Mission Statement

iComply, LLC’s mission is to provide our clients the most relevant, effective, meaningful and comprehensive regulatory compliance support by delivering leadership, integrity and excellence in every service we offer. We embody impeccable quality and value through our commitment, passion and dedication to deliver the best performance for our customers, the industry as well as the health and safety of the public. Our objective is to help our trainees feel: Engaged! Educated!! Empowered!!! In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance is a necessary goal which cannabis organizations always aspire to. This is best achieved by each individual knowing and following steps to comply with laws and regulations relevant to their roles and responsibilities as a team. It is imperative that each employee has a complete and thorough understanding of the laws, rules, and regulations that pertains to them. This understanding is essential in protecting everyone as the industry moves from prohibition to a legal, regulated model.

If at any time you require additional instruction or clarity on any aspect of our training, please let your trainer know. We encourage your feedback and suggestions in order to foster continual employee improvement.

1 © iComply, LLC 2019 V.05.22.19..01

Comprehensive Compliance Training

OUR GOAL: Ensure that you are knowledgeable, competent, and confident in the duties and regulations required for you to perform your job in a compliant and responsible manner as a Responsible Vendor.

OUR OBJECTIVES: By the end of this course, students will demonstrate knowledge of marijuana’s physical effects on the human body, general laws and regulations on transfers to consumers, packaging and labeling requirements, access to the medical marijuana online patient registry and resources, and applicable health and safety state and local regulations and laws pertaining to their role in the , how to identify acceptable forms of ID and to prevent sales to minors, and competency in following laws affecting their jobs in a professional manner to protect and strengthen the integrity of the industry.

Everyone involved in Colorado’s industry has a responsibility to know and understand the rules and regulations that govern this extraordinary paradigm shift. We also bear the responsibility as citizens to act in the utmost good faith as Responsible Vendors for the sake of the at-large community - not just in Colorado, but for all that will benefit from safe and regulated access to cannabis.

Welcome to our Comprehensive Compliance Training!

2 © iComply, LLC 2019 V.05.22.19..01

Table of Contents Table of Contents ...... 3 Section 1 ...... 6 Regulatory Enforcement ...... 6 Regulatory Terms ...... 7 Colorado Cannabis Industry ...... 9 How Rules are Made ...... 10 iComply's Government Relation Efforts ...... 11 Strategic Allies in Government Relations ...... 12 DOJ Enforcement Priorities ...... 14 Duties & Powers of the MED and Local Authorities ...... 15 License Infractions & Violations ...... 16 Excercise: Assessing License Violations ...... 18 Mitigating/Aggravating Factors ...... 19 Section 2 ...... 21 Facility Requirements ...... 21 Compliance Binder ...... 22 Badges and Identification ...... 23 Facility Diagrams ...... 26 Limited Access Areas ...... 27 Restricted Access Areas ...... 28 Visitors ...... 29 Permitted Hours of Operation ...... 30 Records and Retention ...... 31 Reporting Requirements ...... 33 Cameras and Video Surveillance ...... 35 Security Alarm System Requirements ...... 39 Outdoor/Greenhouse Cultivations ...... 40 Dual Purpose Facility Requirements ...... 41 METRC Overview ...... 43 Using METRC ...... 49

3 © iComply, LLC 2019 V.05.22.19..01

Signage, Marketing, and Advertising ...... 52 Health and Safety ...... 53 Disposal of Cannabis Waste and Fibrous Waste ...... 58 Inventory Management ...... 59 Third Party Responsibility ...... 59 Section 3 ...... 61 Cultivation and Manufacturing...... 61 Cultivation and Production Terms ...... 62 Plant Counts and Production Limits ...... 66 Propagation and Immature Plants ...... 69 RFID Tags and Plant Tracking ...... 71 Vegetative and Flower Cycles ...... 72 Harvest, Manufacturing & Processing ...... 73 Marijuana Infused Products Manufacturing ...... 74 Audited Products, Alternative Use Products and Adverse Event Reporting ...... 76 Concentrate Production ...... 77 Infused Product and Concentrate Contract Manufacturing ...... 81 MIP Health & Safety ...... 82 Samples and Test Batches ...... 83 Contaminant Testing ...... 86 Potency Testing ...... 94 Sampling Units and Sampling Managers ...... 97 Wholesale and Transfer ...... 99 Centralized Distribution Permits ...... 104 Transfer of Fibrous Waste ...... 105 Standard Operating Procedures (SOPs) ...... 106 Prohibited Chemicals ...... 109 Section 4 ...... 111 Store/Center Operations ...... 111 Qualifying Medical Patients and Retail Customers ...... 112 Acceptable Forms of ID ...... 114 Invalid and False Identification ...... 115

4 © iComply, LLC 2019 V.05.22.19..01

Sales to Minors ...... 118 Equivalency Standards ...... 119 Registration of a Primary MMC and Caregiver Cultivation Registration ...... 121 Types of Caregivers ...... 122 Medical Patients ...... 124 Medical Marijuana Patient Registry Applicant Types and Qualifying Conditions ...... 125 Patient Privacy ...... 126 Online Patient Registry ...... 127 Medical Patient Online Registry Access ...... 128 Medical Patient Registry Email Notification System Sign-Up ...... 132 Section 5 ...... 134 Responsible Operations and Labeling ...... 134 Health and Safety Concerns of Marijuana Use ...... 135 Effects of Marijuana Use While Pregnant or Breastfeeding ...... 136 Amount of Time to Feel Impairment from Marijuana Use ...... 138 Amount of Time to Wait before Driving after Marijuana Use ...... 140 Recognizing Signs of Impairment ...... 141 Appropriate Response to Unintentional or Over-Consumption of Marijuana ...... 142 Additional Health and Safety Resources for Marijuana Use ...... 143 Responsible Operator Obligations ...... 144 Conduct of the Establishment ...... 145 Packaging and Labeling Information ...... 146 General Labeling Requirements ...... 149 Shipping Container Packaging ...... 153 Universal Symbol ...... 154 Symbols ...... 155

5 © iComply, LLC 2019 V.05.22.19..01

Section 1 Regulatory Enforcement

- Regulatory Terms - Colorado Cannabis Industry - How Rules are Made - iComply’s Government Relation Efforts - Strategic Allies in Government Relations - DOJ Enforcement Priorities - Duties & Powers of the MED and Local Authorities - License Infractions & Violations - Exercise: Assessing License Violations - Mitigating/Aggravating Factors

6 © iComply, LLC 2019 V.05.22.19..01

Regulatory Terms

- “AUD” Alterative Use Designation

- “AP” Audited Product *

- “ATP” Approved Training Program *

- “AUP” Alternative Use Product *

- “CDP” Centralized Distribution Permit *

- “CDPHE” Colorado Department of Public Health and Environment

- “DOJ” Department of Justice

- “DOR” Department of Revenue

- “FW” Fibrous Waste *

- “IFP” Industrial Fiber Products *

- “IFPP” Industrial Fiber Products Producer *

- “LRB” Licensed Research Business (a medical marijuana R&D cultivation or a medical marijuana R&D

facility) *

- “LVAPS” License Violation Affecting Public Safety

- “MED” Marijuana Enforcement Division

- “METRC” Marijuana Enforcement Tracking Regulatory Compliance (aka, “seed-to-sale inventory tracking

system”, or “state inventory tracking system”)

- “MMB” Medical Marijuana Business (a medical center, infused products manufacturer, cultivation, testing

facility, business operator, transporter, R&D facility or R&D cultivation)

- “Minor” Any person under the age of 21 years old

- “MMC” Medical Marijuana Center (aka, “Center”)

7 © iComply, LLC 2019 V.05.22.19..01

- “MMJ” Medical Marijuana

- “MMIPM” Medical Marijuana-Infused Products Manufacturer (aka, “MMIPM”)

- “MMT” Medical Marijuana Transporter (aka, “Medical Transporter”)

- “MMTF” Medical Marijuana Testing Facility (aka, “Medical MTF”)

- “OPCO” Optional Premise Cultivation Operation (aka, “Medical grow” or “Medical cultivation”)

- “PPE” Personal Protective Equipment

- “PM” Pesticide Manufacturer

- “RMJ” Retail Marijuana

- “RMCF” Retail Marijuana Cultivation Facility (aka, “Retail grow”, “Retail OPC”, or “Retail cultivation”)

- “RME” Retail Marijuana Establishment (a retail store, cultivation, products manufacturer, testing facility,

establishment operator or a transporter)

- “RMPMF” Retail Marijuana Product Manufacturing Facility (aka, “Retail MIP”)

- “RMS” Retail Marijuana Store (aka, “Store”)

- “RMT” Retail Marijuana Transporter (aka, “Retail Transporter”)

- “RMTF” Retail Marijuana Testing Facility (aka, “Retail MTF”)

- “R&D” Research and Development Co-Location Permit (aka, “medical R&D cultivation/facility) *

- “RVPP” Responsible Vendor Program Provider *

- “SM” Sampling Manager *

- “SOP” Standard Operating Procedure

- “SU” Sampling Unit *

* Signifies a term added to the regulations in 2019

8 © iComply, LLC 2019 V.05.22.19..01

Colorado Cannabis Industry

One of the Most Regulated Marijuana Markets - Seed to Sale tracking and enforcement through METRC – Security, ownership requirements, testing, etc. - Requires intense attention to detail for accurate and timely reporting

Robust Enforcement and Marijuana Related Programs - According to the MED’s fiscal year report for 2018: - 1,582 active retail marijuana business exist in Colorado: - 744 retail marijuana cultivations - 289 retail infused product manufacturers - 538 retail marijuana stores - 8,922 investigations completed by the MED

- The MED employs a staff of 80+ people to tackle all marijuana enforcement division duties - Enforcement includes license application processing, investigations, audits, fines, suspensions, arrests, etc., and sanctioning of products, plants, people, licenses and facilities - Research, studies, and state education programs are reviewed and approved by the MED

Hundreds of Pages of Medical/Retail Rules - Frequently updated by the legislature and the MED - Complex legalese, self-referential format and therefore difficult to follow - Generally, results in time sensitive modifications to procedures and operations

9 © iComply, LLC 2019 V.05.22.19..01

How Rules are Made

In order of priority, Colorado’s constitution allows for Medical marijuana under Amendment 20 and Retail or Recreational Marijuana under Amendment 64. Below the People’s mandate enter statues and laws crafted by Colorado’s elected representatives at the legislature. Once legislation interprets the constitution, mandates from these statutes are given to regulatory agencies such as the MED, CDA, and CDPHE to craft administrative rules and regulations. Finally, local governments may pass their own ordinances that can impact cannabis businesses.

- Marijuana Businesses and Employees are subject to all the above regulation.... - Plus: OSHA, Fire Code, Building Code, Health Code, etc....

10 © iComply, LLC 2019 V.05.22.19..01

iComply's Government Relation Efforts

As Cannabis legalization evolves in Colorado and the elsewhere, so do the opportunities to improve and influence the legislative and regulatory landscapes. iComply engages directly with policy makers on federal, state and local levels to ensure that the voices of consumers, patients and industry stakeholders are heard by those directly responsible for developing cannabis policies. We devote time, effort and other resources to promote policy, legislation, regulation that is based on common sense, factual data, objective measures, free market principles, social - justice, and personal, as well as institutional responsibility and civil liberties.

We understand that developing our relationships as a trusted resource with policy makers, regulatory authorities, drug policy organizations, industry associations, advocates and lobbyists is fundamental to success in our political endeavors. iComply continually identifies and develops positions on issues, composes and distributes white papers, develops strategic alliances, serves on industry group committees and councils, and monitors legislative committees and commissions. We work with related issue groups outside the realm of policy to continue to educate ourselves and legislators on issues, expand our influence, serve as friendly watchdogs, and develop our reputation for leadership with an unparalleled depth and breadth on cannabis policy issues. Using these strategies, we continue to gain traction with important issues: - venues for adult use; - Marijuana rights for parents, patients, and consumers; - Industry education for safe use, consumption & storage - Product packaging, labeling and marketing; - Sunset reviews of marijuana code; - Taxation; - Banking; - Reducing unnecessary and onerous industry regulations.

11 © iComply, LLC 2019 V.05.22.19..01

Strategic Allies in Government Relations iComply belongs to and works with the following organizations in our government relations efforts to face challenges at Local, State, and Federal levels. The following organizations specialize in development, implementation, and management of progressive cannabis policies at strategic levels of government. We encourage our clients to become involved, as much as possible, in reforming cannabis policy at all levels affecting the industry, our common business development, and invested future. National Cannabis Industry Association

NCIA is the industry leader and longest standing organization rooted in cannabis advocacy at the National Level. Supporting their efforts furthers lobbying dollars at the Federal level to resolve issues common to the industry at large. NCIA focuses full time efforts to reform federal prohibition, 280E tax inequality, banking, and to raise awareness of marijuana business in Washington D.C. Their efforts are invaluable in providing a legitimate and trustworthy voice for the industry. Additionally, they provide worthwhile events tackling thought leading issues around the nation in a variety of cities and states bringing various facets of the industry into context as new markets develop. For as little as $100 a month, NCIA is an invaluable partner in national development of the cannabis industry and we encourage all clients to join and support their invaluable efforts.

12 © iComply, LLC 2019 V.05.22.19..01

Cannabis Business Alliance

One of the original voices in Colorado Cannabis Commercialization, CBA is a collective cannabis industry organization focused on developing and implementing thoughtful, sensible, and collaborative policies for Colorado cannabis. Their work entails weekly policy discussions, regular meetings with stakeholders, and invaluable connections to Colorado government officials on upcoming issues, policy, and legislation impacting Colorado cannabis businesses. They are reputable, inclusive, and transparent in lobbying both in Denver and at the Colorado State Capitol. Their regular reports and access to legislators, policy makers, and movers and shakers is a worthwhile and valuable investment for any cannabis business in Colorado.

Other Cannabis Organizations: Colorado is home to a variety of other industry groups which iComply collaborates with regularly. If the above options aren’t the exact fit for our clients, we suggest researching the following organizations as well. - Marijuana Industry Group – MIG http://marijuanaindustrygroup.org/ - Colorado Cannabis Chamber of Commerce – C4 http://www.cannabischamberofcommerce.com/ - Southern Colorado Cannabis Council – SCCC http://sococc.org/ - Southern Colorado Growers Association – SOCOGA http://www.cannabisgrowers.org/

13 © iComply, LLC 2019 V.05.22.19..01

DOJ Enforcement Priorities

The Marijuana Industry blatantly violates Federal Law as long as Marijuana remains a Schedule 1 substance. Although rescinded, the Federal Department of Justice (DOJ) issued a memorandum allowing marijuana businesses to continue violating Federal Law without interference as long as we demonstrate clear, unambiguous, compliance with State Law. This is still the guidance used by most states and pioneered by Colorado to develop the regulatory framework everyone must follow. State Law follows DOJ Guidance according to the following priorities: 1. Preventing distribution to minors 2. Preventing revenue from the sale of marijuana from going to cartels 3. Preventing diversion of product to other States whose laws do not allow for possession 4. Preventing State sanctioned cannabis production and sale from being used as a cover for the sale of illegal drugs or other illegal activity 5. Preventing violence and the use of firearms in the cultivation and distribution of Cannabis 6. Preventing drugged driving and other adverse public health consequences relating to public health 7. Preventing the growing of Cannabis on Public Lands 8. Preventing Cannabis possession or use on federal property

State Laws cover these priorities so that we can all “legally violate Federal Law” We are “tolerated” as quasi-legal Federal Criminals.

14 © iComply, LLC 2019 V.05.22.19..01

Duties & Powers of the MED and Local Authorities

The Marijuana Enforcement Division is a division of the State of Colorado’s Department of Revenue. Investigators and supervisors of the MED have and exercise all the powers of peace officers in the State of Colorado. Clients may not interfere with officers or their investigations in any way.

MED Investigators are Law Enforcement Officers - Investigate, serve documents, and assist law enforcement - Think like law enforcement: former detectives, sheriff's, officers - Carry guns and badges

Mandatory Inspections - Inspect, examine premises, and/or records up to 3 years old - Cooperation is mandatory – No 4th or 5th Amendment Rights - Operators must supply truthful statements and records

Regulatory Enforcement (DOR/MED) - Impose fines, mandate third party audits, issue license suspensions, and revocations - Administrative penalties/holds/quarantines and other actions - Destruction of unauthorized marijuana

Local Agencies and Authorities - All local fire, health, safety, and associated laws and regulations apply - All establishments must submit to inspection by all federal, state, and local authorities - Law Enforcement often works together

15 © iComply, LLC 2019 V.05.22.19..01

License Infractions & Violations

The MED has established guidelines for enforcement and penalties that are imposed by the State for non-compliance with retail and/or medical marijuana rules, or any other applicable code. The State Licensing Authority (MED) will make determinations on the type of penalty to impose based on the severity of the violation in the following categories:

License Infractions This category of violation is the least severe and includes, but is not limited to:

- Failure to display required badges - Unauthorized modifications to the premises of a minor nature - Failure to notify the State Licensing Authority of a minor change in ownership or other required reporting The range of penalties for this category of violation may include license suspension, a fine per individual violation, and/or a fine in lieu of suspension of up to $10,000 depending on the mitigating and aggravating circumstances. License Violations This category of violation is more severe than a license infraction but generally does not have an immediate impact on the health, safety and welfare of the public at large. License violations may include but are not limited to: - Advertising and/or marketing violations - Packaging or Labeling violations that do not directly impact consumer safety - Failure to maintain minimum security requirements - Failure to keep and maintain adequate business books and records - Minor or clerical errors in inventory tracking procedures The range of penalties for this category of violation may include a license suspension, a fine per individual violation, a fine in lieu of suspension of up to $50,000, and/or license revocation depending on the mitigating and aggravating circumstances.

16 © iComply, LLC 2019 V.05.22.19..01

License Violations Affecting Public Safety This category covers the most severe violations and includes, but is not limited to: - Unauthorized sales to minors/non-patients - On-site consumption - Sales in excess of the relevant transaction limit for marijuana or the equivalent in marijuana product - Allowance of diversion of marijuana or product outside or into the regulated market - Possession of marijuana or product obtained from outside the regulated distribution system or from an unauthorized source - Misstatements or omissions in METRC - Failure to continuously escort a visitor in a Limited Access Area - Violation in relations to a co-located medical business and retail establishment, a R&D co- location permit, a centralized distribution permit, and a licensed research cultivation - Incomplete books and records for all business transactions - Failure to cooperate with MED investigators during an investigation - Failure to account fully for all Sampling Managers and Sampling Unit transfers - Advertisement which directly targets minors, or packaging and labeling that impacts patient or consumer safety - Any violation that has a general and immediate impact on health, safety, and welfare of the public Violations of this nature generally have an immediate impact on the health, safety and welfare of the public at large. The range of penalties for this category may include a license suspension, a fine per individual violation, a fine in lieu of suspension of up to $100,000, and/or license revocation depending on the mitigating and aggravating circumstances.

THIS CATEGORY OF ENFORCEMENT IS MOST LIKELY TO SHUT DOWN THE LICENSED OPERATION!

17 © iComply, LLC 2019 V.05.22.19..01

Excercise: Assessing License Violations

Identify the Minimum License Violation Category for the below Non-Compliance: - Think like a MED officer: Is this the first instance of non-compliance? What mitigating or aggravating factors should be taken into consideration? Does this affect public safety?

1. Transfer to a non-qualified or underage person 2. Advertising and/or marketing violation 3. Failure to continuously escort a visitor in a Limited Access Area 4. Failure to display required badge 5. Consumption on licensed premises 6. Packaging and labeling violation that does not directly impact consumer safety 7. Unauthorized minor modification to the premises 8. Sampling Unit inventory tracking system inaccuracy 9. R&D co-location permit violation 10. Failure to maintain minimum security requirements 11. Failure to notify the State Licensing Authority of a minor change in ownership or other required reporting 12. Failure to cooperate with MED investigators during investigation 13. Failure to report an Adverse Event

Check Your Work: - Use the License Violation Answer Key and License Violation Category Type table below.

License Violation Exercise Answer Key: 1.) LVAPS 6.) LV 11.) LI License Violation Category Code: 2.) LV 7.) LI 12.) LVAPS - LI – License Infraction 3.) LVAPS 8.) LVAPS 13.) LVAPS - LV – License Violation 4.) LI 9.) LVAPS - LVAPS – License Violation Affecting Public Safety 5.) LVAPS 10.) LV

18 © iComply, LLC 2019 V.05.22.19..01

Mitigating/Aggravating Factors

Mitigating and aggravating factors are circumstances or situations the MED may take in to consideration surrounding any violation. These factors, once considered, may seriously impact and/or determine the severity of an imposed penalty. The circumstances surrounding any penalty imposed are determined on a case by-case basis. Mitigating and aggravating factors include:

Factors taken into consideration with License Violations: - Action taken by the licensee to prevent the violation (e.g. training provided to employees) - Corrective action(s) taken by the Licensee in the event of a violation - Licensee’s history of success or failure with compliance checks - Likelihood of the recurrence of the violation - Overall circumstances surrounding the violation, for example may include, but are not limited to: - Prior notification letter to the licensee that an underage ID sting/compliance check would be forthcoming. - The dress or appearance of an underage operative used during an underage ID sting - Any history of written warnings in relation to an underage ID sting violation - Willfulness and deliberateness of the violation - Whether or not the Owner or manager is the violator or directed an employee to violate the law

Factors taken into consideration in determining severity of License Violation: - The structure of penalties by violation type determined by code - Any applicable company documents that may be in relation to the violation (e.g. SOPs, etc.) - Any prior violations that the Licensee has admitted to or was found to have engaged in - All incidence reports and/or logs License has maintained from previous events relating to violation - If auditing and reporting requirements relevant to the violation are met - Participation in mandatory and state-approved training and certification programs related to the License’s operations

19 © iComply, LLC 2019 V.05.22.19..01

Other factors taken into consideration with License Violations and MED investigations: More recently adopted rules allow the MED to exercise discretion in issuing Written Warnings and while reviewing and/or approving Assurances of Voluntary Compliance. - Written Warnings may be issued during an investigation if a MED investigator identifies a violation(s) of the code or rules and issues a Written Warning in lieu of recommending immediate administrative action. - Assurances of Voluntary Compliance regarding any act of practice that may violate the rules may be reviewed and/or accepted by the Director of the MED. Note: Although neither a written warning nor an assurance of voluntary compliance is considered to be admissions of a violation(s), both will be taken into consideration as evidence for any subsequent administrative proceedings or administrative actions during investigations of violations by the MED.

MITIGATION = PROTECTION

AGGREVATION = SEVERE DAMAGE

INFRACTIONS VIOLATIONS LVAPS iComply works with you in the world of mitigation to meet many of the above legal standards. The idea is to build a system of protections within our client’s operations that both protects the company, employees, and brand but that also provides the efficiencies necessary to achieve greater profitability.

Legal Note: For all administrative offenses involving a proposed suspension, you may petition the state for permission to pay a monetary fine, in lieu of having its license suspended for all or part of the suspension.

20 © iComply, LLC 2019 V.05.22.19..01

Section 2 Facility Requirements

- Compliance Binder - Dual Purpose Facility - Badges and Identification Requirements - Facility Diagrams - METRC Overview and Using - Limited Access Areas METRC - Restricted Access Areas - METRC Requirements - Visitors - Signage, Marketing, and - Permitted Hours of Operation Advertising - Records and Retention - Health and Safety - Reporting Requirements - Disposal of Cannabis Waste & - Cameras & Video Surveillance Fibrous Waste - Security Alarm - Inventory Management System Requirements - Third-Party Responsibility - Outdoor/Greenhouse Operations

21 © iComply, LLC 2019 V.05.22.19..01

Compliance Binder

It is a best practice to have on hand at each facility a compliance binder which is maintained up to date and ready for inspection by the MED. Compliance Binders normally include basic books and records pertaining to each licensed facility that the MED generally asks for on each visit – such as:

Current Employee List: Full names and badge numbers of each facility employee and all Owners - This is to be kept current in METRC once the functionality is available. - Maintain accuracy as staff comes and goes (within 10 days) - Part of HR on-boarding and off-boarding procedures - Print list out when changes are made and keep physical copy in binder in case of power or internet outage for inspection.

Secure Facility Information: Each licensed premises must have: - Current contact information for vendors that maintain the facility video surveillance and/or alarm systems.

Primary Center Patient List (MMC/OPCO): Current list of medical patients that have designated that Center as their Primary Center. - Includes each patients’ Medical Marijuana Registry (MMR) Number and supporting paperwork for any extended ounce or plant count. - Can be kept electronically, but you must be able to provide any material to the MED upon request, - Keep updated physical copy in binder in case of power or internet outage for inspection to show compliance.

Facility Diagrams, Visitor Logs, Waste Logs, etc.: See Below The MED may request more than these items and generally uses the above to determine a relative level of suspicion. Having these items accurate, complete, and ready for inspection in your Compliance binder will help mitigate enforcement actions such as an inspection becoming an investigation or audit. *This is not an extensive list of required books and records required by the rules.

22 © iComply, LLC 2019 V.05.22.19..01

Badges and Identification

Employees must have a MED issued license to work in the Marijuana industry and cannot begin work without first obtaining a valid occupational license, aka “a badge”, from the MED. This applies to anyone associated with the possession, cultivation, dispensing, selling, serving, transporting, distributing, sampling, testing, researching or delivering of legal marijuana. Occupational Licenses allow you to enter Limited Access Areas and transport marijuana between licensed premises. All employees, managers, and owners must obtain and display their occupational license to be in a Limited Access Area. All licenses are the MED’s property and subject to revocation by the State Licensing Authority. Occupational Licenses are a revocable privilege, and the licensed worker bears the burden of proving qualifications for licensure at all times. Any worker may be denied and charged if intentional misstatements, purposeful omissions, untruths, or misrepresentations are found in an application for occupational licensing. Applicants must submit a full and complete application with a non-refundable application fee before being allowed to work. All applicants will be fingerprinted and must pass both a Federal and State background check. You may be asked to submit a new application if more than a year has passed since your license expired, if you have been denied for a license or the license has been revoked, or if the MED needs more information to do a background investigation. All employees must fill out and return the appropriate MED licensing application and pay appropriate fees in a timely, truthful, full, faithful, and fair manner. Failure to maintain compliance with Occupational License and Associated Key License requirements can result in potential VAPS for the licensee. Occupational (Key/Support) and Associated Key (CO-Resident/Non CO-Resident) Info: Associated Key (CO Associated Key Type of Badge Key Support Resident) (Non-CO Resident) Fee $250 $800 $5,000 $75 Owner(s) Ownership/Direct Ownership/Direct Grow/Store Who /Manager(s) Beneficial Interest Beneficial Interest /Manuf. Employee Variety of Variety of Most responsibility Least Responsibility Responsibilities leadership roles and leadership roles and /Access /Access responsibilities responsibilities Occupational Licenses are valid for two years from the date on which the license badge was issued. The following information outline the requirements for each person wishing to apply for an Occupational License or Associated Key License. Occupational License Applicant: An applicant must meet the following requirements before receiving approval for an Associated Key License:

23 © iComply, LLC 2019 V.05.22.19..01

- Annual application and licensing fees have been paid - Criminal history indicates applicant is of Good Moral Character - Be at least 21 years of age - Resident of Colorado - An exemption to Colorado residency is possible for Workforce Training or Development License. A non-Colorado-resident can get a Support or Key License if they submit a complete application and comply with the following requirements: - Meet the above licensing criteria; and - Provide evidence of proof of lawful presence; and - Provide a complete Workforce Training or Development Affirmation form executed under penalty of perjury. - All taxes, interest, penalties due to DOR relating to a marijuana business or establishment have been paid - Not currently subject to or discharged a sentence for a conviction of a felony in the preceding five years from application date - No conviction at any time of a felony in any state or federal law regarding the possession, distribution, manufacturing, cultivation, or use of a controlled substance in preceding ten years from application date or five years from May 28, 2013 - Except that if it was a state felony conviction based on possession or use of marijuana or marijuana concentrate that would not be a felony if you were convicted of the offense on the date you applied for a license - Not a sheriff, deputy sheriff, police officer, or prosecuting officer, or an officer or employee of state or local licensing authority - Have not been employed by the MED in the six months preceding application - Full compliance with a court or administrative order for current child support, child support debt, retroactive child support, or child support arrearages

24 © iComply, LLC 2019 V.05.22.19..01

Associated Key License Applicant: An applicant must meet the following requirements before receiving approval for an Associated Key License: - Annual application and licensing fees have been paid - Criminal history indicates applicant is of Good Moral Character - Not employ, or finance any person with a criminal history that indicates they are not of Good Moral Character in any way - All taxes, interest, penalties due to DOR relating to a marijuana business or establishment have been paid - Not currently subject to or discharged a sentence for a conviction of a felony in the preceding five years from application date - Meet qualifications relating to the operation of a marijuana business or establishment - No conviction at any time of a felony in any state or federal law regarding the possession, distribution, manufacturing, cultivation, or use of a controlled substance in preceding ten years from application date or five years from May 28, 2013 - Except that if it was a state felony conviction based on possession or use of marijuana or marijuana concentrate that would not be a felony if you were convicted of the offense on the date you applied for a license - Not employ any person without a valid Occupational License - Not a sheriff, deputy sheriff, police officer, or prosecuting officer, or an officer or employee of state or local licensing authority - Have not been employed by the MED in the six months preceding application - Not propose to license any retail food establishment or wholesale food entity - Must be either: - Resident of Colorado for at least one year before applying for License, or - A U.S. citizen before applying for a License has received a Finding of Suitability from the MED (See M 231.1 and R 231.1) - Be a U.S. citizen if owner of a closely held business entity - Full compliance with a court or administrative order for current child support, child support debt, retroactive child support, or child support arrearages - Note: An Associated Key License is for an individual who is a “Direct Beneficial Interest Owner” (DBIO) of the medical business or retail establishment - A DBIO is a natural person or closely held business entity owning shares or stock in a licensed establishment/business, including officers, directors, members, or partners - Each shareholder, officer, director, member, or partner of a closely held business entity that is a Direct Beneficial Interest Owner and anyone who controls or exercises control over a mariuana business or establishment must have an Associated Key License

25 © iComply, LLC 2019 V.05.22.19..01

Facility Diagrams

Facility diagrams are essential documents for every licensed facility as they outline the areas of operation, directional camera coverage, and limited access areas and restricted access areas. Keeping this diagram current and on site is required by rules M 901 and R 901 – Required Business Records. This is one of the first documents that will be examined during an audit by the MED, Local Government, or iComply.

