Unless you are in or have business customers in one of the states where marijuana is legalized in some fashion, I question the need for the provision. However, if you need it, you are right to parse your words very carefully as any third party reviewer can pick it apart.
If this was an academic debate, I would offer: We will not knowingly provide services to customers whose businesses operate in violation of state or federal law. Critiquing my own example, any business you file a SAR on; e.g. for structuring, is allegedly operating in violation of the law. So, a single SAR filing requires account closure or calling a loan?
Operating in the real world, I would plug the word "knowingly" into your straightforward or KISS example; i.e. move to "satisfy the examiners" rather than reach some theoretical perfection.
Whatever you say in your policy should be reflected in your due diligence questions; i.e. you don't want to prohibit a relationship, but then fail to ask questions that might bring the prohibited activity to your attention. Internet gambling, marijuana related business, etc. Make certain the folks on the lending side know this applies to them too.