DSCSA Compliance Checklist for Wholesale Distributors (2026)

All Drug Supply Chain Security Act requirements for wholesale drug distributors are now fully enforced. The stabilization period for enhanced package-level tracking and interoperable electronic systems expired August 27, 2025. Wholesale distributors must verify authorized trading partner status, exchange serialized transaction data at the package level, perform product identifier verification on receipt and for saleable returns, and maintain interoperable electronic systems under Section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act.

Background and Regulatory Context

The Drug Supply Chain Security Act (DSCSA) was enacted as Title II of the Drug Quality and Security Act (Pub. L. 113-54) on November 27, 2013. DSCSA established federal requirements for tracking and tracing prescription drugs distributed in the United States, replacing a patchwork of state pedigree laws with a uniform national system.

DSCSA regulates five categories of entities: manufacturers, wholesale drug distributors, dispensers (pharmacies), third-party logistics providers (3PLs), and repackagers. Wholesale distributors are defined under FD&C Act Section 581(21) as entities engaged in wholesale distribution of prescription drugs, including but not limited to manufacturers' warehouses, chain pharmacy warehouses, and wholesale drug warehouses.

The law established a phased implementation schedule. Initial requirements focused on transaction documentation (lot-level transaction information, transaction history, and transaction statements) and authorized trading partner verification. Enhanced requirements under Section 582(g)(1) — including unit-level serialization, package-level product tracing, and interoperable electronic systems — had a statutory deadline of November 27, 2023.

FDA exercised enforcement discretion for wholesale distributors and dispensers through an initial stabilization period, extended multiple times. The final extension expired August 27, 2025. As of that date, all DSCSA requirements for wholesale distributors are subject to full enforcement, including package-level serialization, interoperable electronic data exchange (typically via EPCIS 1.2 or 2.0 standards), and verification of product identifiers on receipt and for saleable returns.

The only remaining enforcement discretion applies to small dispensers (25 or fewer full-time employees), who have until November 27, 2026 to comply with enhanced requirements. Wholesale distributors transacting with small dispensers during this period must still comply with all Section 582(c) requirements, including providing package-level transaction data even if the dispenser is not yet required to accept it.

Authorized Trading Partner Verification

Wholesale distributors must verify that all entities in a transaction chain are authorized trading partners (ATPs) before conducting any transaction. Section 581(2) defines an ATP as an entity licensed or registered per DSCSA requirements and listed in FDA's database or verified directly with the relevant regulatory authority.

State Licensing Requirements: Under Section 582(a)(6), wholesale distributors must hold a valid state license meeting national licensing standards. These standards include criminal background checks, storage and handling security, responsible party qualifications, and recordkeeping systems. States without wholesale distributor licensing requirements fall under federal licensing per Section 583.

ATP Verification Sources:

• Manufacturers and repackagers: Verify FDA registration via the FDA Drug Establishments Current Registration Site (eDRLS database)
• Wholesale distributors and 3PLs: Verify state licenses via state boards of pharmacy and FDA's annual reporting database
• Dispensers: Verify state pharmacy licenses via state boards of pharmacy

Wholesale distributors must retain copies of all trading partner licenses for six years and maintain written procedures documenting verification frequency, sources, and escalation processes for expired or suspended licenses. ATP verification must occur before every transaction or at regular intervals per documented policy (many distributors verify quarterly or semi-annually for established trading partners).

Only covered prescription drugs — defined in Section 581(13) as finished dosage forms for human use, excluding OTC drugs and animal drugs — are subject to DSCSA requirements. ATP verification applies only to transactions involving covered drugs.

Transaction Data Exchange Requirements

Wholesale distributors must provide and receive three forms of transaction documentation for every sale or purchase of covered prescription drugs: transaction information (TI), transaction history (TH), and transaction statement (TS).

Transaction Information (TI) includes:

• Product identifier (NDC, serial number, lot/batch number, expiration date)
• Transaction date
• Shipment date (if different from transaction date)
• Names and addresses of both parties (seller and buyer)

Transaction History (TH) is the full upstream chain of prior transaction information, tracing the product back to the manufacturer or repackager. Wholesale distributors receiving product from manufacturers receive initial TH and must forward the complete history plus their own transaction information when selling downstream.

Transaction Statement (TS) certifies that the distributor:

• Received the product from an authorized trading partner
• Received required transaction information and transaction history
• Did not knowingly ship suspect or illegitimate product
• Maintains systems and processes to comply with verification and tracing requirements

All TI/TH/TS exchange must occur at the package level with serialized product identifiers. Lot-level transaction data is no longer compliant for wholesale distributors. Transaction data must be exchanged via secure, electronic, interoperable systems — typically EPCIS (Electronic Product Code Information Services) based on GS1 standards. Paper or email-based transaction documentation does not satisfy interoperability requirements under current enforcement.

Wholesale distributors must respond to FDA or state regulator requests for transaction data within required timelines, typically 24-48 hours for trace investigations related to suspect or recalled products.

Product Identifier Verification

Wholesale distributors must verify product identifiers at two critical points: receipt of product and before redistribution of saleable returns.

