Controlled Substances Ordering System (CSOS) Modernization

#  [Amended]

**AGENCY:**

Drug Enforcement Administration, Department of Justice.

**ACTION:**

Final rule.

**SUMMARY:**

This rule is amending the Drug Enforcement Administration's (DEA) regulations to conform to the Controlled Substances Ordering System (CSOS) modernization effort by requiring all CSOS enrollment applications and supporting materials to  be submitted through the Diversion Control Division secure online portal. These amendments improve the enrollment process by aligning it with DEA's current requirements for other online form submissions. The online submission of enrollment applications and supporting material through the secure online portal increases the efficiency of the enrollment, modification, and revocation processes, and ensures DEA's receipt of accurate documentation in a more timely and organized manner.

**DATES:**

This Final Rule is effective November 3, 2025.

**FOR FURTHER INFORMATION CONTACT:**

Heather E. Achbach, Regulatory Drafting and Policy Support Section, Diversion Control Division, Drug Enforcement Administration; Telephone: (571) 776-2265.

**SUPPLEMENTARY INFORMATION**

**Legal Authority**

The Controlled Substances Act (CSA) grants the Attorney General authority to promulgate rules and regulations relating to: the registration and control of the manufacture, distribution, and dispensing of controlled substances and listed chemicals; reporting changes to professional or business addresses; and the efficient execution of his statutory functions. [^1] The Attorney General is further authorized by the CSA to promulgate rules and regulations relating to the registration and control of importers and exporters of controlled substances and listed chemicals. [^2] The Attorney General has delegated this authority to the Administrator of DEA. [^3]

[^1] 21 U.S.C. 821, 822(a), 823, 827 (h), 871(b).

[^2] 21 U.S.C. 957(a), 958(f).

[^3] 28 CFR 0.100(b).

The CSA defines “distribute” as “to deliver (other than by administering or dispensing) a controlled substance or a listed chemical” and “distributor” as “a person who so delivers a controlled substance or a listed chemical.” [^4] The CSA further provides that it “shall be unlawful for any person to distribute a controlled substance in schedule I or II to another except in pursuance of a written order of the person to whom such substance is distributed, made on a form to be issued by the Attorney General in blank in accordance with subsection (d) [of 21 U.S.C. 828] and regulations prescribed by him pursuant to [21 U.S.C. 828].” [^5] “Every person who gives an order required under subsection (a) [of 21 U.S.C. 828] shall, at or before the time of giving such order, make or cause to be made a duplicate thereof on a form to be issued by the Attorney General in blank in accordance with subsection (d) [of 21 U.S.C. 828] and regulations prescribed by him pursuant to [21 U.S.C. 828], and shall, if such order is accepted, preserve such duplicate for a period of two years and make it available for inspection and copying. . . . ” [^6] “The Attorney General shall issue forms . . . only to persons validly registered under [21 U.S.C. 823] (or exempted from registration under [21 U.S.C. 822(d)). Whenever any such form is issued to a person, the Attorney General shall, before delivery thereof, insert therein the name of such person, and it shall be unlawful for any other person (A) to use such form for the purpose of obtaining controlled substances or (B) to furnish such form to any person with intent thereby to procure the distribution of such substances.” [^7]

[^4] 21 U.S.C. 802(11).

[^5] 21 U.S.C. 828(a).

[^6] 21 U.S.C. 828(c)(2).

[^7] 21 U.S.C. 828(d)(1).

**Implementation of the CSA Written Order Form Requirement**

**Paper DEA Form 222**

In 1971 DEA implemented the CSA's written order form requirement by publishing a final rule requiring triplicate paper DEA Form 222s. [^8] In 2019, DEA amended its regulations to create a new single-sheet format for the paper DEA Form 222s. [^9] The rule contained transition provisions allowing registrants to continue to use their existing stocks of the triplicate paper DEA Form 222s until October 30, 2021. [^10]

[^8]*Regulations Implementing the Comprehensive Drug Abuse Prevention and Control Act of* 1970, 36 FR 7776, 7797 (Apr. 24, 1971).

[^9]*New Single-Sheet Format for U.S. Official Order Form for Schedule I and II Controlled Substances (DEA Form 222),* 84 FR 5395 (Feb. 21, 2019); *New Single-Sheet Format for U.S. Official Order Form for Schedule I and II Controlled Substances (DEA Form 222),* 84 FR 51368 (Sept. 30, 2019).

[^10] 21 CFR 1305.20.

**Electronic DEA Form 222**

In 2005, DEA published a final rule amending its regulations to provide an electronic equivalent to the DEA Form 222 (also known as CSOS). [^11] The amendments allowed registrants to order schedule I and II controlled substances electronically and maintain records of these orders electronically. The intent of these amendments was to reduce paperwork and transaction times for DEA registrants who sell or buy controlled substances.

[^11]*Electronic Orders for Controlled Substances,* 68 FR 38557 (June 27, 2003), and *Electronic Orders for Controlled Substances,* 70 FR 16901, (Apr. 1, 2005).

**Summary of Current CSOS Regulations**

The current CSOS regulations are found in 21 CFR parts 1305 and 1311. DEA Registrants use CSOS as a secure system to track schedule I and II controlled substance orders. The system allows for secure electronic controlled substance orders without the need for a paper order form (DEA Form 222). Using Public Key Infrastructure (PKI), CSOS requires that each individual supplier and purchaser enroll with DEA to acquire a CSOS digital certificate. System enhancements allow electronic documentation submission, self-service support options, and electronic processing of single and bulk applications, renewals, and revocations. Users are able to electronically search for, revoke, report, retrieve, and renew secure digital certificates.

**Purpose of Rule**

Current regulations require registrants who wish to participate in the CSOS system to enroll using a labor-intensive manual process which relies on paper applications. The paper application must be notarized and the package mailed to DEA, creating delays in the enrollment process and putting applications at risk of being lost. [^12] The purpose of this rule is to simplify the application process by requiring all CSOS enrollment applications to be submitted online. [^13] All applicants for enrollment will follow the CSOS link on the *deadiversion.gov* website to the CSOS log-in page. From the CSOS log-in page the applicant will be redirected to *Login.gov* for Identification Verification. Upon arrival at the site, the applicant will be asked to create a *Login.gov* account by entering a valid email address, selecting a default language, and agreeing to *Login.gov* 's Rules of Behavior. A confirmation email will then be sent to the applicant's selected email. Once the email has been confirmed, the applicant must create a *Login.gov* password by providing a telephone number to which a verification code can be sent. Once the code is sent and the applicant enters the given code on the *Login.gov* website, the applicant must agree to the site's security statement. *Login.gov* next requires applicants to upload photographs of one or more forms of identification as specified by *Login.gov* and to enter a Social Security Number, after which the applicant is asked to verify the given information. The applicant is next asked to re-enter their *Login.gov* password to receive a  Personal Key by separate message. The applicant is then asked to enter that Personal Key and review their information. Upon review of the information, the applicant is then directed back to the CSOS website for further processing. Upon return to the CSOS website, the applicant is asked to agree to the CSOS User Agreement and can apply for one of three system user roles (Registrant, Coordinator, or Power of Attorney in descending order of superiority) with enrollment requests approved or rejected by the superior role. After the Registrant role is established, all subordinate applications for enrollment must be approved by the Registrant. Upon establishment of a Coordinator, all subordinate applications for enrollment for the Power of Attorney role must be approved in the system by the responsible Coordinator.

[^12] 21 CFR part 1311 *et seq.*

[^13] CSOS 2.0 was successfully deployed for public use on December 9, 2024.

This final rule amends DEA regulations to require electronic enrollment through a secure web-based system. Submission through the secure online system will be a streamlined process which will benefit both DEA and CSOS participants.

**Summary of the Notice of Proposed Rulemaking**

On February 2, 2023, the Drug Enforcement Administration (DEA) published a Notice of Proposed Rulemaking (hereinafter “NPRM”) proposing to amend DEA's regulations to conform to the CSOS modernization effort by requiring CSOS enrollment applications and supporting materials to be submitted through the Diversion Control secure online portal. [^14] In this rulemaking, DEA is finalizing the regulatory text proposed in the NPRM and addressing concerns brought forth by commenters.

[^14] 88 FR 7033.

**Discussion of Public Comments**

DEA received eight (8) comments in response to the NPRM. [^15] The commenters included: the general public, third-party interest groups, and an online identity network company. The commenters were mostly supportive of the proposed rule. Six (6) commenters supported the new system and viewed the proposed rule's modernization effort of CSOS as positive. However, one (1) commenter disagreed with the use of *Login.gov* and wanted DEA to align the credential service provider requirement to current practices within the healthcare industry that coordinates with National Institute of Standards and Technology (hereinafter, “NIST”) IAL2/AAL2 standards. Most of the commenters were asking for clarification regarding certain aspects of the proposed rule. The comments will be further discussed in detail below.

[^15] A total of eight (8) comments were received; however, one commenter submitted a duplicate comment.

