Home/Federal/Federal Register/2025-19325

Rule2025-19325

Controlled Substances Ordering System (CSOS) Modernization

Primary source

Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.

Published

October 2, 2025

Effective

November 3, 2025

Issuing agencies

Justice DepartmentDrug Enforcement Administration

Abstract

This rule is amending the Drug Enforcement Administration's (DEA) regulations to conform to the Controlled Substances Ordering System (CSOS) modernization effort by requiring all CSOS enrollment applications and supporting materials to be submitted through the Diversion Control Division secure online portal. These amendments improve the enrollment process by aligning it with DEA's current requirements for other online form submissions. The online submission of enrollment applications and supporting material through the secure online portal increases the efficiency of the enrollment, modification, and revocation processes, and ensures DEA's receipt of accurate documentation in a more timely and organized manner.

Full Text

<html>
<head>
<title>Federal Register, Volume 90 Issue 189 (Thursday, October 2, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 189 (Thursday, October 2, 2025)]
[Rules and Regulations]
[Pages 47566-47581]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-19325]

-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

21 CFR Part 1311

[Docket No. DEA-732]
RIN 1117-AB79

Controlled Substances Ordering System (CSOS) Modernization

AGENCY: Drug Enforcement Administration, Department of Justice.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This rule is amending the Drug Enforcement Administration's
(DEA) regulations to conform to the Controlled Substances Ordering
System (CSOS) modernization effort by requiring all CSOS enrollment
applications and supporting materials to

[[Page 47567]]

be submitted through the Diversion Control Division secure online
portal. These amendments improve the enrollment process by aligning it
with DEA's current requirements for other online form submissions. The
online submission of enrollment applications and supporting material
through the secure online portal increases the efficiency of the
enrollment, modification, and revocation processes, and ensures DEA's
receipt of accurate documentation in a more timely and organized
manner.

DATES: This Final Rule is effective November 3, 2025.

FOR FURTHER INFORMATION CONTACT: Heather E. Achbach, Regulatory
Drafting and Policy Support Section, Diversion Control Division, Drug
Enforcement Administration; Telephone: (571) 776-2265.

SUPPLEMENTARY INFORMATION

Legal Authority

The Controlled Substances Act (CSA) grants the Attorney General
authority to promulgate rules and regulations relating to: the
registration and control of the manufacture, distribution, and
dispensing of controlled substances and listed chemicals; reporting
changes to professional or business addresses; and the efficient
execution of his statutory functions.\1\ The Attorney General is
further authorized by the CSA to promulgate rules and regulations
relating to the registration and control of importers and exporters of
controlled substances and listed chemicals.\2\ The Attorney General has
delegated this authority to the Administrator of DEA.\3\
---------------------------------------------------------------------------

\1\ 21 U.S.C. 821, 822(a), 823, 827 (h), 871(b).
\2\ 21 U.S.C. 957(a), 958(f).
\3\ 28 CFR 0.100(b).
---------------------------------------------------------------------------

The CSA defines ``distribute'' as ``to deliver (other than by
administering or dispensing) a controlled substance or a listed
chemical'' and ``distributor'' as ``a person who so delivers a
controlled substance or a listed chemical.'' \4\ The CSA further
provides that it ``shall be unlawful for any person to distribute a
controlled substance in schedule I or II to another except in pursuance
of a written order of the person to whom such substance is distributed,
made on a form to be issued by the Attorney General in blank in
accordance with subsection (d) [of 21 U.S.C. 828] and regulations
prescribed by him pursuant to [21 U.S.C. 828].'' \5\ ``Every person who
gives an order required under subsection (a) [of 21 U.S.C. 828] shall,
at or before the time of giving such order, make or cause to be made a
duplicate thereof on a form to be issued by the Attorney General in
blank in accordance with subsection (d) [of 21 U.S.C. 828] and
regulations prescribed by him pursuant to [21 U.S.C. 828], and shall,
if such order is accepted, preserve such duplicate for a period of two
years and make it available for inspection and copying. . . . '' \6\
``The Attorney General shall issue forms . . . only to persons validly
registered under [21 U.S.C. 823] (or exempted from registration under
[21 U.S.C. 822(d)). Whenever any such form is issued to a person, the
Attorney General shall, before delivery thereof, insert therein the
name of such person, and it shall be unlawful for any other person (A)
to use such form for the purpose of obtaining controlled substances or
(B) to furnish such form to any person with intent thereby to procure
the distribution of such substances.'' \7\
---------------------------------------------------------------------------

\4\ 21 U.S.C. 802(11).
\5\ 21 U.S.C. 828(a).
\6\ 21 U.S.C. 828(c)(2).
\7\ 21 U.S.C. 828(d)(1).
---------------------------------------------------------------------------

Implementation of the CSA Written Order Form Requirement

Paper DEA Form 222

In 1971 DEA implemented the CSA's written order form requirement by
publishing a final rule requiring triplicate paper DEA Form 222s.\8\ In
2019, DEA amended its regulations to create a new single-sheet format
for the paper DEA Form 222s.\9\ The rule contained transition
provisions allowing registrants to continue to use their existing
stocks of the triplicate paper DEA Form 222s until October 30,
2021.\10\
---------------------------------------------------------------------------

\8\ Regulations Implementing the Comprehensive Drug Abuse
Prevention and Control Act of 1970, 36 FR 7776, 7797 (Apr. 24,
1971).
\9\ New Single-Sheet Format for U.S. Official Order Form for
Schedule I and II Controlled Substances (DEA Form 222), 84 FR 5395
(Feb. 21, 2019); New Single-Sheet Format for U.S. Official Order
Form for Schedule I and II Controlled Substances (DEA Form 222), 84
FR 51368 (Sept. 30, 2019).
\10\ 21 CFR 1305.20.
---------------------------------------------------------------------------

Electronic DEA Form 222

In 2005, DEA published a final rule amending its regulations to
provide an electronic equivalent to the DEA Form 222 (also known as
CSOS).\11\ The amendments allowed registrants to order schedule I and
II controlled substances electronically and maintain records of these
orders electronically. The intent of these amendments was to reduce
paperwork and transaction times for DEA registrants who sell or buy
controlled substances.
---------------------------------------------------------------------------

\11\ Electronic Orders for Controlled Substances, 68 FR 38557
(June 27, 2003), and Electronic Orders for Controlled Substances, 70
FR 16901, (Apr. 1, 2005).
---------------------------------------------------------------------------

Summary of Current CSOS Regulations

The current CSOS regulations are found in 21 CFR parts 1305 and
1311. DEA Registrants use CSOS as a secure system to track schedule I
and II controlled substance orders. The system allows for secure
electronic controlled substance orders without the need for a paper
order form (DEA Form 222). Using Public Key Infrastructure (PKI), CSOS
requires that each individual supplier and purchaser enroll with DEA to
acquire a CSOS digital certificate. System enhancements allow
electronic documentation submission, self-service support options, and
electronic processing of single and bulk applications, renewals, and
revocations. Users are able to electronically search for, revoke,
report, retrieve, and renew secure digital certificates.

Purpose of Rule

Current regulations require registrants who wish to participate in
the CSOS system to enroll using a labor-intensive manual process which
relies on paper applications. The paper application must be notarized
and the package mailed to DEA, creating delays in the enrollment
process and putting applications at risk of being lost.\12\ The purpose
of this rule is to simplify the application process by requiring all
CSOS enrollment applications to be submitted online.\13\ All applicants
for enrollment will follow the CSOS link on the <a href="http://deadiversion.gov">deadiversion.gov</a>
website to the CSOS log-in page. From the CSOS log-in page the
applicant will be redirected to <a href="http://Login.gov">Login.gov</a> for Identification
Verification. Upon arrival at the site, the applicant will be asked to
create a <a href="http://Login.gov">Login.gov</a> account by entering a valid email address, selecting
a default language, and agreeing to <a href="http://Login.gov">Login.gov</a>'s Rules of Behavior. A
confirmation email will then be sent to the applicant's selected email.
Once the email has been confirmed, the applicant must create a
<a href="http://Login.gov">Login.gov</a> password by providing a telephone number to which a
verification code can be sent. Once the code is sent and the applicant
enters the given code on the <a href="http://Login.gov">Login.gov</a> website, the applicant must
agree to the site's security statement. <a href="http://Login.gov">Login.gov</a> next requires
applicants to upload photographs of one or more forms of identification
as specified by <a href="http://Login.gov">Login.gov</a> and to enter a Social Security Number, after
which the applicant is asked to verify the given information. The
applicant is next asked to re-enter their <a href="http://Login.gov">Login.gov</a> password to receive
a

[[Page 47568]]

Personal Key by separate message. The applicant is then asked to enter
that Personal Key and review their information. Upon review of the
information, the applicant is then directed back to the CSOS website
for further processing. Upon return to the CSOS website, the applicant
is asked to agree to the CSOS User Agreement and can apply for one of
three system user roles (Registrant, Coordinator, or Power of Attorney
in descending order of superiority) with enrollment requests approved
or rejected by the superior role. After the Registrant role is
established, all subordinate applications for enrollment must be
approved by the Registrant. Upon establishment of a Coordinator, all
subordinate applications for enrollment for the Power of Attorney role
must be approved in the system by the responsible Coordinator.
---------------------------------------------------------------------------

\12\ 21 CFR part 1311 et seq.
\13\ CSOS 2.0 was successfully deployed for public use on
December 9, 2024.
---------------------------------------------------------------------------

This final rule amends DEA regulations to require electronic
enrollment through a secure web-based system. Submission through the
secure online system will be a streamlined process which will benefit
both DEA and CSOS participants.

Summary of the Notice of Proposed Rulemaking

On February 2, 2023, the Drug Enforcement Administration (DEA)
published a Notice of Proposed Rulemaking (hereinafter ``NPRM'')
proposing to amend DEA's regulations to conform to the CSOS
modernization effort by requiring CSOS enrollment applications and
supporting materials to be submitted through the Diversion Control
secure online portal.\14\ In this rulemaking, DEA is finalizing the
regulatory text proposed in the NPRM and addressing concerns brought
forth by commenters.
---------------------------------------------------------------------------

\14\ 88 FR 7033.
---------------------------------------------------------------------------

Discussion of Public Comments

DEA received eight (8) comments in response to the NPRM.\15\ The
commenters included: the general public, third-party interest groups,
and an online identity network company. The commenters were mostly
supportive of the proposed rule. Six (6) commenters supported the new
system and viewed the proposed rule's modernization effort of CSOS as
positive. However, one (1) commenter disagreed with the use of
<a href="http://Login.gov">Login.gov</a> and wanted DEA to align the credential service provider
requirement to current practices within the healthcare industry that
coordinates with National Institute of Standards and Technology
(hereinafter, ``NIST'') IAL2/AAL2 standards. Most of the commenters
were asking for clarification regarding certain aspects of the proposed
rule. The comments will be further discussed in detail below.
---------------------------------------------------------------------------

\15\ A total of eight (8) comments were received; however, one
commenter submitted a duplicate comment.
---------------------------------------------------------------------------

Paper DEA Form 222s Should Still Be An Option

Issue 1: Two (2) commenters expressed concern that the proposed
rule should continue to allow the use of paper DEA Form 222s as an
option. Both of the commenters noted that some states still require
paper forms to transfer controlled substances between a Long-Term Care
(hereinafter, ``LTC'') pharmacy and emergency kit in a skilled nursing
facility.
DEA Response 1: Paper DEA Form 222s will still be an available
option. The proposed rule will have no impact on the continued
availability and use of paper DEA Form 222s. DEA is aware of some
states continuing to require the use of paper DEA Form 222s, and
therefore, will keep the forms available as an option for the
distribution of controlled substances.

Transition of Existing Registrants to CSOS 2.0

Issue 2: Three (3) commenters asked for clarification on how DEA
intends to transition registrants with existing, active certificates to
CSOS 2.0.
DEA Response 2: DEA will transition existing registrants to CSOS
2.0 by transferring all active certificate holders and their associated
information to CSOS 2.0. This associated information includes DEA
number(s), certificate serial numbers, and other aspects. This
information will be accessible when the user creates an account in the
new portal. The following fields of active certificate holders are
being moved into CSOS 2.0: registrant status, renewal instance number,
application status code, application status date, certificate serial
number, certificate expiration date, DEA number, individual
identification, and role. The information that is related to current
and/or active certificates will not need to be resubmitted.
Issue 3: Two (2) commenters wanted clarification on whether
existing and active registrants will have to resubmit information in
the new online portal.
DEA Response 3: Current and/or active registrants will not be
required to re-submit information related to their current and/or
active certificates.

Receipt of Verification Code

Issue 4: One (1) commenter asked for clarification as to whether
the individual accessing the CSOS login page could provide either a
cellular phone or a landline phone number for the purpose of receiving
the verification code. This commenter was concerned as cellular phone
usage is not always available. The commenter also asked for secure
alternatives to providing the verification code as phone use will not
always be available for all registrants attempting to utilize the CSOS
system.
DEA Response 4: Individuals logging into CSOS will receive a
verification code. CSOS registrants have the option of receiving the
verification code through OKTA Verify,\16\ Google Authenticator, and
email. OKTA Verify has recently discontinued the phone option. As a
result, cell phones or land phones are no longer an option.
---------------------------------------------------------------------------

\16\ OKTA Verify is a multifactor authentication application
that enables users to confirm their identity. <a href="https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm">https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm</a>.
---------------------------------------------------------------------------

Features of CSOS

Issue 5: One (1) commenter sought clarification regarding the
implementation of the electronic application submission process.
Specifically, the commenter asked if the user will be notified upon
login to the site that they have reached their two opportunities for
online renewal before the certificate expires and now need to submit a
new application.
DEA Response 5: Currently, the portal does not show that an
individual has reached his or her two opportunities to renew online
before the certificate expires. The DEA will continue working towards
incorporating this feature in a future update to the portal.
Issue 6: One (1) commenter asked whether the Coordinator(s) will be
notified that the subordinate's application for enrollment for the
Power of Attorney role is ready for review and approval by the
Coordinator, as required by the rule and if so, how.
DEA Response 6: All users in the system will have full visibility
into their actions pending review and approval. Approvers will receive
email notifications of pending approvals. The Coordinator will be
notified via email that the subordinate's application for enrollment
for the Power of Attorney role is ready for review and approval.
Issue 7: One (1) commenter asked DEA for a live chat option for
registrants to contact DEA regarding enrollment issues, and the option
to receive an email transcript of said chat conversation.

[[Page 47569]]

DEA Response 7: Currently, this option is unavailable; however,
this feature can be considered in a future upgrade. A new feature to
CSOS will be an email option that generates a ticket number and assigns
a time frame wherein a help desk representative will respond.

Implementation

Issue 8: One (1) commenter asked for DEA to further explore and
clarify the implementation process.
DEA Response 8: The implementation and transition processes are
being finalized. Prior to the launch date, informational announcements
previewing new functionality, pertinent dates, and online application
instructions will be provided to DEA registrants via email and on the
DEA Diversion website. An email will be sent to users providing them
with a website link. The email will come from <a href="http://deaecom.gov">deaecom.gov</a>, which is a
verified government email address, from which CSOS and DEA participants
have received emails in the past. The email will only be sent in
response to action taken by the participant, not initiated by DEA.
These measures are sufficient for users to recognize valid
communications from DEA. The website will provide the users with
instructions. Users will be informed when the new process will go into
effect as well as what steps users will need to take. Current users
will continue utilizing the login page as they did in the past. Current
users are not required to act until the time of renewal. There will be
a pre-launch date that will enable users to perform the <a href="http://Login.gov">Login.gov</a>
identity verification process prior to creating a CSOS account. When
CSOS 2.0 is launched, current users will be able to create accounts as
well as take advantage of the new self-service features.
Issue 9: One (1) commenter asked whether DEA would take steps to
remedy registrants experiencing excessive hold times when calling the
CSOS help desk, and whether DEA would further staff the help desk with
individuals that can resolve the problem as opposed to someone that
records and relays information to the support team.
DEA Response 9: The newly automated system will allow subscribers
to complete tasks independently on the portal that, under the current
system, required users to call the help desk. This will greatly lower
the number of calls made to the help desk. As a result, hold times will
be significantly diminished. The call center operators are increasingly
being cross-trained to handle CSOS and general registration requests.
Call center operators had their initial training session and are in the
process of reviewing a training manual. There is a training site for
them to utilize as well.
Issue 10: One (1) commenter wanted to see improvements with the
CSOS certificate retrieval process as the retrieval process is time
consuming and difficult. The commenter asked DEA to standardize and
streamline the CSOS certificate retrieval process, particularly with
pharmacy chains. This commenter urged DEA to create an automated
process in which the passwords for CSOS certificate retrieval can be
uploaded into the certificate retrieval system. Furthermore, the
commenter asked DEA to update its software to eliminate the need for
passwords to be issued in text files, and that the automated process
allow a user to be logged in for extended periods of time.
DEA Response 10: A modernized retrieval process will be a part of a
later upgrade to the portal. DEA has taken this comment into
consideration for future upgrades to the system.

Credential Service Provider and Identity Proofing Security

Issue 11: One (1) commenter stated that DEA should strike <a href="http://Login.gov">Login.gov</a>
from its purpose statement and align the credential service provider
(hereinafter, ``CSP'') requirement to current practices within the
healthcare industry, i.e., credentials aligned with NIST IAL2/AAL2
standards. This commenter also stated that DEA should enable providers
to use portable, digital credentials they already have for CSOS access
by providing multiple CSP solutions selected through a competitive
procurement process.
DEA Response 11: The use of additional CSPs may be a future
enhancement. <a href="http://Login.gov">Login.gov</a> will conduct identity proofing, and DEA will
continue as the Certification Authority. <a href="http://Login.gov">Login.gov</a> does not meet the
standard of NIST IAL2/AAL2; however, <a href="http://Login.gov">Login.gov</a> meets the IAL1/AAL1
standard. Following the standards of NIST IAL1/AAL1 is sufficient for
CSOS 2.0 as <a href="http://Login.gov">Login.gov</a> conducts additional verification procedures
similar to those used by financial institutions. Alignment with NIST
IAL2/AAL2 may be an enhancement in the future.
Issue 12: One (1) commenter wanted clarification regarding the
notary requirement, and which free online verification method will be
used. The ``Purpose of Rule'' section of the NPRM discusses the use of
<a href="http://Login.gov">Login.gov</a>, which the commenter states does not appear to be an identity
proofing service. Further the commenter wanted clarification as to
whether ID.me is the identity proofing service that will be used, as
other government agencies mention the use of <a href="http://Login.gov">Login.gov</a>, but indicate
ID.me is the actual identity proofing service.
DEA Response 12: The Technology Transformation Services within the
General Services Administration operates a system, <a href="http://Login.gov">Login.gov</a>, which
provides authentication and identity verification services to federal
agencies. DEA will use <a href="http://Login.gov">Login.gov</a> for authenticating users and verifying
identity. ID.me is not the identity proofing service that will be used.
<a href="http://Login.gov">Login.gov</a> conducts identity proofing, and no payment is required by the
applicant during the <a href="http://Login.gov">Login.gov</a> or CSOS account creation. Federal
agencies are responsible for ensuring that users are properly
authenticated and identified before accessing services, benefits, and
other resources. <a href="http://Login.gov">Login.gov</a> provides these capabilities as a shared
service to agencies on a cost reimbursable basis. Strong authentication
requires each account to be protected by a multi-factor option, which
increases account security. Identity verification requires users to go
through an identity proofing process to confirm that the user is who
the user claims to be. This process may include, but is not limited to,
a combination of digital technologies, government and commercial data
sources, and in-person interactions to check identifying documents and
evidence. <a href="http://Login.gov">Login.gov</a> offers other settings for authentication, including
requiring a user-provided second factor for authentication each time a
user authenticates. This setting is required for identity verification
and authentication-only services that use personal data.
Issue 13: One (1) commenter asked for clarification on whether the
free online verification service is a hosted or cloud-based service,
and what the level of assurance is compared with the level of assurance
of the current process.
DEA Response 13: There is no payment requirement for the applicant
during account creation for <a href="http://Login.gov">Login.gov</a> and CSOS 2.0. <a href="http://Login.gov">Login.gov</a> is cloud-
based. After analyzing alternative solutions, <a href="http://Login.gov">Login.gov</a> was selected as
the preferred solution, based on comprehensive service offerings and
competitive pricing. The level of assurance of the new process is
comparable to the current process. The level of assurance with the
current process involves a notary requirement. The <a href="http://Login.gov">Login.gov</a> system
that is going to be used for CSOS 2.0 is at the IAL1/AAL1 assurance
level. DEA determined that the IAL1/AAL1 assurance level plus
additional verification procedures similar to those

[[Page 47570]]

used in financial institutions is comparable to the current process.
The use of CSPs and alignment with NIST IAL2/AAL2 may be a future
enhancement.
Issue 14: Two (2) commenters were concerned with the level of
assurance or security of the process that will be implemented.
DEA Response 14: The assurance level for CSOS 2.0 is at IAL1/AAL1,
which includes additional verification procedures similar to those used
by financial institutions conducted by <a href="http://Login.gov">Login.gov</a>. The assurance level
of IAL1/AAL1 was deemed sufficient due to the additional verification
procedures that <a href="http://Login.gov">Login.gov</a> conducts.
Issue 15: One (1) commenter discussed how currently, two copies of
identification are needed for obtaining a CSOS digital certificate
under 21 CFR 1311.25(a)(1). The commenter asked DEA to provide
clarification as to what the new process will encompass as the proposed
change states to ``complete the online verification proofing process.''
DEA Response 15: Applicants should be prepared to provide the
following information: state issued identification, email, phone bill
details, and a verified address. Social Security Numbers are being
collected during the <a href="http://Login.gov">Login.gov</a> registration process, but are not being
passed, transferred, or stored within CSOS 2.0.

Online Portal

Issue 16: One (1) commenter asked for clarity on what the online
registration process will look like through the secure online portal.
This commenter further asked for clarification if it will be a web-
based form with the same exact fields as the current paper DEA Forms
251, 252, 253, and 254.
DEA Response 16: DEA will update the CSOS user guide with
screenshots of the new portal prior to launch. The new portal uses web-
based forms that require the same information as on the paper forms.
Issue 17: One (1) commenter asked whether the secure online portal
will be cloud-based and what kind of security will be implemented.
DEA Response 17: The online portal is a FedRAMP government cloud-
based solution with multifactor implementation. FedRAMP is a certified
system and is a government-wide program that promotes the adoption of
secure cloud services across the federal government by providing a
standardized approach to security assessment, authorization, and
continuous monitoring for cloud products and services. FedRAMP provides
a standardized approach to security authorizations for Cloud Service
Offerings.

Coordinator

Issue 18: One (1) commenter asked for clarification for the reason
of removal of the coordinator from the process in 21 CFR 1311.25, as
the coordinator seems to have a significant security role in limiting
who can apply for a CSOS digital certificate.
DEA Response 18: DEA is not removing the Coordinator role from the
process in 21 CFR 1311.25. The individuals who are acting in the
Coordinator role will be able to review and approve and/or deny
applications in the online portal. <a href="http://Login.gov">Login.gov</a> does the identification
proofing on all subscriber applications; therefore, the Coordinator
will no longer be tasked with verifying and approving submitted
documentation for Power of Attorney applications. The requirement for
the application to be notarized and physically mailed to DEA will be
removed with the amending of the regulations.
Previously, the Principal Coordinator was responsible for identity
proofing all applications submitted under a respective DEA
registration. Although all applicants will now be verified and
authenticated online, the Principal Coordinator remains an integral
part of the application process. Once a Principal Coordinator is
designated by the registrant, the Principal Coordinator will be
involved in the issuance of, revocation of, and changes to digital
certificates issued under that registrant's DEA registration and can
approve subsequent applications submitted for the Power of Attorney
role. The Principal Coordinator role will continue to provide security
and certificate oversight.
Issue 19: One (1) commenter asked for clarification on how the
Coordinator informs the Certification Authority of all digital
certificate applications, and how the process will work with the
Coordinator for approving applicants applying for a Power of Attorney
certificate.
DEA Response 19: The Coordinator will receive an automatic email
from CSOS 2.0 requesting that the Coordinator review and approve
requests for the Power of Attorney role triggering issuance of the
certificate. Coordinators use the portal to revoke certificates of
subscribers they oversee and to approve or reject new Power of Attorney
role requests and certificate renewals. Powers of Attorney submit these
requests independently, which then go to the Coordinator to approve or
reject the request. The Coordinator no longer needs to provide a
signature on the application for submission of the request.
Issue 20: One (1) commenter stated that 21 CFR 1311.20 and 1311.25
have been changed in a way so that the Coordinator no longer has to
send a copy of the DEA Form 223 \17\ to the CSOS Registration
Authority. This commenter discussed how the NPRM proposed to remove
language stating that the Coordinator is responsible for verifying the
applicant's identity in 21 CFR 1311.20, as well as the Coordinator
reviewing the application package, and the Coordinator submitting the
completed package to the Certification Authority. Finally, the
commenter asked for clarification regarding the purpose of the changes,
and how security will be impacted.
---------------------------------------------------------------------------

\17\ DEA form 223 is the Certificate of Registration, which
contains ``the name, address, and registration number of the
registrant, the activity authorized by the registration, the
schedules and/or Administration Controlled Substances Code Number
(as set forth in part 1308 of this chapter) of the controlled
substances which the registrant is authorized to handle, the amount
of fee paid (or exemption), and the expiration date of the
registration.'' 21 CFR 1301.35(c).
---------------------------------------------------------------------------

DEA Response 20: The purpose of the change is to enable online
registration for CSOS 2.0. DEA numbers will be validated during account
creation. Coordinator applications will require approval by the
registrant.
CSOS 2.0 will directly access DEA's registration database and
review current DEA Form 223 status electronically, which will eliminate
the need for the paper document. Due to this development, advanced
security measures have been implemented.
When a registrant enrolls in CSOS 2.0, identity verification
services will be provided by <a href="http://Login.gov">Login.gov</a>. <a href="http://Login.gov">Login.gov</a> will collect a photo
of a government issued ID and other personal identifiable information
(including, but not limited to, full name, date of birth, mailing
address, phone number, and Social Security Number or Individual
Taxpayer Identification Number). <a href="http://Login.gov">Login.gov</a> will also validate the
information submitted by the user with authoritative data sources.
Depending on the information entered, the system will also perform one
of the following: (1) sending a text message or call with a code to the
phone number associated with the user, or (2) receiving a one-time code
using face or touch unlock, security key, or third-party authentication
applications such as OKTA Verify, and/or Google Authenticator. The user
will need to provide this code to <a href="http://Login.gov">Login.gov</a> in order to complete
<a href="http://Login.gov">Login.gov</a>'s identity verification process. If the user was

[[Page 47571]]

successfully verified and provides consent, DEA may receive the user's
attributes at the time of authentication. If the user was unable to
successfully verify their identity, they will retain their account for
authentication services.
Identity verification services may also involve in-person
supervision and remote supervision of the user during the process, such
as when <a href="http://Login.gov">Login.gov</a> is unable to collect a photo of their government-
issued ID, or other methods of verification such as inheriting
credentials from an agency partner. In amending its regulations to
transfer all paper applications for CSOS ordering to electronic
submissions, the requirement for the application to be notarized and
physically mailed to DEA will be removed. Previously, the Principal
Coordinator role was responsible for identity-proofing all applications
submitted under a respective DEA registration. As proposed, all
applicants will be verified and authenticated online, however the
Principal Coordinator remains an integral part of the application
process. Once a Principal Coordinator is designated by the registrant,
the Principal Coordinator will be involved in the issuance of,
revocation of, and changes to digital certificates issued under that
registrant's DEA registration and can approve subsequent applications
submitted for the Power of Attorney role. The Principal Coordinator
role will continue to provide security and certificate oversight.

Call Center Wait Times

Issue 21: One (1) commenter provided the following call center wait
time calculations: savings to industry seems to represent a 94%
reduction in DEA call center demand. Old process = (90 minutes per new
application x 31,372 new applications per year) + (90 minutes per
renewal x 62,344 renewals per year) = 8,434,440 minutes. New process =
(15 minutes per new application x 31,372 new applications per year) +
(0 minutes per renewal x 62,344 renewals per year) = 470,580. With the
estimated numbers of new and renewal applications being found in DEA's
Executive Order (E.O.) 12866 section. The commenter wanted DEA to
confirm whether these calculations were correct.
DEA Response 21: The commenter seems to have misunderstood the
calculation and DEA also notes that the commenter appears to have
mistyped the number of new applications. As detailed in the Executive
Order (E.O.) 12866 section below, DEA estimates there will be labor
cost savings from reduced time to complete a new application. DEA
estimates that the current time to complete a new application is three
hours, which includes an estimated 1.5 hours to prepare and provide the
necessary information and 1.5 hours calling DEA for assistance or to
check the status of the application. Under the proposed final rule,
while an applicant is expected to require the same 1.5 hours to prepare
and provide the necessary information, the online system will allow
self-viewing of status, reducing the need for or duration of calls to
DEA. DEA estimates the required time to complete a new application
would be 1.75 hours, including an estimated 0.25 hours for logging in
to the CSOS system or calls to DEA for assistance. The commenter's
calculation would instead be correct as follows: Old process = (180
minutes per new application x 31,172 per year) + (90 minutes per
renewal x 62,344 per year) = 11,221,920 minutes. New process = (105
minutes per new application x 31,172 per year) + (15 minutes per
renewal x 62,344 per year) = 4,208,220.

Audits and Testing

Issue 22: One (1) commenter stated that third-party vendors of CSOS
software are required to go through audits. This commenter asked DEA
whether audits will be required of any third-party software
contemplated for use in this modernized registration process.
DEA Response 22: DEA does not anticipate the use of any third-party
software for the modernized registration process.
Issue 23: One (1) commenter inquired as to how the modernized
system will be tested and whether there will be industry involvement in
testing.
DEA Response 23: DEA performs ongoing, continual, and extensive
testing to include: regression, performance, security, and user
acceptance. DEA is considering opportunities for industry involvement.

