DSCSA: What the Drug Supply Chain Security Act Requires

The Drug Supply Chain Security Act (DSCSA) is the U.S. federal law that requires prescription drug manufacturers, repackagers, wholesale distributors, and dispensers to build an electronic, interoperable system for tracing every package of a human prescription drug back to its origin. Congress passed it as Title II of the Drug Quality and Security Act, signed November 27, 2013 — the same law’s Title I addressed compounding-pharmacy oversight, a response to the 2012 fungal-meningitis outbreak tied to compounded injectables from the New England Compounding Center. DSCSA’s own origin is separate: counterfeit, diverted, and stolen prescription drugs re-entering the legitimate supply chain, which a paper-based, lot-level distribution system could not reliably catch.

DSCSA does not create a single certificate or a one-time inspection. It creates an ongoing set of documentation, verification, and investigation duties that attach to every change of ownership of a drug package, phased in over a decade, ending in a unit-level, package-serialized, electronically interoperable tracing system covering the full chain of custody from manufacturer to the pharmacy counter.

What DSCSA Requires, in Brief

Three obligations run through the statute regardless of where a company sits in the supply chain:

• Pass transaction documentation forward at every sale. Each trading partner must both receive and pass on Transaction History, Transaction Information, and a Transaction Statement (together, “T3”) for the product — see the dedicated section below.
• Verify that trading partners are authorized. Before transacting, a company has to confirm the manufacturers, wholesalers, dispensers, and repackagers it deals with hold the licensure and registration the statute requires of an “authorized trading partner.”
• Quarantine, investigate, and act on suspect or illegitimate product. A trading partner that has reason to believe a product may be counterfeit, diverted, stolen, or otherwise illegitimate must quarantine it, investigate, and notify FDA and affected trading partners if the investigation confirms the product is illegitimate.

For the specific documentation, verification, and investigation duties that attach to a distributor buying and reselling product — and what a buyer should check before taking a distributor’s “DSCSA compliant” claim at face value — see DSCSA Compliance: What It Requires of a Distributor.

Who DSCSA Applies To

DSCSA defines several trading partner categories, each with its own phase-in schedule and some category-specific duties:

• Manufacturers — the first link in the chain; responsible for applying the product identifier (serial number) to each package and initiating Transaction History.
• Repackagers — entities that take possession of a finished drug and repackage it under their own labeler code; must apply their own product identifier to the repackaged unit.
• Wholesale distributors — entities that distribute prescription drugs to persons other than the consumer or patient without having manufactured or dispensed them; the group most exposed to trading-partner verification duties because they sit between manufacturers and dispensers.
• Dispensers — retail pharmacies, hospital pharmacies, and other outlets that dispense product directly to a patient; the last link required to receive and retain T3 data.
• Third-party logistics providers (3PLs) — entities that take custody of a drug for storage/shipment without taking ownership; must be licensed but do not take title, so their obligations differ from a wholesale distributor’s.

Scope note: DSCSA governs human prescription drug products. It does not apply to OTC drugs, medical devices, biologics regulated as devices, or veterinary products. For the parallel device-side traceability system, see UDI Medical Device: FDA Unique Device Identifier Requirements — a distinct requirement built on a different statute and a different identifier scheme, not a drug-side substitute for DSCSA.

DSCSA Serialization Requirements

DSCSA’s serialization requirement is what most compliance discussions actually mean by “DSCSA”: every saleable unit of a covered drug carries a 2D GS1 DataMatrix barcode encoding four data elements — the National Drug Code (NDC) as part of a Standardized Numerical Identifier, a unique serial number, the lot number, and the expiration date — applied at the package level under the standard GS1 US has published for the industry. Two further mechanics sit on top of the barcode itself:

• Serialization — assigning and encoding the unique serial number at the saleable-unit level so an individual package, not just a lot, can be traced.
• Aggregation — linking serialized units to the cases and pallets that contain them, so a single case or pallet scan can resolve every unit inside it, rather than requiring each unit to be scanned individually at every handoff.

The serialization phase-in ran on a staggered schedule by trading-partner type: manufacturers were required to apply product identifiers starting November 27, 2017; repackagers by November 2018; wholesale distributors by November 2019; and dispensers by November 2020. A barcode alone does not satisfy DSCSA — the statute also requires the transaction data behind it to move electronically between trading partners; a compliant-looking label on a package whose transaction data isn’t actually being exchanged is not a compliant transaction.

Transaction History, Transaction Information, and Transaction Statement (T3)

T3 is the documentation package that has to move forward with the product at every change of ownership:

• Transaction History (TH) — the record of every prior transaction in the product’s chain of ownership, going back to the manufacturer.
• Transaction Information (TI) — identifies the specific product and the transaction: proprietary and established name, dosage form, strength, container size, NDC, lot number, quantity, and the date and parties of the transaction.
• Transaction Statement (TS) — the seller’s certification that it is an authorized trading partner, received the product from an authorized trading partner, received TI and TH for the product, did not knowingly ship a suspect or illegitimate product, has systems in place to comply with verification obligations, and did not knowingly provide false T3 information.

The statute’s end state, phased in fully starting November 27, 2023, replaces this with fully electronic, interoperable exchange of serialized transaction data at the package level — commonly implemented using EPCIS (Electronic Product Code Information Services), a GS1 data-exchange standard, rather than the paper or PDF-based T3 records many trading partners used during the earlier phases.