**Paper DEA Form 222s Should Still Be An Option**

*Issue 1:* Two (2) commenters expressed concern that the proposed rule should continue to allow the use of paper DEA Form 222s as an option. Both of the commenters noted that some states still require paper forms to transfer controlled substances between a Long-Term Care (hereinafter, “LTC”) pharmacy and emergency kit in a skilled nursing facility.

*DEA Response 1:* Paper DEA Form 222s will still be an available option. The proposed rule will have no impact on the continued availability and use of paper DEA Form 222s. DEA is aware of some states continuing to require the use of paper DEA Form 222s, and therefore, will keep the forms available as an option for the distribution of controlled substances.

**Transition of Existing Registrants to CSOS 2.0**

*Issue 2:* Three (3) commenters asked for clarification on how DEA intends to transition registrants with existing, active certificates to CSOS 2.0.

*DEA Response 2:* DEA will transition existing registrants to CSOS 2.0 by transferring all active certificate holders and their associated information to CSOS 2.0. This associated information includes DEA number(s), certificate serial numbers, and other aspects. This information will be accessible when the user creates an account in the new portal. The following fields of active certificate holders are being moved into CSOS 2.0: registrant status, renewal instance number, application status code, application status date, certificate serial number, certificate expiration date, DEA number, individual identification, and role. The information that is related to current and/or active certificates will not need to be resubmitted.

*Issue 3:* Two (2) commenters wanted clarification on whether existing and active registrants will have to resubmit information in the new online portal.

*DEA Response 3:* Current and/or active registrants will not be required to re-submit information related to their current and/or active certificates.

**Receipt of Verification Code**

*Issue 4:* One (1) commenter asked for clarification as to whether the individual accessing the CSOS login page could provide either a cellular phone or a landline phone number for the purpose of receiving the verification code. This commenter was concerned as cellular phone usage is not always available. The commenter also asked for secure alternatives to providing the verification code as phone use will not always be available for all registrants attempting to utilize the CSOS system.

*DEA Response 4:* Individuals logging into CSOS will receive a verification code. CSOS registrants have the option of receiving the verification code through OKTA Verify, [^16] Google Authenticator, and email. OKTA Verify has recently discontinued the phone option. As a result, cell phones or land phones are no longer an option.

[^16] OKTA Verify is a multifactor authentication application that enables users to confirm their identity. *https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm.*

**Features of CSOS**

*Issue 5:* One (1) commenter sought clarification regarding the implementation of the electronic application submission process. Specifically, the commenter asked if the user will be notified upon login to the site that they have reached their two opportunities for online renewal before the certificate expires and now need to submit a new application.

*DEA Response 5:* Currently, the portal does not show that an individual has reached his or her two opportunities to renew online before the certificate expires. The DEA will continue working towards incorporating this feature in a future update to the portal.

*Issue 6:* One (1) commenter asked whether the Coordinator(s) will be notified that the subordinate's application for enrollment for the Power of Attorney role is ready for review and approval by the Coordinator, as required by the rule and if so, how.

*DEA Response 6:* All users in the system will have full visibility into their actions pending review and approval. Approvers will receive email notifications of pending approvals. The Coordinator will be notified via email that the subordinate's application for enrollment for the Power of Attorney role is ready for review and approval.

*Issue 7:* One (1) commenter asked DEA for a live chat option for registrants to contact DEA regarding enrollment issues, and the option to receive an email transcript of said chat conversation.

*DEA Response 7:* Currently, this option is unavailable; however, this feature can be considered in a future upgrade. A new feature to CSOS will be an email option that generates a ticket number and assigns a time frame wherein a help desk representative will respond.

**Implementation**

*Issue 8:* One (1) commenter asked for DEA to further explore and clarify the implementation process.

*DEA Response 8:* The implementation and transition processes are being finalized. Prior to the launch date, informational announcements previewing new functionality, pertinent dates, and online application instructions will be provided to DEA registrants via email and on the DEA Diversion website. An email will be sent to users providing them with a website link. The email will come from *deaecom.gov* , which is a verified government email address, from which CSOS and DEA participants have received emails in the past. The email will only be sent in response to action taken by the participant, not initiated by DEA. These measures are sufficient for users to recognize valid communications from DEA. The website will provide the users with instructions. Users will be informed when the new process will go into effect as well as what steps users will need to take. Current users will continue utilizing the login page as they did in the past. Current users are not required to act until the time of renewal. There will be a pre-launch date that will enable users to perform the *Login.gov* identity verification process prior to creating a CSOS account. When CSOS 2.0 is launched, current users will be able to create accounts as well as take advantage of the new self-service features.

*Issue 9:* One (1) commenter asked whether DEA would take steps to remedy registrants experiencing excessive hold times when calling the CSOS help desk, and whether DEA would further staff the help desk with individuals that can resolve the problem as opposed to someone that records and relays information to the support team.

*DEA Response 9:* The newly automated system will allow subscribers to complete tasks independently on the portal that, under the current system, required users to call the help desk. This will greatly lower the number of calls made to the help desk. As a result, hold times will be significantly diminished. The call center operators are increasingly being cross-trained to handle CSOS and general registration requests. Call center operators had their initial training session and are in the process of reviewing a training manual. There is a training site for them to utilize as well.

*Issue 10:* One (1) commenter wanted to see improvements with the CSOS certificate retrieval process as the retrieval process is time consuming and difficult. The commenter asked DEA to standardize and streamline the CSOS certificate retrieval process, particularly with pharmacy chains. This commenter urged DEA to create an automated process in which the passwords for CSOS certificate retrieval can be uploaded into the certificate retrieval system. Furthermore, the commenter asked DEA to update its software to eliminate the need for passwords to be issued in text files, and that the automated process allow a user to be logged in for extended periods of time.

*DEA Response 10:* A modernized retrieval process will be a part of a later upgrade to the portal. DEA has taken this comment into consideration for future upgrades to the system.

**Credential Service Provider and Identity Proofing Security**

*Issue 11:* One (1) commenter stated that DEA should strike *Login.gov* from its purpose statement and align the credential service provider (hereinafter, “CSP”) requirement to current practices within the healthcare industry, *i.e.,* credentials aligned with NIST IAL2/AAL2 standards. This commenter also stated that DEA should enable providers to use portable, digital credentials they already have for CSOS access by providing multiple CSP solutions selected through a competitive procurement process.

*DEA Response 11:* The use of additional CSPs may be a future enhancement. *Login.gov* will conduct identity proofing, and DEA will continue as the Certification Authority. * Login.gov* does not meet the standard of NIST IAL2/AAL2; however, * Login.gov* meets the IAL1/AAL1 standard. Following the standards of NIST IAL1/AAL1 is sufficient for CSOS 2.0 as *Login.gov* conducts additional verification procedures similar to those used by financial institutions. Alignment with NIST IAL2/AAL2 may be an enhancement in the future.

*Issue 12:* One (1) commenter wanted clarification regarding the notary requirement, and which free online verification method will be used. The “Purpose of Rule” section of the NPRM discusses the use of *Login.gov,* which the commenter states does not appear to be an identity proofing service. Further the commenter wanted clarification as to whether ID.me is the identity proofing service that will be used, as other government agencies mention the use of *Login.gov,* but indicate ID.me is the actual identity proofing service.

*DEA Response 12:* The Technology Transformation Services within the General Services Administration operates a system, *Login.gov,* which provides authentication and identity verification services to federal agencies. DEA will use *Login.gov* for authenticating users and verifying identity. ID.me is not the identity proofing service that will be used. *Login.gov* conducts identity proofing, and no payment is required by the applicant during the *Login.gov* or CSOS account creation. Federal agencies are responsible for ensuring that users are properly authenticated and identified before accessing services, benefits, and other resources. *Login.gov* provides these capabilities as a shared service to agencies on a cost reimbursable basis. Strong authentication requires each account to be protected by a multi-factor option, which increases account security. Identity verification requires users to go through an identity proofing process to confirm that the user is who the user claims to be. This process may include, but is not limited to, a combination of digital technologies, government and commercial data sources, and in-person interactions to check identifying documents and evidence. *Login.gov* offers other settings for authentication, including requiring a user-provided second factor for authentication each time a user authenticates. This setting is required for identity verification and authentication-only services that use personal data.

*Issue 13:* One (1) commenter asked for clarification on whether the free online verification service is a hosted or cloud-based service, and what the level of assurance is compared with the level of assurance of the current process.

*DEA Response 13:* There is no payment requirement for the applicant during account creation for *Login.gov* and CSOS 2.0. *Login.gov* is cloud-based. After analyzing alternative solutions, *Login.gov* was selected as the preferred solution, based on comprehensive service offerings and competitive pricing. The level of assurance of the new process is comparable to the current process. The level of assurance with the current process involves a notary requirement. The *Login.gov* system that is going to be used for CSOS 2.0 is at the IAL1/AAL1 assurance level. DEA determined that the IAL1/AAL1 assurance level plus additional verification procedures similar to those  used in financial institutions is comparable to the current process. The use of CSPs and alignment with NIST IAL2/AAL2 may be a future enhancement.

*Issue 14:* Two (2) commenters were concerned with the level of assurance or security of the process that will be implemented.