Bulk Enrollment

Issue 24: One (1) commenter asked for clarification as to whether
the CSOS 2.0 enrollment processes will continue to accommodate bulk
enrollment (i.e., the enrollment of multiple registrants under a single
applicant, as occurs with chain pharmacy organizations).
DEA Response 24: DEA's CSOS online portal will continue to
accommodate bulk enrollment. CSOS 2.0 will enable subscribers to
complete the bulk enrollment process directly online, which will
simplify the process.
Issue 25: One (1) commenter asked DEA to assign specialists for
each pharmacy organization that uses bulk enrollment.
DEA Response 25: It is anticipated that these updates to CSOS will
mitigate the need for DEA assistance, as the bulk renewal will be done
online directly by the subscriber. As such, DEA does not anticipate a
need to assign specialists for each pharmacy organization that uses
bulk enrollment. In the event that assistance is required, the
Diversion Control Contact Center Operators (help desk) will be
available 8:30 a.m.-5:50 p.m. EST, Monday through Friday.

Power of Attorney

Issue 26: One (1) commenter asked for clarification as to whether
individuals who have been granted the Power of Attorney authority for
DEA registration purposes can serve in the role of the registrant for
CSOS purposes and could therefore designate CSOS coordinators.
DEA Response 26: Individuals who have been granted Power of
Attorney authority for DEA registration purposes can also serve in the
role as the registrant coordinator for CSOS purposes, if such role is
authorized through an executed Power of Attorney.
An applicant for a DEA number may authorize one or more individuals
to sign applications for the applicant by filing a Power of Attorney
for each such individual.\18\ A DEA registrant may also execute a Power
of Attorney to authorize one or more individuals to issue orders for
Schedule I and Schedule II controlled substances on behalf of the
registrant.\19\
---------------------------------------------------------------------------

\18\ 21 CFR 1301.13(j) (May 11, 2022).
\19\ 21 CFR 1305.05(a) (Oct. 30, 2019).
---------------------------------------------------------------------------

A DEA registrant may execute a Power of Attorney that designates an
individual as the registrant coordinator for said registrant's
respective DEA registration number, once this individual enrolls
through the CSOS 2.0 portal. The registrant coordinator may designate
an individual as the Principal Coordinator over the CSOS
certifications. This individual designated as the Principal Coordinator
can assign himself or another as the Principal Coordinator for CSOS.

Discussion of Regulatory Changes

Need for Regulatory Changes

Regulatory changes are needed to conform existing DEA regulations
regarding the submission of paper CSOS system enrollment forms to DEA's
current requirements that other DEA

[[Page 47572]]

forms be submitted online.\20\ The paper enrollment process is prone to
errors, creates wasteful and unnecessary paper records, requires manual
processing, and leads to hard copy records that are expensive to
process and store. This rule amends existing DEA regulations in one
part--Title 21 Chapter II Part 1311. DEA is amending 21 CFR 1311 to
require all CSOS enrollment applications and supporting materials to be
submitted to DEA through the CSOS secure network portal. This amendment
improves the submission process by aligning it with DEA's current
policy of reducing and/or eliminating the reliance on wasteful paper
applications and expediting enrollment by utilizing modern technology.
The online submission of applications and supporting materials through
the secure database will ensure DEA's receipt of documentation in a
more timely and organized manner.
---------------------------------------------------------------------------

\20\ See Reporting of Theft or Significant Loss of Controlled
Substances, 88 FR 40707 (June 22, 2023) (published Final Rule to
require all DEA Form 106s to be submitted electronically);
Suspicious Orders of Controlled Substances, 85 FR 212 (Nov. 2, 2020)
(published NPRM proposing centralized electronic reporting for
suspicious order reports based on Congressional mandate); Agency
Rule List--Spring 2021 (2021), <a href="https://www.reginfo.gov/public/do/eAgendaMain?operation=OPERATION_GET_AGENCY_RULE_LIST&currentPub=true&agencyCode=&showStage=active&agencyCd=1100&csrf_token=F19C7C599C70B80C228EC16B60AEB150F6339AF3C80E56FE003EEB7D3A758895BC8E16A215E8A0466326EBFBA8639F799E09">https://www.reginfo.gov/public/do/eAgendaMain?operation=OPERATION_GET_AGENCY_RULE_LIST&currentPub=true&agencyCode=&showStage=active&agencyCd=1100&csrf_token=F19C7C599C70B80C228EC16B60AEB150F6339AF3C80E56FE003EEB7D3A758895BC8E16A215E8A0466326EBFBA8639F799E09</a> (Spring 2021 Unified Agenda of Regulatory and
Deregulatory Actions, Active Regulatory Actions Listed By Agency,
Agency Rule list noting proposed rule stage for Electronic
Submission of DEA Form 41 (Registrant Record of Controlled
Substances Destroyed)--1117-AB59).
---------------------------------------------------------------------------

Section-by-Section Analysis

DEA is amending 21 CFR 1311.20, 1311.25, 1311.40, and 1311.60 by
eliminating the ability of registrants to submit paper CSOS enrollment
application forms. Registrants will be required to submit all their
application materials through the secure online portal. Moreover, DEA
is amending these regulations by eliminating certain recordkeeping
requirements, as those records will now be accessible as a digital
version in the system. DEA believes these amendments will expedite the
enrollment process for registrants and facilitate the Agency-wide goal
of reducing DEA's reliance on paper forms.
DEA is amending 21 CFR 1311.20, which describes the role and
responsibilities of the CSOS Coordinator. Current regulations require
the CSOS Coordinator to complete the paper application process by
submitting the notarized enrollment package to the DEA Certification
Authority for processing. This amendment streamlines the process by
eliminating the paper process and requiring Coordinator applicants to
enroll using the secure online portal.
Additionally, DEA is amending 21 CFR 1311.25, which establishes the
requirements for a registrant, or authorized representative with a
Power of Attorney, to complete the manual application process by
submitting the notarized enrollment package to the DEA Certification
Authority for processing. This amendment streamlines the process by
eliminating the manual paper process and requiring all registrants, or
authorized representatives with Powers of Attorney, to enroll using the
secure online portal.
DEA is also amending 21 CFR 1311.40, which establishes the criteria
for renewal of a CSOS digital certificate. This amendment streamlines
the renewal process by eliminating the manual paper process and
requiring that all renewal applications be submitted using the secure
online portal.
Last, DEA is amending 21 CFR 1311.60, which establishes
recordkeeping requirements on the part of the CSOS certificate holder
by requiring that a copy of the subscriber agreement be maintained for
the life of the certificate. This amendment removes the requirement of
the CSOS certificate holder to maintain a copy of the subscriber
agreement by enabling registrants to sign and access a digital version
of the agreement in the online portal.

Regulatory Analyses

Executive Orders 12866, 13563, and 14192 (Regulatory Review)

DEA has determined that this rulemaking is not a ``significant
regulatory action'' under section 3(f) of Executive Order (E.O.) 12866,
Regulatory Planning and Review. Accordingly, this proposed rule has not
been submitted to the Office of Management and Budget (OMB) for review.
This proposed rule has been drafted and reviewed in accordance with
E.O. 12866, ``Regulatory Planning and Review,'' section 1(b),
Principles of Regulation; E.O. 13563, ``Improving Regulation and
Regulatory Review,'' section 1(b), General Principles of Regulation;
and E.O. 14192 ``Unleashing Prosperity Through Deregulation.''

Analysis of Benefits, Costs/Cost Savings

Current regulations require registrants who wish to participate in
the CSOS system to enroll using a labor-intensive manual process which
relies on paper applications. This final rule amends DEA regulations to
require electronic enrollment through a secure web-based system.
The current regulations related to CSOS enrollment are summarized
below.
(1) 21 CFR 1311.20(b)-(c) requires Coordinators to enroll in
writing.
(2) 21 CFR 1311.25(a)-(b) requires a registrant, or authorized
representative with a Power of Attorney, to enroll in writing.
(3) 21 CFR 1311.40(c)-(d) requires submitting a new application in
writing for every third renewal and for expired certificates.
(4) 21 CFR 1311.60(c) requires maintaining a copy of the
subscription agreement for the life of the certificate.
The final rule would change these requirements to the following.
(1) 21 CFR 1311.20(b)-(c) requiring Coordinators to enroll online.
(2) 21 CFR 1311.25(a) (with (b) removed) requiring all registrants,
or authorized representative with a Power of Attorney, to enroll
online.
(3) 21 CFR 1311.40(c)-(d) requiring, for every third renewal and
expiration, a new application online.
(4) 21 CFR 1311.60(c), removing this provision to allow electronic
subscription agreements to be held online and no longer requiring a
paper copy be maintained.
Table 1 summarizes the changes from current regulations to the
final rule.

Table 1--Summary of Current Regulations and the Final Rule
------------------------------------------------------------------------
21 CFR location Current Final rule
------------------------------------------------------------------------
1311.20(b)-(c)............... Requires Will require
Coordinators to Coordinators to
enroll in writing. enroll online.
1311.25(a)-(b)............... Requires a Will require all
registrant, or registrants, or
authorized authorized
representative with representatives
a Power of with Powers of
Attorney, to enroll Attorney, to
in writing. enroll online.

[[Page 47573]]

1311.40(c)-(d)............... Requires submitting Will require, for
a new application every third
in writing, for renewal and
every third renewal expiration, a new
and for expired application
certificates. online.
1311.60(c)................... Requires maintaining (Removal) will
a copy of the allow subscription
subscription agreements to be
agreement.. held online and no
longer require a
copy be
maintained.
------------------------------------------------------------------------

DEA has examined the benefits and costs/cost savings of this final
rule and believes it is of net positive economic benefit. DEA believes
the cost savings to registrants, as well as DEA, heavily outweigh any
cost to DEA associated with implementing and maintaining the necessary
computer systems to allow for online enrollment and renewal to CSOS.

Affected Parties and Number of CSOS Applications

This final rule will affect registrants who wish to participate in
the CSOS system, and DEA. A registrant, designated person, or an
authorized representative, who wishes to enroll in the CSOS system can
apply for one of three system user roles: Registrant, Coordinator, or
Power of Attorney. New and renewal enrollment applications are
submitted online. DEA processes the applications in addition to
operating and maintaining the systems used in the enrollment and
certificate management process. The economic impact of this final rule
is a function of changes in requirement for each CSOS enrollment
application and the estimated number of applications.
Each year, DEA receives a mix of new and renewal applications for
enrollment. In 2021, DEA received 31,172 new applications. These
applications include 11,411; 6,974; and 12,787 new applications for
Registrant, Coordinator, and Power of Attorney roles, respectively. For
every third renewal, the CSOS certificate holder must submit a new
application.\21\ Therefore, for the purposes of this analysis, a third
renewal is considered as a new application. Based on this renewal
requirement, DEA estimates that new applications are approximately one-
third of total applications and the number of renewals is approximately
twice the number of new applications. Therefore, DEA estimates there
were 62,344 renewal applications for a total of 93,516 (31,172 +
62,344) total applications in 2021.
---------------------------------------------------------------------------

\21\ 21 CFR 1311.40(c).
---------------------------------------------------------------------------

As pharmacies are the largest registration business activity that
participate in CSOS, representing approximately 73 percent of CSOS
registered locations,\22\ DEA believes the growth in the number of
pharmacies registered with DEA represents a good proxy for the growth
of CSOS-participating registrants, and the number of CSOS applications
for enrollment.
---------------------------------------------------------------------------

\22\ Source: DEA.
---------------------------------------------------------------------------

The number of DEA registered pharmacies has declined from 72,353 in
2015 to 70,628 in 2019 and has roughly stayed constant, with no growth,
from 2019 to 2021, with 70,789 and 70,670 pharmacy registrations in
2020 and 2021, respectively. So, DEA believes that zero net growth in
CSOS applications is a reasonable estimate. Therefore, DEA estimates
the numbers of applications will stay constant at 31,172 new and 62,344
renewal, for a total of 93,516 applications, over the 10-year analysis
period.

Registrant Impact

New Applications
Below is a description of the estimated impact of the final rule on
new enrollment applications for Registrant, Coordinator, and Power of
Attorney roles.
1. Time to Complete New Application: DEA estimates there will be
labor cost savings from reduced time to complete a new application. DEA
estimates that the current time to complete a new application is three
hours, which includes an estimated 1.5 hours to prepare and provided
the necessary information and 1.5 hours calling the DEA for assistance
or status of application. Under the final rule, while an applicant is
expected to require the same 1.5 hours to prepare and provide the
necessary information, the online system will allow self-viewing of
status, reducing the need or duration of calls to DEA. DEA estimates
the required time to complete a new application would be 1.75 hours,
including an estimated 0.25 hours for logging to CSOS system or calls
to DEA for assistance. Using a loaded hourly rate of $93.02 for
Pharmacists,\23\ \24\ \25\ the labor cost would decrease from $282.06
($94.02 x 3) to $164.54 ($94.02 x 1.75), resulting in an estimated cost
savings of $117.52 ($282.06-$164.54) per application.
---------------------------------------------------------------------------

\23\ U.S. Bureau of Labor Statistics (BLS), Occupational
Employment and Wages, May 2024, 29-1051 Pharmacists. <a href="https://data.bls.gov/oes/#/industry/000000">https://data.bls.gov/oes/#/industry/000000</a>. (Accessed 5/22/2024.).
\24\ BLS, ``Employer Costs for Employee Compensation--March
2025'' (ECEC).
\25\ As pharmacies represent a large majority of CSOS
participants and pharmacists are expected to be the most prevalent
CSOS users, DEA believes pharmacists wages therefore represent a
good estimate of the wage for all applicants. BLS reports that the
median wage of pharmacists is $66.10. BLS also reports that average
benefits for private industry is 29.5 percent of total compensation.
The 29.5 percent of total compensation equates to 42.24 percent
(29.7 percent/70.3 percent) load on wages and salaries. The load of
42.24 percent is added to each of the hourly rates to estimate the
loaded hourly rates. $66.1 x 1.4224 = $94.02.
---------------------------------------------------------------------------

2. Postage Cost: Under current regulations paper application forms
and supporting information need to be shipped to DEA. The final rule
will eliminate the need to ship paper applications. Not having to ship
the enrollment package is estimated to reduce postage costs by $13.27
per application.\26\
---------------------------------------------------------------------------

\26\ FedEx Ground rates for a one-pound package using zone five,
effective January 6, 2025 and downloaded on 5/22/2025.
---------------------------------------------------------------------------

3. Notary Cost: Under current regulations, a new application for a
Registrant or a Coordinator role requires a notary. The final rule will
eliminate the notary requirement. Not having to get a notary (due to
online verification methods is expected to eliminate an estimated
notary cost of $5.00 per enrollment package.\27\ The notary requirement
only applies to Registrant and Coordinator roles, and as discussed
earlier, of the estimated 31,172 total new applications, 11,411 and
6,974 are for Registrant and Coordinator, respectively, making up 59
percent ((11,411 + 6,974)/31,174) of total registrations. Therefore, 59
percent of $5.00, $2.95 is the average notary cost savings for all new
applications.
---------------------------------------------------------------------------

\27\ National Notary Association, ``2025 Notary Fees by State''.
<a href="https://www.nationalnotary.org/knowledge-center/about-notaries/notary-fees-by-state">https://www.nationalnotary.org/knowledge-center/about-notaries/notary-fees-by-state</a> (accessed 5/22/2025). Notary fees can range
from $2 to $25. DEA has decided to use $5 as its estimate of notary
fees. DEA believes many applicants can get documents notarized at
low costs, i.e., at banks, employees with public notary, etc.
---------------------------------------------------------------------------

4. Agreement Storage Costs: Under current regulations, a CSOS
certificate holder is required to maintain a copy of the subscriber
agreement. The final rule will eliminate this requirement. DEA does not
believe there is a material

[[Page 47574]]

impact from not having to store written subscription agreements and
having them be stored online in CSOS.
Table 2 summarizes the impact of the final rule for new
applications.

Table 2--Registrant Impact: New Application
----------------------------------------------------------------------------------------------------------------
Cost savings
Current ($) New ($) ($)
----------------------------------------------------------------------------------------------------------------
Labor cost per New app.......................................... 282.06 164.54 117.52
Postage cost per New app........................................ 13.27 .............. 13.27
Cost of notary per New app...................................... 2.95 .............. 2.95
-----------------------------------------------
Total new application....................................... .............. .............. 133.74
----------------------------------------------------------------------------------------------------------------

Renewal Applications
Below is a description of the estimated impact of the final rule on
renewal enrollment applications for Registrant, Coordinator, and Power
of Attorney roles.
1. Time Spent Requested Renewal: DEA estimates there will be labor
cost savings from reduced time to complete a renewal application. DEA
estimates that the time spent requesting a renewal will fall from 1.5
hours using the phone method to 0.25 hours using the online method.
Using a loaded hourly rate of $94.02 for Pharmacists,\28\ the labor
cost would decrease from $141.03 ($94.02 x 1.5) to $23.51 ($94.02 x
0.25), resulting in an estimated cost savings of $117.52 ($141.03-
$23.51) per application.
---------------------------------------------------------------------------

\28\ Note 17.
---------------------------------------------------------------------------

Table 3 summarizes the impact of the final rule for renewal
applications.

Table 3--Registrants Impact--Renewal Applications
----------------------------------------------------------------------------------------------------------------
Cost savings
Current ($) New ($) ($)
----------------------------------------------------------------------------------------------------------------
Labor cost per Renewal app................................... 141.03 23.51 117.52
----------------------------------------------------------------------------------------------------------------

Total Registrant Impact

The total registrant cost savings is $11,495,610 per year,
calculated by multiplying the cost of a new and renewal application by
the number of new and renewal applications. Table 4 details the
calculation.

Table 4--Total Registrant Impact
------------------------------------------------------------------------

------------------------------------------------------------------------
Number of new applications..................... 31,172
Number of renewal applications................. 62,344
------------------------
Number of total applications............... 93,516
Cost savings per new application ($)........... 133.74
------------------------
Subtotal, all new applications ($)......... 4,168,943
Cost savings per renewal application ($)....... 117.52
------------------------
Subtotal, all renewal applications ($)..... 7,326,667
------------------------
Total cost savings to registrants ($).. 11,495,610
------------------------------------------------------------------------

Additional Benefits

There are additional benefits of the final rule. These include:
(1) Shorter end-to-end process time (submission to certificate):
Allowing earlier use of CSOS for ordering Schedule II controlled
substances and realizing the benefits of electronic ordering rather
than using paper order forms.
(2) Insight into status and workflows to track the progress of the
submission: Allowing Coordinators to get status updates online, see how
the application progresses, and plan for additional CSOS users.
(3) No longer needing to wait for the call center to request
Certificate management action revocations: Allowing Coordinators to
self-manage and remove user certificates.
(4) Safer submission process: Allowing secure delivery of
potentially sensitive information.
(5) Error checking: Allowing programmatic review for erroneous or
incomplete information, reducing delays in application processing.

