DSCSA and EU FMD Serialization Requirements for Manufacturers

US DSCSA and EU FMD Serialization Requirements: Manufacturing Compliance Obligations

The US Drug Supply Chain Security Act (DSCSA) and European Union Falsified Medicines Directive (FMD) impose distinct but parallel serialization requirements on pharmaceutical manufacturers, creating overlapping compliance obligations for entities that operate in both markets. As of November 27, 2024, US manufacturers must implement product identifier serialization under 21 USC 360eee-1, while EU manufacturers have operated under serialization mandates since February 9, 2019 under Directive 2011/62/EU and Commission Delegated Regulation (EU) 2016/161.

Regulatory Framework

US DSCSA Requirements

The DSCSA requires manufacturers to affix a product identifier to each saleable unit and homogenous case. The product identifier must contain the National Drug Code (NDC), a unique serial number, lot number, and expiration date, encoded in a 2D Data Matrix barcode compliant with GS1 standards. Under 21 CFR 582, manufacturers must maintain transaction information, transaction history, and transaction statements (TI/TH/TS) for all products distributed into US commerce.

Enhanced drug distribution security requirements took effect on November 27, 2024. Manufacturers must now verify returned products, investigate suspect products within five business days, and quarantine illegitimate products. The FDA issued final guidance on verification systems, requiring manufacturers to respond to verification requests from authorized trading partners within 24 hours.

EU FMD Requirements

The EU FMD mandates manufacturers affix a unique identifier (UI) and anti-tampering device (ATD) to the outer packaging of prescription medicines. The UI consists of a product code, serial number, national reimbursement number, expiration date, and batch number, encoded in a 2D Data Matrix barcode. Data must be uploaded to the European Medicines Verification System (EMVS) hub before products enter the supply chain.

Commission Delegated Regulation (EU) 2016/161 specifies the technical characteristics of the UI and ATD. Manufacturers must upload UI data to their national medicine verification system (NMVS) repository, which connects to the EU Hub. Pharmacies and hospitals verify products at the point of dispense by scanning the UI and decommissioning it in the EMVS.

Operational Requirements

Serialization Data Management

US manufacturers must generate unique serial numbers for each saleable unit using an FDA-approved serialization algorithm or GS1 standard. Serial numbers must be non-repeating for at least 20 years and cannot be reassigned to a different product. Aggregation data — linking serial numbers at the unit, case, and pallet level — is recommended but not required under current DSCSA regulations.

EU manufacturers must generate random or pseudo-random serial numbers compliant with ISO/IEC 15459. The serial number must be unique within the product code and cannot be reused. Unlike DSCSA, the EU FMD requires manufacturers to upload serialization data to the repository before products are released for distribution, creating a synchronous verification model.

Production Line Integration

Manufacturers must integrate serialization into existing packaging lines, requiring line-level serialization hardware, vision systems for print quality verification, and software to manage serial number generation and aggregation. Line speeds range from 100 to 600 units per minute for oral solids, creating quality control challenges at high throughput rates.

Both regulations require 100% verification of serialized data at the packaging line. Reject rates for unreadable or duplicate serial numbers must be tracked and reported as part of quality system documentation under 21 CFR Part 211 (US) and EU GMP Annex 11.

Compliance Deadlines

US manufacturers subject to DSCSA have been required to serialize products since November 27, 2018, with enhanced verification and interoperability requirements phased in through November 2024. The FDA has not announced further delays to enforcement, though the agency granted limited enforcement discretion during the COVID-19 pandemic.

EU manufacturers have operated under full serialization mandates since February 9, 2019. Member states may grant exemptions for specific product categories, but most prescription medicines distributed in the EU must carry a unique identifier and be uploaded to the EMVS.

What ColdChainCheck Data Shows

ColdChainCheck tracks 1,275 wholesale drug distributors and 3PLs, of which 1,234 hold active FDA registration — the foundational requirement for entities handling serialized products under DSCSA. However, FDA registration alone does not indicate DSCSA serialization readiness. The average compliance score across the directory is 51/100, placing most entities in the "Fair" tier. This suggests baseline regulatory compliance but limited visibility into advanced capabilities like enhanced verification systems or EPCIS 1.4 implementation.

Only 63 entities in the directory hold NABP accreditation (formerly VAWD), which requires annual inspection of quality systems, storage conditions, and supply chain security practices. NABP-accredited distributors are more likely to have implemented internal controls for handling serialized products, including transaction data verification and product identifier scanning at receipt. Of the 919 entities scored "Fair," the majority lack NABP accreditation, indicating potential gaps in verifiable serialization infrastructure.

Seventy-three entities in the directory have at least one FDA recall on record. While recalls do not directly correlate with serialization failures, they signal quality system deficiencies that could extend to serialization data integrity. Enhanced DSCSA requirements now mandate verification of returned products and investigation of suspect products within five business days — capabilities that require functioning serialization systems and trading partner connectivity.

Practical Guidance for QA and Compliance Teams

• Verify distributor DSCSA readiness before November 27, 2024 enforcement. Check the ColdChainCheck directory to confirm whether your wholesale partners hold active FDA registration and NABP accreditation. Entities without NABP accreditation should be asked to demonstrate enhanced verification system capability through documentation or third-party audit.

• Document serialization verification workflows in SOPs. DSCSA requires verification of product identifiers on returned products and suspect product investigations. If your trading partner cannot respond to verification requests within 24 hours, document the gap and escalate to procurement for alternative sourcing.

• Monitor enforcement actions for serialization non-compliance. ColdChainCheck tracks FDA warning letters and recall data. Entities with recent enforcement actions related to counterfeit products, diverted drugs, or supply chain security failures may lack functional serialization systems. See the compliance guides for DSCSA enforcement trends.

• Assess aggregation data capabilities for 3PL partners. While DSCSA does not mandate aggregation, entities that manage case- and pallet-level serialization data provide higher supply chain visibility. Request Evidence of Delivery (EOD) documentation that includes aggregated serial numbers to verify product movement accuracy.

Disclaimer: This article provides informational content based on publicly available regulatory requirements and ColdChainCheck directory data as of the publication date. It is not legal or compliance advice. Readers should consult with qualified legal counsel and verify all regulatory requirements with the FDA, NABP, and relevant state boards of pharmacy.