California Cannabis Business Security Requirements
*Please note that this section encompasses only the compliance requirements relevant to business security. Many parts of the rules and regulation shave been removed to focus exclusively on the security compliance aspects. To view the full set of rules and regulations for California, click here!
California’s cannabis regulations are currently under emergency rulemaking and are expected to change. Please check back here for updates!
California Business Security Requirements for Cannabis Licensees
You can view the program webpage here.
5002. Annual License Application Requirements
- (a) Applications may be completed and submitted online at www.bcc.ca.gov or completed in hard copy and submitted by delivering a printed copy to the Bureau’s office(s).
- (b) Applicants who submit their applications online shall first register for a user account. To register for a user account, the applicant shall do all of the following:
- (1) Create a user name, password, and security question and answer;
- (2) Provide an email address; and
- (3) Provide the owner’s first and last name, primary phone number, social security number or individual taxpayer identification number, date of birth, and mailing address.
- (c) An application must be completed by an owner as defined by section 5003 of this division. An application must be submitted to the Bureau for each location and each license type. An application for an annual cannabis license includes the following:
- (1) The name of the applicant. For applicants who are individuals, the applicant shall provide both the first and last name of the individual. For applicants who are business entities, the applicant shall provide the legal business name of the applicant.
- (2) If applicable, the business trade name (“DBA”) of the applicant.
- (3) The commercial cannabis license that the applicant is applying for, and whether the applicant is requesting that the license is designated as medicinal, adult-use, or both. Testing laboratory applicants do not have to designate medicinal or adult-use, as testing laboratory licenses allow the holder to test both medicinal and adult-use cannabis.
- (4) Payment of an application fee pursuant to section 5014 of this division.
- (5) Whether the owner is serving or has previously served in the military. Disclosure of military service is voluntary. An applicant who has served as an active duty member of the Armed Forces
of the United States and was honorably discharged and who can provide evidence of such honorable discharge shall have his or her application expedited pursuant to Business and Professions Code section 115.4.
- (6) A list of the license types and the license numbers issued from the Bureau and all other state cannabis licensing authorities that the applicant holds, including the date the license was issued
and the licensing authority that issued the license.
- (7) Whether the applicant has been denied a license or has had a license suspended or revoked by the Bureau or any other state cannabis licensing authority. The applicant shall provide the
type of license applied for, the name of the licensing authority that denied the application, and the date of denial.
- (8) The physical address of the premises. If the Bureau is unable to confirm that the address provided is valid, then the applicant shall provide a document that confirms the physical address
of the premises. Such a document may include a utility bill, printed information from the county
assessor, deed, or title.
- (9) The mailing address for the applicant, if different from the premises address.
- (10) The telephone number for the premises.
- (11) The website address and email address of the applicant’s business.
- (12) The business’ federal employer identification number.
- (13) Contact information for the applicant’s designated primary contact person including the name, title, phone number, and email address of the individual.
- (14) A description of the business organizational structure of the applicant, such as partnership
- (15) All business-formation documents, which may include, but are not limited to, articles of incorporation, bylaws, operating agreements, partnership agreements, and fictitious business
name statements. The applicant shall also provide all documents filed with the California Secretary of State, which may include, but are not limited to, articles of incorporation, certificates of stock, articles of organization, certificates of limited partnership, and statements of partnership authority. If the commercial cannabis business is held in trust, the applicant shall provide a copy of the certificate of trust establishing trustee authority.
- (16) A list of every fictitious business name the applicant is operating under including the address where the business is located.
- (17) A commercial cannabis business that is a foreign corporation or foreign limited
liability company shall include in its application a certificate of qualification, certificate of
registration, or certificate of status issued by the California Secretary of State.
- (18) The applicant shall supply the following financial information:
- (A) A list of funds belonging to the applicant held in savings, checking, or other accounts maintained by a financial institution. The applicant shall provide, for each account, the financial institution’s name, the financial institution’s address, account type, account number, and the amount of money in the account.
- (B) A list of loans made to the applicant. For each loan, the applicant shall provide the amount of the loan, the date of the loan, term(s) of the loan, security provided for the loan, and the name,
address, and phone number of the lender.
- (C) A list of investments made into the applicant’s commercial cannabis business. For each investment, the applicant shall provide the amount of the investment, the date of the investment, term(s) of the investment, and the name, address, and phone number of the investor.
