Whether or not you sail by DEA Schedule III registration or spend the approaching weeks scrambling relies on how properly your present program is documented and whether or not you’ve gotten already addressed the 5 necessities that your state license doesn’t cowl.
Schedule III rescheduling for state-licensed medical marijuana went into impact April 28, 2026 (DOJ). As of that date, state-licensed medical hashish cultivators are federally labeled as DEA-registered producers of a Schedule III managed substance. The registration portal opened April 29. Operators who register earlier than the top of June 2026 obtain expedited assessment and should proceed working below their state license whereas DEA processes the appliance. Miss that window and also you enter the usual queue, with no assured operational continuity and potential federal publicity (Fennemore Legislation).
The exact cutoff date has been cited in another way throughout authorized sources, starting from June 22 to June 29, relying on how the 60-day window from Federal Register publication is calculated. File properly earlier than the top of June and don’t depend on the final accessible day. The appliance is reside, the questions are particular, and most grows are usually not as ready as they assume.
What DEA Registration Really Requires From Cultivators
The registration portal is at mmapplication.diversion.dea.gov. Cultivators register as producers, which carries an annual charge of $3,699 per the DEA remaining rule (91 Fed. Reg. 22714). That’s the producer price, not the $888 dispenser price that applies to retail operations. Cost is at the moment accepted through PayPal solely, so operators will want an account arrange earlier than beginning the appliance. Charges are non-refundable.
There’s one mechanism within the registration framework that has no precedent in state licensing frameworks and deserves consideration upfront. Below the Single Conference treaty obligations the rescheduling order is constructed on, DEA should function the unique purchaser of hashish manufacturing. In observe, this implies registered cultivators set a nominal worth for his or her crop, DEA purchases it at that worth and sells it again plus an administrative charge, and the crops should stay in a DEA-accessible facility till that transaction completes. The appropriate to examine that facility is unconditional and on demand. This isn’t a theoretical federal oversight posture; it’s a standing operational requirement (DEA remaining rule, 91 Fed. Reg. 22714).
For many state-licensed medical cultivators, the SOP classes the appliance covers won’t really feel unfamiliar. Ordering, receiving, stock, storage, safety, disposal, theft and loss reporting, recordkeeping: these are the identical operational controls Colorado, California, and just about each mature medical state already requires for license upkeep. The DEA software is basically asking cultivators to substantiate that their present compliance infrastructure is documented and present.
Compliant Colorado grows have most of this. Colorado serves as a helpful benchmark as a result of its MED necessities signify one of many extra mature state compliance frameworks within the nation. Operators in different states ought to audit in opposition to their very own licensing necessities, however the 5 federal additions beneath are new no matter the place you use.
Colorado MED badge necessities already cowl fingerprint-based prison background checks, date of beginning, and id verification for all workers. MED licensing already mandates alarm programs with skilled monitoring, zone-based entry controls, safe storage, and steady video surveillance in restricted entry areas. METRC already handles seed-to-sale stock monitoring, waste disposal documentation, and theft and loss reporting on the state degree.
The place the federal framework provides genuinely new necessities, the gaps are particular.
5 DEA registration necessities which can be new, no matter the place you use.
First, Social Safety numbers are required for each particular person with entry to managed substances; MED makes use of fingerprints and government-issued ID, not SSNs.
Second, the appliance requires itemizing upstream hashish suppliers and their federal DEA registration numbers, that means different registered handlers who switch plant materials to the power, akin to clone suppliers or biomass sources. This doesn’t prolong to distributors of vitamins, develop media, or different non-cannabis inputs.
Third, DEA registration grants unconditional on-demand inspection authority that’s basically completely different from MED’s scheduled or complaint-driven inspection mannequin.
Fourth, the nominal worth crop purchase-and-resale mechanism has no state program equal.
Fifth, registration creates parallel federal recordkeeping obligations, quota reporting, and import and export allow necessities that run alongside the present state compliance stack, not rather than it.
These 5 objects are the place compliant medical grows even have preparation work to do.
DEA confirmed in Might 2026 that separate registration varieties for manufacturing, distribution, and testing companies are in growth. The present portal pathway is obtainable now for cultivators utilizing the present Kind 225 course of with the suitable medical marijuana drug codes. Monitor mmapplication.diversion.dea.gov for the cannabis-specific producer type.
Why Biosecurity Is the Basis, Not Simply an Agronomic Program
The belief that biosecurity is primarily about IPM and pathogen exclusion is without doubt one of the most consequential misframings in hashish cultivation proper now. A practical biosecurity program overlaying zone-based entry, entry and exit logging, quarantine protocols, and chain of custody from propagation by harvest is structurally an identical to what DEA is asking for. The hole, for many grows, isn’t this system itself. It’s whether or not this system is documented.
