Last week brought three significant DEA developments for state-licensed medical marijuana operators: (a) guidance on what “Timely Applicants” (“Guidance”) may and may not do while their registration applications are pending; (b) an Order to Show Cause proposing to deny a Minnesota dispensary's application; and (c) the first batch of federal registrations, all issued in medical-only markets. As described below, these developments represent major progress for applicants in medical-only states, but create great uncertainty for applicants in dual-use states.

The guidance confirms that Timely Applicants may keep operating, but it limits who they may do business with to other Timely Applicants and DEA registrants, and it expects compliant supply chains no later than November 29, 2026.

The Order to Show Cause and the first registrations, read together, suggest that the path to registration may look very different depending on whether an operator's state has a medical-only program or a combined medical and adult-use market, especially given that the first registrations issued appear to be limited to medical-only markets.

At a high level, the key takeaways and considerations based on these events, include:

• Medical-only markets: If you operate in a medical-only state, the path is comparatively clear. Follow the Timely Applicant guidance closely, including the closed-loop counterparty rules, the diligence steps, and the November 29 deadline. The first registrations DEA has issued all went to operators in these markets. There is an extra layer of compliance added as of 11/29, even if you don’t yet have DEA registration. You’ll need to begin doing diligence buyers and suppliers to ensure they are Timely Applicants or Registrants, including logging their DEA control numbers
• Dual medical/adult-use markets: If you operate in a state with both medical and adult-use programs, the guidance is only the starting point. Read together with DEA's recent Order to Show Cause to a Minnesota dispensary, it raises a real and open question about whether DEA will register entities in mixed-use states at all, and if so, on what terms and conditions. Even more confusing is what to do if the DEA has not rejected your application in a dual use state, but you will (most likely) be unable to comply with the Guidance that – in effect – would limit all applicants in dual use states to the medical supply chain only.

Particularly for applicants in Dual-Use markets, we suggest thinking carefully about your next steps, and are happy to consult.

Background

As we reported in April, DOJ's April 23, 2026 Order placed cannabis “subject to a state medical marijuana license” in Schedule III of the Controlled Substances Act. The April 28, 2026 Final Rule then opened a 60-day window for medical facilities to apply for DEA registration and continue operating while their applications were pending. That window closed on June 26, 2026.

Since then, we have written numerous blogs on the process, including:

• the opening of the dispensary portal;
• DEA's field inspections and information requests; and
• the long-awaited registration forms for manufacturers, distributors, and analytical labs.

The new guidance answers a common question, namely, now that I've applied, what is the impact?

The answer has largely been unclear in the absence of any guidance or pronouncements from the DEA in the interim. While the DEA has spent the last several weeks and months inspecting facilities in several different markets, guidance from those individual field offices have remained limited.

As part of those inspections and pre-inspection requests, DEA has consistently asked operators to list their suppliers, including each supplier's name, address, and DEA registration numbers. DEA has also asked for SOPs on vetting suppliers and on due diligence for suspicious orders.

The new guidance seems to be the culmination of that process and now, first the first time, spells out the consequences of those supplier relationships.

Who Does the Guidance Apply to and Who Is a "Timely Applicant"?

The guidance applies to entities that submitted a complete application under 21 CFR 1301.13(k) between April 28 and June 26, 2026. “Complete” means both the application and payment of the registration fee were submitted within that window.

Two groups do not qualify:

• applicants that withdrew their application or received a Final Order denying it; and
• applicants that lack the required state medical marijuana license.

What Timely Applicants Can Do

Under 21 CFR 1301.13(k)(7), Timely Applicants may continue dispensing, manufacturing, or distributing schedule III medical marijuana under their state license while their DEA application is pending. They may do so “notwithstanding” the general rule that no one may operate until a registration is granted.

The Closed Loop: Permitted and Prohibited Counterparties

Timely Applicants may transact with other Timely Applicants.

For example, a distributor may buy from a Timely Applicant manufacturer and sell to a Timely Applicant dispensary. They may also transact with DEA registrants that hold a schedule III medical marijuana registration (to the extent any have already been issued).