- (D) A list of all gifts of any kind given to the applicant for its use in conducting commercial cannabis activity. For each gift, the applicant shall provide the value of the gift or description of
the gift, and the name, address, and phone number of the provider of the gift.
- (19) A complete list of every individual who has a financial interest in the commercial cannabis business as defined in section 5004 of this division, who is not an owner as defined in section 5003 of this division.
- (20) A complete list of every owner of the applicant as defined in section 5003 of this division. Each individual named on this list shall submit the following information:
- (A) The full name of the owner.
- (B) The owner’s title within the applicant entity.
- (C) The owner’s date of birth and place of birth.
- (D) The owner’s social security number or individual taxpayer identification number.
- (E) The owner’s mailing address.
- (F) The owner’s telephone number. This may include a number for the owner’s home, business, or mobile telephone.
- (G) The owner’s email address.
- (H) The owner’s current employer.
- (I) The percentage of the ownership interest held in the applicant entity by the owner
- (J) Whether the owner has an ownership or a financial interest as defined in sections 5003 and 5004, respectively, of this division in any other commercial cannabis business licensed under the
- (K) A copy of the owner’s government-issued identification. Acceptable forms of identification are a document issued by a federal, state, county, or municipal government that includes the
name, date of birth, height, gender, and picture of the person, such as a driver license.
- (L) A detailed description of the owner’s convictions. A conviction within the meaning of this section means a plea or verdict of guilty or a conviction following a plea of nolo contendere. Convictions dismissed under Penal Code section 1203.4 or equivalent non-California law must be disclosed. Convictions dismissed under Health and Safety Code section 11361.8 or equivalent non-California law must be disclosed. Juvenile adjudications and traffic infractions under $300 that did not involve alcohol, dangerous drugs, or controlled substances do not need to be
included. For each conviction, the owner shall provide the following:
- (i) The date of conviction.
- (ii) Dates of incarceration, if applicable.
- (iii) Dates of probation, if applicable.
- (iv) Dates of parole, if applicable.
- (v) A detailed description of the offense for which the owner was convicted.
- (vi) A statement of rehabilitation for each conviction. The statement of rehabilitation is to be written by the owner and may contain evidence that the owner would like the Bureau to consider
that demonstrates the owner’s fitness for licensure. Supporting evidence may be attached to the statement of rehabilitation and may include, but is not limited to, a certificate of rehabilitation
under Penal Code section 4852.01, and dated letters of reference from employers, instructors, or professional counselors that contain valid contact information for the individual providing the
- (M) If applicable, a detailed description of any administrative orders or civil judgments for violations of labor standards, any suspension of a commercial cannabis license, revocation of a commercial cannabis license, or sanctions for unlicensed commercial cannabis activity by a licensing authority, local agency, or state agency against the applicant or a business entity in which the applicant was an owner or officer within the three years immediately preceding the date of the application.
- (N) Attestation to the following statement: Under penalty of perjury, I hereby declare that the information contained within and submitted with the application is complete, true, and accurate. I
understand that a misrepresentation of fact is cause for rejection of this application, denial of the license, or revocation of a license issued.
- (21) Evidence that the applicant has the legal right to occupy and use the proposed location that complies with section 5007 of this division.
- (22) Evidence that the proposed premises is in compliance with Business and Professions Code section 26054(b) and section 5026 of this division.
- (23) For an applicant with 20 or more employees, the applicant shall attest that the applicant has entered into a labor peace agreement and will abide by the terms of the agreement. The
applicant shall submit a copy of the page of the labor peace agreement that contains the signatures of the union representative and the applicant. For applicants who have not yet entered into a labor peace agreement, the applicant shall provide a notarized statement indicating that the applicant will enter into and abide by the terms of a labor peace agreement as soon as reasonably practicable after licensure.
- (24) The applicant shall provide a valid seller’s permit number issued by the California Department of Tax and Fee Administration, if applicable. If the applicant has not yet received a
seller’s permit, the applicant shall attest that the applicant is currently applying for a seller’s permit.
- (25) A diagram of the premises as required by section 5006 of this division.
- (26) Proof of a bond as required by section 5008 of this division
- (27) For testing laboratory applications, the certificate(s) of accreditation as required by section 5702 of this division, or the information required for an interim license as required by section
5703 of this division.
- (28) When an applicant provides a license, permit, or other authorization from the local jurisdiction where the licensed premises will be or is located, the Bureau will notify the
applicable local jurisdiction to confirm the validity of the authorization. If the local jurisdiction does not respond within 10 calendar days, the Bureau shall consider the authorization valid
- (29) All license applications shall include a detailed description of the applicant’s operating procedures. Applicants shall use and submit to the Bureau the following forms, which are incorporated by reference:
- (A) Transportation Procedures, Form BCC-LIC-015 (New 10/18)
- (B) Inventory Procedures, Form BCC-LIC-016 (New 7/18)
- (C) Non-Laboratory Quality Control Procedures, Form BCC-LIC-017 (New 10/18)
- (D) Security Procedures, Form BCC-LIC-018 (New 10/18)
Bureau of Cannabis Control Order of Adoption – 8 of 138
- (E) Delivery Procedures, Form BCC-LIC-020 (New 10/18)
- (30) For applicants applying for a microbusiness license, the application shall include a detailed description of the applicant’s operating procedures required by this section for each cannabis activity the applicant intends to engage in.
- (31) For applicants applying for a testing laboratory license, in addition to the operating procedures required under subsection (c)(29) of this section, the standard application shall include the operating procedures required by Chapter 6 of this division.
- (32) The limited waiver of sovereign immunity required by section 5009 of this division, if applicable.
- (33) Evidence of exemption from, or compliance with, the California Environmental Quality Act as required by sections 5010-5010.3 of this division.
- (34) The applicant’s State Employer Identification Number (SEIN) issued by the California Employment Development Department
- (35) For an applicant with more than one employee, the applicant shall attest that the applicant employs, or will employ within one year of receiving a license, one supervisor and one employee
who has successfully completed a Cal-OSHA 30-hour general industry outreach course offered by a training provider that is authorized by an OSHA Training Institute Education Center to
provide the course.
5006. Premises Diagram
- (a) An applicant shall submit to the Bureau, with the application, a complete and detailed diagram of the proposed premises. The diagram shall be used by the Bureau to determine whether the premises meets the requirements under this division and the Act. The Bureau shall
deny an application if the premises does not qualify for licensure pursuant to Business and Professions Code section 26057.
- (b) The diagram shall show the boundaries of the property and the proposed premises to Bureau of Cannabis Control Order of Adoption – 11 of 138 be licensed, showing all boundaries, dimensions, entrances and exits, interior partitions, walls, rooms, windows, and doorways, and shall include a brief statement or description of the principal activity to be conducted therein.
- (c) The diagram shall show and identify commercial cannabis activities that will take place in each area of the premises, and identify limited-access areas. Commercial cannabis activities that shall be identified on the diagram include the following, if applicable to the business operations: storage, batch sampling, loading or unloading of shipments, packaging and labeling, customer sales, loading for deliveries, extraction, infusion, cultivation, and processing.
- (d) The diagram shall show where all cameras are located and assign a number to each camera for identification purposes unless the premises is exempt from the video surveillance requirement pursuant to section 5315 of this division.
- (e) The diagram shall be to scale.
- (f) The diagram shall not contain any highlighting and the markings on the diagram shall be in black-and-white print.
- (g) If the proposed premises consists of only a portion of a property, the diagram must be labeled indicating which part of the property is the proposed premises and what the remaining property is used for.
- (h) If the proposed premises consists of only a portion of a property that will contain two or more licensed premises, the diagram shall clearly show the designated entrances and walls under the exclusive control of the applicant for the premises, as well as the designated entrances and
walls for each additional premises. The diagram shall also show all proposed common or shared areas of the property. Such areas may include lobbies, bathrooms, hallways, and breakrooms.
- (i) If the proposed premises will be a microbusiness that includes cultivation activities, in addition to the requirements of this section, the premises diagram shall also include all the required information for a premises diagram under section 5501(d) of this division.
- (j) If a proposed premises is located on only a portion of a property that also includes a residence, the diagram shall clearly show the designated buildings for the premises and the
5033. Storage of Inventory
- (a) All inventory stored on the licensed premises shall be secured in a limited-access area.
- (b) A licensee shall not store cannabis goods outdoors.
- (c) Employee break rooms, changing facilities, and bathrooms shall be separated from all storage areas.
- (d) Each location where cannabis goods are stored must be separately licensed.
5036. Notification of Theft, Loss, and Criminal Activity
- (a) A licensee shall notify the Bureau and local law enforcement within 24 hours of discovery of any of the following situations:
- (1) The licensee discovers a significant discrepancy, as defined in section 5034 of this division, in its inventory.
