TLDR
Cannabis issuers must disclose the federal illegality of their operations in every filing, address IRC 280E impact on effective tax rates, explain banking limitations that affect capital access, and evaluate going concern implications of potential federal enforcement. Inadequate disclosure in any of these areas compounds with every subsequent filing period.
The Federal-State Regulatory Conflict
Cannabis is the only major industry in the United States where the core business operation is legal under state law in a majority of states but remains a federal crime under the Controlled Substances Act. This fundamental legal conflict creates disclosure challenges that have no precedent or parallel in securities law. When I review cannabis company SEC filings, the adequacy of the federal illegality disclosure is the first thing I evaluate because it is the first thing the SEC staff will evaluate.
The Controlled Substances Act classifies marijuana as a Schedule I controlled substance, meaning the federal government considers it to have a high potential for abuse, no currently accepted medical use, and a lack of accepted safety for use under medical supervision. Despite this classification, as of 2025, the majority of states have legalized marijuana for medical use, recreational use, or both. This federal-state conflict creates a unique set of risks that must be prominently and specifically disclosed in every SEC filing by a cannabis company.
The SEC's position on cannabis company filings is pragmatic: the Commission does not prohibit cannabis companies from becoming public reporting companies, but it requires full and accurate disclosure of all material risks, including the risk that the company's operations, officers, directors, and investors could be subject to federal criminal prosecution. This is not a theoretical risk that can be addressed with a single sentence in the risk factors. It is a fundamental business reality that permeates every aspect of the company's operations, financial condition, and prospects.
Cannabis-Specific Risk Factor Requirements
The risk factors section of a cannabis company's SEC filing must be substantially more detailed and specific than those of companies in traditional industries. Generic risk factors that could apply to any company are insufficient. The SEC staff expects risk factors that are tailored to the specific risks facing a cannabis company, written in language that allows investors to understand the actual nature and magnitude of each risk.
At minimum, the risk factors should address: federal illegality and the risk of prosecution, the potential for changes in federal enforcement policy, the impact of IRC Section 280E on the company's effective tax rate and cash flows, the instability of banking relationships, the limitations on interstate commerce, the regulatory complexity of operating in multiple states with different cannabis regulatory frameworks, the risk of state regulatory changes including license revocation, product liability risks specific to cannabis products, real property risks including federal forfeiture, insurance coverage limitations, and the impact of potential federal legalization on the competitive landscape.
Each of these risk factors should include specific, quantifiable information where available. A risk factor that states "our banking relationships may be terminated" is less useful to investors than one that states "we have experienced three banking relationship terminations in the past 18 months, and our current banking arrangement does not include any contractual protections against termination." The SEC staff will push for specificity, and companies that provide it in the initial filing reduce the number of comment letter rounds.
IRC Section 280E and Financial Disclosure
IRC Section 280E is perhaps the single most significant financial challenge facing cannabis companies, and its impact must be clearly disclosed in both the risk factors and the financial statements. Section 280E provides that no deduction or credit shall be allowed for any amount paid or incurred during the taxable year in carrying on any trade or business if the trade or business consists of trafficking in controlled substances.
In practical terms, Section 280E means that cannabis companies cannot deduct ordinary and necessary business expenses such as rent, utilities, salaries, marketing, administrative costs, or professional fees. The only deduction available is cost of goods sold under IRC Section 263A. This creates effective tax rates that routinely exceed 70%, consuming a substantial portion of operating cash flow and creating persistent financial pressure that must be disclosed as both a risk factor and a material financial consideration.
The financial statement implications of Section 280E require careful accounting treatment and clear disclosure. The MD&A should quantify the impact of Section 280E on the company's effective tax rate, compare the effective rate to what it would be without Section 280E, and explain how the tax burden affects the company's cash flow, growth strategy, and ability to compete with companies in states where cannabis is not yet legal. Auditors must evaluate the Section 280E treatment as part of their audit procedures, and any uncertainties in the tax position should be disclosed under ASC 740.
