As long as cannabis remains a Schedule I drug in the United State the legalized cannabis industry, whether medical or adult-use, will remain a cash-only business for most operators. Although there are alternatives available to the organizations allowing them to utilize payment cards and apps, they come at a cost to the customer, the businesses, or both so they often choose to remain a cash-only business. Until the U.S. government does something to change this such as the passage of the Secure and Fair Enforcement (SAFE) Banking Act of 2019 and other bills stalled in congress, burglaries and robberies at dispensaries will continue with the perception of large sums of cash inside. In the interim, what can a dispensary do to help mitigate the risk of burglaries and robberies?
How Do You Mitigate Crime in Your Dispensary – Set Up a Financial Account
The first and perhaps most obvious step to take is to establish a bank account into which your facility’s cash can be deposited. It has become much easier to set up a legitimate bank account as a cannabis business. Federal banks are not willing to take the risk of participating in money laundering the proceeds from a federally illegal business, but statewide banks and credit unions are available and willing to accept cannabis accounts. These statewide banks and credit unions charge a substantial sum for each deposit and even larger monthly fees just to have the account, but the fees are far better than no bank accounts.
Once a bank account is established, a common solution allows dispensaries to accept debit cards for a point of banking (POB). POB programs legally utilize ATM networks and are recognizable by a small amount of physical cash back or electronic rebate for each transaction. The reason that transactions must be in increments of $5 due is the business is essentially turning the dispensary’s point of sale (POS) POB terminal into a literal cashless ATM. There are cash apps and member card solutions available as well that eliminate the need for customers to carry cash into the dispensary and reduce the accumulation of large sums of cash inside the dispensaries.
All of these solutions come with a fee. Many dispensaries take on that fee, but many do not and pass them on to the customers. Regardless of who pays these fees, cash is no longer as prevalent inside the dispensary. This would seem to be a positive security point, however, with the myriad media stories about the cannabis industry being a cash-only enterprise, criminals still see them as prime opportunities. Criminals have visions of safes bursting with cash inside dispensaries either because many businesses still don’t have a bank or refuse to utilize other money solutions that would eat into their profits. This leads to burglaries during non-operational hours and robberies during normal operational hours.
Mitigating Crime with Technology
Burglaries and robberies are two separate and distinct types of crime requiring different strategies for mitigation. The regulating bodies for legal cannabis operations promulgate rules designed to address both. However, the rules are simply not enough. Many videos exist of both robberies and burglaries and their very existence should be considered verifiable proof that the most extensive video surveillance system (VSS) does nothing to prevent either as a standalone solution.
VSSs can be a valuable tool in the security operations at a dispensary and provide forensic evidence after the fact but they do not prevent or deter criminals from targeting a dispensary. A security manager experienced in security operations should consider how analytics such as heat mapping, dwell time, line crossing, and countless others can help. Managers should also consider reviewing recorded video archives on a routine basis to develop predictive intelligence strategies.
Access control systems (ACS) can also be used for far more than “key cards” replacing brass keys. Who went where, or attempted to go where, and when, can provide intelligence far more useful for compliance issues than just a report showing who has access or who accessed the secure storage room. Who can or who actually accessed a particular room is considered post-event investigative forensic information.
Developing a role-based access authorization, including eliminating the all-too-common 24/7 access times for anyone who does not operationally have a need for access at 2 AM should be the standard. Security managers must also review access logs on a frequent and routine basis to catch irregularities and issues that otherwise would go unnoticed. Establishing secure entry vestibules where customers are vetted between the main entry door and the door leading from the vestibule to the lobby or waiting room is a best practice. Clients can then be escorted or allowed to enter the sales area through another locked door that would create enough of a controlled process flow to enforce to criminals that they are less likely to enter unnoticed or unidentified before actually encountering at a point of sale (POS) unit to execute a robbery. No dispensary should be designed with only a single door to the building being the lone secured entrance a potential robber would enter before reaching their intended target at the POS.
Cash controls at the POS should be programmed to limit the amount of cash stowed in the drawer. POS registers should be designed to disallow a transaction if there is a certain level of cash inside the drawer. A cash drop into a safe should be made from the drawer to allow sales to continue. Smart safes accept stacks of multiple bills of varying denominations and validate them for the amount deposited. They can also flag any counterfeit bills and have time locks to prevent safes from being opened quickly to illegally remove cash deposits. Dispensaries should consider using smart safes like those convenience stores have operated for decades to help limit cash available in the event of a robbery.
