations for genuinely lawful ancillary goods and services (apparel, media, education, hemp goods meeting the 0.3% delta-9 limit — see AK Futures LLC v. Boyd Street Distro, LLC, 35 F.4th 682 (9th Cir. 2022)), (d) copyright in packaging art and creative content, and (e) trade secret protection for genetics, cultivars, and extraction methods. Understand what you are giving up: see Trademark Fundamentals: A Plain-English Primer and From Brand Idea to Registered Mark: A Trademark Registration Toolkit. Because trade secret is doing the work trademark and patent cannot, stand the program up properly: Standing Up a Trade Secret Protection Program: A Practical Checklist and Trade Secret Law: How Secrecy Becomes Protectable Intellectual Property.
[ ] Real estate. Negotiate the lease knowing your landlord faces real federal exposure: civil forfeiture under 21 U.S.C. § 881 and the drug-involved-premises statute, 21 U.S.C. § 856. Expect (and negotiate) a cannabis-specific rider: express landlord consent and acknowledgment, an above-market rent that prices the risk, a broad indemnity, a regulatory-compliance covenant, a termination right if the law changes, and an assignment provision that survives license transfer rules. Confirm the landlord's lender has consented — a federally regulated mortgagee will often have a due-on-cannabis-use clause. See Commercial Leases: A Comprehensive Guide to Negotiating and Drafting and Reviewing a Commercial Lease: A Practical Checklist.
[ ] Bankruptcy is not available. Federal bankruptcy courts have consistently dismissed cannabis-related cases because a trustee cannot administer assets whose possession violates federal law — see, e.g., In re Arenas, 535 B.R. 845 (B.A.P. 10th Cir. 2015). Plan your workout, your security interests, and your receivership strategy on the assumption that Chapter 11 is closed to you. Read Bankruptcy Law: A Comprehensive Guide to Chapters 7, 11, and 13 for what you are being denied.
[ ] Neighbors and civil RICO. Private plaintiffs have used civil RICO against cannabis operations, and the Tenth Circuit allowed such a claim to proceed in Safe Streets Alliance v. Hickenlooper, 859 F.3d 865 (10th Cir. 2017). Odor, traffic, and property-value theories are the usual vehicle. Odor control is a legal expense, not an HVAC expense.

Why it matters, and the traps. Read those bullets together and you can see the shape of the thing: the ordinary commercial safety net — enforce your contract, register your brand, file for bankruptcy, tender the claim — has holes in it, and the holes are all in the same place. The trap is assuming the safety net is there. Price the risk in the deal, contract around what you can, and never build a business plan whose downside case depends on a Chapter 11 you cannot file.

Phase 13 — Interstate movement: the bright line

[ ] Do not move cannabis, cannabis products, or cannabis money across state lines. Not for a customer, not between your own facilities, not "just samples," not through a state that has also legalized.
[ ] Do not ship product by mail or common carrier. Use of the mails is an independent federal offense.
[ ] Confirm every transport is intrastate, manifested in the state's track-and-trace system, and made by a licensed transporter on a permitted route.
[ ] Train every driver and every employee on this rule, in writing, annually.

Why it matters, and the traps. This is the one place where a compliance failure is unambiguously and immediately a serious federal crime, with no state-law shelter, no appropriations rider, and no plausible confusion. It is also the rule most likely to be broken by a well-meaning employee doing a favor. Make it the loudest rule in your handbook.

Phase 14 — Renewal, inspection, and enforcement

[ ] Calendar every renewal, fee, report, and required filing — including changes of ownership, officers, location, and premises layout, which typically require prior approval.
[ ] Run an internal mock inspection quarterly against the state's own inspection checklist.
[ ] Maintain a corrective-action log: every deficiency found, the fix, the date, and the owner.
[ ] Know the enforcement ladder — notice of violation, fine, suspension, revocation — and the administrative appeal deadline, which is often very short.
[ ] Preserve the record for any contested action from the first day of the dispute. Administrative appeals are usually decided on the agency record.
[ ] Report what the rules require you to report, when they require it — theft, diversion, adverse events, and significant discrepancies almost always carry a short mandatory reporting window.
[ ] Fold all of this into a real compliance function with a named officer, a budget, and a board reporting line — see The Corporate Compliance Toolkit.

Why it matters, and the traps. Cannabis regulators are administrative agencies, and administrative agencies build records. The operator who is candid, self-reports, and documents corrective action gets a fine. The operator who is discovered gets a revocation. The trap is the unreported minor variance that becomes a pattern; the second trap is missing the appeal deadline, which forecloses judicial review entirely.

