DEA license verification: what a registration covers and what the file should hold

You open the Drug Enforcement Administration's registration validation tool to confirm a new physician's registration, and the login page asks for a DEA number of your own, adding: "You will need information from your registration certificate in order to login" [1]. A staffing agency with no registration has no number to enter, so DEA license verification has to start somewhere else.

DEA's own term is registration, and what it issues is a Certificate of Registration, DEA Form 223 [2]. The registration rests on a state license to practice and prescribe controlled substances [3], and this guide uses DEA's term from here on.

A DEA registration lookup needs a registrant login or an approved data-use request

Two validation tools sit on DEA's Registration page, an individual registrant verification and a download of registrant datasets "for in-house verifications", and both are marked "DEA Registrant restricted access". The page states: "Access is restricted to DEA Registrants. Access verification will be conducted during the login process" [4].

A hospital holding its own registration can log in. A staffing agency or health plan without one cannot use that login, and the page does not mention the route DEA keeps for such organizations [4]. That route is the Registration for Controlled Substances Act Data-Use Request. DEA's Federal Register notice of April 13, 2026 says it "allows non-registrants to register for access to the CSA Database System, which gives the names and registration statuses of all DEA-registrants", and that applicants re-apply annually [17]. The Office of Management and Budget's record shows the collection approved until August 31, 2028 [18].

The request form on that record, marked V11.03.2021, offers an online validation tool, a full dataset download or both to listed groups that include "Entities providing credentialing or verification services to the Pharmaceutical and Healthcare industry". It offers a limited download that "Does not contain DEA Numbers or Expiration Dates" to applicants who can show a need to know. The form says to return it, completed, by email to DEA, and DEA's supporting statement says the blank form "will be emailed to the applicant upon their request" [18]. No DEA web page read for this guide says where to ask for the form or how long approval takes, so ask for the current form and where to send it through the help address on DEA's Registration page [4]. What the online validation tool displays is not described in these documents.

Before the request existed, the data was sold through the National Technical Information Service, known as NTIS. DEA's supporting statement says it ended that arrangement, and that "As of November 17, 2020, NTIS no longer had access to the CSA Dataset" [18]. NCQA, the National Committee for Quality Assurance, stopped accepting NTIS from the same date, saying "NTIS is no longer an acceptable source to verify a practitioner's DEA certificate is valid" [5]. Chapter 6 of the Medicare Managed Care Manual from the Centers for Medicare and Medicaid Services, dated April 27, 2007, still names the NTIS database as a source, alongside "obtaining a copy of the certificate" [6].

The Joint Commission's public hospital requirements, in the report generated September 30, 2025, do not name DEA registration [8]. NCQA's current standards are a licensed publication and could not be read for this guide. Its 2017 FAQ, which predates the data-use request and is tied to the 2017 and 2018 health plan standards, accepted a photocopy of the certificate "because the DEA does not provide phone or written verification" [7]. For DEA license verification at an organization that has neither a registration nor approved access, the certificate is the working evidence, and the file should record when it was read and by whom.

A DEA registration covers one state

In answer EO-DEA089, dated October 21, 2020, DEA says a practitioner registration "is based on a State license to practice medicine and prescribe controlled substances" and "cannot authorize controlled substance dispensing outside the State" [3]. For a practitioner with practice locations in several states, EO-DEA181, dated November 2, 2020, says "DEA requires that the practitioner obtain a separate DEA registration in each state", and that state authorization to handle controlled substances must come first [3].

Inside one state, DEA's 2023 Practitioner's Manual says no further registration is needed at other locations where the practitioner "only prescribes controlled substances" [9]. The exception stops at the state line.

An invented case shows the mechanism. A physician with a practice in one state takes a locum tenens assignment at a hospital in another, and the file holds one current certificate with an address in the first. On DEA's wording, it does not authorize prescribing at the new hospital. Two routes appear in DEA's rules: a registration in the second state, after that state's authorization, or prescribing under the hospital's registration. The second is open to "an agent or employee of a hospital or other institution" on conditions that include the hospital verifying the practitioner's authority in the jurisdiction and assigning an internal code as a suffix to its DEA number [2]. Each hospital assigns its own codes, which is part of why locum tenens credentialing starts over at every facility.

Some states add their own registration. DEA's table lists 25 jurisdictions, 22 states plus the District of Columbia, Guam and Puerto Rico, under "Second CS License Requirement", meaning a state controlled substance license as well as the professional one, and 28 states under "One License Requirement" [10]. The page is undated, so confirm each rule with the state.