The purpose of facility diagrams is to define all area access and operations in the licensed premises and to establish boundaries of the different areas of the facility. Facility diagrams are required to be filed with initial and renewal applications but are also required to be updated and filed with the MED if any changes are made to the licensed premises.

Below is a non-compliant facility diagram that is missing required elements such as camera coverage and limited access area or restricted access area designation.

Definitions of a change that will need to be reported includes, but is not limited to: tearing down or adding a wall; adding, moving, or removing of equipment such as cameras covering POS, DVR’s, or scales; defining or changing the definition of areas such as cultivation rooms, concentrate production areas, waiting rooms, restricted or limited access areas, etc.

It is very important that operators are aware and vigilant of any changes to the facility that may require an updated facility diagram. Failure to notify the MED and/or your local authority of changes to the premises may be considered a license infraction by the MED and could lead to product sanctions and/or fines up to $10,000.

Best practices surrounding diagrams include: - Having them as part of any facility’s compliance binder - Training all staff members in the boundaries of the licensed premises and where and how product can move, be stored, opened, weighed, etc.

26 © iComply, LLC 2019 V.05.22.19..01

Limited Access Areas

Limited Access Areas are areas that Non-Licensed individuals, including Patients and Customers, ARE NOT permitted entry to without being escorted as a visitor. All visitors must be 21 years of age to enter any limited area. All entries and exits to limited access areas must be marked with a sign of not less than 12” wide and 12” long with letters no less than ½” in height with the exact wording used below.

Post 12” X 12” signs with lettering no smaller than ½ inch at the entrance of any and all limited access areas that reads:

You must also file and keep on premise a diagram of each licensed premises showing specific areas of your operations. You must display all licenses and require ID badges for persons allowed into your limited access areas. The MED also specifies rules to allow visitors into your limited access areas. Note: Not all areas of the licensed premises are limited or restricted access areas.

File diagrams of each licensed premises showing walls, partitions, counters, and points of entry and exit. Mark the diagram with each of the limited access and restricted access areas for surveillance.

NEW: Not all areas of a licensed premises may be LAA or RAA. Such as waiting rooms, reception areas, conference rooms, etc.

THINK: What kind of areas in your facility are Limited Access and why?

27 © iComply, LLC 2019 V.05.22.19..01

Restricted Access Areas

The purpose of this rule is to control and safeguard access to certain areas where marijuana and marijuana products are sold and to prevent the diversion of marijuana and products to people under 21 years of age. The display of Marijuana and Marijuana Products for sale is only allowed in Restricted Areas. Any product displays that are readily accessible to the customer must be supervised by licensed employees at all times when customers are present.

All entries and exits to Restricted Access Areas where marijuana or marijuana products are sold, possessed for sale, displayed or dispensed must be marked with a sign no less than 12” wide and 12” long, with letters no less than ½” in height, with the exact wording used below:

The restricted area must be supervised by a licensed Owner or employee at all times when customers are present to ensure that only Persons who are 21 years of age or older or qualified patients (or their qualified caregiver) are present. When allowing customers access to restricted areas, you must make reasonable efforts to limit the number of customers compared to the number of licensed Owners or employees in the restricted area.

NEW: Not all areas of a licensed premises may be LAA or RAA. Such as waiting rooms, reception areas, conference rooms, etc.

28 © iComply, LLC 2019 V.05.22.19..01

Visitors

Anyone without an occupational license is considered a Visitor. You must ensure all visitors (including outside contractors) meet the following requirements before granting entry to your licensed facility. All visitors must: - Be 21 years of age or older - Sign in and out of a visitors’ log - Comply with Visitor Log requirements *ID to validate name and age with log - Fill out all and complete all data fields *sign in and out with visitor entry and exit - Have valid ID (with name and information matching log entry) - Display a Visitor Badge above the waist at all times - Be escorted, and contractors or tradespeople must be ‘reasonably monitored’ by an occupational licensed/badged employee - Fill out all areas of the visitor log and that all data fields are complete. - Not exceed a number of 5 Visitors per badged employee escort Even if you see the same contractors or know your visitors personally, you must verify all complete fields in the visitor log and physically check their ID on each visit. The MED has wide discretion to determine if a visitor is purposefully using the Visitor system to circumvent, or go around, the badging process. Contractors, consultants, and other vendors are especially at risk of a VAPS if the MED determines these visitors are “getting around” or circumventing the requirements for occupational licensing. The MED may consider certain factors to determine if an employee who has not been issued an Occupational License is using the Visitor System to enter a Limited and/or Restricted Access area. Factors may include, but are not limited to: - How often the Visitor is accessing the Facility - The purpose of the Visit - Length of time of the Visit - Number of Visitors per Visit - Who is the Visitor - What is the Visitor’s relation to the License - Job Function of the Visitor An employee who escorts a visitor must be within the same room and be able to monitor visitors while in LAA. Frequent contractors or other “trade/crafts-people” may be “reasonably monitored” although the MED leaves this definition vague. It is up to you to determine what reasonably monitoring means. Watching them on camera or checking in frequently may be ways to comply with reasonably monitoring contractors in the limited access areas.

29 © iComply, LLC 2019 V.05.22.19..01

Permitted Hours of Operation

A sale of marijuana after hours is considered at least License Infraction by the MED, if not resolved or if the MED consider the incident serious or in case of a repeated pattern this could also result in a License Violation which includes fines up to $50,000.

This applies to all locations within their hours of operations. You are not permitted to sell, serve, distribute, or initiate the transport of any product between the hours of 12:01 AM and 7:59 AM in Colorado. Retail and Medical Transfers or Transactions are only permitted between the hours of:

8:00 AM – 12:00 AM

Permitted Hours of Operation are subject to additional restrictions by local jurisdiction.

Keep in mind, that although the State sets allowable operating hours, Local Authorities often set additional restrictions on operating hours. Know your local restrictions on operating hours and default to concluding all transactions according to your local jurisdiction.

Hours of operations also applies to when stores may transfer out product or receive product from another licensed entity. Be sure to send and receive product after opening and before closing hours.

30 © iComply, LLC 2019 V.05.22.19..01

Records and Retention

The rules M 901 and R 901 identify required business. You must keep all books and records necessary to fully show the business transactions for the current calendar year and previous three years. Required records from the previous six months are required to be maintained at the licensed premises. Required information must be kept in a format that is readily understood by a reasonably prudent business person.

A Marijuana Establishment, and any of its agents and employees, must provide access to on premise records (6 months at a time) following a request from the MED during normal business hours or hours of apparent operation. Any off-premise business record that is older than six months must be made available within three business days following a request from the MED. Beginning in 2017, all business records may be maintained in digital format only if the records are available on demand to the MED on-demand in functionally accessible formatting at the licensed premises. Any failure to provide any requested record to the MED could result in penalties, aggravating charges, suspension, or other administrative action.

The required books and records must fully show the transactions of the business and must include the following:

1. Current Employee List – This list must provide full names and occupational license numbers, including non-employee Owners who work at a Marijuana Establishment (in METRC <10 days).

2. Secure Facility Information – For each business location, you must have the business contact information for video surveillance and Security Alarm System vendors (Compliance Binder).

3. Advertising/Demographic Records (Audience Composition Data)

4. Diagram(s) of Licensed Premise including any Limited Access, Restricted Access, or any off- premises storage facilities (Compliance Binder – up to date & accurate)

5. Visitor Logs (Compliance Binder)

6. Tax Records – You must maintain all records normally retained for tax purposes (Online Access).

7. Waste Logs (comprehensive records required for waste and fibrous waste)

8. Surveillance Logs and Records

9. Identity Statement and/or Standardized Graphic Symbol Records

31 © iComply, LLC 2019 V.05.22.19..01

10. License Application Records - includes all records in connection with an application for license that are provided to state and local jurisdictions

11. Adverse Event Reporting Records of Audited Product and/or Alternative Use Product (see additional info below) And all other records required by the rule:

12. Contact information for all current vendors. All contracts and agreements with vendors (Vendor Files – separate for medical vs retail). 13. Current patient list/patient files and any changes in patient’s primary center (Medical Only – Patient Files and/or Online Access)

14. Accurate and comprehensive inventory tracking records that account for evidence for all marijuana or marijuana product inventory from seed or immature plant stage, to harvesting, processing, packaging, testing, transferring, etc. (including waste and fibrous waste, sampling units, testing units, quarantined or destroyed products and back-up documents if POS system or METRC fails

15. Adequate records of all transport activities. You must carry a hard copy of the transportation manifest at all times when transporting marijuana

16. Crime Report records

32 © iComply, LLC 2019 V.05.22.19..01

Reporting Requirements

Any written report to the MED according to these reporting requirements must also be maintained as required books and records. The MED generally requires the following reports to be made in writing, in a timely manner, via email ([email protected]) for the following reasons: - Change of Patient to Primary MMC within 72 hours (Medical only) - Modification of Premises proposed before any changes to facility occur - Transfers in ownership and equity no longer than 30 days before change should take effect, which may include: - Transfer of stock or change in directors of a corporation requires MED and local approval - Transfer of or changes to membership interest in LLC requires MED and local approval of Transfer or changes to partnership interest requires MED & local approval - Ownership changes due to death, disability, divestment, revocation or suspension of direct beneficial interest owners must be submitted within 45 days of final decision or settlement agreement. - Temporary or entity court appointees, after accepting an appointment as a court appointee, must submit notice to state & local licensing authorities within 7 days and file application for suitability within 14 days - Entity conversion require minimum of a 30-day notice - Renewal for existing license must be filed no less than 30 days before expiration to be considered timely - Filing a license renewal application less than 30 days from expiration requires a written explanation for untimely filings - In the event of a renewal application filed after the license expiration, a marijuana establishment or business may not operate unless and until the MED deems that license administratively continued - Change in management within 7 days (e.g. a promotion, demotion, hire, fire, etc.) - Change in any electronic or physical mailing address within 30 days of address change - Change of location a minimum of 30 days in advance (a permit is required – 120 days prior to change of locations) - Arrests of any and all employees within 10 days - Sampling Manager additions, removals, or changes - Adverse Events Report involving Alternate Use Product or Audited Product within 48 hours of the facility learning of event

33 © iComply, LLC 2019 V.05.22.19..01

“Reporting of a Crime on the Licensed Premises” This means a written report must be filed with the MED for any discovered plan or other action of any Person to: 1. Commit theft, burglary, underage sales, diversion of marijuana or marijuana product, or other crime related to the operation of the Marijuana Establishment; or 2. Compromise the integrity of the Inventory Tracking System. - A written report must be made ASAP and no later than 14 days from the incidence(s) - Nothing alters or eliminates any obligation for to report criminal activity to a local law enforcement agency

34 © iComply, LLC 2019 V.05.22.19..01

Cameras and Video Surveillance

Cameras are an essential part of the security and accountability of marijuana operations. Expect to have your cameras accessed during an inspection to verify compliance. The MED has outlined detailed specifications regarding video surveillance equipment and rules as to where equipment must be placed. Video surveillance equipment (DVR and Monitor) must be installed before licensing. All licensed operations must use a video surveillance system located in a secured area available only to management staff. The equipment may also be housed in a locked box within a limited access area. Remember, cameras record every corner of each facility continuously (24/7). The MED may review any piece of footage for up to 40 days of recording. Video Surveillance Equipment must meet the following requirements at all times:

1. Video surveillance consists of digital or network video recorders (DVR), cameras capable of meeting MED recording requirements, video monitors, digital archiving devices, and a color printer capable of printing still color photos. 2. All DVRs must have a failure notification system that promptly notifies any prolonged surveillance interruption and/or the complete failure of the surveillance system. 3. All surveillance equipment must be functioning and maintained so that the playback quality is suitable for viewing and cameras are capturing the identity of all individuals and activities in the monitored areas. - This includes the angles of the cameras to capture someone’s face even if they are wearing a baseball cap or hat. - Any time a light is lowered or raised, equipment is moved, or plants grow, you must make sure nothing blocks the camera footage or angle. - Best practice is to conduct periodic security checks to ensure equipment is functioning and cameras are capturing intended angles and footage. - All video surveillance equipment has to have sufficient battery backup to support a minimum of four (4) hours of recording in the event of a power outage. - This means you can still operate without electricity in conducting sales, cultivating plants, or manufacturing – as long as the cameras are recording all activity during the power outage and back up records are maintained for inventory tracking (see METRC section below).

35 © iComply, LLC 2019 V.05.22.19..01

Video Recording and Retention Requirements

1. All camera views of all Limited Access Areas must be continuously recorded 24 hours a day. – However, motion detection is authorized if you can demonstrate that monitored activities are adequately recorded. 2. All surveillance recordings must be kept for a minimum of 40 days (different cities and counties may have additional requirements) and be in a format that can be easily accessed for viewing and made available to the MED upon inspection. 3. Video recordings must be archived in a format that ensures authentication of the recording as legitimately-captured video and guarantees no alteration of the recorded image has taken place. 4. The surveillance system or equipment must have the ability to produce a color still photograph from any camera image, live or recorded, of any footage of the Licensed Premises. - Be sure to have camera operating instructions in the DVR room and in your Standard Operating Procedures (SOP) in the event someone must access the system to print a still image. 5. The date and time must be embedded on all surveillance recordings without significantly obscuring the picture. The date and time must be synchronized with any point-of-sale system. Time must be measured in accordance with official United States time established by the National Institute of Standards and Technology and the U.S. Naval Observatory at: http://www.time.gov/timezone.cgi?Mountain/d/-7/java. 6. After the 40-day surveillance video storage schedule has lapsed, surveillance video recordings must be erased or destroyed before selling or transferring a facility or business to another licensee or being discarded or disposed of for any other purpose. - Surveillance video recordings may not be destroyed if the Licensee knows or should have known of a pending criminal, civil or administrative investigation or any other proceeding for which the recording may contain relevant information.

36 © iComply, LLC 2019 V.05.22.19..01

Location and Maintenance of Surveillance Equipment

1. The surveillance room or area is a Limited Access Area and DVR equipment must be in a designated, locked and secured room or enclosure with limited access to authorized employees, agents of the MED and relevant local jurisdiction, state or local law enforcement agencies, and service Personnel or contractors only. 2. You must keep a current list of all authorized employees and service Personnel who have access to the surveillance system and/or room on the Licensed Premises. - Update it any time an employee is on-boarded of offboarded. - Be sure at least one person from the list is working at all times to provide access to the MED in the event of an inspection. 3. You must keep a “surveillance equipment maintenance activity log” current at all times on the Licensed Premises to record all service activity including: - The identity of the individual(s) performing the service, - The service date, time, and reason for servicing the DVR system. 4. Off-site Monitoring and video recording storage of the Licensed Premises is allowed as long as standards exercised at the remote location meet or exceed all MED standards for on-site Monitoring. 5. Each Licensed Premises located in a common or shared building must have a separate surveillance room/area that is dedicated to that specific Licensed Premises. 6. Licensed Premises that combine both a Medical Marijuana business and a Retail Marijuana Establishment, Shared Licensed Premises and Operational Separation, may have one central surveillance room located at the shared Licensed Premises. 7. Commonly-owned Marijuana Establishments located in the same local jurisdiction may have one central surveillance room located at one of the commonly owned Licensed Premises which simultaneously serves all of the commonly-owned facilities. 8. The facility that does not house the central surveillance room is required to have a review station, printer, and map of camera placement on the premises. 9. At a minimum, the requirements for equipment and security standards in this section apply to the review station.

37 © iComply, LLC 2019 V.05.22.19..01

Your approved installation company should have thorough understanding of the following, but it’s important that you make sure that conditions are met:

1. All limited access areas, point of sale areas, security rooms, all points of entry and exit to limited access areas, entrances and exits, to all licensed facilities must have fixed camera coverage from 20 feet away. 2. Make sure that the cameras are capable of allowing you to clearly identify any individual in your facility. Watch those angles and adjust any obstructions. 3. All marijuana must be placed on a scale approved by the Colorado Department of Agriculture and calibrated by an approved company. This ensures that the amount removed is recorded in your Point of Sales (POS) system. Cameras must cover all scales being used to weigh marijuana with the ability to clearly read scale measurements. 4. All entrances and exits to the building must have a fixed camera capturing the interior and exterior of the entrance/exit. 5. The cameras must be capable of operating in low light conditions. 6. Entrances and exits of flowering rooms must be constantly illuminated. 7. Anywhere that marijuana is grown, cured or manufactured you must have a camera facing the door, and other locations at a height which provides an unobstructed view of the medical marijuana, plants or person(s) in the room. 8. Cameras must be placed anywhere that you weigh, package or tag medical marijuana. 9. At least one camera must record the access points to the surveillance equipment area. 10. Outdoor cultivation must also meet these standards.

38 © iComply, LLC 2019 V.05.22.19..01

Security Alarm System Requirements

Security alarms protect your company’s assets (products, cash, equipment, and safety of personnel). The rules R 305 and M 305 establish the minimum-security requirements for alarm systems, as well as guidelines for commercial locks that maintain adequate security.

Your alarm must be installed by a licensed alarm installation company. The company’s contact information should be readily available and kept current for inspection in the compliance binder with the same information for the surveillance equipment company. The alarm system’s design must cover all entry and exit points to the facility, and may include internal monitoring devices (motion sensors, pressure plates, etc.) as well as intrusion deterrence and silent notification devices (panic, duress, and holdup buttons). All facilities must have, at a minimum, commercial grade 2, non-residential, locks on all points of entry and exit into the building, limited access areas, and surveillance room.

- Ensure alarm system has been installed (to include all entry and exit points) by an Alarm Installation Company. - Report the location of the alarm system for each licensed premises to the MED. - Ensure system is kept updated, maintained and free of any conditions that may cause a false alarm. - Each Licensee must ensure that all of its Licensed Premises are continuously monitored. Licensees may engage the services of a Monitoring Company to fulfill this requirement. - Maintain records on the Licensed Premise that describe the location and operation of each Security Alarm System, a schematic of security zones, the name of the Alarm Installation Company, and the name of any Monitoring Company. - Upon Division Request, make available to agents of the state or local licensing authority or other enforcement agency all information related to Security Alarm Systems, Monitoring, and alarm activity.

Best practices for security include Access Controls which control who may be in which areas of a licensed facility. Key Cards, coded locks, and biometrics may be used to designate who has access to which areas. Access, include alarm codes, should be cancelled immediately after someone leaves the organization along with the return of any keys, canceling of METRC or Point of Sale access, and updates made to DVR access lists, and employee lists.

Additional security is best handled by registered security vendors who are bonded, insured, and who may be armed and who can conduct onsite surveillance, patrols, escorts, or deliveries.

39 © iComply, LLC 2019 V.05.22.19..01

Outdoor/Greenhouse Cultivations

Any Medical or Retail Cultivation, or Marijuana Research and Development Cultivation that has an outdoor or greenhouse operation is considered a Limited Access Area and must meet all of the requirements for Security Alarm Systems and surveillance.

An outdoor or greenhouse grow must provide sufficient security and access controls to prevent access by unauthorized individuals. All entrances to the facility and limited access areas should be locked and secured to maintain physical security including alarms.

In greenhouse and outdoor cultivation operations, fencing is required around the perimeter of the licensed premises. Fencing must be designed to prevent the general public from entering the Limited Access Areas and must meet the following requirements: 1. The entire Limited Access Area must be surrounded by a fence that measures at least eight feet from the ground to the top of the fence, or in the alternative, the fence may measure six feet from the ground to the top with a 1-foot barbed wire arm with at least three strands along the entire fence. 2. The fence must be constructed of nine gauge or lower metal chain link or another similarly secure material, which may include wood. 3. All support posts must be made of steel and securely anchored. 4. All gates of ingress or egress must be also be at least eight feet from the ground to the top of the entry gate, or in the alternative, the gate may measure six feet from the ground to the top with a 1-foot barbed wire arm with at least three strands, and shall be constructed of nine gauge or lower metal chain link fence or a similarly secure material. 5. The fence must obscure the Limited Access Area so that it is not easily viewed from outside the fence. 6. The points of ingress and egress of the fence must be illuminated (use of motion sensing lights is permitted) illuminating all sides of the fence for at least 20 feet from the fence. The MED expects full compliance with this rule by January 1, 2019. Greenhouse or Outdoor Cultivations may petition the MED for a waiver to these requirements if the security requirements are in conflict with a local ordinance of general applicability or they have an alternative safeguard that accomplishes the goals of the security rules, specifically public safety, prevention of diversion, accountability, and prohibiting access to minors.

40 © iComply, LLC 2019 V.05.22.19..01

Dual Purpose Facility Requirements

This rule establishes guidelines for the manner in which a medical marijuana Licensee may share its existing Licensed Premises with a Licensed Retail Marijuana Establishment, and to ensure the proper separation of medical marijuana from retail marijuana establishment operations. General Requirements

A Medical Business (MMC/OPCO/MMIPM/MMTF) licensed by the Medical Code may share its existing Licensed Premises with a licensed Retail Establishment (RMS/RMCMF/RMPMF/RMTF), if the relevant local jurisdiction permits a dual operation at the same location and the MMB/RME meet all other requirements set forth by the rules. A Medical Marijuana Center that does not authorize patients under the age of 21 years to be on the premises, may also hold a Retail Marijuana Store license and operate a dual retail business operation on the same licensed premises.

A MMC that authorizes medical marijuana patients under the age of 21 years to be on the premises is prohibited from sharing its Licensed Premises with a Retail Marijuana Store. The two cannot be co- located in this instance and shall maintain distinctly separate Licensed Premises; including, but not limited to: - Separate retail and storage areas (including permitted centralized distribution areas) - Separate entrances and exits - Separate inventories, - Separate point-of-sale operations - Separate record-keeping, such as - Separate METRC accounts and activities (including Sampling Units and Sampling Managers)

Cultivation/Manufacturing/Research/Distribution/Testing Operations: Persons operating medical and retail license operations must: - Maintain physical or virtual separation of the facilities, marijuana plants, and all inventory. - Maintain separate record keeping for the business operations and Labeling of products that allow the MED and local jurisdictions to distinguish the inventories and business transactions of Medical Marijuana from Retail Marijuana.

41 © iComply, LLC 2019 V.05.22.19..01

Retail Store and Medical Center Operations (No Patients Under 21 Years): A Medical Marijuana Center that specifically prohibits the admittance of patients under the age of 21 years and a Retail Marijuana Store may: - Share their Licensed Premises. - Share the same entrances and exits. - Display marijuana separately on the same sales floor.

A Medical Marijuana Center that is 21+ only must: - Post signage that clearly conveys that Persons under the age of 21 years may not enter. - Maintain separate record keeping for the business operations of both medical and retail that allows the MED and local jurisdictions to clearly distinguish the products and business transactions all inventory sold between the two.

Retail Stores and Medical Marijuana Centers (Patients Under 21 Years): A co-located Medical Marijuana Center and Retail Marijuana Store must: - Maintain separate Licensed Premises, including entrances and exits, inventory, point of sale operations, and record keeping if the Medical Marijuana Center serves or permit admission of patients under the age of 21 on the premises.

In all cases of Dual Purpose Operations:

- You must maintain separate and distinct inventory tracking processes for Medical and Retail Marijuana inventories. - Clearly tag or label the inventories so that the products can be reconciled to a particular originating package tag, plant tag, and METRC entry. Best Practices is PHYSICAL separation for ease of inspection in all areas of operation.

42 © iComply, LLC 2019 V.05.22.19..01

METRC Overview

Marijuana establishments must account for and track all inventory on the Cultivation Premises from seed or cutting to transfer or sale to another Marijuana Establishment by complying with the final implementation of a required “seed-to-sale” tracking system that tracks Marijuana from either the seed or immature plant stage until the Marijuana, Marijuana Concentrate, or Marijuana Product is sold to a customer at a Marijuana Store, Transferred to a Medical Marijuana Research Facility, Transferred to a Pesticide Manufacturer, or destroyed in the system known as METRC.

METRC is an online tool coupled with RFID technology required to be used so the MED may monitor and follow plants and product through all phases of cultivation, production, extraction, manufacture, transfer, final sale and/or destruction. It allows the MED to monitor and track all marijuana inventories at all times.

Each Facility must have METRC and/or an internal tracking system to ensure inventories are tracked starting when seeds or cuttings are propagated to when marijuana is delivered to a Marijuana Establishment. Each manufacturing facility uses METRC to track production batches, and packages are tracked in METRC for transfer and final sale in stores.

- METRC is NOT a POS System. It is a regulatory enforcement tool for the MED. It must be used in each step of the marijuana cultivation, manufacturing, transporting, and sales process. - POS systems track individual and overall sales, individual patient data, overall store inventories, and manage reports and are necessary for marijuana stores but are independent of METRC. - A Marijuana Establishment is required to use METRC as the primary inventory tracking system of record. A Marijuana Establishment must have a METRC account activated and functional prior to operating or exercising any privileges of a license. - A Marijuana Establishment must have at least one individual Owner who is a METRC Administrator. A Marijuana Establishment may also designate additional Owners and occupationally licensed employees to obtain METRC Administrator accounts. - In order to obtain a METRC Administrator account, a person must attend and successfully complete all required METRC training. The Division may also require additional ongoing, continuing education for an individual to retain his or her METRC Administrator account. - A Marijuana Establishment may designate licensed Owners and employees who hold valid MED-issued badges as METRC Users. A Marijuana Establishment must ensure that all Users who are granted METRC User account access (for the purposes of conducting inventory tracking functions in the system), are trained by METRC Administrators in the proper and lawful use of METRC. - Each individual user is also accountable for their actions while logged into METRC.