Think about how every layer maps.
Personnel entry controls. Colorado MED already requires zone-based entry controls, badged entry, and restricted entry space documentation. DEA registration doesn’t reinvent this. It asks cultivators to re-confirm the present framework inside a federal context and provides the SSN requirement for personnel with managed substance entry. If MED-compliant entry logs are present and retrievable, this portion of the appliance is primarily a translation train.
Storage safety. MED already requires vaults, safes, and safe storage, so the safety {hardware} questions on the DEA software cowl acquainted floor. The brand new obligation is the DEA-accessible facility requirement: storage areas should stay accessible for federal inspection on demand, and crops can not depart the power till the purchase-and-resale transaction completes. The rule doesn’t prescribe a particular SOP format for this. The registration itself specifies the permitted cultivation areas, and bodily entry is the operative requirement. What it means virtually is that any biosecurity protocol governing facility lockdown, restricted entry, or crop motion must account for DEA’s unconditional proper to enter.
Stock and traceability. METRC already captures harvest batch data, plant and package deal actions, and waste in Colorado. Cultivators working clear METRC data are well-positioned right here. The hole is on the enter aspect: DEA requires provider info together with federal registration numbers for upstream hashish handlers, which METRC doesn’t seize in that format. Pesticide software logs, IPM data, and fumigation documentation that biosecurity packages generate additionally feed instantly into the GACP traceability necessities that observe DEA registration. These data carry worth past the rapid software.
Destruction and disposal. METRC tracks hashish plant waste and disposal in Colorado, so this SOP requirement is basically met for compliant grows. What DEA provides on prime of that’s guaranteeing disposal documentation aligns with federal 21 CFR Half 1317 requirements alongside state data, and that biosecurity disposal protocols for contaminated or contaminated plant materials are written down somewhat than practiced informally.
Biosecurity packages constructed as documented, SOP-driven compliance programs map on to DEA registration necessities. Packages constructed as cultivation observe, efficient however casual, require important documentation work earlier than the appliance may be accomplished precisely. The window is tight and shutting.
GACP: The Subsequent Layer
DEA registration is the rapid requirement. For cultivators with pharmaceutical provide chain or worldwide market ambitions, Good Agricultural and Assortment Practices come subsequent. GACP frameworks, established by the WHO GACP pointers and the EU EMA GACP guideline for export-oriented operators, require repeatable validated manufacturing processes, managed environmental situations, steady auditable information assortment, and safe digital data that may help inspection. Operators pursuing EU GMP certification for export markets want each GACP and EU GMP certification. The biosecurity SOPs constructed for DEA registration are the inspiration of that readiness, not an alternative to it. Getting DEA registration accomplished accurately means not beginning GACP from zero.
What to Do Earlier than the Finish of June
Verify your state medical marijuana license is present and qualifies below the rescheduling scope. State-licensed medical marijuana is roofed; adult-use and leisure operations stay Schedule I.
Audit in opposition to the 5 genuinely new DEA necessities. SSNs for all personnel with managed substance entry, provider DEA registration numbers for upstream hashish handlers, a facility that continues to be accessible for DEA inspection on demand, the crop purchase-and-resale mechanism, and federal CSA recordkeeping working parallel to your state compliance stack. Current state licensing and seed-to-sale monitoring compliance covers most every little thing else.
Doc gaps earlier than submitting. A single omission can maintain up federal approval. Personnel entry data and SOP protection are the areas probably to set off a assessment delay.
Register at mmapplication.diversion.dea.gov earlier than the top of June. Have a PayPal account prepared earlier than beginning. Utility charges are $3,699 yearly for producers and are non-refundable.
Monitor the portal for the manufacturer-specific type. DEA confirmed in Might 2026 that cannabis-specific varieties for producers, distributors, and testing labs are coming. The Kind 225 pathway with medical marijuana drug codes is obtainable now.
If biosecurity documentation gaps exist, contemplate third-party help. Formalizing an off-the-cuff program earlier than the top of June is achievable, however grows with lively contamination dangers or undocumented protocols round mould, pathogen remediation, or disposal might profit from outdoors assist. SafetyNet America’s Enhanced Bio-Safety Program supplies agricultural-grade disinfection and remediation companies, together with documentation that may help SOP growth for storage, quarantine, and disposal protocols.
If pharmaceutical provide chain or worldwide markets are on the roadmap, start a GACP hole evaluation now. The documentation self-discipline required for DEA registration and for GACP is identical self-discipline. Construct the SOP structure accurately the primary time.
Federal inspection authority over registered producers isn’t hypothetical. Grows with biosecurity packages constructed to be audited have already accomplished the arduous work. The appliance is open, and the top of June arrives sooner than a harvest cycle.