Common mistakes to avoid

Treating the state license as legality. It is a permit, not a defense.
Signing the lease before checking the city. Local opt-outs, buffers, and moratoria kill more applicants than state regulators do. This is Sable Creek's story and it is avoidable.
Hiding an owner. Convertible notes, revenue shares, management fees, and option grants can all create a disclosable true party of interest. Undisclosed control is the fastest route to revocation.
Papering a social-equity partnership without real equity-holder control. Regulators look through it, and the consequences are severe.
Getting a bank account by misdescribing the business. That converts a regulatory problem into bank fraud.
Structuring deposits to avoid reporting thresholds. An independent federal felony, 31 U.S.C. § 5324. Never.
Discovering § 280E in year two. The COGS allocation must be built into the chart of accounts and the physical operation from day one, with contemporaneous documentation.
Reconstructing allocations for the auditor. Contemporaneous or worthless.
Copying a zero-tolerance drug policy across state lines. Off-duty-use protections now vary sharply by state.
Cartoon packaging, candy look-alikes, and health claims. Three regulators and a brand owner, all at once.
Letting cameras overwrite before the retention period. The footage you cannot produce is the violation.
Manually "fixing" track-and-trace counts. Falsifying a state record.
Assuming a contract will be enforced. Draft for the illegality defense; consider arbitration.
Assuming bankruptcy is a backstop. It is not available to you.
Moving product or cash across a state line. The bright line. Never.

The consolidated cannabis compliance checklist

Before you spend money

[ ] Federal illegality understood, documented, and accepted by every owner
[ ] Current federal status (including any rescheduling) verified
[ ] Individual exposure mapped: immigration, firearms, professional licenses, federal contracts
[ ] Counsel's own ethics position confirmed under the state's Rule 1.2
[ ] Local opt-in, zoning, buffers, caps, and moratoria confirmed before site control

Licensing

[ ] Entity formed; every true party of interest identified and disclosed
[ ] Source of funds documented; regulatory transfer restrictions in the operating agreement
[ ] Eligibility, residency, capital, and background requirements met
[ ] Application built to the scoring rubric; site control secured; local approvals sequenced
[ ] Social-equity structure (if any) reflects genuine ownership and control

Operations

[ ] Security and surveillance built to spec; retention period met and audited
[ ] Track-and-trace integrated; reconciliation cadence set; manual adjustments controlled
[ ] Testing panel, quarantine, and recall SOP in place
[ ] Packaging child-resistant, non-appealing to children, fully labeled, pre-approved
[ ] Advertising age-gated, audience-verified, claim-free, and substantiated

Money

[ ] Bank relationship obtained with full disclosure; BSA/SAR expectations understood
[ ] Cash controls in place; no structuring, ever
[ ] § 280E chart of accounts and COGS allocation built and contemporaneously documented
[ ] State conformity or decoupling from § 280E confirmed

Protection

[ ] Insurance placed with a knowing carrier; exclusions read and gaps priced
[ ] Contracts drafted against the illegality defense; forum and arbitration chosen
[ ] Brand protected by state marks, common law, ancillary federal marks, copyright, trade secret
[ ] Lease rider, landlord consent, and lender consent obtained
[ ] Employment policies rebuilt to the state's off-duty-use and testing statute

Forever

[ ] Nothing crosses a state line
[ ] Renewals calendared; mock inspections quarterly; corrective-action log maintained
[ ] Every regulatory change re-reviewed annually — this body of law moves constantly

Primary Authority

Federal statutes and regulations

Controlled Substances Act, 21 U.S.C. §§ 801–971 (marijuana remains Schedule I); 21 U.S.C. § 841 (manufacture and distribution); 21 U.S.C. § 856 (maintaining drug-involved premises); 21 U.S.C. § 881 (civil forfeiture)
Internal Revenue Code § 280E (no deductions or credits for trafficking in a Schedule I or II controlled substance); IRC § 471 (inventory/COGS); IRC § 263A (uniform capitalization)
Bank Secrecy Act, 31 U.S.C. § 5311 et seq.; 31 U.S.C. § 5324 (structuring); 18 U.S.C. §§ 1956, 1957 (money laundering); FinCEN Guidance FIN-2014-G001, BSA Expectations Regarding Marijuana-Related Businesses (Feb. 14, 2014)
Agriculture Improvement Act of 2018 (2018 Farm Bill), Pub. L. No. 115-334; hemp defined at 7 U.S.C. § 1639o (≤ 0.3% delta-9 THC, dry weight) — the hemp definition has been the subject of recent federal legislation; verify the current text
Lanham Act, 15 U.S.C. § 1051 et seq. (lawful use in commerce required for federal registration); FTC Act § 5, 15 U.S.C. § 45
Federal Food, Drug, and Cosmetic Act, 21 U.S.C. §§ 331, 343, 355 (misbranding; unapproved new drugs)
Fair Labor Standards Act, 29 U.S.C. § 201 et seq.; Americans with Disabilities Act, 42 U.S.C. § 12114 (current illegal drug use not protected); DOT drug-testing procedures, 49 C.F.R. Part 40
18 U.S.C. § 922(g)(3) (firearms and unlawful drug users — constitutionality contested and unsettled)
Child-resistant packaging protocol, 16 C.F.R. § 1700.20 (incorporated by many state cannabis rules)