*DEA Response 14:* The assurance level for CSOS 2.0 is at IAL1/AAL1, which includes additional verification procedures similar to those used by financial institutions conducted by *Login.gov.* The assurance level of IAL1/AAL1 was deemed sufficient due to the additional verification procedures that *Login.gov* conducts.

*Issue 15:* One (1) commenter discussed how currently, two copies of identification are needed for obtaining a CSOS digital certificate under 21 CFR 1311.25(a)(1). The commenter asked DEA to provide clarification as to what the new process will encompass as the proposed change states to “complete the online verification proofing process.”

*DEA Response 15:* Applicants should be prepared to provide the following information: state issued identification, email, phone bill details, and a verified address. Social Security Numbers are being collected during the * Login.gov* registration process, but are not being passed, transferred, or stored within CSOS 2.0.

**Online Portal**

*Issue 16:* One (1) commenter asked for clarity on what the online registration process will look like through the secure online portal. This commenter further asked for clarification if it will be a web-based form with the same exact fields as the current paper DEA Forms 251, 252, 253, and 254.

*DEA Response 16:* DEA will update the CSOS user guide with screenshots of the new portal prior to launch. The new portal uses web-based forms that require the same information as on the paper forms.

*Issue 17:* One (1) commenter asked whether the secure online portal will be cloud-based and what kind of security will be implemented.

*DEA Response 17:* The online portal is a FedRAMP government cloud-based solution with multifactor implementation. FedRAMP is a certified system and is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP provides a standardized approach to security authorizations for Cloud Service Offerings.

**Coordinator**

*Issue 18:* One (1) commenter asked for clarification for the reason of removal of the coordinator from the process in 21 CFR 1311.25, as the coordinator seems to have a significant security role in limiting who can apply for a CSOS digital certificate.

*DEA Response 18:* DEA is not removing the Coordinator role from the process in 21 CFR 1311.25. The individuals who are acting in the Coordinator role will be able to review and approve and/or deny applications in the online portal. *Login.gov* does the identification proofing on all subscriber applications; therefore, the Coordinator will no longer be tasked with verifying and approving submitted documentation for Power of Attorney applications. The requirement for the application to be notarized and physically mailed to DEA will be removed with the amending of the regulations.

Previously, the Principal Coordinator was responsible for identity proofing all applications submitted under a respective DEA registration. Although all applicants will now be verified and authenticated online, the Principal Coordinator remains an integral part of the application process. Once a Principal Coordinator is designated by the registrant, the Principal Coordinator will be involved in the issuance of, revocation of, and changes to digital certificates issued under that registrant's DEA registration and can approve subsequent applications submitted for the Power of Attorney role. The Principal Coordinator role will continue to provide security and certificate oversight.

*Issue 19:* One (1) commenter asked for clarification on how the Coordinator informs the Certification Authority of all digital certificate applications, and how the process will work with the Coordinator for approving applicants applying for a Power of Attorney certificate.

*DEA Response 19:* The Coordinator will receive an automatic email from CSOS 2.0 requesting that the Coordinator review and approve requests for the Power of Attorney role triggering issuance of the certificate. Coordinators use the portal to revoke certificates of subscribers they oversee and to approve or reject new Power of Attorney role requests and certificate renewals. Powers of Attorney submit these requests independently, which then go to the Coordinator to approve or reject the request. The Coordinator no longer needs to provide a signature on the application for submission of the request.

*Issue 20:* One (1) commenter stated that 21 CFR 1311.20 and 1311.25 have been changed in a way so that the Coordinator no longer has to send a copy of the DEA Form 223 [^17] to the CSOS Registration Authority. This commenter discussed how the NPRM proposed to remove language stating that the Coordinator is responsible for verifying the applicant's identity in 21 CFR 1311.20, as well as the Coordinator reviewing the application package, and the Coordinator submitting the completed package to the Certification Authority. Finally, the commenter asked for clarification regarding the purpose of the changes, and how security will be impacted.

[^17] DEA form 223 is the Certificate of Registration, which contains “the name, address, and registration number of the registrant, the activity authorized by the registration, the schedules and/or Administration Controlled Substances Code Number (as set forth in part 1308 of this chapter) of the controlled substances which the registrant is authorized to handle, the amount of fee paid (or exemption), and the expiration date of the registration.” 21 CFR 1301.35(c).

*DEA Response 20:* The purpose of the change is to enable online registration for CSOS 2.0. DEA numbers will be validated during account creation. Coordinator applications will require approval by the registrant.

CSOS 2.0 will directly access DEA's registration database and review current DEA Form 223 status electronically, which will eliminate the need for the paper document. Due to this development, advanced security measures have been implemented.

When a registrant enrolls in CSOS 2.0, identity verification services will be provided by *Login.gov* . *Login.gov* will collect a photo of a government issued ID and other personal identifiable information (including, but not limited to, full name, date of birth, mailing address, phone number, and Social Security Number or Individual Taxpayer Identification Number). *Login.gov* will also validate the information submitted by the user with authoritative data sources. Depending on the information entered, the system will also perform one of the following: (1) sending a text message or call with a code to the phone number associated with the user, or (2) receiving a one-time code using face or touch unlock, security key, or third-party authentication applications such as OKTA Verify, and/or Google Authenticator. The user will need to provide this code to *Login.gov* in order to complete *Login.gov* 's identity verification process. If the user was  successfully verified and provides consent, DEA may receive the user's attributes at the time of authentication. If the user was unable to successfully verify their identity, they will retain their account for authentication services.

Identity verification services may also involve in-person supervision and remote supervision of the user during the process, such as when *Login.gov* is unable to collect a photo of their government-issued ID, or other methods of verification such as inheriting credentials from an agency partner. In amending its regulations to transfer all paper applications for CSOS ordering to electronic submissions, the requirement for the application to be notarized and physically mailed to DEA will be removed. Previously, the Principal Coordinator role was responsible for identity-proofing all applications submitted under a respective DEA registration. As proposed, all applicants will be verified and authenticated online, however the Principal Coordinator remains an integral part of the application process. Once a Principal Coordinator is designated by the registrant, the Principal Coordinator will be involved in the issuance of, revocation of, and changes to digital certificates issued under that registrant's DEA registration and can approve subsequent applications submitted for the Power of Attorney role. The Principal Coordinator role will continue to provide security and certificate oversight.

**Call Center Wait Times**

*Issue 21:* One (1) commenter provided the following call center wait time calculations: savings to industry seems to represent a 94% reduction in DEA call center demand. Old process = (90 minutes per new application × 31,372 new applications per year) + (90 minutes per renewal × 62,344 renewals per year) = 8,434,440 minutes. New process = (15 minutes per new application × 31,372 new applications per year) + (0 minutes per renewal × 62,344 renewals per year) = 470,580. With the estimated numbers of new and renewal applications being found in DEA's Executive Order (E.O.) 12866 section. The commenter wanted DEA to confirm whether these calculations were correct.

*DEA Response 21:* The commenter seems to have misunderstood the calculation and DEA also notes that the commenter appears to have mistyped the number of new applications. As detailed in the Executive Order (E.O.) 12866 section below, DEA estimates there will be labor cost savings from reduced time to complete a new application. DEA estimates that the current time to complete a new application is three hours, which includes an estimated 1.5 hours to prepare and provide the necessary information and 1.5 hours calling DEA for assistance or to check the status of the application. Under the proposed final rule, while an applicant is expected to require the same 1.5 hours to prepare and provide the necessary information, the online system will allow self-viewing of status, reducing the need for or duration of calls to DEA. DEA estimates the required time to complete a new application would be 1.75 hours, including an estimated 0.25 hours for logging in to the CSOS system or calls to DEA for assistance. The commenter's calculation would instead be correct as follows: Old process = (180 minutes per new application × 31,172 per year) + (90 minutes per renewal × 62,344 per year) = 11,221,920 minutes. New process = (105 minutes per new application × 31,172 per year) + (15 minutes per renewal × 62,344 per year) = 4,208,220.

**Audits and Testing**

*Issue 22:* One (1) commenter stated that third-party vendors of CSOS software are required to go through audits. This commenter asked DEA whether audits will be required of any third-party software contemplated for use in this modernized registration process.

*DEA Response 22:* DEA does not anticipate the use of any third-party software for the modernized registration process.

*Issue 23:* One (1) commenter inquired as to how the modernized system will be tested and whether there will be industry involvement in testing.

*DEA Response 23:* DEA performs ongoing, continual, and extensive testing to include: regression, performance, security, and user acceptance. DEA is considering opportunities for industry involvement.

**Bulk Enrollment**

*Issue 24:* One (1) commenter asked for clarification as to whether the CSOS 2.0 enrollment processes will continue to accommodate bulk enrollment ( *i.e.,* the enrollment of multiple registrants under a single applicant, as occurs with chain pharmacy organizations).

*DEA Response 24:* DEA's CSOS online portal will continue to accommodate bulk enrollment. CSOS 2.0 will enable subscribers to complete the bulk enrollment process directly online, which will simplify the process.