DEA Impact

DEA's costs are driven by the personnel and technology resources
required to process the applications. Below is a list of the cost
activities and anticipated impact.
1. Certification Authority Cost: The Certification Authority serves
as the central element responsible for establishing a trust
relationship between controlled substance manufacturers, distributors,
pharmacies, and other DEA authorized ordering entities. Certification
Authority issues user digital certificates used to digitally sign
electronic transactions. DEA believes that the personnel resources and
costs to certify enrollment and issue digital certificates will not
change as a result of

[[Page 47575]]

this final rule. Based on current Certification Authority resources,
DEA estimates the annual Certification Authority cost will remain at
$732,922.\29\
---------------------------------------------------------------------------

\29\ Source: DEA.
---------------------------------------------------------------------------

2. Registration Authority Cost: The Registration Authority is the
entity that collects and verifies each applicant's identity and
information that are to be entered into his or her public key
certificates. Receiving electronic applications eliminates the need to
scan paper applications. DEA estimates that the personnel resources and
costs to process enrollment applications will fall by 30 percent
starting with the second year of implementation of the rule. However,
in the first year of implementation, DEA anticipates the decrease in
resource requirements from elimination of scanning requirement will be
offset by increase in applicant questions referred to Registration
Authority. DEA estimates the total annual Registration Authority cost
of $597,688 \30\ will remain the same in year 1 and will be $418,382
($597,688 x 0.7) in year 2 and thereafter.
---------------------------------------------------------------------------

\30\ Source: DEA.
---------------------------------------------------------------------------

3. Mail Reception Cost: Currently, DEA requires personnel to
receive, sort, and deliver paper applications to the Registration
Authority at an estimated annual cost of $34,562.\31\ Under the final
rule, applications would be received online, eliminating this cost.
---------------------------------------------------------------------------

\31\ Source: DEA.
---------------------------------------------------------------------------

4. Data Entry Cost: Currently, personnel resources are needed to
verify the accuracy of the scanned paper applications and make any
needed corrections. Under the final rule, online applications eliminate
the need for this task. The estimated total current annual cost of
$109,138 \32\ will be eliminated when this final rule is implemented.
---------------------------------------------------------------------------

\32\ Source: DEA.
---------------------------------------------------------------------------

5. Call Center Support Cost: DEA operates a CSOS call center to
service questions, or provide assistance, regarding CSOS enrollment and
certificate management. The estimated total current annual cost as
$1,749,946.\33\ While DEA anticipates a reduction in the number of
calls and duration of each call, DEA anticipates this reduction will
result in lower wait-times for callers rather than reduced call center
resources. Therefore, DEA estimates this cost will remain the same at
$1,749,946.
---------------------------------------------------------------------------

\33\ Source: DEA.
---------------------------------------------------------------------------

6. Information Technology Cost: DEA currently spends approximately
$255,000 per year on its Information Technology enrollment-related
systems and software. DEA anticipates Information Technology costs will
increase to $2,935,200 per year.\34\ Information Technology cost
includes, but are not limited to, cloud services, workflow management,
identity verification, identity management functionality, professional
services for continuous development, integration and deployment, and
maintenance and troubleshooting.
---------------------------------------------------------------------------

\34\ Source: DEA.
---------------------------------------------------------------------------

All costs are expected to scale with the volume of new
applications, except Information Technology cost, which does not vary
with the volume of applications. Table 5 summarizes the DEA's impact.

Table 5--Total DEA Impact
[Initial and remaining years]
----------------------------------------------------------------------------------------------------------------
Year 1, change Year 2, change
Current ($) Year 1 ($) from current Year 2 * ($) from current
($) ($)
----------------------------------------------------------------------------------------------------------------
Number of applications.......... 31,172 31,172 .............. 31,172 ..............
Certification Authority......... 732,992 732,992 .............. 418,382 -314,610
Registration Authority **....... 597,688 418,382 -179,306 418,382 -179,306
Mail preparation (received mail) 34,562 .............. -34,562 .............. -34,562
Data Entry...................... 109,138 .............. -109,138 .............. -109,138
Call Center Support............. 1,749,946 1,749,946 .............. 1,749,946 ..............
Information Technology.......... 255,000 2,935,200 2,680,200 2,935,200 2,680,200
-------------------------------------------------------------------------------
Total cost.................. 3,479,325 5,836,519 2,357,194 5,521,909 2,042,584
----------------------------------------------------------------------------------------------------------------
* Years 2 through 10 are all assumed to be the same.
** New cost starts on second year.

Additional Benefits

There are additional benefits to the DEA from the final rule. These
include:
(1) That the CSOS System will be supported, secure, reliable, and
scalable: Reducing the risk of lost or stolen data and long-term
reduction in costs associated with to maintenance, operations, and
growth.
(2) The Certificate management process no longer involves a help
desk call: Call center resources will be freed up to reduce hold-times
for registrants allowing meeting call management service level
agreements and improving user satisfaction.
(3) Possible increase in CSOS adoption due to ease of enrollment
process: Reducing DEA costs associated with printing and mailing paper
order forms.
(4) The ease at which enhancements can be made as needed, for
example Enterprise Certificates with multiple DEA numbers: Allowing
efficient future improvements to CSOS.

Registrant and DEA Total Impact

Using the registrant and DEA impacts from table 5 the estimated net
cost savings of this final rule for the 10-year analysis period is
listed in Table 8.

Table 6--DEA and Registrant Total Impact
----------------------------------------------------------------------------------------------------------------
Total cost savings to Net cost savings to DEA Total net cost savings,
Year registrants ($) (net cost) ($) registrant + DEA ($)
----------------------------------------------------------------------------------------------------------------
1.................................... 11,495,610 (2,536,501) 8,959,109

[[Page 47576]]

2.................................... 11,495,610 (2,357,194) 9,138,416
3.................................... 11,495,610 (2,357,194) 9,138,416
4.................................... 11,495,610 (2,357,194) 9,138,416
5.................................... 11,495,610 (2,357,194) 9,138,416
6.................................... 11,495,610 (2,357,194) 9,138,416
7.................................... 11,495,610 (2,357,194) 9,138,416
8.................................... 11,495,610 (2,357,194) 9,138,416
9.................................... 11,495,610 (2,357,194) 9,138,416
10................................... 11,495,610 (2,357,194) 9,138,416
----------------------------------------------------------------------------------------------------------------

The present value of the net cost savings over the 10-year analysis
period is $77,952,542 and $64,184,410 at three and seven percent
discount rates, respectively. The annualized net cost savings is
$9,138,416 at three and seven percent.
The final rule is an E.O. 14192 deregulatory action because it is
being finalized and has a total cost less than zero. The present value
of the estimated net cost savings is $64,184,410 at seven percent
discount rate in 2025 dollars.

Executive Order 12988, Civil Justice Reform

This final rule meets the applicable standards set forth in
sections 3(a) and 3(b)(2) of E.O. 12988, Civil Justice Reform to
eliminate ambiguity, minimize litigation, establish clear legal
standards, and reduce burdens. DEA expects the instant validation of
online registration applications to reduce ambiguity and reduce the
number of errors in submissions and reduce burdens on both DEA and
registrants.

Executive Order 13132, Federalism

This final rule does not have federalism implications warranting
the application of E.O. 13132. The final rule does not have substantial
direct effects on the States, on the relationship between the National
government and the States, or on the distribution of power and
responsibilities among the various levels of government.

Executive Order 13175, Consultation and Coordination With Indian Tribal
Governments

The final rule does not have substantial direct effects on one or
more Indian tribes, on the relationship between the Federal government
and Indian tribes, or on the distribution of power and responsibilities
between the Federal government and Indian tribes.

Executive Order 14267, Reducing Anti-Competitive Regulatory Barriers

The proposed rule does not reduce competition, entrepreneurship,
and innovation.

Executive Order 14294, Overcriminalization of Federal Regulations

Executive Order 14294 specifies that all NPRMs and final rules
published in the Federal Register, the violation of which may
constitute criminal regulatory offenses, should include a statement
identifying that the rule or proposed rule is a criminal regulatory
offense, the authorizing statute, and the mens rea requirement for each
element of the offense. This final rule does not involve a criminal
regulatory offense and thus E.O. 14294 does not apply.

Regulatory Flexibility Act

In accordance with the Regulatory Flexibility Act (RFA), the DEA
has reviewed the economic impact of this final rule on small entities.
DEA's economic impact evaluation indicates that the rule will not, if
promulgated, have a significant economic impact on a substantial number
of small entities.
The RFA requires an agency to analyze options for regulatory relief
of small entities unless it can certify that the rule will not have a
significant impact on substantial number of small entities. DEA has
analyzed the economic impact of each provision of this final rule and
estimates that it will have minimal economic impact on affected
entities, including small businesses, nonprofit organizations, and
small governmental jurisdictions.
This final rule will simplify the enrollment process by requiring
all initial registration and renewal applications be submitted online.
The rule affects all enrollment and renewals for CSOS, whose users
currently use paper applications. However, once a registrant is
enrolled the DEA already requires them to order using CSOS. So, there
is no additional cost to obtaining access to CSOS, since registrants
will already be required to use it eventually.
There is a total of 94,011 CSOS participating entities, as can be
seen in Table 7, with approximately 325,000 active certificates.
Certificates have to be renewed every one or three years, based on the
registrants' DEA registration renewal cycle. In 2021, the number of new
applications were 31,172. For every third renewal, the CSOS certificate
holder must submit a new application.\35\ Therefore, for the purposes
of this analysis, a third renewal is considered as a new application.
DEA estimate that the total applications, including renewals, is
93,516.
---------------------------------------------------------------------------

\35\ 21 CFR 1311.40(c).

Table 7--Percentage and Number of Registered Locations by Business Activity
----------------------------------------------------------------------------------------------------------------
Number of Renewal cycle
Business activity entities Percent (years)
----------------------------------------------------------------------------------------------------------------
Pharmacy........................................................ 62,291 66.26 3
Hospital/Clinic................................................. 11,898 12.66 3
Practitioner/Mid-Level Practitioner (MLP)....................... 18,095 19.25 3
Teaching Institution............................................ 14 0.01 3

[[Page 47577]]

Manufacturer.................................................... 103 0.11 1
Distributor/Importer/Exporter................................... 444 0.47 1
Researcher...................................................... 247 0.26 1
Analytical Lab.................................................. 26 0.03 1
Reverse Distributor............................................. 5 0.01 1
Narcotic Treatment Program (NTP)................................ 888 0.94 1
-----------------------------------------------
Total....................................................... 94,011 100.00 * 2.97
----------------------------------------------------------------------------------------------------------------
* Weighted average.
(Source: DEA).

This final rule affects all new and renewal enrollment applications
for CSOS, as applications will have to take place online, and all
entities who would submit new and renewal applications. This final rule
affects small entities in industries associated with the above business
activities, primarily industries associated with pharmacy, hospital/
clinic, and practitioner/MLP registrations, as these business
activities make up 98.17 percent of the CSOS-participating
registrations. Table 8 indicates the sectors, as defined by the North
American Industry Classification System (NAICS), that best correlate
with business activities affected by the final rule.