43 © iComply, LLC 2019 V.05.22.19..01

- Authorized Tags Required and Costs. Licensees are required to use RFID tags issued by Franwell. Each licensee is responsible for the cost of all RFID tags and any associated vendor fees. - Must ensure your inventories are properly tagged where METRC requires RFID tag use and that it has an adequate supply of RFID tags to properly tag Marijuana and Marijuana Product as required. - All inventory tracking activities at a Marijuana Establishment must be tracked through use of METRC. You must reconcile all on-premises and in-transit Marijuana and Marijuana Product inventories each day in METRC at the close of business. - A Marijuana Establishment must utilize a standard of measurement that is supported by METRC to track all Marijuana and Product. - A scale used to weigh product prior to entry into the METRC system must be “tested and approved” in accordance with established measurement standards. - You must maintain an accurate and complete list of all METRC Administrators and METRC Users for each Licensed Premises and update this list when a new METRC User is trained. - Admins must train and authorize any new METRC Users before those Owners or employees may access METRC or input, modify, or delete any information in METRC. - A Marijuana Establishment must cancel any METRC Administrators and METRC Users from their associated METRC accounts once any such individuals are no longer employed. - All employees must be designated into or out of METRC within 10 days of hire, or unemployment - whether they use METRC or not. - A Marijuana Establishment is accountable for all actions taken by employees while logged into METRC or otherwise conducting inventory tracking activities; and each User is responsible for the accuracy of all information entered into METRC. Any misstatements or omissions may be considered a license violation affecting public safety. - Be sure all METRC data is accurately transferred to and from METRC for the purposes of reconciliations with any secondary systems. You must preserve original METRC data when transferred to and from a secondary application(s). Secondary software applications must use METRC data as the primary source of data and must be compatible with updating to METRC. - Misstatements or Omissions are Prohibited. A Marijuana Establishment and its designated METRC Administrator(s) and METRC User(s) must enter data into METRC that fully and transparently accounts for all inventory tracking activities. - Use of another User’s Login Prohibited. Individuals entering data into the METRC system must only use their own METRC account. - If at any point you lose access to METRC for any reason, the Marijuana Establishment must keep and maintain comprehensive records detailing all Marijuana and Marijuana Product tracking inventory activities that were conducted during the loss of access. Once access is restored, all Marijuana and Marijuana Product inventory tracking activities that occurred during the loss of access must be entered into METRC. - A Marijuana Establishment must document when access to the system was lost and when it was restored. A Marijuana Establishment shall not transport any Marijuana or Marijuana Product to another Marijuana Establishment until access is restored and all information is recorded into METRC.

44 © iComply, LLC 2019 V.05.22.19..01

Medical Marijuana Business License Conversions to Retail Declaring Inventory: To convert medical product into retail (allowed one time): - Create a Retail Marijuana METRC account for each MMJ license you are converting and transfer all relevant MMJ inventory into the Retail Marijuana Establishment’s METRC accounts as Retail Marijuana and Retail Marijuana Product. - Once Medical Marijuana inventory is declared as Retail Marijuana, no further transfers of inventory from Medical to Retail Marijuana will be allowed.

METRC Conversion MMJ to RMJ (M/R 211) - Any inventory conversion from a medical license to a retail marijuana license may only happen at the OPC to RMCF level with OPC produced marijuana as finished goods (including MMJ concentrates) and vegetating marijuana plants. - At the time of application, all license numbers for designated facilities to be converted must be disclosed. - Only one retail cultivation license may be permitted at each single licensed premise located at a distinct and locally recognized address. This requirement forces multiple cultivation licenses attached to a single-premises to be collapsed into one surviving license… meaning that the maximum authorized plant count also collapses according to Rule R 506 – Production Management.

45 © iComply, LLC 2019 V.05.22.19..01

METRC Cultivation Life Cycle:

1. Cuttings, clippings, seedlings, or clones are grouped and identified as an immature batch. 2. An immature plant becomes a vegging plant when the plant is larger than 8” x 8” and in a sealed growing container larger than 2” x 2”. Unique RFID tag is assigned to the vegging plant. 3. A vegging plant becomes a flowering plant when the light cycle changes to 12-hour light cycles. 4. The process of cutting down a plant and obtaining the wet weight before initiating the trim process, performed only on plants in the flower phase. 5. Once tested, marijuana in the form of flower, buds or shake, trim, or (by weight), etc. may be packaged for transfer for sale to another facility, a customer/patient, a sampling manager, or for transfer to a production or testing or research facility. 5.1. Unique RFID label is assigned to the package. 6. New in 2019: Fibrous Waste should be designated and tracked accordingly for transfer to an Industrial Fibrous Products Producer

46 © iComply, LLC 2019 V.05.22.19..01

Post Cultivation Transfer:

Packaged inventory is transferred to an “Manufacturing”, “Centralized Distribution”, or “Selling” facility by its own cultivation or from another “Centralized Distribution” or “Selling” facility and packaged items may be transferred between “Manufacturing”, “Centralized Distribution”, and “Selling” facilities. The purpose of transferring to an “Manufacturing” facility would be to manufacture marijuana into infused marijuana product. The purpose of transferring to a “Centralized Distribution” would be to temporarily store product until an associated “Selling” facility was ready to receive the product from its commonly owned cultivation facility. The purpose of transferring to a “Selling” facility would be for selling to a patient.

Effective in 2019, new regulations introduce Centralized Distribution Permits (CDP) in addition to changes in transfers that allow cultivations to participate in sending and receiving other marijuana or marijuana product for temporary storage.

Be aware that regulations define which facilities may transfer product to other facility types. METRC will allow non-compliant transfers between facilities and it is up to you know whether any transfer is compliant.

An infusing facility will repack its infused product for transfer to a selling facility or a cultivation facility with a CDP. A unique RFID label (aka, a “package tag“) is then attached to the re-packed package.

47 © iComply, LLC 2019 V.05.22.19..01

A store facility will sell this packaged inventory and may repack items for transfer to another facility, commonly owned or not. A unique RFID label is attached to the re-packed package yet again.

POS systems must have the ability to reconcile inventories and maintain accurate weight measurements of harvested and packaged marijuana. METRC is not a Point of Sale system and it is your responsibility to maintain documentation evidencing all inbound marijuana raw materials, on- hand inventory, and all outbound Marijuana transferred to or from any Facility.

Effective January 1, 2019, a retail or medical cultivation facility may apply for a Centralized Distribution Permit which, if approved, allows transfer and temporary storage of concentrate or other marijuana product ready for sale for the sole purpose of transferring it only to commonly owned stores or centers. This means retail and medical MIP facilities may transfer product and temporarily store it at the cultivation facility for no more than 90 days until transfer from a permitted cultivation facility to a commonly owned store or center. Additionally, effective January 1, 2019, an approved R&D Co- Location Permit will enable a licensed research business to share a single licensed premises and operate with another commonly owned medical marijuana business or retail marijuana establishment. Notably, a separate R&D permit is required for each location at which a LRB wishes to seeks to share a single licensed premises. In either case of a CDP or R&D permit, it is imperative to keep inventory and product separated both physically and virtually. A VAPS may result for any license involved in non-compliant activity associated with any permitted centralized distribution or R&D licensed premises.

48 © iComply, LLC 2019 V.05.22.19..01

Using METRC

METRC Administrator - One Owner per facility will be a METRC Administrator. Additional Owners and employees may obtain METRC administrator accounts. - Each person must attend and successfully complete all required METRC training and continuing education to obtain and retain a METRC Administrator account. - METRC Administrators must ensure licensed Owners and employees with METRC User access are trained in the proper and lawful use of METRC. - Each individual user is also accountable for their actions while logged into METRC.

METRC Users - METRC Administrator must ensure their proper training. - Best Practice: Contract outside METRC trainer and maintain documentation of training. - Users can access, modify, or enter data, create and print manifests, and reconcile inventory.

General METRC Use - All inventory tracking activities at Marijuana Establishments must be tracked through METRC. You must reconcile all on-premises and in-transit Marijuana and Marijuana Product inventories each day in METRC at the close of business. Effective January 1, 2019, all tracking and transferring of Sampling Units, Fibrous Waste, Audited Products and Alternative Use Products must be in compliance with inventory tracking rules. - Use a standard of measurement supported by METRC to track all Marijuana, and Products with Scales that are “tested and approved” according to State measurement standards. - Maintain an accurate and complete list of all METRC Administrators, METRC Sampling Managers and METRC Users for each Licensed Premise. Update this list when a new METRC User is trained or when Users leave. - Employee lists are also maintained in METRC within 10 days. - Train and authorize any new METRC Users before they can access, input, modify, or delete any information in METRC. - You must cancel any METRC Administrators, METRC Sampling Managers and METRC Users from their associated METRC accounts once they are no longer employed at the Licensed Premises. o Administrators share accountability with each employee for actions taken while logged into METRC or when conducting Marijuana or Product inventory tracking activities.

49 © iComply, LLC 2019 V.05.22.19..01

METRC Requirements

The following are requirements for the “state inventory tracking system” – more commonly known as METRC: - Use “tested and approved” scales and measurement standards – Reconcile Inventory (plants/batches/products/samples/waste) DAILY - Maintain accurate/complete list of METRC Admins/Users/Sampling Manager – Cancel immediately if no longer employed - Owners and users are responsible for their METRC users’ actions – Beware as METRC has NO SAFEGUARDS for Non-Compliance - Secondary POS systems must be compatible to uploading into METRC - Must have back up protocols in the event of Primary System Failure: - Maintain back up records during any system failure: power outage, server down in POS or METRC, and/or internet failure. - Be sure staff is trained on how to manually cultivate, manufacture, and sell with backup systems. - Cannot transport without access to METRC as manifests are generated in METRC only

Inventory tracking in METRC: 1. Properly indicate the creation of a Production Batch including the assigned Production Batch Number; 2. Accurately identify the cultivation rooms and location of each plant within those rooms on the Licensed Premises; 3. Accurately identify when inventory is no longer on the Licensed Premises; 4. Properly indicate that a Test Batch is being used as part of achieving process validation; 5. Accurately indicate the METRC category for all Marijuana, Marijuana Concentrate and Marijuana-Infused Product; and 6. Accurately include a note explaining the reason for any destruction of plants or adjustment of weights to Inventory Tracking System packages. 7. Accurately indicate that a Research & Development batch or sample is being used for approved research or is being transferred to an approved research facility.

50 © iComply, LLC 2019 V.05.22.19..01

Secondary Software Systems Allowed - You can use other software applications to collect the required information to be used including secondary inventory tracking or point of sale systems. It is your responsibility to ensure that all relevant METRC data is accurately transferred to and from METRC when reconciling with any secondary systems. - You must preserve original METRC data when transferring to and from secondary application(s) which must use METRC as a primary data source and be compatible with updating to METRC

51 © iComply, LLC 2019 V.05.22.19..01

Signage, Marketing, and Advertising

ALL Marijuana Establishments are restricted on the advertising and display of marijuana and marijuana products to prevent the sale or diversion of marijuana to persons under the age of 21 (or 18 for medical). Signage, marketing and advertising restrictions include but are not limited to a prohibition on mass-market campaigns that have a high likelihood of reaching minors. Voluntary standards adopted by the alcohol industry demand refraining from advertising where more than approximately 30 percent of the audience is reasonably expected to be under the age of 21 (or 18 for medical).

The State Licensing Authority has determined that, in order to prevent advertising that has a high likelihood of reaching minors, it is appropriate to model the voluntary standard used by the alcohol industry. This standard is consistent with the directive in the state constitution to regulate marijuana in a manner that is similar to alcohol, while also recognizing that the legal status of the marijuana industry and the legal status of the liquor industry are not the same.

Marijuana Establishments cannot use television, radio, print media, internet, or event sponsorship Advertising unless the Establishment has reliable evidence that no more than 30 percent of the audience is reasonably expected to be under the age of 21 (or 18 for medical). Keep records of these advertising demographics on file and/or contracts from advertisers guaranteeing ads do not reach this audience.

A Marijuana Establishment is permitted to have a fixed sign that is located on the same lot zone as the store that exists solely to identify the location and complies with local ordinances.

It is illegal to engage in advertising that is visible to members of the public from any street, sidewalk, park or other public place, including Advertising utilizing any of the following media: any billboard or other outdoor general Advertising device; any sign mounted on a vehicle; any hand-held or other portable sign; or any handbill, leaflet or flier directly handed to any person in a public place, left upon a motor vehicle, or posted upon any public or private property without the consent of the property owner.

Neither MEDICAL nor RETAIL Marijuana Establishments can make deceptive, false or misleading statements.

Local jurisdictions often adopt additional ordinances with respect to signage i.e., sign spinners are not allowed in many municipalities. It’s important to know your town’s laws to know what advertising is permissible.

52 © iComply, LLC 2019 V.05.22.19..01

Health and Safety

All Marijuana Establishments are subject to third party inspection by OSHA, the local fire department, building inspector, or code enforcement officer who ensure that no health or safety concerns are present.

The MED recognizes these rules produce healthy conditions for healthy products as well as a safe facility for employees to cultivate marijuana, manufacture infused marijuana products, or sell marijuana to the public. The MED recognizes their need to partner with specialists to conduct effective third party inspections as they relate to Health and Safety, Fire and Building Codes.

As such, they may request that such inspections be conducted by local authorities or appropriate third parties at any time. Additionally, facilities are subject to existing Federal and State laws regarding workplace safety and code.

Should a Licensee be found to be in violation of any Health and Safety, Fire or Building Codes, such violations may then be considered a Violation Affecting Public Safety by the MED and may be treated as such.

Best practices for all Medical and Retail Marijuana facility types include the following:

Maintain Cleanliness

- Establish and adhere to Daily, Weekly and Monthly Cleaning regiments of Equipment, Ballasts, Fans, Floors, Tables, Scales, Storage Bins, Gardening and Trimming Tools, etc. - Restaurant grade equipment and surfaces strongly recommended (req. in MIP) - Dispose of waste daily - Ensure adequate lighting where product is stored and where utensils are cleaned - Make premises as inaccessible to pests as possible - Cleanliness should include efforts for the prevention of micro-organism growth - Staff must maintain personal hygiene (washing hands, using soap and hot water) and cannot work if infected with communicable illness

53 © iComply, LLC 2019 V.05.22.19..01

Maintain Proper Chemical Protocol

- Know your SDS sheets and what to do in emergencies - If SDS calls for any PPE then it must be on site and easily accessible - Record any and all pesticide applications on batches - Toxic cleaning compounds, sanitizing agents, solvents and pesticides shall be identified, held, stored and disposed of in a manner that protects against contamination

Comply with Local Building and Fire Code

- Pull, and close out, the proper Permits required for any change to the facility such as electrical/plumbing/HVAC upgrades and roof repairs - Keep premises free of debris, such as dead plant material and paper towels soaked in alcohol, that could become fire hazards - Keep ingresses and egresses unobstructed - Ensure adequate number of Fire Extinguishers are easily accessible - Local Building and Fire Codes can be nuanced between jurisdictions. If unsure, be proactive and contact local authority for clarity

Retail Marijuana Stores/Medical Marijuana Center:

Since employees working in an RMS or MMC have direct contact with the public, it is required to maintain good personal hygiene and cleanliness. It is mandatory to refrain from having direct contact with the product if there is any risk of contamination.

Be sure to clean the jars, shelves, scales, bins, and common areas regularly. Members of the public increase the risk of cross contamination so common areas such as waiting rooms, bathrooms, counters, doorknobs, tongs, and scales/trays should be cleaned daily. Take special precautions in handling money between transactions; gloves, tongs, and hand sanitizer are highly recommended.

Safety must be considered in use of chemical cleaning compounds and chemicals should be stored immediately after use. Spilling alcohol on electrical equipment, for example, may cause a fire.

Stores must also maintain accurate and current SDS sheets detailing all chemicals including cleaning agents kept on the premises to avoid mixing the wrong agents and to clean up certain chemical spills.

54 © iComply, LLC 2019 V.05.22.19..01

Medical and Retail Cultivation Facilities:

Cultivation facilities must take reasonable measures and precautions to keep all areas clean, all areas have adequate lighting, and that the facility is constructed in a way that makes it easy to clean.

Equipment and utensils shall be so designed and of such material and workmanship as to be adequately cleanable and must be properly maintained. Only sanitizers and disinfectants registered with the Environmental Protection Agency shall be used in a cultivation facility and used in accordance with labeled instructions.

Cultivation facilities are also required to ensure that the water supply is sufficient and capable of carrying sufficient quantities of water. There shall be no cross-connections between the potable and wastewater lines.

Cultivation facilities are required to have Safety Data Sheets (SDS) and labels for each chemical (whether water, cleaning, solvent, nutrient or pesticide/fungicide/herbicide) on site. If the SDS calls out for a particular piece of Personal Protective Equipment (PPE) then the facility must have the PPE on site and make it easily accessible to staff members. If a chemical is on site and the associated PPE called for on the SDS is absent, then the Licensee could be found in violation of OSHA, as well as other authorities.

If a cultivation facility produces water-based concentrates, it must follow all MIP sanitary requirements including a thorough cleaning after each production batch and restaurant grade surfaces, equipment, and food safety protocols must be followed. Trim tables and storage bins must also be restaurant grade to avoid contamination post-harvest.

Extra care should be taken in cultivation environments where high moisture and humidity is often present. Cultivation rooms should be constructed of mold and fungi resistant material and must be cleaned after every harvest batch. Cleaning schedules must periodically include walls, ceilings, floors, ballasts, hoods, fans, CO2 generators, tables, trays, shelves, hoses, reservoirs, chemical storage areas. Any reused pots, mediums, or other equipment must be cleaned before being reused.

55 © iComply, LLC 2019 V.05.22.19..01

Medical and Retail Marijuana Infused Products Manufacturer:

MIPs that manufacture edible Marijuana Product must comply with all kitchen-related health and safety standards of the relevant local jurisdiction and, when applicable, with all CDPHE health regulations that pertain to retail food establishments. All equipment, surfaces, and protocols must conform to restaurant/food safety standards and must be cleaned after every production batch.

MIPs are required to have Safety Data Sheets (SDS) and labels for each chemical (whether water, cleaning, solvent, nutrient or pesticide/fungicide) on site. If the MSDS calls out for a particular piece of Personal Protective Equipment (PPE) then the MIP must have the PPE on site and make it easily accessible to staff members.

Common PPE includes gloves, eye protection, respirators (with appropriate filters), and eye wash stations are required to be in extraction rooms for solvent-based extractions. If a chemical is on site and the associated PPE called for on the SDS is absent, then the Licensee could be found in violation of OSHA, as well as other authorities.

If any piece of equipment used in the process not UL or ETL listed it must be certified by a Certified Industrial Hygienist or Physical Engineer that is safe for use in its newly prescribed manner prior to operation. The premises and SOPs must also be certified by a PE or CIH that it meets all code requirement relevant to the intended processes prior to operation.

56 © iComply, LLC 2019 V.05.22.19..01

Health and Sanitation Audits of all Medical and Retail Marijuana facilities:

The State may require an independent health and sanitation audit at any time they deem appropriate. The Licensee can request a specific independent auditor but State retains authority over who conducts the audit. You are responsible for all associated costs.

What might trigger an audit?

1. You are unable or unwilling to provide requested records regarding training and production (such as signed Employee Training Manuals (ETM) and/or Production Checklists). 2. You are unable or unwilling to provide documentation related to certification of its Licensed Premises, equipment or SOPs, training of Owners or Occupational Licensees, or Production Batch specific records. 3. The MED has reason to believe that Facility is in violation of any production or testing violations or was a potential source of contamination. 4. Unsatisfactory results of the Audit can result in suspension of operations. 5. Unsatisfactory third-party review and audit results can result in quarantined products, a suspension of operations or a violation affecting public safety

What might mitigate an audit?

1. Being well organized and able to find all of the requested documents and information quickly. 2. Logging any and all mishaps into Incident Reports as best practice, filed systematically, by nature of and in a manner that makes them readily identifiable and available. 3. Maintaining required records regarding contamination and potency test results by batch.

57 © iComply, LLC 2019 V.05.22.19..01

Disposal of Cannabis Waste and Fibrous Waste

Licensed facilities must process waste from all stages of cannabis production. As of January 1, 2019, new fibrous waste rules allow qualified licensed facilities to designate and transfer fibrous waste material to contracted Industrial Fiber Product Producers to manufacture Industrial Fiber Products. See Transfer of Fibrous Waste in Section 3 for more details as these transfers are only available to Grows and MIPs. Otherwise, all marijuana is disposed of according to this rule at all licensed facility types. All marijuana storage and disposal must comply with local regulations and all applicable State Laws. All marijuana waste, excluding designated fibrous waste, must be made “unusable and unrecognizable” and not easily “separated” or “sorted” before it leaves a licensed facility. Solid non-fibrous marijuana waste is rendered “unusable and unrecognizable” and not easily “separated” or “sorted” after it has been shredded/ground AND combined with 50% mixture of allowable non- marijuana waste or a composting agent. Liquid, chemical, dangerous and hazardous waste from cannabis production must be disposed of according to all applicable laws. The MED also specifies that the unusable marijuana waste must be disposed of at a licensed disposal facility, licensed compost facility, or on site at a facility following existing CDPHE regulation of solid waste sites. All waste must be identified, weighed and tracked in METRC on the premises until disposed of. - Throw away cannabis waste separately from regular trash, and/or store waste to be made unusable in a disposal container marked for cannabis waste in your own trash receptacle. - Weigh all waste prior to disposal and enter weight from certified scale into METRC inventory tracking system. - Render solid cannabis waste “unusable” by law by grinding and mixing it with one or more of these waste materials: - Paper, Plastic, or Cardboard waste - Food, Grease or other compostable waste - Bokashi, or other compost activators - Soil - Other wastes approved by the State Licensing Authority that will render Marijuana and Marijuana-Infused Product waste unusable and unrecognizable as marijuana. All marijuana waste must be weighed prior to disposal and be inaccessible by locking and enclosing it (in a dumpster or inside the facility) until pick up by an approved waste-disposal company.

58 © iComply, LLC 2019 V.05.22.19..01

Inventory Management

Beyond checking for the compliance of vendors in sending over child-resistant, opaque, and properly labeled packaging, it is important for any receiving entity to also check for the data integrity in shipping container labeling. With many labeling requirement changes, this is an added challenge for cultivators, manufacturers, and stores who must constantly examine the intake of these products. Periodically, stores should also examine existing inventory to ensure perishable products are not expiring as expired products cannot be sold. Best practice is to manage inventory ordering by understanding your average shelf-life per product and avoid over-ordering. Additionally, put products that are about to expire on sale and encourage customers to purchase them. When receiving product, keep in mind to double check the manifest and ensure the accuracy of the travel dates and times, transporting person, vehicle, and double-count the order to ensure the inventory accuracy. If there is an inaccuracy, delay, or other issue, be sure to have the shipping entity correct the mistake on their end and have the transporter fill in the extenuating circumstances field on the manifest. Assuming all labeling, shipping container labeling, and packaging is compliant, be sure to sign the manifest, file it, and re-weigh/count and input the order into your point of sale system. At all times inventory must be tracked in METRC, this includes all Sample Units designated by authorized facilities (excludes all Stores and Centers). If marijuana falls on the floor or a container is damaged or contaminated, be sure to follow disposal procedures by weighing waste, accounting for it in the POS/METRC and on the waste log, and shredding, grinding, and mixing it. For back-stocked product that gets placed into jars from received packages, be sure the bottom of the Jar(s) reflects the METRC package tag. If need be, copy the tag from the originating package and tape it to the bottom of multiple jars. Similarly, you should track containers holding concentrates or infused products to the packages they originated from. Be sure to manage inventories of labels, containers, exit packages, and other non-marijuana inventory necessary to avoid shortages. Best practice is an SOP and employee training manual for the store to manage inventory, record keeping, cash procedures, security, and sanitation. To avoid contamination, be sure to establish cleaning schedules for all areas including scales used to weigh product, storage jars, back-stock storage areas, shelves, point of sales, bathrooms, waiting rooms, and break rooms. Personal protective equipment should include gloves, tongs, and hand sanitizer to prevent illness and contamination – especially when handling money and multiple customers. Do not allow random customers to smell jars and any sampling smell jars should never be sold and should be rotated out regularly. Third Party Responsibility

59 © iComply, LLC 2019 V.05.22.19..01

For the remainder of these rules and applicable to all licensed facilities, any act or conduct done by a third party you contract, employ, hire, or “otherwise engage” can directly reflect on your business and license. All applicable enforcement actions may be taken against you for actions, omissions, conduct by any third-party. What makes compliance with this rule challenging, is that the MED does not specify what “otherwise engage” means. This is very broad and subject to MED discretion. One example may be a friend of an employee who was told to buy marijuana using their medical card for the employee. Certainly, this rule tightens the noose on loopholes previously exploited through third-party contracts. For example, a dispensary may not advertise, but if they license their intellectual property (brand, graphics, name) to a third party, that third party may be able to advertise without a risk of losing the right to sell marijuana. Another example of this are Dab Busses, agreements with consumption venues, or marijuana tour companies which may be third-party as a way to circumvent advertising and consumption rules. The intention of this rule can also impact non-compliance done by Vendors who may be acting on your behalf but have little to no understanding of the regulation. Some examples may be transport companies, packaging vendors, accountants, waste companies, or other third- parties who may touch upon but are not fully responsible for your compliance. iComply strongly recommends examining your vendors and third-party agents to ensure they have the information they need and a level of accountability you may not currently have to ensure third-party acts, conduct, or omissions do not negatively impact your business. We strongly recommend you ensure any third parties have Errors and Omissions insurance for high dollar and high-risk activities and mitigate these risks wherever possible in any legal contracts with third-parties. Holding them accountable via auditing, QA, and other systems is also critical to mitigating this risk.

60 © iComply, LLC 2019 V.05.22.19..01

Section 3 Cultivation and Manufacturing

- Cultivation and Manufacturing - Infused Product and Concentrate Terms Contract Manufacturing - Plant Counts and Production - MIP Health and Safety Limits - Samples and Test Batches - Propagation and Immature - Contaminant Testing Plants - Marijuana Testing Facilities - RFID Tags and Plant Tracking - Potency Testing - Vegetative and Flower Cycles - Sampling Units and Sampling - Harvesting, Manufacturing, & Managers Processing - Wholesales and Transfers (CDP) - MIP Product Manufacturing - Transfer of Fibrous Waste - Audited and Alternative Use - Standard Operating Procedures Products (SOPs) - Concentrate Production - Prohibited Chemicals

61 © iComply, LLC 2019 V.05.22.19..01

Cultivation and Production Terms

Term: Definition: Immature Plant Nonflowering plant no taller or wider than 8 inches; in max 2x2 container, sealed on the sides and bottom; do not count towards carry weight but are required to be tracked and accounted for in METRC Propagation Reproduction of plants by seeds, cuttings or grafting Vegetative State when plants aren’t producing buds but are bulking up to a desired production size for Flowering Flowering State of plant reproduction with physical signs of flower or budding out of nodes in stem RFID Tag Radio Frequency Identification T.O.H.I. Total on hand inventory –in 2019, 50/50 rule is effectively repealed and all OPCs may sell, transfer or wholesale any amount of marijuana from any other OPC without restrictions of 50/50 rule Harvest Batch Processed marijuana uniform in strain, cultivated using the same pesticide and agricultural chemicals and harvested at the same time Marijuana Infused Product infused with marijuana intended for use or consumption other Product or Marijuana than by smoking, including but not limited to edible product, ointments Product and tinctures Liquid Edible Product Edible marijuana product in liquid form intended to be consumed orally, such as a soft drink or cooking sauce Edible Medical Any marijuana infused product intended for oral consumption (i.e. any Marijuana Infused type of food, drink, pill, etc.), serving size not restricted to 10mg of Product active THC Single Serving Edible An edible retail marijuana product containing no more than 10mg of Retail Marijuana active THC per unit Product Multiple Serving Edible retail marijuana product containing more than 10mg of active Edible Retail THC but no more than 100mg of active THC. If product consists of Marijuana Product multiple pieces where each individual piece may contain less than 10mg active THC then the product is considered a multiple serving edible retail product Water Based Concentrate produced by extraction using ice, dry ice, or water Marijuana Concentrate Heat/Pressure-Based Produced by extracting through the use of heat and/or Marijuana pressure Concentrate

62 © iComply, LLC 2019 V.05.22.19..01

Food Based Marijuana concentrate produced with extraction method using Marijuana propylene glycol, glycerin, butter, olive oil or other typical cooking fats Concentrate SOP Standard Operating Procedures, must be accurate and up to date with all cultivation and manufacturing processes and procedures at grow and MIP facilities (any material changes should be considered and accounted for in SOPs) Material Change Any change that would require a substantive revision to a marijuana establishment’s SOP(s) for cultivation or production UL or ETL Listing Means that either UL (Underwriters Laboratories) or Intertek Testing Services (formerly ETL Testing Laboratories) has tested the product and determined that it meets certain international standards Flammable Solvent A liquid with a flash point below 100 degrees Fahrenheit PE Professional Engineer: an individual who is licensed by the State of Colorado as a professional engineer pursuant to 12-25-101 et. seq., C.R.S. CIH Certified Industrial Hygienist, an individual who holds a valid and current certification from the American Board of Industrial Hygiene Production Batch Any amount of marijuana concentrate(s) or marijuana product of same category/type and produced using same extraction methods, ingredients, SOPs and same group of harvest or production batch(es) of marijuana (PB number can be combined with production date on product package/label) Test Batch Batch submitted for testing to a Medical Marijuana Testing Facility or a Retail Marijuana Testing Facility from the same Strain, same Production Batch, Concentrate, or Product or from the same Harvest Batch Sample Anything collected from a licensed facility that is provided for testing to a marijuana testing facility (not to be confused with a ‘Sampling Unit’ for transfer to ‘Sampling Manager’) Profile The level of concentration of THC and CBD Homogeneity Uniform structure, ingredients, and potency throughout the entire unit and/or serving – testing standard Proficiency Testing Performing the same analyses on the same samples and comparing Samples results to ensure samples are homogeneous and stable Pesticide And substance of mix of substances for preventing, destroying, repelling or mitigating any pest or any substance or mix intended for use as a plant regulator Pesticide Any entity with involvement in pesticide production, possession (with Manufacturer EPA approval), research, licensing (with CDA approval), business (with CO state approval), etc., but not a marijuana MMB or RME Contaminant Testing Testing includes pesticides, microbials, chemicals, mycotoxins, residual solvents, metals, etc.

