As the late, great Yogi Berra famously quipped, “It’s déjà vu all over again.” That phrase perfectly captures what I’m seeing today in the CBD industry, a regulatory and enforcement landscape that feels eerily reminiscent of my experience in the mortgage sector during the post-crisis crackdown.

Back in my mortgage industry days, I watched firsthand as the federal government launched an aggressive crackdown using the False Claims Act (FCA) to pursue mortgage companies that cut corners, falsified documents, or otherwise failed to play by the rules.

The FCA, originally signed into law during the Civil War to combat wartime procurement fraud, was revitalized after 2008 to target mortgage lenders and servicers who knowingly submitted false certifications or misrepresented compliance in government-backed loans and foreclosure relief programs.

Egregious actors who thought “it’s cheaper to play the odds than pay the odds” got a rude awakening as civil and federal litigation led to massive settlements, industry-wide accountability, and much tighter lending standards.

The consequences were so far-reaching that the collapse of countless mortgage companies was tracked daily on a website that still exists today called the Mortgage Implodometer, a veritable casualty list of those who bet against compliance and lost.

The FCA gave regulators and whistleblowers alike the power to bring civil actions with treble damages and significant penalties, transforming the risk calculus for everyone in the industry. Box-checking, paper compliance became obsolete: instead, verifiable, auditable, and systemic imbedded and technical compliance controls became the new normal, as non-compliant actors faced public exposure and permanent business consequences.

Now, this same dynamic is playing out in the CBD and hemp industry through the use of civil RICO statutes. When I entered the CBD space in 2018, I predicted the regulatory pendulum would swing, ushering in a new wave of civil litigation and enforcement. Many dismissed the warning, just as they did in the early 2000s in the mortgage world. “It’s cheaper to play the odds than pay the odds” was once again a common refrain, until history began to repeat itself.

Today, after the recent Supreme Court’s civil RICO ruling, and amid sweeping changes and heightened scrutiny in hemp and CBD laws scheduled for future implementation, the compliance mandate in CBD is being delivered not just through agency letters, fines, fees and penalties, but by empowering consumers, competitors, and ex-employees to bring triple-damages lawsuits over egregious fraud, mislabeling, and even mail fraud involving shipped products.

Like the False Claims Act, civil RICO reaches entire chains of bad actors and rewards those who call out misconduct. With pending federal legislation likely to ban most intoxicating and synthetic hemp products, allowing only narrowly defined, non-intoxicating derivatives within the next year, the risk landscape is intensifying. Everyone in the marketing, manufacturing, and fulfillment chain is at risk if they're linked to deceptive commerce, and no one is insulated by plausible deniability anymore.

What does this mean for the CBD industry?

• “THC-Free” and other high-risk claims that lack robust, batch-level substantiation are now legal tripwires, not mere marketing hooks.
• If your business or your partners are implicated in deceptive or fraudulent actions, the litigation risk and remediation costs may be existential.
• The era of compliance “theater” is over. Only those building real, technology-enabled, audit-ready systems for traceability, marketing accuracy, and supply chain due diligence can thrive moving forward.
• Banks and credit card merchant processing partners have become far more vigilant; even minor missteps or compliance gaps can trigger immediate account suspensions, frozen funds, or sudden termination of payment services and this can happen overnight with little warning.
• Insurance companies may deny claims outright if they find evidence of negligence, leaving businesses exposed to risk and without recourse.
• The strategic shift must be from “fire fighting” to “fire prevention”: proactive risk management and transparent operations are now essential.
• Superficial compliance is no longer enough. Only those building real, technology-enabled, audit-ready systems for traceability, marketing accuracy, and supply chain due diligence can thrive moving forward

As I liked to say in my last company on the mortgage regulatory technology side, “the game has changed, it’s time to play different.” Those who still “play the odds” face the very real prospect of becoming this industry’s version of a cautionary tale—a caution tracked not just by competitors and regulators, but by litigants and their counsel. As with the Mortgage Implodometer, loss of trust and reputation is public, immediate, and often permanent.

References:

• Boof du Jour, "Civil RICO for Dummies: How a Supreme Court Case Just Made Your Shopify Store a Syndicate"
• FHA and HAMP mortgage fraud settlements and False Claims Act use
• DOJ/CFPB post-crisis False Claims Act enforcement and recoveries
• The Mortgage Implodometer and industry impact