Table 8--Industrial Sectors Affected by the Final Rule
------------------------------------------------------------------------
Business activity NAICS code NAICS code description
------------------------------------------------------------------------
Pharmacy......................... 445110 Supermarkets and Other
Grocery (except
Convenience) Stores.
446110 Pharmacies and Drug
Stores.
452210 Department Stores.
452311 Warehouse Clubs and
Supercenters.
NTP, Hospital/Clinic, 621111 Offices of Physicians
Practitioner, MLP *. (except Mental Health
Specialists).
621112 Offices of Physicians,
Mental Health
Specialists.
621330 Offices of Mental Health
Practitioners (except
Physicians).
621420 Outpatient Mental Health
and Substance Abuse
Centers.
621491 HMO Medical Centers.
621493 Freestanding Ambulatory
Surgical and Emergency
Centers.
622110 General Medical and
Surgical Hospitals.
622210 Psychiatric and
Substance Abuse
Hospitals.
622310 Specialty (except
Psychiatric and
Substance Abuse)
Hospitals.
Teaching Institute............... 611310 Colleges, Universities
and Professional
Schools.
Manufacturer..................... 325411 Medicinal and Botanical
Manufacturing.
325412 Pharmaceutical
Preparation
Manufacturing.
Distributor, Importer, Exporter.. 424210 Drugs and Druggists'
Sundries Merchant
Wholesalers.
Researcher....................... 541715 Research and Development
in the Physical,
Engineering, and Life
Sciences (except
Nanotechnology and
Biotechnology).
Analytical Labs.................. 541380 Testing Laboratories.
Reverse Distributor.............. 562213 Solid Waste Combustors
and Incinerators.
562219 Other Nonhazardous Waste
Treatment and Disposal.
------------------------------------------------------------------------
* Practitioners and mid-level practitioners are generally employed in
one of these industries.

As shown in Table 8, the final rule affects a wide variety of
entities across many industry sectors. Some industry sectors are
expected to consist primarily of DEA CSOS registrants (i.e., 446110--
Pharmacies and Drug Stores, 622110--General Medical and Surgical
Hospitals, etc.). Therefore, this final rule is expected to affect a
substantial number of small entities in some industries.
There are no new costs associated with this final rule. The labor
burden to submit an application is estimated to be the same for
electronic and paper submissions. All CSOS registered location will
already need to have access to the internet in order to use CSOS. DEA
acknowledges some applicants prefer paper forms. DEA does not have a
basis to quantify this preference; however, DEA believes any costs
associated with eliminating this preference is offset by the cost
savings discussion below.
DEA anticipates there will be cost savings associated with
electronic submissions. Some cost savings are described qualitatively
and some are quantified. Many paper applications submitted contain
illegible or erroneous information or omit required information. Many
such errors or omissions, such as not including a signature or paying
the wrong amount, require DEA to contact applicants to correct or
clarify the information in the paper form, consuming DEA's and the
applicant's time and resources. Electronic submissions are expected to
virtually eliminate the requirement for DEA to contact applicants for
clarifications of form data or correction of submission errors, as
validation features in the system will flag common errors prior to
transmission. As DEA has not tracked the number of delays or the
duration of such delays, DEA does not have a basis to quantify the cost
savings.
Furthermore, this final rule eliminates the need to print paper
forms and transmit by mail or courier service, generating an estimated
cost savings of $13.27 per each paper application not submitted.\36\
DEA assumes the cost savings associated with eliminating

[[Page 47578]]

printing costs and envelopes is negligible. This final rule also
eliminates the need to get a notary for new applications, which will
save $5.00 each for applications for registrant and coordinator
roles.\37\ An application for the Power of Attorney role does not
require a notary; and while there would be no notary cost savings for
these applications, $5 cost savings is included in the analysis to be
conservative and because applications for registrant and coordinator
roles are slightly more than half of all applications.
---------------------------------------------------------------------------

\36\ Note 18.
\37\ Note 20.
---------------------------------------------------------------------------

As discussed in the E.O. 12866 section above, DEA estimates that
the time savings from this final rule will save $117.52 per new and
renewal application.
Total cost savings for a new application is $135.797 (117.52 +
13.27 + 5.00 = 135.79), as can be seen in Table 9.

Table 9--Cost Savings per New Application
----------------------------------------------------------------------------------------------------------------
Cost savings
Current ($) New ($) ($)
----------------------------------------------------------------------------------------------------------------
Labor cost per New app.......................................... 282.06 164.54 117.52
Postage cost per app............................................ 13.27 .............. 13.27
Cost of notary.................................................. 5.00 .............. 5.00
-----------------------------------------------
Total....................................................... .............. .............. 135.79
----------------------------------------------------------------------------------------------------------------

As also calculated in the E.O. 12866 section above, total cost
savings for renewals is $117.52, as can be seen in Table 10.

Table 10--Cost Savings per Renewal Application
----------------------------------------------------------------------------------------------------------------
Cost savings
Current ($) New ($) ($)
----------------------------------------------------------------------------------------------------------------
Labor cost per Renewal app...................................... 141.03 23.51 117.52
-----------------------------------------------
Total....................................................... .............. .............. 117.52
----------------------------------------------------------------------------------------------------------------

There were 31,172 new applications in 2021. DEA estimates there
were also 62,344 renewal applications for a total of 93,516
applications. Given there are 94,011 CSOS participating entities, there
is less than one application per year per entity on average (93,516/
94,011 = 0.99). Given that there are at approximately 325,000 active
digital certificates, the vast majority of which are on three-year
renewal cycles, DEA expects approximately 108,333 certificates to be
renewed annually (325,000/3 = 108,333). There are then approximately
1.15 certificates per entity (108,333/94,011 = 1.15). Given that
smaller firms should have less certificates than larger firms, DEA
believes using one certificate or one application per entity per year
is a reasonable assumption for the smallest of small entities.
To determine whether the final rule would have a significant
economic impact on small entities, DEA conducted a revenue test by
comparing the estimated annual cost savings to the average annual
revenue for the smallest of small entities in industries affected by
the final rule. Based on the Statistics of U.S. Businesses data from
the Census Bureau, table 11 lists the enterprise size, number of
establishments, and the average annual revenue for the smallest of
small businesses in each industry sector.<SUP>38 39</SUP>
---------------------------------------------------------------------------

\38\ Census Bureau, Statistics of U.S. Businesses Revenue Data
by Size, 2017. <a href="https://www.census.gov/programs-surveys/susb.html">https://www.census.gov/programs-surveys/susb.html</a>.
(Released 5/28/2021).
\39\ Census Bureau, Statistics of U.S. Businesses Number of
Establishment Data by Size, 2021. <a href="https://www.census.gov/programs-surveys/susb.html">https://www.census.gov/programs-surveys/susb.html</a>. (Released 12/21/2022).

Table 11--Average Annual Revenue of Smallest of Small Entities
----------------------------------------------------------------------------------------------------------------
Average revenue
Enterprise size Number of per
NAICS NAICS description (number of establishments establishment ($
employees) thousands)
----------------------------------------------------------------------------------------------------------------
325411...................... Medicinal and Botanical 0-4 303 690
Manufacturing.
325412...................... Pharmaceutical Preparation 0-4 398 1,173
Manufacturing.
424210...................... Drugs and Druggists' Sundries 0-4 4,131 1,512
Merchant Wholesalers.
445110...................... Supermarkets and Other Grocery 0-4 20,420 519
(except Convenience) Stores.
446110...................... Pharmacies and Drug Stores.... 0-4 7,118 1,328
452210...................... Department Stores............. 0-4 3 467
452311...................... Warehouse Clubs and 0-4 25 475
Supercenters.
541380...................... Testing Laboratories.......... 0-4 2,446 316
541715...................... Research and Development in 0-4 5,243 449
the Physical, Engineering,
and Life Sciences (except
Nanotechnology and
Biotechnology).
562213...................... Solid Waste Combustors and 0-4 17 949
Incinerators.
562219...................... Other Nonhazardous Waste 0-4 299 580
Treatment and Disposal.
611310...................... Colleges, Universities, and 0-4 526 802
Professional Schools.
621111...................... Offices of Physicians (except 0-4 80,722 465
Mental Health Specialists).

[[Page 47579]]

621112...................... Offices of Physicians, Mental 0-4 9,836 291
Health Specialists.
621330...................... Offices of Mental Health 0-4 28,428 165
Practitioners (except
Physicians).
621420...................... Outpatient Mental Health and 0-4 4,015 248
Substance Abuse Centers.
621491...................... HMO Medical Centers........... 0-4 79 98
621493...................... Freestanding Ambulatory 0-4 2,001 666
Surgical and Emergency
Centers.
622110...................... General Medical and Surgical 0-4 215 15,559
Hospitals.
622210...................... Psychiatric and Substance 0-4 9 1,024
Abuse Hospitals.
622310...................... Specialty (except Psychiatric 0-4 13 1,965
and Substance Abuse)
Hospitals.
----------------------------------------------------------------------------------------------------------------

The estimated cost savings of $135.79 for new applications and
$117.52 for renewal applications were compared to the average annual
revenue for each of the NAICS codes in Table 11. For example, taking
the smallest possible entities, HMO Medical Centers with 0-4 people,
with an average revenue of $98,000, the benefit, in the form of cost
savings, from new applications is $133.97 (116.27 + 12.70 + 5 =
133.97), or 0.14 percent of revenues (133.69/98,000 = 0.0014). The
benefit from renewals is 0.12 percent of revenues (116.27/98,000 =
0.0012). Table 12 details the revenue test results for all affected
NAICS codes.

