Short answer: If your California medical cannabis business filed for DEA registration under the new Schedule III pathway, the single most important thing to do next may be a comprehensive audit of your operation against the Department of Cannabis Control’s regulations. Federal registration is built on top of your state license. Under 21 C.F.R. § 1301.13(k), your DCC license is the authorization the DEA relies on that state law authorizes your activity. That makes your state compliance load-bearing for your federal status. A structured, top-to-bottom DCC audit finds and fixes the cracks in that foundation before a federal inspection, a tax filing, or a license action does. It also exposes gaps between state and federal requirements. This guide explains why the audit now matters more than ever and what a thorough one covers.
Why your DCC compliance suddenly carries federal weight
In April 2026, the U.S. Department of Justice reclassified two categories of marijuana from Schedule I to Schedule III of the Controlled Substances Act, effective April 28, 2026: marijuana inside an FDA-approved drug product, and marijuana handled under a state medical cannabis license. Adult-use cannabis stayed in Schedule I.
That second category is what opened the door for California operators. The order created a federal DEA registration pathway under 21 C.F.R. § 1301.13(k), and the mechanism is the part that matters here: under the rule, a qualifying medical operator’s state license is treated as conclusive evidence of state-law authorization, the DEA registration cannot exceed the scope of that state license, and the federal registration is automatically suspended if the state license is suspended, revoked, or expires.
The DEA prioritized applications filed within an initial 60-day window, but it has indicated it will continue accepting applications afterward. However, filings submitted after June 26, 2026 are not subject to the expedition provision. Qualifying applicants who filed within the window may engage in covered medical marijuana activity during the pendency of their application, in conformity with the state license.
Here is the consequence operators tend to miss. The pathway does not make your DCC license less important; it makes it dramatically more important. Your state credential is no longer just what lets you operate in California. It is now the legal foundation underneath your federal registration. Because the federal rule ties the registration directly to the state license, anything that weakens that license, whether a suspension, a condition, or a revocation triggered by a state violation, can automatically pull your federal registration down with it. You have, in effect, taken a structure you already had and put a second story on top of it. Before you do anything else, you check the foundation.
Why a full DCC audit is now mission-critical (not optional housekeeping)
Plenty of operators treat state compliance as something they revisit at renewal. Once you file for DEA registration, that posture is a liability. Three things change the calculus.
- Your license became load-bearing. The § 1301.13(k) pathway leans on your DCC credential. A clean, current, defensible state license is now the thing holding up your federal registration and the benefits that come with it. A shaky one puts both at risk simultaneously.
- A federal inspection surfaces state problems. DEA registration places the business within the federal controlled-substances inspection regime. The DEA may inspect controlled premises, records, equipment, inventory, and regulated materials under the Controlled Substances Act and DEA regulations, and depending on the posture an inspection may proceed by consent, by administrative inspection warrant, or under an applicable exception, including certain initial-registration inspections. The practical point: the records an inspector reconciles and the premises they walk are the same records and premises that reveal whether you are actually meeting your state obligations. A federal inspector reconciling your inventory can expose a METRC discrepancy that is, first and foremost, a DCC problem. You do not want a federal visit to be the moment you learn about a state gap.
- The financial upside depends on a clean structure. The reason many operators pursued registration is IRC § 280E, the rule that, for Schedule I and II substances, disallows ordinary business deductions and has compressed cannabis margins for years. Moving registered medical activity to Schedule III is widely expected to change that calculus for the medical side, but the federal tax treatment is not yet settled. Treasury and the IRS have signaled that guidance is coming, including guidance relevant to businesses with multiple activities, so operators should not assume the answer is automatic across an entire mixed adult-use and medical business. What you can do now is build a clean, documented structure, which is exactly what a DCC audit pressure-tests. Sloppy books or commingled inventory undermine both your state standing and any future tax position.
Put simply: federal registration raised the stakes on everything you already had to do under state law. An audit is how you make sure the foundation can bear the new weight.
What a comprehensive DCC compliance audit actually covers
A real audit is not a spot check of a few obvious items. It is a structured review across every domain the DCC regulates, designed to find problems you do not already know about. Done thoroughly, it touches the following areas.
- Operational SOPs. Are your written standard operating procedures current, complete, and (the part that trips operators up) actually followed on the floor? This spans the full set: cultivation, manufacturing, distribution, retail, delivery, security, recall, and destruction. An SOP that exists on paper but does not match practice is a finding, not a defense.
- Personnel. Owner and employee disclosures matching reality, required training documented, background-check obligations satisfied, and any badging or screening requirements met. Personnel issues are also where state and federal scrutiny overlap most, since the DEA cares deeply about who has access to controlled substances.
- Premises. Your licensed footprint matching your actual operations, with limited-access areas, signage, surveillance, and storage configured to code. Operations that have grown or shifted since licensing frequently drift out of alignment here.
- Track-and-trace. Your METRC data complete, reconciled, and free of unresolved discrepancies. This is the single most consequential area, because track-and-trace records are exactly what both state and federal inspectors reconcile first.
- Reporting. Required reports filed accurately and on time. Missed or late filings are easy to overlook internally and easy for a regulator to spot.
- Recordkeeping. Records created, organized, and retained for the periods the regulations require, and producible on demand rather than scattered across systems and inboxes.
- Tax. Cannabis tax obligations current and correctly calculated. With 280E relief now in play for the medical side, the tax picture is both more favorable and more scrutinized.
- Employment. Wage-and-hour compliance, handbook and policy obligations, and any labor-peace requirements met. Employment exposure can threaten a license just as directly as an operational lapse.
- Entity governance. Your ownership chain and corporate records matching what you have disclosed to the DCC. Undisclosed changes in ownership or control are a serious and common vulnerability.
- Insurance. Coverage in place at the required limits, with proof on file.
The deliverable you want from all of this is not a vague list of concerns. It is a severity-ranked findings report paired with a remediation roadmap: a clear separation of what is critical, what is material, and what is housekeeping, with a sequenced plan to fix each. That ranking is what lets you triage: close the license-threatening gaps first, then work down to the cosmetic ones.
The audit does double duty: it also builds your federal readiness
Here is the efficiency that makes auditing first the smart sequence rather than just the safe one. The same work that shores up your state compliance generates a lot of what federal oversight will ask you to produce.
- When you tighten your track-and-trace and recordkeeping for the DCC, you are building the reconcilable inventory chain the DEA expects, and you are well positioned to layer on any federal requirements.
- When you align your premises and security with DCC requirements, you are directly addressing the federal security standard. For state medical marijuana licensees registered under § 1301.13(k), state-compliant security requirements are deemed sufficient under the federal rule, making DCC security compliance the starting point for federal readiness. As a practical matter, operators should still document access controls, storage practices, employee screening, surveillance, and anti-diversion procedures to clearly explain the system during an inspection.
- When you clean up entity governance and tax, you are laying the groundwork to document how your medical and adult-use activity is identified, recorded, allocated, and controlled, which both your federal registration and any future tax position will depend on. Complete operational separation is not always achievable in California. The DCC adopted emergency regulations on June 5, 2026, that may allow an eligible retailer to separate a combined adult-use and medical license into an existing A-license and a new related M-license, but the DCC currently requires licensees issued a separate M-license to hold all inventory and conduct all sales through the existing license’s track-and-trace account until further guidance or legal changes. So the goal at this stage is clean documentation and allocation, not an assumption that the split immediately creates fully separate operations.
In other words, you are not choosing between a state audit and federal readiness. The audit is the most efficient on-ramp to both.
What happens if you skip it
The operators who get hurt are rarely the ones with the worst operations. They are the ones who did not know what they did not know. A latent METRC discrepancy, a stale SOP, an undisclosed change in ownership, a lapsed insurance limit: each is survivable when you find it on your own terms and fix it. Each is far more dangerous when a DEA inspector, a tax auditor, or a DCC enforcement action finds it for you, now with federal consequences attached to a problem that started as a state one.
