Handling Suspect and Illegitimate Products Under DSCSA

Handling Suspect and Illegitimate Products Under DSCSA

Wholesale distributors must identify, quarantine, investigate, and report suspect and illegitimate products under Section 582(c)(4) of the Drug Supply Chain Security Act. FDA enforcement of these requirements began August 27, 2025, when wholesale distributor exemptions expired. Facilities failing to maintain written procedures for suspect product handling, complete investigations within reasonable timeframes, or notify FDA within 24 hours of illegitimate product determinations face 483 observations and enforcement action.

Background and Regulatory Context

The Drug Supply Chain Security Act (DSCSA) was enacted November 27, 2013, as Title II of the Drug Quality and Security Act (Pub. L. 113-54). Section 582 established verification, investigation, and notification requirements for suspect and illegitimate products applicable to manufacturers, wholesale distributors, dispensers, repackagers, and third-party logistics providers.

Wholesale distributors operated under transaction-level exemptions through August 26, 2025. These exemptions permitted product distribution based on transaction information, transaction history, and transaction statement (TI/TH/TS) in paper or electronic form without package-level verification. The November 27, 2023 deadline activated enhanced verification requirements, but FDA extended enforcement discretion for wholesale distributors through the exemption period.

As of August 27, 2025, wholesale distributors must verify product at the package level using the product identifier (PI) — a standardized numerical identifier consisting of National Drug Code (NDC), serial number, lot number, and expiration date. This package-level verification requirement applies when investigating suspect products, conducting saleable returns verification, and responding to requests from authorized trading partners.

DSCSA regulates entities based on their role in the pharmaceutical supply chain. Wholesale distributors are defined under 21 U.S.C. § 360eee(22) as entities engaged in wholesale distribution of prescription drugs. 3PLs that take title to product are regulated as wholesale distributors. 3PLs providing only logistics services without taking title operate under separate requirements in 21 U.S.C. § 360eee-3(d).

Key Requirements

Definitions and Evidentiary Standards

DSCSA establishes two product classifications with distinct evidentiary thresholds under FD&C Act Section 581(8) and (21).

Suspect product requires "reason to believe" the product is potentially counterfeit, diverted, stolen, intentionally adulterated, subject to fraudulent transaction, or otherwise unfit for distribution. This lower evidentiary threshold triggers investigation and quarantine obligations.

Illegitimate product requires "credible evidence" the product meets one of the same six categories. This higher evidentiary threshold triggers mandatory 24-hour notification to FDA and trading partners.

Products are unfit for distribution when adulterated under FD&C Act Section 501, misbranded under FD&C Act Section 502, or otherwise compromised in safety, identity, strength, quality, or purity in a manner likely to cause serious adverse health consequences or death. Products awaiting reverse distribution, products under Section 582(a)(3) waivers, and grandfathered products under Section 582(a)(5) are excluded from the unfit classification.

Quarantine Requirements

Wholesale distributors must immediately quarantine any product meeting the suspect definition under FD&C Act Section 582(c)(4)(A)(i). Quarantine means physical segregation from saleable inventory to prevent distribution, sale, or transfer during investigation.

Quarantine must be maintained throughout the investigation period. DSCSA does not specify a fixed investigation timeline, but FDA expects prompt action. Delays in investigation without documented justification may constitute failure to maintain adequate systems and processes under 21 U.S.C. § 360eee-1(c)(4).

Quarantined product must remain segregated until investigation concludes the product is not illegitimate or until proper disposition (destruction, return, or reverse distribution) is completed for illegitimate product.

Investigation Requirements

Upon identifying suspect product, wholesale distributors must conduct a documented investigation to determine whether the product is illegitimate under FD&C Act Section 582(c)(4)(A)(ii).

Investigations must verify:

• Product identifier accuracy by comparing serialized data against manufacturer records
• Transaction information completeness and authenticity
• Transaction history integrity across all trading partners in the chain
• Transaction statement validity for each distribution event
• Authorized Trading Partner (ATP) status of all entities in the transaction chain

Wholesale distributors must coordinate with manufacturers during investigations. Manufacturers possess authoritative serialization data and can definitively verify or invalidate product identifiers. Failure to consult the manufacturer during suspect product investigation weakens evidentiary findings.

Investigations must examine both DSCSA-required transaction data and non-DSCSA records including shipping documentation, temperature monitoring records, purchase orders, and physical packaging condition. FDA guidance FDA-2014-D-0609 emphasizes totality of circumstances analysis when assessing whether credible evidence exists.

Notification Requirements

When an investigation determines a product is illegitimate, wholesale distributors must notify FDA and immediate trading partners within 24 hours under FD&C Act Section 582(c)(4)(A)(iii).

