DSCSA Enforcement and Penalties: What Pharmacies Risk in 2026
DSCSA enforcement used to feel like a distant idea for small pharmacies. Then, in the spring of 2026, maybe a colleague sent you a link and asked if you'd seen it. It was an FDA warning letter, it cited the Drug Supply Chain Security Act (DSCSA), and it went to a dispenser.
If your first reaction was a small knot in your stomach, that's normal. The good news is that the letter is also a clear lesson. It shows exactly what FDA looked at, and those are things you can check this week.
So let's take it calmly. We'll look at what FDA found, what the law says about penalties, and what the small dispenser exemption does and doesn't change. Then we'll finish with what to do.
What DSCSA enforcement looks like in 2026
On April 1, 2026, FDA issued a warning letter to a medical spa in Texas. A spa isn't a pharmacy, but the law's definition of a dispenser includes anyone authorized to dispense or administer prescription drugs. So FDA treated the spa as a DSCSA dispenser, the same category your pharmacy is in.
FDA inspected the spa in December 2025 and then cited two violations. The first was buying from unauthorized sources, which breaks the rule that you trade only with authorized trading partners. The second was handling product without a product identifier, the 2D barcode many pharmacists call the "QR code."
Here's the detail that matters most for you. FDA also faulted the spa's written response. It had no supporting documents, such as new policies and procedures, and it didn't explain how the spa would check trading partner status. FDA describes the letter as advisory. Still, it warned that failing to fix the problems could lead to legal action, including seizure and injunction.
Notice what FDA did not cite. There was nothing about electronic data or software. Both violations were basic duties that have applied to every pharmacy for years.
What the law says about DSCSA penalties
The penalties come from the Federal Food, Drug, and Cosmetic Act (FD&C Act). The pharmacy duties in DSCSA live in section 582 of that law. Section 301(t) lists failing to comply with section 582 as a prohibited act.
In plain terms, non-compliance with section 582 is a prohibited act under the FD&C Act and can carry criminal penalties, including fines and imprisonment. Section 303(a) of the FD&C Act sets two tiers.
| Situation | Maximum under the FD&C Act |
|---|---|
| A violation | Up to 1 year in prison, a fine of up to $1,000, or both |
| A repeat violation after a final conviction, or one with intent to defraud or mislead | Up to 3 years in prison, a fine of up to $10,000, or both |
The fine could be higher in practice. A separate federal law, 18 U.S.C. 3571, sets general fine limits for federal crimes, and it can raise the maximum fine. These are maximums, and a warning letter is not a conviction. Still, the law treats these duties as serious.
Does the small dispenser exemption protect you?
Only for one part of the law. FDA has extended its small-dispenser exemption until November 27, 2027. As FDA's August 6, 2026 letter explains, it covers electronic, package-level tracing and the package-count verification step in suspect-product investigations. It does not cover your other DSCSA duties.
Look back at the warning letter. Authorized partners and product identifiers are both outside the exemption. So is the duty to answer requests for records. If FDA or a state official asks during a recall or an investigation, you respond within 2 business days, unless FDA sets another reasonable time. Paper is fine for that today. Our guide to what the exemption covers lays out the full split.
DSCSA Compliance for Small Pharmacies: Free Training (2026 Rules). Short video lessons + a printable checklist → Get free access
Could your pharmacy pass the same test?
Example (fictional): Sam owns one pharmacy with two pharmacists and three technicians. After reading about the warning letter, he blocks out one hour on a slow afternoon to test his pharmacy against it.
First, Sam lists his suppliers and checks each license. One secondary wholesaler has no record of a check in his files, so he looks it up and writes down what he finds. Next, he walks the shelves looking for anything without a 2D barcode, and he finds none.
Then he picks an invoice from two years ago and times how long it takes to pull the transaction records. It takes eleven minutes, which is well inside two business days. Finally, he notices he has no written procedure for checking partners, so he writes one page. That one page is exactly what the spa couldn't show FDA.
What to do this week
You don't need to fix everything at once. These five habits cover the duties FDA has already enforced, and the ones a request would test.
- Check every partner. Buy only from authorized trading partners, and keep a dated record of each check. Here's how to check a license.
- Check for the 2D barcode. Don't accept product without a product identifier. See what pharmacies actually need for scanning.
- Keep your records. Don't accept product without transaction information and a transaction statement, and keep them for at least 6 years.
- Write your procedures down. Cover how you check partners and how you quarantine and investigate suspect product. If you determine a product is illegitimate, notify FDA and the immediate trading partners you believe may have received it within 24 hours. Our guide to suspect product and Form FDA 3911 walks through it.
- Run a practice request. Pull one old invoice and time yourself, the way Sam did.
For the whole list on one page, use our DSCSA compliance checklist.
FAQ
Is DSCSA non-compliance a crime? It can be. Failing to comply with section 582 is a prohibited act under the FD&C Act, and prohibited acts can carry criminal penalties, including fines and imprisonment.
What are the DSCSA fines? The FD&C Act sets up to 1 year in prison and a fine of up to $1,000. For repeat violations or intent to defraud, it's up to 3 years and $10,000. A separate federal law can raise the maximum fine.
Has FDA taken action against a dispenser under DSCSA? Yes. In April 2026, FDA cited a Texas medical spa, treated as a DSCSA dispenser, for buying from unauthorized sources and for handling product without a product identifier.
Does the small dispenser exemption protect me from enforcement? Only for the electronic, package-level requirements and one verification step in suspect-product checks, until November 27, 2027. Authorized partners, product identifiers, records and suspect product rules apply today.
Who can ask for my DSCSA records? FDA or another appropriate federal or state official, during a recall or a suspect-product investigation. You have 2 business days to respond, on paper or electronically.
The short version
FDA has already enforced DSCSA against a dispenser, and it cited basic duties, not software. The law treats non-compliance as a prohibited act, with criminal penalties. The small dispenser exemption doesn't cover those basics. So check your partners, check for the 2D barcode, keep your records, and write your procedures down.
Know what applies today, and show that you do it. → Get the free DSCSA training
DSCSA rules can change. Always confirm the latest requirements on FDA.gov. This is educational content, not legal advice.
Sources
- FDA, Warning Letter 723267 (Apr 1, 2026).
- 21 U.S.C. 331, FD&C Act §301 (prohibited acts), Cornell LII.
- 21 U.S.C. 333, FD&C Act §303 (penalties), Cornell LII.
- 18 U.S.C. 3571 (criminal fines), Cornell LII.
- FDA, DSCSA exemptions for small business dispensers until Nov 27, 2027 (Aug 6, 2026).
- FD&C Act §582 (21 U.S.C. 360eee-1), Cornell LII.