New York cannabis compliance, end to end.

How the New York program is structured

The Marijuana Regulation and Taxation Act (MRTA) was signed in March 2021, establishing New York's adult-use cannabis program alongside the pre-existing medical framework (operational since 2014 under the Compassionate Care Act). Adult-use retail sales began in December 2022 with the launch of the Conditional Adult-Use Retail Dispensary (CAURD) program. MRTA created the Cannabis Control Board (CCB) — a five-member policy-setting body appointed by the Governor and legislative leaders — and the Office of Cannabis Management (OCM), the operational regulator. OCM writes rules under 9 NYCRR Parts 113 (license standards), 124 (operating requirements), 125 (packaging, labeling, marketing, advertising), and 130 (testing); issues licenses; runs inspections; and brings enforcement actions. The statutory framework sits in the Cannabis Law (Article 13-A).

For an operator, the regulator-statute distinction matters because almost every compliance question routes through OCM, but the rule itself sits in 9 NYCRR — and citations on a notice of violation will reference the regulation, not the statute. Knowing both the program structure and the rule numbering is the difference between cleanly cured findings and accidental repeat violations.

Four structural features make New York's compliance environment distinctive among US cannabis programs.

The first is the Conditional Adult-Use Retail Dispensary (CAURD) program — the country's first major effort to ensure that the licensed adult-use market opened to entrepreneurs harmed by past cannabis enforcement, not just to capitalized investors. CAURD eligibility required prior cannabis-related convictions (or family member convictions) and qualifying business ownership experience. The CAURD program represents one of the most consequential equity-prioritization frameworks in any US state cannabis program. While new CAURD applications have closed, the existing CAURD cohort continues to operate; CAURD licensees face specific compliance attention around continued SEE eligibility and priority-status maintenance.

The second is the Social and Economic Equity (SEE) priority framework. MRTA established SEE priority designations covering individuals from communities disproportionately impacted by past cannabis enforcement, minority-owned businesses, women-owned businesses, distressed farmers, and service-disabled veterans. SEE-priority designations affect license-award scoring and ongoing compliance obligations. For SEE-priority licensees including the CAURD cohort, ongoing documentation that the as-applied eligibility criteria continue to be met is itself a load-bearing compliance commitment — loss of priority status mid-license is one of the more avoidable enforcement outcomes and undermines the priority-driven award.

The third is the True Party of Interest (TPI) framework. New York's TPI rules under 9 NYCRR Part 113 establish one of the strictest cross-tier ownership concentration regimes in US cannabis. The framework caps how much ownership any single party can hold across the supply chain — common ownership between cultivators and retailers, distributors and retailers, or processors and retailers is generally prohibited outside the vertically-integrated Microbusiness and ROND structures. The TPI analysis reaches beneficial ownership, financial relationships, and operational control — not just nominal ownership. The framework exists to prevent the kind of vertical integration that emerged in other state programs and to preserve a multi-tier market structure. Cross-tier ownership violations are bright-line findings with significant administrative exposure including potential structural unwind orders.

The fourth is the packaging pre-approval requirement. New York is one of the few US programs that requires cannabis product packaging to be submitted to and approved by OCM before any product enters distribution. The pre-approval process verifies compliance with the packaging requirements at 9 NYCRR Part 125 — child-resistance, mandated warnings, lab result references, font-size minimums, THC content disclosure — before market entry rather than at random inspection. The practical effect is that non-approved packaging in circulation is itself the citation basis, separate from any underlying labeling content failure.

Layered on top of these structural features are the granular licensing framework, the legacy medical Registered Organization structure, and the local opt-in framework.

Granular licensing. The MRTA framework spans 13 distinct adult-use license types — Cultivator (with the legacy Conditional Adult-Use Cultivator class), Processor, Distributor, Retail Dispensary (with the legacy CAURD cohort), Microbusiness, On-Site Consumption, Delivery, Cannabis Laboratory, Cannabis Nursery, Cannabis Cooperative, ROND (Registered Organization with Non-Dispensing), Registered Organization (medical), and the priority-cohort overlay structures — each with its own application path, fee schedule, ongoing reporting cadence, and inspection focus. Where most states have five or six license types, New York's structure fragments authority across the supply chain to support the multi-tier market that the TPI framework is designed to preserve.

Legacy medical Registered Organization framework. Pre-MRTA medical Registered Organizations (vertically integrated medical cultivation-processing-dispensing operations established under the 2014 Compassionate Care Act) had two paths after MRTA: continue under the Registered Organization (medical) structure for medical-only authority, or convert to ROND (Registered Organization with Non-Dispensing) status to add adult-use cultivation, processing, and distribution rights without competing for the limited retail authority. The ROND structure is one of New York's transitional accommodations for pre-MRTA operators.

Local opt-in. MRTA gave New York municipalities the authority to opt out of allowing adult-use retail dispensaries and on-site consumption establishments within their borders. The opt-out had to be exercised by the end of 2021; municipalities that did not opt out by the deadline are "opted in" by default. Many municipalities took the opt-out, particularly for retail. Operating outside the approved municipal envelope is one of the most consequential structural findings.

