Category 5 is the mild one. Improper record-keeping, a labeling problem, the filing nobody got to — and the published penalty range runs from $5,000 to $50,000.
Then read the sentence under the table: penalties escalate with repeat offenses, and each day not in compliance counts as a separate violation.
What is remarkable is not the size of the fines. It is that New Jersey wrote all of it down — the categories, the ranges, the guidance, the inspection reports, the enforcement notices with the licensee's name at the top. I have rarely seen an industry handed this much free information and open so little of it.
The penalty schedule is a table, not a judgment call
The Commission's guidance document, Avoiding Violations, sorts violations into five categories against the Personal-Use Cannabis Rules at N.J.A.C. 17:30-20.
- Category 1 — a pattern of violations posing serious risk to health or safety, such as repeatedly selling contaminated product. Revocation.
- Category 2 — administrative failure posing immediate and serious risk, or actual harm, such as transferring cannabis to a minor. Up to $500,000, suspension or revocation.
- Category 3 — fraudulent or misleading information, falsified or concealed records, such as falsified test results. Up to $500,000 and revocation.
- Category 4 — failure to register, to obtain Cannabis Business Identification Cards, or to complete required training, such as employees working without their cards. $10,000 to $50,000 and suspension.
- Category 5 — other regulatory violations that are not major. $5,000 to $50,000.
Category 4 should make a retailer uncomfortable, because it is an onboarding problem, not a judgment problem. A new hire covers three shifts while a card is pending, and the published range starts at five figures.
The Commission wrote the guide to avoiding its own fines
Avoiding Violations opens with boilerplate — "Proactive compliance is key to operating successfully in New Jersey's regulated cannabis market" — and then says something that is not: each license holder has access to a dedicated NJ-CRC compliance officer who can help clarify rules and prevent violations.
Read that twice. The state assigns you somebody whose job includes telling you how not to get fined, free. Consultants quote four figures for the same answer. The Facebook operator groups give it away wrong.
Every enforcement notice carries a name
The Violations and Enforcement library indexes actions by year, 2020 through 2025, in ten categories. The document types show how a matter travels: Notice of Violation, Notice of Enforcement Action, corrective action plan, Notice of Civil Monetary Penalty, and the closing resolution.
Columbia Care New Jersey received one dated January 9, 2025 citing failure to make a good faith effort to enter a collective bargaining agreement within 200 days of opening, found through "an investigation which commenced on December 23, 2024, and remains ongoing."
2026 has been heavier: Mollitiam's licenses were revoked on July 16 over nineteen violations, and Verano was fined $20,500. None of it needed a records request, which is the same uncomfortable point as how public your company's file already is.
The monitoring reports show how a case gets built
The monitoring reports are the part worth an hour: they let you watch an investigator work.
One covers a January 7, 2023 monitoring of Acreage/CCF NJ in Egg Harbor Township, opened by a patient's complaint about a long wait at a Williamstown dispensary. The investigator called the patient back, verified identity against the registry and a driver's license, then pulled the facility's own video: entry at 11:11:10, point of sale at 11:28:43, "a total of 17 minutes and 30 seconds." The management system showed that during that wait "3 medicinal marijuana patients sales were completed and 19 adult use consumers were served." The site ran five POS stations. Its own certification had promised distinct medical terminals and a stanchioned queue. It was maintaining one.
Notice what built that case: your video, your registry record, your POS data. Nothing came from a third party. The gap was between what the business certified and what it did on a Saturday morning.
A separate TerrAscend notice over two May 2023 transactions in Lodi and Maplewood turned on single employee decisions — a patient pushed to the adult-use menu, another told to come back during recreational hours — against the standard that "an alternative treatment center shall meet the anticipated treatment needs of registered qualifying patients before meeting the retail requests of cannabis consumers." Both came from customer complaints.
Twenty business days is the whole window
The Columbia Care notice sets out the clock plainly: "Within 20 business days of the receipt of the Notice of Violation, Columbia Care shall (1) Correct the violation; (2) Notify the Commission, in writing."
Roughly a calendar month, running from receipt — not from the moment somebody inside the company decides to deal with it. Whether a fix counts as corrected is a question for your cannabis attorney. The deadline itself is published.
The officer you have never called
The Office of Compliance and Investigation describes its own work as investigating non-compliance, inspecting businesses "for compliance with operational requirements," making "recommendations for remediation," and carrying out enforcement where warranted. Recommendations for remediation. That is a help desk inside an enforcement office, and most operators only meet it in its second mode.
- The Commission's Avoiding Violations guidance, under Violations and Enforcement. Read the category table and the escalation sentence underneath it.
- The violations index for your own license class, newest year first. You are looking for the rule numbers that keep recurring.
- One monitoring report, start to finish, to see exactly which of your systems an investigator pulls from.
- Your own SOPs and license certifications, read against what your floor actually does. That gap is where the Egg Harbor matter lived. An inspection looks at the same things: alarm and video working, POS and inventory synced to Metrc, filed procedures actually in use.
- Your assigned compliance officer's contact details. Then use them, before you need them.
What the Commission will not tell you
The limits are published too. The Commission is blunt in its own FAQ: it does not "perform any law enforcement duties," does not "direct municipal action on permitting or zoning of cannabis businesses," and cannot "overrule or conflict with existing statutes."
It will not tell you whether a deal structure works, what your tax position is, whether your landlord's consent clause survives a change of control, or whether your cure letter is adequate. Those belong to your cannabis attorney and your CPA, and using the free channel for rule questions is what pays for them on the real ones.
It will not clean the record either. The record stays.
Buyers read this library. A diligence team can work through every published action against your license in an afternoon, because the state indexed it by year with your company's name attached. Unresolved compliance violations commonly take twenty to thirty percent off a valuation, and the discount is rarely about the fine itself — it is about what an open file implies regarding everything nobody has looked at yet. I have written before about how a New Jersey dispensary actually gets priced, and about how long the Commission's own calendar makes a transfer take. Compliance sits upstream of both. The cheapest hour you spend this quarter may be the one where you call a state employee and ask a question you are a little embarrassed not to know the answer to. Then look at what is trading in New Jersey and ask yourself which of those files you would want opened.