They may not transact with entities that missed the window or never applied, until those entities obtain a registration.

The consequences are potentially serious. Transacting with a non-qualifying entity could be grounds for denial of a Timely Applicant's application, or for revocation of a registrant's certificate.

Due Diligence Is Now Expected and Required

DEA expects operators to verify the status of every trading partner.

At a minimum, it expects you to:

• obtain each Timely Applicant's DEA submission confirmation (for dispensaries, the “Marijuana Dispensary Information Submission”) and verify its document control number (DCN) on the DEA Diversion Control Website;
• obtain a copy of each registrant's DEA certificate of registration;
• confirm that each partner's state license is active; and
• keep records of all of this diligence.

Registrants must also keep full schedule III records under 21 CFR part 1304. A Timely Applicant's DCN may be used where a DEA registration number would otherwise be required.

This guidance builds on a duty that already exists. DEA's general security regulations require a registrant to make a good-faith inquiry before distributing to anyone it does not know to be registered. We have also seen DEA ask manufacturer applicants, ahead of site visits, for SOPs on onboarding new customers and verifying orders, along with supplier and customer lists that include DEA numbers. Operators should therefore build the guidance's diligence steps into their written receiving, ordering, and distribution SOPs, and keep the supporting records ready for inspection.

A Narrow Carve-Out for Testing Labs

Analytical labs are not covered by § 1301.13(k)(7) and still need their own registration. Recognizing that registered labs may be scarce, DEA will not penalize operators for sending de minimis samples to an unregistered lab if all of the following are true:

• the lab is in the same state;
• detailed records are kept of every shipment; and
• no DEA-registered lab is available, either nationwide or, where state law bars out-of-state shipments, within the state.

Product cannot be received back from an unregistered lab.

Existing Inventory and the November 29 Deadline

DEA is giving Timely Applicants until November 29, 2026 to verify their trading partners and restructure their supply chains. Timely Applicant dispensaries and distributors may continue to sell inventory acquired before the guidance was issued, even if it came from non-qualifying sources. The guidance does not expressly extend this allowance to manufacturers.

Does the Guidance Change the Rule?

No, at least not formally.

The rule's expedited-application provision, 21 CFR 1301.13(k)(7), provides that, “[n]otwithstanding subsection (a),” an applicant that applied within the 60-day window “may engage in the manufacture, distribution, and/or dispensing of marijuana . . . for medical purposes in conformity with a state-issued license during the pendency of the application.” The rule text says nothing about who a Timely Applicant may buy from or sell to. The guidance itself states that it does “not have the force and effect of law.”

The guidance cuts both ways. It is generous in treating Timely Applicants, identified only by a DCN, as acceptable trading partners for registrants. It is restrictive in shutting out state-licensed medical operators that missed the window or never applied.

For operators that missed the window, the path forward is to apply. Applications may be filed "at any time." A late filer, however, does not receive the safe harbor in § 1301.13(k)(7) and arguably cannot handle product federally until its registration is granted.

What About Dual-Use Operators?

Many of our clients hold both medical and adult-use licenses, often in the same state and sometimes at the same facility. The guidance does not address them in any express or material capacity, but the Final Rule sets the boundaries:

• Only medical marijuana moved. Only marijuana “subject to a state medical marijuana license” moved to Schedule III. Other marijuana remains in Schedule I.
• Registrations are medical-only. They “do not authorize the manufacture, distribution, dispensing, or use of marijuana . . . for non-medical purposes.”
• Registrations track the state medical license. A registration cannot exceed the scope of the holder's state medical license and is automatically suspended if that license is suspended, revoked, or expires.
• The safe harbor is medical-only. The Timely Applicant safe harbor covers only activity “for medical purposes.”

For dual-use operators, this means a split supply chain. On the medical side, the closed loop applies: Timely Applicants and registrants only. Adult-use activity falls entirely outside the federal registration framework, so the guidance offers it no protection.

