In 2025, cannabis banking crossed an inflection point that many financial services executives might have anticipated but few fully prepared for. Let me state clearly: there was no definitive resolution to the long-standing conflict between federal prohibition and state-level cannabis legalization, nor did it usher in a simple expansion of permissible banking activity. Instead, it produced something more complex and, in many ways, more challenging: an equal mix of opportunity and risk driven by federal rescheduling momentum on one side and a simultaneous tightening of rules around low-THC and hemp-derived products on the other. For banks, particularly those operating in states where recreational cannabis remains illegal, this new landscape demands sharper strategic choices, more granular compliance frameworks, and a willingness to confront exposure that may already exist whether or not it is formally acknowledged.

The most visible catalyst for renewed optimism in cannabis-adjacent financial services was the federal push to reclassify marijuana from a Schedule I to a Schedule III substance under the Controlled Substances Act. That momentum, culminating in a December 18, 2025 executive order directing the Department of Justice to move expeditiously toward rescheduling, sent a powerful signal to markets, operators, and boards alike. Schedule III status would acknowledge accepted medical use of cannabis, permit expanded research, and critically for operators, remove the punitive tax burden imposed by IRS Section 280E. From 10,000 feet, this looked like a long-awaited normalization event. In reality, for banks, it is best understood as a partial thaw rather than a full-fledged spring.

Most importantly, rescheduling does not legalize cannabis at the federal level, nor does it eliminate the fundamental conflict that has kept most federally regulated banks on the sidelines. Marijuana would remain illegal outside tightly controlled medical and research contexts, and state-licensed recreational markets would still operate in conflict with federal law. The practical constraints that shape examiner expectations, BSA/AML obligations, and reputational risk assessments remain largely intact unless and until Congress acts. For financial institutions that interpret Schedule III as a green light to broadly expand THC-touching banking services, the risk is not theoretical, it is real and regulatory based.

While executive attention is focused on rescheduling, a quieter but more operationally significant shift was unfolding in the low-THC and hemp-derived products market. Since the passage of the 2018 Farm Bill, a wide array of intoxicating cannabinoid products, such as Delta-8, Delta-10, THCA flower, hemp-derived gummies, beverages, and vapes had exploded across the country, often sold in convenience stores, wellness boutiques, smoke shops, and on many online platforms. Many of these products thrived in states without legal recreational cannabis, filling consumer demand through what was widely perceived as a legal loophole. For banks, this segment often appeared safer than state-licensed marijuana, leading to indirect exposure through ordinary retail, payments, and small-business banking relationships.

In 2025, that perception began to break down. Congress enacted significant changes to federal hemp definitions and oversight as part of a broader spending package, marking the most consequential revision to hemp policy since legalization. At the same time, states accelerated enforcement actions focused not on the mere presence of cannabinoids, but on how these products were marketed, labeled, and sold. Restrictions increasingly targeted product forms that appealed to younger consumers, imposed age related requirements, curtailed certain health or wellness claims, and limited advertising practices. Texas became a bellwether state, moving aggressively to regulate THC-containing vape products and impose penalties tied to marketing and retail behavior rather than chemical thresholds alone.

For banks like those FNBB serves, this represented a material shift in risk. Exposure is no longer confined to clearly identifiable marijuana-related businesses. It was embedded in merchant related commerce that, on the surface, looks entirely conventional. A convenience store, beverage distributor, e-commerce seller, or hospitality venue might derive a growing share of revenue from hemp-derived intoxicants, with legality hinging on constantly evolving state interpretations and enforcement priorities. The compliance challenge moved from determining whether a business sold cannabis to determining whether it sold the “right” cannabinoid products in the “right” way, with compliant marketing, labeling, and customer access controls. That is a much harder question to answer and one that changes frequently.

This dynamic has created a paradox for banks in states where recreational cannabis remains illegal. Many institutions in these states believe they are insulated from cannabis risk because they do not knowingly bank entities in the seed to sale ecosystem, such as cultivators or dispensaries. In practice, their exposure may be broader and less controlled than that of banks operating in fully legalized states with formal cannabis banking programs. Payment disruptions, sudden processor terminations, elevated chargebacks, and forced shifts to cash-intensive behavior often begin in the hemp and low-THC segment, not in the regulated dispensaries. These events introduce BSA/AML noise, fraud risk, and customer friction that can quickly escalate into supervisory concerns if not anticipated.

Compounding the issue is the fact that enforcement in the low-THC space frequently flows through consumer protection, licensing, or attorney general actions rather than traditional cannabis regulators. This places pressure on banks’ consumer compliance, UDAAP monitoring, and third-party risk management functions, areas not always aligned with cannabis-specific policies. A merchant’s marketing misstep, such as cartoon branding, inadequate age verification, or aggressive wellness claims, can trigger account reviews, disputes, or reputational fallout that ripple back to the financial institution. In states where public sentiment remains skeptical of cannabis, these events can carry outsized reputational weight.

Despite these challenges, 2025 also clarified where real opportunity exists for banks willing to be strategic. The most sustainable revenue is not found in rushing to bank THC-heavy operators but in choosing defensible lanes aligned with institutional risk appetite and examiner expectations. For example, banking the “boring” cannabis-adjacent supply chain, such as equipment providers, packaging firms, landlords, security companies, and professional services, offers stable deposits and treasury relationships without direct exposure to THC handling. Similarly, institutions that develop genuine expertise in hemp and low-THC compliance can differentiate themselves by providing enhanced onboarding, monitoring, and advisory support to merchants navigating regulatory volatility. In an environment where rules change faster than business models, guidance becomes a valued service.

There is also room for innovation, albeit with caution. One emerging idea is the creation of structured account offerings that explicitly price regulatory volatility. For example, a commercial account tier designed for cannabinoid-exposed merchants could include enhanced monitoring, higher fees, stricter transaction controls, and predefined escalation paths if payment processors exit or rules change. Such a model treats regulatory uncertainty as a known risk to be managed, rather than an external shock. It is not for every institution, but it reflects a more honest alignment between risk and revenue.

What will undermine cannabis-adjacent banking strategies in 2026 is not regulatory hostility so much as conceptual laziness. Assuming that Schedule III resolves banking barriers, treating low-THC merchants as ordinary retail customers, or relying on outdated policies written for a simpler era are all recipes for supervisory and reputational trouble. The institutions that struggle will be those that cling to outdated singularity, i.e.: cannabis versus non-cannabis, while the regulatory world moves decisively toward nuance.

The defining lesson of 2025 is that cannabis banking is no longer about whether to participate; it is about how exposure manifests and whether it is intentional, monitored, and priced appropriately. Schedule III momentum may eventually lead to congressional action, but it does not eliminate the need for disciplined risk management today. At the same time, the tightening of hemp and low-THC rules means that avoidance is no longer a reliable strategy. Exposure is already present in your current customer base.

For financial services executives, particularly in non-recreational states, the strategic imperative is clear. Choose your lane. Update your strategic plan. Align marketing and product compliance monitoring with how enforcement actually works. Prepare for rescheduling without overselling its impact. And above all, recognize that the cannabis question for 2026 is less about ideology or legality and more about operational reality. The banks that succeed will be those that acknowledge that reality early and design for it deliberately.

Author’s Note: Background data for this article was compiled using ChatGPT 5.2.