Technology and compliance training are needed to adhere to customer purchase limits and avoid ‘looping’ practice
At its height, Sweet Leaf was one of Colorado’s largest vertically integrated cannabis businesses and considered a pioneer in the marijuana retail chain concept. Now, the company is a cautionary tale for other marijuana retailers.
The city of Denver stripped Sweet Leaf of its 26 municipal licenses in July, alleging the company’s top brass propagated an illegal sales scheme called “looping,” which allowed some customers to make multiple purchases in one day that combined to exceed the legal sales limit. In October, the company’s owners made a deal with Colorado’s regulatory agency to pay more than $2 million in fines, sell their remaining business licenses in the state and drop their appeal of the charges.
The case has put marijuana retailers on edge and underscored the need for strict compliance with customer and patient sales limits.
That can be accomplished with technology and compliance training.
In some medical marijuana markets, compliance with sales limits is made simpler by state patient databases or regulations that dictate where consumers shop. Sales are associated with patient identification numbers, and their purchases are deducted daily or in real time from their limits.
Tracking sales in adult-use markets, however, is complicated by consumer privacy concerns and fear over high-profile data breaches – think Yahoo, eBay, Equifax and Target.
Experts – some of whom asked not to be identified – provided the following tips for complying with customer and patient sales limits.
Confirm a Customer’s Identification Multiple Times
Identification, such as a government-issued ID and or a medical ID card, should be confirmed at the point of entry, at customer check-in and when the customer pays for the purchase, retailers in multiple states said.
The employees who check IDs should look for:
- Date of birth.
- A valid expiration date.
- A photo that confirms the identity of the customer.
- To verify an ID’s authenticity, employees should be trained to:
- Refer to a domestic and international ID guidebook.
- Inspect ID markings with a magnification device known as a jeweler’s loupe.
- Use a black-light bulb that illuminates holograms and ID markings.
- Technology should always be used to confirm the authenticity of IDs, too.
One Colorado retail executive said her staff uses its point-of-sale provider Flowhub’s NUG app to scan each customer’s ID, confirm he/she is of legal age and that the ID is authentic. Another retail executive in California said his store uses a Honeywell-brand ID scanner and software plug-in that reads bar-code data on government-issued IDs.
To protect consumer privacy, any personal information stored by these scanners should be purged on a regular basis, the California retail executive said. To be in compliance, however, retailers should consider retaining the birthdates on every ID scanned, because some regulatory agencies will later ask to see whether you confirmed customers’ ages.
Require Same-day Return Customers to Provide Earlier Receipts
To safeguard against looping, one retail executive’s Colorado store requires customers to show same-day sales receipts if the computer recognizes an ID as having been scanned earlier that day.
“Our focus is on maintaining compliance with (purchase limits), as directed by state and local authorities,” she said. “A customer is welcome to make multiple visits to one or more stores at any time, as long as they remain under their total limit for
The executive said the store ensures compliance by:
- Training staff to remind customers at the point of sale to keep their receipts if they plan to visit the dispensary or one of its other locations in the same day.
- Using Flowhub’s NUG app to scan IDs. The app alerts staff if the ID has been scanned that day at the dispensary or one of its other locations.
- Requiring staff to ask return customers to see a same-day sales receipt. If return customers cannot present a receipt, they are turned away and no sale is made.
Allowing return customers with a same-day sales receipt to make a purchase provided the quantity complies with purchase limits.
Identify Point-of-sale Systems That Provide Safeguards
Point-of-sale (POS) systems can provide another layer of protection that prevents looping. Most POS systems can create a customer profile with few or no identifying details for recreational consumers who show a valid government ID. They can calculate sales limits and also alert sales associates when customers attempt to purchase more than they are allowed. Here are ways POS systems can help keep you in compliance with sales limits:
- BioTrackTHC’s POS system assigns every customer or patient a nonidentifying, 16-digit number when a driver’s license or patient ID card is scanned. The 16-digit number creates a consumer profile without storing any personally identifying information, unless customers have given the retailer consent to store names and other details for loyalty and rewards programs. If a customer reaches the daily purchase limit and returns to make an additional purchase the same calendar day, the system flags the transaction, blocks it from being processed and does not allow a sales associate to override the block. “The functionality was carried over from our opioid prescription-tracking venture, and now it’s a standard feature for dispensary point-of-sale systems,” said Moe Afaneh, chief operating officer at BioTrackTHC.
- Cova and MJ Freeway’s MJ Platform’s POS systems automatically calculate product equivalencies for retailers. This comes in handy in states that calculate products to a single value. In Colorado, for example, an eighth of flower is equal to 1 gram of concentrate or 100 milligrams of infused products. If a sales associate was required to manually calculate equivalencies, it could lead to error. The Cova and MJ Platform systems make those calculations to ensure customers don’t exceed the state’s 2-ounce daily purchase limit.
- IndicaOnline’s POS system notifies sales associates when patients meet or exceed their sales limits, and it offers a blacklisting option to retailers. A network blacklist would notify any retailer using IndicaOnline during check-in when a customer tries to make multiple same-day purchases. The system is also capable of restricting permissions so staff can’t view a customer’s personal information. Even if these permissions are not in place, the system tracks staff actions and records which staff member views which profile.
In Medical Markets, Lean on Seed-to-sale Tracking Systems and State Software
In medical markets including Delaware, Illinois, Maryland, New Mexico and Pennsylvania, seed-to-sale tracking systems – including BioTrackTHC, Franwell’s Metrc and MJ Freeway – can be used in conjunction with state patient registries to monitor purchase limits.
In Maryland, Metrc integrates with a patient portal that stores patient information including names, birthdates and purchase limits, said Jennifer White, a spokeswoman for the Maryland Medical Cannabis Commission. Here’s how it works:
- Patients’ medical ID cards are scanned into Maryland’s registry when they check in at a dispensary.
- The state system shows how much product is left to purchase in the patient’s rolling 30-day limit.
- When a patient attempts to make a purchase, Metrc queries the state’s system and verifies purchase limits.
- If the sale exceeds a patient’s limit, Metrc alerts the retailer and the sale is declined.
Maryland has had issues with Metrc, including outages and slowdowns, but when the software works properly, it safeguards retailers from overselling product and patients from consuming too much medicine, said William Askinazi, principal at Potomac Holistics dispensary in Rockville.
BioTrackTHC in Illinois and MJ Freeway in Pennsylvania have real-time digital ledgers that track patient limits, too, said Charlie Bachtell, CEO of Chicago-based Cresco Labs, a vertically integrated marijuana company with operations in six states.
Some states – Illinois, for example – use regulations as an additional safeguard to prevent looping. MMJ patients in Illinois are required to register with one dispensary, and that’s the only place where they are allowed to purchase cannabis. If patients want to change their registered retailer, they must notify the state.
The requirement for patients to register with a single dispensary and the state’s requirement for patients to submit fingerprints and background checks might swing too far in the direction of overregulation, Bachtell said. He’d advocate for regulations that provide checks and balances on operators with fewer barriers to access for patients.
“You can’t be a healthy, successful company without a healthy, successful program,” Bachtell said. “And I can say with confidence that no operator in any regulated market wants to be out of compliance.”