DSCSA FOR PHARMACIES

DSCSA Suspect Product and Form FDA 3911: The 24-Hour Rule

By MaltexiPublished October 21, 2026

A DSCSA suspect product set apart on a marked quarantine shelf.

A DSCSA suspect product usually shows up on an ordinary day, inside an ordinary tote. Your technician is checking in the afternoon delivery when one bottle looks off. The label is bubbling at the edge, and there's no lot number where it should be. She holds it up and asks the question every pharmacy should have an answer to: what now?

Most people have heard of "the 24-hour rule," but it's often applied at the wrong moment. The law treats a bottle that looks wrong and a bottle that is proven fake as two different stages. Each stage has its own steps. Once you see the difference, the whole process gets much calmer.

DSCSA Suspect Product: Quarantine and the 24-Hour Rule

Suspect vs. illegitimate: two words, two different duties

The law's definitions draw a clear line. A product is suspect when there's reason to believe it may be fake, stolen, diverted or tampered with. The same goes for a product that may be part of a fraudulent sale, or unfit in a way that could cause serious harm. It becomes illegitimate when credible evidence shows that it is. The first is a question. The second is an answer.

That difference decides what you do, and how fast.

Stage	What it means	What you do	How fast
Suspect	Reason to believe something is wrong	Quarantine and investigate	Promptly
Illegitimate	Credible evidence shows it's wrong	Notify FDA (Form FDA 3911) and the immediate trading partners you believe may have received it; disposition the product	Within 24 hours of your determination
Cleared	The investigation shows it's fine	Return it to stock; tell FDA only if FDA was involved	Promptly

So the 24-hour clock doesn't start when the bottle arrives. It starts when you determine that a product is illegitimate.

What makes a DSCSA suspect product? FDA's red flags

FDA's 2021 guidance on suspect product lists the scenarios that raise the risk. They fall into three groups, and it helps to train your team on all three.

The first is where it came from. Think of a new supplier, an unsolicited offer from someone you don't know, or an unknown seller online. Paperwork that looks incomplete or odd belongs here too.

The second is the product itself. Drugs in high demand, drugs in shortage, drugs that are often faked, and prices that seem too good to be true all deserve a closer look.

The third is how it looks. Watch for misspelled or off-color labels, bubbling labels, unusual glue residue, or a missing lot number or expiration date. Missing security features count, and so do tablets with an odd shape, color or imprint. A package with no product identifier is a red flag of its own, because pharmacies may only handle product that carries one.

Step 1: Quarantine it

The first move is simple. Take the product out of the stock you sell or dispense, and keep it apart until it's cleared or dispositioned. The law describes quarantine as storing the product in a clearly marked, separate area, or using other procedures, so it can't be sold or transferred. In most pharmacies, that's a labeled bin or shelf that everyone on the team knows about.

Step 2: Investigate with your trading partners

Next, you investigate promptly, together with your trading partners. FDA's guidance says the manufacturer is usually best placed to judge whether a product is real, so involve them early. Your investigation should check the lot number and review the transaction information (TI) you received with the product. TI is the record of what you bought, from whom, and when.

The law also lists one more check: verifying the product identifier on at least three packages or 10% of the suspect product. If you're a small dispenser, that one step is exempt until November 27, 2027, under FDA's August 6, 2026 letter. Everything else in this post applies today.

Example (fictional): Maya, a pharmacist, moves the bottle with the bubbling label to her quarantine shelf. She calls her wholesaler and the manufacturer, and sends photos and the lot details. Two days later, the manufacturer confirms that the lot was never made. Maya has now determined the product is illegitimate, and her 24-hour clock starts.

DSCSA Compliance for Small Pharmacies: Free Training (2026 Rules). Your suspect-product steps and every other duty, with one short video for each. → Get free access

Step 3: If it's illegitimate, file Form FDA 3911 within 24 hours

Now the clock matters. Once you determine a product is illegitimate, notify FDA and the immediate trading partners you believe may have received it within 24 hours. FDA's guidance adds that this can include the partners you sold it to, and in some cases the one you bought it from.

You notify FDA with Form FDA 3911. FDA's notification page gives you two ways to send it.

Option	How it works
3911 platform in CDER NextGen (FDA's preferred method)	Log in to CDER NextGen, or sign up for an account, then click "3911 Platform" to start a new submission
Email	Download Form FDA 3911, fill it in, and email it to [email protected] with the subject line "Illegitimate Product Notification Submission"

FDA then confirms receipt and gives you an incident number. Use that number in every message about the product. You also need to disposition the illegitimate product, and keep a sample if the manufacturer or FDA asks for one.

Here's a practical tip. Set up your CDER NextGen account now, on a quiet day. Creating a login while a 24-hour clock is running is stress you don't need.

Closing the loop: termination and records

When the notification is no longer needed, you ask to end it. You send the request the same way you sent the first notice, with the incident number. Then you wait for FDA's reply before you tell your trading partners it's over. FDA says it intends to respond within 10 business days.

Records matter here too. Keep the records of a suspect-product investigation for six years after it ends. For an illegitimate product, keep the disposition records for six years after the disposition ends.

Does the small dispenser exemption change any of this?

Mostly no. Only the package-count check from Step 2 is exempt until November 27, 2027. Quarantine, investigation, the 24-hour notice and the records all apply to your pharmacy today. Our post on the small dispenser exemption explains what else it covers. For the other duties that apply today, see DSCSA pharmacy requirements in 2026.

The easiest way to make this stick is a one-page procedure, taped near where deliveries arrive. It should name your quarantine spot, who calls the manufacturer, and who files Form FDA 3911. Buying only from authorized trading partners cuts the risk at the source. Our DSCSA compliance checklist shows where this procedure fits with your other duties.

FAQ

Do I have to report a suspect product to FDA within 24 hours? No. For a suspect product, you quarantine it and investigate. The 24-hour notice applies once you determine a product is illegitimate.

Who do I have to notify about an illegitimate product? FDA, using Form FDA 3911, and the immediate trading partners you believe may have received it. It's not every partner you do business with.

Where do I send Form FDA 3911? Through the 3911 platform in CDER NextGen, which is FDA's preferred method. You can also email the completed form to [email protected].

A bottle has no barcode. Can I dispense it? Not until you've sorted it out. Pharmacies may only handle product that carries a product identifier, so set it aside and check with your supplier and the manufacturer.

How long do I keep suspect-product records? At least six years after the investigation ends. For illegitimate product, keep the disposition records for six years after the disposition ends.

The short version

A bottle that looks wrong is suspect, so quarantine it and investigate with your partners, starting with the manufacturer. If you determine it's illegitimate, you have 24 hours to notify FDA with Form FDA 3911 and the immediate trading partners you believe may have received it. Keep the records for six years, and write it all on one page before you need it.

Know what to do today. Be ready for 2027. → Get the free DSCSA training

DSCSA rules can change. Always confirm the latest requirements on FDA.gov. This is educational content, not legal advice.

Sources

← All DSCSA articles