- (2) The licensee discovers diversion, theft, loss, or any other criminal activity pertaining to the operations of the licensee.
- (3) The licensee discovers diversion, theft, loss, or any other criminal activity by an agent or employee of the licensee pertaining to the operations of the licensee.
- (4) The licensee discovers loss or unauthorized alteration of records related to cannabis Bureau of Cannabis Control Order of Adoption- 35 of 138 goods, customers, or the licensee’s employees or agents.
- (5) The licensee discovers any other breach of security.
- (b) The notification to the Bureau pursuant to subsection (a) of this section shall be submitted on the Notification and Request Form, BCC-LIC-027 (New 10/18), which is incorporated herein by reference, and shall include the date and time of occurrence of the theft, loss, or
criminal activity, the name of the local law enforcement agency that was notified, and a description of the incident including, where applicable, the item(s) that were taken or lost.
Authority: Section 26013, Business and Professions Code. Reference: Section 26070, Business and Professions Code
Article 5. Security
§ 5042. Access to Limited-Access Areas
- (a) Licensees shall ensure that only employees of the licensee and other authorized individuals access the limited-access areas of the licensed premises.
- (b) For the purpose of this section, authorized individuals include outside vendors, contractors, or other individuals conducting business that requires access to the limited-access areas.
- (c) An individual who enters the limited-access area and is not employed by the licensee shall be escorted by an employee of the licensee at all times while within the limited-access area.
- (d) A licensee shall maintain a record of all authorized individuals who are not employees of the licensee who enter the limited-access areas. The record shall include the name of the individual, the company the individual works for, the reason the individual entered the limited-access area, the date, and the times the individual entered and exited the limited-access area. These records shall be made available to the Bureau immediately upon request.
- (e) A licensee shall not receive consideration or compensation for permitting an individual to enter the limited-access areas.
- (f) Entrances to all limited-access areas shall have a solid door and a lock meeting the requirements of section 5046 of this division. The door shall remain closed when not in Bureau of Cannabis Control Order of Adoption – 40 of 138 use during regular business hours.
Authority: Section 26013, Business and Professions Code. Reference: Sections 26070 and 26160, Business and Professions Code.
5043. Licensee Employee Badge Requirement
All agents, officers, or other persons acting for or employed by a licensee shall display a laminated or plastic-coated identification badge issued by the licensee at all times while engaging in commercial cannabis activity. The identification badge shall, at a minimum, include the licensee’s “doing business as” name and license number, the employee’s first name,
an employee number exclusively assigned to that employee for identification purposes, and a color photograph of the employee that clearly shows the full front of the employee’s face and that is at least 1 inch in width and 1.5 inches in height.
Authority: Section 26013, Business and Professions Code. Reference: Section 26070, Business and Professions Code.
5044. Video Surveillance System
- (a) Each licensed premises shall have a digital video surveillance system with a minimum camera resolution of 1280 × 720 pixels.
- (b)The video surveillance system shall at all times be able to effectively and clearly record images of the area under surveillance.
- (c) Each camera shall be permanently mounted and in a fixed location. Each camera shall be placed in a location that allows the camera to clearly record activity occurring within 20 feet of all points of entry and exit on the licensed premises, and allows for the clear and certain
identification of any person and activities in all areas required to be filmed under subsection
- (d) of this section.
- (d) Areas that shall be recorded on the video surveillance system include the following:
- (1) Areas where cannabis goods are weighed, packed, stored, loaded, and unloaded for transportation, prepared, or moved within the licensed premises;
- (2) Limited-access areas;
- (3) Security rooms;
- (4) Areas storing a surveillance-system storage device with at least one camera recording the access points to the secured surveillance recording area; and
- (5) Entrances and exits to the licensed premises, which shall be recorded from both indoor and outdoor vantage points.
- (e) Licensed retailers and licensed microbusinesses authorized to engage in retail sales shall also record point-of-sale areas and areas where cannabis goods are displayed for sale on the video surveillance system. At each point-of-sale location, camera placement must allow for the
recording of the facial features of any person purchasing or selling cannabis goods, or any person in the retail area, with sufficient clarity to determine identity.
- (f) Cameras shall record continuously 24 hours per day and at a minimum of 15 frames per second (FPS).
- (g) The physical media or storage device on which surveillance recordings are stored shall be secured in a manner to protect the recording from tampering or theft.