Verification on Receipt: Distributors must scan the 2D DataMatrix barcode on each package to capture the serialized product identifier (GTIN, serial number, lot number, expiration date). This scanned data must be matched against the transaction information received from the seller to confirm:

• Serial number matches TI
• Lot number and expiration date match TI
• Product has not been flagged as suspect or subject to recall

Distributors must maintain systems capable of querying product identifiers with manufacturers or repackagers when verification failures occur or when product is designated as suspect.

Saleable Returns Verification: Before redistributing any returned product, distributors must verify the product identifier with the manufacturer per Section 582(c)(4)(D). This requirement applies only to saleable returns — products returned in condition suitable for resale. Nonsaleable returns (damaged, expired, opened) are not subject to verification but must be documented and disposed of per written procedures.

Returns verification ensures the serial number is still valid in the manufacturer's system and has not been reported as suspect, illegitimate, or subject to a recall since the original distribution. Only returns that pass manufacturer verification may be added back to active inventory.

Suspect and Illegitimate Product Procedures

Wholesale distributors must maintain written procedures for identifying, investigating, and handling suspect products. Section 581(19) defines a suspect product as one for which there is reason to believe it is counterfeit, diverted, stolen, intentionally adulterated, the subject of fraudulent transaction documentation, or otherwise unfit for distribution.

Identification Triggers: Suspect product determinations may result from:

• Product identifier verification failures
• Temperature excursion during storage or shipment
• Damaged or tampered packaging
• Notification from trading partner or FDA
• Transaction data anomalies (missing TI/TS, unverified ATP)
• Product appearance inconsistent with known authentic product

Upon identification, distributors must immediately quarantine the suspect product to prevent distribution. Quarantine must be physical (segregated storage area) or electronic (system hold preventing release) and documented.

Investigation: The distributor must conduct an investigation to determine whether the product is illegitimate. This includes:

• Coordinating with the manufacturer to verify product identifier authenticity
• Reviewing complete transaction history to identify potential diversion points
• Examining physical product and packaging for counterfeiting indicators
• Verifying ATP status of all upstream trading partners in the product's history

Disposition: If investigation clears the product, it may be released from quarantine. If investigation confirms the product is illegitimate (defined in Section 581(7) as counterfeit, diverted, stolen, intentionally adulterated, the subject of fraudulent transaction, or otherwise unfit), the distributor must:

• Notify FDA and all immediate trading partners within 24 hours
• Not distribute the illegitimate product under any circumstances
• Destroy or return the product per written procedures
• Retain all investigation documentation for six years

Failure to notify FDA and trading partners within 24 hours is a citable violation under current enforcement.

Interoperable Electronic Systems and Exception Handling

Section 582(g)(1) requires wholesale distributors to operate secure, electronic, and interoperable systems for transaction data exchange and product verification. Interoperability means systems must be capable of exchanging DSCSA data with any trading partner using standardized data formats and protocols.

EPCIS Implementation: The industry standard for interoperability is EPCIS (Electronic Product Code Information Services), a GS1 standard for supply chain event data sharing. EPCIS 1.2 and EPCIS 2.0 are both in use. Wholesale distributors must implement EPCIS repositories capable of receiving, storing, and transmitting serialized transaction data.

Exception Handling: Full package-level serialization generates significantly higher exception volumes than previous lot-level systems. Common exceptions include:

• Unreadable or damaged 2D barcodes
• Serial number mismatches between physical product and received TI
• Missing transaction data from upstream trading partner
• ATP verification failures

Distributors must implement documented exception handling workflows:

1. Quarantine product with data-related holds until resolved
2. Document the nature of the exception (serial mismatch, missing data, etc.)
3. Contact upstream trading partner or manufacturer to resolve discrepancy
4. Record resolution steps, parties involved, and resolution date
5. Release product from quarantine only after successful resolution

Exception resolution timelines vary by distributor policy, but FDA expects rapid resolution (typically 24-48 hours) to prevent supply chain disruption. Systems must be scalable to handle exception volumes at full serialized intake capacity.

Record Retention and FDA Reporting

Wholesale distributors must retain all DSCSA records for six years:

• Transaction information, transaction history, and transaction statements
• Authorized trading partner verification records (licenses, verification dates, sources)
• Suspect and illegitimate product investigation files
• Exception handling documentation
• Written policies and procedures

Records must be retrievable — capable of rapid access in response to FDA or state regulator inquiries. Electronic storage systems must include search functionality by product identifier, lot number, trading partner, and transaction date.

Annual Reporting: Distributors must complete annual licensure reporting to FDA via the CDER Direct portal. This reporting confirms continued compliance with national licensing standards and provides FDA with current contact information.

Illegitimate Product Reporting: Illegitimate product determinations must be reported to FDA within 24 hours via the DSCSA Pilot Program portal or email to [email protected]. Reports must include product identifier, lot information, trading partner information, and a summary of the investigation.

ColdChainCheck Insights

DSCSA Compliance Indicators in Our Dataset

What the Data Reveals

The 97% FDA registration rate indicates most entities tracked by ColdChainCheck maintain the baseline federal requirement for wholesale distribution. However, only 24% of entities achieve Good or Excellent compliance scores (as calculated per our methodology), suggesting significant gaps in verifiable compliance signals beyond basic registration. The low NABP accreditation rate (5%) reflects the voluntary nature of VAWD accreditation — while NABP accreditation provides independent verification of storage, handling, and compliance practices, most distributors rely solely on state licensure to meet DSCSA ATP requirements. The 6% recall rate represents entities with at least one FDA recall on record, providing a historical compliance signal that may inform trading partner risk assessment.

How to Use ColdChainCheck for Trading Partner Verification

• Cross-reference ATP verification sources: Before onboarding a new trading partner, check ColdChainCheck to confirm FDA registration status, state license counts, and NABP accreditation status as a preliminary step before verifying directly with state boards and eDRLS
• Identify compliance gaps in existing relationships: Review compliance scores and data completeness for current trading partners to prioritize re-verification efforts and identify entities requiring more frequent ATP checks
• Document due diligence for audits: Export entity profiles to support written ATP verification procedures and demonstrate use of multiple independent data sources during internal audits or FDA inspections
• Monitor recall history: Flag trading partners with multiple recalls on record for enhanced product verification procedures or increased inspection frequency upon receipt — view the full directory to filter by recall status, state licensure, and accreditation

Resources

• FDA DSCSA Implementation Page — Official FDA guidance documents, compliance dates, and enforcement policy
• FD&C Act Section 582 — Full statutory text of wholesale distributor requirements
• FDA Drug Establishments Current Registration Site (eDRLS) — Official database for verifying manufacturer and repackager FDA registration
• NABP VAWD Accreditation Program — Information on Verified-Accredited Wholesale Distributors accreditation
• GS1 US DSCSA Resources — EPCIS implementation guidance and GS1 barcode standards for product identifiers
• Healthcare Distribution Alliance (HDA) DSCSA Hub — Industry association resources for wholesale distributor compliance
• Partnership for DSCSA Governance (PDG) Blueprint — Chapter 2, v1.5 covers digital authentication and ATP verification standards
• FDA DSCSA Waivers, Exceptions, and Exemptions Guidance — Process for requesting individual hardship exemptions

Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. DSCSA compliance requirements are subject to change based on FDA guidance and enforcement policy. Consult with qualified regulatory counsel and verify all compliance obligations with relevant federal and state authorities.

Update: DSCSA Implementation Timeline: Final Requirements for Distributors

March 7, 2026

The Final Push: What Wholesale Distributors Need to Know About Full DSCSA Implementation

As of November 27, 2024, wholesale drug distributors entered the final phase of Drug Supply Chain Security Act (DSCSA) compliance. The FDA's enforcement of enhanced drug distribution security requirements—originally set for November 2023 but delayed—now marks the official end of the unit-level traceability transition period.

Regulatory Background

The DSCSA was enacted in 2013 under Title II of the Drug Quality and Security Act (Public Law 113-54). The statute established a phased 10-year implementation timeline designed to create an electronic, interoperable system for identifying and tracing prescription drugs distributed in the United States.

Under 21 U.S.C. § 360eee et seq., the law requires trading partners—manufacturers, repackagers, wholesale distributors, and dispensers—to exchange transaction information, transaction history, and transaction statements (collectively, TI/TH/TS) for each product transaction. The final implementation phase replaces paper-based lot-level tracing with serialized, unit-level product tracing using standardized EPCIS (Electronic Product Code Information Services) data formats.

The FDA issued final guidance on DSCSA implementation requirements in February 2023. After industry feedback citing systems readiness challenges, the agency announced in November 2023 that it would exercise enforcement discretion through November 27, 2024, effectively extending the compliance deadline by one year.

Current Compliance Requirements

Wholesale drug distributors must now meet four core requirements under 21 CFR § 582:

1. Product Identifier Verification (21 CFR § 582.35)

Distributors must verify the product identifier—including National Drug Code (NDC), serial number, lot number, and expiration date—on at least three saleable returns annually. This requirement applies only to product units returned to a distributor's control after being shipped to a trading partner, not to all inventory.

2. Systems and Processes for Verification (21 CFR § 582.35(b))

Distributors must implement systems capable of promptly investigating and resolving high-risk product discrepancies and facilitating FDA access to serialized product tracing information within specific timeframes (24 hours for suspect products, 48 hours for illegitimate products).

3. Enhanced Drug Pedigree Requirements (21 CFR § 582.50)

Transaction documentation must include product identifiers down to the package level. Wholesale distributors must maintain records associating each serialized unit with its transaction history for six years. Paper records are no longer sufficient—distributors must capture and store this data electronically.

4. Interoperable Electronic Exchange (21 CFR § 582.31)

Trading partners must exchange TI/TH/TS data electronically using systems capable of accepting EPCIS-formatted data. Distributors are not required to use a specific technology platform, but systems must support the standardized data exchange formats specified in FDA guidance.

Operational Impact on Wholesale Distributors

The transition from lot-level to unit-level serialization fundamentally changes distribution operations:

Saleable Returns Processing

Every returned unit that re-enters distribution must undergo product identifier verification. Distributors handling significant return volumes—common in specialty pharmaceutical distribution—require GS1-compliant barcode scanning infrastructure and database systems capable of comparing scanned serial numbers against manufacturer-provided data sets.