Track-and-trace is METRC, with mandatory tagging from cultivation through retail sale. The early-rollout period saw a transition from BioTrack-administered traceability to METRC; the platform has been operational across the adult-use program as it has scaled.

What OCM inspectors actually check

A New York cannabis inspection covers far more than a checklist walk-through. Inspectors arrive with a copy of the licensee's filed security plan, SOP submissions, prior inspection findings, packaging pre-approval records, True Party of Interest disclosures, SEE-status filings, and any open complaints. The on-site visit then verifies that what's filed matches what's happening — and that gap is where most citations come from. The OCM-specific focus areas:

• Track-and-trace data integrity. Inspectors will pull a sample of recent transactions and walk them backward through METRC, comparing tag movement, weight discrepancies, and timing against physical inventory. Discrepancies above the de minimis threshold trigger reconciliation requirements at minimum and citations with $1,000–$10,000-per-occurrence penalty exposure for pattern findings.
• True Party of Interest concentration currency. OCM expects ownership filings to remain current, with proactive disclosure of any pending changes. Cross-tier ownership findings — surfaced during change-of-control reviews, complaint-driven investigations, or financial-disclosure reconciliations — can trigger administrative action including potential structural unwind orders.
• SEE and CAURD status documentation. For SEE-priority licensees and the CAURD cohort, inspectors check that the as-applied eligibility criteria continue to be met and that ongoing documentation supports the priority-status award.
• Camera and security plan compliance. Coverage of every required area, retention period adherence, and alarm-system functionality are routinely checked under 9 NYCRR § 124.6. Cameras with blind spots over critical areas (vault, sales floor exits, packaging stations) are a top-five citation category.
• SOPs on premises and acknowledged. Every required SOP must be available on-site (digital is acceptable in most circumstances) and there must be evidence that current employees have acknowledged the most recent version. Stale acknowledgments after an SOP update — particularly an SOP update driven by a 9 NYCRR revision — is a common quiet violation that compounds at the next inspection.
• Training records. Responsible-vendor training certificates, license-specific training (e.g., extraction safety for processors), and onboarding/continuing-education records are all subject to spot-check. Missing or expired certificates become individual citations per affected employee.
• Packaging pre-approval compliance. Inspectors verify that packaging in circulation matches OCM-approved designs. Non-approved packaging found in distribution is itself the citation basis, separate from any underlying labeling content failure.
• Packaging and labeling content. Random product samples are inspected against 9 NYCRR Part 125 — child-resistance, mandated warnings, lab result references, font-size minimums, THC content disclosure. Non-compliant inventory can be embargoed pending relabeling even where the design was pre-approved.
• Pre-retail testing compliance. Inspectors verify that retail-ready inventory has corresponding COAs from accredited Cannabis Laboratories and that testing happened in the correct sequence per 9 NYCRR Part 130. Untested or failed-test inventory found in retail-ready locations is grounds for embargo and mandatory destruction.
• Local opt-in and municipal-ordinance compliance. Operating outside the approved municipal envelope is one of the most consequential structural findings. Inspectors check the as-operated arrangement against the as-approved municipal record.
• Recordkeeping currency. Manifest copies, destruction logs, recall procedures, and visitor logs are checked for completeness and recency. A recordkeeping gap is treated more seriously than a one-off operational miss because it suggests a systemic deficiency.

The pattern: OCM inspectors are not looking for whether you have systems — they're looking for whether your systems produce the documentation an inspection requires, on the day of the inspection, without scrambling.

Common violations and how to prevent them

Six categories produce the majority of OCM citations:

1. Track-and-trace discrepancies. Daily inventory counts reconciled against METRC, with discrepancies investigated and documented within 24 hours. The citation isn't usually about the discrepancy itself; it's about the absence of an investigation trail. With penalty exposure at $1,000–$10,000 per occurrence, pattern findings compound quickly.
2. True Party of Interest concentration and SEE status currency. Annual structural attestation against the as-applied ownership and priority-status filings, with proactive disclosure of any pending ownership or financial-control changes. New York's TPI framework is one of the strictest in US cannabis; the compliance discipline has to reflect that.
3. Packaging pre-approval gaps. A pre-approval submission workflow with versioned approval records; document vault retention for every approved design; SOPs that require pre-approval verification before any new SKU enters distribution. Vendor-supplied packaging still needs licensee verification against the OCM-approved design.
4. Training gaps. Automated assignment-by-role plus expiration tracking with multi-stage alerts (90/60/30/14/7 days). Manual tracking via spreadsheets has a near-100% rate of missed renewals across multi-employee operations. Responsible-vendor training at the retail tier is the highest-leverage tracking discipline.
5. SOP staleness. A publication workflow with mandatory acknowledgments — new versions trigger an acknowledgment requirement that's tracked per employee until cleared. Manual SOP management consistently leaves a long tail of un-acknowledged versions, particularly after 9 NYCRR revisions land.
6. Security plan deviations. Monthly self-audits against the filed plan, with any deviations either corrected immediately or filed as plan amendments before they're discovered at inspection.

