Serialization Track and Trace: DSCSA Deadlines and Penalties

DSCSA serialization requirements make manufacturers, repackagers, wholesale distributors, and pharmacies place a unique product identifier on every prescription drug package and sealed homogeneous case, and exchange electronic tracking data each time the product changes hands. The identifier is a 2D data matrix barcode carrying four data elements, and the electronic exchange, verification, and tracing capabilities that surround it are what the Drug Supply Chain Security Act calls its “enhanced” requirements. Those enhanced requirements took effect November 27, 2023, but FDA has staggered enforcement through a series of exemptions that run out between May 2025 and November 2026.¹

What Has to Be on the Package

Every prescription drug package and sealed homogeneous case must carry a product identifier: a standardized graphic printed in both human-readable text and a machine-readable 2D data matrix barcode. The barcode has to follow standards set by a widely recognized international standards development organization, which in practice means GS1.²

Four data elements make up the identifier:

National Drug Code (NDC), identifying the specific product and package configuration
Serial number, a unique alphanumeric string of up to 20 characters assigned to that individual package
Lot number, tying the package to its manufacturing batch
Expiration date, the last date the product should be dispensed

The NDC and serial number together form what the statute calls the standardized numerical identifier. In the GS1 system, the NDC is encoded within a Global Trade Item Number (GTIN), which is the format scanners actually read from the data matrix.³ The human-readable text printed alongside lets someone check the same four elements by eye if a scanner fails.

Distributing a package that lacks a product identifier is a prohibited act under the Federal Food, Drug, and Cosmetic Act. The product can be treated as misbranded, which opens the door to seizure and penalties.⁴

Current Compliance Deadlines

The enhanced package-level requirements officially took effect November 27, 2023, but industry wasn’t ready. FDA responded by granting exemptions to trading partners that had made good-faith efforts to build the data connections. Those exemptions expire on a rolling basis:⁵

Manufacturers and repackagers: May 27, 2025
Wholesale distributors: August 27, 2025
Dispensers with 26 or more full-time employees: November 27, 2025
Small dispensers with 25 or fewer full-time pharmacists and technicians: November 27, 2026

Filing an exemption request does not pause the compliance obligation, and FDA expects trading partners to keep working toward full implementation while any request is pending. The window for grace periods is closing.

The Data That Has to Travel With the Package

Serialization on the package is only half of the requirement. Every time a prescription drug product changes ownership, three categories of documentation have to move with it, and under the enhanced requirements the exchange has to be electronic and interoperable.

Transaction Information covers the specifics of the product and the deal: product name, strength, dosage form, NDC, container size, number of containers, lot number, transaction date, and the names and addresses of both the sending and receiving entities. If the shipment date is more than 24 hours after the transaction date, it has to be recorded separately.

Transaction History is a cumulative record of every prior ownership change since the product left the manufacturer. Each link in the chain adds to it, so by the time a package reaches a pharmacy, the full chain of custody is documented.

Transaction Statement is a formal declaration from the seller that the product came from an authorized trading partner, that verification systems were in place, and that the seller did not knowingly ship suspect or illegitimate product or provide false information.

All trading partners must keep these records for at least six years.⁶ Dispensers can outsource the storage to a third party, such as an authorized wholesale distributor, under a written agreement.⁷

The Three Interoperable Capabilities

The 2023 enhanced requirements broke package-level compliance into three capabilities that every trading partner has to be able to perform:⁸

Interoperable exchange of Transaction Information and Transaction Statements electronically, at the package level
Interoperable verification of the product identifier on any package or sealed case
Interoperable tracing, meaning electronic systems capable of producing Transaction Information for each transaction back to the manufacturer when requested

In practice, verification often runs through a Verification Router Service. A wholesale distributor or pharmacy scans the 2D barcode, and the router sends the four data elements to the manufacturer’s serial data repository, which checks for a match and returns an automatic response confirming or denying authenticity.² Verification can also run through direct EPCIS (Electronic Product Code Information Services) data exchange between trading partners, though industry readiness for that method varies.

Manufacturers and repackagers must respond to verification requests within 24 hours, or within another timeframe set by the Secretary of Health and Human Services.⁹ A mismatch triggers the suspect product investigation process.

Saleable Returns Verification

Returns create a specific vulnerability. A drug that leaves a distributor’s control and comes back could have been tampered with, stored improperly, or swapped for a counterfeit. Wholesale distributors have to verify the product identifier on each sealed homogeneous case of a saleable returned product, or on each individual package if the product is not in a sealed case. Nothing returned can go back out for redistribution until verification is complete.¹⁰ If the identifier fails verification, the product cannot re-enter the supply chain.