FDA notification must be submitted to FDA's Division of Drug Quality I (DDQI) via email to drugshortages@fda.hhs.gov and DrugSupplyChainIntegrity@fda.hhs.gov. Notifications should include:

• Product identification (proprietary name, NDC, lot number, serial numbers)
• Nature of illegitimacy determination (counterfeit, diverted, stolen, intentionally adulterated, fraudulent transaction, or unfit)
• Quantity affected
• Trading partner information (entities who sold the product, entities to whom it was sold)
• Actions taken (quarantine, disposition plans)

Trading partner notification must reach all immediate trading partners who may have received the illegitimate product. This includes parties to whom the product was sold. In certain circumstances, notification to the party from whom the product was purchased is appropriate when that party may have additional illegitimate product or when coordination is necessary to trace the product through the supply chain.

Manufacturers face a higher notification standard. When notified of suspect product and determining there is high risk of illegitimacy, manufacturers must notify FDA and trading partners within 24 hours even before final illegitimate determination under FD&C Act Section 582(b)(4)(A)(iii).

Disposition Requirements

Illegitimate product must not be distributed under any circumstances per FD&C Act Section 582(c)(4)(A)(iv). Wholesale distributors may:

• Destroy product per documented procedures compliant with DEA requirements for controlled substances
• Return product to manufacturer or seller for credit if coordinated and documented
• Route product through reverse distribution channels appropriate to the specific circumstances

Disposition decisions should be documented with rationale, particularly when product is returned rather than destroyed. All disposition activities must be retained in investigation records for six years.

Record Retention

Wholesale distributors must maintain records for six years under 21 U.S.C. § 360eee-1(c)(1). This includes:

• Transaction data (TI, TH, TS) for all distributions
• Investigation records documenting suspect product identification, investigation steps, parties consulted, findings, and disposition
• Notification records (FDA submissions and trading partner communications)
• Written policies and procedures for suspect and illegitimate product handling

Investigation records must identify the nature of the error or suspicion, resolution steps, parties involved, resolution date, and final disposition per FDA guidance FDA-2014-D-0609.

Compliance Steps

1. Establish Written Procedures

Develop and maintain written policies and procedures (P&Ps) for identifying, quarantining, investigating, and dispositioning suspect and illegitimate products. P&Ps must address:

• Identification triggers (transaction data discrepancies, packaging anomalies, trading partner red flags, external notifications)
• Quarantine protocols (physical segregation methods, inventory system flags, access controls)
• Investigation protocols (product identifier verification steps, trading partner contact procedures, manufacturer consultation requirements, documentation standards)
• Notification templates (FDA format, trading partner format, timeline monitoring)
• Disposition procedures (destruction, return, reverse distribution authorization)

Review and update P&Ps annually or when regulatory requirements change. Ensure staff training on current procedures.

2. Implement Package-Level Verification Systems

Deploy systems capable of verifying product identifiers at the package level during receiving, saleable returns processing, and suspect product investigation. Verification systems must:

• Scan 2D Data Matrix barcodes containing serialization data (NDC, serial number, lot, expiration)
• Query manufacturer Verification Router Service (VRS) endpoints or authorized DSCSA solution providers
• Flag mismatches, invalid serial numbers, or verification failures for immediate investigation
• Generate audit trails of all verification activities

Wholesale distributors using legacy systems based on TI/TH/TS documents without package-level scanning capability are non-compliant as of August 27, 2025.

3. Train Personnel on Physical Indicators

Conduct training for receiving, warehousing, and quality assurance personnel on physical indicators of suspect product:

• Packaging inconsistencies (misspellings, incorrect colors, unusual materials, low-quality printing)
• Tampered or broken seals
• Products lacking 2D Data Matrix barcodes or serialized identifiers
• Temperature excursions inconsistent with shipping documentation
• Damaged secondary or tertiary packaging

Establish clear escalation procedures so personnel know exactly whom to contact when physical indicators are observed.

4. Verify Trading Partner ATP Status

Maintain current ATP verification for all trading partners. Confirm:

• State licensure in the state where the facility operates and the state to which product is shipped
• FDA registration (if applicable based on entity type)
• NABP VAWD accreditation (not required but provides additional verification signal)
• No exclusions from federal healthcare programs via HHS OIG LEIE database

Trading partners with unverifiable ATP status, lapsed licenses, or history of distributing suspect product present heightened risk. Document ATP verification frequency (quarterly minimum recommended).

5. Establish Manufacturer Contact Protocols

Pre-identify manufacturer contacts for product verification. During investigations:

• Contact the manufacturer's DSCSA compliance team or quality assurance department
• Provide product identifier data (NDC, serial number, lot, expiration)
• Request confirmation of serialization data authenticity
• Request transaction history from the manufacturer to the first wholesale distributor

Maintain a database of manufacturer DSCSA contacts to minimize investigation delays. Update contacts quarterly as personnel change.

6. Document Investigations From Initiation

Begin documentation at the moment suspect product is identified. Record:

• Date and time of identification
• Person who identified the issue
• Nature of the suspicion (which category and specific evidence)
• Quarantine actions taken (timestamp, location, system flags applied)
• Parties contacted (manufacturers, trading partners, internal personnel)
• Verification results (serial number validation, TI/TH review findings)
• Evidence reviewed (DSCSA transaction data, shipping records, temperature logs, photos of packaging)
• Conclusion (suspect cleared or escalated to illegitimate determination)
• Disposition (product released, destroyed, returned, or routed through reverse distribution)

Use standardized investigation forms to ensure consistency and completeness.

7. Implement 24-Hour Notification Monitoring

When an investigation determines a product is illegitimate, activate a 24-hour countdown for notification. Assign a specific individual responsible for:

• Preparing FDA notification (populate pre-built template with case-specific data)
• Preparing trading partner notification (identify all parties who received the product)
• Submitting notifications via required channels (email to FDA, direct communication to trading partners)
• Documenting submission timestamps and recipient confirmations

Test notification procedures quarterly through tabletop exercises simulating illegitimate product determination scenarios.

8. Conduct Mock Suspect Product Drills

Run simulated suspect product scenarios quarterly to test:

• Staff ability to recognize identification triggers
• Quarantine execution speed and accuracy
• Investigation protocol adherence
• Notification timeline compliance
• Documentation completeness

Drills should vary scenarios (diverted product, counterfeit packaging, fraudulent TI, stolen product) to ensure staff competency across all categories.

9. Monitor External Alerts

Subscribe to:

• FDA MedWatch safety alerts and drug recalls
• NABP Pulse notifications of counterfeit or diverted product alerts
• State board of pharmacy bulletins on licensure actions against distributors
• Trading partner suspect product notifications

Integrate external alerts into daily operations reviews. Incoming product from manufacturers or distributors named in alerts should receive enhanced scrutiny during receiving.

10. Maintain Segregated Quarantine Areas

Designate physical quarantine areas with:

• Clear signage indicating quarantine status
• Access controls (locked cages, restricted badge access, security monitoring)
• Inventory system integration (flagged SKUs cannot be picked or transferred)
• Environmental controls appropriate to product storage requirements

Quarantine areas should be visually distinct to prevent accidental commingling with saleable inventory during picking or cycle counts.

ColdChainCheck Insights

DSCSA Compliance Indicators in Our Dataset

What the Data Reveals

The 97% FDA registration rate reflects the statutory requirement under 21 U.S.C. § 360 for drug establishments engaged in manufacturing, repackaging, or wholesale distribution. The 5% NABP accreditation rate indicates that voluntary VAWD accreditation remains uncommon — most entities rely on state licensure and FDA registration alone to establish ATP status. The 6% recall rate (73 entities with FDA recalls on record) provides a compliance signal: these entities have demonstrated quality system failures resulting in product removal from commerce. While a recall does not automatically disqualify an entity as an authorized trading partner, it indicates heightened scrutiny is warranted during ATP verification and suspect product investigations involving these distributors. The scoring methodology used by ColdChainCheck weights these signals to produce a standardized compliance posture assessment.

How to Use ColdChainCheck for Trading Partner Verification

• Cross-reference ATP verification findings: After verifying state licensure through individual state boards of pharmacy, check the trading partner's FDA registration status and recall history in ColdChainCheck to identify compliance gaps or negative signals not visible in state license data alone.
• Identify trading partners with NABP accreditation: The 63 NABP-accredited entities in the directory represent distributors that have undergone NABP's facility inspection and operational systems review — a supplemental verification signal beyond minimum ATP requirements.
• Flag entities with recall histories for enhanced monitoring: When onboarding or re-qualifying trading partners, entities with recalls on record warrant additional scrutiny during due diligence — request root cause analysis documentation and CAPA implementation evidence for past recalls before finalizing ATP status.
• Benchmark compliance scores during trading partner selection: When multiple distributors can fulfill a sourcing requirement, compliance scores provide a standardized signal for comparing regulatory posture — entities scoring 60+ demonstrate stronger verified compliance signals across state licensure, FDA registration, and NABP accreditation dimensions.

Resources

• FDA Drug Supply Chain Security Act (DSCSA) — Official FDA DSCSA resource page
• FDA Guidance: Definitions of Suspect Product and Illegitimate Product — FDA-2018-D-0338
• FDA Guidance: Identification of Suspect Product and Notification — FDA-2014-D-0609
• NABP Verified-Accredited Wholesale Distributors (VAWD) — NABP accreditation program
• GS1 US DSCSA Resources — Serialization and data standards
• Healthcare Distribution Alliance DSCSA Implementation Guide — Industry association guidance
• 21 U.S.C. § 360eee et seq. — Full text of DSCSA statute
• FDA Drug Shortage and Supply Chain Integrity Email — Contact for illegitimate product notifications

Disclaimer: This article provides informational content based on publicly available regulatory requirements and industry guidance. It is not legal advice. Wholesale distributors should consult qualified regulatory counsel and conduct independent compliance assessments to ensure adherence to all applicable DSCSA requirements.