Top Issues in the Cannabis Industry for 2026

1. Banking and Payments Access (SAFER Banking and Beyond)

Federal cannabis policy is shifting, but do not expect major banks to follow. While marijuana reclassification to Schedule III would ease some regulatory burdens, it does not equal legalization, and most major banks will remain on the sidelines until explicit safe harbor laws pass. This means cannabis businesses will continue to face barriers to basic deposit accounts, merchant services, and payment processing. Big banks continue to view cannabis proceeds as carrying significant compliance risk under federal law, and the SAFER Banking Act remains the clearest path to industry-wide banking reform — rescheduling alone will not open the floodgates.

Automated clearing house (ACH) and bank-to-bank payment systems are rapidly becoming the preferred alternative to cash and credit cards. Projections suggest nearly 42% of cannabis transactions could run over ACH rails in 2026, up from 28% in 2025. At the same time, compliance standards are rising. Schedule III status would increase scrutiny around recordkeeping, anti-money laundering controls, and beneficial ownership transparency. Banks and payment partners will likely require deeper documentation before onboarding cannabis clients to demonstrate compliance with these heightened regulatory expectations and mitigate their own exposure to federal enforcement risk.

What makes 2026 different is not a shift in legality, it is a shift in capability. After years of patchwork approaches, tech-driven financial infrastructure has finally caught up to cannabis. Real-time settlement, mobile payments, and shutdown-proof systems are doing what legislation has not, creating a more secure and affordable payments environment. Businesses still waiting on US Congress will fall behind, but those investing in technology-first payment solutions will ultimately be miles ahead when the law does catch up.

The 2025 appropriations bill that reopened the federal government takes direct aim at the so called “intoxicating hemp” loophole. The bill redefines the federal definition of hemp and adds categorical product exclusions, currently scheduled to take effect later this year (though proposals to extend the deadline are currently being circulated). After the new law takes effect, the US Food and Drug Administration (FDA) will be tasked with quickly clarifying which cannabinoids fall inside or outside the new line.

The illicit cannabis market remains a formidable competitor, and in some states, it still dominates. In California, unlicensed operators supply an estimated 60% of all cannabis consumed, according to a 2024 Department of Cannabis Control report. In New York, unlicensed storefronts proliferated faster than the state could issue licenses, prompting “Operation Padlock to Protect,” which has sealed nearly 1,400 unlicensed storefronts and seized over $95 million in illicit products as of mid-2025. California has pursued similar enforcement through its Unified Cannabis Enforcement Task Force, seizing $534 million in illegal cannabis in 2024 alone. Both states have also targeted landlords who lease to unlicensed operators, with New York imposing fines of up to $50,000 in New York City and California increasing civil penalties to $20,000 per day.

While enforcement benefits compliant businesses, the regulatory burden cuts both ways. Licensed operators face layered compliance regimes, including separate state and local licenses, zoning restrictions, and social equity contributions, all of which increase costs and compress margins. Combined state and local taxes exceeding 35% in some jurisdictions further widen the price gap between legal and illicit products, undermining both competitive dynamics and state tax capture as consumers turn to cheaper unlicensed sources.

Operators should monitor legislative efforts to rationalize taxes and streamline licensing. California eliminated its cultivation tax under AB 195 in 2022 and reduced its excise tax from 19% to 15% under AB 564 in September 2025. New York has delayed certain taxes to support its nascent market. With revenues under pressure, several states are reconsidering their approach.

Federal illegality largely forecloses federal trademark registration for cannabis goods. As a result, brand owners must rely on narrower state registrations and common law rights, which vary by jurisdiction and can be harder to enforce across state lines. Attempts to register cannabis marks federally face “lawful use” refusals, although ancillary goods and services and certain hemp-derived products may qualify, creating uneven protection and gaps that invite copycats. This patchwork complicates licensing, increases litigation costs, and can depress brand valuation in financing and mergers and acquisitions.

Operators should concentrate on core protections:

• Secure state registrations in priority markets and pursue federal registrations for ancillary goods and eligible hemp-compliant stock keeping units (SKU).

• Fortify non-trademark levers and contracts, including distinctive trade dress, copyrights, confidentiality, and quality control terms.

• Monitor and enforce brands with marketplace and social media takedowns and maintained evidence of use.

• Protect digital and packaging assets with defensive domains and handles and compliant, non-descriptive naming and labeling.

Together, these steps enhance enforceability, deal readiness, and resilience as laws evolve.

Cannabis retailers and multi-state operators (MSOs) handle substantial volumes of sensitive consumer data, including purchase histories, identification records, payment information, and in medical markets, qualifying health conditions, making them attractive cyberattack targets. Cannabis operators must also feed transaction data into state-mandated seed-to-sale tracking systems like METRC or BioTrack, creating additional points of vulnerability.

The patchwork of state privacy laws adds further complexity. Nearly 20 states, including California, Virginia, Colorado, Connecticut, and Texas, now have comprehensive consumer privacy statutes, each imposing distinct requirements for data collection notices, opt-out rights, and sensitive data handling. Several classify health-related data (including medical cannabis patient information) as “sensitive personal information,” triggering heightened consent requirements.

