Every state builds different verification tools, but the procedure barely changes — a repeatable sequence that works anywhere, with honest workarounds for the states that make it hard.
License verification is the seatbelt of cannabis commerce: uneventful almost every time, and the only thing that matters on the day it matters. Whether you are an ancillary vendor onboarding a new client, an operator vetting a supply partner, or a landlord reviewing a prospective tenant's paperwork, the underlying question is identical — is this business actually authorized to do what it claims — and the answer never lives in the counterparty's marketing materials. It lives in the issuing state's own records. The walkthrough below is written to work in any state. The tools vary far more than the procedure does, so the steps are generic and the hedges are explicit.
The first step is identifying the issuing authority, because cannabis licensing is entirely state-based and the agency whose opinion governs differs by jurisdiction. In many states, licensing runs through a standalone cannabis commission or office. In others, it sits inside a larger department — agriculture, revenue, health, or an alcohol control board. Some states split authority between programs, with one agency handling medical licenses and another handling adult-use, and permits for hemp-derived products often live with an agriculture department even where cannabis has its own dedicated regulator. Getting the agency right matters because lookalike records — a corporate registration, a hemp permit, a municipal business license — can create false confidence that a cannabis license exists when it does not. A business can be perfectly registered with the secretary of state and hold no cannabis authorization at all.
The second step is finding the official lookup. Most states publish some public way to check licensees: a searchable portal, a downloadable roster, or, in the less generous cases, a periodically refreshed document posted on an agency page. The reliable route runs through the agency's own website, reached directly rather than through whatever a search engine surfaces first, because unofficial directories and commercial lookalikes are common and vary widely in quality and currency. Third-party databases — this platform included — are a fine place to begin a search and a poor place to end one when the stakes are real. For any decision that matters, the state's own record is the reference the state itself will stand behind.
The third step is collecting the right identifiers before you search. Ask the counterparty for two things: the registered legal entity name and the license number. Brand names are the leading cause of failed searches, because most registries index licenses by legal name, and the business known locally by its storefront sign may be licensed under an unrelated-sounding company. A licensed business fields this request routinely and answers it without friction; hesitation or evasion in response to it is, in itself, information worth noticing.
The fourth step is running the search and reading misses correctly, because zero results does not immediately mean unlicensed. Search the license number alone first if you have it, since number searches sidestep spelling problems entirely. Then try variations of the entity name: punctuation, abbreviations, ampersands, and corporate suffixes all trip exact-match systems. Check the other program track, since medical and adult-use licenses sometimes live in separate lists, and check the other agency where a state splits authority. Only after those misses accumulate does absence begin to mean something — and at that point the question to the counterparty changes from what is your license number to why does the state not show it.
The fifth step is reading the record you find. Confirm the status field first, using the state's own vocabulary: active means what it says, while conditional or provisional generally means approved but not yet authorized to operate, and suspended, expired, surrendered, and revoked each carry different implications that deserve a follow-up question rather than an assumption. Check the expiration date, since a license close to expiring without visible renewal activity is worth asking about before a sizable transaction. Check the license type against the activity in front of you, because holding a license is not the same as holding the right license — cultivation authorization does not cover retail sale, and a medical-track license may not cover adult-use commerce in states that separate them. Finally, check the premises address against the location where business is actually being done, since most states tie a license to a specific site rather than to a company generally.
The sixth step is cross-checking identity between the record and the paperwork in front of you. Match the entity name on the license against the name on the contract or invoice, the premises address against the address you ship to or visit, and the license number against the one printed on the counterparty's documents. Small mismatches often have innocent explanations — an outdated suite number, a parent and subsidiary sharing a brand — but they are cheap to ask about and expensive to ignore. The classic failure mode in this industry is not a forged license; it is a valid license that belongs to a different entity than the one signing the agreement.
The seventh step is handling the hard states, because not every jurisdiction makes verification easy. Some publish records only through one-at-a-time lookup portals. A few publish nothing usable and answer only formal public records requests. In those states, the workaround stack looks like this: search whatever the portal allows; request a roster from the agency if one exists; ask the counterparty for its license certificate and then confirm that document with the agency directly, since certificates can be outdated or superseded; and for high-stakes relationships, put the verification question to the agency in writing, which most will answer. Slower is not the same as impossible, and the difficulty of checking is never a reason to skip the check.
The eighth step is documenting what you found. A verification that lives in someone's memory is worth little a year later. Save the record — a dated screenshot or export, the registry's own as-of date if it displays one, a note of who ran the check and when. This small habit converts a compliance gesture into an audit trail, and it protects both sides of any later dispute about who knew what and when they knew it.
The ninth step is re-verifying on a rhythm, because licenses change status mid-relationship. Renewals lapse, suspensions land, entities restructure, and a check performed at onboarding answers the question only for that day. The durable practice is a cadence: before contract renewals, before materially larger orders, when payment behavior changes, and on a simple calendar otherwise. Recurring counterparties deserve recurring checks, and the businesses most worth working with tend to respect the diligence rather than resent it.
None of this requires specialized expertise; all of it requires the discipline to prefer the primary source over the convenient one. When a record is ambiguous, the agency itself answers questions, and a cannabis-licensing attorney in the relevant state is the right escalation when a transaction is large enough to deserve one. The procedure is boring by design. In verification, boring is what success looks like.
General information, not legal, tax, or medical advice.