I believe some work with smaller local credit unions who only have in-state business. Not sure if these credit unions are in the clear or just minimally exposed to federal prosecution though?
Rohrabacher-Farr, as long as it is in effect, is pretty much a complete bar to federal prosecution for in-state actions associated with state-approved medical marijuana activities (both on its face and, because DoJ tried to narrow it in practice and got challenged, this is also fairly well tested in the courts.)
Of course, that's tied to federal spending bills and needs renewed with each new spending authorization, so without timely and full-year budgets it's kind of perpetually at risk of near-term expiration.