Banking and Capital Markets Challenges
The inability to maintain stable banking relationships is a material operational risk for cannabis companies that must be prominently disclosed. Federal money laundering statutes create criminal liability risk for financial institutions that knowingly process funds derived from the sale of marijuana. While FinCEN guidance issued in 2014 provides a framework for financial institutions to serve cannabis businesses, the guidance does not provide a safe harbor from criminal prosecution, and most major banks have declined to serve the industry.
Cannabis companies that do obtain banking services typically work with smaller banks or credit unions that have developed specialized cannabis banking programs. These relationships are fragile and can be terminated with little or no notice if the financial institution's regulators express concern or if the institution's risk tolerance changes. Companies should disclose the nature of their current banking arrangements, any contractual protections (or lack thereof), the history of banking relationship terminations, and the operational plan for managing cash-intensive operations if banking services are lost.
The capital markets challenges extend beyond banking to include limitations on the use of certain payment processing services, restricted access to public capital markets (many U.S. exchanges will not list cannabis companies), and limitations on the availability of traditional debt financing. These limitations affect the company's cost of capital, its ability to grow, and its competitive position, all of which must be disclosed.
State Licensing and Compliance Disclosure
Cannabis companies operate under state licenses that are the foundation of their right to conduct business. The disclosure of these licenses must be comprehensive and specific. Investors need to understand not only what licenses the company holds but also the terms and conditions of those licenses, the regulatory requirements for maintaining them, the renewal process and timeline, any regulatory actions or citations that affect the licenses, and the financial and operational impact of potential license loss.
Each state's cannabis regulatory framework is different, creating a patchwork of compliance obligations that must be navigated and disclosed. Some states limit the number of licenses available, creating scarcity value. Others have open or expanding license frameworks. Some states permit vertical integration (cultivation, processing, and retail under a single license), while others require separate licenses for each function. These regulatory differences affect the company's competitive position and growth strategy in each state and should be addressed in the business description and MD&A.
Companies should also disclose any pending or threatened regulatory actions, investigations, or compliance reviews by state cannabis regulators. The loss of a single state license can have a material impact on the company's revenue and operations, particularly if the company operates in a limited number of states. The disclosure should help investors understand the company's regulatory compliance track record and the risks associated with the regulatory environment in each state of operation.
SEC Comment Letter Patterns for Cannabis
Based on my review of publicly available SEC comment letters for cannabis companies, several recurring patterns emerge. The most common comment category relates to the adequacy of risk factor disclosure. The SEC staff consistently pushes cannabis companies to provide more specific risk factors that address the actual risks facing the company, rather than generic statements about regulatory uncertainty.
Revenue recognition is the second most common comment category. Cannabis companies must explain their revenue recognition policies in the context of an industry where products cannot be shipped across state lines, where pricing is affected by regulatory structures, and where different states have different product categories and pricing frameworks. The staff expects companies to explain how these industry-specific factors affect the timing and amount of revenue recognized.
Consistency between SEC filings and marketing materials is the third pattern. The SEC staff reviews cannabis company websites, press releases, and social media in conjunction with SEC filing reviews. When marketing materials present an optimistic picture of the company's prospects that is not reflected in the risk factors or MD&A, the staff will issue comments asking the company to explain the inconsistency or enhance its SEC disclosure to provide a more balanced presentation.
Cannabis-Specific Enforcement Exposure
Cannabis companies face enforcement exposure on multiple fronts: SEC enforcement for disclosure violations, DOJ enforcement for federal drug laws, state regulatory enforcement for cannabis compliance violations, and IRS enforcement for tax positions related to Section 280E. Each of these enforcement risks must be evaluated and disclosed in the context of the company's specific operations and compliance history.