Secure Storage is Critical to Stay Compliant
Storage safes should be secured inside vaults. Denver, Colorado has recently required dispensaries to install ¾” plywood lining to the inside of their “vaults” and secure the entry with a steel-lined door. The new rules also require that all inventory must be placed inside a locked area nightly. Leaving products out on shelves shouldn’t have to be disallowed by law for a dispensary to do it. This is simply common sense. Using steel doors on “vault” entries should also not have to be a law needing to be implemented.
I have placed the word “vault” in quotes because a true vault as required by 21 CFR § 1301.72 for storage of Schedule I drugs is far more robust than what is typically employed by dispensaries, even though the cannabis being sold is a Schedule I drug and should be stored according to this standard. If a vault were constructed to these standards there would be far fewer successful burglaries and even fewer surreptitious entries to dispensary secured storage.
Here are the physical security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment programs; mobile narcotic treatment programs; storage areas as instructed in 21 CFR § 1301.72:
(1) Where small quantities permit, a safe or steel cabinet;
(i) Which safe or steel cabinet shall have the following specifications or the equivalent: 30-man minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques.
(ii) Which safe or steel cabinet, if it weighs less than 750 pounds, is bolted or cemented to the floor or wall in such a way that it cannot be readily removed; and
(iii) Which safe or steel cabinet, if necessary, depending upon the quantities and type of controlled substances stored, is equipped with an alarm system which, upon attempted unauthorized entry, shall transmit a signal directly to a central protection company or a local or state police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve.
(2) A vault constructed before, or under construction on, September 1, 1971, which is of substantial construction with a steel door, combination or key lock, and an alarm system; or
(3) A vault constructed after September 1, 1971:
(i) The walls, floors, and ceilings of which vault are constructed of at least 8 inches of reinforced concrete or other substantial masonry, reinforced vertically and horizontally with 1 ⁄2-inch steel rods tied 6 inches on center, or the structural equivalent to such reinforced walls, floors, and ceilings.
(ii) The door and frame unit of which vault shall conform to the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques.
(iii) Which vault, if operations require it to remain open for frequent access, is equipped with a “daygate” which is self-closing and self-locking, or the equivalent, for use during the hours of operation in which the vault door is open.
(iv) The walls or perimeter of which vault are equipped with an alarm, which upon unauthorized entry shall transmit a signal directly to a central station protection company, or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve, and, if necessary, holdup buttons at strategic points of entry to the perimeter area of the vault.
(v) The door of which vault is equipped with contact switches; and
(vi) Which vault has one of the following: Complete electrical lacing of the walls, floor and ceilings; sensitive ultrasonic equipment within the vault; a sensitive sound accumulator system; or such other device designed to detect illegal entry as may be approved by the Administration.
Many dispensaries utilize gun safes. This is a mistake. The door is the only strong part of a gun safe. The sides can be peeled open like a sardine can. TL 30-rated safes are a closer fit to the requirements above and should be used for cash or product.
Access Control Has Strict Requirements
Perimeter man-doors should be steel with steel frames. The door frames should be filled with mortar or grout. Multipoint door locking hardware, roll down steel shutters, or locking steel gates across the doors are all solid ways to reinforce the portals and mitigate against forced entry. All windows and perimeter glass should be reinforced with impact or blast-resistant film. Steel bars or shutters can be installed on the outside of the glass to mitigate against entry as well.
In addition to these physical security suggestions, training all employees on security awareness, surveillance detection, and proper behavior during a robbery can help staff recognize signs of trouble and help prevent injuries or casualties. Enlisting the help of a security consultant with boots-on-the-ground dispensary operations experience and knowledge validated by security industry testing and accredited certifications to conduct a thorough assessment of the environment and operations unique to the specific location is the best way to improve the security posture of the dispensary and should produce numerous suggestions going far beyond lacking regulatory requirements for compliance.
Prior to joining Guidepost Solutions as a Senior Security Consultant, Sutton worked as a director of security for Greenhouse Group and its Grassroots and Herbology banners, responsible for enterprise security risk management in all markets. He authored Security, Emergency Action and Fleet Safety Plans along with security training and operations manuals. He also conducted new hire background investigations and security advances at dispensaries as part of Transportation Security Plans in multiple states. Prior to Greenhouse Group, he worked as the director of security for Revolution Enterprises where similarly he was responsible for everything security in all states of operation.
