Authorized Trading Partner checks are a foundational DSCSA requirement

Two notable events happened in the US Drug Supply Chain Security Act (DSCSA) world in mid-December 2025.

1. The Texas med spa Pure Indulgence Aesthetics was issued a Form FDA 483 citing DSCSA violations. This was probably the first DSCSA-focused 483 issued to a dispenser according to Abha Kundi’s article.

2. The Louisiana Board of Drug and Device Distributors ran Trace Readiness Week (TR-WEEK) 2 geared up for DSCSA’s EDDS (see below) requirements.

Dispenser receives an FDA Form 483

FDA inspectors use Form FDA 483 to list specific objectionable conditions observed in order of risk significance alongside the citations of applicable regulations.

In the context of DSCSA, the wide-spread assumption has been for a good while that dispensers are less on FDA’s radar because they are at the end of the supply chain and, thus, to a certain degree, dependent on the trickling down of the compliance measures of their upstream trading partners. This has been the tenor especially with regard to the Enhanced Drug Distribution Security (EDDS) Requirements Under Section 582(g)(1).

Here’s the catch, though.

DSCSA is about more than just EDDS. A number of requirements have already been enforceable for years! Thus, even small dispensers, who currently benefit from the only remaining FDA exemption period, are not entirely off the hook.

So, where did the med spa go wrong? - Botox.

1. Failure to conduct business only with authorized trading partners (ATPs).

2. Failure to engage in transactions involving only product with a product identifier.

It appears that there were blatant gaps in their data and documentation trails so that due process was non-existent or, at least, not provable to the inspector.

It is interesting that FDA went after a med spa. Usually, we have pharmacies or hospital clinics in mind when speaking about dispensers. This 483 confirms that a wide range of dispensers are in scope of DSCSA - and ignorance is not bliss. Together with previous inspection reports, FDA has demonstrated that they are ready to scrutinize anyone, from small to large entities across the pharma supply chain.

Impact beyond DSCSA compliance

Based on the 483 report, it appears that some patients will have walked out of that clinic with Botox in their body that came from questionable sources, and there may be no way of tracing that back to the sources.

Credit: Tung Lam, Pixabay

Product tracing with ATP credentials

You may have heard of ATP credentials being baked into the Verification Router Service (VRS) network (aka product verification systems). Well, the same possibility exists within electronic product tracing systems.

Interoperable Tracing is the DSCSA 2023 requirement that trading partners maintain secure, electronic, interoperable systems and processes to provide TI and TS in response to a valid request and promptly facilitate gathering the information necessary to produce the TI for each transaction going back to the manufacturer. Source: Partnership for DSCSA Governance (PDG)

Product tracing model. Credit: PDG

Even though the product data-related workflows differ between VRS and tracing verifications, ATP credentials work just the same by providing instant ATP checks in line with DSCSA. While other ways of checking a trading partner’s authorization are permissible, these verifiable credential-facilitaetd checks automate and speed up the process supporting consistent compliance with DSCSA, including its EDDS section.

Last December, the Louisiana Board of Drug and Device Distributors organized a real-world exercise to undertake a series of electronic trace requests involving 1 pharmacy and 4 manufacturers. The Board is no stranger to EDDS-related exercises with industry stakeholders. In their ongoing hands-on efforts to learn and educate, they have previously run public exercises, such as VR Day 2 last May.

TR WEEK 2 results

Overall, the exercise went swimmingly with insights gained at all fronts. I strongly recommend reading the Board’s report.

12 trace requests were sent in total, revealing 8 distinct transactions. Credit: Louisiana Board of Drug and Device Distributors, TR WEEK 2 report.

The PDG-compliant tracing activity enabled the Board to efficiently and accurately establish product lineage across multiple segments of the drug supply chain. The exercise demonstrated the practical effectiveness of DSCSA-aligned interoperability standards in supporting regulatory oversight and identifying potential violations of state and federal law. Source: TR WEEK 2 report

The results contain a minor observation that was not material to the tracing exercise itself but can be significant in business and operational contexts.

“In one instance, two respondents disagreed on the entity level GLN to be used to identify one of the parties involved in the transaction.”

It is remarkable that even as small a sample as used in this exercise picked up on frictions with GLN allocation. Personally, I doubt this was a freak event. It confirms that there is still confusion in the industry as to which GLN is allocated to whom and who makes that decision. There are wider ramifications for this. For example, we have previously given 5 Reasons Why DSCSA ATP Digital Credentials Beat GLN Allow Lists.

Disclaimer

Since this post touches on legal and regulatory requirements, I’d like to make clear that I’m not qualified to provide legal advice. Nothing stated here should be taken as such.