DSCSA Compliance: Requirements, Deadlines, Exemptions, and Penalties

The Drug Supply Chain Security Act (DSCSA) compliance requirements apply to every company that manufactures, repackages, distributes, dispenses, or provides third-party logistics for prescription drugs in the United States. In short: you must serialize covered products, exchange electronic transaction data with authorized trading partners, verify suspect or returned products, keep records for six years, and hit staggered enforcement deadlines that run through November 27, 2026. Missing them exposes you to fines that scale to $1,000,000 per violation and, for knowing conduct, up to 10 years in prison.

Who the Law Covers

The DSCSA reaches five categories of supply chain participants: manufacturers, repackagers, wholesale distributors, dispensers (mainly retail and hospital pharmacies), and third-party logistics providers that store or transport drugs without taking ownership. Each role carries a different mix of registration, licensing, and reporting obligations. Manufacturers and repackagers need active federal registrations. Wholesale distributors and dispensers need state licenses where they operate. Third-party logistics providers need state licenses and must report their licensure to the FDA every year.¹

The law covers prescription drugs in finished dosage forms, such as capsules, tablets, and certain lyophilized products before reconstitution. If a drug still requires substantial further manufacturing before a patient can take it, it falls outside the scope.¹ Several drug categories are specifically excluded from tracing requirements:

Over-the-counter drugs
Animal drugs
Blood and blood components intended for transfusion
Radioactive drugs and radioactive biological products
Imaging drugs
Certain intravenous products
Medical gases
Certain homeopathic drugs
Drugs lawfully compounded under federal compounding provisions

The FDA’s product tracing FAQ confirms the same list for companies unsure whether their inventory falls within scope.²

Product Identifiers on Every Package

Every covered drug package and homogeneous case must carry a product identifier: a standardized graphic that encodes key information in both human-readable text and a machine-readable data carrier, typically a 2D barcode, conforming to widely recognized international standards. The identifier contains a standardized numerical identifier, the lot number, and the expiration date. The standardized numerical identifier combines the National Drug Code for that product configuration with a unique serial number of up to 20 characters.¹

The industry has converged on GS1 standards. In practice, that means a GS1 DataMatrix barcode on every saleable unit, with the human-readable text alongside showing the GTIN (derived from the NDC), serial number, lot number, and expiration date. Manufacturers must affix or imprint the product identifier before a drug enters commerce.³

Transaction Records You Must Keep

Every time a covered drug changes hands, three categories of documentation must travel with it. The industry calls them the “3Ts.”

Transaction Information is the detailed record: drug name, strength, dosage form, National Drug Code, container size, number of containers, transaction date, and the names and addresses of the businesses involved. Transaction History records previous ownership transfers for the product. The Transaction Statement is the seller’s formal declaration that it is authorized under the law and has met all applicable verification requirements.¹

Manufacturers, wholesale distributors, dispensers, and repackagers must all capture and retain these records for at least six years after the transaction date.³ The retention window exists so the FDA can trace a product backward through the supply chain years after distribution if a safety problem surfaces. Verify data fields are complete and accurate before accepting a shipment. Incomplete documentation looks minor until an investigation starts and the gaps point at your facility.

Authorized Trading Partners

You can only buy from or sell to companies that qualify as authorized trading partners under federal law. What “authorized” means depends on the entity type. Manufacturers and repackagers need valid federal registration. Wholesale distributors need state licenses (or federal licenses if no state license is required) plus federal reporting compliance. Dispensers need valid state pharmacy licenses. Third-party logistics providers need state licenses plus federal reporting compliance.¹

Before conducting business, verify your trading partner’s credentials. For wholesale distributors, that means checking federal licensure reporting databases. For pharmacies, it means verifying active licenses through official state board records. Vetting is not a one-time exercise. Licenses expire, get suspended, or lapse, so monitoring has to happen on an ongoing basis.

Handling Suspect and Illegitimate Products

Every supply chain participant must have procedures for identifying and handling products that look wrong. The law draws a line between two categories. A suspect product is one where there is reason to believe it may be counterfeit, diverted, stolen, or otherwise unfit for distribution. An illegitimate product is one confirmed to be fraudulent, stolen, intentionally adulterated, or the subject of a fraudulent transaction.

When a product triggers suspicion, quarantine it immediately and investigate. That means checking the product identifier, examining packaging for tampering, and reviewing transaction documentation for inconsistencies. If the investigation confirms the product is illegitimate, notify the FDA and all trading partners who may have received the same product within 24 hours. The FDA prefers notification through the 3911 platform in CDER NextGen, though Form FDA 3911 can also be submitted by email.⁴ Keep detailed records of the investigation and final disposition for at least six years.³

Saleable Returns

Wholesale distributors must verify the product identifier on any saleable returned drug before putting it back into distribution. Returned inventory is a known vulnerability: a counterfeit product entering the returns stream could re-enter the legitimate supply chain without anyone catching it. The FDA has issued compliance guidance on the enforcement timeline for this verification requirement, most recently extending it through the stabilization period.⁵

Electronic, Package-Level Exchange

The DSCSA’s final implementation phase replaces paper-based, lot-level tracking with a fully electronic, package-level system. Transaction Information and Transaction Statements must be exchanged electronically for every individual package in a shipment, and the system must support package-level verification so any entity in the chain can confirm a specific unit’s identity and trace its history on demand.³

The FDA recommends the Electronic Product Code Information Services (EPCIS) standard for exchanging transaction data but does not mandate any single technology. Companies can use other approaches as long as they achieve interoperability and meet the statutory requirements.⁶ Most of the industry has coalesced around EPCIS because it provides a common language across different software platforms.

Products that lack matching electronic data at the point of receipt can be rejected at the loading dock. A company without functioning electronic interoperability connections risks being unable to receive shipments at all.

The 2025 and 2026 Deadlines

The enhanced drug distribution security requirements took effect on November 27, 2023.⁷ Because the industry was not uniformly ready, the FDA issued temporary exemptions from certain enhanced requirements on a rolling basis. The compliance obligation was never paused, but enforcement was staggered:

Manufacturers and repackagers: exemptions expired May 27, 2025
Wholesale distributors: exemptions expire August 27, 2025
Dispensers with 26 or more full-time employees: exemptions expire November 27, 2025
Small dispensers (25 or fewer full-time pharmacists and pharmacy technicians): exemptions expire November 27, 2026

These dates come from the FDA’s waivers and exemptions framework.⁸ Companies that miss their applicable deadline and lack an approved waiver face the full weight of enhanced system requirements with no regulatory cushion.

Waivers and the Small Dispenser Exemption

The FDA can grant waivers from specific DSCSA requirements when compliance would cause undue economic hardship or when emergency medical circumstances exist, including public health emergencies declared under the Public Health Service Act.⁹ Requests for CDER-regulated products go through the CDER NextGen portal.

The most broadly relevant exemption in 2026 applies to small dispensers. A pharmacy qualifies if the corporate entity that owns it employs 25 or fewer full-time pharmacists and pharmacy technicians as of November 27, 2024.¹⁰ Qualifying pharmacies are temporarily exempt from several enhanced requirements, including electronic interoperable exchange of transaction data, package-level product identifier verification for suspect or illegitimate products, and the obligation to respond to trace-back requests at the package level.

The exemption runs until November 27, 2026. Qualifying dispensers do not need to submit documentation or notify the FDA to take advantage of it.⁸ The underlying obligation has not disappeared. When November 2026 arrives, the requirements will apply with no additional grace period currently announced.

Penalties for Noncompliance

DSCSA violations fall under the enforcement provisions of the Federal Food, Drug, and Cosmetic Act, and severity depends on whether the violation was knowing or unintentional. Knowing violations of drug distribution requirements, such as intentionally selling or purchasing drugs outside legitimate channels, can result in imprisonment of up to 10 years, fines of up to $250,000, or both.¹¹

Civil penalties apply to companies whose representatives violate distribution rules. The first two violations by any representative of a manufacturer or distributor within a 10-year period carry fines of up to $50,000 each. After the second conviction in that window, each additional violation can result in fines up to $1,000,000.¹¹ The FDA can also take regulatory actions like warning letters, import alerts, and injunctions that effectively stop a company from operating while the issues are resolved.

1
Office of the Law Revision Counsel. 21 USC 360eee – Definitions
2
Food and Drug Administration. Drug Supply Chain Security Act Product Tracing Requirements Frequently Asked Questions
3
Office of the Law Revision Counsel. 21 USC 360eee-1 – Requirements
4
Food and Drug Administration. Notify FDA of Illegitimate Products
5
Food and Drug Administration. Wholesale Distributor Verification Requirement for Saleable Returned Drug Product and Dispenser Verification Requirements When Investigating a Suspect or Illegitimate Product – Compliance Policies
6
Food and Drug Administration. DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs Guidance for Industry
7
Food and Drug Administration. Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act
8
Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period
9
Food and Drug Administration. The Drug Supply Chain Security Act (DSCSA) Waivers, Exceptions, and Exemptions
10
Food and Drug Administration. DSCSA Exemptions from Certain Requirements Under Section 582 for Small Dispensers
11
Office of the Law Revision Counsel. 21 U.S. Code 333 – Penalties