Given that the scope of lawful activity must necessarily follow state mandated rules and requirements related to separation/segregation of adult-use and medicinal, strict adherence to these state rules are necessarily mandated. In New Jersey, for example, medical dispensaries may source product from expanded ATCs that also cultivate and manufacture for the adult-use market. Medical-only product, meanwhile, may not be wholesaled to adult-use retailers. Moreover, METRC tags designate certain products as adult-use and medicinal, even if state and METRC guidance permits redesignation at different points in the supply chain. Operators should be prepared to show, through inventory tracking and records, that product designated as medical proceed appropriately through these designated channels.

The Minnesota Order to Show Cause. DEA has issued an Order to Show Cause proposing to deny the dispenser application of In-Dispensary, LLC, a Minneapolis timely applicant. DEA cited three independent grounds.

The first and broadest is that Minnesota's dual-purpose license, which permits both medical and non-medical dispensing, falls outside the definition of a “state medical marijuana license” and fails to provide “robust protections” against diversion.

The other two grounds are more specific to Minnesota: the state lets veterans self-attest to qualifying status without a practitioner's certification, and it permits dispensing of synthetic and artificially derived cannabinoids, which remain in Schedule I.

The order is not final. The applicant has 30 days to request a hearing and file an answer, and DEA has left open the option of a corrective action plan.

While the Minnesota Order to Show Cause rests on three (3) grounds, certainly one (1) of those bases was that “an applicant seeking to obtain a medical marijuana registration is not authorized to manufacture, distribute, dispense, or use ‘marijuana or products containing marijuana for non-medical purposes.’” The DEA emphasized that its registration of medical marijuana applicants must be “consistent with the Single Convention,” which, in turn, must be based on the need to maintain “medical prescriptions for the supply or dispensing of drugs to individuals.” The Order to Show Cause, albeit limited to the Minnesota market, nevertheless went on to state that “[b]ecause the State of Minnesota allows licensees to participate in both the non-medical and medial marijuana markets . . . the state regime fails to provide ‘robust protections’ against diversion, as non-medical use of marijuana remains prohibited under federal law.”

How this language can harmonize with the sizeable number of jurisdictions whereby the vast majority of licenses therein are dual-use remains the largest open question.

The First Registrations: Medical-Only Markets

As important, the DOJ’s recent announcement that it has issued its first registrations to more than 900 dispensaries is all the more noteworthy, given that those registrations were limited to states where only medically licensed businesses are currently operational: Alabama, Florida, Mississippi, South Dakota, Texas, Virginia, and West Virginia. As industry press has noted, those markets are medical-only, or, in Virginia's case, have not yet begun adult-use licensing. That leaves open the treatment of applicants in the states where adult-use sales are legal. One report counts nearly 2,800 timely applicants in those other states, and notes press reporting that DEA may reject Schedule III applicants from adult-use states altogether. Others have observed that the states carrying most of the applicant pool have yet to see a single registration.

Neither development guarantees that dual-use operators will be denied. The self-attestation and synthetic-cannabinoid grounds in the Minnesota order are tied to Minnesota's program, and states differ widely in how they separate medical and adult-use licenses, inventory, and premises. But DEA has not said what degree of separation is enough, and it has not yet registered anyone in a mixed-use market. Operators in those states should assess now how their state's licensing structure compares to Minnesota's, document their medical/adult-use separation, and be prepared to respond quickly to an order to show cause.

Closing Observations

Several points stand out as noteworthy:

• The guidance is non-binding, but the stakes are real. The document itself “do[es] not have the force and effect of law,” but it tells operators how DEA will evaluate pending applications.
• Contracts need attention. Operators should revisit their supply agreements now to add status representations and termination rights.
• Adult-use looms large. The guidance addresses only medical marijuana activity under state medical licenses, and DEA registrations do not authorize any adult-use activity. With the first registrations limited to medical-only markets and the Minnesota Order to Show Cause on the books, dual-use operators should not assume their registrations will follow on the same terms.

Our cannabis team continues to track the DEA registration process, assisting clients with applications, inspections, and broader compliance.

Please reach out if you have questions about how this guidance affects your specific state and/or company operations.