*Issue 25:* One (1) commenter asked DEA to assign specialists for each pharmacy organization that uses bulk enrollment.

*DEA Response 25:* It is anticipated that these updates to CSOS will mitigate the need for DEA assistance, as the bulk renewal will be done online directly by the subscriber. As such, DEA does not anticipate a need to assign specialists for each pharmacy organization that uses bulk enrollment. In the event that assistance is required, the Diversion Control Contact Center Operators (help desk) will be available 8:30 a.m.-5:50 p.m. EST, Monday through Friday.

**Power of Attorney**

*Issue 26:* One (1) commenter asked for clarification as to whether individuals who have been granted the Power of Attorney authority for DEA registration purposes can serve in the role of the registrant for CSOS purposes and could therefore designate CSOS coordinators.

*DEA Response 26:* Individuals who have been granted Power of Attorney authority for DEA registration purposes can also serve in the role as the registrant coordinator for CSOS purposes, if such role is authorized through an executed Power of Attorney.

An applicant for a DEA number may authorize one or more individuals to sign applications for the applicant by filing a Power of Attorney for each such individual. [^18] A DEA registrant may also execute a Power of Attorney to authorize one or more individuals to issue orders for Schedule I and Schedule II controlled substances on behalf of the registrant. [^19]

[^18] 21 CFR 1301.13(j) (May 11, 2022).

[^19] 21 CFR 1305.05(a) (Oct. 30, 2019).

A DEA registrant may execute a Power of Attorney that designates an individual as the registrant coordinator for said registrant's respective DEA registration number, once this individual enrolls through the CSOS 2.0 portal. The registrant coordinator may designate an individual as the Principal Coordinator over the CSOS certifications. This individual designated as the Principal Coordinator can assign himself or another as the Principal Coordinator for CSOS.

**Discussion of Regulatory Changes**

**Need for Regulatory Changes**

Regulatory changes are needed to conform existing DEA regulations regarding the submission of paper CSOS system enrollment forms to DEA's current requirements that other DEA  forms be submitted online. [^20] The paper enrollment process is prone to errors, creates wasteful and unnecessary paper records, requires manual processing, and leads to hard copy records that are expensive to process and store. This rule amends existing DEA regulations in one part—Title 21 Chapter II Part 1311. DEA is amending 21 CFR 1311 to require all CSOS enrollment applications and supporting materials to be submitted to DEA through the CSOS secure network portal. This amendment improves the submission process by aligning it with DEA's current policy of reducing and/or eliminating the reliance on wasteful paper applications and expediting enrollment by utilizing modern technology. The online submission of applications and supporting materials through the secure database will ensure DEA's receipt of documentation in a more timely and organized manner.

[^20] See *Reporting of Theft or Significant Loss of Controlled Substances,* 88 FR 40707 (June 22, 2023) (published Final Rule to require all DEA Form 106s to be submitted electronically); *Suspicious Orders of Controlled Substances,* 85 FR 212 (Nov. 2, 2020) (published NPRM proposing centralized electronic reporting for suspicious order reports based on Congressional mandate); Agency Rule List—Spring 2021 (2021), *https://www.reginfo.gov/public/do/eAgendaMain?operation=OPERATION_GET_AGENCY_RULE_LIST&currentPub=true&agencyCode=&showStage=active&agencyCd=1100&csrf_token=F19C7C599C70B80C228EC16B60AEB150F6339AF3C80E56FE003EEB7D3A758895BC8E16A215E8A0466326EBFBA8639F799E09* (Spring 2021 Unified Agenda of Regulatory and Deregulatory Actions, Active Regulatory Actions Listed By Agency, Agency Rule list noting proposed rule stage for Electronic Submission of DEA Form 41 (Registrant Record of Controlled Substances Destroyed)—1117-AB59).

**Section-by-Section Analysis**

DEA is amending 21 CFR 1311.20, 1311.25, 1311.40, and 1311.60 by eliminating the ability of registrants to submit paper CSOS enrollment application forms. Registrants will be required to submit all their application materials through the secure online portal. Moreover, DEA is amending these regulations by eliminating certain recordkeeping requirements, as those records will now be accessible as a digital version in the system. DEA believes these amendments will expedite the enrollment process for registrants and facilitate the Agency-wide goal of reducing DEA's reliance on paper forms.

DEA is amending 21 CFR 1311.20, which describes the role and responsibilities of the CSOS Coordinator. Current regulations require the CSOS Coordinator to complete the paper application process by submitting the notarized enrollment package to the DEA Certification Authority for processing. This amendment streamlines the process by eliminating the paper process and requiring Coordinator applicants to enroll using the secure online portal.

Additionally, DEA is amending 21 CFR 1311.25, which establishes the requirements for a registrant, or authorized representative with a Power of Attorney, to complete the manual application process by submitting the notarized enrollment package to the DEA Certification Authority for processing. This amendment streamlines the process by eliminating the manual paper process and requiring all registrants, or authorized representatives with Powers of Attorney, to enroll using the secure online portal.

DEA is also amending 21 CFR 1311.40, which establishes the criteria for renewal of a CSOS digital certificate. This amendment streamlines the renewal process by eliminating the manual paper process and requiring that all renewal applications be submitted using the secure online portal.

Last, DEA is amending 21 CFR 1311.60, which establishes recordkeeping requirements on the part of the CSOS certificate holder by requiring that a copy of the subscriber agreement be maintained for the life of the certificate. This amendment removes the requirement of the CSOS certificate holder to maintain a copy of the subscriber agreement by enabling registrants to sign and access a digital version of the agreement in the online portal.

**Regulatory Analyses**

**Executive Orders 12866, 13563, and 14192 (Regulatory Review)**

DEA has determined that this rulemaking is not a “significant regulatory action” under section 3(f) of Executive Order (E.O.) 12866, Regulatory Planning and Review. Accordingly, this proposed rule has not been submitted to the Office of Management and Budget (OMB) for review. This proposed rule has been drafted and reviewed in accordance with E.O. 12866, “Regulatory Planning and Review,” section 1(b), Principles of Regulation; E.O. 13563, “Improving Regulation and Regulatory Review,” section 1(b), General Principles of Regulation; and E.O. 14192 “Unleashing Prosperity Through Deregulation.”

**Analysis of Benefits, Costs/Cost Savings**

Current regulations require registrants who wish to participate in the CSOS system to enroll using a labor-intensive manual process which relies on paper applications. This final rule amends DEA regulations to require electronic enrollment through a secure web-based system.

The current regulations related to CSOS enrollment are summarized below.

(1) 21 CFR 1311.20(b)-(c) requires Coordinators to enroll in writing.

(2) 21 CFR 1311.25(a)-(b) requires a registrant, or authorized representative with a Power of Attorney, to enroll in writing.

(3) 21 CFR 1311.40(c)-(d) requires submitting a new application in writing for every third renewal and for expired certificates.

(4) 21 CFR 1311.60(c) requires maintaining a copy of the subscription agreement for the life of the certificate.

The final rule would change these requirements to the following.

(1) 21 CFR 1311.20(b)-(c) requiring Coordinators to enroll online.

(2) 21 CFR 1311.25(a) (with (b) removed) requiring all registrants, or authorized representative with a Power of Attorney, to enroll online.

(3) 21 CFR 1311.40(c)-(d) requiring, for every third renewal and expiration, a new application online.

(4) 21 CFR 1311.60(c), removing this provision to allow electronic subscription agreements to be held online and no longer requiring a paper copy be maintained.

Table 1 summarizes the changes from current regulations to the final rule.

| 21 CFR location | Current | Final rule |
| --- | --- | --- |
| 1311.20(b)-(c) | Requires Coordinators to enroll in writing | Will require Coordinators to enroll online. |
| 1311.25(a)-(b) | Requires a registrant, or authorized representative with a Power of Attorney, to enroll in writing | Will require all registrants, or authorized representatives with Powers of Attorney, to enroll online. |
| 1311.40(c)-(d) | Requires submitting a new application in writing, for every third renewal and for expired certificates | Will require, for every third renewal and expiration, a new application online. |
| 1311.60(c) | Requires maintaining a copy of the subscription agreement. | (Removal) will allow subscription agreements to be held online and no longer require a copy be maintained. |

DEA has examined the benefits and costs/cost savings of this final rule and believes it is of net positive economic benefit. DEA believes the cost savings to registrants, as well as DEA, heavily outweigh any cost to DEA associated with implementing and maintaining the necessary computer systems to allow for online enrollment and renewal to CSOS.

**Affected Parties and Number of CSOS Applications**

This final rule will affect registrants who wish to participate in the CSOS system, and DEA. A registrant, designated person, or an authorized representative, who wishes to enroll in the CSOS system can apply for one of three system user roles: Registrant, Coordinator, or Power of Attorney. New and renewal enrollment applications are submitted online. DEA processes the applications in addition to operating and maintaining the systems used in the enrollment and certificate management process. The economic impact of this final rule is a function of changes in requirement for each CSOS enrollment application and the estimated number of applications.

