Cannabis Businesses See Frequent D&O and Cyber Losses

As demand grows for both medical and recreational marijuana, manufacturers, distributors, retailers, and other industry players are exposed to evolving risks related to regulation and product usage. Review the following article to understand some of the risks cannabis businesses face and get a glimpse into the losses they are experiencing, according to Advisen data.

Industry Composition and Related Risks

For cannabis to reach the market, it must be grown, distributed, produced and sold. Each level of production comes with its own set of risks. Here are some of the primary types of cannabis-related businesses (CRBs) and summaries of the exposures they face at different stages of production:

• Cannabis dispensaries—Medical or recreational cannabis is sold from dispensaries. In addition to typical general liability and property damage risks, dispensaries are exposed to a high risk of theft. One report found that employees steal 2%-3% of the $700 million Colorado cannabis market. Shoplifting, robbery and break-ins are also risks for cannabis dispensaries. Dispensaries also have significant exposures to cyber threats from in-store technology like point-of-sale systems.
• Cannabis cultivators—Cultivators grow cannabis for commercial use. To grow cannabis on a commercial level, cultivators must invest in equipment, lighting, seeds and security. Such infrastructure is expensive, leading to concerns of equipment breakdown and vandalism. The industrial lighting and growing equipment used by cultivators produce significant heat, creating a high risk of fire. Cabling used to power equipment can also short-circuit and ignite. Insider theft is also a serious concern for cultivators. Dishonest employees may cut leaves or stems from growing plants, reducing product yield.
• Cannabis manufacturers—Manufacturers store and process cannabis for sale. They are exposed to potentially costly repairs if equipment breaks down. Business interruption costs are also a risk if the breakdown of equipment stalls production. Additionally, it’s important for manufacturers to prevent product tampering or product impurities that could make customers sick and expose manufacturers to liability.
• Cannabis landlords—Landlords of CRBs have the same property, liability and business income exposures as any landlord. However, a big difference is that federal regulation of cannabis and cannabis-related products may make it difficult for landlords of CRBs to get claims paid from their insurers if they were unaware the tenant was a CRB.
• Cannabis laboratories—Testing laboratories determine the level of THC in cannabis products and the levels of mold, pesticides and pests. These laboratories are at risk for errors and omission lawsuits as well as product liability and property exposures.
• Cannabis delivery businesses—Delivery businesses may be held responsible for damage to vehicles, injuries and medical bills in the event of an automobile accident.
• Cannabis physicians—Physicians that prescribe non-FDA medications, such as cannabis, typically won’t be covered by insurers. This opens them up to errors and omissions lawsuits as well as allegations of negligence and malpractice if a patient has unwanted side effects from cannabis.

While these risks are specific to certain aspects of cannabis production, other exposures provide challenges throughout the industry.

Advisen Data:

Given the rapid changes that have taken place in the cannabis industry, many cannabis-related losses are still in litigation or have yet to be collected by Advisen. While Advisen data contains over 400 of these losses, the database focuses primarily on large and significant losses. Therefore, these statistics may not be fully representative of the threat landscape faced by CRBs. Here are the most frequent types of losses at CRBs, according to Advisen data:

Directors and officers (D&O) is the most frequent line of business to have cannabis-related losses at 36%, followed by cyber at 19%.

D&O Losses at CRBs

CRBs are particularly vulnerable to D&O lawsuits due to a lack of established standards regarding cannabis products and regulatory uncertainty over the legality of cannabis. These uncertainties may cause a CRB’s stock value to decline (if the business is a public company), resulting in shareholder lawsuits alleging directors and officers failed to properly navigate regulatory obstacles or made misleading statements about a product’s clinical trial results.

Securities class action is one of the most common types of D&O losses at CRBs. Capital regulatory action and derivative shareholder action are also common loss causes.

Unauthorized contact or disclosure accounts for the majority of CRBs’ cyber losses at 69%. Such infractions include any event in which information is shared with unauthorized parties. Malicious data breaches account for 15% of cyber losses, and unintentional disclosure accounts for 10%.

When a cyber loss occurs at a CRB, Advisen data shows personal identifiable information (e.g., name, address, Social Security number, etc.) is the most frequently targeted. Personal health information and personal financial information were targeted less frequently.

Regulatory Risks

Some form of medical or recreational cannabis is legal in most states. But at the federal level, cannabis remains a Schedule 1 drug, which is illegal to produce and distribute. The inconsistencies between state and federal laws often create problems for CRBs because of the following reasons:

• Lack of insurance options—Many traditional standard market insurers have avoided writing policies for CRBs due to the fact that cannabis remains illegal at the federal level. As a result, CRBs have often had to obtain coverage in the excess and surplus marketplace at a high cost and with less comprehensive policy terms and conditions. For some, the inability to procure proper and affordable insurance has made starting and operating a new cannabis business too risky or expensive.
• Banking restrictions—Cannabis businesses operating with state legality also often face difficulties accessing traditional banking and financial services due to the illegality of cannabis at the federal level. According to the National Association of Insurance Commissioners, 70% of CRBs operate as cashonly businesses and have no formal relationship with a bank, increasing the risk of theft and other liabilities.

Policy Changes

Although regulatory inconsistencies create challenges for CRBs, there is proposed legislation to clarify federal restrictions around banking and insurance for the cannabis industry. Two pieces of legislation currently awaiting approval in the Senate are intended to improve the access CRBs have to traditional methods of insurance and banking. The proposed legislation is as follows:

• CLAIM Act—The Clarifying Law Around Insurance of Marijuana (CLAIM) Act is intended to create a legal safe harbor for brokers and insurers to provide coverage to CRBs. If passed, this law would:

o Prohibit penalizing or discouraging insurers from providing coverage to CRBs

o Prohibit the termination of an insurer’s policy solely because they provide insurers to CRBs

o Prohibit encouraging insurers not to engage in business with CRBs

o Prohibit the federal government from taking adverse action against insurers who provide coverage to CRBs If passed, the CLAIM act is expected to open the insurance market to CRBs.

If passed, the CLAIM act is expected to open the insurance market to CRBs. This includes providing CRBs with greater capacity and lower premiums and creating new markets for specialized and hard-to-find insurance, such as D&O.

• SAFE Act—The Secure and Fair Enforcement (SAFE) Banking Act would create a safe harbor for financial institutions to provide services to CRBs. This law proposes to:

o Prohibit or limit deposit insurance solely because an institution provides financial services to CRBs

o Prohibit discouraging financial institutions to offer services to CRBs o Prohibit encouraging financial institutions not to provide services to CRBs o Prohibit adverse loan action solely because a person is     associated with CRBs

The SAFE Banking Act has passed through the House of Representatives six times, although it has never been taken up on the Senate floor.

If passed, the CLAIM Act and the SAFE Banking Act could revolutionize the way CRBs finance and insure their institutions.

Conclusion The exposures CRBs face are aggregated by the industry’s newness, the nature of cannabis products, and the discrepancy between state and federal laws.

For more information on the state of the cannabis market, call us or schedule a call with Adam Hengst.