- (h) Surveillance recordings shall be kept for a minimum of 90 calendar days.
- (i) Surveillance recordings are subject to inspection by the Bureau, and shall be kept in a manner that allows the Bureau to view and obtain copies of the recordings at the licensed premises immediately upon request. The licensee shall also send or otherwise provide copies
of the recordings to the Bureau upon request within the time specified by the Bureau.
- (j) Recorded images shall clearly and accurately display the time and date. Time is to be measured in accordance with the standards issued by the United States National Institute of Standards and Technology.
- (k) The video surveillance system shall be equipped with a failure notification system that provides notification to the licensee of any interruption or failure of the video surveillance system or video surveillance-system storage device.
- (l) If multiple licensed premises are contained within the same building, a single video surveillance system covering the entire building may be used by all of the licensees under the following conditions:
- (1) Each applicant or licensee shall disclose on their premises diagram where the surveillance recordings are stored
- (2) Each applicant or licensee shall include in their security operating procedures, submitted with the application pursuant to section 5002(c)(29)(D) of this division, an explanation of how
the video surveillance system will be shared, including who is responsible for monitoring the video footage and storing any video recordings.
- (3) All licensees shall have immediate access to the surveillance recordings to produce them pursuant to subsection (i) of this section.
- (4) All licensees shall be held responsible and subject to discipline for any violations of the video surveillance requirements.
5045. Security Personnel
- (a) A licensed retailer or licensed microbusiness authorized to engage in retail sales shall hire
or contract for security personnel who are at least 21 years of age to provide on-site security
services for the licensed retail premises during the hours of operation. All security personnel hired or contracted for by the licensee shall be licensed by the Bureau of Security and Investigative Services and shall comply with Chapters 11.4 and 11.5 of Division 3 of the Business and Professions Code.
- (b) Notwithstanding subsection (a) of this section, a licensed non-storefront retailer or licensed microbusiness who is not engaged in storefront retail sale is not required to hire or contract for
Bureau of Cannabis Control Order of Adoption – 42 of 138
- (c) If multiple licensed premises are contained within the same building, security personnel may be shared by all of the licensees to cover the entire building under the following conditions:
- (1) Each licensee shall include in their security operating procedures, submitted with the application pursuant to section 5002(c)(29)(D) of this division, an explanation of how security
personnel will be shared, including who is responsible for employing or contracting the security personnel.
- (2) All licensees shall be held responsible and subject to discipline for any violations of the security personnel requirements.
A licensee shall ensure that the limited-access areas described in section 5042 of this division can be securely locked using commercial-grade, nonresidential door locks. A licensee shall
also use commercial-grade, nonresidential door locks on all points of entry and exit to the licensed premises.
5047. Alarm System
- (a) A licensee shall maintain an alarm system as defined in Business and Professions Code section 7590.1(n) at the licensed premises.
- (b) A licensee shall ensure a licensed alarm company operator or one or more of its registered alarm agents installs, maintains, monitors, and responds to the alarm system.
- (c) Upon request, a licensee shall make available to the Bureau all information related to the alarm system, monitoring, and alarm activity.
- (d) If multiple licensed premises are contained within the same building, a single alarm system covering the entire building may be used by all of the licensees under the following conditions:
- (1) Each licensee shall include in their security operating procedures, submitted with the application pursuant to section 5002(c)(29)(D) of this division, an explanation of how the
alarm system will be shared, including who is responsible for contracting with the alarm company.
- (2) All licensees shall have access to and be able to provide the information under subsection (c) of this section.
- (3) All licensees shall be held responsible and subject to discipline for any violations of the alarm system requirements.
5403.1 Requirements While Not Open for Business
At any time the licensed premises is not open for retail sales, a licensed retailer shall ensure that:
- (a) The licensed premises are securely locked with commercial-grade, nonresidential door locks as required in section 5046 of this division;
- (b) The licensed premises is equipped with an active alarm system pursuant to section 5047 of this division, which shall be activated when the licensed retailer or its employees are not on the licensed premises; and
- (c) Only employees of the licensee and other authorized individuals are allowed access to the licensed premises. For the purposes of this section, authorized individuals include individuals employed by the licensee as well as any outside vendors, contractors, or other individuals conducting business that requires access to the licensed premises.
- (d) The account manager shall maintain a complete, accurate, and up-to-date list of all track and trace system users, consisting of their full names and usernames.
You can view the program webpage here.