The Drug Enforcement Administration (DEA) enforces the Controlled Substances Act (CSA) at every link in the supply chain. Manufacturers, distributors, and pharmacies must all register with the DEA, account for every transaction, and follow the rules for their registration type. For a pharmacy, that registration is what makes controlled substance dispensing possible, and the standards for keeping it have grown far more demanding over the past decade. The DEA no longer reserves investigations for the most serious diversion cases. Now, even a short-staffed pharmacy with loose records can be as vulnerable as one with far more serious problems. Consequences of an adverse DEA action can range from registration proceedings and potentially substantial civil penalties to criminal charges against individual pharmacists and owners.
The Current DEA Enforcement Landscape
DEA diversion enforcement against pharmacies has grown in scope and frequency. Through 2024 and 2025, the DEA’s Diversion Control Division announced consent agreements, civil penalty settlements, registration revocations, and pharmacist indictments in nearly every part of the country, a deliberate posture of using the full administrative and criminal toolkit, not saving it for the worst cases.
In early 2026, “Operation Meltdown” was a single, coordinated sweep against online diversion that seized more than 200 website domains, produced multiple arrests, and issued five Immediate Suspension Orders. That operation targeted internet activity, but the tools the DEA used to find its targets included dispensing pattern analysis, Prescription Drug Monitoring Program (PDMP) data, and referrals from Medicare and Medicaid integrity contractors, all of which apply equally to any brick-and-mortar pharmacy.
DEA Registration and What Is at Stake
Losing DEA registration credentials ends a pharmacy’s ability to dispense any Schedule II through V medication immediately. Registrations renew every three years, and the pharmacy must account for every controlled substance transaction at all times. Under 21 U.S.C. § 824, the DEA can issue a Show Cause Order to begin revocation proceedings, or an Immediate Suspension Order if it finds an imminent danger to public health or safety. An Immediate Suspension Order takes effect on service, without prior notice, and controlled substance dispensing must stop immediately.
Either action may also prompt scrutiny by state licensing boards, which can suspend or revoke the state license on their own track. Responding takes counsel familiar with the burden-shifting framework in DEA administrative proceedings and the five public interest factors under 21 U.S.C. § 823.
What a DEA Audit Actually Looks Like
The DEA runs routine accountability audits without warning. Diversion investigators may arrive unannounced, hand the owner or pharmacist-in-charge an informed consent notice (Form DEA-82), and request a defined set of records. They pull random controlled substance prescriptions to confirm each is valid on its face and free of red flags, and they request the biennial inventory plus purchase and dispensing records to run an invoice reconciliation, comparing what was ordered against what was dispensed and billed to confirm nothing is missing.
The scope of an audit is limited to controlled substance prescription, dispensing, and purchase records; it does not reach the pharmacy’s financial information, and pharmacies should understand those limits.
The violations the DEA finds most often are:
- Undocumented professional judgment on narcotic prescriptions;
- Disorganized recordkeeping that is difficult to produce and reconcile on the spot;
- Inventory error rates suggesting systemic tracking failure; and
- Heavy volumes of sought-after Schedule II drugs or concurrent opioid, benzodiazepine, and muscle relaxant fills without documented clinical rationale.
We recommend designating a knowledgeable employee in advance as the audit point of contact, and training staff to understand that while cooperation is appropriate, no one is required to answer questions or sit for an interview without counsel present.
Corresponding Responsibility and the Red Flag Doctrine
Under 21 C.F.R. § 1306.04, a controlled substance prescription must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. The pharmacist who fills it carries a corresponding responsibility. DEA enforcement has placed an affirmative duty on pharmacies to investigate any concern; a pharmacist who sees a clinical or contextual concern cannot simply fill and defer to the prescriber but must resolve the concern and document the process before dispensing.
Investigators and administrative law judges consistently treat these as red flags requiring documented resolution: a prescriber whose specialty does not match the medication; a patient driving past closer pharmacies to obtain prescriptions at a particular pharmacy; cash payment despite insurance; early refills outside the regimen; and concurrent opioid, benzodiazepine, and muscle relaxant prescriptions (the so-called “holy trinity”) from one prescriber or several. Each red flag warrants careful evaluation and appropriate documentation. A pharmacy’s record should capture the concern, the steps taken, who was contacted, what was said, and the reasoning behind the decision. Reconstructing that account after an inquiry begins is not a substitute for a contemporaneous note.
Loss and Theft Reporting: A Concurrent Federal Obligation
DEA compliance does not stop at dispensing. Under 21 C.F.R. § 1301.76(b), a registrant must report any theft or significant loss in writing to its local DEA Diversion Field Division Office within one business day of discovery, followed by a detailed DEA Form 106 within 45 days.
The costliest mistakes here are misjudging whether a loss is significant, missing the one-business-day notice, and filing an incomplete Form 106. Federal regulations do not define significant loss precisely because the question is fact-specific, as it turns on the drug’s type and quantity, whether losses recur, and diversion potential, so documenting the analysis is vital. Many states impose parallel reporting duties on shorter timelines or different forms, and missing the state requirement can jeopardize the state license even when the federal filing was perfect.
Manufacturer Purchasing Restrictions and the ARCOS System
Not all DEA-related risk comes from the DEA. Manufacturers and wholesalers in the closed distribution system have their own CSA duty to monitor suspicious orders, and that duty increasingly shows up as purchasing restrictions imposed on pharmacies without warning.
The DEA’s Automation of Reports and Consolidated Orders System (ARCOS) tracks the supply chain nationally, and manufacturers separately receive transaction-level chargeback data from wholesalers, letting them watch ordering patterns pharmacy by pharmacy and flag anything unusual in size, frequency, or mix. A flagged pharmacy can lose access to a manufacturer’s products through the chargeback system and find itself unable to buy those drugs from its wholesaler. Restrictions may develop gradually due to ordering patterns that exceed peer benchmarks, high concentrations of certain controlled substances, or repeated threshold overrides. Alternatively, restrictions may be imposed abruptly when a state board action, law enforcement inquiry, or unexplained order triggers immediate suspension.
Civil monetary penalties under the CSA run per violation, and dispensing billed to Medicare or Medicaid adds False Claims Act exposure, multiplying those figures through treble damages and per-claim penalties. Criminal liability under 21 U.S.C. § 841 requires proof that controlled substances were knowingly dispensed outside the usual course of professional practice; under Ruan v. United States, that means subjective knowledge, but thin documentation, a pattern of red-flag fills, or prescriptions from prescribers already under DEA scrutiny can supply the circumstantial proof. Sentences in pharmacy diversion cases have ranged from one year to 15 years or more, depending on volume, duration, and harm to patients.
Wholesalers have imposed year-long suspensions on their own, citing manufacturer lists or undisclosed criteria rather than the individualized, risk-based justification DEA guidance contemplates. A suspension that cannot be tied to specific compliance findings should not be treated as final. Pharmacies have been successful in challenging unsubstantiated suspensions and should any pharmacy be subject to such action, it is important the pharmacy engage counsel promptly, pull at least 90 days of purchasing and dispensing records, and prepare a formal compliance package for the manufacturer’s review committee.
Building a Compliance Program That Withstands Scrutiny
If the pharmacy has not reviewed its controlled substance compliance program recently, below are some important considerations
- Is there a written red flag policy that pharmacists actually follow and are trained on?
- Does dispensing documentation capture the required elements at the time of the fill?
- Are DEA Form 222 records, biennial inventories, and PDMP query logs complete, accurate, and retained for the required periods?
- Are there written protocols for loss and theft reporting under 21 C.F.R. § 1301.76(b) and the parallel state rules?
Gaps between ordered and dispensed quantities, missing required PDMP queries, and holes in inventory or disposal records draw adverse inferences regardless of how sound the underlying dispensing was. A pharmacy with a concentrated prescriber base should build the clinical rationale record before DEA asks, and every pharmacy should have a protocol for an unannounced visit, which should include a designated point of contact, outside counsel identified in advance, and staff trained on how to respond appropriately before an investigator arrives.
Specialty and Oncology Pharmacy Considerations
Specialty pharmacies serving oncology, palliative care, and pain management patients may draw heightened scrutiny because of their clinical profile, particularly where high-volume Schedule II dispensing in those populations may statistically appear abnormal against general retail benchmarks even when every prescription is appropriate. As a result, it is important to document clinical context, therapeutic specialization, patient population characteristics, and the rationale for fills that would be hard to explain without that background. Pharmacies affiliated with physician practices or health systems carry added exposure where DEA compliance meets the Anti-Kickback Statute, since prescriber-dispenser economic alignment draws scrutiny under both frameworks at once.
How Frier Levitt Can Help
Frier Levitt advises independent pharmacies, specialty pharmacies, pharmacy chains, and individual pharmacists across the full range of DEA compliance and enforcement matters. We build controlled substance compliance programs that meet current DEA documentation and recordkeeping standards, conduct privileged internal assessments before any government inquiry, and respond to Show Cause Orders, Immediate Suspension Orders, civil investigative demands, and criminal referrals at every stage of the federal process. We also counsel pharmacies on loss and theft reporting, represent clients in manufacturer and wholesaler purchasing restriction disputes, and advise integrated pharmacy operations on DEA compliance alongside broader healthcare regulatory risk. If your pharmacy has received DEA correspondence, faces a purchasing restriction, is under state board review, or wants to know whether its current practices would hold up under federal scrutiny, we are available to help.