For MSOs, building a unified compliance program across jurisdictions is a significant undertaking. Operators must track varying effective dates and cure periods while anticipating private rights of action in states like California, where breaches can trigger class action exposure. Beyond legal liability, a data breach can put state cannabis licenses at risk. The 2025 Ohio Marijuana Card breach illustrates these dual stakes: nearly one million patient records were exposed, including Social Security numbers and medical records, triggering federal class action lawsuits and investigations by Ohio’s Division of Cannabis Control and State Medical Board. Operators should conduct annual privacy and security assessments, ensure vendor contracts include strong data protection provisions, and scrutinize third-party integrations (such as point-of-sale systems, delivery apps, and loyalty programs) that access customer data.

In 2026, companies marketing cannabis products will need to harmonize two moving targets simultaneously: the patchwork of state advertising restrictions and the fast-shifting policies of major digital platforms. Many states restrict or prohibit the use of certain claims, imagery, or channels, yet even where state law permits certain content, many platforms continue to restrict advertising of cannabis and THC-containing products, with some experimenting with narrow carve-outs for hemp and cannabidiol (CBD) under strict age-gating, certification, and geofencing conditions. This divergence complicates national campaigns, influencer and affiliate programs, and marketplace listings, particularly when targeting and retargeting tools inadvertently reach prohibited audiences or jurisdictions. Parallel compliance typically means calibrating creative to the most restrictive state and platform standards, building auditable age and location controls into the media stack, and hard coding prohibited content filters to avoid youth appeal, therapeutic claims, or price or giveaway promotions where banned.

Courts are also beginning to scrutinize broad state limits on third-party advertising and out-of-home media under commercial speech principles, introducing legal uncertainty that can cut both ways. Successful challenges might open new channels, but until rules are definitively narrowed, regulators are likely to enforce existing rules, and many platforms will continue to act on perceived violations. Operators should assume heightened review of endorsements, user-generated content, and cross-border impressions, and should negotiate vendor and influencer contracts that allocate compliance responsibilities, preserve takedown rights, and require data needed to substantiate age, geolocation, and audience controls. The most resilient operators will be those who treat platform policies as binding constraints in addition to state law and build dynamic workflows that can redeploy media spend and creative as soon as either set of rules shifts.

Most states prohibit ads that target minors, make unsubstantiated health claims, or run in media where a significant share of the audience is underage. Audience composition thresholds vary: Colorado permits advertising only where no more than 30% of the audience is under 21, while Connecticut caps that figure at 10%. Content restrictions also differ, with California banning depictions of consumption, Massachusetts prohibiting celebrity endorsements, and Connecticut and New Jersey requiring pre-approval of marketing materials. Ohio recently adopted one of the nation’s most restrictive bans, blocking dispensaries from using billboards, radio, television, internet, and stadium advertising. Violations can result in fines, license suspensions, or revocation.

Platform policies add another layer. Google prohibits ads for recreational cannabis, permitting only limited topical CBD advertising with third-party certification. .Courts are also weighing in. In November 2025, the US Supreme Court declined to hear a challenge to Mississippi’s near-total advertising ban, leaving in place a ruling that upheld the restrictions because marijuana remains federally illegal. Other cases have produced mixed results, with some courts upholding certain restrictions while striking down others as overly broad.

Given this complexity, operators should consult legal counsel before launching multistate campaigns and build compliance review into campaign timelines from the outset.

Public health concerns continue to shape cannabis regulation, with emerging evidence on perinatal exposure, adolescent use, and impaired driving informing proposals such as potency caps, stronger warnings, and more rigorous testing and labeling standards. Many states have considered or advanced limits on THC concentration in certain product forms, standardized universal symbols, larger front-of-pack warnings about pregnancy and breastfeeding risks, and tighter prohibitions on youth appealing flavors, shapes, and branding. Testing and labeling are converging on accredited labs, method harmonization, QR-linked certificates of analysis, and enforcement against “lab shopping” and potency inflation. At the same time, impaired driving initiatives are expanding roadside oral fluid pilots, drug recognition protocols, and public awareness campaigns, with downstream effects for product claims and point of sale messaging.

For operators, this trend creates both a compliance burden and a strategic risk. Potency caps and standardized dosing may force SKU reformulation and refreshed packaging inventories, while stricter warnings can crowd already constrained label real estate and limit brand voice. Continued scrutiny of health‑related claims continues to raise liability risk under consumer protection laws. Planning for 2026 should include scenario mapping for various labeling permutations, investment in validated testing partners, and conservative claim‑substantiation protocols. Even when federal policy eventually evolves, state‑level public‑health measures are likely to intensify, so portfolio design, marketing strategy, and compliance systems should be resilient to tighter limits and ready to pivot as rules harden.

ArentFox Schiff attorneys are closely monitoring developments in relation to this alert and are able to discuss the impact this could have on your organization. If you have any questions about this issue, please contact a member of our Cannabis group.