By Joshua Horn, Partner and Co-Chair, Cannabis, Fox Rothschild LLP
Can a regulator really be my friend? Maybe not, but it is always worth the effort to get ahead of and manage your regulatory risk.
Key Takeaways
- Cannabis businesses may answer to multiple regulators beyond their primary state cannabis regulatory agency, including federal, state and local authorities.
- Operators should identify the key people within their regulatory agencies and develop professional working relationships before problems arise.
- Proactive communication can help operators resolve situations where statutes, regulations or agency guidance do not provide a clear answer.
- Credibility with regulators can become particularly valuable when an operator must disclose a compliance problem or challenge a regulator's position.
- Operators should understand when disclosure is legally required and when voluntary disclosure may prevent an issue from becoming more serious.
- Experienced cannabis regulatory counsel can help operators manage regulatory risk while allowing the company to maintain the direct relationship with its regulators.
Who Actually Regulates a Cannabis Business?
As crazy as it may seem, what often gets missed with state licensees is knowing who oversees them from a regulatory perspective. There are, of course, the obvious state regulatory authorities with which licensees are inextricably intertwined. But are there others? For example, as of the writing of this article, the United States Drug Enforcement Administration ("DEA") for medical marijuana licensees who have sought DEA registration. What about state environmental regulators when it comes to the operation of a cultivation facility? You also cannot forget federal and state departments of labor when it comes to working conditions and ensuring payment of wages and benefits for your employees. And how about local municipalities, which, under certain state regimes, can decide whether and how a state licensee can operate at the local level? This amalgamation of regulators raises the fundamental question of how to manage it all.
Know the Key People, and Treat Regulators as Business Partners
Throughout my career in this highly regulated space, working with state licensees and their regulators, the first key is to understand who the key constituents at the regulator are. If you do not know who these people are, you may become lost in a regulatory wilderness. Who heads the authority? Who spearheads compliance? Who is in charge of site inspections? Once I know who the key players are, I have found the best approach is to treat your regulators as your "business partners," and those individuals as the face of your partnership. You cannot operate without a solid relationship with them, understanding, of course, that you will not always see eye to eye and must be adverse from time to time. Even if the worst-case scenario comes to pass, it is still important to work together as best you can, because there are other matters that will need to be addressed going forward. Being too adversarial is not a pathway to success.
From my perspective, you need to meet and get to know the people at your regulators as best you can, because they can be an invaluable resource for asking questions and addressing problems before they get out of control. Budgets permitting, it is also helpful to have a state lobbyist who can help you work with the back office, so to speak, including facilitating introductions that may prove useful in the future.
Using the Relationship When the Rules Are Not Clear
I have had many situations where the applicable statute, regulations or available guidance from the state marijuana regulatory authority did not address a particular circumstance. Having a solid working relationship with these regulators has given me the opportunity to reach out to the regulator or its counsel, raise the gap in the law, regulations or guidance, and try to steer the regulator in the client's direction, or simply get clarity on how the regulator wishes us to proceed. This approach works. It helps you avoid the regulatory upset, and the possibility of fines or other sanctions, that can come from simply acting how you want instead of working to get buy-in on your contemplated approach. Treating the regulator as your partner as much as possible provides you with this window of opportunity.
Three Real-World Examples
1. Building a Proactive Regulatory Relationship
In one state where I have a good working relationship with the marijuana regulatory authority, our client wanted to host an in-person meeting at one of its facilities as a kind of meet and greet. Ultimately the regulator agreed, and we met with the head of that program, its compliance teams and its policy leaders. We toured the facilities together and met with them for some time both before and after the tours. This casual meeting gave us the chance to ask the regulator what our client was doing right and what it could improve upon to make things easier for the regulator and the client alike. But for a solid working relationship with this regulator, the meeting would never have happened, and the client would never have received valuable feedback that helps it remain fully compliant with the state regime while maintaining a meaningful working relationship with the regulator.
2. Proactively Disclosing a Serious Compliance Issue
That was a friendly exchange, almost a group think about how to improve. But what about when you have to disclose something not so good to a regulator? How do you know when you should, and what should you say? I always believe in over-disclosing an adverse event because, by doing so, any pain to be inflicted by the regulator may be mitigated. If the regulator finds out on its own and learns that you knew and said nothing, it will be far worse. One incident comes to mind.