Each year, DEA receives a mix of new and renewal applications for enrollment. In 2021, DEA received 31,172 new applications. These applications include 11,411; 6,974; and 12,787 new applications for Registrant, Coordinator, and Power of Attorney roles, respectively. For every third renewal, the CSOS certificate holder must submit a new application. [^21] Therefore, for the purposes of this analysis, a third renewal is considered as a new application. Based on this renewal requirement, DEA estimates that new applications are approximately one-third of total applications and the number of renewals is approximately twice the number of new applications. Therefore, DEA estimates there were 62,344 renewal applications for a total of 93,516 (31,172 + 62,344) total applications in 2021.

[^21] 21 CFR 1311.40(c).

As pharmacies are the largest registration business activity that participate in CSOS, representing approximately 73 percent of CSOS registered locations, [^22] DEA believes the growth in the number of pharmacies registered with DEA represents a good proxy for the growth of CSOS-participating registrants, and the number of CSOS applications for enrollment.

[^22] Source: DEA.

The number of DEA registered pharmacies has declined from 72,353 in 2015 to 70,628 in 2019 and has roughly stayed constant, with no growth, from 2019 to 2021, with 70,789 and 70,670 pharmacy registrations in 2020 and 2021, respectively. So, DEA believes that zero net growth in CSOS applications is a reasonable estimate. Therefore, DEA estimates the numbers of applications will stay constant at 31,172 new and 62,344 renewal, for a total of 93,516 applications, over the 10-year analysis period.

**Registrant Impact**

**New Applications**

Below is a description of the estimated impact of the final rule on new enrollment applications for Registrant, Coordinator, and Power of Attorney roles.

1. *Time to Complete New Application:* DEA estimates there will be labor cost savings from reduced time to complete a new application. DEA estimates that the current time to complete a new application is three hours, which includes an estimated 1.5 hours to prepare and provided the necessary information and 1.5 hours calling the DEA for assistance or status of application. Under the final rule, while an applicant is expected to require the same 1.5 hours to prepare and provide the necessary information, the online system will allow self-viewing of status, reducing the need or duration of calls to DEA. DEA estimates the required time to complete a new application would be 1.75 hours, including an estimated 0.25 hours for logging to CSOS system or calls to DEA for assistance. Using a loaded hourly rate of $93.02 for Pharmacists, <sup>23</sup><sup>24</sup>[^25] the labor cost would decrease from $282.06 ($94.02 × 3) to $164.54 ($94.02 × 1.75), resulting in an estimated cost savings of $117.52 ($282.06−$164.54) per application.

[^23] U.S. Bureau of Labor Statistics (BLS), Occupational Employment and Wages, May 2024, 29-1051 Pharmacists. *https://data.bls.gov/oes/#/industry/000000.* (Accessed 5/22/2024.).

[^24] BLS, “Employer Costs for Employee Compensation—March 2025” (ECEC).

[^25] As pharmacies represent a large majority of CSOS participants and pharmacists are expected to be the most prevalent CSOS users, DEA believes pharmacists wages therefore represent a good estimate of the wage for all applicants. BLS reports that the median wage of pharmacists is $66.10. BLS also reports that average benefits for private industry is 29.5 percent of total compensation. The 29.5 percent of total compensation equates to 42.24 percent (29.7 percent/70.3 percent) load on wages and salaries. The load of 42.24 percent is added to each of the hourly rates to estimate the loaded hourly rates. $66.1 × 1.4224 = $94.02.

2. Postage Cost: Under current regulations paper application forms and supporting information need to be shipped to DEA. The final rule will eliminate the need to ship paper applications. Not having to ship the enrollment package is estimated to reduce postage costs by $13.27 per application. [^26]

[^26] FedEx Ground rates for a one-pound package using zone five, effective January 6, 2025 and downloaded on 5/22/2025.

3. *Notary Cost:* Under current regulations, a new application for a Registrant or a Coordinator role requires a notary. The final rule will eliminate the notary requirement. Not having to get a notary (due to online verification methods is expected to eliminate an estimated notary cost of $5.00 per enrollment package. [^27] The notary requirement only applies to Registrant and Coordinator roles, and as discussed earlier, of the estimated 31,172 total new applications, 11,411 and 6,974 are for Registrant and Coordinator, respectively, making up 59 percent ((11,411 + 6,974)/31,174) of total registrations. Therefore, 59 percent of $5.00, $2.95 is the average notary cost savings for all new applications.

[^27] National Notary Association, “2025 Notary Fees by State”. *https://www.nationalnotary.org/knowledge-center/about-notaries/notary-fees-by-state* (accessed 5/22/2025). Notary fees can range from $2 to $25. DEA has decided to use $5 as its estimate of notary fees. DEA believes many applicants can get documents notarized at low costs, *i.e.,* at banks, employees with public notary, etc.

4. *Agreement Storage Costs:* Under current regulations, a CSOS certificate holder is required to maintain a copy of the subscriber agreement. The final rule will eliminate this requirement. DEA does not believe there is a material  impact from not having to store written subscription agreements and having them be stored online in CSOS.

Table 2 summarizes the impact of the final rule for new applications.

|  | Current | New | Cost savings |
| --- | --- | --- | --- |
| Labor cost per New app | 282.06 | 164.54 | 117.52 |
| Postage cost per New app | 13.27 |  | 13.27 |
| Cost of notary per New app | 2.95 |  | 2.95 |
| Total new application |  |  | 133.74 |

**Renewal Applications**

Below is a description of the estimated impact of the final rule on renewal enrollment applications for Registrant, Coordinator, and Power of Attorney roles.

1. *Time Spent Requested Renewal:* DEA estimates there will be labor cost savings from reduced time to complete a renewal application. DEA estimates that the time spent requesting a renewal will fall from 1.5 hours using the phone method to 0.25 hours using the online method. Using a loaded hourly rate of $94.02 for Pharmacists, [^28] the labor cost would decrease from $141.03 ($94.02 × 1.5) to $23.51 ($94.02 × 0.25), resulting in an estimated cost savings of $117.52 ($141.03−$23.51) per application.

[^28] Note 17.

Table 3 summarizes the impact of the final rule for renewal applications.

|  | Current | New | Cost savings |
| --- | --- | --- | --- |
| Labor cost per Renewal app | 141.03 | 23.51 | 117.52 |

**Total Registrant Impact**

The total registrant cost savings is $11,495,610 per year, calculated by multiplying the cost of a new and renewal application by the number of new and renewal applications. Table 4 details the calculation.

|  |  |
| --- | --- |
| Number of new applications | 31,172 |
| Number of renewal applications | 62,344 |
| Number of total applications | 93,516 |
| Cost savings per new application ($) | 133.74 |
| Subtotal, all new applications ($) | 4,168,943 |
| Cost savings per renewal application ($) | 117.52 |
| Subtotal, all renewal applications ($) | 7,326,667 |
| Total cost savings to registrants ($) | 11,495,610 |

**Additional Benefits**

There are additional benefits of the final rule. These include:

(1) *Shorter end-to-end process time (submission to certificate):* Allowing earlier use of CSOS for ordering Schedule II controlled substances and realizing the benefits of electronic ordering rather than using paper order forms.

(2) *Insight into status and workflows to track the progress of the submission:* Allowing Coordinators to get status updates online, see how the application progresses, and plan for additional CSOS users.

(3) *No longer needing to wait for the call center to request Certificate management action revocations:* Allowing Coordinators to self-manage and remove user certificates.

(4) *Safer submission process:* Allowing secure delivery of potentially sensitive information.

(5) *Error checking:* Allowing programmatic review for erroneous or incomplete information, reducing delays in application processing.

**DEA Impact**

DEA's costs are driven by the personnel and technology resources required to process the applications. Below is a list of the cost activities and anticipated impact.

1. *Certification Authority Cost:* The Certification Authority serves as the central element responsible for establishing a trust relationship between controlled substance manufacturers, distributors, pharmacies, and other DEA authorized ordering entities. Certification Authority issues user digital certificates used to digitally sign electronic transactions. DEA believes that the personnel resources and costs to certify enrollment and issue digital certificates will not change as a result of  this final rule. Based on current Certification Authority resources, DEA estimates the annual Certification Authority cost will remain at $732,922. [^29]

[^29] Source: DEA.

2. *Registration Authority Cost:* The Registration Authority is the entity that collects and verifies each applicant's identity and information that are to be entered into his or her public key certificates. Receiving electronic applications eliminates the need to scan paper applications. DEA estimates that the personnel resources and costs to process enrollment applications will fall by 30 percent starting with the second year of implementation of the rule. However, in the first year of implementation, DEA anticipates the decrease in resource requirements from elimination of scanning requirement will be offset by increase in applicant questions referred to Registration Authority. DEA estimates the total annual Registration Authority cost of $597,688 [^30] will remain the same in year 1 and will be $418,382 ($597,688 × 0.7) in year 2 and thereafter.

[^30] Source: DEA.

3. *Mail Reception Cost:* Currently, DEA requires personnel to receive, sort, and deliver paper applications to the Registration Authority at an estimated annual cost of $34,562. [^31] Under the final rule, applications would be received online, eliminating this cost.