Table 12--Revenue Test of Smallest of Small Entities
----------------------------------------------------------------------------------------------------------------
Average Benefit from Benefit from
revenue per new Percent of renewal Percent of
NAICS NAICS description establishment applications revenue (%) applications revenue (%)
($ thousands) ($) ($)
----------------------------------------------------------------------------------------------------------------
325411............. Medicinal and 690 133.97 0.02 116.27 0.02
Botanical
Manufacturing.
325412............. Pharmaceutical 1,173 133.97 0.01 116.27 0.01
Preparation
Manufacturing.
424210............. Drugs and Druggists' 1,512 133.97 0.01 116.27 0.01
Sundries Merchant
Wholesalers.
445110............. Supermarkets and 519 133.97 0.02 116.27 0.02
Other Grocery
(except Convenience)
Stores.
446110............. Pharmacies and Drug 1,328 133.97 0.01 116.27 0.01
Stores.
452210............. Department Stores.... 467 133.97 0.03 116.27 0.02
452311............. Warehouse Clubs and 475 133.97 0.03 116.27 0.02
Supercenters.
541380............. Testing Laboratories. 316 133.97 0.04 116.27 0.03
541715............. Research and 449 133.97 0.03 116.27 0.02
Development in the
Physical,
Engineering, and
Life Sciences
(except
Nanotechnology and
Biotechnology).
562213............. Solid Waste 949 133.97 0.01 116.27 0.01
Combustors and
Incinerators.
562219............. Other Nonhazardous 580 133.97 0.02 116.27 0.02
Waste Treatment and
Disposal.
611310............. Colleges, 802 133.97 0.02 116.27 0.01
Universities, and
Professional Schools.
621111............. Offices of Physicians 465 133.97 0.03 116.27 0.02
(except Mental
Health Specialists).
621112............. Offices of 291 133.97 0.04 116.27 0.04
Physicians, Mental
Health Specialists.
621330............. Offices of Mental 165 133.97 0.08 116.27 0.07
Health Practitioners
(except Physicians).
621420............. Outpatient Mental 248 133.97 0.05 116.27 0.04
Health and Substance
Abuse Centers.
621491............. HMO Medical Centers.. 98 133.97 0.13 116.27 0.11
621493............. Freestanding 666 133.97 0.02 116.27 0.02
Ambulatory Surgical
and Emergency
Centers.
622110............. General Medical and 15,559 133.97 0.00 116.27 0.00
Surgical Hospitals.
622210............. Psychiatric and 1,024 133.97 0.01 116.27 0.01
Substance Abuse
Hospitals.
622310............. Specialty (except 1,965 133.97 0.01 116.27 0.01
Psychiatric and
Substance Abuse)
Hospitals.
----------------------------------------------------------------------------------------------------------------

As shown in Table 12, the revenue test for the smallest of small
entities (0-4 employees) ranges from 0.00 percent with rounding for
NAICS code 622110 to 0.13 percent for NAICS code 621491. Therefore, the
economic impact of this final rule is not significant for the smallest
of small entities, and the economic impact is estimated to be not
significant on any small entity.
In conclusion, while the final rule impacts a substantial number of
small entities in at least some industries, the economic impact will
not be significant. Therefore, this final rule will not have a
significant economic impact on a substantial number of small entities.

Unfunded Mandates Reform Act of 1995

In accordance with the Unfunded Mandates Reform Act of 1995
(UMRA),\40\ DEA has determined that this action would not result in any
Federal mandate that may result ``in the expenditure by State, local,
and tribal governments, in the aggregate, or by the private sector, of
$100,000,000 or more (adjusted annually for inflation) in any 1 year.''
Therefore, neither a Small

[[Page 47580]]

Government Agency Plan nor any other action is required under the UMRA.
---------------------------------------------------------------------------

\40\ 2 U.S.C. 1501 et seq.
---------------------------------------------------------------------------

Paperwork Reduction Act

This final rule will modify existing collection(s) of information
requirement under the Paperwork Reduction Act (PRA).\41\ The final rule
will combine all information collection into one on-line enrollment
process eliminating the need for individual forms. Pursuant to the
PRA,\42\ DEA has identified the collections of information below
related to this final rule. A person is not required to respond to a
collection of information unless it displays a valid OMB control
number.\43\
---------------------------------------------------------------------------

\41\ 44 U.S.C. 3501-3521.
\42\ 44 U.S.C. 3507(d).
\43\ Copies of existing information collections approved by OMB
may be obtained at <a href="http://www.reginfo.gov/public/do/PRAMain">http://www.reginfo.gov/public/do/PRAMain</a>.
---------------------------------------------------------------------------

A. Collections of Information Associated With the Final Rule
1. Title: CSOS Certificate Application.
OMB Control Number: 1117-0038.
Form Number: DEA-251.
DEA is amending its regulations to require that all CSOS
applications and supporting materials must be submitted to DEA through
the DEA Diversion Control Division secure network application. This
amendment will improve the submission process by aligning it with DEA's
current requirements for other online form submissions. The online
submission of applications and supporting material through the secure
database will ensure DEA's receipt of documentation in a more timely
and organized manner. This combined online form will be used for all
CSOS user roles: DEA Registrant, Principal Coordinator/Alternate
Coordinator, and Power of Attorney.
DEA estimates the following number of respondents and burden
associated with this collection of information:
<bullet> Number of respondents: 94,011.
<bullet> Frequency of response: 0.994735 (as needed,
calculated).\44\
---------------------------------------------------------------------------

\44\ Calculated by dividing the number of responses (93,516) by
the number of respondents (94,011).
---------------------------------------------------------------------------

<bullet> Number of responses: 93,516.
<bullet> Burden per response: 0.75.\45\
---------------------------------------------------------------------------

\45\ Weighted average of new and renewal applications. There are
31,172 new applications and they take 1.75 hours. There are 62,344
renewals and they take 0.25 hours. New applications represent 33
percent of applications (31,172/93,516 = 0.33) and renewals
represent 67 percent of applications (62,344/93,516 = 0.67). The
weighted average is then 0.75 ([0.33 x 1.75] + [0.67 * 0.25] =
0.75).
---------------------------------------------------------------------------

<bullet> Total annual hour burden: 70,137.
If you need additional information, please contact the Regulatory
Drafting and Policy Support Section (DPW), Diversion Control Division,
Drug Enforcement Administration; Mailing Address: 8701 Morrissette
Drive, Springfield, Virginia 22152; Telephone: (571) 362-3261.
Any comments on this collection of information may be sent in
writing to the Office of Information and Regulatory Affairs, OMB,
Attention: Desk Officer for DOJ, Washington, DC 20503. Please state
that your comments refer to RIN 1117-AB79/Docket No. DEA-732.

Congressional Review Act

This final rule is not a major rule as defined by section 804 of
the Congressional Review Act (hereinafter, ``CRA''). This rule will not
result in an annual effect on the economy of $100,000,000 or more; a
major increase in costs or prices for consumers, individual industries,
Federal, State, or local government agencies, or geographic regions; or
significant adverse effects on competition, employment, investment,
productivity, innovation, or on the ability of the United States-based
enterprises to compete with foreign-based enterprises in domestic and
export markets. 5 U.S.C. 804. Pursuant to the CRA, the DEA has
submitted a copy of the Final Rule to both Houses of Congress and to
the Comptroller General.

List of Subjects in 21 CFR Part 1311

Administrative practice and procedure, Control substances, Drug
traffic control, Prescription drugs, Reporting and recordkeeping
requirements.

For the reasons stated in the preamble, DEA amends 21 CFR part 1311
as follows:

PART 1311--REQUIREMENTS FOR ELECTRONIC ORDERS AND PRESCRIPTIONS

0
1. The authority citation for part 1311 continues to read as follows:

Authority: 21 U.S.C. 821, 828, 829, 871(b), 958(e), 965, unless
otherwise noted.

0
2. Amend Sec. 1311.20 by revising paragraphs (b) and (c) to read as
follows:

Sec. 1311.20 Coordinators for CSOS digital certificate holders.

* * * * *
(b) If the designated coordinator changes at any time, the
Certification Authority must immediately be notified of the change and
the new responsibilities assumed by each of the registrant's
coordinators, if applicable. New Coordinators must complete the online
application as provided in Sec. 1311.25.
(c) The registrant's coordinator must inform the Certification
Authority of all digital certificate applications, renewals and
revocations for the registrant's users and approve applicants applying
for a power of attorney digital certificate for a DEA registrant by
means instructed by the Certification Authority within the system.

0
3. Revise Sec. 1311.25 to read as follows:

Sec. 1311.25 Requirements for obtaining a CSOS digital certificate.

(a) To obtain a certificate to use for signing electronic orders
for controlled substances, a registrant, coordinator, or person with
power of attorney authorized to obtain a certificate for signing
electronic orders for controlled substances for a registrant must
complete the online enrollment process at <a href="http://www.deaecom.gov">www.deaecom.gov</a> by:
(1) Completing the online identification proofing process;
(2) Providing a current listing of DEA registrations for which the
individual has authority to sign controlled substances orders.
(3) Uploading all copies of the power of attorney forms authorized
by the registrant, when applicable.
(4) Acknowledging that the applicant has read and understands the
Subscriber Agreement and agrees to all terms contained in the Statement
of Subscriber Obligations contained online.
(b) When the Certification Authority verifies the applicant's
identity and employment and approves the application, it will send the
applicant a one-time use reference number and access code, via separate
channels, and information on how to use them. Using this information,
the applicant must then electronically submit a request for
certification of the public digital signature key. After the request is
approved, the Certification Authority will provide the applicant with
the signed public key certificate.
(c) Once the applicant has generated the key pair, the
Certification Authority must prove that the user has possession of the
key. For public keys, the corresponding private key must be used to
sign the certificate request. Verification of the signature using the
public key in the request will serve as proof of possession of the
private key.

0
4. Amend Sec. 1311.40 by revising paragraphs (c) and (d) to read as
follows:

Sec. 1311.40 Renewal of CSOS digital certificates.

* * * * *
(c) If a CSOS certificate holder applies for a renewal before the
certificate expires, the certificate holder may renew online at
<a href="http://www.deaecom.gov">www.deaecom.gov</a> twice. For every third renewal, the

[[Page 47581]]

CSOS certificate holder must submit a new application and
documentation, as provided in Sec. 1311.25.
(d) If a CSOS certificate expires before the holder applies for a
renewal, the certificate holder must submit a new application and all
required documentation, as provided in Sec. 1311.25.

Sec. 1311.60 [Amended]

0
5. Amend Sec. 1311.60 by removing paragraph (c).

Signing Authority

This document of the Drug Enforcement Administration was signed on
September 30, 2025, by Administrator Terrance Cole. That document with
the original signature and date is maintained by DEA. For
administrative purposes only, and in compliance with requirements of
the Office of the Federal Register, the undersigned DEA Federal
Register Liaison Officer has been authorized to sign and submit the
document in electronic format for publication, as an official document
of DEA. This administrative process in no way alters the legal effect
of this document upon publication in the Federal Register.

Heather Achbach,
Federal Register Liaison Officer, Drug Enforcement Administration.
[FR Doc. 2025-19325 Filed 10-1-25; 8:45 am]
BILLING CODE 4410-09-P

</pre></body>
</html>

View on FederalRegister.gov →Plain-text source

Indexed from Federal Register on October 2, 2025.

This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.