Cases

Gonzales v. Raich, 545 U.S. 1 (2005) (Commerce Clause reaches intrastate cultivation)
United States v. Oakland Cannabis Buyers' Cooperative, 532 U.S. 483 (2001) (no medical-necessity defense to the CSA)
United States v. McIntosh, 833 F.3d 1163 (9th Cir. 2016) (scope of the medical-marijuana appropriations rider)
Northeast Patients Group v. United Cannabis Patients & Caregivers of Maine, 45 F.4th 542 (1st Cir. 2022) (dormant Commerce Clause invalidated a dispensary residency requirement; courts are split)
City of Riverside v. Inland Empire Patients Health & Wellness Center, Inc., 56 Cal. 4th 729 (2013) (local bans permitted)
Californians Helping to Alleviate Medical Problems, Inc. v. Commissioner, 128 T.C. 173 (2007) (§ 280E applies; COGS available; separate-trade-or-business allocation)
Olive v. Commissioner, 792 F.3d 1146 (9th Cir. 2015) (rejecting a separate-business allocation not real in substance)
Patients Mutual Assistance Collective Corp. v. Commissioner (the Harborside decision, T.C. 2018, aff'd 9th Cir.) (a cannabis reseller's COGS is limited by § 471; § 263A cannot be used to capitalize otherwise-disallowed costs)
Kenney v. Helix TCS, Inc., 939 F.3d 1106 (10th Cir. 2019) (FLSA covers cannabis-industry employees)
Coats v. Dish Network, LLC, 350 P.3d 849 (Colo. 2015) (off-duty-use statute did not protect medical marijuana use)
Barbuto v. Advantage Sales & Marketing, LLC, 477 Mass. 456 (2017) (state handicap-discrimination claim available)
Green Earth Wellness Center, LLC v. Atain Specialty Ins. Co., 163 F. Supp. 3d 821 (D. Colo. 2016) (federal illegality did not void a knowingly issued policy; exclusions still enforced)
In re Arenas, 535 B.R. 845 (B.A.P. 10th Cir. 2015) (bankruptcy relief unavailable)
Safe Streets Alliance v. Hickenlooper, 859 F.3d 865 (10th Cir. 2017) (private civil RICO claim against a cannabis operation may proceed)
AK Futures LLC v. Boyd Street Distro, LLC, 35 F.4th 682 (9th Cir. 2022) (hemp-derived products within the Farm Bill definition are lawful and trademark-eligible)
Trademark Trial and Appeal Board decisions (including In re Brown and In re JJ206, LLC, both 2016) refusing registration of marks for cannabis goods and services for lack of lawful use in commerce

State authority. Your state's cannabis statute, its implementing regulations, and your municipality's ordinance are the operative rules for nearly everything in this checklist. They vary enormously and change often. Nothing above states a nationwide rule of state or local cannabis law.

Tribal authority. Federally recognized tribes are separate sovereigns with their own governments, codes, and courts. Tribal cannabis regulation is not state law and is not described here; a project in Indian country raises distinct questions of federal Indian law and requires specialized counsel.

Secondary sources. Restatement (Second) of Contracts §§ 178–181 (unenforceability on public-policy grounds); ABA Model Rules of Professional Conduct R. 1.2(d) — a model only; the Model Rules bind no lawyer until a state adopts them, adopted rules vary by jurisdiction (California's notably), and there is no national rule of legal ethics; FinCEN and IRS published guidance; state regulator inspection checklists and advisory bulletins.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Marijuana remains a Schedule I controlled substance under federal law; nothing here advises or assists anyone in violating federal law. Cannabis licensing and compliance rules are overwhelmingly state and local, vary enormously by jurisdiction, and change constantly. Verify the current federal status and your own state and local requirements, and consult qualified counsel before acting.