63 © iComply, LLC 2019 V.05.22.19..01

Quarantine Required for specified marijuana or marijuana product if MED investigation deems license guilty of deliberate/willful violations, if product poses potential threat to public health and safety, if product is involved in an adverse event report, if product fails an independent third-party review, or if product doesn’t comply with audited and alternative use product requirements Independent Third- Required for specified test batches that are suspected to contain Party Review substance(s) known to cause and/or substance(s) known to be toxic as consumed or applied Shipping Container Container or wrapping used solely for transport of product in bulk to other marijuana establishments. A hard-side container or other enclosure that can be in a secured place, and is solely used for transport of product, RFID tag(s) required for each harvest batch(es) or production batch(es)contained in each shipping container. Universal Symbol The image established and approved by the MED, which can be found on the CDPHE website indicating the Infused-Product contains marijuana Container Immediately contains marijuana or marijuana product, which may not exceed 10 pounds of marijuana or marijuana product. Marketing Layer Optional packaging in addition to the container that’s the outermost layer visible to the customer at the POS Sampling Units Units of marijuana or marijuana product that are designated for transfer to an authorized Sampling Manager, always tracked and accounted for in METRC Sampling Manager A designated associated key or key badged employee who may receive Sampling Units transfer from a grow or MIP (never from stores/centers), always tracked and accounted for in METRC Kief The resinous crystal-like trichomes found on marijuana flower that accumulate, resulting in higher concentration of cannabinoids Intended Use Identification of product(s) for specific labeling requirements as one of the following: Inhaled product, oral consumption, skin and body products, audited product, or alternate use product Audited Product Marijuana products must meet all requirements in accordance with intended use(s) of: (1) metered dose nasal spray, (2) pressurized metered dose inhaler, (3) vaginal administration, or (4) rectal administration, Alternate Use Product(s) with intended use not listed in rules which require alternate Product use designation via evaluation/audit and approval from MED and CDPHE, production may result in additional safeguards and oversight if approved, transfer of AUP permitted unless AU designation is approved

64 © iComply, LLC 2019 V.05.22.19..01

Alternate Use Required approval/authorization from the MED and CDPHE to allow for Designation the production and transfer of Alternate Use Products, comply with all rules and directives to avoid VAPS Fibrous Waste Any marijuana plant roots, stalks, and stems which must be stored and managed in accordance with all state and local requirements, not and may be transferred for manufacturing to a IFPP Industrial Fiber Finished or unfinished product(s) created from fibrous waste and not Product intended for human or animal consumption (i.e. cordage, paper, fuel, textiles, bedding, insulation, construction materials, compost materials, and industrial materials) Industrial Fiber An approved and contracted entity involved in receiving transfers of Products Producer fibrous waste from a grow or MIP for purposes of producing industrial fiber products R&D Co-Location Authorizes co-location of licensed research business/R&D facility with a Permit commonly owned grow or MIP facility Centralized Allows transfer of marijuana and marijuana product to other grows for Distribution Permit purposes of temporary storage and eventual transfer of product to commonly owned store or center Licensed Research A marijuana research and development cultivation or a marijuana Business research and development facility, which allow approved MMB and RME facilities to conduct research on marijuana. All marijuana must be destroyed and shall not be transferred to any person or license after testing is complete.

65 © iComply, LLC 2019 V.05.22.19..01

Plant Counts and Production Limits

Before 2019, cultivation facility plant count limits, or production management limits, depended on the license type and association with other facilities. Effective from July 1, 2018 to June 30, 2019, For an MMC, the number of registered patients determines the total number of plants the commonly owned (vertically integrated) OPCO may cultivate. Normally, this is six (6) plants and two (2) ounces of marijuana (or its equivalent in marijuana product) per patient. However, a patient may choose to split plant counts with a center and cultivate their own or may have a physician recommendation to cultivate more plants. It is important that the MMC maintain supporting documentation for each patient’s file to warrant the accurate plant count and that this total plant count limit is communicated regularly to the OPCO.

HB18-1381 creates a transition period between the previous limited sourcing model that began July 1, 2018. For one year from that date, medical marijuana centers and optional premises cultivation facilities can purchase and sell 50% of their inventory as a wholesale transaction, and medical marijuana trim is not included in the calculation of the percentage. Then, effective July 1, 2019, an optional premises cultivation facility may sell any amount of the medical marijuana it cultivates to any medical marijuana center. Similarly, a medical marijuana center may source its medical marijuana from any optional premise’s cultivation facility without restriction. This new bill eliminates the previous 70/30 requirement.

Beginning July 1, 2019, Mandatory collapse of cultivation licenses with Identical Direct Beneficial Interest Owner Percentages and OPTIONAL collapse of licenses with non-identical DBIO percentages to only one med grow license per licensed premises implies that each license must have distinct address recognized by local jurisdiction. OPCO licenses with identical DBIO’s should notify MED before June 30, 2019 of desired surviving license and surrender all other licenses by July 1, 2019 through a change of location app. OPCO licenses with non-identical DBIO’s opting to surrender licenses proactively should submit a change of ownership application after July 1, 2019. Effective July 1, 2019, OPCO’s and RMCF’s shall not possess more plants than is permitted based on production management class established through license applications.

66 © iComply, LLC 2019 V.05.22.19..01

Medical Cultivation Production Limits

Effective July 1st, 2019, Production limits in Medical Cultivation will be determined by the number of plants in each production management class. The MED shall calculate the average plants cultivated by all OPCO licenses at shared licensed premises between Jan 1, 2018 and Dec 31, 2018 in each OPCO license application review.

Expanded Production Management Licenses for OPCs - Class 1 (1-500 plants) - Class 2 (501-1,500 plants) - Class 3 (1,501-3,000 plants) i. Each class increase of 3,000 plants over Class 3 subject to additional fees if approved by MED

Retail Cultivation Production Limits

Production limits in Retail Cultivation are set by a pay to play system in which each licensing tier allows a certain number of plants. To manage these levels of production, the MED has strict rules on how cultivations may move between tiers and production limits. Retail Production Management Tiers (Retail). 1. Tier 1: 1 - 1,800 plants 2. Tier 2: 1,801 – 3,600 plants 3. Tier 3: 3,601 – 6,000 plants 4. Tier 4: 6,001 – 10,200 plants 5. Tier 5: 10,201 – 13,800+ plants ii. Tier 5 has no cap on the maximum authorized plant count. iii. The maximum authorized plant count above Tier 5 increases by 3,600 plants at a time through application and approval by the Division.

All New RMCF licenses granted including any associated to a Retail MIP can cultivate no more than 1,800 plants. RMCF’s with license(s) granted before November 30, 2015 can cultivate the same number of plants previously authorized until licensing renewal. Upon renewal, any RMCF that has multiple licenses, can cultivate a plant count that is the sum across those licenses but all multiple Retail Cultivation licenses at a common location will be collapsed into one license upon renewal.

67 © iComply, LLC 2019 V.05.22.19..01

Reduced or Increased Plant Counts

Effective July 1, 2019, at renewal, for existing RMCF’s authorized to cultivate more than 1,800 plants and qualified OPCO’s authorized to cultivate more than 1,500 plants, the MED will review the purchases, sales, and cultivated plant count and may reduce your maximum allowed plant count to a lower tier if you sold less than 70% of what you produced during the 180 days prior to the application for renewal. When determining whether to reduce your maximum plant count, the MED may consider the following factors: - Cultivation and production history including whether the plants/inventory suffered a catastrophic event during the licensing period; - Transfer, sales, and excise tax payment history; - Existing inventory and inventory history; - Sales contracts - Any other factors relevant to ensuring responsible cultivation, production, and inventory management.

After accruing at least two quarters of sales a cultivation may apply with the MED for a higher tier or class. You must provide documentation demonstrating that you have consistently cultivated an amount of plants at or near your maximum plant count and have transferred at least 85% of the inventory produced during the previous 180 days to another MME or RMB, and any other information requested by the Division in its evaluation of the application for a tier increase. - If the tier increase application is approved, you must pay the applicable expanded production management tier fee before cultivating the additional authorized plants approved by the upgrade tier. For every multiple of three RMCF or OPCO licenses a company has an interest in, the owner must have a controlling interest in at least one RMS or MMC. This doesn’t apply to Persons with a controlling interest in fewer than 3 RMCF or OPCO licenses. - This rule creates an arbitrary, Semi-Vertical Integration mandating a Person with an Interest in Three or More Cultivation Facility Licenses to have a controlling interest in at least one RMS or MMC. At any time, the MED may adjust any of the plant limits on an industry-wide basis for all licensed cultivation facilities. At no time should a cultivation grow more plants than authorized.

68 © iComply, LLC 2019 V.05.22.19..01

Propagation and Immature Plants

An Immature Plant is identified as a nonflowering marijuana plant no taller or wider than 8” produced from a cutting, clipping, or seedling and in a growing container no taller or wider than 2” with sealed sides and bottom. Immature Plants never count against a license’s maximum allowable plant count but should always be accounted for in the inventory tracking system, METRC.

General Requirements for Immature Plants - Always create beginning batch from seed or clone. Estimate the number of plants typically destroyed before up-potting into vegetative cycle and ensure plant counts allow for propagation before planting. - Every immature plant must be accounted for in METRC and have an associated RFID tag once it becomes a vegetative plant at a height/width of 8” or out of a 2”x 2” container. - Plant batches according to desired and destined harvest batches - Recommend physical Log to track batches and associated tags - Sourcing new genetics is limited because all plants and strains are accounted for in METRC. It is unlawful to source genetics from a clone or a seed outside of the regulated model and would be considered Diversion. - Only a few options are implicitly available for obtaining new genetics: - Buy genetics from another licensee - Grow from seed bank acquired and already on hand - Once an immature plant reaches height/width of 8” or is out of a 2”x2” container, each plant must be physically tagged with its unique RFID METRC issued tag throughout the cultivation process.

69 © iComply, LLC 2019 V.05.22.19..01

Medical and Retail grow facility maximum allowable plant count limits are defined by license Tier or Class. Effective July 1, 2019, OPCO’s production management expansion changes will be redefined.

Medical (until June 30, 2019) Retail Type 1 300 or fewer patients Tier 1 1 – 1,800 plants Type 2 301 – 500 patients Tier 2 1,801 – 3,600 plants Type 3 501 or more patients Tier 3 3,601 – 6,000 plants Tier 4 6,001 – 10,200 plants Tier 5 10,201 – 13,800 +

*Use until June 30, 2019

Medical (starting July 1, 2019) Retail Class 1 1 – 1,500 plants Tier 1 1 – 1,800 plants Class 2 501 – 1,500 plants Tier 2 1,801 – 3,600 plants Class 3 1,501 – 3,000 plants Tier 3 3,601 – 6,000 plants Class 4 Tier 4 6,001 – 10,200 plants Class 5 Tier 5 10,201 – 13,800 +

*Use beginning July 1, 2019

70 © iComply, LLC 2019 V.05.22.19..01

RFID Tags and Plant Tracking

All plants and marijuana inventory in process must be physically tagged and tracked with unique batch numbers, barcodes and RFID tags. - Packages are also tagged for testing and transport purposes - Use RFID tags issued by a Division-approved vendor authorized to provide RFID tags for METRC. - Ensure all inventory is tagged with unique RFID tags, which includes immature plants, processed marijuana, trim, waste, final product, etc.

Specific RFID Features: Read Distance – Rooms can be read with plant ID numbers from a distance of 10 to 15 ft. which means no touching or brushing against plants unnecessarily Read Speed – RFID read speed is 90% or faster than bar-code. Performing inventory of a room is dramatically faster. Accuracy- Able to isolate and cingulate an ID number from a group - Allows operations to quickly locate and find misplaced or misallocated Efficiency- Can capture and ignore ID’s already identified – Allows 2nd or 3rd screenings without having to begin the process over again. Simplicity- RFID improves and simplifies reporting and compliance processes. Accountability- Creates a strong chain of custody and traceability.

71 © iComply, LLC 2019 V.05.22.19..01

Vegetative and Flower Cycles

Stake RFID Tag in soil during Vegetative cycle (More than 12 hours of light) - Once plants reach 8” in 2” x 2” container, tag, and up-pot healthy plants - Destroy unhealthy plants – best business practice - Associate RFID tags assigned in propagation to individual plants in METRC - Due to size of plants/potting, RFID tag should be attached to the stalk of plant until it reaches a viable size to support RFID tag and strap on lower supporting branch

Attach Tags to Stalk until strong enough to support Tags on branches once in Flower Stage (Plant in which there are physical signs of flower or budding out of the nodes in the stem.) - After full grown vegetative plant is ready for flower - Keep RFID tag with plant through Harvest and Processing - Do Not bury tags in dirt or RFID may not read

Track in METRC every time plants move - Track any destruction of plants in METRC and physically remove RFID tags

Collect waste weight per facility - Record daily when pruning/maintaining/trimming plants into master log of waste - Maintain separate logs for Medical and Recreational - Separate and designate applicable Fibrous Waste for transfer to contracted Industrial Fibrous Products Producer and track accordingly in METRC

The RFID tags will be associated with the individual Plant ID numbers that act as serial number. These are used to track the Plants through their life cycles. Additionally, these tags will be associated with a Harvest Batch number at the end of the plants’ life cycles; with these Harvest Batch Numbers being potentially associated with Production Batch numbers if the plant material is used in the productions of concentrates and/or infused products.

While it is possible for Plants in Propagation stage to not be tagged, since they are potentially Immature (while under 8” tall and/or wide), once a plant moves into the Vegetative stage it should be tagged by this point and that tag MUST stay with the Plant as it enters the Flowering cycle. Tags should remain with the plants throughout the life cycle of the plant and into associated batches as a best business practice until final packages receive package tags and are transported.

72 © iComply, LLC 2019 V.05.22.19..01

Harvest, Manufacturing & Processing

Once plants have matured through various stages of growth, the mature flowers are harvested from the plants and processed into final product for sale at the retail store or medical marijuana center. At harvest, all tagged plants must be combined into batches according to strain type for processing. Each plant tag and RFID from the flowering stage should accompany the processing batches during curing and be kept as a supplementary record for the MED for each batch. - Harvest plants and transform plant counts into weighted batches of flowers for additional processing (hash making, contractual infusing, or drying/curing), - Maintain batch records with the plant tags/RFID from flowering process and display the batch tag throughout the drying and curing process. The weights of the plants’ harvest must be designated and logged as unprocessed product, wholesale byproduct, or waste and disposed of in accordance with all waste regulations (including new fibrous waste disposal regulations and transfers to industrial fiber products producer). After harvest, plants should be batched and tagged and placed into drying and curing processing. During this time, cannabis will dry out and inactive THC will oxygenate to become active THC. Bear in mind that during drying/curing, the plants will lose weight; this is the most vulnerable point in the cultivation process for accountability as the harvested material is no longer a plant counting against a plant count. This “plant purgatory” also does not count against weight count limits at the medical and retail cultivations and stores/centers. Harvested material is also vulnerable to diversion as drying reduces the weight of the product. As a best practice, we recommend physical access controls to product in drying/curing to prevent internal diversion and the perception of impropriety to regulators. Once the final marijuana product is trimmed, dried, and cured, it is considered “processed” according the MED. Once “processed,” cannabis must be immediately prepared for final packaging and transport to a licensed cultivation, manufacturing, testing, research, permitted R&D, sales facility (see below), or the Sampling Manager beginning July 1, 2019. Effective Jan 1, 2019, OPCO and RMCF licenses may share and operate at the same licensed premises as a Licensed Research Business so long as; - Each business/entity holds a separate license - The LRB obtains an R&D Co-Location Permit - Both the OPC and LRB comply with all terms and conditions of R&D Co-Location Permit; and - Both LRB and OPCO comply with all applicable rules

Harvest: Remove from growing medium, doesn’t count against carry weight Manuf. & Prod: Trim, dry, cure, or production of water-based concentrate Wholesale: Package and transport for transfer to other facilities

73 © iComply, LLC 2019 V.05.22.19..01

Marijuana Infused Products Manufacturing

Medical and Retail Marijuana Manufacturers are specialized sets of operators who manufacture, prepare, package, store, and label marijuana products. Marijuana products may be in concentrated form or comprised from marijuana infusion into edibles, ointments, tinctures, transdermal patches, and other products. Effective January 1, 2019, medical and retail MIPs will be allowed to manufacture and transfer Sampling Units, Audited and Alternative Use Products if approved by the MED (more info below).

A marijuana manufacturer must provide samples of concentrates and infusions as well as final product samples to licensed and qualified testing facilities for potency and contaminant testing and maintain results for manufacturing batches as part of their records. Testing should occur each time a production batch is produced, unless process validation for a particular product has been obtained and approved in accordance with rules.

Manufacturers may acquire marijuana for concentrate and/or infused product manufacturing from a commonly owned cultivation facility, outside wholesale purchases from other Retail Cultivation facilities or MMC’s and through infused production contracts with Stores. They may only sell to retail or medical marijuana centers and may not wholesale directly to consumers or cultivation facilities, excluding permitted transfers to CDP facilities, Sampling Managers, etc.

All infused products and concentrates sold to stores must meet proper packaging and labeling standards including new allowances for Sampling Units, audited and alternate use products, etc. Retail manufacturers may not sell single servings that contain more than 10mg of THC or have an aggregate of more than 100mg of THC. Excise tax must be paid by Retail Marijuana Cultivation Facilities based on calculations described by the DOR Taxation Department - effective January 1, 2019.

Adequate Care of Perishable Product: Retail and Medical MIPs must provide adequate refrigeration for perishable Product that will be consumed and shall utilize adequate storage facilities and transport methods. Close attention should be paid to local Health Department regulations regarding liquid products especially.

Homogeneity of Edible Marijuana Product: A Retail MIP / Medical MIP must ensure that its manufacturing processes are designed so that the cannabinoid content of any Edible Marijuana Product is homogenous.

74 © iComply, LLC 2019 V.05.22.19..01

Required Training All Owners and Occupational Badge Holders that are to manufacture Edibles must successfully receive their ServSafe (or comparable) Food Handler Certification prior to working with Infused Product. Documentation proving successful completion of the training must be kept on the premises for each badge holder.

Adequate training for the production of marijuana concentrates includes creating and providing a copy of an internal training manual for the Licensed Premises. Supervisors must conduct live, in-person instruction to all staff members and new hires detailing all of the topics required in the training manual for concentrate manufacturing. The trainer must sign and date documentation, to be kept on file, attesting that all required aspects of training were conducted and that the Trainer is confident that the Trainee can safely produce the Marijuana Concentrate before allowing the Trainee to produce marijuana concentrates independently and autonomously.

Employee Training Manuals The comprehensive Employee Training Manual must provide step-by-step instructions for each method used to produce a Marijuana Concentrate on its Licensed Premises. Although only required for concentrate manufacture, an industry best practice is to extend these protocols to infused product manufacturing as well. The training manual must include, but is not limited to, the following topics: - All SOPs for each method of concentrate production and/or manufacturing process used at that Licensed Premises - The MIP’s quality control procedures - The emergency procedures for that Licensed Premises (fire, chemical spills, etc) - The appropriate use of any necessary PPE or sanitation equipment - The hazards presented by all solvents and chemicals used within the Licensed Premises as described in the safety data sheet SDS for each - Clear instructions on the safe use of all equipment involved in each process and in accordance with manufacturer’s instructions, where applicable - How to properly use the eyewash station - Any additional periodic cleaning required to comply with all sanitary rules

The trainee that received the training must sign and date documentation to be kept on file attesting that he or she can safely implement all standard operating procedures, quality control procedures, and emergency procedures, operate all equipment and systems, use all safety, sanitary and other equipment and understands all hazards presented by the solvents and chemicals to be used in Licensed Premises and any additional periodic cleaning required to maintain compliance with all sanitary rules.

75 © iComply, LLC 2019 V.05.22.19..01

Audited Products, Alternative Use Products and Adverse Event Reporting

New in 2019, Marijuana Concentrate or Infused-Products Manufacturers seeking to produce products with an intended use that is not listed in the rules will require Alternate Use Designation approval prior to any production or transfer by a medical or retail MIP. Alternate Use Products may be transferred to a medical or retail marijuana testing facility (MTF) prior to receiving an Alternate Use Designation if all other requirements for medical or retail marijuana concentrates, and infused products are satisfied.

As discussed in the Records and Retention (Section 1), any adverse event must be reported to the CDPHE and the MED within 48 hours of the manufacturer receiving notice of an occurrence. A MIP is required to maintain a record of any complaints that may describe concerns with quality or possible adverse reactions specific to products. According to the MED, an Adverse Event is defined as any untoward medical occurrence associated with the use of marijuana – this may include any unfavorable and unintended sign (including a hospitalization, emergency department visit, doctor’s visit, abnormal lab finding, etc.), symptom or disease temporally associated with the use of a marijuana product, and may include concerns or reports on the quality or possible adverse reactions to a specific Audited Product or Alternative Use Product.

It is the MMIPM or RMPMF license’s responsibility to accurately record all pertinent information surrounding an adverse event complaint that includes info on the event occurrence, the complainant (name/date/nature), the steps taken to investigate, the response, the Production Batch number, and the audited product number. A few other notable pieces about Audited Products, Alternative Use Products and Adverse Event Reporting timeline include: - Effective July 1, 2019, MIP must follow requirements for audited products and alternative use products including documentation of third-party audits during last 24 months, product development testing, personnel training, master formulation records, and all other applicable and required records. - From January 1, 2019 to June 30, 2019, products can be transferred without full compliance to rules only if MIP certifies that it will be compliant by July 1, 2019. - Effective Jan 1, 2019 thru Dec 31, 2019, an MMC or RMS may transfer products to consumer if product was transferred by MIP before July 1, 2019.

76 © iComply, LLC 2019 V.05.22.19..01

Concentrate Production

Permitted Types of Concentrate Production: Water-based marijuana concentrate, food-based marijuana concentrates, heat/pressure based, and solvent-based marijuana concentrate using only the following solvents*: butane, propane, CO2, ethanol, isopropanol, acetone, and heptane. Note: Denatured Alcohol is prohibited from use as a solvent. *The use of any other solvent is expressly prohibited unless and until it is approved by the MED. A MIP may submit a request to the Division to consider the approval of solvents not permitted for use under this rule during the next formal rulemaking.

A Retail MIP / Medical MIP that produces concentrate, regardless of the method of extraction or category of concentrate being produced, must ensure: 1. That the space in which any concentrate is produced is a fully enclosed room and clearly designated on the current diagram of the Licensed Premises. 2. That all applicable sanitary rules are followed. 3. That each method used to produce concentrates is documented in the SOP and followed. Water and Food-Based Marijuana Concentrate: RMPMF/MMIPM producing water-based, heat/pressure, and/or food- based concentrate must ensure: 1. That all equipment, counters and surfaces used in the production are food- grade and that all counters and surface areas are constructed in such a manner as to reduce the potential for the development of microbials, molds and fungi and that they can be easily cleaned. 2. That all equipment, counters, and surfaces used in the production of a Concentrate are thoroughly cleaned after the completion of each Production Batch. 3. That any room in which dry ice is stored or used for processing Marijuana into a Concentrate is well ventilated to prevent against the accumulation of dangerous levels of CO2. 4. That the appropriate safety or sanitary equipment, including PPE, is provided to, and appropriately used by, each person engaged in the production of Concentrate. 5. That only finished drinking water and ice made from finished drinking water is used in the production of a Concentrate. 6. That if propylene glycol or glycerin is used in the production of a Food-Based Concentrate, then the propylene glycol or glycerin to be used is food- grade. 7. That you follow all of the rules related to the production of a Solvent-Based Marijuana Concentrate if a pressurized system is used in the production of a any of these types of Concentrate.

77 © iComply, LLC 2019 V.05.22.19..01

Solvent-Based Marijuana Concentrate: A Retail / Medical MIP engaged in the production of Solvent-Based Marijuana Concentrates must obtain a report from a Certified Industrial Hygienist or a Physical Engineer that certifies that the equipment, Licensed Premises and SOPs comply with these rules and all applicable local and state building codes, fire codes, electrical codes and other laws. If a local jurisdiction has not adopted a local building code or fire code or if local regulations do not address a specific issue, then the Certified Industrial Hygienist (CIH) or Professional Engineer (PE) shall certify compliance with the following: - The International Building Code of 2012 (http://www.iccsafe.org) - The International Fire Code of 2012 (http://www.iccsafe.org) AND/OR - The National Electric Code of 2014 (http://www.nfpa.org), when applicable.

The Retail / Medical MIP engaging in solvent-based concentrate production must: 1. Ensure that all equipment, counters and surfaces used in the production of a Solvent-Based Marijuana Concentrate must be food-grade and must not react adversely with any of the solvents to be used in the Licensed Premises. 2. Ensure that all counters and surface areas are constructed in a manner that reduces the potential development of microbials, molds and fungi and can be easily cleaned. 3. Ensure that the room in which Solvent-Based Marijuana Concentrate is produced contains an emergency eye-wash station. 4. Ensure that a professional grade, closed-loop extraction system capable of recovering the solvent is used to produce Solvent-Based Marijuana Concentrate. 5. Ensure that all solvents used are food-grade or at least 99% pure 6. Must have SDS for each solvent used or stored on site. 7. Must have receipts for all purchases of solvents used or stored on site. 8. Ensure that all Flammable Solvents or other flammable materials, chemicals and waste are stored in accordance with all applicable laws, rules and regulations. Cannot have more on site than allowed by CIH or PE. 9. Ensure that the appropriate safety and sanitary equipment, including PPE, is provided to, and appropriately used by Each staff member engaged in the production of a Solvent-Based Marijuana Concentrate 9. Ensure that a trained Owner or Occupational Licensee is present at all times during the production of a Solvent-Based Marijuana Concentrate whenever an extraction process requires the use of pressurized equipment.

78 © iComply, LLC 2019 V.05.22.19..01

Ethanol or Isopropanol: A Retail / Medical MIP need not use a professional grade, closed-loop system extraction system capable of recovering the solvent for the production of a Solvent- Based Concentrate if ethanol or isopropanol are the only solvents being used in the production process. Ethanol or isopropanol must be at least 99% food grade.

