McKesson DSCSA Compliance Guide for Wholesale Distributors

McKesson's DSCSA Compliance Guide: What Wholesale Distributors Need to Know

McKesson published updated DSCSA implementation guidance in November 2024, detailing its approach to enhanced drug distribution security requirements that took effect August 27, 2025. The document provides a benchmark for how large wholesale drug distributors are interpreting serialization, verification, and transaction data requirements under 21 U.S.C. § 360eee-1.

Regulatory Context

The Drug Supply Chain Security Act established a phased implementation timeline for an electronic, interoperable system to identify and trace prescription drugs distributed in the United States. The statute mandated three critical enforcement dates:

• November 27, 2023: Wholesalers must verify product identifiers on saleable returns from pharmacies and other dispensers
• November 27, 2024: Enhanced verification requirements for suspect and illegitimate products
• August 27, 2025: Full system interoperability — wholesalers must maintain EPCIS-compliant transaction data and participate in product tracing at the package level

Section 582 of the Federal Food, Drug, and Cosmetic Act defines wholesale distributors as entities engaged in wholesale distribution of prescription drugs, excluding manufacturers distributing their own products and certain authorized distributors of record. The DSCSA applies to approximately 4,500 licensed wholesale drug distributors operating in the United States.

McKesson's DSCSA Framework

McKesson's guidance document outlines four operational pillars for DSCSA compliance:

Serialization Infrastructure: McKesson deployed EPCIS 1.2-compliant systems capable of capturing and storing serialized National Drug Codes (SNDCs), lot numbers, and expiration dates at the package level. The company reported completing serialization integration with 95% of its top 100 pharmaceutical manufacturers by March 2024.

Verification Response Service (VRS): McKesson established VRS connectivity to validate product identifiers against manufacturer-maintained repositories. The system performs automated verification for saleable returns, quarantined inventory, and suspect products flagged through internal screening protocols.

Transaction Data Exchange: McKesson transitioned from paper-based transaction statements to electronic data interchange using the GS1 EPCIS standard. The company requires trading partners to accept transaction information, transaction history, and transaction statements in electronic format.

Suspect Product Protocols: McKesson defined specific triggers requiring product quarantine and verification: shipments received from unlicensed sources, products with damaged or missing serialization, products identified through FDA recall notifications, and products flagged by internal analytics systems monitoring for diversion patterns.

Implications for Mid-Size Distributors

McKesson's approach creates a de facto operational standard that influences expectations across the wholesale distribution tier. Mid-size distributors face three specific challenges:

System Integration Costs: EPCIS-compliant serialization systems require integration with warehouse management systems, order processing platforms, and manufacturer VRS endpoints. Distributors handling 500+ SKUs typically report implementation costs between $150,000 and $400,000, excluding ongoing maintenance and trading partner onboarding.

Trading Partner Readiness: Distributors must confirm that upstream suppliers (manufacturers and repackagers) provide EPCIS transaction data and maintain functional VRS endpoints. As of January 2025, FDA reported that approximately 200 drug manufacturers had not yet registered VRS systems, creating compliance gaps for distributors receiving their products.

State Licensure Alignment: While DSCSA is federal law, state boards of pharmacy retain authority to impose additional transaction documentation requirements. Distributors must maintain both DSCSA-compliant electronic records and any state-specific pedigree or chain-of-custody documentation. California, Florida, and Texas maintain parallel transaction reporting requirements that exceed DSCSA minimums.

The enhanced drug distribution security requirements under DSCSA do not replace state wholesale drug distributor licensing obligations under 21 CFR 205. Distributors must maintain both federal DSCSA compliance and active state licenses in each jurisdiction where they operate.

What ColdChainCheck Data Shows

ColdChainCheck tracks 1,275 wholesale drug distributors and 3PLs across 51 jurisdictions. The current compliance score distribution suggests uneven preparedness for DSCSA's August 2025 interoperability requirements:

• 28 entities (2.2%) score in the Excellent tier (76-100 points)
• 281 entities (22%) score in the Good tier (61-75 points)
• 919 entities (72%) score in the Fair tier (41-60 points)
• 47 entities (3.7%) score in the Poor or Minimal tiers (0-40 points)

The 72% Fair-tier concentration indicates that most distributors maintain basic state licensure and FDA registration but lack secondary compliance signals like NABP accreditation or clean enforcement records. Fair-tier scores do not indicate DSCSA non-compliance—ColdChainCheck does not yet track serialization system deployment or VRS connectivity. The score reflects verified regulatory standing across state licenses, FDA registration, NABP accreditation status, recall history, and FDA warning letters.

Of the 1,275 tracked entities, 1,234 (96.8%) hold active FDA registration under 21 CFR 207. The remaining 41 entities operate under state-only licenses, typically handling non-FDA-regulated products or operating as logistics providers rather than wholesale distributors under DSCSA definitions.

Only 63 entities (4.9%) hold NABP accreditation (formerly VAWD). NABP accreditation requires operational audits covering storage, handling, and pedigree practices but does not independently verify DSCSA serialization compliance. The low accreditation rate reflects NABP's voluntary program structure—most distributors rely on state licensure rather than third-party accreditation.

Practical Steps for QA and Procurement Teams

Verify trading partner licensure: Use the ColdChainCheck directory to confirm that upstream distributors and 3PLs maintain active state licenses in jurisdictions where they store or ship product. DSCSA compliance does not supersede state licensing requirements under 21 CFR 205.

Check recall history: 73 entities in the directory have FDA recalls on record. Review recall data for potential trading partners to identify entities with product handling or storage control issues that may indicate operational risk beyond DSCSA scope.

Document due diligence: Maintain records showing verification of trading partner FDA registration numbers and state license statuses. Auditors expect documented evidence of pre-qualification checks, not reliance on distributor self-reporting.

Monitor ongoing compliance signals: ColdChainCheck updates license statuses and enforcement actions monthly. Set quarterly reviews for active trading partners to detect license suspensions, new warning letters, or recall events between annual vendor re-qualification cycles.

For broader DSCSA implementation guidance, see the ColdChainCheck compliance guides covering state-specific licensing requirements and federal enforcement timelines.

Disclaimer: This article provides informational analysis of publicly available regulatory guidance and compliance data. It does not constitute legal or compliance advice. Verify all regulatory requirements with qualified legal counsel and the relevant regulatory authorities.