TLDR: The DEA’s Timely Applicant list shows a state, a business activity and a control number, not a name. To build a compliant supply chain, filter the list to your state and collect identities and documents from suppliers and buyers through one short request. For each Timely Applicant, get its DEA submission confirmation and verify its DCN on the DEA Diversion Control website. For each registrant, get its DEA certificate of registration. For everyone, get a copy of the state license and confirm with the state that it is active. Keep a record of every check in a single verification ledger, with a date and a reviewer on every entry. The checks the DEA expects are in paragraph 8 of its October 30 guidance; Timely Applicants are expected to finish them by November 29, 2026.
The DEA has published a list of medical marijuana Timely Applicants, but it leaves businesses with a practical problem: the list does not identify applicants by name. It provides a state, business activity and application control number. That makes it useful for checking a number someone gives you, but much less useful for finding suppliers or buyers you do not already know.
For a Timely Applicant trying to build a workable supply chain, the most efficient approach is to combine that federal list with a standardized request for information from businesses in its state. Collect the identities directly, match the supporting documents to the DEA’s records, and keep the results in one organized spreadsheet.
This process should include businesses that have already received DEA registration. A directory limited to pending Timely Applicants could miss potential business partners that have moved from applicant to registrant.
Start with the federal list
Download the current DEA Timely Applicant list. Import it into Excel or Google Sheets using tabs as the separator, and label the three columns State, Business Activity and Control Number. Filter the State column to your state’s two-letter abbreviation.
Keep the file date with your downloaded copy. On its medical marijuana information page, the DEA says the list is updated daily, so an older spreadsheet should not become your permanent verification source.
The filtered list gives you application numbers to check against information businesses provide. It does not tell you which company owns each number. Do not infer a company’s identity from the order of entries, similar application numbers or a third-party claim.
Collect names through one consistent request
Begin with your existing suppliers and business customers. They are the relationships you need to understand first. Then expand your outreach through the state’s official license directory, industry associations and referrals from existing business partners.
Use one short form rather than collecting scattered emails with different information. Ask each business for:
- Its full legal entity name and any trade name.
- Its licensed premises address.
- Its state license number, license type, a copy of the license and its written confirmation that the license is active and in good standing as of a stated date.
- Its claimed federal status: pending Timely Applicant, DEA registrant or another status.
- Its application control number or DEA registration number.
- A copy of its DEA submission confirmation (for dispensers, the “Marijuana Dispensary Information Submission” confirmation) or its DEA certificate of registration, as applicable.
- A contact responsible for licensing and status updates.
The five checks the guidance expects
Paragraph 8 of the DEA’s October 30 guidance describes the agency’s minimum due diligence expectations during the transition. Every business partner gets the checks that fit its status:
- Timely Applicant dispensers: obtain a copy of the “Marijuana Dispensary Information Submission” confirmation the DEA sent when the application was submitted, and verify the document control number, or DCN, on the DEA Diversion Control website.
- Timely Applicant manufacturers and distributors: obtain a copy of the submission confirmation the DEA provided when the application was submitted, and verify the DCN on the DEA Diversion Control website.
- DEA registrants: obtain a copy of the DEA certificate of registration.
- Every business partner: obtain a copy of its relevant state license and verify that the license is active.
- Your own file: keep records of all the due diligence you conduct.
The sections below walk through each check in practice.
Check a Timely Applicant’s documents against the DEA’s list
Start with the confirmation itself. A dispenser should produce its “Marijuana Dispensary Information Submission” confirmation; a manufacturer or distributor should produce the submission confirmation the DEA provided when it applied. A statement that the business applied, without the confirmation, does not complete the check.
Then verify the DCN on the DEA Diversion Control website: search the current Timely Applicant list for the exact DCN shown on the confirmation, and save a copy of the result with the date you checked. Compare the state and activity, then connect that record to the legal entity and premises identified in the supporting documents.
A matching number is only useful if it belongs to the business you are actually dealing with. A brand name, common owner or affiliated company should not substitute for identifying the counterparty.
If the documents do not match, mark the record unresolved and request clarification. Do not fill the gap with an assumption.
Check a business that says it is already registered
For a DEA registrant, the guidance calls for a copy of its DEA certificate of registration, together with the same state license check and records every business partner gets.
Review the certificate for the entity, registered location, authorized activity, covered substances and expiration date. Confirm that those details fit the proposed transaction. If authenticity, restrictions or current federal status are unclear, seek confirmation from the DEA before treating the issue as resolved.
Do not reject a business merely because its DCN has disappeared from the pending-applicant list. The DEA explains that applicants can leave the list when registrations are granted, applications are withdrawn or their status otherwise changes. Absence alone does not establish which event occurred.
Confirm the state license is active
Every business partner, applicant or registrant, needs this check. Obtain a copy of the relevant state license, then confirm its status with the state rather than relying on the copy, which shows only what was true when it was issued. Use the state regulator’s own public license lookup; in California, that is the Department of Cannabis Control’s license search. Confirm that the license is active, that the licensee and premises match the business you are dealing with, and that the license type fits the transaction.
Do not stop at the public tool. Get a written representation from the licensee itself that its license is active and in good standing as of a stated date, with an obligation to tell you if that changes. A public lookup can lag behind a suspension, a surrender or a renewal for any number of reasons, and the representation gives you the licensee’s own statement to rely on and to hold it to if the lookup turns out to be stale. The two checks back each other up; neither one alone is the complete answer.
Save the lookup result and the representation with the dates you obtained them. A license that is suspended, expired or surrendered should keep the record unresolved, whatever the federal documents show.
Keep one verification ledger
A shared spreadsheet is enough to start. Use a separate record for each relevant entity, premises and application or registration. Include the business name, contact, state license number and the date its active status was confirmed, federal identifier, activity, document links, date checked, reviewer and any unresolved issue.
The guidance expects records of all the due diligence conducted, so the ledger should point to the evidence, not just summarize it. Keep the copies you obtained (the submission confirmation or registration certificate and the state license), the saved DCN search result, the saved state license lookup and the licensee’s own representation that its license is active, each with its date. If a check could not be completed, record that too, along with what was requested and when.
Keep submitted information separate from reviewed information. Useful internal labels include “documents requested,” “verification incomplete,” “Timely Applicant checks completed as of [date]” and “registration documents reviewed as of [date].” Avoid a permanent “DEA approved” label for a pending applicant.
Assign someone responsibility for refreshing the records. A practical internal policy is to recheck before the first covered transaction, after notice of a status change and periodically during continuing relationships. That is a suggested operating practice, not a verification interval specified in the October 30 guidance.
In paragraph 11 of its October 30 guidance, the DEA says Timely Applicants are expected to complete business-partner verification and necessary supply-chain adjustments by November 29, 2026. That date is not a new application window.
A request businesses can send today
Collecting these responses gives you the identities the public list lacks. Checking the documents gives those identities practical value. Neither a form submission nor a spreadsheet entry replaces determining whether the particular transaction is authorized.
Frequently asked questions
Can I search the DEA’s Timely Applicant list by business name?
The published file contains state, business activity and control number, without business names. Obtain the business’s identity and submission confirmation directly, then match its DCN to the current list.
Does “we applied” establish Timely Applicant status?
No. The DEA’s guidance requires a completed application and applicable fee submitted between April 28 and June 26, 2026, a still-pending application and the requisite state medical marijuana license. Withdrawn applications and applications denied by final order do not qualify.
Should I check buyers as well as suppliers?
Yes. This workflow covers commercial medical marijuana counterparties on both sides of the transaction.
Does completing these checks guarantee a lawful transaction?
No. Identity and status verification are part of the analysis. The parties’ authorized activities, premises, products and applicable state requirements still matter. Any unresolved discrepancy should remain visible rather than being treated as approval.
Keep reading
Attorney advertising. This article provides general information, not legal advice, and does not create an attorney-client relationship.
