Guide

DSCSA Enhanced Drug Distribution Security: the 2024-2025 stabilization stack

The Drug Supply Chain Security Act (DSCSA, Title II of the Drug Quality and Security Act 2013) establishes the US 10-year framework for an interoperable, electronic, package-level traceability system for prescription drugs. The enhanced drug distribution security (EDDS) requirements were originally set for November 2023; FDA issued a one-year stabilization period through November 2024 for manufacturers/repackagers/wholesalers, with a further dispenser exemption through November 2026. Core EDDS requirements: package-level Standardized Numerical Identifier (SNI), EPCIS 1.2 (Electronic Product Code Information Services) electronic transaction data including Transaction Information (TI), Transaction History (TH) and Transaction Statement (TS), saleable returns verification using the Verification Router Service (VRS), suspect/illegitimate product investigation and quarantine, and authorised trading partner (ATP) discipline. The 2024 stabilization period continued enforcement discretion while industry resolved interoperability gaps in EPCIS data quality, master data alignment and aggregation/inference handling.

Start free trial Free trial, no credit card, onboard in days, not months.

The DSCSA stack — SNI, EPCIS, verification, ATP, suspect/illegitimate

Layer 0 is the Standardized Numerical Identifier per saleable package: GS1 Serialised GTIN (sGTIN) — GTIN-14 plus unique serial number — applied as a 2D DataMatrix with lot and expiration. Aggregation links unit-level to case-level to pallet-level via Serial Shipping Container Codes (SSCC) for shipping efficiency. Layer 1 is EPCIS 1.2 electronic event data shared between trading partners covering commissioning, packing, shipping, receiving, dispatching, decommissioning events, plus Master Data (location, product) and Transaction-level TI/TH/TS data. Layer 2 is Verification Router Service (VRS) for saleable-returns verification — wholesalers verify package status with manufacturer before reselling returned product. Layer 3 is Authorised Trading Partner discipline — every transaction party must be ATP-eligible (manufacturer, repackager, wholesale distributor licensed in every state of distribution, dispenser). Layer 4 is suspect/illegitimate product investigation, quarantine, FDA notification (Form FDA 3911) and shared trading-partner notification.

The 2023-2026 stabilization timeline

Original DSCSA EDDS effective date: November 27, 2023. FDA stabilization compliance policy August 2023 extended enforcement discretion to November 27, 2024 for manufacturers, repackagers, wholesale distributors and dispensers. FDA further extended dispenser exemption (small dispensers — pharmacies with 25 or fewer full-time employees) through November 27, 2026, and provided additional flexibility for non-small dispensers through November 27, 2025. Stabilization focus areas: EPCIS data quality (missing master data, inconsistent serial numbers, aggregation gaps), interoperability between manufacturer/wholesaler/dispenser systems, exception handling for inference/aggregation issues, and verification-router-service uptime. FDA continues to assess industry readiness against EDDS framework — full enforcement signals expected through 2025-2026.

EPCIS 1.2 — events, master data and the data quality problem

EPCIS 1.2 events: Object Event (commissioning, decommissioning, shipping, receiving), Aggregation Event (parent-child relationship of unit-case-pallet), Transaction Event (linking objects to business transactions), Transformation Event (repackaging). Each event carries event time, action (ADD/OBSERVE/DELETE), business step (urn:epcglobal:cbv:bizstep:*), disposition, EPC list (sGTINs and SSCCs), business transaction list and source/destination master data. Master Data — Location Master Data (GLN per ship-from/ship-to) and Product Master Data (GTIN, NDC, regulatory product code) must be aligned across trading partners. Data quality is the dominant practical issue: missing or incorrect GLNs, GTIN mismatches, lot/expiration discrepancies between EPCIS and physical label, aggregation gaps from packaging-line exceptions. Industry maturity tools include the GS1 US Healthcare DSCSA EPCIS Implementation Guideline and the Healthcare Distribution Alliance (HDA) reference architecture.