Flammable Solvent Determinations: If a Flammable Solvent (flash point of 100F) is to be used, then the CIH or PE must: 1. Establish a maximum amount of Flammable Solvents and other flammable materials that may be stored on the premises. 2. Determine what type of electrical equipment, which may include but need not be limited to outlets, lights, junction boxes, must be installed within the room in which Concentrate is to be produced or Flammable Solvents are to be stored in. 3. Determine whether a gas monitoring system and fire suppression system must be installed within the room in which Concentrate is to be produced or Flammable Solvents are to be stored, and if required the system’s specifications, in accordance with applicable laws, rules and regulations.

CO2 Solvent Determination: If C02 is used as a solvent, then the CIH or PE must determine whether a CO2 gas monitoring system must be installed within the room in which Concentrate is to be produced or CO2 is stored. The CIH or PE must determine whether a fume vent hood or exhaust system must be installed within the room in which Concentrate is produced.

Material Change: If a MIP makes a Material Change to its Licensed Premises, equipment or a production procedure, it must obtain a report from a CIH or PE re-certifying its extraction SOPs and, if changed, its Licensed Premises and equipment as well.

Manufacturer’s Instructions: The CIH or PE may review and consider any information provided to the Retail / Medical MIP by the designer or manufacturer of any equipment used in the extraction process.

79 © iComply, LLC 2019 V.05.22.19..01

UL or ETL Listing: If the extraction system is UL or ETL listed, then a Retail / Medical MIP may use the system in accordance with the manufacturer’s instructions. If the system is UL or ETL listed but the Medical Marijuana-Infused Products Manufacturer intends to use a solvent in the system that is not listed in the manufacturer’s instructions for use in the system, then, prior to using the unlisted solvent within the system, the MIP must obtain written approval for use of the non-listed solvent in the system from either the system’s manufacturer or a PE after the PE has conducted a peer review of the system. If the system is not UL or ETL listed, then there must a designer of record. If the designer of record is not a PE, then the system must be peer reviewed by a PE. In reviewing the system, the PE must review and consider any information provided by the system’s designer or manufacturer. If any piece of equipment used in the process not UL or ETL listed it must be certified by a Certified Industrial Hygienist or Physical Engineer that is safe for use in its newly prescribed manner prior to operation. The premises and SOPs must also be certified by a PE or CIH that is meets all code requirement relevant to the intended processes prior to operation.

80 © iComply, LLC 2019 V.05.22.19..01

Infused Product and Concentrate Contract Manufacturing

Retail / Medical MIPs are allowed to contract with other licensed facilities to process trim, flower, or other byproduct into concentrates and/or infused products without limit. For a MMC, this does not count against their 50/50 TOHI limitations (until rule is repealed). In order to contract manufacture for another licensed entity, a MIP must: 1. Follow due diligence and rules pertaining to wholesale transactions and transportation. 2. Sign contracts with the client outlining provisions of the manufacturing agreement. 3. Contracts need to be current and available for inspection on the Licensed Premises by the MED 4. Maintain independent records for each contract for intake of product, storage protocols, production, and transportation logs Each contract should outline the percentage of contracted product the MMC or Store will receive in return as well as the cost for the service of infusion or extraction. MIPs are allowed to retain a certain percentage of the manufactured product for their own inventory to be made available for wholesale to other licensed entities.

The biggest consideration for MIPs engaged in receiving input material such as trim, flower, or concentrate from outside facilities is ensuring the data integrity from the other licensee is intact. This means ensuring your MIP receives the proper, complete, and accurate: - Packaging of received material - Shipping container labeling - List of non-organic chemicals used in the cultivation of the originating material - Originating Harvest and Production batch numbers - Transport manifest: delivered in time, designated by person & vehicle designated, and signed Any input material received that does not have this information can cause serious delays in the production process and expose your MIP to the risk of a violation. Best practice is to outline all the requirements for data integrity with clients before ordering material and to reject any non-compliant packaging and labeling received. Proper restaurant-grade equipment, personal protective equipment, and regularly adhered-to cleaning schedules are necessary for all extractions and infused product manufacturing.

81 © iComply, LLC 2019 V.05.22.19..01

MIP Health & Safety

When it comes to the safety of the public, the MED has put in place specific regulations around the production of marijuana food products. This includes refrigeration, restaurant grade equipment and surfaces, cleanliness, edibles serving size standards, and personal protective equipment. Beyond edibles, all MIP facilities must follow regulations for the health and safety of the public.

Edible Production - Product Safety: A Retail / Medical MIP that produces edibles must: 1. Ensure that all products are produced according to SOPs of Record. 2. Ensure that no single serving size contains more than 10mg of THC ( Retail) 3. Ensure that the mg of THC in the single serving and total amount of product are in the SOP. 4. Ensure that each “single serving” of a multiple serving edible is physically de-marked in a way that makes it easy to determine, and separate, a single serving. If an edible is the type that is impractical to de-mark then the product must contain no more than 10mg of THC per unit. (Retail only) 5. Provide adequate refrigeration for perishable Product that will be consumed and utilize adequate storage facilities and transport methods. 6. Ensure that manufacturing processes are designed so that the cannabinoid content of any Edible Marijuana Product is homogenous. MIPs that manufacture edible Marijuana Product must comply with all kitchen- related health and safety standards of the relevant local jurisdiction and, when applicable, with all health regulations that pertain to retail food establishments. All equipment, surfaces, and protocols should conform to restaurant/food safety standards and must be cleaned after every production batch. MIPs are required to have Safety Data Sheets (SDS) and labels for each chemical (whether cleaning, solvent, nutrient or pesticide/fungicide) on site. If the SDS calls out for a particular piece of Personal Protective Equipment (PPE) then the MIP must have the PPE on site and make it easily accessible to staff members. Common PPE includes gloves, eye protection, respirators (with appropriate filters), and eye wash stations are required to be in extraction rooms for solvent- based extractions. If a chemical is on site and the associated PPE called out for on the SDS is absent Licensee could be found in violation of OSHA, as well as other authorities.

82 © iComply, LLC 2019 V.05.22.19..01

Samples and Test Batches

Testing is required for both potency and contamination before final packaging for Grows and MIPs.

Sample Collection: All Samples submitted for testing must be collected in line with the Division’s sampling policy and minimum amounts. Effective January 1, 2019, medical and retail cultivations and MIPs may participate in the transfer of “Sampling Units” to a designated “Sampling Manager” so long as rules are followed to account for Sampling. However, it should be noted that samples taken for Test batches are not subject to the same/specific requirements that Sampling Units for transfer to a Sampling Manager are.

Division Sampler Selection: The Division normally permits a Marijuana Establishment to select a Sample. However, the Division may elect, at its sole direction, to assign personnel to collect a Sample.

Sample Selection: A Marijuana Establishment cannot try to influence the Samples selected by Division personnel when such personnel are assigned by the MED.

Samples for Test Batches of Marijuana and Marijuana Concentrate: Each Test Batch of Marijuana or Marijuana Concentrate must be comprised of a representative selection of Samples. Exemptions-Marijuana Concentrate: - A Production Batch of Marijuana Concentrate shall be considered exempt from contaminant testing if the MIP that produced it does not wholesale or transfer any of portion of the Production Batch and uses the entire Production Batch to manufacture Marijuana Product, except for solvent-based Retail Concentrate produced using butane, propane, ethanol, isopropanol, acetone or heptane which should still be submitted for a residual solvent contaminant test.

83 © iComply, LLC 2019 V.05.22.19..01

Flower and Trim Harvest Batch samples for Testing Batches: - Harvest batch: Same strain, same nutrient/pesticide regiment, same grow cycles - Use one package tag to combine harvest batches into one batch for testing – using guide below - Keep RFID plant tags throughout processing to track

Minimum Number of Samples: At a minimum, each Test Batch of Marijuana Harvest Batches at the Cultivation must be comprised of at least the following number of separately taken 0.5g Samples: Comprised of Harvest Batch Test Batch Weight Number of Samples (0.5g) per Test Batch 0 < 10 lbs 8

10 lbs < 20 lbs 12

20 lbs < 30 lbs 15

30 lbs < 40 lbs 18

40 lbs < 100 lbs 23

100 lbs > 29

Concentrate Production Batch samples for Testing Batches: - Production batch: Same concentrate, made from same input (harvest batches) - Use one package tag to combine production batch for testing – using guide below:

Minimum Number of Samples: At a minimum, each Test Batch of Concentrate Production Batches at the MIP must be comprised of at least the following number of separately taken 0.5gr Samples:

Comprised of Production Batches Test Batch Weight Number of Samples (0.5g) per Test Batch 0 < 1 lb 8 1 lbs < 2 lbs 12 2 lbs < 3 lbs 15 3 lbs < 4 lbs 18 4 lbs < 10 lbs 23 10 lbs > 29

84 © iComply, LLC 2019 V.05.22.19..01

Infused-Product Production Batch samples for Testing Batches: - Batch: Same infused-product, made from same input(s) (production batch(es) - Use one package tag to combine production batch for testing – using guide below:

Minimum Number of Samples: Each Test Batch of Infused-Product Production Batches at the MIP must be comprised of at least the following number of separately taken per unit Samples: Comprised of MIP Production Batch Test Batch Weight Number of Samples per Test Batch 0 < 100 Units 2 100 < 500 Units 4 500 < 1,000 Units 6 1,000 < 5,000 Units 8 5,000 <10,000 Units 10 10,000 Units > 12

85 © iComply, LLC 2019 V.05.22.19..01

Contaminant Testing

Tests for microbes, mold, filth, chemicals, pesticides, solvents are required to ensure safe products are approved for consumers prior to manufacturing, wholesale or transfer. Contaminant testing drives labeling as to whether a harvest batch, concentrate, or infused product (including sampling units, alt use and audited product) is safe for consumption. The MED can require tests (chemical, metal, etc) beyond these rules at any time. *Beginning, August 1, 2018, mandatory pesticide testing for all medical and retail marijuana for all Harvest Batches created on or after August 1, 2018. Medical and Retail Marijuana that are part of Harvest Batches created prior to August 1, 2018 are not subject to pesticide testing requirements. Pre August 1, 2018 Harvest Batched may be submitted for mandatory pesticide testing of flower and trim prior to August 1, 2018 if working towards achieving process validation. Required Contamination Tests: 1. Microbials: Applies to Harvest Batches. Water, heat/pressure, or food-based concentrates, or Audited Products. a. Tests for Salmonella, e-coli, and total yeast and mold, total aerobic microbial count, staphylococcus aureus, pseudomonas aeruginosa, bile tolerant gram negative bacteria, and candida albicans. 2. Pesticides: Applies to Harvest Batches. a. Tests for Pesticides listed in the rules. R/M 712(E)(5) 3. Residual Solvents: Production Batches of Solvent-Based Concentrate, and any Audited Products with solvent-based concentrate. a. Tests for acetone, butane, ethanol, heptane’s, isopropyl alcohol, propane, benzene, toluene, pentane, hexane, and total xylenes i. Solvent-based concentrate exceeding acceptable limit for ethanol may only be used in concentrate of infused-product with the intended use of oral consumption, skin and body products, or audited product (info repeated below residual solvent table below) 4. Mycotoxins: Only applies to solvent-based concentrate being remediated from a previous batch’s microbial failure. a. Tests for aflatoxins (B1, B2, G1, G2) and ochratoxin. 5. Metals: Applies to Harvest batches, water-, food-, heat/pressure- and solvent-based concentrates, and marijuana products, including audited products (allowable limits dependent on intended use) a. Tests for arsenic, cadmium, lead and mercury i. Applies to test batch (if metals considered to be in toxic amounts found, batch is contaminated)

86 © iComply, LLC 2019 V.05.22.19..01

Contaminant Testing Process Validation

After proving consistency in having contaminant-free harvest and production batch test results, through process validation, cultivations and manufacturers can test harvest and production batches less often; thereby incentivizing consistent and clean operations and procedures.

Validating Processes – Harvest Batch - Cultivation processes are deemed validated if every harvest batch produced during at least a six (6) week period, but not longer than twelve (12) weeks, passes all testing. - Cultivations may obtain process validation for all contaminants at the same time of separately for each contaminant. - Must include at least six (6) test batches which must pass contaminant testing.

Validating Processes – Production Batch Concentrate or Marijuana-Infused Products Manufacturer’s production process regarding contaminants are deemed valid if: - Every Production Batch produced during at least a four (4) week period but no longer than an eight (8) week period pass all contaminant tests - Must include Test Batches from at least four (4) Production Batches which must pass contaminant testing. Once validated, validation for each contaminant listed will remains effective for one year from the date of the last passing test required to complete process validation requirements and must be renewed annually.

Maintaining Process Validation for Contaminant Tests – Harvest and Production Batches Ongoingly, to maintain process validation, grows and MIPs must: - Once every 30 days, submit a harvest or production batch for all contaminant testing. - If no harvest or production within 30 days, must submit next readily available Batch. - Must pass to maintain validation, if failure occurs, must follow failure rules below.

87 © iComply, LLC 2019 V.05.22.19..01

Required Re-Validation for Contaminant Testing

Material Change Re-validation: Any change that requires a substantive revision to a Marijuana Establishment’s SOP for the cultivation of Marijuana or the production of a Marijuana Concentrate or Marijuana Product. This includes changes to equipment, cultivation processes, pesticides, production processes, solvents, recipes, testing, or storage procedures. If a cultivation or MIP makes a Material Change to its cultivation or production process, then it must have the first five (5) Harvest or Production Batches produced using the new SOP tested for all of the contaminants required, regardless of whether its process has been previously validated. If any of those tests fail, then the Establishment’s process must be re-validated.

Pesticides and Solvents: It is considered a Material Change if a cultivation begins using a new or different Pesticide during its cultivation process. It is considered a Material Change if a MIP begins using a new or different solvent or combination of solvents.

Notification: A cultivation or a manufacturer that makes a Material Change must notify the testing facility that conducts contaminant testing to restart testing on the first five (5) Harvest or Production Batches produced using the new SOP. Material Changes may also prompt updating SOPs, SDS sheets and labels, Employee Training Manuals, and employee handbooks or other documents.

Testing Required Prior to Wholesale, Transfer or Processing: When a Harvest Batch sample or Production Batch sample is required to be submitted for testing pursuant to this rule (regardless of whether its process has been validated and without notice), the Marijuana Establishment that produced it may NOT wholesale, transfer or process into a Marijuana Concentrate or Marijuana Product any of the Marijuana, Marijuana Concentrate, or Marijuana Product from that Harvest Batch or Production Batch.

Failed Contaminant Testing Re-Validation: Any failed contamination batches may be considered a violation by the MED. In all cases, the batch from which the failed sample came from must be quarantined and cannot be sold or transferred. To maintain validation, If a Sample fails contaminant testing, the Grow or MIP must: 1. Internally Quarantine the Batch. 2. Submit three (3) additional Test Batches within 30 days to maintain validation. 3. If any of the three new batches fail, the MIP or Grow must re-validate their entire process.

88 © iComply, LLC 2019 V.05.22.19..01

Failed Contaminant Tests: The Grow or MIP may do the following with the package, Harvest Batch, or Production Batch from which the failed Sample was taken: (all contaminant testing except microbial testing of retail marijuana flower or trim and pesticide testing) 1. Destroy and document the destruction of the entire portion of the package, Harvest, or Production Batch that it possesses. 2. Decontaminate package, harvest batch or production batch and create two new test batches (each with the required number of samples) and retest for required contaminant test that failed and: 3. Facility can either: (1) submit new test batches to same testing facility, or (2) submit new test batched to two different testing facilities 4. If a package, Production Batch, or Harvest Batch fails for microbials, the Grow may transfer the packages or Harvest batch associated with the failed sample to a MIP for decontamination/Remediation. a. Remediation of failed microbial harvest batches may be done by MIPs through solvent- based extraction and must undergo all testing for concentrates. b. Decontamination may be attempted via UV light, Infrared, or other technology by a different marijuana business than the one who failed the microbial test. 5. Grows or MIPs may attempt corrective (decontamination) measures, if possible, and create two (2) new Test Batches (each with the required number of samples) and retest for required contaminant test that failed: a. Facility can either: (1) submit new test batches to same testing facility, or (2) submit new test batched to two different testing facilities b. If both new Test Batches pass the contaminant test(s), then the batch of Marijuana may be transferred or processed in to Concentrate, or Infused Product and may be sold, wholesaled or transferred. c. If one of the two Test Batches fail contamination testing, then the Marijuana Grow or MIP must destroy and document the destruction of the entire Harvest or Production Batch from which the failed Sample was taken.

Product may be quarantined and/or destroyed if it fails contaminant testing and regulators may conduct and health and safety audit if you are believed to be a source of contamination or reports of adverse events have been reported.

Failure to comply with testing rules may constitute a License Violation Affecting Public Safety!

89 © iComply, LLC 2019 V.05.22.19..01

Marijuana Testing Facilities Effective in 2019, suspicion of a threat to public health and safety in accordance to testing authorizes the MED to mandate an Independent Third-Party Review of product and/or the Quarantine of product. Marijuana product ingredients including marijuana and other ingredients generally recognized or regulated by the U.S. FDA shall not constitute grounds to require independent third- party review. Each MTF must have appropriate certification to test for metals (for contaminant testing) and mycotoxin (for pesticide testing), as well as ISO/IEC 17025:2005 accreditation.

The following are levels at which the MED considers a product, concentrate, or harvest batch to pass or fail contaminant testing:

Microbials (Bacteria, Fungus)

Substance Acceptable Limits Per Gram Product to be Tested

Shiga-toxin producing Escherichia < 1 Colony Forming Unit (CFU) Flower; retail marijuana products coli (STEC)*- bacteria (other than Audited Product); water- and Salmonella species – bacteria < 1 CFU food- based concentrates, and heat/pressure-based concentrate < 10^4 CFU Audited Product (nasal spray, inhaler, or Total Yeast and Mold <10^1 cfu/ml or <10^1 cfu/g vaginal administration) <<10^2 cfu/ml or<10^2 cfu/g Audited Product: (rectal administration) Audited Product (nasal spray, inhaler, or <10^2 cfu/ml or <10^2 cfu/g Total aerobic microbial count vaginal administration) <10^3 cfu/ml or 10^3 cfu/g Audited Product: (rectal administration) Audited Product (nasal spray, inhaler, or Staphylococcus Aureus Absent in 1 ml or 1 g vaginal administration) Audited Product (nasal spray, inhaler, or Pseudomonas aeruginosa Absent in 1 ml or 1 g vaginal administration) Bile tolerant gram negative bacteria Absent in 1 ml or 1 g Audited Product (nasal spray, inhaler) Candida albicans Absent in 1 ml or 1 g Audited Product (vaginal administration) *Testing facilities should contact the Colorado Department of Public Health and Environment when STEC and Salmonella are detected beyond the acceptable limits.

90 © iComply, LLC 2019 V.05.22.19..01

Mycotoxins

Substance Acceptable Limits Per Gram Product to be Tested

Aflatoxins (B1, B2, G1, and G2) < 20 PPB (total of B1 + B2 + G1 = G2) Solvent-Based Concentrate from flower or trim that failed microbial Ochrotoxin A < 20 PPB testing *Testing facilities should contact the Colorado Department of Public Health and Environment when STEC and Salmonella are detected beyond the acceptable limits.

Residual Solvents

Substance Acceptable Limits Per Gram Product to be Tested

Acetones < 1,000 PPM Butanes < 1,000 PPM Ethanol**** < 1,000 PPM

Heptanes < 1,000 PPM Isopropyl Alcohol < 1,000 PPM

Propane < 1,000 PPM Solvent-Based Benzene** < 2 PPM Concentrate Toluene** < 180 PPM Pentane < 1,000 PPM

Hexane** < 60 PPM Total Xylenes (m,p, o-xylenes)** < 430 PPM Non-Permitted Solvents None Detected **While these substances are not permitted solvents, the MED recognizes that they might be present, as impurities in current permitted solvent supplies. ***Solvent-based concentrate exceeding acceptable limit for ethanol may only be used in concentrate of infused-product with the intended use of oral consumption, skin and body products, or audited product

91 © iComply, LLC 2019 V.05.22.19..01

Metals

Acceptable Max Limits Per Gram Substance (based on intended use inhaled or Product to be Tested audited product) Inhaled - nasal spray or inhaler: Arsenic, Lead < 0.5 PPM Cadmium, Arsenic < 0.2 PPM Lead, Cadmium < 0.2 PPM and Mercury Mercury < 0.1 PPM Topical and/or Transdermal: Arsenic, Lead < 10 PPM Cadmium, Flower; Infused-Product; Water-, Food-, Arsenic < 3 PPM Lead, Heat/Pressure-Based, and Solvent-Based Cadmium < 3 PPM and Mercury Concentrate; Marijuana Product Mercury < 1 PPM Oral consumption or Audited Product Arsenic, - rectal or vaginal administration: Cadmium, Lead < 1 PPM Lead, Arsenic < 1.5 PPM and Mercury Cadmium < 0.5 PPM Mercury < 1.5 PPM

Pesticides

Substance Detection Limits Product to be Tested

Abamectin (Avermectins: B1a & B1b) < 0.07 PPM Azoxystrobin < 0.02 PPM Bifenazate < 0.02 PPM

Etoxazole < 0.01 PPM Imazalil < 0.04 PPM

Imidacloprid < 0.02 PPM Malathion < 0.05 PPM Marijuana flower and trim Myclobutanil < 0.04 PPM Permethrin (mix of isomers) < 0.04 PPM Spinosad (mix of A and D) < 0.06 PPM Spiromesifen < 0.03 PPM Spirotetramat < 0.02 PPM Tebuconazole < 0.01 PPM

92 © iComply, LLC 2019 V.05.22.19..01

Other Contaminants

Substance Acceptable Limits per gram Pesticides If testing identifies the use of a banned pesticide or improper application of a permitted pesticide, then that test batch shall be considered to have failed contaminant testing.

Chemicals If test batch is found to contain levels of any chemical that could be toxic if consumed, then the Division may determine that the test batch has failed contaminant testing. Microbials If test batch is found to contain levels of any microbial that could be toxic if consumed, then the Division may determine that the Test Batch has failed contaminant testing. Molds, Mildew, If a test batch is found to contain levels of any mold, mildew, or filth that could be toxic if consumed, and Filth then that test batch shall be considered to have failed contaminant testing.

Metals If the Test Batch is found to contain levels of any metals that could be toxic if consumed or present, then the MED may determine that the Test Batch has failed contaminant testing.

93 © iComply, LLC 2019 V.05.22.19..01

Potency Testing

Both potency and contaminant testing drive labeling requirements for shipping containers of product for wholesale or transfer and displayed on products eventually sold to consumers. Both help create a chain of traceability and accountability between seed to sale cultivators, manufacturers, and retailers and independent testing laboratories.

Required Tests: Potency tests conducted on Marijuana (including Kief), Concentrates, or Marijuana- Infused Products determine the level of concentration of the required cannabinoids (THC, THCA, CBD, CBDA, CBN) and whether or not THC is homogeneously distributed throughout the product.

Partially Infused Retail Marijuana Products: If only a portion of a Marijuana Product is infused with Marijuana, then the MIP must inform the Testing Facility of exactly which portions of the Product are infused and which portions are not infused.

For Cultivation Potency Testing process validation - Grows must have potency tests conducted by a Testing Facility on four Harvest Batches, created a minimum of one week apart, for each strain of Marijuana that it cultivates. For new strains this must happen within 6 months of cultivating. - The first potency test must be conducted on each strain before wholesaling, processing, or transferring that strain. - After the initial four (4) potency tests, a Cultivation must potency test each strain of Marijuana it cultivates at least once per quarter [every three (3) months].

NO POTENCY PROCESS VALIDATION EXISTS FOR CONCENTRATES OR KIEF. Every Harvest batch of marijuana concentrate must be tested for potency every time.

Edibles and Infused Product Process Validation for Potency and Homogeneity Applies to any Edible Containing 100 Milligrams or Less of THC or on any infused-product. - So long as the Medical Edible contains 100 milligrams or less of THC. - Deemed valid for a Production Batch for a particular type of Edible or infused-product produced during at least a four-week period but no longer than an eight-week period. - This must include at least four Test Batches that contain Samples from entirely different Production Batches. Also applies for potency and homogeneity of non-edible infused products - regardless of the potency of the product. Process validation is good for one year and then must be re-validated yearly and records of all test results and validations must be kept internally.

94 © iComply, LLC 2019 V.05.22.19..01

Maintaining Validated Processes A MIP process is deemed valid regarding potency and homogeneity if: - At least once per quarter, one Production Batch of each type of Marijuana Product is submitted and passes potency and homogeneity testing. - If no production batch for a product type is done within the quarter, the next available batch must be submitted for that product type.

Required Re-Validation – POTENCY AND HOMOGENEITY

Material Change Re-validation: Any change that requires a substantive revision to a MIP’s SOP for the production of a Marijuana- Infused Product. This includes changes to equipment, production processes, solvents, recipes, testing, or storage procedures. Material Changes may also prompt updating SOPs, MSDS sheets and labels, Employee Training Manuals, and employee handbooks or other documents.

If a MIP makes a Material Change to its production process for a particular product type, then it must have the next three (3) Production Batches for that product produced using the new SOP tested for potency and homogeneity. If any of those tests fail, then the MIP’s process must be re-validated.

New Equipment: It is considered a Material Change if a MIP begins using a new or different Equipment for any material part of the production process.

Notification: A manufacturer that makes a Material Change must notify the testing facility to restart potency and homogeneity testing on the first three (3) Production Batches produced using the new SOP.

Testing Required Prior to Wholesale, Transfer or Processing: When a Production Batch is required to be submitted for Potency and Homogeneity testing you may NOT wholesale or transfer until it obtains a passing test.

95 © iComply, LLC 2019 V.05.22.19..01

Failed Potency and Homogeneity Tests: Any failed Potency or Homogeneity testing batches may be considered a violation by the MED. In all cases, the batch from which the failed sample came from must be quarantined and cannot be sold or transferred.

The MIP may do the following with the package or Production Batch from which the failed Sample was taken:

1. Destroy and document the destruction of the entire portion of the package or Batch. 2. Attempt corrective measures and send to 2 new testing facilities to re-test for the failure. a. If both pass, ok to sell. b. If one fails, must destroy entire batch.

Cannabinoid Profile: Must be reported by listing a single percentage concentration for each cannabinoid that represents an average of all samples within the test batch (THC, THCA, CBD, CBDA, CBN). Edibles are tested for active THC in milligrams.

Failed Potency Tests: - If an individually packaged Edible Retail Marijuana Product contained within a Test Batch is determined to have more than 100 mgs of THC within it, then the test batch shall be considered to have failed potency testing. - If the THC content of a MIP is determined through testing to not be homogenous, then it shall be considered to have failed potency testing. - A Marijuana Product Infused-Product is considered to not be homogenous if 10% of the infused portion of the Marijuana Product contains more than 20% of the total THC contained within entire Marijuana Product. - The MED allows for a plus/minus Variance on potency testing pass or failure.

96 © iComply, LLC 2019 V.05.22.19..01

Sampling Units and Sampling Managers

New in 2019, and not to be confused with Testing Sampling, Sampling Units are designated quantities of samples that a cultivation or MIP may release from METRC via designated Sampling Managers as long as the qualified licensed facility complies with the following:

Sampling Units Units of marijuana or marijuana product that are designated for transfer to an authorized Sampling Manager, always tracked and accounted for in METRC Sampling Manager A designated associated key or key badged employee who may receive Sampling Units transfer from a grow or MIP (never from stores/centers), always tracked and accounted for in METRC

- All Sampling Managers must be properly designated in METRC prior to any transfer of Sampling Units - Only Associated Key and Key occupational licenses, or associated key and key badged, employees may qualify for Sample Unit transfers – NO SUPPORT SM’s. - Only cultivation and manufacturing facilities may participate in SU and SM transfers, store and centers may not transfer SUs to any employees - No more than five SMs may be permitted at a facility in any calendar month - SM’s must consent to their personal identification and subsequent tracking and reporting associated with SU transfers - All SMs must be provided with SOPs which address SUs in accordance with the rules and regulations for topics such as SM personal possession limits, qualified SMs and valid MMR cards, inventory tracking, and permitted and prohibited actions: - SUs may not be consumed on premises - SUs should never serve as source of compensation for SMs - SMs may be designated in multiple METRC accounts - SMs may not transfer any SU to any individual including another SM - Copies of documents for designated SU quality control, product development and SOPs must be maintained for SMs - Sample units are subject to the following inventory tracking requirements: - Each SU should be consistently and accurately accounted for in METRC - Each SU should reflect the date of transfer, weight of unit, name and license number of the receiving SM - Each SU should accurately reflect an appropriate reconciliation in METRC for all transfers of SUs to SMs

97 © iComply, LLC 2019 V.05.22.19..01

- Specific SU limits apply per product type as follows: - Only one SU permitted per production batch and any designated SU must satisfy applicable testing requirements prior to designation as SU for transfer - Medical SU limit: - SU of marijuana should not exceed one gram, and - SU of marijuana concentrate should not exceed one-quarter of a gram; except for concentrate intended for vaporization that should not exceed one-half of a gram - Retail SU limit: - SU of marijuana product should not exceed one standardized serving size of 10mg of active THC, and - SU of marijuana concentrate should not exceed one-quarter of a gram; except for concentrate intended for vaporization that should not exceed one-half of a gram - Transfers of sampling units are subject to the following restrictions: - All SUs must comply with packaging and labeling requirements from 1001-1 series rules - SU may be transferred to SM designated appropriately in METRC for the calendar month that the SU transfer occurs in - In any calendar month, manufacturing and cultivations facilities should check with SM’s to ensure the individual won’t receive SUs that result in amounts that exceed monthly limits for SM - Retail SM monthly SU limit: - 14 standardized servings of marijuana product, or - 8 grams of retail marijuana concentrate for retail facility SM’s - Medical SM monthly limit: - 15 grams of medical marijuana concentrate, or - One ounce of marijuana

98 © iComply, LLC 2019 V.05.22.19..01

Wholesale and Transfer

OPCO and RMCF Transfers Prior to January 1, 2019, to move product out of the cultivation facility, it must be either wholesaled to another facility or transferred internally to a commonly owned Facility. Beginning July 1, 2019, all 50/50 rules for MMC’s are effectively repealed! Effective July 1, 2019, OPCO and RMCF licenses may apply for a Centralized Distribution Permit, or a CDP, to authorize transfer and temporary storage of marijuana concentrates and infused products from MMIPM or RMPMF licenses, for no more than 90 days, for the sole purpose of temporary storage then product transfer commonly owned MMC or RMS license(s). To apply, OPCO or RMCF licenses seeking a CDP may submit either an addendum, a new application, or a separate addendum prior to license renewal, and copies of all application documents must be sent to each applicable local jurisdiction. Additionally, upcoming sampling manager and unit allowances enable cultivation and production participation in the transfer of sampling units to sampling managers if all requirements are met. Each cultivation license should consider the following information for wholesales and transfers: - Medical or retail cultivations may transfer marijuana and water-based medical concentrate to other licensed cultivators, manufacturers, a stores or centers, testing facilities, distribution centers, research facilities, pesticide manufacturers, Sampling Managers, etc. - Medical or retail cultivations shall accurately track and transfer fibrous waste to an IFPP - Packaging and labeling requirements for transfer of marijuana product may vary with product type and reason for transfer - Marijuana product may only be sold during the jurisdiction specific, legal operating hours regardless of whether it is a sale to a patient or a permitted wholesale transaction between licensed facilities.

ADD GRAPHIC HERE!**

MMIPM and RMPMF Transfers

- Medical or retail marijuana infused product manufacturers may transfer marijuana product to other licensed cultivators, manufacturers, a stores or centers, testing facilities, distribution centers, research facilities, pesticide manufacturers, Sampling Managers, etc. - Medical or retail manufacturers may transfer Fibrous waste to an Industrial Fibrous Product Producer

99 © iComply, LLC 2019 V.05.22.19..01

MMC and RMS Transfers - Medical and retail stores and centers may receive transfers of marijuana product from cultivations, manufacturers, and other stores or centers - Stores and centers should never participate in transferring marijuana product with testing facilities, distribution centers, research facilities, pesticide manufacturers, or Sampling Managers.

Marijuana Business and Establishment Operators and Transfers Medical Marijuana Business Operators and Retail Marijuana Establishment Operators are entities that are licensed by the MED to provide professional services to other businesses or establishments (other than medical marijuana licensed research businesses). An operator’s contract with other businesses or establishments does not constitute ownership in any way. - A Marijuana Research Facility (MRF) is involved with marijuana through research, but is not considered a licensed marijuana establishment or business - A Marijuana Testing Facility (MTF) is licensed and certified by the MED to perform testing and research, and is also subject to inventory tracking rules for marijuana testing. A MTF shall not be involved in any transfer of marijuana except solely to receive marijuana transfers solely for purposes of testing and must destroy all samples after testing. - A Pesticide Manufacturer (PM) is not a licensed marijuana business or establishment, but is specifically licensed by the U.S. EPA to conduct research on pesticide use on marijuana. - A Industrial Fiber Products Producer (IFPP) is not a licensed marijuana establishment or business but may participate in receiving transfers of fibrous waste from licensed marijuana cultivation and production facilities.

100 © iComply, LLC 2019 V.05.22.19..01

Use the graphic below to understand how and why transfers between different licensed businesses or establishments and operators. *denotes transfers that will be allowed beginning July 1, 2019

MTF, MPM, MRF or LRB, IFPP, and *SM

OPCO or MMIPM or RMCF *w/ CDP RMPMF

MMC or RMS

Patient or Customer

101 © iComply, LLC 2019 V.05.22.19..01

General Requirements for Transport Between Licenses After final packaging and labeling, product is ready for transportation to the destination entity. It is the responsibility of any receiving entity to validate labels and ensure packaging integrity upon product arrival. It is required to transport (Retail & Medical) marijuana / marijuana vegetative plants or marijuana product in a way that is both secure and discreet (i.e. in the vehicle/trunk).

After packaging and labeling shipping container(s) - Log associated batch numbers/RFID tags - Ship within 7 days of Final Packaging - Required for Transporters, best practice.

Fill out and print transport manifest from METRC - Manifests include origin and destination, driver, product, and vehicle information - Cannot Transport Product if METRC is down

Transport all marijuana and marijuana product securely and discreetly by a Badged Individual - Do not deviate from route - Do not open product during transit

Recipients must weigh and log into METRC immediately upon receipt

102 © iComply, LLC 2019 V.05.22.19..01

Licensed Marijuana Transporter In 2017 House Bill 16-1211 introduced mandatory transporter licenses to handle the temporary storage and/or transport of marijuana, marijuana concentrate and marijuana infused product between licensed marijuana businesses or establishments. Marijuana transporters handle transfers of marijuana between all marijuana establishments or businesses and, by default are involved with a large a variety of licenses, operations, and of course, ever-changing marijuana regulations. As a result of the scope of client base that marijuana transporters deal with, diligence is key to maintain compliance and protect their license from potential violations. For example, transporters may transfer marijuana back and forth between cultivation and production licenses as a result of the nature of the business and relationship of the license types. However, factors such as whether or not the licenses participating in transfers maintain compliance with the regulations, even something as simple as double checking that a medical business is not attempting to transfer marijuana between a retail establishment, and vice versa. Additionally, it’s important to note that transporters are restricted further by regulations when acting as a licensed marijuana transporter. Transporters may not transfer (buy, sell, give away, etc.) marijuana product in any way, and failure to comply with transporter license regulations may result in serious administrative action and potential license violations. Transporters should be very cautious to check the fine details of their operation to ensure the transfers they are responsible for would stand up to potential investigation by the MED. For example, transporters may not participate in transporting marijuana back and forth between a center or store and a pesticide manufacturer license type. Although both facilities operate as a licensed marijuana business or establishment, the nature of each license’s type of operation would render any transfer of marijuana between a center or a store and a pesticide manufacturer to be non-compliant. NOTE: Always remember, just because you can do something in METRC, does not mean the action is compliance. METRC is purely for inventory tracking, and does not have any sort of safe guards against non-compliant actions taken by, or between, marijuana businesses or establishments.

103 © iComply, LLC 2019 V.05.22.19..01

Centralized Distribution Permits

Effective January 1, 2019, the MED may grant cultivations a Centralized Distribution Permit which allows for temporary storage of medicated recreational and medical products at an approved centralized storage or distribution location. Upon permit approval, products may be stored at a recreational or medical cultivation facility for future transfer to a commonly-owned medical marijuana center or retail marijuana store for no longer than 90 days, and as long as the products satisfy all packaging and labeling requirements before leaving the MIP facility of origin.

Transport of Marijuana, Seeds, Immature Plants, Concentrate, and Marijuana-Infused Product - Only Occupational Badge holders, with valid DL, may transport MJ - Must be in physical possession of accurate METRC generated transport Manifest - Can transport to multiple destinations as long as the destinations are listed on Manifest - Has to transport in registered motor vehicle (no bicycles, longboards or UAV) - Driver has to respect all rules of the road - If Infused products are perishable or require refrigeration, must transport as such

Transport of (Retail & Medical) Marijuana Vegetative Plants - Marijuana vegetative plants can only be transported between Licensed Premises. and they cannot be transported to an off-premises storage facility

Operators must transport product between the following hours: - Time of departure cannot be prior to the Center/Store opening time allowed by a local authority. Product must be delivered prior to Store closing time per local authority. - Local Jurisdictions may further restrict these hours so know your own and your destinations’ jurisdictions’ hours of operation. Know before you go.

Required records to be kept include: - Batch Testing Results - Inventory Tracking Logs/METRC - Infused Contracting Agreement(s) - Completed Transport Manifest(s) - License copies of receiving and shipping entities with invoices/purchase orders

104 © iComply, LLC 2019 V.05.22.19..01

Transfer of Fibrous Waste

Effective January 1, 2019, RMCF, OPCO, RMPMF and MMIPM facilities may designate Fibrous waste for transfer to an approved/contracted Industrial Fiber Products Producer. Here is a little more information the transfer of fibrous waste from licensed cultivations and infused product facilities: - Fibrous waste can be identified as any roots, stalks, and stems from a marijuana plant. - Fibrous waste must be stored and managed in accordance with all applicable state and local statutes, regulations, ordinances, or other requirements (i.e. transfers, books and records, security measures, inventory tracking) - Fibrous waste is not considered in the same way that marijuana waste is, so it need not be unusable or unrecognizable when leaving facility, but it must be tracked accordingly in METRC and all activities must comply with fibrous waste requirements. - Fibrous waste should be tracked in METRC to ensure post-harvest materials are identified, weighed and tracked while on a licensed premises and until transfer - A tested and certified scale should be used prior to entry into METRC - All books and records for fibrous waste must be maintained accurately to account for all transfer - Fibrous waste must be physically and virtually separated from other inventory, and in receptacle with a label reading, “Contains Fibrous Waste”. - Fibrous waste should be separated from other marijuana plant material and waste within the Limited Access Area and on video surveillance. - Contaminated fibrous waste should not be transferred to an industrial fiber products producer. Industrial Fiber Products Producers (IFPPs), who are contracted by cultivation or manufacturing facilities for the production of industrial fibrous products, must ensure the security of the fibrous waste during transport from the licensed premises to the point of processing by the IFPPP and must maintain all business records from transfers of fibrous waste - Industrial Fiber Products are finished or unfinished products that aren’t intended for consumption and are not usable or recognizable as marijuana (ex: cordage, paper, fuel, textiles, bedding, insulation, construction materials, compost materials, and industrial materials).

105 © iComply, LLC 2019 V.05.22.19..01

Standard Operating Procedures (SOPs)

All cultivation facilities and marijuana products manufacturers must establish written standard operating procedures that document production procedures and manufacturing processes for each product. A copy of all standard operating procedures must be maintained on the Licensed Premises.

Material Change: Defined as any change that would require a substantive revision to a Marijuana Establishment’s SOP for the cultivation of Marijuana or the production of a Marijuana Concentrate or Marijuana Product. This includes but is not limited to, adding a new pesticide or moving from soil to hydro, feeding schedules, or equipment for a cultivation facility or changing the process or solvents for concentrate production.

Cultivation Facilities: An SOP for a Cultivation Facility must at a minimum include when, and the manner in which, all Pesticide and other agricultural chemicals are to be applied during its cultivation process.

Additional processes that must be covered include at minimum: - Cultivation, Harvest, Drying, Curing, Packaging, Storing and Sampling - Safety Data Sheets (SDS) must be kept for all pesticides or agricultural chemicals - Original Labels for all pesticides or agricultural chemicals - Pesticide application documentation for any pesticide or agricultural chemical to any portion of a plant, water, or feed used - Detailing name, signature, and occupational license number of the individual who applied the pesticide or agricultural chemical - Applicator certification number if the applicator is licensed with the Department of Agriculture for “Pesticide Applicator Act” compliance. - The date and time of the application - The EPA registration number of the Pesticide or CAS number of any agricultural chemical applied - Any active ingredients of the Pesticide or Agricultural Chemical - Brand name and product name of the Pesticide or Ag Chemical - The restricted entry interval from the product label of any Pesticide or Agricultural chemical - The RFID Tag number(s) of the plant(s) to which the Pesticide or Agricultural chemical(s) are applied. - The total amount of each Pesticide or Ag Chemical applied

106 © iComply, LLC 2019 V.05.22.19..01

- All sanitary rules, cleaning, maintenance and safety procedures - Quality control procedures to maximize safety and minimize contamination - Waste disposal procedures - Emergency procedures (chemical spill, fire, etc) - Sampling Unit procedures, including the designated Sampling Manager, inventory tracking of sample units transferred to sampling manager, and any time a designated sampling manager change.

Products Manufacturing Facility: If a Marijuana Products Manufacturing or cultivation Facility makes a Material Change to its Licensed Premises, equipment or a concentrate production procedure, recipe, or equipment, in addition to all other requirements, it must obtain a report from an Industrial Hygienist or Professional Engineer certifying its standard operating procedures and, if changed, re- certifying its Licensed Premises and equipment to building code, fire code, and local regulations as well. MIP SOPs must outline step-by-step instructions on how to perform the following: - All sanitary rules, cleaning, maintenance and safety procedures - Cleaning all equipment, counters, and surfaces thoroughly - Step by step instructions on each kind of Infused Product manufactured. - Written and documentable quality control procedures to maximize safety and minimize product contamination - Emergency procedures (chemical spill, fire, etc.) - Sampling procedures, including the designated Sampling Manager, inventory tracking of sample units transferred to sampling manager, and any time a designated sampling manager changes. - SOP for each Concentrate method including step by step instructions on: - How to conduct all necessary safety checks prior to commencing concentrate production - How to prepare marijuana for processing - How to extract cannabinoids and other essential components - Purge any solvent or unwanted components from a concentrate - Dispose of any waste produced during processing - Comprehensive Training Manual providing step by step instructions for each method used to produce a concentrate including: - All SOPs for concentrate production - Quality Control Procedures - Emergency Procedures - Appropriate use of necessary safety or sanitary equipment - Clear instructions on safe use of all equipment according to manufacturer’s instructions

107 © iComply, LLC 2019 V.05.22.19..01

- Any additional periodic cleaning required to comply with sanitary rules - Copy of the training manual must be provided to and live, in- person instruction given covering all topics. - Trained individual and trainer must sign and date a document attesting to all required aspects being trained and that the individual can confidently and safely produce a concentrate and follow all procedures. For Example: Wax type concentrate products will have a different procedure from shatter type products, and a chocolate chip cookie is going to have material differences from a peanut butter cookie. Any deviations in recipe or process will constitute its own procedure and any changes constitute a Material Change.

Production Documentation: The MIP must maintain clear and comprehensive records of the name, signature and Occupational License number of every individual who engaged in any step related to the creation of a Production Batch of Marijuana Concentrate and the step that individual performed.

Other Documentation: In addition to the above documentation required by the MED, iComply suggests the following additional documentation to drive any licensed marijuana business compliance:

Safety Data Sheet (SDS): A Licensed Facility must obtain and maintain Safety Data Sheet for all chemicals used or stored on its Licensed Premises - including cleaning agents.

HR Handbook: A Licensed Facility should set expectations for employment with Policies that are in accordance with rules and regulations including: onboarding/outboarding procedures, fireable offenses, dress code, safety policies, disciplinary expectations, etc.

Quality Management SOPS: A licensed facility should develop SOPs specifically relating to defining quality, preventing defects, identifying defects, maintaining quality standards, and expectations.

Facility SOPs: A licensed facility should develop SOPs relating specifically to the licensed facility itself, including applicable building and fire code expectations, HVAC, plumbing, electrical, and equipment maintenance and maintenance schedules,

Document Management and Training SOPs: A licensed facility should develop SOPs specifically relating to managing its compliance documentation, required reporting, official forms, licensing renewal, employee training documents and presentations, and managing material changes.

108 © iComply, LLC 2019 V.05.22.19..01

Prohibited Chemicals

*The following chemicals shall not be used on a licensed research business licensed premises unless part of an approved research project and any possession of the following chemicals and/or these chemical containers violates the rules, unless as part of an approved research project.

Marijuana cannot contain Dimethyl sulfoxide (“DMSO”), nor must any of the any of the following chemicals be used in the growing and manufacturing of marijuana: Chemical Name - CAS Registry Number (or EDF Substance ID) - ALDRIN / 309-00-2 - ETHYLENE OXIDE / 75-21-8 - ARSENIC OXIDE(3) / 1327-53-3 - FLUOROACETAMIDE / 640-19-7 - ASBESTOS (FRIABLE) / 1332-21-4 - AZODRIN / 6923-22-4 - GAMMA-LINDANE / 58-89-9 - 1, 4-BENZOQUINONE, 2, 3, 5, 6-TETRACHLORO / - HEPTACHLOR / 76-44-8 118-75-2 - BINAPACRYL / 485-31-4 - HEXACHLOROBENZENE / 118-74-1 - 2,3,34,5-BIS (2-BUTENYLENE) TETRAHYDROFURAL - 1,2,3,4,5,6-HEXACHLOROCYCLOHEXANE / 126-15-8 (MIXTURE OF ISOMERS) / 608-73-1 - BROMOXYNIL BUTYRATE / EDF-186 - 1,3-HEXANEDIOL, 2-ETHYL- / 94-96-2 - CADMIUM COMPOUNDS / CAE750 - LEAD ARSENATE / 7784-40-9 - CALCIUM ARSENATE [2ASH3O4.2CA] / 7778-44-1 - LEPTOPHOS / 21609-90-5 - CAMPHECHLOR / 8001-35-2 - MERCURY / 7439-97-6 - CAPTAFOL / 2425-06-1 - METHAMIDOPHOS / 10265-92-6 - CARBOFURAN / 1563-66-2 - METHYL PARATHION / 298-00-0 - CARBON TETRACHLORIDE / 56-23-5 - MEVINPHOS / 7786-34-7 - CHLORDANE / 57-74-9 - MIREX / 2385-85-5 - CHLORDECONE (KEPONE) / 143-50-0 - NITROFEN / 1836-75-5 - CHLORDIMEFORM / 6164-98-3 - OCTAMETHYLDIPHOSPHORAMIDE / 152-16-9 - CHLOROBENZILATE / 510-15-6 - PARATHION / 56-38-2 - CHLOROMETHOXYPROPYLMERCURIC ACETATE - PENTACHLOROPHENOL / 87-86-5 [CPMA] EDF- / 183 - PHENYLMERCURIC OLEATE [PMO] / EDF-185 - COPPER ARSENATE/ 10103-61-4 - PHOSPHAMIDON / 13171-21-6 - 2,4-D, ISOOCTYL ESTER / 25168-26-7 - PYRIMINIL / 53558-25-1 - DAMINOZIDE / 1596-84-5 - SAFROLE / 94-59-7 - DDD / 72-54-8 - SODIUM ARSENATE / 13464-38-5 - DDT / 50-29-3 - SODIUM ARSENITE / 7784-46-5 - DI(PHENYLMERCURY)DODECENYLSUCCINATE [PMDS] EDF- / 187 - 2,4,5-T / 93-76-5 - 1,2-DIBROMO-3-CHLOROPROPANE (DBCP) / 96- - POLYCHLORINATES (STROBANE6) / 12-8 8001-50-1

109 © iComply, LLC 2019 V.05.22.19..01

Marijuana cannot contain Dimethyl sulfoxide (“DMSO”), nor must any of the any of the following chemicals be used in the growing and manufacturing of marijuana: Chemical Name - CAS Registry Number (or EDF Substance ID) - 1,2-DIBROMOETHANE / 106-93-4 - THALLIUM(I) SULFATE / 7446-18-6 - 1,2-DICHLOROETHANE / 107-06-2 - 2,4,5-TP ACID (SILVEX) / 93-72-1 - DIELDRIN / 60-57-1 - TRIBUTYLTIN COMPOUNDS / EDF-184 - 4,6-DINITRO-O-CRESOL / 534-52-1 - 2,4,5-TRICHLOROPHENOL / 95-95-4 - DINITROBUTYL PHENOL / 88-85-7 - VINYL CHLORIDE / 75-01-4 - ENDRIN / 72-20-8 - EPN / 2104-64-5

110 © iComply, LLC 2019 V.05.22.19..01

Section 4 Store/Center Operations

- Qualifying Medical Patients and Retail Customers - Acceptable Forms of ID - Invalid and False Identification - Sales to Minors - Equivalency Standards - Patient Registration of Primary MMC - Caregiver Cultivation Registration - Medical Patients Types and Conditions - Patient Privacy - Online Registry - Medical Patient Online Registry Access and Email Resources - Medical Patient Registry Notifications

111 © iComply, LLC 2019 V.05.22.19..01

Qualifying Medical Patients and Retail Customers

Acceptable forms of ID for Medical Patients You are not permitted to sell medical marijuana to any patient or caregiver who is unable to produce a valid patient registry card or a copy of a current and complete new application along with current proof of identification. You cannot sell retail marijuana to any adult unable to produce valid proof of age. You must physically inspect all identification and paperwork and then deny access to any customers, patients, or caregivers unable to produce valid documents or acceptable identification. Additionally, no workers should be allowed into limited access areas without properly displaying their licensed badges. You may only sell medical marijuana to primary caregivers when the primary caregivers are able to prove that they have a homebound patient or homebound patients and have a copy of their own ID and the patient’s original paperwork.

Ensure all patients entering your MMC must have acceptable forms of ID, defined as one of the following - ID’s must match patient paperwork: - Any type of driver’s license, including a temporary license, issued by any State within the U.S., District of Columbia, or any U.S. territory; - Current ID card, including a temporary ID, issued by any State within the U.S., District of Columbia, or any U.S. territory; - Military I.D. card or any other ID card issued by the U.S. government including but not limited to a permanent resident card, alien registration card, or consular card; - Indian tribe enrollment card from a federally recognized tribe with proof of age; - Valid Passport or Passport ID card

Ensure all employees physically inspect every patient or caregiver’s ID and paperwork under camera to judge authenticity in all cases. - Check for discrepancies in date of birth and name between medical patient registry card and ID. - Collect U.S. Postal certification and application, or online temporary paperwork to confirm submission of medical records - Caregivers must also have their patient’s paperwork showing the patient is homebound in their possession, their own ID, their patient’s ID and all must be validated prior to accessing restricted access areas Ensure any sales to medical marijuana patients does not exceed two ounces (2 oz) of marijuana or the equivalent in marijuana product unless proper physician certification documentation is presented to the patient’s primary MMC to authorize an extended plant and ounce count.

112 © iComply, LLC 2019 V.05.22.19..01

Even if you see a patient frequently, you must check the physical I.D. and registry card (or proper paperwork) every time someone enters any RAA.

Acceptable forms of ID for Retail Customers Ensure all customers entering your facility have acceptable forms of ID, defined as one of the following – see more specifics on ID verification in Acceptable Forms of Identification section: - Any type of driver’s license, including a temporary license, issued by any State within the U.S., District of Columbia, or any U.S. territory; - Current ID card, including a temporary ID, issued by any State within the U.S., District of Columbia, or any U.S. territory; - Military I.D. card or any other ID card issued by the U.S. government including but not limited to a permanent resident card, alien registration card, or consular card; - Indian tribe enrollment card from a federally recognized tribe with proof of age; - Valid Passport or Passport ID card

Ensure any sales to retail customers without valid ID do not purchase more than one ounce (1 oz) of retail marijuana or its equivalent. - You must refuse the sale of Marijuana or Products to anyone who cannot produce a form of valid identification proving they are 21 years of age or older. The identification is valid as long as it has a picture and date of birth, is not expired, and meets one of the ID-type requirements above.

113 © iComply, LLC 2019 V.05.22.19..01

Acceptable Forms of ID

Here are the acceptable forms of ID patients or customers must present to purchase medical or retail cannabis from a center or store: Medical: Retail: - Valid and acceptable form of ID - Driver’s License or Temporary Driver’s AND License or, ID card or Temporary ID - Valid Patient Registry Card card from any State in U.S., D.C., or OR any U.S. territory - Current, complete and valid patient - Military ID card of other ID issued by registry application and certified mail the U.S. Gov. including permanent receipt or valid online temporary resident card, alien registration card, application or consular card - Caregiver registry card and valid - Indian tribal card from recognized current or temporary patient medical tribe registry documents and patient ID - Valid Passport or Passport ID card

NOTE: For retail, customer must be 21 years old and medical patients must be 18 years old to independently purchase marijuana. Patients under 18 years of age must have parental caregivers present to purchase medical marijuana. How to Check Identification It is important to have a process for checking identification before allowing access to Restricted Access Areas. The benefit of having a process is to build a routine, to ensure IDs are checked the same way each time to reduce the risk of missing something important. Follow this process to qualify each customer before granting access to a Restricted Access Area: 1. Check the expiration date: - This is something that may be forgotten. When verifying an individual’s age, an ID check generally starts by checking the date of birth. Always check if the ID is valid/ not expired. 2. Check the date of birth: - Do the math to ensure that the person is of legal age. 3. Look at the picture: - Compare the picture to the person in front of you. Does this match with the information on the ID (eyes, sex, etc.)? Be sure to take at least 10 seconds to review the ID. 4. Turn it around: - Look at the back of the ID to check if it has a barcode, magnetic strip, etc. Cross compare the ID to security features in the Fraud ID book.

114 © iComply, LLC 2019 V.05.22.19..01

Invalid and False Identification

Does the ID look “right”? Does the customer appear young?

Many false IDs look just a little bit off. If you have any doubts that the ID is valid, please ensure that you also follow the steps below for how to identify false identification.

Types of Fake IDs The most common forms of False ID are:

Counterfeit/Fake ID – Identification that is produced to copy and imitate real IDs. Today, these IDs may be ordered online and arrive in a short amount of time for minors to use in obtaining marijuana or for out of state adults to use in increasing purchase limits. - ID Checking guide, detection equipment (UV), security features - Visual and physical ID check – edges, bend, material

Altered ID - An ID that is legitimate for the holder, but that has been altered with false birthdays, false fronts, or other attempts to change the information on the ID. - Under 21 or Vertical ID? - Visual and physical ID check - edges, bend, material

Borrowed ID – The most common form of illegal ID in which the holder borrows a fake ID from an older family member or friend. Often, a closer inspection of the ID and questioning of the holder will help identify use of borrowed IDs. - Scrutiny of the ID compared to the user - ID information, discrepancy, and validation - Questioning of the holder on ID information Security Features Not all States use each of these features, but store employees should be aware of these options for each state and should consult the ID book to check for the following when applicable:

Ultra-Violet (UV) Images – Many modern IDs contain words, pictures, and designs on the front and/or back of valid IDs that are only visible using a UV light source.

Ghost Images – Some states have smaller versions of the identifying picture used elsewhere on the ID and should be somewhat transparent. Fake IDs may have the standard photo reduced and lightened but not “ghosted”.

115 © iComply, LLC 2019 V.05.22.19..01

Kinegrams – More often used on international passports than State IDs, this feature is similar to a holographic image except that the image appears with different colors and patterns depending on the angle the ID is being viewed in.

Optical Variable Device (OVD) – When moved around, this security feature also changes colors depending on the angle, but it is combined with micro-print to be examined by magnification as well.

Laser Light Feature – As a newer security feature, a laser pointer may be used on a specific point of the ID in which a letter or image will reflect off. It is not the easiest method to check as you must use a flat surface and dark lighting conditions to verify this feature.

Opacity Mark – Another newer feature in which an embedded, tiny, perforated marking is made visible through the ID when held up to a light source. The pattern varies state to state and is an internal feature within the ID that cannot be detected by feeling.

Embossed Dates/Information – Embossed information and/or embossed ink raises off the ID like numbers on a credit card. It is a newer feature and may alter with wear.

Barcodes, Data Chips, and Magnetic Stripes – Magnetic Stripes are one of the most common security features containing the information about the ID holder and are now programmable and easier to copy. States are now using more barcoding and RFID chips to store electronic information.

Micro Printing/Nano Printing – Security feature involving tiny print that cannot be read (or easily duplicated) with the naked eye. This may appear in lines with the ID or as a part of images and patterns on the ID. Using a magnifying glass, these features should be identifiable on valid IDs.

Holographic Images – Holograms are 3D images that move around or jump from the document. For many states, this is a feature used with the State Seal.

Common concerns and what to look for…

- Feel the edges and bend the edge of the ID slightly, false IDs are usually poorly laminated and could be peeling. Also check for dirt at the edges to indicate a laminated ID. Inferior plastic may crack or not bend back into place as easily as a true ID. Embossed features? Smooth Edges? - Look at the foils or holograms. Turn the ID in the light, any holograms, foils or background outlines should flash in and out of vision. Extra features that shouldn’t be there? Back of the card make sense? - Compare the holder to the ID. Is the holder wearing similar clothing and a similar hairstyle?

116 © iComply, LLC 2019 V.05.22.19..01

- Look for slight differences in facial features. People age and change quickly, if the picture was taken recently but the issue date was at a significantly earlier date then you need to be suspicious - Check birth date, expiration date, age restrictions, and photograph - Ask the holder for a detail from the ID. Zip code, height/weight, ID number, hair/eye color. - Use creative Questioning: year of graduation, middle name, replicate signature - Ask for additional photo ID. If lost, stolen or transferred, the holder might not have backup ID - Look for signs of anxiety or deceit. If the holder is avoiding eye contact, asking for a quick check, or looking nervous, be more suspicious. - Scan the ID if possible. Forged IDs often have real magnetic stripes, but most may not scan and display information. Check with UV light and look for additional security features according to ID book. - Ask for backup. If you're still unsure, say, "I think I need my manager to look at this"

What do I do if the ID is false?

If you have reasonable cause to believe that the ID presented to you is fake, you have the right to confiscate it but are not required to do so if you are not 100% sure or if the situation may be dangerous to do so. Internal policies should be defined around what to do for each store.

If you decide to confiscate False Identification, then you must turn it over to the police within 72 hours. Best practice is to alert security as soon as possible so they may safely detain the customer while waiting for police to arrive and confirm the suspected False ID.

The Best Compliance practice is to have an ID book available wherein you may check any given identification to its State security features. The MED allows a burden of proof and affirmative defense if a minor uses a fraudulent ID and you have an ID book issued in the past 3 years.

117 © iComply, LLC 2019 V.05.22.19..01

Sales to Minors

Be vigilant and do your part. Preventing distribution to minors is extremely important and one of the top priorities of the industry and the MED. Cannabis is regulated in Colorado and is only legal for recreational adult use for adults above the age of 21. We all share the compliance burden and responsibility to ensure that no person under the age of 21 can purchase retail cannabis.

You must refuse the sale of Marijuana or Products to anyone who cannot produce a form of valid identification of 21 years of age and/or valid patient paperwork.

- Retail Transfer of 1 oz or less between persons at least 21 years of age is legal (does not include medical marijuana products) - As of 2014, it is considered a Class 1 misdemeanor instead of a Class 2 to sell marijuana to minors - Class 1 misdemeanors are generally associated with jail time and/or heavy penalties - Sales to a minor under the age of 15 carry an additional penalty of a mandatory minimum sentence of 4 years imprisonment - The sale of 5 lbs. or more to a minor is a Class 3 felony punishable between 3- 12 years imprisonment as well as a fine of $3,000 - $75,000

Sale to minors or sale of to non-qualified patients is considered a License Violations Affecting Public Safety and carries a fine up to $100,000.

As an affirmative defense, you have a burden of proof to establish by a preponderance of the evidence that the minor presented fraudulent ID. You have an affirmative defense to any administrative action for an alleged sale to a minor if the minor presented fraudulent ID and you have an ID book issued within the past three years.

118 © iComply, LLC 2019 V.05.22.19..01

Equivalency Standards

Retail Marijuana Equivalency Standards and Purchase Limits In the attempt to limit diversion of marijuana out of state and to prevent the misuse and abuse of marijuana, the State commissioned a study to look at what the equivalent consumption amount should be in Concentrates and Edibles as compared to 1 ounce of Flower. Similar to alcohol in that a drink is considered 1 ounce of hard liquor, which is equivalent to a 5-oz. glass of wine or a 12-oz. beer, Retail Marijuana equivalency standards seek to define and limit the amount of concentrate and edibles one may purchase with a 1 oz. limit. Audited Products or Alternative Use Products included and should be calculated according to psycho-activity or the amount of active THC in each unit. Non-edible, non-psychoactive Retail Marijuana Products including ointments, lotions, balms, and other non-transdermal topical products are exempt from the one-ounce quantity limit on Sales/Transfers. - Quantity Limitations for retail marijuana sales are according to the following equivalencies: - Sales Transaction: A Retail Marijuana Store and its employees are prohibited from selling more than one ounce of Retail Marijuana flower, concentrate, marijuana product or more than six retail marijuana seeds in a single transaction to an individual. I. One ounce of Retail Marijuana flower shall be equivalent to eight grams of Retail Marijuana Concentrate. (1oz = 8gr of Concentrate) II. One ounce of Retail Marijuana flower shall be equivalent to 80 ten milligram servings of THC in Retail Marijuana Product. (1oz = 80 10mg or 8 100mg Product) III. One ounce of Retail marijuana flower shall be equivalent to six Retail marijuana seeds (1oz = 6 individual seeds)

119 © iComply, LLC 2019 V.05.22.19..01

The challenge in retail marijuana quality limitations “budtender math” is complicated when trying to combine different types of products and the units of measurement used in the equivalency truly forces unit standardization for flower into 3.5gr for simplicity’s sake and to reduce the risk of selling over limit. Especially in the event of a power outage, internet or computer malfunction in which the Point of Sale system is unavailable to calculate the equivalencies within the purchase.

Medical Marijuana Purchase Limits - Medical marijuana never subjected to restrictions by way of equivalency standards - Patient carry weight and plant count may vary dependent on multiple factors, but 6 plants / 2 ounces is most common - For medical patient purchase limits, equivalency standards do not exist, so to calculate in consideration of purchase limits, simply add up the weight of marijuana in grams/ounces/lbs, and marijuana product in milligrams of active THC. - No equations or formulas or calculators needed for medical purchase limits - For example, to calculate how many chocolate bars one could buy as a medical a ‘normal’ plant count/carry weight of 6 plants/2 ounces means: - 2ozs = 2ozs x 28gs per 1oz = 56 gs = 56gs x 1,000mgs per 1g= 56,000mgs = purchase limit for patient with 6 plants / 2ounces - Each medical marijuana seed is equivalent to buying one marijuana plant, so a patient with a6 plants/2 ounces for plant count/carry weight may only purchase 6 seeds in one transaction.

120 © iComply, LLC 2019 V.05.22.19..01

Registration of a Primary MMC and Caregiver Cultivation Registration

Patient Registration of a Primary Medical Marijuana Center

MMCs cannot allow patients to register it if the patient has designated another MMC as its Primary Center in the previous 30 days. Once it has been 30 days since the patient listed the previous MMC, your MMC may register the patient as a member by documenting the following: 1. Notify previous MMC in writing. - Notify the Former Medical Marijuana Center with a written or electronic notification advising that the Medical Marijuana Center has been designated as the patient’s new primary Medical Marijuana Center. 2. Update Membership agreement with patient affidavit. - Medical Marijuana Center and its employees must require a patient to sign in writing that he or she has not designated another Medical Marijuana Center within the last 30 days. 3. Report the new registration of your center to the MED within 72 hours within METRC.

Maintain the written notification, copy of the patient affidavit, and any applicable patient plant count waivers (to support the number of ounces of marijuana, excluding infused-product or concentrate, included in its on-hand inventory) as records on file for each patient who has registered your MMC and maintain the documentation in the patient file for each patient registering you as their center.

Each MMC must maintain these written records in each patient file for registered members in addition to a copy of the valid ID and registry card from the patient. Patient registration file documents can be maintained in hard copy or electronic forms.

121 © iComply, LLC 2019 V.05.22.19..01

Types of Caregivers 4 Types of Primary Caregivers:

Primary caregivers have significant responsibility for managing the well-being of a patient who has a debilitating medical condition. All caregiver types are indicated as such on the medical marijuana registry card for the patient. Caregivers are also registered according to the following types with the CDPHE in accordance with the patients they provide caregiving for.

The patient registration should include the name of the patient, their caregiver’s name, whether the caregiver is cultivating for the patient, and one of the following designations for the type of caregiver they are:

1. Parent of Child Caregiver – - Parent or anyone who assists parent with caregiver responsibilities, including cultivation and transport. - Child Patients may not enter RAA under 18 years of age. This requires parents to purchase on behalf of any patient under 18.

2. Advising Caregiver – - Advises patient on what marijuana products/potency to use (doesn't possess, provide, cultivate, or transport on behalf of patient) - This type of caregiver can only provide advice to the patient and is allowed to enter the RAA of a dispensary with the patient to do so.

3. Transporting Caregiver – - Purchases and transports marijuana to homebound patient - This Caregiver may not purchase or transport unless the patient is declared “homebound by a physician” - May transport between a cultivating caregiver and a homebound patient. - Must provide number of plants and ounces to the CDPHE. - Must keep receipt of purchase on their persons when transporting.

4. Cultivating Caregiver – - Grows for a patient - May not purchase at the dispensary or transport for the patient. - May only cultivate and must provide registration of cultivation location to CDPHE.

In all cases, the caregiver must provide their valid ID and the valid ID of the patient to gain access to any RAA or to purchase (where qualified to do so) on behalf of their patient(s).

122 © iComply, LLC 2019 V.05.22.19..01

Caregiver Cultivation Registration Beginning in 2017, all Medical Marijuana Cultivating Caregivers and Transporting Caregivers must register the location of their Caregiver cultivation location, among other applicable information, with the MED/DOR in the Colorado Medical Marijuana Caregiver registry. The login page has a Caregiver Registration button (on the right) for new all Cultivating or Transporting Caregivers to input all required information.

Cultivating Caregivers To comply with state statute, Cultivating Caregivers must register the location of each cultivation, the registration number of each patient they are cultivating for, and any extended plant count numbers and thee corresponding patient registry numbers.

Transporting Caregivers To comply with state statute, Transporting Caregivers must register the registration number of each homebound patient they are transporting for, the total number of plants and ounces that the caregiver is authorized to transport, and if applicable, the location of the MMC or Caregiver Cultivation for each patient.

123 © iComply, LLC 2019 V.05.22.19..01

Medical Patients

How to Check Patient or Caregiver Paperwork Physically inspect every patient or caregiver’s ID and paperwork under camera to judge authenticity - Check for discrepancies in Dates of Birth and Name between paperwork and identification - Caregivers must also have their patient’s paperwork showing the patient is homebound and under their care and verified prior to being granted access.

What do I do if the Patient Registry Card is invalid? If the patient presents a Patient Registry Card that does not match their identification, if you determine that the identification is false, you should confiscate the paperwork and notify local law enforcement and CDPHE. If a Patient Registration has any other discrepancies with the paperwork (such as expired or illegible patient cards), or if it is considered invalid according to the following, you should help the patient file a Lost, Stolen, or Damaged registration card and/or renew an expired registration, or assist them with gaining online access to their card. A Medical Marijuana Registry Card is valid if: - It has all the security features (ex: watermark, CO State seal, etc.) - The patient's name & date of both can be clearly read - The patient's identification and card have matching name & date of birth - The card does not have writing or marks - The card is not taped or laminated - The card number is complete & can be read easily - The card has not been tampered with or altered in any way (ex: not shrunk down to wallet size) - The expiration date on the card date has not yet passed

*A patient's registry card is valid if the patient registration ID number is not listed on the Registry's permanently voided card or denied applications and revoked cards list, which can be found on the registry's Medical Marijuana Centers page

124 © iComply, LLC 2019 V.05.22.19..01

Medical Marijuana Patient Registry Applicant Types and Qualifying Conditions

Patient Application Type and Physician Certification Document Requirements: 1. Adult: Application requires written documentation of diagnosis for debilitating or disabling medical condition that the physician suggests use of medical marijuana for 2. Minor with debilitating medical condition: Application requires written documentation from two physicians that the applicant has been diagnosed with a debilitating condition 3. Minor with disabling medical condition: Application requires written documentation from two physicians, one of whom must be a board-certified pediatrician, a board-certified family physician, or a board-certified child and adolescent psychiatrist who attests that they are part of the patient's primary care team, that the patient has been diagnosed with a disabling medical condition

Debilitating Medical Condition: • Cancer, Glaucoma, HIV, AIDS, or treatment for such conditions • Chronic or debilitating disease or condition, or treatment for conditions which produce cachexia, severe pain, severe nausea, seizures (including epilepsy), or persistent muscle spasms (including MS), or any other medical condition or treatment approved by the state or via petition from the patient or physician Disabling Medical Condition: • PTSD

125 © iComply, LLC 2019 V.05.22.19..01

Patient Privacy

As either a medical or retail facility, we all handle and gather a lot of personal information on our customers and patients. As patient information is confidential, and we must take steps to protect it. The information that is stored can be used to commit fraud and identity theft, but could also contains private, personal, and medical information that is confidential and is protected by HIPAA law. In addition to any internal policies and practices in place for protecting the privacy of patients, store employees should also ensure that: - Don’t share any information or discuss any of your patients or their conditions with anyone that is not privileged to the same information as you. - Don’t leave any personally identifiable information unsecured. This includes files, driver’s licenses, customer records, etc. File them and lock up cabinets nightly in limited access areas. - Turn off screens and ensure that doors are locked and secured to where personal information can be found. Password protect all POS software and other systems containing sensitive information.

CDPHE Forms NEW applications may be used as a proof of registration if: - Packet includes application and physician’s certification. Renewal paperwork is not acceptable. - A certified mail return receipt with a mailing date no more than 35 days’ old - A valid picture ID that matches the name and Date of Birth on the application - Purchases using a copy of application are valid from 8 a.m. to 5 p.m., Monday through Friday. You must contact CDPHE to determine whether the purchaser's application has been denied. Most days, there are no denials posted at CDPHE site. - If the Purchaser's application has been denied, confiscate the purchaser's copy of the application and certified mail receipt - Turn it over to CDPHE or local law enforcement agency within 72 hours - Make Copies of all new paperwork purchases

126 © iComply, LLC 2019 V.05.22.19..01

Online Patient Registry

Patients may now register and re-register their CDPHE issued registry cards online. This means they can print and present cards to Dispensaries as a Valid Proof of registry in addition to any cards issued by the CDPHE which may still be issued until January 2018. Applying online allows patients to have their applications processed much faster, allows them to monitor the status of their applications, and allows a printing of their registry card immediately upon application approval or renewal. Follow the step-by-step instruction below for access to the online patient registry! This simplifies any lost, stolen, or damaged registry card issues as well as the patient may print a new copy at any time. At all times, dispensary employees must check the registry card and match it with a Valid proof of ID prior to allowing access to a restricted access area and before allowing any purchases – regardless if the registry card was printed by the CDPHE or online by the patient.

127 © iComply, LLC 2019 V.05.22.19..01

Medical Patient Online Registry Access

Step-by-Step Online Patient Registry Access: Use the link below for the CDPHE’s website for patient registry online access https://www.colorado.gov/pacific/cdphe/medical-marijuana-registry-patients - STEP 1: Log into account via patient login portal using credentials from medical card evaluation appointment.

- STEP 2: Click “New Request Access to Patient Registration”.

128 © iComply, LLC 2019 V.05.22.19..01

- STEP 3: Select application type from drop down menu.

- STEP 4: Enter patient information in all required fields.

- STEP 5: Click “browse” to upload a copy of valid CO ID or DL for patient.

129 © iComply, LLC 2019 V.05.22.19..01

- STEP 6: Enter patient name to sign the form.

- STEP 7: Click “save” to submit the form.

- STEP 8: After form is submitted, the request status will be “pending”.

130 © iComply, LLC 2019 V.05.22.19..01

- STEP 9: Once request is approved, log in and view patient registration by clicking on the patient name.

- NOTE: For additional questions or concerns, try searching the online patient registry FAQ’s with this link: https://www.colorado.gov/pacific/cdphe/medical-marijuana-online-registration- system-frequently-asked-questions-faq

131 © iComply, LLC 2019 V.05.22.19..01

Medical Patient Registry Email Notification System Sign-Up

Step-by-Step Patient Registry Email Notification List Sign Up: Use this link to access the CDPHE marijuana patient registry page: https://www.colorado.gov/pacific/cdphe/medicalmarijuana

- STEP 1: Access the CDPHE’s “Medical Marijuana Registry” page with the link above and click on the blue, underlined link reading “Patients”.

- STEP 2: Scroll to the bottom of the “Medical Marijuana Registry patients” page on the CDPHE website and click on the blue, underlined link reading “Contact”. Link for reference: https://www.colorado.gov/pacific/cdphe/m edical-marijuana-registry-patients

132 © iComply, LLC 2019 V.05.22.19..01

- STEP 3: Scroll to the bottom of the “Medical marijuana contacts” page and click on the blue, underlined link reading “Sign up for electronic updates”. Link for reference https://www.colorado.gov/pacific/cdphe/m edical-marijuana-contacts

- STEP 4: A email window will pop up and prompt you to send a message to the [email protected] email address. Write out a brief request for medical patient registry notifications.

Sample MMR Patient Card

This is how a patient’s MMR card will look when printed from the CDPHE online patient portal using STEPS 1-10 from above

*As a vendor, it is your responsibility to verify each and every patient MMR card with a valid ID to ensure the patient’s name, DOB, physical appearance, etc. match between the ID and the registry card.

133 © iComply, LLC 2019 V.05.22.19..01

Section 5

Responsible Operations and Labeling

- Health and Safety Concerns of Marijuana Use - Effects of Marijuana Use While Pregnant or Breastfeeding - Amount of Time to Feel Impairment - Amount of Time to Wait before Driving from Marijuana Use - Recognizing Signs of Impairment - Appropriate Response in Case of Unintentional or Over-Consumption of Marijuana - Additional Health and Safety Resources - Responsible Vending Obligations - Conduct of the Establishment - Packaging and Labeling

134 © iComply, LLC 2019 V.05.22.19..01

Health and Safety Concerns of Marijuana Use

The effects of marijuana consumption can vary from person to person, but as a responsible vendor, it’s important for you to know and inform patients and consumers about the health and safety concerns of marijuana. Although more research on the subject of health and safety concerns of marijuana is needed, consider the following topics about the effects of marijuana use, which are identified by the “Responsibility Grows Here” website: - How marijuana use effects your lungs: - Marijuana smoke irritates lungs, has the same cancer-causing chemicals as tobacco, has been linked with tissue damage in the lungs which increases chances of developing lung cancer, and frequent use may cause a cough, bronchitis, mucus and wheezing. - Marijuana use and your mental health: - Daily or near-daily use of marijuana can have negative effects on memory - Marijuana, especially in high doses, can cause hallucinations, paranoia and not knowing what’s real - Secondhand smoke from marijuana use - Secondhand smoke from marijuana has same cancer-causing chemicals from tobacco smoke - Never smoke around children, pregnant or breastfeeding women or anyone who doesn’t want to be exposed to secondhand smoke - Marijuana’s health effects on youth - Youth who use marijuana regularly are more likely to have difficulty learning, memory issues, and lower math and reading scores

Long-Term Health Effects of Marijuana Use According to the Retail Marijuana Public Health Advisory Committee, current research has shown that the following effects may be caused from marijuana use: - Respiratory effects of marijuana use: - Marijuana smoke irritates lungs, contains the same cancer-causing chemicals as tobacco, is linked to tissue damage and increases chances of developing lung cancer, and may cause a cough, bronchitis, mucus and wheezing. - Lung cancer and marijuana use: - The available research on marijuana use and lung cancer is conflicting, but we do know that the respiratory effects of marijuana use (listed above) may have an impact on developing lung cancer - Brain and mental health effects of marijuana use: - High rates of consumption of marijuana can cause memory damage or temporary psychosis (not knowing what is real, hallucinations and paranoia) while you are high.

135 © iComply, LLC 2019 V.05.22.19..01

Effects of Marijuana Use While Pregnant or Breastfeeding

While addressing the topic of marijuana use while pregnant or breastfeeding, it’s important to consider the following facts and information on risks for new of expecting mothers: - There is no known safe amount of marijuana to use while pregnant or breastfeeding - Regardless of method of consumption, THC always gets passed to the baby from mom regardless of the type of marijuana used. - Just because marijuana use is legal, doesn’t mean it is safe to use and using marijuana during pregnancy or while breastfeeding may harm a baby, just like alcohol or tobacco. Smoking marijuana in the home or around a baby should not be allowed because breathing in marijuana smoke is bad for the mom and baby. - Just because marijuana is “natural”, doesn’t make it safe. Not every all-natural substance or plant is safe – for example, lead, tobacco, and poisonous berries. - Marijuana use while pregnant or breastfeeding for medical reasons are not recommended unless in special cases, by a medical doctor. - Marijuana use to treat nausea or morning-sickness isn’t recommended, and communication with a health care provider is strongly recommended for pregnant women. - “Pumping and Dumping” isn’t a solution because THC is stored in fat cells and may still exist in breast milk even after marijuana use has stopped. - Some cannabinoids, called endocannabinoids, occur naturally in the body and can help nerve cells communicate better but THC from marijuana is much stronger and can upset the natural in both the mom and baby’s body. - Legal consequences may result from marijuana use while pregnant or breastfeeding. Effects of marijuana use can make taking care of a baby difficult or dangerous. - Pregnant women and new mothers are priority for drug and alcohol treatment, which exists in a nonjudgmental and confidential space.

136 © iComply, LLC 2019 V.05.22.19..01

Effects of Marijuana Use While Pregnant or Breastfeeding

In 2018 the MED issued an Industry Bulletin to address the topic of store and center employees providing information on marijuana use for women reporting pregnancy-related morning sickness, which according to the rules and requirements aiming to promote public safety and reduce public harm, prohibit such actions.

Here are a few rule references to consider for this topic:

- Required warning statement: Labels must say "The long term..." (see warning statements below) - False or misleading statements: Labels are prohibited from including any statements that are false or misleading. - Health benefit claims: Labels are prohibited from including any claims regarding health or physical benefits to the patient or consumer. - Privileges granted: Any employee of a store or center is prohibited from exercising any privileges other than those granted by the MED in the rules - Prohibited third-party acts: A store or center is responsible for prohibiting employed or contracted individuals from engaging in conduct or actions that are not allowed by the rules.

The MED may investigate any reports or evidence of attempts to circumvent rule requirements. To support this, the MED issued this clarifying statement in the Industry Bulletin that addressed the topic of cannabis consumption while pregnant or breastfeeding:

- ”Licensees (including owners, managers, and employees of medical and retail marijuana businesses) making health or benefit claims to consumers or otherwise communicating information that is prohibited from being advertised or displayed on labels affixed to Containers of Retail and Medical Marijuana, Concentrate and Product may be viewed by the Division as an attempt to evade marketing, advertising, and/or labeling requirements, resulting in recommendation for administrative action."

Resources Mother’s Connection - Link: https://responsibilitygrowshere.com/pbf - Phone Number: 1-800-CHILDREN

Resources Responsibility Grows Here Website - Link: https://responsibilitygrowshere.com/user#marijuana-and-your-health

137 © iComply, LLC 2019 V.05.22.19..01

Amount of Time to Feel Impairment from Marijuana Use

Marijuana use, even in small amounts by frequent consumers, will likely cause impairment. Impairment resulting from the use of marijuana affects the ability to drive, bike, operate machinery or perform other safety-sensitive activities. As a responsible vendor, make sure to mention the following information on the amount of time to wait after marijuana use and impairment before driving, biking, etc. - Smoking or inhaling marijuana smoke or vapor – - Effects from inhaling marijuana can peak after minutes and last up to 4 hours - Eating or drinking marijuana product – - Effects from eating or drinking marijuana product can peak up to 4 hours and last up to 10 hours after consumption (liquid edibles have faster onset of effects) - Using multiple substances – - Using alcohol and marijuana at the same time is likely to result in greater impairment than either one alone. Method of Product Type Onset Duration Potency Consumption

Smoking/Vapor Trim 1 to 15 Min 2 to 4 Hours 4% to 10% THC

Smoking/Vapor Flower 1 to 15 Min 2 to 4 Hours 10% to 30% THC

Smoking/Vaporizer Concentrate 1 to 15 Min 2 to 4 Hours 30%+ THC

Edible Infused Product 30 to 120 Min 4 to 10 Hours 1mg to 10mg

Liquid Edible Infused Product 15 to 60 Min 4 to 10 Hours 1mg to 10mg

Sub lingual Infused Product 10 to 45 Min 4 to 10 Hours 1mg to 10mg

Topical Infused Product 10 to 45 Min 2 to 4 Hours As Needed

Transdermal Infused Product 15 to 60 Min 6 to 10 Hours 1 to 10mg

138 © iComply, LLC 2019 V.05.22.19..01

Distributing educational materials with every purchase is a best practice to engage customers, add value, and maintain a level of responsibility. Additionally, materials help educate consumers to start with low doss and to wait a long period of time before consuming more marijuana

139 © iComply, LLC 2019 V.05.22.19..01

Amount of Time to Wait before Driving after Marijuana Use

Driving and Traveling after Marijuana Use

According to the CDPHE, some people may think they’re safer drivers while impaired because they drive more slowly while stoned. However, research shows that driving while high may increase your risk of a crash. Do not drive, bike or operate machinery while impaired from marijuana use. Driving while impaired is illegal, unsafe, and can result in an arrest for a driving under the influence (DUI) charge. A campaign by the Colorado Department of transportation called, “Drive High, Get a DUI” targets marijuana use and impairment while driving. Similar to alcohol, rules and impairment levels from marijuana use while driving have been established in Colorado as follows: - Drivers found with 5 nanograms of THC (delta-9 ) per milliliter of blood may be prosecuted for DUI - Even if marijuana use was for medical reasons, one can still be arrested for impaired driving - Open containers and packaging of marijuana, as well as use of marijuana is prohibited and may result in a traffic offense (if the marijuana packaging seal has been broken, if product has been consumed, and for evidence of use in the car) - Smoking or inhaling marijuana smoke or vapor - Wait at least 6 hours (if 35mg or less was consumed) or longer (if 35mg or more was consumed) before driving, biking, etc. - Eating or Drinking Marijuana Product - Wait at least 8 hours (if 18mg or less) or longer (if 18mgs or more) before driving, biking, etc. Responsible Vendors should not encourage driving under the influence regardless of substance. Consumers should be educated to wait the full duration time above depending on method of use before driving. For example, one should not advise someone who consumed an edible product that they should operate a motor vehicle within 8 hours after ingestion. Additionally, combining marijuana with other drugs, including alcohol, greatly increases the risk of impaired driving. Budtenders should also refuse to sell marijuana products to customers who are already impaired; especially if the customer is driving. Blindly selling marijuana to impaired persons greatly increases the risk of that customer using marijuana and putting the safety of others at risk on the road.

140 © iComply, LLC 2019 V.05.22.19..01

Recognizing Signs of Impairment

In the same way as you should not sell alcohol to a visually impaired person you should not sell cannabis to a person obviously under the influence. It is important each store take measures to try to minimize the risk of a person leaving the premises in an impaired state, especially if they are getting behind the wheels of their vehicle.

Dry or red eyes, impaired motor skills, slurred speech, poor balance, and irrational behavior may be some signs of impairment. A strong smell of burnt marijuana or alcohol could also be a sign of possible impairment. Seek help from coworkers or security personnel in case you are uncertain if the customer is impaired. It is all about staying safe, and it is best to explain to the customer that you cannot sell any product to anyone that is under the influence of any substances and that you have the right to refuse service. Be courteous and ask the customer to come back when they are no longer impaired. To avoid marijuana impairment, it is important to understand the correct amount of marijuana to consume.