[^31] Source: DEA.

4. *Data Entry Cost:* Currently, personnel resources are needed to verify the accuracy of the scanned paper applications and make any needed corrections. Under the final rule, online applications eliminate the need for this task. The estimated total current annual cost of $109,138 [^32] will be eliminated when this final rule is implemented.

[^32] Source: DEA.

5. *Call Center Support Cost:* DEA operates a CSOS call center to service questions, or provide assistance, regarding CSOS enrollment and certificate management. The estimated total current annual cost as $1,749,946. [^33] While DEA anticipates a reduction in the number of calls and duration of each call, DEA anticipates this reduction will result in lower wait-times for callers rather than reduced call center resources. Therefore, DEA estimates this cost will remain the same at $1,749,946.

[^33] Source: DEA.

6. *Information Technology Cost:* DEA currently spends approximately $255,000 per year on its Information Technology enrollment-related systems and software. DEA anticipates Information Technology costs will increase to $2,935,200 per year. [^34] Information Technology cost includes, but are not limited to, cloud services, workflow management, identity verification, identity management functionality, professional services for continuous development, integration and deployment, and maintenance and troubleshooting.

[^34] Source: DEA.

All costs are expected to scale with the volume of new applications, except Information Technology cost, which does not vary with the volume of applications. Table 5 summarizes the DEA's impact.

|  | Current | Year 1 | Year 1, | Year 2 * | Year 2, |
| --- | --- | --- | --- | --- | --- |
| Number of applications | 31,172 | 31,172 |  | 31,172 |  |
| Certification Authority | 732,992 | 732,992 |  | 418,382 | −314,610 |
| Registration Authority ** | 597,688 | 418,382 | −179,306 | 418,382 | −179,306 |
| Mail preparation (received mail) | 34,562 |  | −34,562 |  | −34,562 |
| Data Entry | 109,138 |  | −109,138 |  | −109,138 |
| Call Center Support | 1,749,946 | 1,749,946 |  | 1,749,946 |  |
| Information Technology | 255,000 | 2,935,200 | 2,680,200 | 2,935,200 | 2,680,200 |
| Total cost | 3,479,325 | 5,836,519 | 2,357,194 | 5,521,909 | 2,042,584 |

**Additional Benefits**

There are additional benefits to the DEA from the final rule. These include:

(1) That the CSOS System will be supported, secure, reliable, and scalable: Reducing the risk of lost or stolen data and long-term reduction in costs associated with to maintenance, operations, and growth.

(2) The Certificate management process no longer involves a help desk call: Call center resources will be freed up to reduce hold-times for registrants allowing meeting call management service level agreements and improving user satisfaction.

(3) Possible increase in CSOS adoption due to ease of enrollment process: Reducing DEA costs associated with printing and mailing paper order forms.

(4) The ease at which enhancements can be made as needed, for example Enterprise Certificates with multiple DEA numbers: Allowing efficient future improvements to CSOS.

**Registrant and DEA Total Impact**

Using the registrant and DEA impacts from table 5 the estimated net cost savings of this final rule for the 10-year analysis period is listed in Table 8.

| Year | Total cost savings to | Net cost savings to DEA | Total net cost savings, |
| --- | --- | --- | --- |
| 1 | 11,495,610 | (2,536,501) | 8,959,109 |
| 2 | 11,495,610 | (2,357,194) | 9,138,416 |
| 3 | 11,495,610 | (2,357,194) | 9,138,416 |
| 4 | 11,495,610 | (2,357,194) | 9,138,416 |
| 5 | 11,495,610 | (2,357,194) | 9,138,416 |
| 6 | 11,495,610 | (2,357,194) | 9,138,416 |
| 7 | 11,495,610 | (2,357,194) | 9,138,416 |
| 8 | 11,495,610 | (2,357,194) | 9,138,416 |
| 9 | 11,495,610 | (2,357,194) | 9,138,416 |
| 10 | 11,495,610 | (2,357,194) | 9,138,416 |

The present value of the net cost savings over the 10-year analysis period is $77,952,542 and $64,184,410 at three and seven percent discount rates, respectively. The annualized net cost savings is $9,138,416 at three and seven percent.

The final rule is an E.O. 14192 deregulatory action because it is being finalized and has a total cost less than zero. The present value of the estimated net cost savings is $64,184,410 at seven percent discount rate in 2025 dollars.

**Executive Order 12988, Civil Justice Reform**

This final rule meets the applicable standards set forth in sections 3(a) and 3(b)(2) of E.O. 12988, Civil Justice Reform to eliminate ambiguity, minimize litigation, establish clear legal standards, and reduce burdens. DEA expects the instant validation of online registration applications to reduce ambiguity and reduce the number of errors in submissions and reduce burdens on both DEA and registrants.

**Executive Order 13132, Federalism**

This final rule does not have federalism implications warranting the application of E.O. 13132. The final rule does not have substantial direct effects on the States, on the relationship between the National government and the States, or on the distribution of power and responsibilities among the various levels of government.

**Executive Order 13175, Consultation and Coordination With Indian Tribal Governments**

The final rule does not have substantial direct effects on one or more Indian tribes, on the relationship between the Federal government and Indian tribes, or on the distribution of power and responsibilities between the Federal government and Indian tribes.

**Executive Order 14267, Reducing Anti-Competitive Regulatory Barriers**

The proposed rule does not reduce competition, entrepreneurship, and innovation.

**Executive Order 14294, Overcriminalization of Federal Regulations**

Executive Order 14294 specifies that all NPRMs and final rules published in the *Federal Register* , the violation of which may constitute criminal regulatory offenses, should include a statement identifying that the rule or proposed rule is a criminal regulatory offense, the authorizing statute, and the mens rea requirement for each element of the offense. This final rule does not involve a criminal regulatory offense and thus E.O. 14294 does not apply.

**Regulatory Flexibility Act**

In accordance with the Regulatory Flexibility Act (RFA), the DEA has reviewed the economic impact of this final rule on small entities. DEA's economic impact evaluation indicates that the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities.

The RFA requires an agency to analyze options for regulatory relief of small entities unless it can certify that the rule will not have a significant impact on substantial number of small entities. DEA has analyzed the economic impact of each provision of this final rule and estimates that it will have minimal economic impact on affected entities, including small businesses, nonprofit organizations, and small governmental jurisdictions.

This final rule will simplify the enrollment process by requiring all initial registration and renewal applications be submitted online. The rule affects all enrollment and renewals for CSOS, whose users currently use paper applications. However, once a registrant is enrolled the DEA already requires them to order using CSOS. So, there is no additional cost to obtaining access to CSOS, since registrants will already be required to use it eventually.

There is a total of 94,011 CSOS participating entities, as can be seen in Table 7, with approximately 325,000 active certificates. Certificates have to be renewed every one or three years, based on the registrants' DEA registration renewal cycle. In 2021, the number of new applications were 31,172. For every third renewal, the CSOS certificate holder must submit a new application. [^35] Therefore, for the purposes of this analysis, a third renewal is considered as a new application. DEA estimate that the total applications, including renewals, is 93,516.

[^35] 21 CFR 1311.40(c).

| Business activity | Number of | Percent | Renewal cycle |
| --- | --- | --- | --- |
| Pharmacy | 62,291 | 66.26 | 3 |
| Hospital/Clinic | 11,898 | 12.66 | 3 |
| Practitioner/Mid-Level Practitioner (MLP) | 18,095 | 19.25 | 3 |
| Teaching Institution | 14 | 0.01 | 3 |
| Manufacturer | 103 | 0.11 | 1 |
| Distributor/Importer/Exporter | 444 | 0.47 | 1 |
| Researcher | 247 | 0.26 | 1 |
| Analytical Lab | 26 | 0.03 | 1 |
| Reverse Distributor | 5 | 0.01 | 1 |
| Narcotic Treatment Program (NTP) | 888 | 0.94 | 1 |
| Total | 94,011 | 100.00 | * 2.97 |

This final rule affects all new and renewal enrollment applications for CSOS, as applications will have to take place online, and all entities who would submit new and renewal applications. This final rule affects small entities in industries associated with the above business activities, primarily industries associated with pharmacy, hospital/clinic, and practitioner/MLP registrations, as these business activities make up 98.17 percent of the CSOS-participating registrations. Table 8 indicates the sectors, as defined by the North American Industry Classification System (NAICS), that best correlate with business activities affected by the final rule.

| Business activity | NAICS code | NAICS code description |
| --- | --- | --- |
| Pharmacy | 445110 | Supermarkets and Other Grocery (except Convenience) Stores. |
|  | 446110 | Pharmacies and Drug Stores. |
|  | 452210 | Department Stores. |
|  | 452311 | Warehouse Clubs and Supercenters. |
| NTP, Hospital/Clinic, Practitioner, MLP * | 621111 | Offices of Physicians (except Mental Health Specialists). |
|  | 621112 | Offices of Physicians, Mental Health Specialists. |
|  | 621330 | Offices of Mental Health Practitioners (except Physicians). |
|  | 621420 | Outpatient Mental Health and Substance Abuse Centers. |
|  | 621491 | HMO Medical Centers. |
|  | 621493 | Freestanding Ambulatory Surgical and Emergency Centers. |
|  | 622110 | General Medical and Surgical Hospitals. |
|  | 622210 | Psychiatric and Substance Abuse Hospitals. |
|  | 622310 | Specialty (except Psychiatric and Substance Abuse) Hospitals. |
| Teaching Institute | 611310 | Colleges, Universities and Professional Schools. |
| Manufacturer | 325411 | Medicinal and Botanical Manufacturing. |
|  | 325412 | Pharmaceutical Preparation Manufacturing. |
| Distributor, Importer, Exporter | 424210 | Drugs and Druggists' Sundries Merchant Wholesalers. |
| Researcher | 541715 | Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology). |
| Analytical Labs | 541380 | Testing Laboratories. |
| Reverse Distributor | 562213 | Solid Waste Combustors and Incinerators. |
|  | 562219 | Other Nonhazardous Waste Treatment and Disposal. |

As shown in Table 8, the final rule affects a wide variety of entities across many industry sectors. Some industry sectors are expected to consist primarily of DEA CSOS registrants ( *i.e.,* 446110—Pharmacies and Drug Stores, 622110—General Medical and Surgical Hospitals, etc.). Therefore, this final rule is expected to affect a substantial number of small entities in some industries.