Verification Router Service and saleable returns

Wholesale distributors processing saleable returns must verify the returned package with the manufacturer before resale. The Verification Router Service (VRS) is the industry-standardised lookup: wholesaler queries VRS with GTIN, serial, lot, expiration; VRS routes to the manufacturer's verification system; manufacturer returns verification status (verified, not verified, lot recalled, etc.) typically within 2-30 seconds. VRS launched 2020 and matured through 2023-2024. Multiple commercial VRS providers operate (rfXcel/Antares Vision, TraceLink, Systech, Tracelogyx) with cross-provider interoperability. Manufacturers must respond to verification requests within the chapter timeframe and maintain commissioning data integrity to support verification.

Authorised Trading Partner discipline

ATP status: manufacturers (with FDA registration), repackagers (with FDA registration), wholesale distributors (with valid state Wholesale Distribution License in every state of distribution and federal Verified-Accredited Wholesale Distributor (VAWD)/National Association of Boards of Pharmacy Drug Distributor Accreditation), dispensers (with state pharmacy license). Every DSCSA transaction must be between ATPs — transactions with non-ATPs trigger suspect-product investigation. ATP verification is typically conducted through industry databases (HDA Origin, NABP Pulse) and per-trading-partner due diligence including state-license verification. ATP discipline failures concentrate in: small wholesaler de-licensure between transactions, missed state-license renewals, and pop-up wholesaler entities used in diversion.

Suspect/illegitimate product investigation and FDA 3911

DSCSA Section 582 establishes the suspect-product framework. Suspect product is product that may be counterfeit, diverted, stolen, fraudulent, unfit for distribution, or with broken serialisation/aggregation chain. Trading partner must quarantine and investigate within a reasonable timeframe (typically 24-72 hours), determine if illegitimate, and if illegitimate notify FDA via Form FDA 3911 within 24 hours plus notify all immediate trading partners. Illegitimate product investigations require documented investigation files, root-cause analysis and CAPA. FDA 3911 reports become part of FDA's enforcement intelligence and may trigger import alerts or domestic recall.

Practical readiness — building for DSCSA EDDS

Validate packaging-line serialisation and aggregation against EPCIS 1.2 schema with master-data validation gates. Establish bidirectional trading-partner EPCIS connections with retry, exception handling and reconciliation. Maintain Location Master Data and Product Master Data with cross-partner alignment workflows. Operate VRS connectivity (provider or in-house) with response-time SLA. Run ATP verification at trading-partner onboarding and at material changes (acquisitions, state-license changes). Operate suspect-product investigation workflow with 24-72-hour internal SLA and FDA 3911 generation. Track FDA stabilization extensions and enforcement signals — EDDS is the framework regardless of enforcement timeline.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Industries this hits hardest

Pharmaceutical Veterinary pharma Radiopharmaceuticals

Frequently asked

Are dispensers exempt from DSCSA until 2026?

Small dispensers (25 or fewer full-time employees) received an extension to November 2026 for full EDDS compliance. Non-small dispensers received flexibility through November 2025. All dispensers remain subject to ATP requirements, suspect-product investigation, and the existing lot-level traceability obligations — only the package-level EPCIS receipt requirement has the extended timeline.

Do compounded drugs fall under DSCSA?

Compounded drugs from 503A pharmacies are generally exempt. 503B outsourcing facilities are partially exempt for compounded products but subject to DSCSA for any prescription drug they distribute that is not a compounded product. The exemption scope continues to evolve through FDA guidance.

What if a manufacturer can't aggregate at the line?

DSCSA allows inference — wholesalers/dispensers can infer unit-level data from case-level scan when aggregation data is provided. Without aggregation data, every unit must be scanned individually at receiving, which is operationally impractical. Industry has moved toward universal aggregation; manufacturers without aggregation face wholesaler/dispenser pushback. Some saleable returns issues trace back to aggregation gaps.

Are veterinary drugs covered?

DSCSA covers prescription human drugs. Veterinary drugs are not subject to DSCSA EDDS. Some veterinary-use drugs that are also human-labelled may trigger DSCSA when distributed for human use. Veterinary supply chain operates under FDA CVM oversight separately.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →