TLDR: DEA has begun inspecting registered medical cannabis operators, and applying put you on the map. Start with state and local compliance, then build the federal layer: your federal file, records, security, people, and channel separation. The six-part starter checklist is below.
This is the first email edition of The Federal Cannabis File. Once a week: federal cannabis law for state-licensed operators and their advisers, plus something I don’t publish anywhere else.
Here’s why this issue matters right now.
DEA has begun inspecting medical cannabis companies that registered. Not hypothetically. Inspections are happening. And if you applied for registration during the spring window, the working assumption should be that an inspection of your operation is a matter of when, not if. Applying puts you on the DEA inspection map.
Most operators I talk to are somewhere between “we’ll deal with it when it happens” and “we don’t know where we’d start.” I find that people get overwhelmed in these situations, and the overwhelm is what keeps them from starting at all.
So this week’s subscriber extra is built for exactly that: the DEA Inspection Starter Checklist, below. It is deliberately not a comprehensive compliance audit checklist. It’s the starting point, organized so you know where to begin: it starts with your state and local compliance, because that’s the foundation, and then builds the federal layer on top of it, from your federal file through your records, security, people, and channel separation.
Print it and discuss it with your team. The items you can’t check should be a priority for the next 90 days.
The Federal Cannabis File DEA inspection starter checklist
Where to begin before DEA contacts you. If you’ve applied for DEA registration, this is where to start. It’s a starter list, not a comprehensive program: the first items to have in hand, so the size of the project doesn’t keep you from beginning it. Start at the top: the federal layer is only as strong as the state and local compliance it sits on.
1. State and local compliance (the foundation, start here)
- Every state license current, with renewal dates calendared
- Every local permit and authorization current, for every premises
- Track-and-trace reconciled: virtual inventory matches actual physical inventory
- State and local tax filings current, with proof of payment retained
- Ownership and financial interests clearly documented: every owner and financial interest holder disclosed to your regulators, and filings updated for any changes
- A current org chart and cap table exist and match your disclosures. If they don’t exist, that needs to happen yesterday
- All open notices, violations, or deficiencies resolved or on a documented remediation plan
- A full state and local compliance audit completed (or scheduled) within the last 12 months. If not, that’s the first project, before the federal layer
2. Your federal file
- Application submission confirmation and filing-date evidence, kept in one place
- Ownership and financial interest information in your application is accurate and consistent with your state disclosures, with any changes since filing documented and ready to report
- One named owner for all DEA correspondence, and a designated backup
- A federal correspondence file: every contact, request, and response, in order
3. Records
- Decide where federal records will live and who maintains them
- Map what your state track-and-trace system captures against what federal recordkeeping will require, and flag the gaps for counsel review
- Dry run: could you produce a complete accounting for the last 30 days, today, at the registered location?
4. Security
- Inventory your current storage, access controls, and diversion-prevention measures
- Identify which were built to your state’s requirements; those are the ones to re-examine against federal expectations
- Document every gap you fix; the remediation trail is itself evidence of good faith
5. People
- Write the inspection protocol: who greets the investigator, who calls counsel, who produces documents, and what nobody volunteers
- Hold a 30-minute floor training on the protocol; put it on the calendar now
- Test it: can every staff member answer “walk me through how you’d handle a DEA visit tomorrow”?
6. Channels (mixed medical and adult-use operations)
- Map every place the channels share rooms, systems, inventory, or records
- That map is your separation project. Prioritize it; it’s the hardest item on this page and the one an inspector will test first
This is a starter checklist: a starting framework, not an exhaustive list. Federal, state, and local requirements vary by operation, license type, and jurisdiction; readiness for any specific operation requires review by counsel.
Keep reading
Attorney advertising. This issue is general information about federal and state cannabis law, not legal advice about your situation, and reading it does not create an attorney-client relationship. Requirements vary by operation, license type, and jurisdiction and change often; confirm the current text of every authority before acting.