Table of Contents
Whether you sail through DEA Schedule III registration or spend the coming weeks scrambling depends on how well your existing program is documented and whether you have already addressed the five requirements that your state license does not cover.
Schedule III rescheduling for state-licensed medical marijuana went into effect April 28, 2026 (DOJ). As of that date, state-licensed medical cannabis cultivators are federally classified as DEA-registered manufacturers of a Schedule III controlled substance. The registration portal opened April 29. Operators who register before the end of June 2026 receive expedited review and may continue operating under their state license while DEA processes the application. Miss that window and you enter the standard queue, with no guaranteed operational continuity and potential federal exposure (Fennemore Law).
The precise cutoff date has been cited differently across legal sources, ranging from June 22 to June 29, depending on how the 60-day window from Federal Register publication is calculated. File well before the end of June and do not rely on the last available day. The application is live, the questions are specific, and most grows are not as prepared as they think.
What DEA Registration Actually Requires From Cultivators
The registration portal is at mmapplication.diversion.dea.gov. Cultivators register as manufacturers, which carries an annual fee of $3,699 per the DEA final rule (91 Fed. Reg. 22714). That is the manufacturer rate, not the $888 dispenser rate that applies to retail operations. Payment is currently accepted via PayPal only, so operators will need an account set up before starting the application. Fees are non-refundable.
There is one mechanism in the registration framework that has no precedent in state licensing frameworks and deserves attention upfront. Under the Single Convention treaty obligations the rescheduling order is built on, DEA must serve as the exclusive purchaser of cannabis production. In practice, this means registered cultivators set a nominal price for their crop, DEA purchases it at that price and sells it back plus an administrative fee, and the crops must remain in a DEA-accessible facility until that transaction completes. The right to inspect that facility is unconditional and on demand. This is not a theoretical federal oversight posture; it is a standing operational requirement (DEA final rule, 91 Fed. Reg. 22714).
For most state-licensed medical cultivators, the SOP categories the application covers will not feel unfamiliar. Ordering, receiving, inventory, storage, security, disposal, theft and loss reporting, recordkeeping: these are the same operational controls Colorado, California, and virtually every mature medical state already requires for license maintenance. The DEA application is largely asking cultivators to confirm that their existing compliance infrastructure is documented and current.
Compliant Colorado grows have most of this. Colorado serves as a useful benchmark because its MED requirements represent one of the more mature state compliance frameworks in the country. Operators in other states should audit against their own licensing requirements, but the five federal additions below are new regardless of where you operate.
Colorado MED badge requirements already cover fingerprint-based criminal background checks, date of birth, and identity verification for all employees. MED licensing already mandates alarm systems with professional monitoring, zone-based access controls, secure storage, and continuous video surveillance in limited access areas. METRC already handles seed-to-sale inventory tracking, waste disposal documentation, and theft and loss reporting at the state level.
Where the federal framework adds genuinely new requirements, the gaps are specific.
Five DEA registration requirements that are new, regardless of where you operate.
First, Social Security numbers are required for every individual with access to controlled substances; MED uses fingerprints and government-issued ID, not SSNs.
Second, the application requires listing upstream cannabis suppliers and their federal DEA registration numbers, meaning other registered handlers who transfer plant material to the facility, such as clone suppliers or biomass sources. This does not extend to vendors of nutrients, grow media, or other non-cannabis inputs.
Third, DEA registration grants unconditional on-demand inspection authority that is fundamentally different from MED’s scheduled or complaint-driven inspection model.
Fourth, the nominal price crop purchase-and-resale mechanism has no state program equivalent.
Fifth, registration creates parallel federal recordkeeping obligations, quota reporting, and import and export permit requirements that run alongside the existing state compliance stack, not in place of it.
Those five items are where compliant medical grows actually have preparation work to do.
DEA confirmed in May 2026 that separate registration forms for manufacturing, distribution, and testing businesses are in development. The current portal pathway is available now for cultivators using the existing Form 225 process with the appropriate medical marijuana drug codes. Monitor mmapplication.diversion.dea.gov for the cannabis-specific manufacturer form.
Why Biosecurity Is the Foundation, Not Just an Agronomic Program
The assumption that biosecurity is primarily about IPM and pathogen exclusion is one of the most consequential misframings in cannabis cultivation right now. A functional biosecurity program covering zone-based access, entry and exit logging, quarantine protocols, and chain of custody from propagation through harvest is structurally identical to what DEA is asking for. The gap, for most grows, is not the program itself. It is whether the program is documented.
