Enforcement Watch · October 2026

Once a year the FDA posts a workbook listing what its investigators cited on standardized Form 483s, the ones they don’t prepare by hand. Across four years, every DSCSA observation in that list landed on a single subsection, belonging to manufacturers.

With the FDA’s September 22 small dispenser survey date past and its enforcement priorities session at the HDA Traceability Seminar behind us,¹ the record worth reading this October is the one the agency publishes without a press cycle. As verification activity continues to rise, manufacturers are increasingly facing pressure to be ready to respond.

What’s a System-Generated 483?

The workbook comes from the FDA’s Office of Inspections and Investigations and counts each citation on the 483s its electronic inspection tools generate, by program area.² A Form 483 is what an investigator hands to management at the close of an inspection when conditions observed may, in the investigator’s judgment, constitute violations of the FD&C Act.³ A 483 came before each of the three posted DSCSA warning letters.

The standard citation reads: “Your firm failed to have systems in place to enable compliance with the verification requirements of the DSCSA.” The one exception, in fiscal 2024, reads: “Your firm failed to notify [FDA] [immediate trading partners] within 24 hours after determining that product in your possession or control is an illegitimate product.” Both are 582(b) citations, and 582(b) is the manufacturer section of the statute. No line in four years cites 582(c), the wholesaler section, or 582(d), the dispenser section.

That absence matters because the three posted DSCSA warning letters were built on exactly those two subsections: Safe Chain Solutions⁴ and Sterling Distributors⁵ under 582(c) and Pure Indulgence Aesthetics⁶ under 582(d). The FDA indicates the workbooks exclude 483s that investigators prepare by hand, so the public 483 data and the public warning letters describe two different groups. Safe Chain’s 483, issued in May 2022, and Sterling’s, issued in March 2025, fall inside the years the workbook covers, yet neither appears in it as a 582(c) line. The letters show the agency escalating against two distributors and a med spa. The workbook shows its investigators writing up manufacturers, inspection after inspection, for their verification systems.

Inspectors are looking for verification systems. Where the procedure is, who is trained on it, and what happened the last time the clock started. The fourteenth citation was about the clock itself.

What 582(b)(4) actually requires

Section 582(b)(4) opens with one sentence, that a manufacturer “shall have systems in place to enable the manufacturer to comply with” what follows, and then lists the duties.⁷ The 483 template quotes that opening sentence. The specifics, which the investigator writes after “Specifically,” come from the list.

The December 2023 final guidance on verification systems turns that list into inspection expectations.⁸ Standard operating procedures are part of the system, so an electronic tool alone does not discharge the duty. Whoever holds the product quarantines it physically, with an electronic quarantine behind it so nothing ships by accident. The procedures should name who may release product from quarantine. A product cleared after an FDA request gets a cleared product notification back to the agency. And trading partners should periodically evaluate their systems, which Faegre Drinker read at the time as an opening for a 483 observation whenever an investigator finds no evidence of such a review.⁹

Observations beyond the template

The FDA’s workbook report stops at the standard template. The warning letters pick up where it stops, because each one sets out what investigators actually found. Two of the three charge the same systems failure under the wholesaler subsection, 582(c)(4): Safe Chain’s first violation and Sterling’s sixth.

At Safe Chain, the suspect and illegitimate product SOP lacked the detail to identify suspect product, investigate with trading partners, handle an illegitimate product notification, handle an FDA verification request, make cleared product notifications or keep the records. A second SOP told staff to contact the Maryland Board of Pharmacy and the FDA within 3 days, against a 24 hour statutory window. The firm told the FDA it had hired a consulting firm to review all its SOPs, yet the new suspect product SOP in its 483 response set a trading partner notification window the FDA called inconsistent with the 24 hour rule, and it disagreed with the firm’s other, corrected SOP.

At Sterling, none of the policy documents and SOPs handed to investigators addressed the verification requirements. The intake record is starker. A dispenser reported possibly mispackaged product on December 4, 2024 and returned it the next day; Sterling sent it back to its supplier without investigating. The manufacturer contacted Sterling on December 17 and followed up on December 19 and January 3. The Arkansas Board of Pharmacy sent subpoenas dated November 19, 2024 and January 14, 2025, and the Mississippi board called around January 8 and wrote on January 23. Sterling could show no response to the manufacturer or either board, kept receiving the same lot until January 28, 2025 and kept shipping it until February 3. When the FDA made its own records request on March 4, the firm replied that it “does not maintain such records in the ordinary course.”

If you manufacture or repackage: six things to show an inspector

1. Read your verification SOP against 582(b)(4). Suspect product, illegitimate product, verification requests and saleable returns each need a named procedure, a named owner and a named record.
2. Write the clocks into the procedure. Twenty four hours to notify the FDA and immediate trading partners of illegitimate product. Twenty four hours to answer a verification request. Promptly for the investigation. Then check that every SOP naming a clock names the same one.
3. Prove the intake works. Drill a trading partner notification, a state board query, and an FDA verification request. Record who received each one, when, and what happened inside the clock.
4. Keep the file that proves the investigation happened. Safe Chain filed Form 3911s but could produce no record of what was quarantined, when, or how the investigations ran. Six years is the statutory minimum, and the file is what the investigator reads.
5. Date the last time you evaluated the system. The 2023 guidance asks for periodic evaluation. A dated review with findings and changes is the difference between a system and a document.
6. Verify saleable returns before they go back to stock, and keep the output. A return restocked without a verification log leaves a hole an investigator can find in an afternoon.

If you distribute or dispense: four things

1. Your subsection carries the same list. Sections 582(c)(4) and 582(d)(4) mirror the manufacturer duties: suspect product, illegitimate product, notifications, and for wholesale distributors saleable returns.
2. Keep a system for authorized trading partner checks, with dated output. Safe Chain’s own SOP linked the FDA’s licensure reporting database, and the firm bought from two distributors the FDA has no record of ever reporting. Sterling could not show it checked its supplier at all. Pure Indulgence was charged under 582(d)(3) after the FDA set AbbVie’s purchase records against the clinic’s treatment records.
3. Receive serialized product or documented exceptions, nothing else. Pure Indulgence was also charged under 582(d)(2): investigators found an unlabeled vial in the trash, lab analysis showed botulinum neurotoxin type A, and the firm produced no label or package carrying a product identifier.
4. Expect the manufacturer upstream to ask you questions. A manufacturer running a suspect product investigation has to validate transaction history and information with its trading partners, so your records are part of its system. Sterling’s failure to respond is in its warning letter.

Where the calendar stands

Dispensers with 26 or more full-time employees have been on the package level requirements since November 27, 2025. Qualifying small dispensers, and their trading partners where applicable, run to November 27, 2027 under the FDA’s August 2026 exemption.¹⁰ Wherever you are in the supply chain, stay safe and keep an eye out!

Enforcement Watch reads the public record: FDA warning letters, FDA inspection observation data, FDA guidance and exemption notices, the statute and published legal analyses. Citation counts come from the Drugs tab of the FDA Inspection Observations workbooks for fiscal years 2022 through 2025 and cover system-generated Form 483s only; the FDA excludes manually prepared 483s, and a frequency figure counts citations rather than firms or inspections. Fiscal years run October 1 through September 30. The February 2019 McKesson warning letter, the first DSCSA-related letter on record, was closed out in 2024 and is no longer posted, so it is excluded from the count of posted letters. This column is informational and is not legal advice.

Sources & notes

1. Healthcare Distribution Alliance, 2026 Traceability Seminar: Sessions, August 31 to September 2, 2026. ↩
2. FDA, Inspection Observations, fiscal year 2022 to 2025 workbooks, Drugs tab. ↩
3. FDA, FDA Form 483 Frequently Asked Questions. ↩
4. FDA, Warning Letter 636044, Safe Chain Solutions, LLC, June 8, 2023. ↩
5. FDA, Warning Letter 706508, Sterling Distributors, June 5, 2025. ↩
6. FDA, Warning Letter 723267, Pure Indulgence Aesthetics, April 1, 2026. ↩
7. 21 U.S.C. 360eee-1(b)(4), FD&C Act section 582(b)(4). ↩
8. FDA, Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs, final guidance, December 2023. ↩
9. Faegre Drinker, FDA Issues Final Guidance on Supply Chain Verification Systems, January 25, 2024. ↩
10. FDA, DSCSA Exemptions from Certain Requirements Under Section 582 of the FD&C Act for Small Business Dispensers Until November 27, 2027, August 2026; FDA, Waivers and Exemptions Beyond the Stabilization Period. ↩