For years, cannabis operators lived in a legal gray zone — state-legal, federally illegal, and hoping nobody looked too closely at the seam. That era ended on April 28, 2026.
On April 23, 2026, Acting Attorney General Todd Blanche signed a DOJ order placing two categories of cannabis products in Schedule III of the Controlled Substances Act: FDA-approved marijuana products and marijuana products regulated under a qualifying state-issued medical marijuana license. The order was published in the Federal Register on April 28, making it effective immediately.
The DEA opened its Schedule III registration portal for state-licensed medical cannabis dispensaries on April 29. As of this week, nearly 400 businesses have already submitted applications.
If you operate a state-licensed medical cannabis facility and have not yet started this process, read this carefully.
What the Order Actually Does — and What It Does Not Do
The DOJ’s order is narrower than many operators assume. It covers:
- FDA-approved marijuana products (currently a small category)
- Marijuana products subject to a qualifying state-issued medical marijuana license — meaning dispensaries, cultivators, processors, and labs operating under a state medical program
Critically, adult-use (recreational) cannabis operations are not covered by this order. They remain Schedule I under federal law. The broader rescheduling rule — which could extend Schedule III status to all state-licensed cannabis — is still moving through the rulemaking process, with a formal hearing scheduled for June 29, 2026.
The other thing this order does not do: it does not automatically bring state-licensed medical cannabis businesses into federal compliance. The DOJ was explicit on this. Operators who handle covered marijuana products must register with the DEA to do so lawfully under the new framework. Operating without registration in this new environment may actually create a cleaner federal enforcement exposure than before, because the legal framework now exists and you are outside it.
The 60-Day Registration Window
The April 28 order previewed a 60-day expedited registration window for medical cannabis dispensaries. Businesses that submit within this timeframe:
- Will receive a DEA response within six months
- May continue operating during the pendency of their application
- Are effectively shielded from enforcement action while the DEA processes their registration
The 60-day window closes around June 28, 2026. If you are a state-licensed medical cannabis dispensary and you have not filed, you should be talking to legal counsel today.
Registration for non-dispensary businesses — cultivators, manufacturers, distributors, testing labs — is expected to open in the coming weeks through a separate portal.
What the Application Requires
The DEA’s registration application is structured in seven sections. Here is what operators need to prepare:
Section 1: Personal/Business Information — Legal business name, DBA names, physical address, type of entity.
Section 2: Activity — The activities you conduct: dispensing, cultivation, manufacturing, distribution, research, import/export.
Section 3: State License(s) — Your existing state cannabis license numbers. The application directs the DEA to grant registration unless doing so would be inconsistent with the public interest, and your state credentials serve as conclusive evidence of compliance with state law.
Section 4: Liability Questions — This is the section that has caused the most anxiety. One question asks applicants to acknowledge prior drug law violations. The DEA has since clarified that this question is “not intended as a categorical barrier” to registration for state-licensed operators whose only violations were related to state-legal cannabis activity. Get legal advice before answering.
Section 5: Compliance Information — This is where cybersecurity and access control matter. The DEA requires you to identify:
- Your medical marijuana suppliers
- Whether you anticipate packaging or relabeling products
- Every individual with access to controlled substances, including biographical details, Social Security Number, any DEA registration numbers, and criminal history
The access-control requirement in Section 5 should prompt every operator to audit their current systems before filing. If you cannot produce a clean, accurate list of every employee with cannabis product access and their background, you have a compliance gap to fix before submitting.
Section 6: Payment — The nonrefundable application fee is $794. The DEA currently accepts ACH bank transfer or PayPal.
Section 7: Submission — Review and submit.
The Security Compliance Obligations That Come With Registration
Becoming a DEA registrant is not just a legal formality. Schedule III registration creates ongoing federal obligations that go well beyond what most state programs require.
Record-keeping
DEA registrants must maintain detailed records of all Schedule III substance receipts, transfers, disposals, and on-hand inventory. These records must be available for DEA inspection and maintained for a minimum of two years. For cannabis operators accustomed to METRC’s tracking system, this is an additional layer — DEA records and METRC records must be reconcilable.
Controlled Substance Ordering System
Non-dispensary registrants handling Schedule III cannabis at scale will need to engage with the DEA’s Controlled Substance Ordering System (CSOS), which uses digital certificates for electronic ordering. (CannaSecure has previously covered CSOS enrollment for DEA-registered entities.)
Theft and Loss Reporting
Schedule III registrants must report theft or significant loss of controlled substances to the DEA within one business day of discovery. This is a stricter timeline than most state programs. Your incident response plan needs to account for this requirement — cybersecurity incidents that result in product diversion or loss of access to inventory records may trigger federal reporting obligations.
Physical Security Standards
The DEA’s physical security standards for Schedule III facilities are more prescriptive than most state cannabis programs. Expect requirements around vault or safe storage, alarm systems, and access controls.
Inspection Readiness
DEA registration opens your facility to DEA inspection. This is a material change for operators who have only dealt with state regulators. Inspection readiness — documented procedures, clean records, functioning security systems — is no longer optional.
The June 29 Hearing and Why It Matters
The April 28 order covers only state-licensed medical cannabis. The broader proposed rulemaking — which could extend Schedule III to all state-licensed cannabis, including adult-use — is proceeding on a separate track.
A formal evidentiary hearing is scheduled for June 29, 2026. Parties that wish to participate must file written notice of intent by:
- May 20, 2026 — if filing by mail
- May 24, 2026 — if filing electronically
Cannabis operators, trade associations, and industry groups with a stake in the outcome of the broader rescheduling should be filing participation notices this week if they have not already.
The Verano Signal
On May 13, 2026, Verano Holdings — one of the largest multi-state operators in the country, with 162 dispensaries and 14 production facilities across 13 states — publicly announced it had submitted DEA registration applications for its state-licensed medical cannabis operations. CEO George Archos described the move as “a significant step forward on the company’s path to becoming a federally legal business.”
Verano is the first major MSO to publicly confirm filing. Other operators are expected to follow. The 60-day window creates a first-mover incentive: companies that register early establish their compliance posture before the regulatory environment hardens.
What to Do This Week
- Determine whether your operations are covered — If you operate under a state medical marijuana license, the April 28 order likely covers you.
- Audit your access control records — Section 5 requires a complete list of individuals with controlled substance access. If your records are not clean, fix that now.
- Engage cannabis-specialized legal counsel — The Section 4 liability questions require careful legal guidance. Do not self-certify without advice.
- File within the 60-day window — The window closes approximately June 28. Operating inside the window gives you continued-operations protection while the DEA processes your application.
- Update your incident response plan — Add the one-business-day DEA theft/loss reporting requirement. Flag any cybersecurity incident scenarios that could implicate product diversion.
- If you want to participate in the June 29 hearing — File your notice of intent by May 24 (electronic) or May 20 (mail).
The Schedule III order is not a gift wrapped in bureaucracy. It is a compliance inflection point with a hard deadline. Operators who move quickly will be positioned to benefit from the tax and banking changes that follow federal registration. Operators who wait may find themselves in a worse position than before.
The broader rescheduling hearing scheduled for June 29, 2026 could extend Schedule III status to adult-use cannabis operations. CannaSecure will continue to track developments as they happen.
