2.3 DEA Schedules & Registration

The DEA and the Controlled Substances Act

The Drug Enforcement Administration (DEA) is the federal law-enforcement agency within the Department of Justice that enforces the Controlled Substances Act (CSA). The CSA regulates the manufacture, distribution, dispensing, and handling of drugs that have a potential for abuse or dependence. For pharmacy supply-chain work, the CSA sets the rules for how controlled substances (CS) are ordered, received, stored, inventoried, and reported — and the DEA registration is the license that authorizes a supply-chain entity to handle them at all.

The Five Schedules

The CSA places controlled substances into five schedules based on accepted medical use and abuse potential:

Schedule-Specific Handling Rules (Supply-Chain View)

• CII ordering requires a DEA Form 222 (paper order form) or its electronic equivalent via the Controlled Substance Ordering System (CSOS). The current Form 222 is a single-sheet form: the purchaser sends the original to the supplier and keeps a copy (paper or electronic) for its own records. The old carbon triplicate form — Copy 1/Copy 2/Copy 3 — was replaced effective October 30, 2019 and became invalid after October 30, 2021, so "Copy 3 goes to DEA" is a stale distractor. CSOS is the secure electronic signing alternative — faster and increasingly the norm.
• CIII–CV are ordered via standard purchase orders and invoices — no Form 222 required — but every CS invoice and record must be maintained for 2 years (DEA minimum) and made available for inspection. Many states require longer retention.
• Refills: CII — no refills. CIII and CIV — up to 5 refills in 6 months from the date of the original prescription. CV — refills permitted as authorized by the prescriber and as state law allows.

DEA Registration Requirements

To handle controlled substances legally, a supply-chain entity — manufacturer, distributor, pharmacy, reverse distributor, researcher — must hold a current DEA registration specific to each schedule handled and each registered location. The registration period depends on the business activity: a retail pharmacy, hospital/clinic, practitioner, central-fill pharmacy, or teaching institution registers on DEA Form 224 for a 3-year period, while a manufacturer, distributor, reverse distributor, importer, exporter, or researcher registers on DEA Form 225 for a 1-year period. Renewal is separate from the biennial inventory, which is an on-site record the registrant keeps — not a report filed with DEA. Practitioners (pharmacists, physicians) register under their own professional license; supply-chain entities (wholesalers, pharmacies) register the business. For supply-chain work, the registration number must appear on every CS order, and the entity must maintain a separate, secured CS storage area. A technician should never accept a CII shipment unless the shipment matches an executed Form 222 or a valid CSOS order on file.

Biennial Inventory

Every DEA registrant must take a complete, accurate inventory of all controlled substances on hand every 2 years (21 CFR 1304.11(c)). The biennial inventory may be taken on any one date the registrant selects (not necessarily the registration anniversary) and must be recorded — listing each CS by name, strength, dosage form, and quantity. Many registrants take an initial inventory at registration and then biennially thereafter.

The counting method is not uniform across schedules. Schedule I and II substances must always be counted by an exact count or measure. Schedule III, IV, and V substances may be estimated — unless the opened container holds more than 1,000 tablets or capsules, in which case an exact count is required even for those lower schedules (21 CFR 1304.11(e)(6)). A common exam trap treats "biennial inventory" as always requiring an exact count; the correct rule is exact for CI/CII, estimate for CIII-CV, with the 1,000-unit exception flipping an opened CIII-CV container back to an exact count. Whichever method applies, the count is recorded, signed, dated, and retained for 2 years.

DEA Forms You Must Know

Form 106 — Theft or Loss Reporting

A registrant that experiences theft or loss of any controlled substance, or a significant unaccounted-for discrepancy, must first give the local DEA Field Division written notice within one business day of discovery (21 CFR 1301.76(b)), then file DEA Form 106 electronically within 45 days. The one-business-day clock is for the initial written notice, not the completed Form 106 itself. This is separate from FDA Form 3911 (suspect/illegitimate product under DSCSA) and from any internal investigation or law-enforcement report. Losses include documented spills, documented breakage, and verified employee diversion. The report must list the drug, quantity, and circumstances, and the DEA may investigate.

Form 41 — Authorized Destruction

DEA Form 41 is the Registrant Record of Controlled Substances Destroyed — it is a record of a destruction that has occurred, not a registration or a permission slip. A registrant that destroys controlled substances on site completes Form 41 with the drug name, strength, dosage form, quantity, and method of destruction, and two employee witnesses sign it. The form is retained with the registrant's CS records; it is not routinely mailed to DEA. Destruction must render the substance non-retrievable and must be documented (often via a reverse distributor or authorized destruction facility). A supply-chain technician should never destroy CS unilaterally — destruction must be authorized, witnessed where required, and documented.

ARCOS

ARCOS (Automation of Reports and Consolidated Orders System) is the DEA's electronic reporting system that collects data on the distribution of controlled substances from manufacturers, distributors, and dispensers. ARCOS feeds the DEA's quota system and helps detect diversion. Most retail pharmacies and small supply-chain entities do not file ARCOS reports directly — they file via their suppliers — but large wholesalers and manufacturers must report. Supply-chain technicians should recognize ARCOS as the DEA's data backbone for diversion monitoring: if a pharmacy orders unusually large CII quantities, ARCOS data can surface that pattern to the DEA.