141 © iComply, LLC 2019 V.05.22.19..01

Appropriate Response to Unintentional or Over-Consumption of Marijuana

Unintentional or over-consumption of marijuana or marijuana product can result in negative health effects and make both adults and children very sick. You should advise consumers to contact a medical professional or poison control hotline (1-800-222-1222) immediately in any case of unintentional or over-consumption of marijuana.

If the reaction to over-consumption or accidental consumption of marijuana is more severe, call 911 or go to an emergency room immediately. Or if there is any worry or concern about an individual that has unintentionally or over-consumed marijuana, call for help. Colorado law protects people from some criminal charges, such as for low-level drug possession and use, or minor in possession, if they call 911 or seek help for a medical emergency. Also, stay with the person having the reaction, and cooperate with police and emergency medical responders.

The CDPHE identifies the following symptoms of over-consumption of marijuana as similar to the typical effects of using marijuana, but more severe. Symptoms of over-consumption of marijuana may include: - Extreme confusion, anxiety, panic or paranoia - Fast heart rate - Hallucinations or delusions - Increased blood pressure - Severe nausea and vomiting - Problems walking, sitting up, breathing, becoming sleepy, etc.

Over-consumption or unintentional use of marijuana has resulted in increasing numbers of hospital or emergency room visits by consumers. A few possible reasons for unintentional or over-consumption of cannabis include: - Mistook marijuana product for regular food - Misused product based on potency that may result from inexperience or trying out of high- THC product - Didn’t wait for marijuana product to fully take effect before ingesting more marijuana

142 © iComply, LLC 2019 V.05.22.19..01

Additional Health and Safety Resources for Marijuana Use

Shareable Resources: CDPHE, DOR/MED, DPS, reports, studies, and additional resources - Link: https://www.colorado.gov/pacific/marijuana/shareable-resources

Laws about Marijuana Use: including during pregnancy and while breastfeeding - Link: https://www.colorado.gov/pacific/marijuana/laws-about-marijuana-use

Legal and Addiction Resources: - Mother’s Connection - Link: https://mothersconnection.com/ - Hotline Number: 1-800-CHILDREN

Additional Resources: - Responsibility Grows Here website - Link: https://responsibilitygrowshere.com/ - Poison Control Hotline - Phone Number: 1-800-222-1222

143 © iComply, LLC 2019 V.05.22.19..01

Responsible Operator Obligations

As vendors on the global forefront of the medical and retail cannabis industries, your awareness is crucial to making sure your business stays operable. Every action you take on a daily basis impacts other. As the prohibition of marijuana ends worldwide, understanding Colorado’s responsibility in taking a stand for regulatory models as a viable alternative is extremely important. As an operator in this industry you have a responsibility to more than just the badge around your neck. You are responsible...

To all stakeholders – Everyone impacted by regulation - Leading the forefront for the State, the Nation, and the World - Responsible for day to day operations – no one else holds it together - Impacts owners, co-workers, consumers, society – everyone is watching - Provide and protect consumer safety – overconsumption, product safety - Child Safety – prevent accidental ingestion

To show regulation works - Strict adherence to the rules, DOJ is tolerant only if compliance happens - Self-regulation and compliance – reduce internal risks, maximize long-term viability - State and Local accountability – you will be penalized for non-compliance

To engage in Best Practices - Lead the industry by example – allow others to model you - Contingency Plans, drills, employee policies and checklists – cover your compliance; ensure everyone knows what to do and how to do it… the right way. - Systemized daily documentation – replicable methods help ensure unambiguous compliance and ease visits/actions by regulators. - Systematic compliance checkpoints

144 © iComply, LLC 2019 V.05.22.19..01

Conduct of the Establishment

Each establishment and each individual working in the marijuana industry carries a stake in the future health of the business. An owner wants to continue staying open for business and each person working for the establishment has an interest in keeping themselves employed. This is done by holding everyone involved accountable and conducting business in a professional and compliant manner. We all have an interest in minimizing the risk of and mitigating possible violations before they occur. Use Best Practices and work together to minimize the opportunity for mistakes.

- Work with enforcement, not against them. Prove that we can all be responsible vendors. - Emergency Plans, i.e., record keeping and power outages, Raid/Inspection, Roles and Responsibilities - Policies/Procedures/Handbook for additional employee training and risk mitigation - Systemic Checks for ensuring accurate files, records, and overall compliance - Monitor customer activity – if need be, don’t be afraid to limit suspected patient re-sellers - Watch for repeat Retail customers; although you can’t collect customer information, you can report suspect behavior to local law enforcement - DO NOT leave doors, chains, and other access restrictions open - DO NOT consume any product on site, including your car - DO NOT keep smoking accessories and/or paraphernalia on your person or premises - DO NOT serve visibly intoxicated or impaired persons - Be conscious and aware of internal patterns to mitigate diversion and inventory inaccuracies - Recall contaminated/tainted products immediately and post these internally to communicate safety risks to consumers in a timely manner

145 © iComply, LLC 2019 V.05.22.19..01

Packaging and Labeling Information

Currently, the 1001-1 series rule revisions enable marijuana product accepted by a MMC or RMS before June 30, 2018 to display previous labeling requirements without issue, but all units that comply with old packaging and labeling series rules must be sold by July 1, 2019. As of July 1, 2018, compliance with the new labeling rules below applies (R 1001-1/M 1001-1).

It is a shared responsibility between MMC/RMS and MMIPM/RMCMF licenses to ensure all marijuana and marijuana products leave the point of sale in a child-resistant container. If the product is not opaque or otherwise meets child-resistant standards, then products may be placed in an opaque exit package prior to leaving the store with the customer. Additionally, all labeling requirements must be met to maintain compliance with all requirements prior to transfer to a patient or consumer. in the case that marijuana is transferred to a facility without satisfying all packaging and labeling requirements, the next facility can affix a supplemental label to satisfy all requirements.

All required information for labeling is either Static or Dynamic.

- Static info: generally, comes from cultivators or manufacturers and should not change by the time it is sold by a store - Dynamic info: may change each batch and must be labeled accurately each time by the cultivator or manufacturer before transfer.

Centers or stores may also have dynamic labeling often generated from their Point of Sale (POS) systems prior to final sale, which is covered more extensively in the following packaging and labeling lists.

MIPs must always ensure products are in containers and placed into shipping containers prior to sale or transfer to a store. MIPs have the responsibility of ensuring Packaging Compliance, but the Store Staff remains the gatekeepers and Products with packaging and labeling that do not meet these rules should be rejected.

It is the manufacturer’s responsibility to ensure Edibles are in child-Resistant Containers. RMS’s / MMC’s should reject product that is not labeled in a compliant manner. - A retail marijuana product manufacturing facility may bundle single- serving edible retail marijuana products that are individually packaged in child-resistant packaging into a larger package so long as the total amount of active THC contained within the bundled package does not exceed 100 milligrams and the external packaging complies with the serving size and total active THC statement requirement

146 © iComply, LLC 2019 V.05.22.19..01

MIPs can bundle a quantity of 10 single serving (10mg or less), child-resistant packaged, individually labeled edibles into a single package for sale that contains a total THC content less than 100mg. (Imagine a bag of child-resistant Jolly Ranchers or a blister pack.)

In the case of Single-Serving edible retail marijuana products of 10mg or less THC, the product does not have to re-open and reclose as child-resistant. It simply must be child- resistant upon the initial opening of the single-serving product.

Edibles may not be shaped or made to look like a Human, Animal, or Fruit or in any shape that bears the likeness or contains characteristics of a realistic or fictional human, animal, or fruit, including artistic, caricature, or cartoons.

*Note: This does not apply to the logo of a Marijuana Business and anything that is a geometric shape or simply fruit flavored or in the shape of a marijuana leaf.

Multiple Serving Edible Retail Marijuana Product “Multiple-Serving Edible Retail Marijuana Product” means an Edible Retail Marijuana Product unit for sale to consumers containing more than 10mg of active THC but no more than 100mg of total active THC. If the overall Edible Retail Marijuana Product unit for sale to the consumer consists of multiple pieces where each individual piece may contain less than 10mg active THC, yet in total all pieces combined within the unit for sale contain more than 10mg of active THC, then the Edible is considered a Multiple-Serving Edible Retail Marijuana Product. - Every MIP must ensure that each multiple serving edible product is individually packaged within a child-resistant container that maintains its child-resistant effectiveness for multiple openings prior to transport or transfer to another retail marijuana establishment. This applies to all Medical Edibles and Anything 10mgs or more in Retail.

147 © iComply, LLC 2019 V.05.22.19..01

Multiple-Serving Edible Retail Marijuana Product Demarcation. All MIPs must ensure that each single Standardized Serving of Marijuana of a Marijuana Product is physically demarked in a way that intuitively determines how much of the product constitutes a single serving of active THC. Each demarked Standardized Serving of Marijuana must be easily separable in order to allow an average person 21 years of age and over to physically separate, with minimal effort, individual servings of the product. Multiple serving edibles may be packaged in one child-resistant container (CRP), but the product itself must be able to be easily separated and be physically demarked so a reasonable person can determine how much to use. - The Child Resistant Container for multiple serving edibles, has to be just as difficult to open the 20th time it’s opened as the first (openable and resealable as CRP). - Individual 10mg Retail pieces are required to be individually packaged, but simply openable as CRP if individually contained.

Liquid edible marijuana product containing one standardized serving of marijuana. - A MIP must ensure that each single serving liquid edible retail marijuana product complies with the same requirements as single serving edible products in general above. This means a single- serving of 10mg or less is treated the same with liquid edible retail marijuana products as normal rules governing single-serving edible products and openable as CRP.

Liquid edible product with more than one standardized serving of marijuana. - A MIP must ensure that liquid edible products are packaged in a child-resistant container that maintains its child-resistant effectiveness for multiple openings in Medical and for anything over 10mgs in retail. The container must clearly demark each standardized serving of the liquid in a way that enables a reasonable person to intuitively determine how much of the product constitutes a single serving of active THC. The portion of the container that clearly demarks each standardized serving of marijuana need not be opaque, but the rest of the container should be.

148 © iComply, LLC 2019 V.05.22.19..01

General Labeling Requirements

Retail and Medical Marijuana, Marijuana Concentrate and Marijuana Infused Product Prior to Transfer to a Patient or Consumer - Font size no smaller than 1/16 of an inch - Not designed to appeal to children (no cartoons or similar images) - No false or misleading statements - Do not cause reasonable confusion to trademarked products or violate any federal trademark law or regulation. - No health or benefit claims - Use English language (may include added, accurate foreign translation) - Unobstructed and conspicuous information (can use multiple labels, can’t block labeling) - “Candy” or “Candies” prohibited unless in the Licensee’s Identity Statement - Child Resistant Certificate(s) required for all containers in compliance with 16 CFR 1700.15 and 16 CFR 1700.20 standards. - Container and Marketing Layer must meet all requirements - Exit packages: - MMC/RMS may, but are not required to, place Child-Resistant container into opaque exit package at point of transfer to consumer - Flower, trim, and seeds don’t need to be in Child-Resistant packaging until transfer to consumer, then opaque exit Child-Resistant packaging is required

* Above requirements do apply to all categories of retail and medical marijuana and marijuana product * Above requirements do apply to Containers immediately containing marijuana, marijuana concentrate, and marijuana infused product * Above requirements do NOT apply to shipping containers, sampling units, fibrous waste, etc. * Flower or trim for transfer to research facility or pesticide manufacturer only also must comply with all requirements

149 © iComply, LLC 2019 V.05.22.19..01

Statement of Intended Use Retail and Medical Marijuana, Marijuana Concentrate and Marijuana Product Prior to Transfer for all categories (excluding Seeds and Immature plants)

Inhaled Product Intended Use: (smoking or vaping only) 1. Flower or Trim (including pre-rolls/joints/Kief); 2. Concentrate (solvent-, water, heat/pressure based-concentrates); 3. Vaporizer cartridge/pen (or syringe-type device) i. Potency Statement required: stated either as a percentage, or the number of milligrams of total THC and CBD per cartridge or pen Oral Consumption Intended Use: (oral consumption only) 1. Infused food or drink; 2. Concentrate; 3. Pills and capsules; 4. Tinctures. i. Potency Statement required: stated as milligrams of active THC and CBD per serving and per Containers with more than one serving ii. Additional Warning Statement: - “The Intoxicating effects of this product may be delayed for up to 4 hours.” i. Expiration/Use-by Date ii. Production Date (may be included in Batch No.) iii. Refrigeration Statement (required for perishable products) Skin and Body Products Intended Use (external use only) 1. Topical; 2. Transdermal. i. Potency Statement required: topical stated as number of milligrams of active THC and CBD per Container, or transdermal stated as number of milligrams of active THC and CBD per product and per Container ii. Expiration/Use-by Date iii. Production Date (may be included in Batch No.) Audited Product Intended Use (specified use only) 1. Metered dose nasal spray; 2. Pressurized metered dose inhaler; 3. Vaginal administration; 4. Rectal administration. i. Expiration/Use-by Date ii. Production Date (may be included in Batch No.) No Other Intended Use Permitted (used defined though Alternate Use Designation approval)

150 © iComply, LLC 2019 V.05.22.19..01

Retail and Medical Marijuana, Marijuana Concentrate and Marijuana Product Prior to Transfer for all categories (excluding Seeds and Immature plants) 1. Alternative Use Product. i. Expiration/Use-by Date ii. Production Date (may be included in Batch No.) Multiple Intended Use(s) i. Any infused product having more than one intended use must list all intended uses from above and comply with all requirements for each intended use ii. Most restrictive requirements should be followed in the case that a conflict arises between labeling requirements

151 © iComply, LLC 2019 V.05.22.19..01

Permissive Information for All Marijuana, Marijuana Concentrate, and Marijuana Products

- Identity Statement may include, but not required to include, ID statement (aka, Standardized Graphic Symbol) for OPCO/RMCF, MMIPM/RMIPM or MMC/RMS - Nutritional Fact Panel in conformance with 21 C.F.R. 101.9(C) or 21 C.F.R. 101.36 - Any other information not included in current rules and requirements

Shipping Containers

- Ten (10) pound increments for marijuana, concentrate, and marijuana product in METRC and physically packaged - May consist of pre-weighed, pre-labeled, child resistant containers in small “ready for sale” amounts or bulk packaging to be weighed at the POS for final sale - Must be in tamper-proof container (tamper-evident tape, vacuumed or heat-sealed bags, etc.) - Multiple batches in one container means multiple RFID tags required - Reject marijuana or product if information is missing or incorrect

152 © iComply, LLC 2019 V.05.22.19..01

Shipping Container Packaging

On final packaging of product, after final processing and clear testing results come back, testing batches containing harvest batches are re-packaged into ten (10) pound increments for marijuana, concentrate, and marijuana product in METRC and physically packaged for final shipment. Packages may consist of pre- weighed, pre-labeled, child resistant containers in small “ready for sale” amounts or bulk packaging to be weighed at the POS for final sale to consumers. Packaging Containers - After processing/testing, before sale or transfer, batches must be weighed, packaged and labeled under camera in a Limited Access Area (LAA) - Log all dry weights for flower, trim, and concentrate into METRC and into internal Log book - (FINAL NET WEIGHTS) - Prepare and Package marijuana, concentrate, or infused, in increments of ten 10 lbs. (or less under camera in LAA). - May pre-package and pre-label smaller increments (1/8, ¼, ½, 1oz) - “SHIP READY FOR SALE” in CRP OR Send in Bulk weight for re-weighing, re- packaging, re- labeling at POS as consumers purchase smaller increments from bulk weight - Packages go into Tamper-evident Shipping Containers; examples include.. - Box with tamper-evident tape - Vacuum sealed, heat-sealed plastic bag o Zip-Lock bag(s) with tamper-evident tape BEST PRACTICE to make Shipping Containers Opaque - If there are multiple harvest or production batches inside the shipping container, then multiple RFID tags within the shipping container should be used and putting one on the shipping container itself is optional - If the RFID tag is on the Shipping Container only, then it serves as the package and can only contain one Harvest or Production Batch of Marijuana, Marijuana Concentrate, or Infused Product. Remember, much of the labeling information will carry over to the labels retailers must use to re-sell the wholesaled or transferred product. If labels are incorrect or missing, product should be rejected by the receiver or the receiver may also be held liable. In the case of pre-packaged infused product/edibles, pre-packaging into CRP containers and pre-labeling must be in place before being packaged for transfer to another establishment.

153 © iComply, LLC 2019 V.05.22.19..01

Universal Symbol

MIPs must ensure each Standard and Multiple Serving of Marijuana to have a MED designated Universal Symbol to appear on at each standard serving of Edibles to distinguish and easily recognize the Edible outside of its packaging. The Universal Symbol marking must be centered either horizontally or vertically on each Standardized Serving of Marijuana and on Packaging containing single or multiple servings of edibles.

- If centered horizontally on a serving, the height and width of the Universal Symbol must be at least 25% of the serving’s width, but not less than ¼ inch by ¼ inch; - If centered vertically on a serving, the height and width of the Universal Symbol must be at least 25% of the serving’s height, but not less than ¼ inch by ¼ inch. - On edibles, the Universal Symbol may be black or imprinted and does not have to be a particular color. On Packaging, this Universal Symbol must be RED.

If an Edible Marijuana Product is considered impracticable to mark, stamp, or otherwise imprint the Universal Symbol directly on the product so that it is distinguishable and easily recognizable, then it cannot have more than 10 mg of THC in Retail. In medical, these impracticable Edibles must meet packaging and labeling standards.

These edibles should be practicable to mark with the Universal Symbol: - Chocolate - Soft confections - Hard confections or lozenges - Consolidated baked goods (e.g. cookie, brownie, cupcake, granola bar) - Pressed pills and capsules These edibles are considered impracticable to mark with the Universal Symbol: - Loose bulk goods (e.g. granola, cereals, popcorn) - Powders

154 © iComply, LLC 2019 V.05.22.19..01

Symbols

MIPs cannot use a commercially manufactured food product as its Edible except:

- A food product that was commercially manufactured specifically for use by the MIP Licensee to infuse with marijuana. - The Licensee has a written agreement with the commercial food product manufacturer that declares the food product’s exclusive use by the MIP. - Commercially manufactured food products may be used as ingredients in an Edible so long as they are used in a way that makes them unrecognizable as the commercial food product in the final Edible and the MIP doesn’t state or advertise to that the final Edible contains the commercially manufactured food product. - MIPs still have the responsibility to comply with trademarked food product laws

“Marketing Layer” means packaging in addition to the Container that is the outermost layer visible to the consumer at the point of sale. The Marketing Layer is optional, but if used, it still must comply with labeling regulations in addition to the actual container of product.

155 © iComply, LLC 2019 V.05.22.19..01

Note: All Packaging and Labeling must be done under dedicated cameras in a limited access area and weights derived from tested, approved, and regularly maintained and calibrated scales. A MIP may never use the word “candy” or “candies” on any package or labeling nor make false health or benefit claims. All labeling font must be at minimum 1/16th inch size, in English, and no labeling may be obstructed on any container.

New in 2019, sealed vaporizer cartridges, disposable vaporizer pens, and syringe-type devices ARE NOT required to have the statements “Contains Marijuana. Keep away from children.”, but ARE required to have the Universal Symbol (and must comply with size measurements)

156 © iComply, LLC 2019 V.05.22.19..01

Flower and Trim – Packaging and Labeling Prior to Transferring to any License Medical Marijuana Flower and Trim & Retail Marijuana Flower and Trim

Packaging: Marijuana Flower and Trim - Sealed Package Container (CRP not required) - 10 lbs or less per package Labeling (Container AND Marketing Layer): Marijuana Flower and Trim - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. for Water-Based Concentrate (static/dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Potency statement - percentage (dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Statement of Intended Use (static)

157 © iComply, LLC 2019 V.05.22.19..01

Concentrate – Packaging and Labeling Prior to Transferring to any License Medical Marijuana Concentrate & Retail Marijuana Concentrate

Packaging: Marijuana Concentrate - Sealed Package Container (CRP not required) - 10 lbs or less per package Labeling (Container AND Marketing Layer): Marijuana Concentrate - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. for Water-Based Concentrate (static/dynamic) - MMIPM/RMPMF License No. (static) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Potency statement - percentage (dynamic) - Solvent List (static/dynamic) - Ingredient List including Allergens (static/dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Statement of Intended Use (static)

158 © iComply, LLC 2019 V.05.22.19..01

Infused Product – Packaging and labeling Prior to Transferring to any License (excluding MMC and RMS Licenses) Medical Marijuana Infused Product & Retail Marijuana Product

Packaging: Marijuana Infused Product for Transfer to MMB/RME other than MMC/RMS - Sealed Package Container (CRP not required) Labeling (Container AND Marketing Layer): Marijuana Infused Product for Transfer to MMB/RME other than MMC/RMS - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMIPM/RMPMF License No. (static) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Potency Statement – dependent on product (dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Statement of Intended Use (static)

159 © iComply, LLC 2019 V.05.22.19..01

Infused Product – Packaging and Labeling Prior to transfer to MMC and RMS Licenses only Medical Marijuana Infused Product & Retail Marijuana Product

Packaging: Marijuana Infused Product for Transfer to MMC/RMS only - Sealed Child-Resistant Package Labeling (Container AND Marketing Layer): Marijuana Infused Product for Transfer to MMC/RMS only - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMIPM/RMPF License No. (static) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement (static) - Ingredient List (dynamic) - Potency Statement – product dependent (dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Solvent List (static) - Ingredient List including Allergens (static/dynamic) - Required Warning Statements: (static) - “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” - “This product complies with testing requirements.”, OR “This product has not been tested.” (medical only) - Statement of Intended Use (static)

160 © iComply, LLC 2019 V.05.22.19..01

Seeds and immature Plants - Packaging and Labeling Prior to Transfer to any License Medical Marijuana Seeds and Medical Immature Plants & Retail Marijuana Seeds and Retail Immature Plants

Packaging: Marijuana Seeds - Sealed Package Container (CRP not required) - 10 lbs or less per package Packaging: Immature Plants - Sealed Package Container (CRP not required) Labeling: Marijuana Seeds and Immature Plants - OPCO/RMCF License No. (static/dynamic)

161 © iComply, LLC 2019 V.05.22.19..01

Flower and Trim – Packaging and Labeling Prior to Transfer to Patient or Customer Medical Marijuana Flower and Trim & Retail Marijuana Flower and Trim

Packaging: Marijuana Flower and Trim - Sealed Child-Resistant Package for transfer - Exit Package required for non-Child Resistant Container Labeling (Container AND Marketing Layer): Marijuana Flower and Trim - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMC/RMS License No. (dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement (static) - Potency Statement – percentage/ranges (dynamic) - Date of Sale (dynamic) - Patient No. (medical only) (dynamic) - Ingredient List including Allergens (static/dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Required Warning Statements: (static) - “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” - “This product complies with testing requirements.”, OR “This product has not been tested.” (medical only) - Statement of Intended Use (static)

162 © iComply, LLC 2019 V.05.22.19..01

Concentrate - Packaging and Labeling Prior to Transfer to Patient or Customer Medical Marijuana Concentrate & Retail Marijuana Concentrate

Packaging: Marijuana Concentrate - Sealed Child-Resistant Package for transfer - Exit Package required for non-Child Resistant Container Labeling (Container AND Marketing Layer): Marijuana Concentrate - License No. OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMIPM/RMIPM License No. (static) - MMC/RMS License No. (dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement *excludes vape carts, disposable vape pens, and syringes (static) - Potency Statement – percentage/ranges (dynamic) - Date of Sale (dynamic) - Patient No. (medical only) (dynamic) - Solvent List (static/dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Ingredient List including Allergens (static/dynamic) - Required Warning Statements: (static) - “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” - “This product complies with testing requirements.”, OR “This product has not been tested.” (medical only) - Statement of Intended Use (static)

163 © iComply, LLC 2019 V.05.22.19..01

Infused Product (non-Edible) – Packaging and Labeling Prior to Transfer to Patient or Consumer Medical Marijuana Infused Product & Retail Marijuana Product

Packaging: Marijuana Infused Product (Non-Edible) - Sealed Child-Resistant Package Packaging: Audited Product (Non-Edible) - Rectal administration Child-Resistant Container required for transfer to patient/consumer - Metered dose nasal spray, pressurized metered dose inhaler, and vaginal administration products require Child-Resistant Container Labeling (Container AND Marketing Layer): Marijuana Infused Product (Non-Edible) - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMIPM/RMIPM License No. (static) - MMC/RMS License No. (dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement *excludes vape carts, disposable vape pens, and syringes (static) - Potency Statement – milligrams (dynamic) - Date of Sale (dynamic) - Patient No. (medical only) (dynamic) - Solvent List (static/dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Ingredient List including Allergens (static/dynamic) - Required Warning Statements: (static) - “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” - “This product complies with testing requirements.”, OR “This product has not been tested.” (medical only) - Statement of Intended Use (static)

164 © iComply, LLC 2019 V.05.22.19..01

Infused Product (Edible) – Packaging and Labeling Prior to Transfer to Patient or Consumer Medical Marijuana Infused Product & Retail Marijuana Product

Packaging: Marijuana Infused Product (Edible) - Child-Resistant Package (resealable single serving not required) - Retail marijuana product only: - Single serving Container need not be resealable, - Bundled single serving product in Container placed into larger Marketing Layer may not exceed 100 milligrams of total active THC per Marketing Layer, - Multiple serving product mustbe in resealable Container and may not exceed 100 milligrams of total active THC per Container Packaging: Marijuana Infused Product (Liquid Edible) - Child-Resistant Package (resealable single serving not required) - Retail marijuana product only: - Multiple serving product in package with both Child-Resistance and accurate serving measurement capabilities for serving of 10mgs of THC or less in Container with no more than 100 milligrams of total active THC per Container Labeling (Container AND Marketing Layer): Marijuana Infused Product (Edible and Liquid Edible) - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. of Water-Based Concentrate (static/dynamic) - MMIPM/RMIPM License No. (static) - MMC/RMS License No. (dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement *excludes vape carts, disposable vape pens, and syringes (static) - Potency Statement – milligrams (dynamic) - Date of Sale (dynamic) - Patient No. (medical only) (dynamic) - Solvent List (static/dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Ingredient List including Allergens (static/dynamic) - Required Warning Statements: (static)

165 © iComply, LLC 2019 V.05.22.19..01

Medical Marijuana Infused Product & Retail Marijuana Product

- “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” - “This product complies with testing requirements.”, OR “This product has not been tested.” (medical only) - Statement of Intended Use (static)

166 © iComply, LLC 2019 V.05.22.19..01

Seeds and Immature Plants – Packaging and Labeling Prior to Transfer to Patient or Customer Medical Marijuana Seeds and Medical Immature Plants & Retail Marijuana Seeds and Retail Immature Plants

Packaging: Marijuana Seeds - Sealed Child-Resistant Package for transfer - Exit Package required for non-Child Resistant Container Packaging: Immature Plants - Receptacle need not be Child-Resistant at point of transfer Labeling: Seeds and Immature Plants - OPCO/RMCF License No. (static/dynamic) - OPCO/RMCF License No. - MMC/RMS License No. (static/dynamic) - Batch No(s). (dynamic) - Net Contents (dynamic/static) - Universal Symbol + Statement (static) - Date of Sale (dynamic) - Patient No. (medical only) (dynamic) - Non-organic Pesticides (medical only) (static/dynamic) - Required Warning Statements: (static) - “This product was produced without regulatory oversight for health, safety, or efficacy.” - “There may be long term physical or mental health risks from use of marijuana, including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.”

167 © iComply, LLC 2019 V.05.22.19..01

Compliance is a team effort, and we’re a part of your team.

ASK ABOUT OUR COMPLIANCE PACKAGES TO TAKE COMPLIANCE MANAGEMENT TO THE NEXT LEVEL!

168 © iComply, LLC 2019 V.05.22.19..01

Thank You!

For Support, Questions, Feedback Contact Us [email protected] www.icomplycannabis.com

169 © iComply, LLC 2019 V.05.22.19..01