Medical Cannabis Is Schedule III. Here's What the DEA Registration Process Looks Like and Why June 22 Matters
On April 23, 2026, the Department of Justice and DEA issued a final order moving two specific categories of cannabis from Schedule I to Schedule III of the Controlled Substances Act: FDA-approved drug products containing marijuana, and marijuana subject to a qualifying state medical marijuana license. The order took effect April 28. Recreational cannabis was not included. For state-licensed medical operators, the change opens the door to two major shifts relief from IRC Section 280E and a new federal registration pathway under the DEA but only for businesses that act inside a 60-day window that closes on June 22, 2026. Operators who file by that date receive prioritized review with a six-month processing target and may continue operating under their state license during DEA review. Operators who miss it lose that protected continuity. This post breaks down what changed, what the DEA registration process actually looks like, and how Flourish supports customers through the transition.
What Actually Moved to Schedule III and What Didn't
The order is narrower than the headlines suggest. Only state-licensed medical cannabis and FDA-approved cannabis-containing drug products were rescheduled. Adult-use cannabis remains Schedule I under federal law, even in states where it's legal. A separate DEA administrative hearing begins June 29, 2026 to evaluate broader rescheduling, but no decision is final until that proceeds through rule-making. For dual-license operators, this distinction matters more than anything else in the order.
The June 22 Registration Window
This is the most actionable deadline in the entire order. State-licensed medical cannabis businesses have 60 days from the order's signing to file for federal DEA registration under the expedited pathway. Applications submitted inside the window receive a six-month processing commitment and protected operating status under existing state licenses during review. Applications filed after the window may still be accepted, but the protected continuity guarantee no longer applies and federal enforcement risk increases. Treat this as the immediate priority, ahead of tax planning, banking conversations, and everything else on the post-rescheduling checklist.
Who Needs to Register
Registration requirements follow the categories on your existing state license. Cultivators, manufacturers, distributors, and analytical labs use DEA Form 225. Retail dispensaries dispensing to qualifying medical patients use DEA Form 224. Vertically integrated operators can hold multiple registration types under a single entity, but each must be filed separately and the federal scope cannot exceed the underlying state license scope. If your state license is suspended, lapsed, or expired, your DEA registration cannot stand confirm your state license is current before you file.
The DEA Registration Application: What to Expect
The online application is organized into seven sections covering personal and business information, registered activities, state license documentation, liability disclosures, compliance information, payment, and submission. Section 5 is the heaviest lift: it asks operators to identify medical marijuana suppliers (including their DEA registration numbers), disclose packaging and relabeling activities, confirm standard operating procedures for nine separate functions (ordering, receiving, inventories, storage, security, dispensing, destruction, theft/loss reporting, and due diligence), list personnel with controlled-substance access along with biographical details and disciplinary histories, and document physical security measures. An application must be filed for each location. Annual fees follow the DEA's standard Schedule III structure: $3,699 for manufacturers, $1,850 for distributors, and $888 every three years for dispensers.
Schedule III Compliance Doesn't End at Registration
DEA approval starts a new set of ongoing federal obligations. Schedule III registrants must maintain recordkeeping, reporting, security, and labeling standards under federal rules. To reduce duplication, the DEA has signaled a cooperative posture: in many cases, compliance with state law satisfies federal Schedule III standards for physical security and packaging. Registered manufacturers also face a treaty-compliance mechanism the DEA must "purchase" the harvested crop at a nominal price and immediately "sell" it back with an administrative fee, a paper transaction designed to satisfy U.S. obligations under the Single Convention on Narcotic Drugs. The mechanics are unusual, but the operational reality is record-keeping and inspection-readiness, not physical custody transfer.
The 280E Tax Implications
Section 280E of the Internal Revenue Code disallows business expense deductions for trades trafficking in Schedule I or II substances. The April rescheduling lifts state-licensed medical cannabis out of that prohibition as of the April 22, 2026 effective date. Industry estimates put the effective tax rate for qualifying medical operators at approximately 20 to 30 percent, down from prior 280E levels. The order also encourages the Treasury Department to consider retroactive relief for prior tax years, but that is a recommendation rather than a mandate, and the IRS has not issued formal guidance. Engage tax counsel before filing amended returns or taking aggressive positions on retroactive treatment.
What Dual-License Operators Need to Watch
The most operationally complex impact falls on businesses running both medical and adult-use product lines, often under a single state's dual-purpose licensing framework. Medical revenue is now outside 280E. Adult-use revenue remains inside it. That divergence requires accounting systems capable of segregating expenses, inventory, and revenue by business line cleanly and defensibly to support 280E positions, withstand IRS review, and prepare for whatever framework emerges from the June 29 hearing. Operators that try to retrofit segregation under audit pressure will find it significantly harder than building it before year-end.
How Flourish Supports Customers Through the Transition
A seed-to-sale platform is built around exactly the kind of record-keeping, audibility, and operational segregation that a Schedule III environment now requires. Flourish helps operators prepare for federal registration and ongoing compliance in several ways:
-
Inventory and chain-of-custody documentation that aligns with DEA record-keeping expectations for Schedule III substances
-
Medical vs. adult-use segregation at the inventory, license, and reporting layer so 280E positions are defensible by data, not by reconstruction
-
SOP-aligned workflows for ordering, receiving, storage, dispensing, destruction, and theft/loss reporting that map to the application's Section 5 compliance disclosures
-
Audit trail and reporting capabilities that support both state regulatory requirements and the increased federal scrutiny that comes with DEA registration
-
License-scoped operations so federal registration boundaries stay consistent with the state license that anchors them
The transition to Schedule III is real for medical operators, narrow in scope, and time-sensitive. The platforms that handle your operational data are now also handling your federal compliance posture.
The 12 SOPs required for DEA registration
Here is the breakdown of the 12 required SOPs
1. Ordering
This SOP governs how controlled substances are purchased from licensed suppliers. Flourish provides full coverage by tracking all inbound orders, supplier license numbers, and timestamps through the Purchase Orders module. Clients are responsible for ensuring that federal DEA registration numbers are populated within their Flourish vendor records to meet federal verification standards.
2. Receiving
The Receiving SOP ensures that every shipment is inspected for damage and verified for accuracy. While Flourish logs line-item quantities and creates an audit trail (including Metrc reconciliation), the physical inspection such as checking for broken seals or tampering is a manual step. Staff must follow a strict workflow to ensure no shipments bypass the digital receiving log.
3. Inventories
DEA compliance requires a "perpetual inventory" alongside specific "initial" and "biennial" (every two years) counts. Flourish maintains real-time tracking at the package level, but the client must formally designate specific snapshots as their DEA-mandated inventories. A schedule should be established to export these baseline reports regularly for federal record-keeping.
4. Storage of Cannabis
This SOP covers where and how products are kept. Flourish tracks the digital "where" by mapping products to specific rooms and locations. However, the physical "how" including vault specifications, lock protocols, and environmental controls like temperature and humidity must be documented manually by the client to complement the system's location reports.
5. Security
Security SOPs bridge the gap between digital and physical safety. Flourish manages system security through user roles and access permissions, providing an audit log of who touched what data. The client is responsible for documenting physical infrastructure, such as alarm systems, surveillance camera placement, and personnel screening processes.
6. Dispensing (incl. delivery)
For retail operations, this SOP ensures products are only given to authorized patients or customers. Flourish handles the transactional compliance, including dispensing limits and ID verification logs. If delivery is offered, the SOP must include extra detail regarding vehicle security, driver protocols, and the chain of custody if a delivery is refused.
7. Distributing
When moving product to other licensed entities, this SOP ensures the recipient is authorized to receive it. Flourish manages the manifest generation and destination license verification. As federal regulations evolve, clients must stay alert for specific DEA guidance regarding interstate transport and additional chain-of-custody documentation.
8.Destruction / Disposal
The DEA is highly prescriptive regarding how waste is handled (21 CFR 1317). Flourish tracks the waste event, reason codes, and witness signatures. Clients must ensure their physical process involves two responsible persons to meet the "witness" requirement and identify an authorized destruction method that meets federal "non-retrievable" standards.
9. Theft / Loss Reporting
This SOP dictates the investigation and reporting of any missing inventory. Flourish identifies discrepancies through reconciliation logs, but the client must manually file DEA Form 106 within one business day of discovery. The SOP should clearly list the contact information for local law enforcement and the regional DEA field office.
10. Due Diligence
Due diligence involves "Knowing Your Customer" (KYC) and monitoring for suspicious orders. While Flourish validates licenses, the client must establish a program to identify red flags (such as unusual order patterns). This is a newer requirement for many in the cannabis industry and requires a defined escalation procedure when a suspicious order is detected.
11. Corresponding Responsibly
Primarily for medical retailers, this SOP ensures that a controlled substance is dispensed only for a legitimate medical purpose. Flourish tracks the link between patient, provider, and recommendation. The client must define the criteria for refusing to fill a recommendation if the legitimacy of the practitioner or the medical need is in question.
12. Maintenance of Records
DEA regulations require that all records be kept for at least two years and be "readily retrievable" for inspection. Flourish provides full coverage by archiving all transaction history, audit trails, and user activity. The client’s primary responsibility is to designate a records custodian who knows how to export these reports during a DEA inspection.
Schedule III compliance isn't a one-time filing it's an ongoing operational standard. Flourish helps medical cannabis operators build the inventory tracking, audit trails, and license-scoped workflows that hold up under federal review. Request a demo to see how your seed-to-sale data becomes your compliance posture.
This content is for informational purposes only and does not constitute legal or tax advice. Cannabis operators should consult qualified counsel before filing for DEA registration or taking positions on Section 280E treatment.