The throughline: each of these categories is structural. The fix is a process that runs on its own cadence, not a heroic effort just before an inspection.

Required SOPs and recordkeeping

Every New York licensee must maintain SOPs covering, at minimum, the categories in the quick-reference list above. License-type additions:

• Adult-Use Cultivators must maintain pesticide and IPM SOPs, plus harvest, drying, and curing procedures. Tier-based environmental and water-management SOP expectations scale with canopy size.
• Adult-Use Processors running solvent-based extraction must maintain extraction-method-specific safety SOPs, plus per-equipment operating procedures and a master sanitation SOP.
• Adult-Use Distributors must maintain transportation manifest handling SOPs covering inter-licensee transfers and chain-of-custody documentation.
• Adult-Use Retail Dispensaries must maintain sale-to-minors prevention SOPs that mirror the POS system's age-verification flow, plus responsible-vendor training tracking SOPs that cover assignment, completion, and renewal cycles.
• Microbusinesses must maintain the full SOP stack appropriate to their operating combination — cultivator, processor, distributor, and retail SOPs as applicable.
• On-Site Consumption Establishments must maintain product-format and on-premise consumption SOPs covering what can be served, consumption-method limits, on-site staffing requirements, customer behavioral controls, and incident response.
• Delivery licensees must maintain a driver-protocol SOP covering route documentation, hand-off verification, ID verification at the customer location, vehicle security, and incident response.
• Cannabis Laboratories must maintain independence attestation SOPs covering ownership-structure documentation and the operating protocols that preserve structural separation from regulated cultivation, processing, distribution, and retail.
• SEE and CAURD priority holders must maintain a priority-status maintenance SOP covering annual attestation against the as-applied eligibility criteria, change-of-control workflows, and proactive notification protocols for any material change.
• Every licensee must maintain a True Party of Interest attestation SOP covering ownership-concentration documentation, beneficial-ownership analysis, and proactive disclosure of any pending ownership or financial-control changes. Local opt-in and municipal-ordinance compliance SOPs apply to every licensee.

Recordkeeping retention defaults are typically five years for transactional and inventory records, two years for security camera footage (longer for incident-related footage), and the duration of employment plus an additional period for personnel records. Packaging pre-approval records, True Party of Interest filings, and SEE/CAURD status documentation are themselves subject to retention requirements; the OCM's specific retention schedules are published per record class and should be the source of truth for retention policy configuration.

How Verdaxi maps to New York's requirements

Verdaxi was built for the operator-side discipline that New York's structurally distinctive, equity-prioritized, concentration-capped compliance regime demands. The compliance product covers state-specific checklists with citation linkage to 9 NYCRR Parts 113, 124, 125, and 130, automated inspection prep, violation tracking with OCM fine-schedule exposure estimates (including the $1,000–$10,000-per-occurrence range), versioned SOPs with per-version acknowledgments, retention-policy-enforced document vault, training matrix with multi-stage expiration alerts, and a real-time compliance health score.

Where New York's complexity bites — the True Party of Interest concentration framework with its beneficial-ownership analysis, the SEE and CAURD priority-status maintenance obligations, the packaging pre-approval workflow requirement, the thirteen-license-type structure with granular per-type compliance baselines, the local opt-in framework, the legacy medical Registered Organization and ROND transitional structures — the Verdaxi compliance product earns its place. True Party of Interest attestation workflows keep ownership disclosures current and surface change-of-control disclosure obligations ahead of pending transactions. Packaging pre-approval workflows route every new SKU through the OCM submission process with versioned approval records; the document vault retains every approved design. SEE and CAURD priority-status maintenance workflows track eligibility-criteria currency separately from operational compliance, so priority-status risk is visible alongside everyday compliance posture. Versioned SOPs with per-version acknowledgments prevent the long-tail acknowledgment gaps inspectors specifically check for — particularly important after 9 NYCRR revisions, which have arrived at meaningful cadence.

The product is system-agnostic on track-and-trace. New York runs METRC; Verdaxi's reconciliation workflows, audit log, and SOP discipline apply equally to METRC, CCRS, BioTrack, and any successor system — the same operator-side compliance posture works across state boundaries regardless of which track-and-trace platform the state mandates.

For multi-license New York operators — particularly Microbusinesses running the full vertical stack under a single license, ROND operators running cultivation-processing-distribution across multiple sites, and multi-license operators carefully structured to comply with the True Party of Interest cross-tier concentration limits — Verdaxi's multi-tenant architecture provides one platform across every license with org-wide rollup and per-license drill-down. Same code path for the single-license CAURD retailer and the multi-facility ROND portfolio.

Start with the free trial and run a full inspection-prep cycle on your own data, or book a demo to see New York-specific checklists and SOP templates side-by-side with what you have in place today.