When Serialization Flags a Suspect Product

When a trading partner has reason to believe a product may be counterfeit, diverted, stolen, or otherwise unfit for distribution, the DSCSA requires a structured investigation. The first step is quarantining the suspect product so it cannot be distributed or dispensed while the investigation runs.⁶

If the investigation confirms the product is illegitimate, the entity has to notify FDA and all appropriate immediate trading partners within 24 hours of the determination. Manufacturers carry an additional obligation: they also have to notify within 24 hours when a product is at “high risk” for illegitimacy, even before a final determination.¹¹ Once confirmed illegitimate, the product must be quarantined separately from legitimate inventory, disposed of properly, and documented for at least six years. Trading partners have to consult with FDA before terminating a notification, and retaining physical samples may be necessary to support ongoing investigations.

Who Must Comply and What’s Out of Scope

The DSCSA places obligations on four categories of trading partners: manufacturers (who generate and apply the product identifier), repackagers (who apply new identifiers when they break bulk product into smaller packages), wholesale distributors, and dispensers (pharmacies and hospitals). Each must also confirm that its counterparties are “authorized trading partners,” meaning properly licensed or registered to handle prescription drugs.¹²

Serialization requirements target finished human prescription drugs. Several product categories fall outside the scope entirely:¹³

Over-the-counter drugs
Animal drugs
Blood and blood components intended for transfusion
Radioactive drugs and radioactive biologic products
Imaging drugs
Certain intravenous drugs
Medical gases
Certain homeopathic drugs
Lawfully compounded drugs

Small pharmacies get additional relief. Small dispensers, defined as pharmacies owned by a company that as of November 27, 2024 employs 25 or fewer full-time pharmacists and pharmacy technicians combined, are exempt from certain enhanced requirements until November 27, 2026. Small dispensers do not need to notify FDA or submit paperwork to claim it; the exemption is automatic. Trading partners that don’t qualify for any automatic exemption but still cannot meet the requirements can submit individual waiver requests to FDA, with detailed justification and supporting documentation.⁵

Penalties for Non-Compliance

Violating the DSCSA is a prohibited act under section 301(t) of the Federal Food, Drug, and Cosmetic Act.⁴ Penalties scale with the nature of the violation:

Basic violations: up to one year in prison, a fine of up to $1,000, or both
Repeat violations or intent to defraud: up to three years in prison, a fine of up to $10,000, or both
Knowing violations involving drug distribution: up to 10 years in prison, a fine of up to $250,000, or both
Knowingly dealing in counterfeit drugs: up to 10 years in prison
Knowing adulteration likely to cause serious harm or death: up to 20 years in prison, a fine of up to $1,000,000, or both

These penalties come from 21 U.S.C. § 333.¹⁴ The jump from misdemeanor to felony hinges on whether the violation was knowing and intentional. A company that simply falls behind on its data connections sits in a very different position than one that deliberately ships product it knows is counterfeit. Beyond criminal exposure, FDA can pursue product seizures and injunctions to halt distribution of misbranded drugs.¹⁵

1
Food and Drug Administration. Drug Supply Chain Security Act (DSCSA)
2
Food and Drug Administration. The FDA DSCSA Pilot Program – Router Service Solution for Verification Under the DSCSA
3
GS1 US. Frequently Asked Questions by the Pharmaceutical Industry in Preparing for the U.S. DSCSA
4
Federal Register. Product Identifier Requirements Under the Drug Supply Chain Security Act Compliance Policy
5
U.S. Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period
6
Food and Drug Administration. Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs
7
American Society of Health-System Pharmacists. Drug Supply Chain Security Act FAQ 2 – Third Party Management of Transaction Information, Transaction History, and Transaction Statements
8
Food and Drug Administration. Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act
9
Federal Register. Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs
10
Food and Drug Administration. Wholesale Distributor Verification Requirement for Saleable Returns
11
Food and Drug Administration. Notify FDA of Illegitimate Products
12
Food and Drug Administration. Identifying Trading Partners Under the Drug Supply Chain Security Act
13
Food and Drug Administration. Drug Supply Chain Security Act Product Tracing Requirements Frequently Asked Questions
14
Office of the Law Revision Counsel. 21 USC 333 – Penalties
15
Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts