Vendor Exclusion Screening for Cannabis Retail

A dispensary buys flower, edibles, packaging, software, security, cleaning, and professional services. Each vendor brings a different risk, and each state may impose different license, disclosure, or contracting requirements. A vendor exclusion check is one part of that picture. It is not a complete due-diligence program, and it is not a substitute for a license verification.

This review examines the public sources a dispensary can reasonably use for exclusion screening, the gaps in those sources, and the record design that keeps the work honest. The central finding is that public lists answer narrow questions. The vendor file must say which question was asked and which one remains open.

What exclusion screening is and is not

Exclusion screening usually means checking whether a person or entity appears on a government list that restricts participation in certain programs or transactions. The consequences of appearing on a list vary. A federal health care exclusion is not the same as a government-wide suspension, a sanctions designation, or a state cannabis license revocation.

For a dispensary, the relevant check depends on the vendor relationship. A software vendor that handles payment data has a different risk profile from a packaging supplier or a security contractor. A state-licensed cannabis vendor has a license status that may matter more than a federal exclusion list. The screening program should start with the relationship, not the list.

Exclusion screening is also not a background check on every employee of the vendor. A public list may identify an entity or an individual, but it does not establish that a company is well run, financially stable, or safe to work with. Those questions need contracts, references, insurance, and operational review.

The federal sources worth knowing

The first source is the System for Award Management exclusions list. SAM exclusions are used in federal procurement and assistance programs. A dispensary is not a federal agency, but the list can still be a useful signal for vendors that work in regulated or government-funded environments. The record should note the exact name searched, the date, and whether a possible match was reviewed.

The second source is the HHS Office of Inspector General List of Excluded Individuals and Entities, commonly called the LEIE. The LEIE is specific to federal health care programs. A dispensary is not a health care provider in the same sense as a hospital, but some vendors may serve health-care-adjacent markets. The list is not a general vendor blacklist.

The third source is the FDA warning letters database. A warning letter is not an exclusion, but it can show a pattern of regulatory problems. For a cannabis or hemp vendor, a warning letter about claims, manufacturing, or labeling may be relevant to the relationship. The record should capture the date, the subject, and the response status, not just the fact that a letter exists.

The fourth source is the OFAC sanctions search. Sanctions screening is a separate legal and compliance area. A possible match requires professional review; a name similarity is not a designation. The dispensary should not make an adverse decision based on an unreviewed search result.

The state license layer

Most dispensaries already check a vendor's cannabis license or registration. That check is essential, but it is not an exclusion screening program. A state license lookup may show the license number, status, premises, and approved activities. It may not show ownership changes, pending discipline, or the vendor's federal status.

The vendor file should record the license type, number, issuing agency, status, expiration date, and the date the status was verified. If the state provides a public license lookup, save the query result or a screenshot with a timestamp. If the vendor operates in multiple states, check each jurisdiction that matters to the relationship.

The vendor license expiration review routine can own the renewal chase. The exclusion screening record should link to it rather than duplicate the license fields.

The coverage problem

There is no single public registry that lists every cannabis vendor, every owner, every subcontractor, and every possible exclusion. The sources cover different populations and different legal authorities. A vendor that is clean on one list may appear on another, or may not appear anywhere because the list does not cover its industry.

Name matching is another gap. A legal entity may use a trade name, a parent company, a subsidiary, or a variation with punctuation and suffixes. A search for the wrong name can produce a false negative. A search for a common name can produce a false positive. The record should show the legal name, the trade name, the address, and the identifier used.

A practical approach is to search the legal name and the known trade name, then review possible matches against the address and ownership information. If the match is ambiguous, mark it for review rather than clearing it. The reviewer should document the basis for the decision.

A screening record that can be defended

A useful record has six parts: vendor identity, source, query, result, review, and next check. Vendor identity includes the legal name, trade name, address, website, and primary contact. Source identifies the list or registry and the URL. Query records the exact search terms and date. Result records whether there was no match, a possible match, or a confirmed match. Review records who evaluated the result and what evidence was used. Next check records the monitoring date or trigger.

The record should also state what was not checked. If the dispensary did not screen subcontractors or beneficial owners, say so. If the state license lookup does not show ownership, say so. The gap statement is not an admission of failure. It is a boundary that prevents a later reviewer from assuming more coverage than the file provides.

False positives and fair review

A possible match is not a finding. The reviewer should compare the name, address, date of birth or incorporation date, and any available identifier. If the source provides a verification contact, use it. Do not tell the vendor that it is "excluded" based on a name match.

The vendor should have a chance to respond if the relationship is at risk. Keep the communication factual and avoid disclosing more than necessary. If the matter is legally significant, route it to counsel before making a decision.

A false negative is harder to detect. The vendor may have changed its legal name, merged with another entity, or used a subcontractor that was not disclosed. The screening program should include a periodic refresh and a contract clause that requires the vendor to notify the dispensary of ownership or license changes.

When to recheck

A one-time screening at onboarding is not enough. Recheck when a vendor's license or registration changes, when ownership or control changes, when a contract renews, when a credible complaint or news report appears, and when the dispensary changes the vendor's scope of work. The vendor onboarding checklist can record the initial check; the renewal calendar can record the refresh.

A simple monitoring cadence is quarterly for high-risk vendors, annually for low-risk vendors, and event-driven for any vendor with a change. The cadence should be written down and assigned. A list that is checked only when someone remembers is not a control.

What public sources cannot establish

Public sources cannot establish that a vendor is financially stable, that its insurance is adequate, that its subcontractors are licensed, or that its product meets the state's requirements. They cannot establish that a vendor is a good business partner. They can only show whether a specific name appears on a specific list at a specific time.

The NIST Cybersecurity Framework's supply chain guidance is useful for the broader question of third-party risk. The NIST Cybersecurity Framework encourages organizations to identify and manage supplier risks, not just check a name against a list. The SBA business management guide provides a general framework for vendor selection and contract management.

A dispensary should combine the public check with a contract review, insurance verification, reference calls, and a clear scope of work. The exclusion check is one input, not the decision.

Practical conclusion

Vendor exclusion screening is a small, repeatable control. Start with the vendor relationships that matter most: license holders, payment and software vendors, security providers, and any vendor with access to customer data or regulated inventory. Search the public sources, record the exact query and result, review possible matches, and state the coverage gap.

Then connect the record to the license renewal and onboarding workflows. The goal is not a perfect clearance. The goal is a vendor file that shows what was checked, when, by whom, and what remains unknown. That is a more defensible position than a folder of screenshots with no context.

Sources

1. SAM.gov exclusions
2. HHS OIG List of Excluded Individuals and Entities
3. FDA warning letters
4. OFAC sanctions search
5. SBA business management guide
6. NIST Cybersecurity Framework

Internal reading: vendor license expiration review and vendor onboarding checklist.