From my SEC enforcement experience, the cases that generate the most attention are those where cannabis companies provide misleading disclosure about the stability of their operations, overstate the likelihood of favorable federal legislative action, understate the financial impact of Section 280E, or fail to disclose material regulatory actions or changes in banking relationships. These disclosure failures create enforcement liability under Section 10(b) and Rule 10b-5, regardless of the underlying legality or illegality of the cannabis operations.
The key insight for cannabis companies is that enforcement exposure from securities law violations is separate from and additional to enforcement exposure from operating in a federally illegal industry. A cannabis company that provides thorough, accurate, and timely disclosure can significantly reduce its securities enforcement risk, even though it cannot eliminate the underlying risk of federal prosecution for drug law violations. The disclosure obligation is the controllable variable.
Disclosure Best Practices
The most effective disclosure strategy for cannabis companies is comprehensive candor. Investors in cannabis companies are generally aware that they are investing in a federally illegal industry. They do not need to be protected from this fact. They need to understand the specific implications of this fact for the company in which they are investing. Disclosure that attempts to minimize or obscure the risks of federal illegality undermines investor confidence and creates enforcement exposure.
Best practices include maintaining a cannabis-specific risk factor section rather than burying cannabis risks among generic business risks, quantifying the impact of Section 280E in the MD&A with comparative analysis, updating banking relationship disclosure in each periodic filing, disclosing state-by-state regulatory developments that affect operations, ensuring consistency between marketing communications and SEC filings, and addressing potential federal legalization or rescheduling with balanced disclosure of both opportunities and risks.
Cannabis companies that adopt these disclosure practices consistently achieve better outcomes in the SEC review process, maintain stronger relationships with the investor community, and reduce their enforcement risk profile. The additional cost of comprehensive disclosure is a fraction of the cost of defending an enforcement action or managing the market impact of a disclosure failure.
10 Key Points
- 1.Cannabis companies face a unique disclosure burden because their core business operations are legal under state law but illegal under federal law, creating risk factors that have no parallel in any other industry.
- 2.The SEC does not prohibit cannabis companies from becoming public reporting companies, but it requires thorough disclosure of the risks arising from the federal-state regulatory conflict, including the risk of federal prosecution.
- 3.IRC Section 280E prohibits cannabis companies from deducting ordinary and necessary business expenses, limiting deductions to cost of goods sold. This has material financial statement implications that must be clearly disclosed.
- 4.Banking relationship risk is a critical disclosure item. Cannabis companies frequently lose banking relationships with little or no notice, which can create going concern issues and must be disclosed as a material risk.
- 5.State licensing disclosure must go beyond listing the licenses held. Companies must disclose license renewal requirements, conditions, regulatory actions, and the impact of license loss on the company's ability to operate.
- 6.SEC comment letters for cannabis companies are typically longer and more detailed than for companies in traditional industries. Staff reviewers apply heightened scrutiny to risk factors, MD&A, and revenue recognition.
- 7.Cannabis companies should anticipate that their filings will be compared against marketing materials, website content, press releases, and social media for consistency. Optimistic marketing language that contradicts SEC disclosure creates enforcement risk.
- 8.The lack of interstate commerce for cannabis products creates unique revenue recognition and segment reporting challenges that must be addressed in the financial statements and MD&A.
- 9.Going concern analysis for cannabis companies must account for the risk that federal enforcement action could terminate all operations, banking relationship instability, and the impact of 280E on cash flows.
- 10.Flat-fee counsel arrangements are particularly valuable for cannabis companies because the enhanced disclosure requirements and heightened SEC scrutiny generate significantly more legal work than comparable filings in traditional industries.
Frequently Asked Questions
Can cannabis companies go public and file with the SEC?
Yes. The SEC does not prohibit cannabis companies from becoming reporting companies or from filing registration statements, periodic reports, or Regulation A+ offering circulars. However, the SEC requires thorough disclosure of all material risks associated with operating in an industry that is illegal under federal law. Several cannabis companies are currently SEC reporting companies with shares trading on OTC Markets and Canadian exchanges.
What risk factors must cannabis companies include in their SEC filings?
