CORI requirements for hiring at a Massachusetts dispensary

Before anyone can work at a Massachusetts marijuana establishment, the establishment registers them with the Cannabis Control Commission as an agent, and an executive registered with iCORI submits a CORI report for them at Required Access Level 2, obtained no more than 30 calendar days before it is submitted (935 CMR 500.030(3)). The Commission decides whether the person is suitable. How you request, store and act on that CORI is governed by the Department of Criminal Justice Information Services (DCJIS) rules in 803 CMR 2.00.

This covers the Commission's rules current as of the June 18, 2026 revision of 935 CMR 500.000 and 803 CMR 2.00 as last amended in June 2021. It is not legal advice.

Who needs to be registered

Every employee, owner, executive and volunteer, not only people who handle product (500.030(1)). Each must be 21 or older, must not have a conviction for distributing controlled substances to minors, and must be found suitable under 500.800 and 500.802. The application includes name, date of birth, address, any other names used, a copy of ID, and criminal, civil, licensing and disciplinary history (500.030(2)).

After registration, notify the Commission within one business day when an agent leaves (500.030(4)), and within five business days of any change to the information you submitted (500.030(6)).

Running the CORI

1. Register your organization with iCORI. An executive accepts the terms, completes CORI training and signs the iCORI agency agreement (803 CMR 2.04). Registration lasts two calendar years. DCJIS lists the organization request fee as $25.
2. Get a signed CORI Acknowledgment Form from the applicant, verify their identity, and sign and date the form yourself (803 CMR 2.11(1)). The form can be collected electronically (2.12).
3. Verify identity in one of the ways 2.11(5) allows: in person against government photo ID, videoconference, a notarized form, or another method DCJIS approves. An employer that verifies by videoconference completes in-person or notarized verification within seven days of the person starting work.
4. Request at Required Access Level 2, which includes pending charges, non-conviction offenses and all adult convictions (803 CMR 2.05(3); 935 CMR 500.030(3)).
5. Submit the report to the Commission within 30 calendar days of obtaining it. One exception: no new report is needed for someone moving between licensees under common control whose CORI was run in the previous calendar year.

The acknowledgment form is valid for one year, or until employment ends (2.11(7)). After a year a new form is needed, but identity does not have to be verified again if the name and date of birth match exactly (2.13).

What the Commission weighs

The suitability tables in 935 CMR 500.802 decide, not the employer. A few points operators ask about most:

• A conviction solely for a marijuana offense, or under M.G.L. c. 94C, section 34, is not disqualifying unless it involved distribution to a minor (500.802(1)).
• A conviction or continuance without a finding for distributing a controlled substance to a minor is a mandatory, indefinite disqualification (Table B).
• Juvenile dispositions are not considered, and lookback periods run from the disposition, or from release if the person was incarcerated (500.802(2)).
• Agents must report a relevant arrest or summons, and its outcome, to the Commission within ten days (500.802(3)).

Storing CORI

• Who sees it: only people on your written need-to-know list, updated at least every six months (803 CMR 2.18). An organization running five or more checks a year needs a written CORI policy.
• How long: acknowledgment forms at least one year from signature (2.11(11)); CORI and forms no longer than seven years from the later of the last day of employment or the final hiring decision (2.14(4)).
• How: locked or encrypted, and destroyed by shredding or burning, or by deleting or overwriting electronic copies (2.14 and 2.15).
• Personnel files are kept 12 months after an agent leaves under 935 CMR 500.105(9).

Before an adverse decision

If you decide not to hire, or to take action against an employee, based on CORI, 803 CMR 2.20 requires you to:

1. Tell the person, and give them a copy of the CORI and its source.
2. Give them your CORI policy.
3. Identify the information that is the basis for the decision.
4. Let them dispute its accuracy or relevance.
5. Give them DCJIS's information on how to correct a record.
6. Document every step.

935 CMR 500.802 still cites these duties under their old numbers, 2.17 and 2.18. The current sections are 2.19, the secondary dissemination log, and 2.20, adverse employment decisions.

Federal Fair Credit Reporting Act duties such as the separate disclosure and pre-adverse-action notice attach, under 803 CMR 2.22, when a consumer reporting agency obtains the CORI for you. Ask counsel which rules apply to the way you request it.

Where BudLogix fits

BudLogix keeps the roster of who is registered and whose required personnel paperwork is short, and moves applicants from inbox to hire with their onboarding packet. Registration with the Commission and the iCORI request itself stay with you. About Team.