Systems Integration Requirements

Legacy warehouse management systems (WMS) and enterprise resource planning (ERP) platforms built for lot-level tracking require substantial upgrades. Distributors must integrate EPCIS adapters, implement serialized inventory control logic, and establish connections to Verification Router Services (VRS) or other interoperability networks for real-time serial number authentication.

Trading Partner Coordination

Full DSCSA compliance requires synchronized readiness across the supply chain. A distributor's EPCIS-capable system provides limited value if upstream manufacturers or downstream dispensers cannot exchange serialized data in the required format. Industry surveys conducted in Q3 2024 indicated approximately 47% of wholesale distributors had completed end-to-end testing with at least 80% of their trading partners.

Regulatory Documentation

State boards of pharmacy continue to require DSCSA compliance documentation as part of wholesale drug distributor license renewals. Distributors operating in multiple jurisdictions must maintain evidence of systems implementation, employee training records, and transaction data retention policies that satisfy both federal DSCSA requirements and state-specific pedigree rules where they still apply.

What ColdChainCheck Data Shows

ColdChainCheck tracks 1,275 wholesale drug distributors, 3PLs, and cold chain logistics providers across 51 U.S. jurisdictions. Of these entities, 1,234 hold active FDA registration—a baseline requirement for lawful drug distribution operations. The average compliance score across the directory is 51/100, placing the majority of tracked entities in the "Fair" tier (919 entities). Only 28 entities achieve "Excellent" scores (76-100), indicating comprehensive verification across multiple compliance dimensions including state licensure, NABP accreditation, and clean enforcement records.

The score distribution suggests significant variance in documented compliance posture across the wholesale distributor population. While 96.8% of tracked entities maintain FDA registration (1,234 of 1,275), only 63 hold NABP Verified-Accredited Wholesale Distributors (VAWD) accreditation—a credential requiring demonstration of DSCSA-compliant systems and processes. This gap indicates that most distributors meet baseline registration requirements but fewer have undergone third-party verification of their serialization and traceability capabilities.

Seventy-three entities in the directory have at least one FDA recall, warning letter, or enforcement action on record. While not all enforcement actions relate to DSCSA compliance, the presence of these negative signals correlates with lower overall compliance scores and may indicate operational or quality system weaknesses relevant to serialization implementation.

Practical Steps for QA and Compliance Teams

Verify Current Trading Partners

Search the ColdChainCheck directory for each wholesale distributor in your supply chain. Check FDA registration status (should show "Active" with a current expiration date) and note whether the entity holds NABP accreditation. Distributors with VAWD credentials have demonstrated DSCSA-compliant systems to an independent auditor.

Document Due Diligence Inquiries

For distributors scoring below 50, initiate direct contact to confirm their EPCIS implementation status. Specifically ask: (1) Can they exchange TI/TH/TS in EPCIS 1.2 format? (2) Have they completed end-to-end testing with your organization's systems? (3) What VRS provider or interoperability solution are they using? Document responses as part of your trading partner qualification files.

Monitor Enforcement Signals

ColdChainCheck tracks FDA recalls and warning letters. Entities with recent enforcement actions may face higher regulatory scrutiny during DSCSA compliance inspections. Review the enforcement history section of each entity profile and assess whether patterns (multiple recalls, repeated pedigree violations) indicate systemic compliance issues.

Assess Geographic Risk

Review state-level licensure data for your trading partners. Distributors operating in multiple states should hold active licenses in each jurisdiction where they distribute product. Gaps in state licensure may indicate incomplete compliance infrastructure. The directory allows filtering by state to compare entities headquartered in your primary distribution regions.

For ongoing DSCSA implementation updates and regulatory guidance, see the ColdChainCheck compliance guides section.

Disclaimer: This content is informational only and does not constitute legal or regulatory advice. Wholesale drug distributors should consult qualified legal counsel and review current FDA guidance to ensure compliance with all applicable DSCSA requirements.

Update: DSCSA Compliance Deadline 2025: Wholesale Distributor Guide

March 16, 2026

DSCSA Compliance Deadlines 2025: What Wholesale Distributors Must Do Now

The Drug Supply Chain Security Act (DSCSA) requires all wholesale drug distributors to implement interoperable, electronic tracing of prescription drugs by November 27, 2025. Distributors without compliant systems in place by this date will be unable to legally accept product from manufacturers or ship to downstream trading partners under 21 U.S.C. § 360eee-1.

Regulatory Background

Congress enacted the DSCSA in 2013 to establish uniform national standards for pharmaceutical supply chain traceability. The law replaced a patchwork of 50 state pedigree requirements with a single federal framework managed by the FDA. Under Section 582 of the Federal Food, Drug, and Cosmetic Act, wholesale distributors must document transaction history, transaction information, and transaction statements (T3 data) for each product transfer.

The law's implementation follows a 10-year phase-in schedule. From 2015 to 2023, distributors met T3 requirements using paper or non-interoperable systems. November 27, 2023 marked the start of Enhanced Drug Distribution Security (EDDS), which introduced serialization requirements at the package level using unique product identifiers encoded in GS1 barcodes. The November 2025 deadline completes the transition by requiring full interoperable exchange of Electronic Product Code Information Services (EPCIS) data between trading partners.

What the November 2025 Deadline Requires

By November 27, 2025, wholesale distributors must:

1. Implement EPCIS-compliant tracing systems capable of exchanging serialized transaction data in EPCIS 1.2 format with upstream manufacturers and downstream dispensers.

1. Connect to a Verification Router Service (VRS) to perform saleable returns verification within 24 hours of receipt, as specified in 21 CFR 580.100.

1. Verify product identifiers before distributing product quarantined due to suspect or illegitimate status under 21 CFR 582.31.

1. Maintain electronic tracing records for six years in a format that can be produced to FDA upon request within 48 hours (21 CFR 582.50).

1. Conduct authorized trading partner (ATP) verification by checking that upstream suppliers and downstream customers hold active state wholesale distributor licenses or appropriate dispenser credentials.

Distributors that handle only products exempt from serialization requirements—including certain intravenous products, medical gases, radiopharmaceuticals, and compounded drugs per 21 U.S.C. § 360eee(1)(D)—are not required to implement interoperable tracing for those products. However, any distributor handling serialized product lines must comply for those products.

Operational Impact for Distributors

The shift to interoperable tracing affects four core distribution processes:

Receiving: Distributors must capture and store EPCIS data from manufacturers or upstream wholesalers for every serialized unit received. This requires either direct integration with trading partner systems or connection through a third-party solution provider. Paper Advanced Ship Notices (ASNs) and manual data entry are no longer compliant.

Storage and Handling: Serialized units must remain traceable through internal warehouse operations. If product is aggregated into cases or pallets, the distributor must maintain parent-child relationships in its data repository. Any disaggregation or repackaging must be documented as an EPCIS transformation event.

Saleable Returns: When receiving product back from a dispenser, distributors must verify the product identifier against the VRS before returning it to saleable stock. The 24-hour verification window requires automated system connectivity—manual verification processes cannot meet the timeline requirement.

Shipping: Outbound shipments must include EPCIS data transmitted electronically to the receiving trading partner. The traditional practice of emailing PDFs or uploading documents to a portal does not meet the interoperability standard under FDA's draft guidance on interoperable exchange issued in February 2023.

Distributors that operate across multiple sites must ensure interoperable tracing at every location where serialized product is handled. A single non-compliant facility creates ATP qualification risk for downstream customers conducting their own due diligence.

What ColdChainCheck Data Shows

ColdChainCheck tracks 1,275 wholesale drug distributors and 3PLs across 51 jurisdictions. As of the November 2025 DSCSA deadline, the average compliance score in the directory is 51/100, placing the majority of entities in the "Fair" tier. This score reflects verified licensure, accreditation, and FDA registration status—baseline compliance signals that precede DSCSA interoperability requirements.

The score distribution reveals significant variance in documented compliance posture: 28 entities (2%) hold Excellent scores (76-100), 281 (22%) hold Good scores (61-75), 919 (72%) hold Fair scores (41-60), 38 (3%) hold Poor scores (21-40), and 9 (0.7%) hold Minimal scores (0-20). While these scores do not directly measure DSCSA system implementation—ColdChainCheck does not audit internal traceability infrastructure—they indicate the extent to which entities maintain verified regulatory credentials that support ATP qualification.

Of the 1,275 tracked entities, 1,234 (97%) hold active FDA establishment registrations under 21 CFR Part 207. This is a necessary but not sufficient condition for DSCSA compliance: registration confirms the entity is known to FDA as a drug handler, but does not verify the entity has implemented interoperable tracing. Only 63 entities (5%) hold NABP accreditation, the industry's voluntary credential for demonstrating supply chain integrity practices. While NABP accreditation is not required by statute, it serves as a compliance signal that the entity has undergone third-party audit of its quality systems, including product handling and data management processes relevant to DSCSA.

73 entities (6%) in the directory have at least one FDA recall or warning letter on record. Recall history does not disqualify an entity from DSCSA compliance—product recalls can occur for reasons unrelated to traceability failures—but it does indicate prior FDA scrutiny, which may correlate with heightened inspection risk post-deadline.

Practical Steps for QA and Compliance Teams

Verify upstream and downstream trading partners. Use the ColdChainCheck directory to check that your manufacturers, wholesalers, and dispenser customers hold active state licenses and FDA registration. ATP verification is a distributor's responsibility under 21 CFR 582.31—failure to validate trading partner credentials creates liability if illegitimate product enters your supply chain.

Document compliance posture for internal audits. If your organization is preparing for DSCSA system validation or third-party audit, reference ColdChainCheck scores as one input to your trading partner risk assessment. A Fair score (41-60) indicates the entity holds some verified credentials but may lack NABP accreditation or have incomplete state licensure. A Poor or Minimal score (0-40) signals significant gaps in publicly documented compliance signals.

Monitor entities with enforcement history. The 73 entities with recalls or warning letters may face increased FDA inspection frequency. If you source from or distribute to an entity with enforcement history, review whether the underlying issue relates to traceability, storage, or product handling—factors that affect DSCSA system reliability.

Cross-reference state licensing requirements. DSCSA compliance does not override state wholesale distributor licensing laws. 29 states require separate "3PL" or "third-party logistics provider" licenses for entities that warehouse but do not take title to product. Use ColdChainCheck's state-level license tracking to verify your trading partners hold the correct credentials in every jurisdiction where they operate facilities.

ColdChainCheck tracks FDA registration, state licensing, NABP accreditation, and recall history—compliance signals that form the foundation of ATP qualification. For operational guidance on DSCSA system implementation, see the FDA's DSCSA Implementation Guidance and consult legal counsel. Additional regulatory explainers are available in the ColdChainCheck guides section.

Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. Wholesale distributors should consult qualified legal counsel and review current FDA guidance to ensure DSCSA compliance for their specific operations.

Update: DSCSA Track and Trace 2026 | Compliance Checklist — ColdChainCheck

April 2, 2026

DSCSA Track and Trace Requirements for Wholesale Distributors: 2025 Compliance Checklist

On November 27, 2024, the Drug Supply Chain Security Act's enhanced drug distribution security requirements took full effect for wholesale drug distributors. Every wholesale distributor now must verify product identifiers at the unit level before distributing prescription drugs in interstate commerce.

Regulatory Context

The Drug Supply Chain Security Act (DSCSA), enacted as Title II of the Drug Quality and Security Act (Public Law 113-54), established a phased implementation schedule for building an electronic, interoperable system to identify and trace prescription drugs distributed in the United States. The statute amended the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360eee et seq.).

From 2015 through November 2024, wholesale distributors operated under transaction documentation requirements: maintaining paper or electronic transaction histories, transaction information, and transaction statements (the "3Ts"). The November 2024 deadline marked the transition to product-level verification and serialization requirements.

FDA has enforcement discretion authority under Section 582(h) of the FD&C Act. The agency issued guidance documents in 2018, 2019, and 2023 addressing implementation timelines, exemptions for specific product categories, and technical interoperability standards. The most recent guidance, published in July 2023, clarified verification obligations for wholesale distributors receiving product from manufacturers versus other distributors.

Enhanced Requirements Effective November 27, 2024

Product Identifier Verification

Wholesale distributors must verify the product identifier on each sealed homogeneous case or unit-level package before distributing product. Verification requires:

1. Affixing or imprinting the product identifier: A standardized numerical identifier (SNI) in both human-readable and machine-readable (2D Data Matrix barcode) formats.
2. Matching data elements: National Drug Code (NDC), serial number, lot number, and expiration date must match the corresponding transaction information.
3. Responding to verification requests: Distributors must verify product identifiers within 24 hours when requested by an authorized trading partner.

Transaction Information and Interoperable Systems

Distributors must provide transaction information in electronic, interoperable, and machine-readable format. Transaction information includes:

• Proprietary or established product name
• Strength and dosage form
• NDC number
• Container size
• Number of containers
• Lot number
• Transaction date
• Business name and address of entity from which ownership is being transferred
• Business name and address of entity to which ownership is being transferred

Paper or PDF transmission no longer satisfies DSCSA requirements. Distributors must implement Electronic Product Code Information Services (EPCIS) or equivalent interoperable data exchange standards.

Saleable Returns Verification

Before redistributing saleable returns, wholesale distributors must verify the product identifier and investigate discrepancies. If verification fails, the product cannot be further distributed until the distributor:

1. Requests transaction information from the trading partner who returned the product.
2. Resolves the discrepancy or quarantines the product.
3. Notifies FDA and trading partners if suspect product is identified.

Operational Implications for Wholesale Distributors

System Infrastructure

Distributors without serialization-capable warehouse management systems (WMS) or enterprise resource planning (ERP) systems face immediate compliance gaps. Verification at the case level requires:

• 2D barcode scanning capability at receiving and shipping
• Integration between inventory systems and EPCIS-compliant transaction data repositories
• Data storage for transaction information covering six years (per 21 CFR 205.50(g))

Distributors reporting fewer than 100,000 transactions annually (small distributors) received a one-year compliance extension but must now verify product identifiers as of November 2024.

Trading Partner Onboarding

Distributors must verify that upstream suppliers (manufacturers, repackagers, other distributors) are providing transaction information in interoperable electronic format. Non-compliant suppliers create verification failures that prevent product distribution.

Authorized trading partner verification—confirming that entities are licensed or registered as required—remains mandatory under Section 582(c)(4) of the FD&C Act. State licensure status, FDA registration, and NABP accreditation are the primary verification mechanisms.

Suspect Product Protocols

Distributors must maintain written procedures for investigating suspect product. A "suspect product" is defined as product for which credible evidence suggests it is:

• Illegitimate (counterfeit, diverted, stolen, contaminated, or otherwise unfit for distribution)
• In a container or packaging that has been opened or bears evidence of tampering

If verification identifies a suspect product, the distributor must quarantine it within 24 hours and notify FDA and immediate trading partners within 24 hours of determining the product is illegitimate.