A full audit converts unknown risk into a managed punch list. That is the entire value: you stop being surprised by your own business.
What’s still in motion (and why a strong compliance posture beats prediction)
The federal picture is not settled. Broader federal marijuana rescheduling, including the question of whether adult-use cannabis will move out of Schedule I, remains in motion, and further guidance, hearings, rulemaking, or litigation from the DOJ, DEA, Treasury, and the courts may reshape the final landscape. The timeline is uncertain.
You cannot control where that lands. What you can control is your posture, and a clean, audited, well-documented compliance program is the right posture under every scenario. It protects your license today, it readies you for federal oversight, and it is exactly what a regulator, an acquirer, or a lender will want to see tomorrow.
Frequently asked questions
- Why audit against state rules if the big change is federal? Because the federal pathway is built on your state license. Under 21 C.F.R. § 1301.13(k), your DCC credential is the evidence the DEA relies on that state law authorizes your activity. A weak state license now jeopardizes your federal registration, so the state side is where readiness starts.
- What does a full DCC compliance audit cover? A thorough audit reviews every domain the DCC regulates: operational SOPs, personnel, premises, track-and-trace, reporting, recordkeeping, tax, employment, entity governance, and insurance. The output is a severity-ranked findings report with a remediation roadmap.
- Can a DEA inspection really expose a state violation? Yes. A federal inspector reconciling your inventory or walking your premises is examining the same records and conditions that determine your state compliance. A problem that surfaces federally is very often a DCC problem first.
- How does an audit help with 280E and the tax upside? Any 280E benefit on the medical side will depend on how clearly your medical activity is documented, allocated, and structured. Treasury and the IRS have indicated that guidance is expected, including guidance relevant to businesses with multiple activities, so operators should not assume federal tax treatment is automatic across the whole business simply because one medical activity is registered. An audit tests your books, inventory, and entity structure now, so that whatever the guidance requires, your tax position rests on a documented foundation rather than an assumption.
- I missed the 60-day priority window. Is the audit still worth it? Absolutely. The window (closed in late June 2026) governs priority review and conditional operating authority, not eligibility, and the § 1301.13(k) pathway continues. Regardless of timing, a clean DCC audit protects your license and prepares you for federal oversight. Talk to counsel about your specific posture.
- Do I need to separate my medical and adult-use licenses? If you hold a combined adult-use and medical retail license and want to register the medical side federally, the DCC’s June 2026 emergency regulations may allow you to separate the license into an existing A-license and a new related M-license. The related M-license may be held by a different entity, but ownership must match exactly, and the existing license and related M-license cannot share a FEIN or CDTFA seller’s permit. Importantly, the DCC currently requires licensees issued a separate M-license to hold all inventory and conduct all sales through the existing license’s track-and-trace account until further guidance or legal changes. Do not assume the split immediately creates separate METRC accounts. Operators should review entity, tax, accounting, inventory, and SOP issues carefully before assuming the split produces clean operational separation, and an audit is how you work through those issues.
How Kocot Law helps
Auditing a cannabis business against California’s DCC regulations, then translating the findings into action before a federal inspection or tax filing tests them, is exactly the work Kocot Law does for operators in California. A Kocot Law audit reviews your operation across every DCC domain, delivers a severity-ranked findings report with a clear remediation roadmap, and positions the same work to carry over into federal readiness: DEA-grade recordkeeping, security documentation, well-documented medical and adult-use allocation, and a defensible tax posture.
If your business has filed for DEA registration, or is weighing it, the smartest first move is to make sure the state foundation underneath that registration is solid.
This article is attorney advertising. It provides general information and is not legal advice, does not create an attorney-client relationship, and should not be relied upon for any specific situation. Cannabis remains illegal under federal law except as expressly provided by the April 2026 rescheduling order, and the rules described here may change. Consult qualified counsel about your specific circumstances.
