For instance, curaleaf, the largest cannabis company includes this bit:
"The Company derives its revenues from the cannabis industry in certain states of the U.S., and the industry is illegal under U.S.
federal law.
The Company is involved (through its licensed subsidiaries) in the cannabis industry in the U.S. where local state laws permit such activities. Currently, its subsidiaries and managed entities are directly engaged in the cultivation, manufacture, processing, sale and distribution of cannabis and hold licenses in the adult-use and/or medicinal cannabis marketplace in the states of Arizona, Arkansas, Colorado, Connecticut, Florida, Illinois, Kentucky (hemp only), Maine, Maryland, Massachusetts, Michigan, Missouri, Nevada, New Jersey, New York, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Utah, and Vermont; and have partnered with an accredited medical school and obtained a “clinical registrant” license in Pennsylvania. In addition, the Company is indirectly involved (through management services which include the use of the “Curaleaf” brand and retail and cultivation and production operations, human resources, finance and accounting, marketing, sales, legal and compliance support services) in both the adult-use and medical cannabis industry in the states of Maine and Arkansas."
in their 40-F filing here: https://last10k.com/sec-filings/curlf