DSCSA Compliance Timeline

• November 27, 2013 — DSCSA enacted as Title II of the Drug Quality and Security Act.
• January 2015 (July 2015 for dispensers) — lot-level Transaction History/Information/Statement documentation requirements took effect.
• November 27, 2017 — manufacturers required to serialize product at the package level; repackagers followed by November 2018, wholesale distributors by November 2019, and dispensers by November 2020.
• November 27, 2023 — the statute’s final phase, requiring fully electronic, interoperable, serialized unit-level tracing across all trading partners, took effect.
• November 27, 2023 – November 27, 2024 — FDA’s confirmed “stabilization period”: FDA stated it did not intend to enforce the enhanced electronic tracing requirements during this window while trading partners finished building and validating interoperable systems, and applied the same enforcement discretion to certain product already in commerce before the deadline through that product’s expiry.

FDA has continued to issue targeted waivers, exceptions, and additional enforcement-discretion guidance for specific requirements and trading-partner categories beyond November 2024, and industry compliance trackers describe further staged enforcement dates for full aggregation and EPCIS data exchange running into 2026. Because this posture has moved more than once since the statutory deadline passed, confirm the current enforcement status directly on FDA’s Drug Supply Chain Security Act page before treating any single date past 2024 as the final word.

DSCSA Compliance in Practice

“DSCSA compliant” is not a single fact a trading partner can assert once. In practice it means, on an ongoing basis: applying and reading the correct serialized barcode, sending and retaining T3 (or its EPCIS successor) for every transaction, confirming every counterparty is an authorized trading partner before transacting, and having a working process to quarantine and investigate suspect product rather than a policy that only exists on paper. A buyer evaluating a supplier’s compliance claim, or a dispenser onboarding a new wholesaler, should expect to see evidence of these four things, not just a verbal assurance — see the distributor-specific breakdown linked above for exactly what documentation that evidence looks like.

DSCSA compliance is distinct from Good Distribution Practice (GDP), which governs the physical storage, handling, and transport conditions (temperature, security, damage prevention) a drug moves through — a wholesaler can meet GDP’s environmental-control standards while still failing DSCSA’s transaction-documentation and verification duties, and vice versa. The two frameworks are complementary, not substitutes for each other.

Suspect and Illegitimate Product

DSCSA distinguishes a suspect product (reasonable suspicion that the product is counterfeit, diverted, stolen, intentionally adulterated, the subject of a fraudulent transaction, or otherwise unfit for distribution) from an illegitimate product (a suspect product that a trading partner’s investigation has confirmed meets one of those conditions). A trading partner that identifies a suspect product must quarantine it and investigate; if the investigation confirms the product is illegitimate, the trading partner must notify FDA and any immediate trading partners that may have received the product. This is one of the reasons trading-partner verification matters on its own, independent of whether a specific shipment turns out to be a problem: buying from or selling to an entity that does not meet the authorized-trading-partner definition is itself a compliance failure.

Frequently Asked Questions

What does DSCSA stand for?

DSCSA stands for the Drug Supply Chain Security Act, the U.S. federal law (Title II of the 2013 Drug Quality and Security Act) requiring an electronic, interoperable system for tracing prescription drugs through the supply chain.

What are the DSCSA serialization requirements?

Every saleable unit of a covered prescription drug must carry a 2D GS1 DataMatrix barcode encoding the NDC, a unique serial number, the lot number, and the expiration date. Manufacturers had to comply starting November 2017, with repackagers, wholesale distributors, and dispensers phased in through November 2020, and full electronic interoperable tracing across all trading partners required starting November 2023.

What is DSCSA compliance, in practical terms?

Ongoing compliance means applying and reading serialized barcodes correctly, exchanging and retaining Transaction History/Information/Statement (or EPCIS) data for every sale, verifying that every trading partner is authorized before transacting, and maintaining a real process for quarantining and investigating suspect product.

Does DSCSA apply to over-the-counter drugs or medical devices?

No. DSCSA covers human prescription drug products only. Over-the-counter drugs, veterinary products, and medical devices fall outside its scope; devices have a separate identification system, Unique Device Identification (UDI), built on different statutory authority.

Is DSCSA the same as Good Distribution Practice (GDP)?

No. DSCSA governs transaction documentation, trading-partner verification, and product serialization/traceability. GDP governs the physical storage, handling, and transport conditions a drug is kept in. A supply chain participant must satisfy both, but they are separate compliance frameworks with separate requirements.

What happens if a trading partner doesn’t meet DSCSA’s requirements?

Transacting with an entity that isn’t an authorized trading partner is itself a compliance failure under DSCSA, independent of whether the product involved is genuine. Suspect or illegitimate product must be quarantined, investigated, and, if confirmed illegitimate, reported to FDA and affected trading partners.

Sources

• Drug Quality and Security Act, Title II (Drug Supply Chain Security Act), Pub. L. 113-54, signed November 27, 2013.
• FDA, Implementing DSCSA: Stabilization Period and Expectations, and DSCSA Compliance Policies Establish 1-Year Stabilization Period for Implementing Electronic Systems (fda.gov).
• GS1 US, Drug Supply Chain Security Act (DSCSA) standards and implementation guidance.

This page sits in CASRAI’s laboratory compliance and quality cluster, alongside Structured Product Labeling (SPL) and EU Risk Management Plan (RMP) for the adjacent drug-regulatory-submission and pharmacovigilance frameworks, and FDA Registered Establishment for what establishment registration does and doesn’t certify about a trading partner.