DSCSA Track and Trace: Serialization, Deadlines, and Penalties

The Drug Supply Chain Security Act track and trace requirements obligate every manufacturer, repackager, wholesale distributor, and pharmacy handling prescription drugs to serialize each package, exchange standardized electronic transaction data at every ownership change, verify product legitimacy on demand, and quarantine and report anything suspect. The rules phased in over a decade under Title II of the 2013 Drug Quality and Security Act, with final compliance deadlines landing between May 2025 and November 2026 depending on the type and size of the business.¹²

Who the Rules Apply To

The DSCSA reaches four categories of “trading partners”: manufacturers, repackagers, wholesale distributors, and dispensers (mostly retail and hospital pharmacies). The baseline rule cuts across all four: you can only buy from or sell to another authorized trading partner, meaning one that holds the federal and state registrations required for its role.

Third-party logistics providers sit outside the trading partner definition because they never take ownership of the product they warehouse and ship.³⁴⁵⁶

Serializing Each Package

Every prescription drug package moving through the U.S. supply chain must carry a product identifier. That identifier bundles four data elements: the National Drug Code, a unique serial number of up to 20 characters, the lot number, and the expiration date. Together the four make up the “standardized numerical identifier,” and no two packages share the same combination.⁷

The identifier appears in two forms on each saleable package: human-readable text and a machine-readable 2D data matrix barcode. Homogeneous cases (shipping cartons of identical units) can use either a linear barcode or a 2D data matrix.⁸ The dual format has a practical purpose. If a scanner fails at a receiving dock, staff can still read the numbers and verify manually.

Containers too small to carry the full label can qualify for an exception, but only through a formal request to the FDA. There is no automatic exemption based on size.

The Data That Travels With Each Sale

At every ownership change, the seller must send the buyer three things, commonly called the 3Ts. All of it now flows electronically; paper-based tracing is no longer permitted under the enhanced requirements.

Transaction Information

This is the core dataset accompanying the sale: the drug name, strength, and dosage form; the NDC; container size and count; lot number; transaction date; shipment date (if shipment occurs more than 24 hours after the sale); and the business name and address for both seller and buyer.⁷ A mismatched NDC or missing lot number will trigger a discrepancy investigation on the receiving end.

Transaction History

The transaction history records every prior ownership change back to the original manufacturer. Under the enhanced tracing requirements, that history is effectively embedded within the current transaction information, reducing paperwork while preserving a complete audit trail.

Transaction Statement

The transaction statement is a set of seven attestations by the seller: that it is authorized, received the product from an authorized source, obtained the required documentation from the prior owner, did not knowingly ship suspect or illegitimate product, had verification systems in place, did not knowingly provide false information, and did not knowingly alter the history.⁷ Falsifying any of them creates direct legal exposure for the signer.

How the Data Moves

Electronic transaction data should arrive at or before the physical shipment, and the systems used by different trading partners must be interoperable. The FDA recommends the EPCIS standard developed by GS1 and has called it an appropriate globally recognized standard, though the guidance leaves room for alternatives.⁹ When product arrives, staff scan the 2D barcodes and the system compares the scans against the electronic file already received. A mismatch blocks the product from inventory until it is investigated.

Verifying, Investigating, and Reporting Suspect Product

Every trading partner must have procedures to flag product that looks wrong. A product is “suspect” when there is reason to believe it may be counterfeit, diverted, stolen, or otherwise unfit for distribution. Once flagged, it must be physically separated from saleable inventory and investigated using the serialization and transaction data.

If the investigation confirms the product is illegitimate, the trading partner has 24 hours to notify the FDA and any immediate trading partners who may have handled the same product.¹⁰ The FDA’s preferred channel is the CDER NextGen portal; Form FDA 3911 submitted by email is also accepted. Final disposition typically means documented destruction.

Trading partners must also respond to verification requests from the FDA or another trading partner within 24 hours. In practice, many verification systems now operate in near real time, driven by wholesale distributors pushing manufacturers to respond faster than the regulatory floor.

Returned Product

Returns create a distinct risk because product re-enters the supply chain after leaving direct custody. Under the enhanced requirements, a wholesale distributor must verify the product identifier on any returned product before redistributing it as saleable.¹¹ That means scanning the 2D barcode and confirming the serial number, NDC, lot number, and expiration date all match legitimate records. If verification fails, the returned unit gets handled as suspect product.

Recordkeeping

Records related to suspect product investigations and the disposition of illegitimate products must be kept for at least six years after the investigation or disposition concludes.¹² The obligation applies to all four trading partner categories. Failing to produce these records during an FDA inspection is the kind of gap that turns a routine audit into an enforcement action.

Compliance Deadlines

The full set of enhanced requirements was originally scheduled to take effect on November 27, 2023. Widespread readiness gaps led the FDA to create a stabilization period with staggered exemptions by trading partner type:²

Manufacturers and repackagers: exemption expired May 27, 2025.
Wholesale distributors: exemption expires August 27, 2025.
Dispensers with 26 or more full-time employees: exemption expires November 27, 2025.
Small dispensers (25 or fewer full-time pharmacists and pharmacy technicians): exemption expires November 27, 2026.

Once a window closes, the enhanced requirements apply in full. Filing a waiver request does not pause the deadline while the FDA reviews it.

Small dispensers benefit from the longest runway, but the exemption only covers the electronic infrastructure pieces: electronic exchange of transaction data, package-level product verification, and electronic recall coordination. Small pharmacies must still verify that their trading partners are authorized, investigate and quarantine suspect product, and follow prescription drug purchasing policies. Trading partners that fall outside these categories but still cannot meet the enhanced requirements can request a formal waiver, exception, or exemption through the CDER NextGen portal, explaining what has been done, why more time is needed, and the plan to reach full compliance.

Penalties for Noncompliance

Penalties scale with intent. General violations of the Federal Food, Drug, and Cosmetic Act carry up to one year of imprisonment and a $1,000 fine on a first offense. A second conviction, or a violation committed with intent to defraud, raises the ceiling to three years and $10,000.¹³

Knowing violations sit in a different tier. Knowingly distributing drugs in violation of federal wholesale distribution requirements can bring up to 10 years of imprisonment, a fine of up to $250,000, or both. Knowingly dealing in counterfeit drugs carries the same 10-year maximum. Intentionally adulterating a drug in a way that creates a serious risk of death or major health consequences carries up to 20 years and a $1,000,000 fine.

Criminal exposure is not the only lever. The FDA can pursue product seizures and court-ordered injunctions that halt operations. For most companies the injunction is the more immediate concern: a criminal case unfolds over years, while a seizure order can pull inventory off shelves within days.

Where State Law Still Applies

Federal law preempts state tracing requirements, including pedigree systems, transaction history rules, and verification or recordkeeping obligations, when the state rules are inconsistent with, more stringent than, or in addition to the federal requirements.¹⁴ Preemption is not total. It only covers items classified as “products” under the DSCSA, essentially finished prescription drugs for human use. States retain authority over tracing for animal drugs, medical devices, over-the-counter drugs, active pharmaceutical ingredients, and clinical trial materials, and they can still regulate wholesale distributors and 3PLs in areas the DSCSA’s licensing standards do not directly address, such as inspection schedules or bonding.

1
Food and Drug Administration. Title II of the Drug Quality and Security Act
2
U.S. Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period
3
U.S. Food and Drug Administration. Drug Supply Chain Security Act Summary
4
Government Publishing Office. 21 USC 360eee-3 – National Standards for Third-Party Logistics Providers
5
eCFR. 21 CFR Part 205 – Guidelines for State Licensing of Wholesale Prescription Drug Distributors
6
Office of the Law Revision Counsel. 21 USC 360eee-2 – National Standards for Prescription Drug Wholesale Distributors
7
Office of the Law Revision Counsel. 21 USC 360eee – Definitions
8
Office of the Law Revision Counsel. 21 USC 360eee-1 – Requirements
9
Food and Drug Administration. DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs – Guidance for Industry
10
U.S. Food and Drug Administration. Notify FDA of Illegitimate Products
11
U.S. Food and Drug Administration. Wholesale Distributor Verification Requirement for Saleable Returned Drug Product
12
U.S. Food and Drug Administration. Verification Systems Under the Drug Supply Chain Security Act
13
Office of the Law Revision Counsel. 21 USC 333 – Penalties
14
Office of the Law Revision Counsel. 21 USC 360eee-4 – Uniform National Policy