Enforcement
Penalty & fine exposure index
Every rule in the library whose own wording names money at stake, a license action or a response deadline. Nothing here is estimated — open a rule to see its text and official source.
22 rules
Notify OBN within one business day of discovering any charge, arrest or conviction of a beneficial owner, agent, employee, contractor or subcontractor.
Why it matters: This covers contractors too, not only staff.
OBN registrants that manufacture or distribute medical marijuana must hold a DEA registration or a timely DEA application. OBN may start administrative action on Jan 1, 2027, up to revoking the OBN registration.
Why it matters: Growers and processors count as manufacturers. Losing the OBN registration also stops you under OMMA's rules.
Don't give access to controlled substances to anyone convicted of a felony relating to controlled substances, or whose DEA registration was denied, revoked or surrendered for cause.
Why it matters: An OMMA employee credential doesn't settle this, so screen for it separately.
Before trading, collect the partner's DEA submission confirmation or registration certificate and a copy of their active state license, and verify their document control number (DCN) on DEA's website. Document every check. Your supply chain must be fully verified by Nov 29, 2026.
Why it matters: Dealing with a business that doesn't qualify can be grounds to deny your application or revoke your registration.
Notify your DEA Field Division in writing within one business day of discovering a theft or significant loss, and file DEA Form 106 online within 45 days.
Why it matters: This is the general rule for DEA registrants. DEA hasn't published marijuana-specific guidance, but reporting on both clocks is the safe course.
Each grower license needs a surety bond of at least $50,000, or an attestation with documents showing you owned the property for at least five years before applying. Renew an expiring bond at least 30 days before it expires. If the surety cancels, file a replacement before the cancellation takes effect.
Why it matters: A lapsed bond is grounds for revocation, non-renewal or fines, and OMMA can recall the bond for up to a year after a license ends.
Correct any correctable violation within 30 days of written notice and follow any corrective-action directive. Failing to correct within 30 days carries a $500 fine per violation, plus other penalties.
Why it matters: Fixing it on time usually ends the matter. Missing the deadline makes it a fine.
Processors making edibles must meet food safety standards and can't make them in a home, living or sleeping area, or adjoining space. Edible labels need about 20 elements, including allergens, lot code, nutrition facts where applicable, mg of THC per serving and a poison-control statement.
Why it matters: Edible labels fail inspection more often than any other product type because the list is long.
Applying for a license is consent to on-site inspection during business hours. Answer a written request for records within 10 business days. Fix a correctable violation within 30 days of a written notice, or pay a $500 fine per violation on top of other penalties.
Why it matters: Refusing entry or records is its own violation. The 30-day window is your chance to fix problems before fines start.
Join external quality-control testing at least 3 times a year. More than 20% unsatisfactory results is a failure, and two consecutive (or two of three) failures can bring suspension or revocation. Send PT and audit results to OMMA within 30 days.
Why it matters: After a failed analyte, re-check batch results since your last good test.
A qualified lab director (bachelor's degree with 24 chemistry credit hours and 2 years' experience) or written designee is on site during operating hours. Notify OMMA of a director change within 7 business days. Follow OSHA 29 CFR 1910.1450, and assess staff within 6 months of hire, then yearly.
Why it matters: Director changes are a 7-day clock.
Don't let anyone else use your license number or operate under your license.
Why it matters: Renting a license out is grounds for revocation.
Batches that fail for pesticides, heavy metals or mycotoxins must be destroyed. Microbial, solvent, foreign-matter and moisture failures may be remediated.
Why it matters: Know which failures are final before you spend on retests.
OMMA visits within 180 days of licensing to confirm you're operating or actively working toward it. Without proof you get a 180-day grace period, possibly one more (never past the license term). Then OMMA must seek revocation.
Why it matters: Paper licenses with no operation are a stated enforcement priority.
If a batch fails, document re-sampling, re-testing and any decontamination or remediation, and give the lab the decontamination method before it retests.
Why it matters: Without these records a passing retest doesn't clear the batch.
Respond to OMMA's written request for records within 10 business days.
Why it matters: Not producing records is grounds for suspension or revocation on its own.
Request a reserve-sample retest within 30 days. If the first retest fails the same analyte, remediate or destroy. If it passes, a second retest must also pass before sale.
Why it matters: One clean retest isn't enough. Plan for two.
Transport product in a locked container, hidden from view and labeled "Medical Marijuana or Derivative", in a part of the vehicle the driver can't reach. Transfers between licenses at the same address are exempt.
Why it matters: A box on the passenger seat fails two requirements at once.
Name a new administrator within 30 business days of a change, and remove a user's access within 3 business days after they leave or stop using the system.
Why it matters: Former employees with live logins are an audit finding and a diversion risk.
At least one owner or manager must be a Metrc administrator. Assign a replacement administrator within 30 business days of a change. Remove a departing user's access within 3 business days. Every user needs their own login; never share credentials.
Why it matters: Shared logins and former employees with access are easy inspection findings, and they make a theft impossible to trace.
Root balls, stems, fan leaves, seeds and stalks may be disposed of on-site (burning, burying, composting or another DEQ-approved method) with a disposal log signed under penalty of perjury. Other waste is tagged, reported in Metrc, kept in a locked receptacle, and disposed of through a licensed waste facility within 90 days.
Why it matters: The disposal log rule alone says 5 years, but OMMA's general record rule is 7, so keep waste records 7 years.
No license for owners under 25, anyone with a disqualifying conviction (including corporate officers, directors and stockholders), owners with unpaid marijuana business taxes, law enforcement and OMMA staff, local officials where you're located, caregivers whose authority was revoked, or anyone who ran a business that lost its license for cause within 5 years.
Why it matters: One ineligible owner puts the whole license at risk, so screen before you add an investor.