A client that operates a grow facility found that it had lackluster security, driven by a culture that was not entirely conducive to full compliance. From reviewing video, it appeared a security guard was taking flower out the back door, literally. The client called me at 5 p.m. on a Friday when I was on my way to watch my son play water polo. I conducted an internal investigation over the weekend. Although we could not definitively establish that there had been diversion, we terminated the guard, revisited the relationship with the guard company, and terminated the company's COO, who happened to be a co-founder, because he had fostered a culture of non-compliance. On that Monday, we wrote to the regulator, disclosed what had happened and set forth our mitigating efforts, including the termination of the co-founder. While the potential diversion could have brought fines or worse, the regulator did little more than thank us for being candid, and the client never heard from the regulator about the incident again: no penalties, no fines, no sanctions. The important thing is that the client earned a great deal of credibility with the regulator by being up front in the face of the risk of real pain. It worked.
3. Knowing When to Push Back
There is a third type of communication with a regulator that is not so friendly. We had a client with a dispensary that had a water leakage problem. We asked the regulator to let us close and relocate the facility. At first the regulator pushed back, until we could demonstrate that there was black mold in the facility that put everyone at risk. Even though the regulator agreed we could shut down the location, it was going to charge our client the fee for opening a new store, as opposed to a relocation, which was not supported by the statute or the regulations. We pushed back and argued that what they were doing was trying to enforce an illegal rule (more on that in another article). The regulator backed down, the client relocated and only had to pay the smaller relocation fee. I believe this worked because of a longstanding good working relationship with this regulator and a client with credibility in the state. And when I raised the issue of an illegal rule and cited the case that the regulator had lost on that basis, they knew where this was heading if we did not reach an arrangement that worked for us both.
The Lesson: Never Lose Your Credibility
These are only three examples of the types of communications you can have with a regulator, but the lesson I have learned from handling these matters is to maintain your credibility. Develop a positive working relationship with your regulators, so that when times are not so great, the possible wrath may be much less than if you treat your regulators like an enemy. Even when you are "enemies," never lose your credibility. You can be in a fight and still maintain respect. Sometimes you get what you give.
Frequently Asked Questions About Cannabis Regulators and Compliance
In my experience, operators frequently ask the same questions. Here are some of them.
Who are my regulators other than the state cannabis regulator?
This is homework you need to do before you jump into the pool. In some states and cities you may be obligated to have a community agreement, which is more or less another license altogether. You may also have zoning boards or local licensing obligations, depending on the type of business you have. You need to be aware of OSHA, the DOL, the DEA, the IRS, and state and local taxing authorities. Do your homework on the front end to make sure it is worthwhile.
When should you proactively reach out to a regulator?
The easy answer is when you have a duty to report under applicable law. Treating something with therapeutic neglect does not get better with age; it is not like a fine red wine. That is the obvious case. But what about the not so obvious? My litmus test, which varies with the circumstances, is whether the situation, if undisclosed, could explode into something bigger than it should be. If so, you should disclose. This is an art, not a science, and it exemplifies why it is so important to have a strong relationship with your regulator and experienced cannabis regulatory counsel.
What do you do if the regulators do not really answer the questions you ask?
Sometimes, no matter how many times you ask, you do not get a clear answer. In my experience, that is a message that the regulator does not know the answer and has never dealt with the issue. As silly as it may sound, there can be a potential upside to not receiving a clear answer. If you then do the very thing you asked about, the regulator has little room to say you violated the law, so sometimes a non-answer is actually a good answer for you.
When should you get your lawyers involved?
Although some may see this as self-preservation, you should have an experienced cannabis regulatory lawyer engaged as soon as you think there may be a regulatory issue. You need an objective sounding board who is not just going to nod her head and say what you want to hear. Even though clients engage me early in the process, nine times out of ten I stay in the background, ghostwrite letters and provide talking points, and have the client interact directly with the regulator. Having an attorney start the communication in the first instance could send the wrong message of an adversarial process. You can always ramp up; you can never ramp down. But having an experienced cannabis lawyer in your corner is key. After all, would you go to a proctologist if you needed heart surgery?
About the Author
Joshua Horn
Partner and Co-Chair, Cannabis, Fox Rothschild LLP
For assistance with cannabis regulatory matters, contact Joshua Horn or a member of Fox Rothschild's Cannabis Law practice.
Connect With Cannabis Industry Experts
Cannabis LAB brings together operators, attorneys, accountants, bankers, consultants and other cannabis industry professionals through education, events, resources and year-round relationship building. Explore our Florida cannabis networking guide, browse the CLAB Business Directory, or see upcoming CLAB events.
Related Resources
- Florida Cannabis Regulations in 2026: What MMTC Operators Need to Know About the New Rulemaking Era
- Cannabis Banking Readiness: What Operators and Ancillary Businesses Need Before Opening an Account
- How to Start a Cannabis Business in Florida
- How to Write a Cannabis Business Plan
This article is provided for informational purposes only and should not be considered legal, accounting, tax, audit, regulatory, investment, or business advice. Readers should consult qualified professionals regarding their specific circumstances.