What ColdChainCheck Data Shows

Of the 1,275 wholesale drug distributors tracked in ColdChainCheck's directory, 1,234 hold active FDA registration—a foundational requirement for DSCSA compliance. However, FDA registration alone does not indicate readiness for enhanced track and trace requirements. The average compliance score across all entities is 51/100, placing the majority in the "Fair" tier (919 entities). This scoring reflects verified data points across state licensure, NABP accreditation, FDA registration, enforcement history, and business structure—not DSCSA system capability, which remains opaque in public data sources.

Only 63 entities in the directory hold NABP accreditation (formerly VAWD), which requires annual on-site inspections and storage/handling verification. While NABP accreditation is not mandatory under DSCSA, accredited distributors are statistically more likely to have invested in serialization infrastructure. The low accreditation rate suggests that most distributors are meeting baseline licensure requirements without third-party validation of operational systems.

73 entities in the directory have at least one FDA recall on record. Recalls do not automatically indicate DSCSA non-compliance, but they reflect detection gaps in product verification workflows. Under enhanced requirements, distributors with weak verification protocols are more likely to distribute product with identifier discrepancies, triggering suspect product protocols and quarantine obligations.

Compliance Actions for QA and Regulatory Teams

• Verify trading partner readiness: Use the ColdChainCheck directory to confirm that upstream and downstream trading partners hold active FDA registration and state licensure in relevant jurisdictions. Filter by state to identify distributors operating in your supply chain geography.

• Review enforcement history: Check whether current or prospective trading partners have FDA warning letters, recalls, or license suspensions on record. Entities with enforcement actions in the past 24 months may face closer FDA scrutiny during DSCSA inspections.

• Document compliance verification: Maintain records showing that trading partner verification was completed before November 27, 2024. ColdChainCheck score breakdowns show which data sources were verified (state boards, FDA, NABP) and when records were last updated.

• Monitor for updated guidance: FDA continues to issue clarifications on DSCSA exemptions and enforcement discretion. ColdChainCheck's DSCSA compliance guide tracks regulatory updates affecting wholesale distributors, 3PLs, and specialty pharmacies handling serialized products.

DSCSA compliance is not a one-time certification—it requires ongoing verification of trading partners and system capabilities. ColdChainCheck provides a standardized starting point for due diligence, but distributors remain responsible for validating that their suppliers can exchange transaction information in interoperable electronic format.

Disclaimer: This article provides informational content based on publicly available regulatory data and is not legal or compliance advice. Entities subject to DSCSA requirements should consult with legal counsel and verify all regulatory obligations with FDA and relevant state boards of pharmacy.

Update: DSCSA Compliance Checklist 2026 | 12 Requirements — ColdChainCheck

April 22, 2026

DSCSA Compliance Checklist for Pharmacies and Distributors: 2026 Requirements

The Drug Supply Chain Security Act's enhanced drug distribution security requirements take full effect November 27, 2026. Wholesale drug distributors, repackagers, and dispensers must implement unit-level traceability systems capable of verifying, quarantining, and investigating suspect products within six business days. ColdChainCheck tracks compliance signals for 1,275 entities navigating these requirements, with current data showing only 63 hold NABP accreditation—a key indicator of system readiness.

Regulatory Framework

The DSCSA (Public Law 113-54) was enacted November 27, 2013, establishing a phased 10-year implementation schedule for pharmaceutical supply chain security. The statute mandates FDA to create an electronic, interoperable system for identifying and tracing prescription drugs distributed in the United States.

Title II of the DSCSA outlines specific requirements for manufacturers, repackagers, wholesale distributors, and dispensers. The statute's core objectives: verify trading partner legitimacy, detect and remove illegitimate products, facilitate recall execution, and enable unit-level product tracing.

FDA's implementing regulations appear in 21 CFR Parts 201, 205, and 211. The agency issued draft guidance on DSCSA implementation in multiple phases, with the most recent updates addressing the November 2026 compliance deadline.

November 2026 Requirements

Unit-level serialization: Each saleable unit (typically individual bottles or packages) must carry a unique product identifier containing National Drug Code (NDC), serial number, lot number, and expiration date. This identifier must be encoded in a 2D barcode format compliant with GS1 standards.

EPCIS data exchange: Trading partners must exchange serialized data in Electronic Product Code Information Services (EPCIS) format. Transaction Information (TI), Transaction History (TH), and Transaction Statement (TS) requirements evolve from lot-level to unit-level granularity.

Product verification: Distributors and dispensers must be able to verify product identifier authenticity and respond to verification requests within 24 hours for suspect products, 48 hours for illegitimate product investigations.

Quarantine and investigation: Upon receiving notification of suspect product, entities must quarantine affected inventory within six business days and conduct disposition investigations. Illegitimate product must be handled per 21 CFR 205.50(d).

Interoperable systems: Internal systems must interoperate with trading partners' systems to exchange EPCIS data. This requires either direct integration, third-party solution providers, or participation in industry verification router services (VRS).

Returns processing: Saleable returns must include serialized product identifiers. Distributors accepting returns must verify unit-level data and update transaction records accordingly.

Specific Obligations by Entity Type

Wholesale distributors (21 CFR 205.50):

• Accept only products with valid product identifiers from authorized trading partners
• Verify product at package level upon receipt or prior to wholesale distribution
• Maintain 6-year transaction records in electronic format
• Respond to authorized requests for product tracing information within 1 business day (48 hours for suspect product)
• Quarantine and investigate suspect product within regulatory timelines

Repackagers (21 CFR 205.50(e)):

• Affix product identifiers to repackaged units
• Associate repackaged product data with original manufacturer serialization
• Maintain aggregation records linking parent-child relationships

Dispensers/pharmacies (21 CFR 205.54):

• Accept products only from authorized trading partners
• Verify product identifiers on request or prior to dispensing suspect product
• Maintain records enabling product tracing back through the distribution chain
• Quarantine and investigate suspect products

Operational Impact on Distributors

System integration deadlines: Entities still operating lot-level systems must complete unit-level upgrades by November 27, 2026. No enforcement discretion period has been announced for this deadline, unlike previous DSCSA phases.

Testing windows: Trading partners should begin EPCIS data exchange testing in Q1-Q2 2026 to identify interoperability gaps before the compliance deadline. FDA recommends pilot programs with a subset of trading partners before full-scale implementation.

Inventory transitions: Distributors holding lot-level product after November 27, 2026 must either return it to serialization-capable trading partners or dispose of it. Grandfather provisions allowing lot-level product distribution expired with the 2023 requirements.

Verification infrastructure: Entities must subscribe to or build verification systems capable of querying manufacturer/repackager databases or participating in industry VRS networks. The National Council for Prescription Drug Programs (NCPDP) maintains standards for verification routing.

Returns management: Saleable returns processing requires system capability to accept, verify, and update serialization records. Non-saleable returns do not require serialization data but must be documented per existing wholesale distribution regulations.

What ColdChainCheck Data Shows

ColdChainCheck tracks 1,275 wholesale drug distributors and 3PLs across 51 jurisdictions. Current compliance scoring reveals significant gaps in verified readiness indicators for the November 2026 DSCSA requirements.

NABP accreditation rates: Only 63 entities in the directory hold active NABP accreditation (formerly VAWD status). NABP's accreditation program evaluates systems capability, including serialization readiness and electronic pedigree infrastructure. The 4.9% accreditation rate suggests the majority of tracked entities have not undergone third-party verification of their DSCSA systems.

Score distribution: The average compliance score across all entities is 51/100, placing the typical distributor in the "Fair" tier. Score breakdown: 28 entities (2.2%) score "Excellent" (76-100 points), 281 (22%) score "Good" (51-75 points), 919 (72%) score "Fair" (26-50 points), 38 (3%) score "Poor" (11-25 points), and 9 (0.7%) score "Minimal" (0-10 points).

The compliance score methodology awards 25 points for NABP accreditation status—the single largest component tied to DSCSA readiness. Entities scoring below 50 lack this accreditation and may have incomplete state licensure coverage, both of which correlate with lower likelihood of full serialization system deployment.

FDA registration status: 1,234 entities (96.8%) hold active FDA establishment registration. While registration is mandatory under 21 CFR 207, it does not indicate serialization capability or EPCIS system deployment. Registration confirms the entity is on FDA's radar for enforcement but provides no insight into November 2026 technical readiness.

Enforcement history: 73 entities in the directory have at least one FDA recall on record. Recall response capability will become more complex under unit-level tracing—entities with prior recalls should prioritize verification system testing to demonstrate improved product quarantine and investigation workflows.

Practical Steps for Compliance Officers

Verify your trading partners' readiness:

• Search ColdChainCheck's wholesale distributor directory for current distributors in your supply chain
• Prioritize outreach to entities scoring below 50—these distributors may lack NABP accreditation and require direct confirmation of their EPCIS capability
• Request DSCSA system testing windows from distributors scoring 51-75 to validate interoperability before Q4 2026

Document due diligence:

• Export compliance scores and license verification data for trading partners as evidence of pre-qualification efforts
• Cross-reference ColdChainCheck data against your internal approved vendor lists—gaps indicate entities requiring additional vetting
• Monitor recall history in entity profiles to assess historical product integrity performance

Track regulatory signals:

• Subscribe to updates for entities in your supply chain—ColdChainCheck flags new recalls, license suspensions, and accreditation status changes
• Review state-specific licensing data for distributors operating in multiple jurisdictions—incomplete state coverage may indicate operational constraints affecting DSCSA implementation

Assess backup sources:

• Identify alternative distributors with NABP accreditation (63 available in directory) as contingency suppliers if primary partners fail November 2026 readiness testing
• Filter the directory by state and compliance score to build qualified backup vendor shortlists

ColdChainCheck tracks these compliance signals across six data sources: state pharmacy board licensure, NABP accreditation status, FDA establishment registration, FDA recall database, state enforcement actions, and business registration records. The directory updates weekly as source data changes. For guidance on interpreting compliance scores in vendor qualification workflows, see the DSCSA compliance guide for wholesale distributors.

Disclaimer: This article provides informational content based on publicly available regulatory data and is not legal or compliance advice. Entities subject to DSCSA requirements should consult qualified legal counsel and verify all compliance obligations directly with FDA and relevant state authorities.