There are no new costs associated with this final rule. The labor burden to submit an application is estimated to be the same for electronic and paper submissions. All CSOS registered location will already need to have access to the internet in order to use CSOS. DEA acknowledges some applicants prefer paper forms. DEA does not have a basis to quantify this preference; however, DEA believes any costs associated with eliminating this preference is offset by the cost savings discussion below.

DEA anticipates there will be cost savings associated with electronic submissions. Some cost savings are described qualitatively and some are quantified. Many paper applications submitted contain illegible or erroneous information or omit required information. Many such errors or omissions, such as not including a signature or paying the wrong amount, require DEA to contact applicants to correct or clarify the information in the paper form, consuming DEA's and the applicant's time and resources. Electronic submissions are expected to virtually eliminate the requirement for DEA to contact applicants for clarifications of form data or correction of submission errors, as validation features in the system will flag common errors prior to transmission. As DEA has not tracked the number of delays or the duration of such delays, DEA does not have a basis to quantify the cost savings.

Furthermore, this final rule eliminates the need to print paper forms and transmit by mail or courier service, generating an estimated cost savings of $13.27 per each paper application not submitted. [^36] DEA assumes the cost savings associated with eliminating  printing costs and envelopes is negligible. This final rule also eliminates the need to get a notary for new applications, which will save $5.00 each for applications for registrant and coordinator roles. [^37] An application for the Power of Attorney role does not require a notary; and while there would be no notary cost savings for these applications, $5 cost savings is included in the analysis to be conservative and because applications for registrant and coordinator roles are slightly more than half of all applications.

[^36] Note 18.

[^37] Note 20.

As discussed in the E.O. 12866 section above, DEA estimates that the time savings from this final rule will save $117.52 per new and renewal application.

Total cost savings for a new application is $135.797 (117.52 + 13.27 + 5.00 = 135.79), as can be seen in Table 9.

|  | Current | New | Cost savings |
| --- | --- | --- | --- |
| Labor cost per New app | 282.06 | 164.54 | 117.52 |
| Postage cost per app | 13.27 |  | 13.27 |
| Cost of notary | 5.00 |  | 5.00 |
| Total |  |  | 135.79 |

As also calculated in the E.O. 12866 section above, total cost savings for renewals is $117.52, as can be seen in Table 10.

|  | Current | New | Cost savings |
| --- | --- | --- | --- |
| Labor cost per Renewal app | 141.03 | 23.51 | 117.52 |
| Total |  |  | 117.52 |

There were 31,172 new applications in 2021. DEA estimates there were also 62,344 renewal applications for a total of 93,516 applications. Given there are 94,011 CSOS participating entities, there is less than one application per year per entity on average (93,516/94,011 = 0.99). Given that there are at approximately 325,000 active digital certificates, the vast majority of which are on three-year renewal cycles, DEA expects approximately 108,333 certificates to be renewed annually (325,000/3 = 108,333). There are then approximately 1.15 certificates per entity (108,333/94,011 = 1.15). Given that smaller firms should have less certificates than larger firms, DEA believes using one certificate or one application per entity per year is a reasonable assumption for the smallest of small entities.

To determine whether the final rule would have a significant economic impact on small entities, DEA conducted a revenue test by comparing the estimated annual cost savings to the average annual revenue for the smallest of small entities in industries affected by the final rule. Based on the Statistics of U.S. Businesses data from the Census Bureau, table 11 lists the enterprise size, number of establishments, and the average annual revenue for the smallest of small businesses in each industry sector. <sub>38 39</sub>

[^38] Census Bureau, Statistics of U.S. Businesses Revenue Data by Size, 2017. *https://www.census.gov/programs-surveys/susb.html.* (Released 5/28/2021).

[^39] Census Bureau, Statistics of U.S. Businesses Number of Establishment Data by Size, 2021. *https://www.census.gov/programs-surveys/susb.html.* (Released 12/21/2022).

| NAICS | NAICS description | Enterprise size | Number of | Average |
| --- | --- | --- | --- | --- |
| 325411 | Medicinal and Botanical Manufacturing | 0-4 | 303 | 690 |
| 325412 | Pharmaceutical Preparation Manufacturing | 0-4 | 398 | 1,173 |
| 424210 | Drugs and Druggists' Sundries Merchant Wholesalers | 0-4 | 4,131 | 1,512 |
| 445110 | Supermarkets and Other Grocery (except Convenience) Stores | 0-4 | 20,420 | 519 |
| 446110 | Pharmacies and Drug Stores | 0-4 | 7,118 | 1,328 |
| 452210 | Department Stores | 0-4 | 3 | 467 |
| 452311 | Warehouse Clubs and Supercenters | 0-4 | 25 | 475 |
| 541380 | Testing Laboratories | 0-4 | 2,446 | 316 |
| 541715 | Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology) | 0-4 | 5,243 | 449 |
| 562213 | Solid Waste Combustors and Incinerators | 0-4 | 17 | 949 |
| 562219 | Other Nonhazardous Waste Treatment and Disposal | 0-4 | 299 | 580 |
| 611310 | Colleges, Universities, and Professional Schools | 0-4 | 526 | 802 |
| 621111 | Offices of Physicians (except Mental Health Specialists) | 0-4 | 80,722 | 465 |
| 621112 | Offices of Physicians, Mental Health Specialists | 0-4 | 9,836 | 291 |
| 621330 | Offices of Mental Health Practitioners (except Physicians) | 0-4 | 28,428 | 165 |
| 621420 | Outpatient Mental Health and Substance Abuse Centers | 0-4 | 4,015 | 248 |
| 621491 | HMO Medical Centers | 0-4 | 79 | 98 |
| 621493 | Freestanding Ambulatory Surgical and Emergency Centers | 0-4 | 2,001 | 666 |
| 622110 | General Medical and Surgical Hospitals | 0-4 | 215 | 15,559 |
| 622210 | Psychiatric and Substance Abuse Hospitals | 0-4 | 9 | 1,024 |
| 622310 | Specialty (except Psychiatric and Substance Abuse) Hospitals | 0-4 | 13 | 1,965 |

The estimated cost savings of $135.79 for new applications and $117.52 for renewal applications were compared to the average annual revenue for each of the NAICS codes in Table 11. For example, taking the smallest possible entities, HMO Medical Centers with 0-4 people, with an average revenue of $98,000, the benefit, in the form of cost savings, from new applications is $133.97 (116.27 + 12.70 + 5 = 133.97), or 0.14 percent of revenues (133.69/98,000 = 0.0014). The benefit from renewals is 0.12 percent of revenues (116.27/98,000 = 0.0012). Table 12 details the revenue test results for all affected NAICS codes.

