DEA Form 106 is the federal report a registrant files after a controlled substance is stolen or goes missing, and it has two clocks running side by side. Send written notice to your local DEA Field Division Office within one business day of discovering the incident, then submit the completed Form 106 through the DEA’s online Theft Loss Reporting portal within 45 days of that same discovery date.1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners The form also covers missing disposal receptacles, mail-back packages, and inner liners.2Drug Enforcement Administration. Theft Loss Reporting
When You Have to File
Every theft of a controlled substance triggers a mandatory report, regardless of the amount. Losses are different. A loss requires reporting only if it is significant, and 21 CFR 1301.76(b) lists six factors registrants weigh to make that call:1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners
- Quantity of the substance missing relative to the size of your business.
- The specific substance, with Schedule II opioids carrying more weight than a Schedule V preparation.
- Whether the loss can be tied to a particular individual or activity.
- A pattern of losses over time, even small ones, that together may qualify.
- Whether the substance is one commonly diverted for illicit use.
- Local diversion trends for that substance.
Minor inventory discrepancies from counting errors or documented breakage typically do not clear the threshold, and the DEA’s portal warns registrants not to use Form 106 to correct minor shortages.2Drug Enforcement Administration. Theft Loss Reporting Either way, write down how you worked through the six factors. If an investigator later asks why you did or did not file, contemporaneous notes are worth far more than a recollection.
Step One: Written Notice to the Field Division Office
Before you open the online form, put the DEA on notice. Within one business day of discovering the theft or significant loss, send written notification to the Field Division Office covering your area.3Drug Enforcement Administration. Theft/Loss Reporting The DEA operates 23 domestic divisions; contact details are on the divisions page at dea.gov.4Drug Enforcement Administration. Divisions
The rule says “in writing,” so email, fax, or a mailed letter all satisfy it. Keep a copy showing the date sent and the office you sent it to. You will want that record when the inspector asks for it.
What to Gather Before You Log In
The online system moves quickly and does not always let you resume a partial form later. Have this information in front of you before starting:
- Your DEA registration number and the business name or last name exactly as they appear on your registration. The login screen matches these fields.2Drug Enforcement Administration. Theft Loss Reporting
- The incident date, the location, and the date of discovery if different.
- The category of incident: night break-in, armed robbery, employee pilferage, or another type.
- The name of the police department contacted and any case or report number.
- The National Drug Code for each missing product. Entering the NDC auto-populates the product name, dosage form, and strength.3Drug Enforcement Administration. Theft/Loss Reporting
- Quantities. Tablets are entered as total tablet count; liquids and powders as total milliliters or milligrams.2Drug Enforcement Administration. Theft Loss Reporting
- Estimated value, meaning the purchase cost of the missing substances.
Reports of listed chemicals rather than controlled substances take quantities in total milligrams or kilograms. The portal picks the right form based on your registrant type and the data you enter.
Filing Form 106 Online
Paper submissions are no longer accepted. A DEA final rule requires all Form 106 filings to go through the Diversion Control Division’s secure network application.5Federal Register. Reporting Theft or Significant Loss of Controlled Substances A registrant who believes an exception is warranted may request one in writing under 21 CFR 1307.03, but the standard is high.
Begin at the Theft Loss Reporting login page at apps.deadiversion.usdoj.gov/TLR. Enter your DEA number and the business or last name from your registration. The system routes you to the correct form based on your registration type. Work through the screens with the incident details, law enforcement information, and the itemized list of missing substances by NDC. Review quantities and the incident category before submitting.5Federal Register. Reporting Theft or Significant Loss of Controlled Substances
The 45-day window runs from the date of discovery, not the date the incident occurred. It exists so you can investigate and reach a final count before filing.1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners That deadline does not replace the one-business-day written notice; both apply.
If the portal is down, call the DEA Help Center at 1-800-882-9539 to report the outage. Note the date and time of your attempt and keep that record with the confirmed submission once you file.5Federal Register. Reporting Theft or Significant Loss of Controlled Substances
After You Submit
Once the form goes through, the system offers a copy to save or print. Do both. Registrants must keep a copy of the filed Form 106 for at least two years and produce it for DEA investigators on request.2Drug Enforcement Administration. Theft Loss Reporting The general recordkeeping rule at 21 CFR 1304.04 sets the same two-year floor for inventories and records under Part 1304.6eCFR. 21 CFR 1304.04 – Maintenance of Records and Inventories
File the printed copy with your controlled substance records so it is immediately accessible during an inspection. Keep the initial written notice to the Field Division Office alongside it. Inspectors ask for both.
Penalties for Not Reporting
Failing to report a theft or significant loss exposes registrants to penalties under Sections 402 and 403 of the Controlled Substances Act.3Drug Enforcement Administration. Theft/Loss Reporting Under 21 U.S.C. 842, a negligent failure to make a required report carries a civil penalty of up to $25,000 per violation. A knowing failure is criminal, punishable by up to one year in prison, a fine, or both. A second or subsequent knowing violation after a prior conviction raises the maximum imprisonment to two years.7Office of the Law Revision Counsel. 21 USC 842 – Prohibited Acts B
The registration itself is also at stake. The DEA can revoke, suspend, or deny renewal when continued registration would be inconsistent with the public interest, and missed or sloppy theft reports draw scrutiny at renewal time.