Cannabis companies must include risk factors addressing federal illegality and the risk of federal prosecution, IRC Section 280E tax treatment, banking relationship instability, state regulatory uncertainty, interstate commerce restrictions, the impact of potential federal legalization or rescheduling, product liability risks, supply chain limitations, real property risks (including forfeiture), insurance limitations, and the difficulty of attracting and retaining qualified personnel due to federal illegality.
What is IRC Section 280E and how does it affect cannabis companies?
IRC Section 280E provides that no deduction or credit shall be allowed for any amount paid or incurred in carrying on any trade or business that consists of trafficking in controlled substances. Because marijuana remains a Schedule I controlled substance under federal law, cannabis companies cannot deduct ordinary business expenses such as rent, salaries, marketing, or administrative costs. They can only deduct costs of goods sold. This creates effective tax rates that can exceed 70% and has material implications for financial statements and cash flow.
How do banking challenges affect cannabis company disclosure?
Most banks and credit unions will not serve cannabis companies due to federal money laundering concerns. Companies that do obtain banking services face the constant risk of account closure with little or no notice. This risk must be disclosed as a material risk factor, and any actual banking relationship termination should be evaluated for Form 8-K reporting. The absence of reliable banking services also affects the company's ability to process payments, pay employees, and manage cash flow.
What SEC comment letters do cannabis companies typically receive?
Cannabis companies typically receive comments about the adequacy and specificity of federal illegality risk factors, the consistency between marketing claims and SEC disclosure, revenue recognition policies for products that cannot cross state lines, the treatment of IRC Section 280E in financial statements, going concern analysis, related party transactions, the impact of state regulatory changes on operations, and the company's assessment of the likelihood and impact of federal enforcement action.
How should cannabis companies handle MD&A disclosure?
The MD&A for cannabis companies must address the impact of IRC Section 280E on financial results, the company's banking situation and any recent changes, state regulatory developments that affect operations, market conditions in each state of operation, the competitive landscape within the constraints of the interstate commerce prohibition, and any material changes in the federal regulatory environment. Generic industry discussions are insufficient; the SEC staff expects specific, quantitative analysis.
What are the going concern implications for cannabis companies?
Cannabis companies face unique going concern considerations because federal enforcement action could terminate all operations, banking relationships can be terminated without notice, IRC Section 280E creates persistent cash flow pressure, and state license renewals are not guaranteed. Auditors must evaluate these factors in their going concern assessment, and the company's disclosure must adequately address how management plans to mitigate these risks.
Can cannabis companies use Regulation A+ to raise capital?
Yes. Cannabis companies can file on Form 1-A for Regulation A+ qualification. The SEC has qualified several cannabis company offerings under Regulation A+. However, the qualification process typically takes longer than for companies in traditional industries because the SEC staff applies heightened scrutiny to cannabis-related disclosures. The Offering Circular must thoroughly address all cannabis-specific risk factors and regulatory challenges.
How do state licensing requirements affect SEC disclosure?
Cannabis companies must disclose all material licenses held, the terms and conditions of those licenses, renewal requirements and timelines, any regulatory actions or citations, the financial impact of potential license loss, and the regulatory requirements for each state of operation. License disclosure should be specific enough for an investor to understand the regulatory framework governing the company's operations in each jurisdiction.
What happens if federal law changes regarding marijuana?
If marijuana is reclassified or descheduled under federal law, the impact on cannabis companies would be transformative but also disruptive. Companies must disclose the risks and opportunities associated with potential federal legalization, including increased competition from larger companies, changes in the tax treatment under IRC Section 280E, potential federal regulatory requirements, and the impact on existing state-by-state market structures.
How should cannabis companies handle marketing vs. SEC disclosure?
Cannabis companies must ensure consistency between their marketing communications and SEC filings. The SEC staff routinely compares company websites, social media, press releases, and marketing materials against the risk factors and business descriptions in SEC filings. Optimistic marketing language about market size, growth projections, or regulatory outcomes that is not reflected in or is contradicted by SEC filings creates enforcement exposure for misleading disclosure.