| NAICS | NAICS description | Average | Benefit | Percent of | Benefit from | Percent of |
| --- | --- | --- | --- | --- | --- | --- |
| 325411 | Medicinal and Botanical Manufacturing | 690 | 133.97 | 0.02 | 116.27 | 0.02 |
| 325412 | Pharmaceutical Preparation Manufacturing | 1,173 | 133.97 | 0.01 | 116.27 | 0.01 |
| 424210 | Drugs and Druggists' Sundries Merchant Wholesalers | 1,512 | 133.97 | 0.01 | 116.27 | 0.01 |
| 445110 | Supermarkets and Other Grocery (except Convenience) Stores | 519 | 133.97 | 0.02 | 116.27 | 0.02 |
| 446110 | Pharmacies and Drug Stores | 1,328 | 133.97 | 0.01 | 116.27 | 0.01 |
| 452210 | Department Stores | 467 | 133.97 | 0.03 | 116.27 | 0.02 |
| 452311 | Warehouse Clubs and Supercenters | 475 | 133.97 | 0.03 | 116.27 | 0.02 |
| 541380 | Testing Laboratories | 316 | 133.97 | 0.04 | 116.27 | 0.03 |
| 541715 | Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology) | 449 | 133.97 | 0.03 | 116.27 | 0.02 |
| 562213 | Solid Waste Combustors and Incinerators | 949 | 133.97 | 0.01 | 116.27 | 0.01 |
| 562219 | Other Nonhazardous Waste Treatment and Disposal | 580 | 133.97 | 0.02 | 116.27 | 0.02 |
| 611310 | Colleges, Universities, and Professional Schools | 802 | 133.97 | 0.02 | 116.27 | 0.01 |
| 621111 | Offices of Physicians (except Mental Health Specialists) | 465 | 133.97 | 0.03 | 116.27 | 0.02 |
| 621112 | Offices of Physicians, Mental Health Specialists | 291 | 133.97 | 0.04 | 116.27 | 0.04 |
| 621330 | Offices of Mental Health Practitioners (except Physicians) | 165 | 133.97 | 0.08 | 116.27 | 0.07 |
| 621420 | Outpatient Mental Health and Substance Abuse Centers | 248 | 133.97 | 0.05 | 116.27 | 0.04 |
| 621491 | HMO Medical Centers | 98 | 133.97 | 0.13 | 116.27 | 0.11 |
| 621493 | Freestanding Ambulatory Surgical and Emergency Centers | 666 | 133.97 | 0.02 | 116.27 | 0.02 |
| 622110 | General Medical and Surgical Hospitals | 15,559 | 133.97 | 0.00 | 116.27 | 0.00 |
| 622210 | Psychiatric and Substance Abuse Hospitals | 1,024 | 133.97 | 0.01 | 116.27 | 0.01 |
| 622310 | Specialty (except Psychiatric and Substance Abuse) Hospitals | 1,965 | 133.97 | 0.01 | 116.27 | 0.01 |

As shown in Table 12, the revenue test for the smallest of small entities (0-4 employees) ranges from 0.00 percent with rounding for NAICS code 622110 to 0.13 percent for NAICS code 621491. Therefore, the economic impact of this final rule is not significant for the smallest of small entities, and the economic impact is estimated to be not significant on any small entity.

In conclusion, while the final rule impacts a substantial number of small entities in at least some industries, the economic impact will not be significant. Therefore, this final rule will not have a significant economic impact on a substantial number of small entities.

**Unfunded Mandates Reform Act of 1995**

In accordance with the Unfunded Mandates Reform Act of 1995 (UMRA), [^40] DEA has determined that this action would not result in any Federal mandate that may result “in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any 1 year.” Therefore, neither a Small  Government Agency Plan nor any other action is required under the UMRA.

[^40] 2 U.S.C. 1501 *et seq.*

**Paperwork Reduction Act**

This final rule will modify existing collection(s) of information requirement under the Paperwork Reduction Act (PRA). [^41] The final rule will combine all information collection into one on-line enrollment process eliminating the need for individual forms. Pursuant to the PRA, [^42] DEA has identified the collections of information below related to this final rule. A person is not required to respond to a collection of information unless it displays a valid OMB control number. [^43]

[^41] 44 U.S.C. 3501-3521.

[^42] 44 U.S.C. 3507(d).

[^43] Copies of existing information collections approved by OMB may be obtained at *http://www.reginfo.gov/public/do/PRAMain.*

**A. Collections of Information Associated With the Final Rule**

*1. Title:* CSOS Certificate Application.

*OMB Control Number:* 1117-0038.

*Form Number:* DEA-251.

DEA is amending its regulations to require that all CSOS applications and supporting materials must be submitted to DEA through the DEA Diversion Control Division secure network application. This amendment will improve the submission process by aligning it with DEA's current requirements for other online form submissions. The online submission of applications and supporting material through the secure database will ensure DEA's receipt of documentation in a more timely and organized manner. This combined online form will be used for all CSOS user roles: DEA Registrant, Principal Coordinator/Alternate Coordinator, and Power of Attorney.

DEA estimates the following number of respondents and burden associated with this collection of information:

• *Number of respondents:* 94,011.

• *Frequency of response:* 0.994735 (as needed, calculated). [^44]

[^44] Calculated by dividing the number of responses (93,516) by the number of respondents (94,011).

• *Number of responses:* 93,516.

• *Burden per response:* 0.75. [^45]

[^45] Weighted average of new and renewal applications. There are 31,172 new applications and they take 1.75 hours. There are 62,344 renewals and they take 0.25 hours. New applications represent 33 percent of applications (31,172/93,516 = 0.33) and renewals represent 67 percent of applications (62,344/93,516 = 0.67). The weighted average is then 0.75 ([0.33 × 1.75] + [0.67 * 0.25] = 0.75).

• *Total annual hour burden:* 70,137.

If you need additional information, please contact the Regulatory Drafting and Policy Support Section (DPW), Diversion Control Division, Drug Enforcement Administration; Mailing Address: 8701 Morrissette Drive, Springfield, Virginia 22152; Telephone: (571) 362-3261.

Any comments on this collection of information may be sent in writing to the Office of Information and Regulatory Affairs, OMB, Attention: Desk Officer for DOJ, Washington, DC 20503. Please state that your comments refer to RIN 1117-AB79/Docket No. DEA-732.

**Congressional Review Act**

This final rule is not a major rule as defined by section 804 of the Congressional Review Act (hereinafter, “CRA”). This rule will not result in an annual effect on the economy of $100,000,000 or more; a major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies, or geographic regions; or significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of the United States-based enterprises to compete with foreign-based enterprises in domestic and export markets. 5 U.S.C. 804. Pursuant to the CRA, the DEA has submitted a copy of the Final Rule to both Houses of Congress and to the Comptroller General.

**List of Subjects in 21 CFR Part 1311**

Administrative practice and procedure, Control substances, Drug traffic control, Prescription drugs, Reporting and recordkeeping requirements.

For the reasons stated in the preamble, DEA amends 21 CFR part 1311 as follows:

**PART 1311—REQUIREMENTS FOR ELECTRONIC ORDERS AND PRESCRIPTIONS**

**21 CFR Part 1311**

1. The authority citation for part 1311 continues to read as follows:

**Authority:**

21 U.S.C. 821, 828, 829, 871(b), 958(e), 965, unless otherwise noted.

**21 CFR Part 1311**

2. Amend § 1311.20 by revising paragraphs (b) and (c) to read as follows:

§ 1311.20

(b) If the designated coordinator changes at any time, the Certification Authority must immediately be notified of the change and the new responsibilities assumed by each of the registrant's coordinators, if applicable. New Coordinators must complete the online application as provided in § 1311.25.

(c) The registrant's coordinator must inform the Certification Authority of all digital certificate applications, renewals and revocations for the registrant's users and approve applicants applying for a power of attorney digital certificate for a DEA registrant by means instructed by the Certification Authority within the system.

**21 CFR Part 1311**

3. Revise § 1311.25 to read as follows:

§ 1311.25

(a) To obtain a certificate to use for signing electronic orders for controlled substances, a registrant, coordinator, or person with power of attorney authorized to obtain a certificate for signing electronic orders for controlled substances for a registrant must complete the online enrollment process at *www.deaecom.gov* by:

(1) Completing the online identification proofing process;

(2) Providing a current listing of DEA registrations for which the individual has authority to sign controlled substances orders.

(3) Uploading all copies of the power of attorney forms authorized by the registrant, when applicable.

(4) Acknowledging that the applicant has read and understands the Subscriber Agreement and agrees to all terms contained in the Statement of Subscriber Obligations contained online.

(b) When the Certification Authority verifies the applicant's identity and employment and approves the application, it will send the applicant a one-time use reference number and access code, via separate channels, and information on how to use them. Using this information, the applicant must then electronically submit a request for certification of the public digital signature key. After the request is approved, the Certification Authority will provide the applicant with the signed public key certificate.

(c) Once the applicant has generated the key pair, the Certification Authority must prove that the user has possession of the key. For public keys, the corresponding private key must be used to sign the certificate request. Verification of the signature using the public key in the request will serve as proof of possession of the private key.

**21 CFR Part 1311**

4. Amend § 1311.40 by revising paragraphs (c) and (d) to read as follows:

§ 1311.40

(c) If a CSOS certificate holder applies for a renewal before the certificate expires, the certificate holder may renew online at *www.deaecom.gov* twice. For every third renewal, the  CSOS certificate holder must submit a new application and documentation, as provided in § 1311.25.

(d) If a CSOS certificate expires before the holder applies for a renewal, the certificate holder must submit a new application and all required documentation, as provided in § 1311.25.

§ 1311.60

**21 CFR Part 1311**

5. Amend § 1311.60 by removing paragraph (c).

**Signing Authority**

This document of the Drug Enforcement Administration was signed on September 30, 2025, by Administrator Terrance Cole. That document with the original signature and date is maintained by DEA. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DEA Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of DEA. This administrative process in no way alters the legal effect of this document upon publication in the *Federal Register* .

Heather Achbach,

Federal Register Liaison Officer, Drug Enforcement Administration.