Consider how each layer maps.
Personnel access controls. Colorado MED already requires zone-based access controls, badged entry, and limited access area documentation. DEA registration does not reinvent this. It asks cultivators to re-confirm the existing framework within a federal context and adds the SSN requirement for personnel with controlled substance access. If MED-compliant access logs are current and retrievable, this portion of the application is primarily a translation exercise.
Storage security. MED already requires vaults, safes, and secure storage, so the security hardware questions on the DEA application cover familiar ground. The new obligation is the DEA-accessible facility requirement: storage areas must remain accessible for federal inspection on demand, and crops cannot leave the facility until the purchase-and-resale transaction completes. The rule does not prescribe a specific SOP format for this. The registration itself specifies the permitted cultivation areas, and physical access is the operative requirement. What it means practically is that any biosecurity protocol governing facility lockdown, restricted entry, or crop movement needs to account for DEA’s unconditional right to enter.
Inventory and traceability. METRC already captures harvest batch records, plant and package movements, and waste in Colorado. Cultivators running clean METRC records are well-positioned here. The gap is on the input side: DEA requires supplier information including federal registration numbers for upstream cannabis handlers, which METRC does not capture in that format. Pesticide application logs, IPM records, and fumigation documentation that biosecurity programs generate also feed directly into the GACP traceability requirements that follow DEA registration. Those records carry value beyond the immediate application.
Destruction and disposal. METRC tracks cannabis plant waste and disposal in Colorado, so this SOP requirement is largely met for compliant grows. What DEA adds on top of that is ensuring disposal documentation aligns with federal 21 CFR Part 1317 standards alongside state records, and that biosecurity disposal protocols for infected or contaminated plant material are written down rather than practiced informally.
Biosecurity programs built as documented, SOP-driven compliance systems map directly to DEA registration requirements. Programs built as cultivation practice, effective but informal, require significant documentation work before the application can be completed accurately. The window is tight and closing.
GACP: The Next Layer
DEA registration is the immediate requirement. For cultivators with pharmaceutical supply chain or international market ambitions, Good Agricultural and Collection Practices come next. GACP frameworks, established through the WHO GACP guidelines and the EU EMA GACP guideline for export-oriented operators, require repeatable validated production processes, controlled environmental conditions, continuous auditable data collection, and secure electronic records that can support inspection. Operators pursuing EU GMP certification for export markets need both GACP and EU GMP certification. The biosecurity SOPs built for DEA registration are the foundation of that readiness, not a substitute for it. Getting DEA registration done correctly means not starting GACP from zero.
What to Do Before the End of June
Confirm your state medical marijuana license is current and qualifies under the rescheduling scope. State-licensed medical marijuana is covered; adult-use and recreational operations remain Schedule I.
Audit against the five genuinely new DEA requirements. SSNs for all personnel with controlled substance access, supplier DEA registration numbers for upstream cannabis handlers, a facility that remains accessible for DEA inspection on demand, the crop purchase-and-resale mechanism, and federal CSA recordkeeping running parallel to your state compliance stack. Existing state licensing and seed-to-sale tracking compliance covers most everything else.
Document gaps before submitting. A single omission can hold up federal approval. Personnel access records and SOP coverage are the areas most likely to trigger a review delay.
Register at mmapplication.diversion.dea.gov before the end of June. Have a PayPal account ready before starting. Application fees are $3,699 annually for manufacturers and are non-refundable.
Monitor the portal for the manufacturer-specific form. DEA confirmed in May 2026 that cannabis-specific forms for manufacturers, distributors, and testing labs are coming. The Form 225 pathway with medical marijuana drug codes is available now.
If biosecurity documentation gaps exist, consider third-party support. Formalizing an informal program before the end of June is achievable, but grows with active contamination risks or undocumented protocols around mold, pathogen remediation, or disposal may benefit from outside help. SafetyNet America’s Enhanced Bio-Security Program provides agricultural-grade disinfection and remediation services, including documentation that can support SOP development for storage, quarantine, and disposal protocols.
If pharmaceutical supply chain or international markets are on the roadmap, begin a GACP gap assessment now. The documentation discipline required for DEA registration and for GACP is the same discipline. Build the SOP architecture correctly the first time.
Federal inspection authority over registered manufacturers is not hypothetical. Grows with biosecurity programs built to be audited have already done the hard work. The application is open, and the end of June arrives faster than a harvest cycle.