What are the insurance challenges for cannabis companies?
Cannabis companies face significant limitations in obtaining standard business insurance policies due to federal illegality. Many insurers will not underwrite cannabis operations, and those that do typically charge significantly higher premiums with more limited coverage. This insurance gap must be disclosed as a risk factor, and the actual insurance coverage maintained by the company should be described in sufficient detail for investors to evaluate the adequacy of coverage.
How does the interstate commerce prohibition affect financial reporting?
Because cannabis cannot legally be transported across state lines, each state operation is effectively a separate market. This creates unique segment reporting considerations, as each state operation may have different revenue characteristics, cost structures, and regulatory environments. Revenue recognition must be evaluated in the context of state-by-state operations, and the MD&A should address financial performance by state or region where material.
What should cannabis companies disclose about real property?
Cannabis companies should disclose that real property used in cannabis operations may be subject to federal asset forfeiture under the Controlled Substances Act, that landlords may terminate leases if they become aware of or uncomfortable with cannabis operations, that property financing is limited due to federal illegality, and that zoning restrictions specific to cannabis operations may affect the company's ability to operate or expand in certain locations.
How do cannabis companies handle employee-related disclosure?
Cannabis companies should disclose challenges in attracting and retaining qualified personnel due to the stigma associated with federal illegality, limitations on employee benefit plans due to federal tax treatment, difficulties in maintaining workers' compensation coverage, the impact of federal background check requirements on cannabis industry employees, and the competitive labor market within states with limited cannabis licenses.
What are the supply chain disclosure requirements for cannabis companies?
Cannabis companies must disclose that their supply chains are inherently limited to single-state operations, that they cannot source product or materials across state lines, that supply disruptions within a single state cannot be mitigated through interstate sourcing, and that supply chain risks include regulatory changes, crop failures, quality control issues, and vendor relationship instability, all within the confines of a single state market.
How should cannabis companies disclose related party transactions?
The SEC staff scrutinizes related party transactions in cannabis company filings with particular attention because the industry's reliance on alternative financing arrangements and the limited number of service providers willing to work with cannabis companies create a higher frequency of related party arrangements. All related party transactions must be disclosed in accordance with ASC 850, with specific attention to the business justification and the terms compared to arm's length transactions.
What is the impact of SAFE Banking Act developments on cannabis disclosure?
Cannabis companies should disclose the current status of federal banking legislation such as the SAFE Banking Act, the potential impact of such legislation on the company's banking relationships and cost of capital if enacted, and the risk that the legislation may not pass or may be enacted in a form that does not provide the protections the company anticipates. Forward-looking statements about the impact of potential legislation must be accompanied by meaningful cautionary language.
How does a flat-fee arrangement benefit cannabis company SEC compliance?
Cannabis companies require significantly more legal work for SEC compliance than companies in traditional industries. The enhanced risk factor requirements, heightened SEC scrutiny, longer comment letter reviews, and cannabis-specific disclosure challenges generate more drafting, more comment letter rounds, and more ongoing counsel involvement. Flat-fee arrangements ensure that this additional work is performed without economic pressure to reduce the scope or quality of disclosure.
What is the most important disclosure principle for cannabis companies?
The most important principle is candor. Cannabis companies must be forthright about the risks of operating in a federally illegal industry. The SEC staff and enforcement attorneys have no tolerance for cannabis company filings that downplay or obscure the fundamental legal risk. Companies that provide clear, specific, and thorough disclosure of cannabis-specific risks consistently achieve better regulatory outcomes than companies that attempt to minimize these disclosures.
This article was written by Frederick M. Lehrer, Esq., a former SEC Division of Enforcement Staff Attorney and Special Assistant United States Attorney (Southern District of Florida) with over 30 years of securities law experience. Florida Bar No. 888400.