DSCSA Requirements for Small Distributors in 2026

For a small US wholesale distributor, DSCSA in 2026 means five things: buy from and sell to authorized trading partners only, trade only product that carries a product identifier, exchange package-level transaction data electronically, verify suspect and returned product, and keep the records for six years. The main exception is sales to small dispensers, which remain exempt until 27 November 2027.

What changed on 27 August 2025?

The Drug Supply Chain Security Act (DSCSA) set 27 November 2023 as the date for the "enhanced drug distribution security" requirements in section 582(g)(1) of the FD&C Act: interoperable, electronic tracing at package level. FDA then gave a one-year stabilization period and, in October 2024, staggered exemptions by trading-partner type.

The exemption for wholesale distributors expired on 27 August 2025. Since then, a distributor that still cannot exchange serialized data needs its own waiver, exception or exemption from FDA. FDA explains how to request one on its waivers and exemptions page.

Which customers are still exempt?

According to FDA's exemptions page (updated 26 August 2026), small dispensers are exempt until 27 November 2027. A small dispenser has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. FDA also ran a small-dispenser assessment survey that closed on 22 September 2026.

Trading partners of exempt small dispensers do not need to file anything with FDA. In practice, you can keep supplying them using your current methods. Record which customers you treat as small dispensers and why, because the rest of your customer base is not exempt.

Trading partner	Enhanced requirements apply from
Manufacturers and repackagers	Exemption ended 27 May 2025
Wholesale distributors	Exemption ended 27 August 2025
Dispensers with 26 or more pharmacist/technician FTEs	Exemption ended 27 November 2025
Small dispensers (25 or fewer FTEs)	Exempt until 27 November 2027

The dates for manufacturers and larger dispensers come from FDA's October 2024 exemptions letter. Check FDA's page before relying on them, because FDA has changed these dates more than once.

What does a distributor have to do today?

The statutory duties for wholesale distributors are in 21 U.S.C. 360eee-1(c), with the enhanced requirements in subsection (g). In summary:

Authorized trading partners only. Every supplier and customer must be registered or licensed as required. Keep state licence numbers and expiry dates on file and block orders when a licence lapses. See FDA's trading-partner guidance.
Product identifiers. Deal only in product encoded with a product identifier: the National Drug Code inside a GTIN, plus serial number, lot and expiry, in a GS1 DataMatrix barcode.
Electronic, package-level transaction data. Receive transaction information and statements from suppliers, and pass them on to customers, in an interoperable electronic format. FDA's standards guidance points to GS1 EPCIS as the industry standard.
Verification. When you find suspect product, or FDA asks you to verify, respond within one business day and in no case more than 48 hours.
Illegitimate product. Quarantine it. Notify FDA (Form FDA 3911) and all immediate trading partners you believe received it within 24 hours of your determination. Keep the investigation records.
Saleable returns. Before you resell a returned package, verify its product identifier with the manufacturer. Most distributors use the industry Verification Router Service (VRS) for this.
Records. Keep transaction information, history and statements for at least six years after the transaction.

How does EPCIS data flow through a small distributor?

EPCIS is a GS1 standard for describing what happened to which serial number, where and when. For a distributor the daily flow is:

The manufacturer sends an EPCIS shipping file listing every serial (and case or pallet SSCC aggregation) in the shipment.
Your warehouse scans cases or packs at receipt. Each scan is matched against the EPCIS file before the stock becomes saleable.
Mismatches (missing data, unexpected serials, wrong lot) go to quarantine for investigation.
At dispatch, you scan what is picked and send the customer an EPCIS file for exactly those serials.

The version in common use is EPCIS 1.2, with EPCIS 2.0 support growing. Agree the version and exchange method with each partner before go-live.

Should DSCSA live in the ERP or a separate service?

Most small distributors use two systems. The ERP holds products, lots, expiry dates, stock locations, quarantine status, customers, licences, orders and invoices. A DSCSA network service exchanges EPCIS files with suppliers and customers, stores serialized history for six years and answers VRS requests.

Job	ERP	DSCSA / EPCIS service
Lot and expiry at receipt, FEFO picking	Yes	No
Trading-partner licence records	Yes	Often duplicated
Receive and send EPCIS files	Sometimes	Yes
VRS verification of returns	Rarely	Yes
Quarantine and investigation workflow	Yes	Partly
Six-year serialized record store	Sometimes	Yes

What matters is the link between them: a scan at receipt or dispatch should update both, and a quarantine in one should block sales in the other.

What should a small distributor check this quarter?

List every supplier and customer with licence numbers and expiry dates. Flag which customers are small dispensers under FDA's definition.
Confirm each supplier is sending EPCIS data and that your provider is receiving it without errors.
Test a receipt end to end: scan, match, release. Then test a mismatch and check that it lands in quarantine.
Run a saleable return through VRS and time it.
Write a suspect-product procedure that covers who decides, how stock is quarantined, and who files Form 3911 within 24 hours.
Confirm you can retrieve a six-year-old transaction record.

How Asli Pharma ERP helps

Asli Pharma ERP is a cloud ERP that handles the ERP side of the table above: lot and expiry capture at receipt, FEFO picking, quarantine with authorized QC release, GS1 DataMatrix scanning, batch recall with a full customer trace, and an audit trail. It has an EPCIS event module, built for the UAE's Tatmeen system. US DSCSA data exchange through an integration partner is on the roadmap and is not available today. Until it ships, you would run Asli alongside your DSCSA provider, and Asli does not claim DSCSA compliance.

Frequently asked questions

Is my wholesale distribution business still exempt from DSCSA enhanced requirements?

Not by default. FDA's exemption for wholesale distributors from the section 582(g)(1) enhanced drug distribution security requirements expired on 27 August 2025. Relief now comes only from an individual waiver, exception or exemption that a company requests from FDA.

Do I need to send EPCIS data to small pharmacies?

Not yet in most cases. FDA extended the exemption for small dispensers (25 or fewer full-time pharmacists and pharmacy technicians) to 27 November 2027, and trading partners may continue using current methods with them until then. Confirm each customer qualifies and keep a record of it.

How long must DSCSA records be kept?

Wholesale distributors must keep transaction information, transaction history and transaction statements for not less than six years after the date of the transaction, under 21 U.S.C. 360eee-1(c).

How fast must I act on illegitimate product?

Once you determine a product is illegitimate, you must notify FDA and all immediate trading partners you believe may have received it within 24 hours. FDA uses Form FDA 3911 for these notifications. Responses to FDA verification requests are due within one business day and no later than 48 hours.

Can my ERP handle DSCSA on its own?

Some pharma ERPs market built-in DSCSA, but most small distributors run a specialist DSCSA or EPCIS network service alongside the ERP. The ERP holds lots, stock, customers and invoices; the DSCSA service exchanges serialized data with trading partners and routes verification requests.

DSCSA requirements for small pharmaceutical distributors in 2026