DEA Form 106 is the federal report every DEA registrant must file after discovering a theft or significant loss of controlled substances. Under 21 CFR 1301.74(c) and 1301.76(b), reporting happens in two steps: a written notification to your local DEA Field Division Office within one business day of discovery, and a completed Form 106 submitted through the DEA’s online system within 45 calendar days.1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners Missing either step, or filing inaccurately, can trigger civil penalties now exceeding $19,000 per violation and, where information is intentionally falsified or omitted, criminal exposure of up to four years in prison.
When You Have to File
The regulation splits reportable events into two categories. Every theft of a controlled substance must be reported, no matter the quantity. A single missing vial counts. For losses that aren’t clearly theft, only those that qualify as “significant” trigger the reporting duty.2Drug Enforcement Administration Diversion Control Division. Theft/Loss Reporting
What counts as significant is left to the registrant, because a loss that matters at a small pharmacy could be routine at a large manufacturer. The regulation lists six factors to weigh:1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners
- The quantity missing relative to your typical volume of that substance.
- The specific substance involved, since a small amount of a high-potency Schedule II drug is more concerning than a larger shortage of a Schedule V preparation.
- Whether specific individuals had access, pointing toward diversion rather than a recordkeeping error.
- Patterns over time, because repeated small shortages can add up to a significant aggregate loss even if no single occurrence stands out.
- The diversion potential of the substance.
- Local diversion trends and other indicators of theft activity in your area.
The DEA has said the registrant is “best positioned to determine whether a loss rises to the level of a significant loss.”3Federal Register. Reporting Theft or Significant Loss of Controlled Substances When in doubt, filing is safer. Reporting a loss that turns out to be minor carries no penalty; failing to report one the DEA later deems significant does.
When Form 106 Does Not Apply
Form 106 is only for thefts and unexplained losses. If a controlled substance is broken or spilled and someone witnesses it happen, the substance is accounted for and not “lost” in the regulatory sense. No Form 106 and no one-business-day notification are required.4Federal Register. Reports by Registrants of Theft or Significant Loss of Controlled Substances Damaged but recoverable substance is handled through DEA Form 41 or a registered reverse distributor; a completely unrecoverable spill is documented in your inventory records and signed by two witnesses. Witnessed breakage stays in your files. Unexplained disappearances go to the DEA.
What the Form Asks For
Form 106 collects two categories of information: your registration details and the incident details.
On the registration side, you provide your legal business name, the physical address of the registered location, and your DEA registration number.2Drug Enforcement Administration Diversion Control Division. Theft/Loss Reporting
On the incident side, you list the date you discovered the loss and, if known, the date it occurred. You categorize the event using descriptors such as armed robbery, night break-in, employee pilferage, or customer theft, and add details about the method of entry or nature of the diversion.
Missing substances are identified by National Drug Code. When you enter the NDC, the online system auto-populates the product name, dosage strength, and quantity per container.2Drug Enforcement Administration Diversion Control Division. Theft/Loss Reporting You then enter the total units missing, whether that’s tablets, capsules, or milliliters.
Cross-reference your perpetual inventory logs and purchase invoices before submitting. Inaccurate quantities are the most common problem with Form 106 filings. If a local police report exists, include the case number so the DEA can coordinate with investigators.
The Two Deadlines and How to Submit
The two deadlines run in parallel, not one after the other. Registrants frequently confuse this.
The first is the one-business-day written notification. As soon as you discover a theft or significant loss, notify the DEA Field Division Office in your area in writing within one business day.1eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners The DEA does not prescribe a specific format. Different field offices prefer different methods, so contact yours to find out whether they want a fax, email, or another written format.3Federal Register. Reporting Theft or Significant Loss of Controlled Substances This preliminary notice is intentionally brief and puts the DEA on alert while you investigate.
The second is the 45-calendar-day deadline to file the completed Form 106 through the DEA Diversion Control Division’s secure online application.5eCFR. 21 CFR 1301.74 – Other Security Controls for Non-Practitioners That window exists so you can investigate thoroughly and make a final determination of what is missing before filing.3Federal Register. Reporting Theft or Significant Loss of Controlled Substances Once you submit, the system generates a confirmation that the Diversion Control Division received your report.
Both deadlines apply even if the controlled substances are later recovered or the responsible party is identified. A favorable outcome does not erase the duty to report.6Drug Enforcement Administration. Theft or Loss Q&A
Losses in Transit
When controlled substances go missing during shipment, the supplier files, not the recipient. The supplier must notify the DEA within one business day of discovering the in-transit loss and file a Form 106, whether the shipment was handled by their own employee, a contract carrier, or a common carrier. For international transactions, the responsibility shifts at the border: for imports, the importer takes over once customs releases the shipment at the port of entry; for exports, the exporter is responsible until customs releases the shipment at the port of export.5eCFR. 21 CFR 1301.74 – Other Security Controls for Non-Practitioners
Penalties for Not Filing
Consequences operate on two tracks.
Civilly, failing to make required records or reports violates 21 U.S.C. § 842(a)(5). The statutory cap is $10,000 per violation, but with inflation adjustments the current maximum reaches $19,246. For registered manufacturers or distributors of opioids, the ceiling climbs to $124,825 per violation when the failure relates to opioid diversion controls or suspicious order reporting.7Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025 Beyond fines, the DEA can suspend or revoke a registrant’s controlled substance license for persistent recordkeeping failures.
Criminally, intentionally falsifying or omitting material information from a required report violates 21 U.S.C. § 843(a)(4). A first offense carries up to four years in prison and a fine. A second conviction after a prior felony under the Controlled Substances Act doubles the maximum to eight years.8Office of the Law Revision Counsel. 21 U.S. Code 843 – Prohibited Acts C A registrant who files late but accurately faces civil penalties. A registrant who hides a theft faces prison time.
Local Police and State Boards
Filing Form 106 satisfies your federal obligation. It does not replace a report to local police. A police report creates a separate investigative record with a case number that you should document in your files and include on the Form 106. Local law enforcement responds to the immediate security threat; the DEA uses your report to track broader diversion patterns. If an employee is involved, the local report also preserves your ability to pursue criminal charges through the state system.
State pharmacy boards in many states impose their own reporting deadlines for controlled substance losses. These vary widely and sometimes differ from the federal one-business-day requirement, so confirm with your state board that you have met both federal and state obligations.
Record Retention
Keep a copy of the completed Form 106, digital or printed, at the registered location. Federal regulations require registrants to maintain all controlled substance inventories and records, including theft and loss reports, for at least two years from the date of the record.9eCFR. 21 CFR Part 1304 – Records and Reports of Registrants These records must be available to DEA investigators during routine audits or follow-up inquiries about the reported incident.