MATE Act training is attested on the form, and DEA collects no training evidence

Training under the Medication Access and Training Expansion Act, known as the MATE Act, covers the treatment and management of patients with opioid or other substance use disorders [13] [14]. A final rule published June 9, 2026 placed it in DEA's registration regulation [11]: 21 CFR 1301.11(c) makes it "a condition on registration" for practitioners licensed under state law to prescribe controlled substances, other than those who are solely veterinarians [2] [12]. It applies from the first registration or renewal on or after June 27, 2023, and "No qualified practitioner is required to complete the training more than once" [2].

DEA's MATE Act Q&A says "practitioners will be required to check a box on their online DEA registration form", and that this affirmation "will not be a part of future registration renewals" [13].

In July 2026 the Justice Department's Office of the Inspector General reported that all 14 specialists it interviewed confirmed DEA "does not collect or request any training documentation or evidence, other than the attestation". Because DEA requires only the attestation, the audit concludes, it "cannot verify an applicant's actual compliance with this federal law unless an investigation is initiated" [14]. A registration issued or renewed since June 27, 2023 shows that the provider attested, and no more.

No federal source read for this guide places a duty on an employer or credentialing body to collect that evidence, so asking for it is a policy choice the file should record.

The inspector general found about 1.5 million renewals approved without a second review

The same audit, report 26-069, found that "Between FYs 2022 and 2024, approximately 1.5 million renewal applications were auto-approved by the system without a secondary review by a Specialist or Diversion Investigator" [14].

The auditors also checked state licensure for 300 medical practitioners, 30 from each of 10 states: "297 of the 300 applicants had active licenses to practice within their respective states. The remaining three applicants held a DEA registration with an expired state license" [14]. The finding applies to that sample of 300 only. For the file, it means the state license gets its own primary source check, separate from the DEA registration.

DEA registrations expire on the last day of a month

As of November 2026, the practitioner fee is $888 for a three-year registration, the figure in both the regulation and the audit [2] [14]. The first period can run "not less than 28 months nor more than 39 months" from registration and ends on the last day of a month; later periods run 36 months [2]. The expiration date has to be read from the certificate or another record of it, since it cannot be worked out from the issue date.

The renewal chain, from DEA's email reminders to the one-month reinstatement window [4], is covered in how a DEA registration lapses between checks.

Telemedicine prescribing rests on the same registration. As of November 11, 2026, the fourth temporary extension of the COVID-19 telemedicine flexibilities lets a DEA-registered practitioner prescribe Schedule II to V medications by telemedicine without a prior in-person evaluation, where the registration covers the class of drug prescribed [15]. That extension expires at the end of December 31, 2026, and no successor had been published by November 11, 2026. The onboarding side is in why telehealth onboarding takes longer than it should.

What a credentialing file should hold after DEA license verification

NAMSS, the National Association Medical Staff Services, says in its January 2024 credentialing standards that DEA and state controlled substance certificates should be primary-source verified "within 180 days prior to the credentialing decision" [16]. For each provider, the file should hold:

• Each DEA registration held, with "issuing state, status, registration number, and issue and expiration dates", and schedules that NAMSS says "should be appropriate for the applicant's practice" [16].
• Both certificates where a registration was modified, since DEA issues a new one that the registrant keeps "with the old certificate of registration until expiration" [2].
• The state controlled substance registration, where the state requires one.
• The date and method of verification, and who carried it out.
• For a provider prescribing under a hospital's registration, the hospital's authorization and the internal code.
• For a provider who does not prescribe, their statement, which the CMS manual treats as making the item "not applicable". For a pending certificate, the arrangement under which "other DEA-certified contracted practitioners write all prescriptions that require a DEA number" [6].
• Any MATE Act training evidence your organization has chosen to collect.

The rest of the file is set out in what a complete credentialing file contains.

Keeping each DEA certificate and its expiration date in view

Keeping that file current is mostly document work. Credentially reads each document as it arrives and matches it to the requirement it satisfies, capturing the relevant details. Its ongoing compliance monitoring covers state license status and document expirations in the background, alerting your team when something changes or needs action, and each check is recorded as it happens. Decisions that need a person, such as whether a locum's prescribing route holds at a new hospital, come back to your credentialing team.

At Health Carousel, a US staffing agency, credentialing time came down to 10 business days against an industry average of 15 to 20. Brittany, Director of Credentialing, said: "Previously, we outsourced or paid providers for updates on licenses and credentials. Now, with Credentially, it's all in-house".

To see how documents are matched to requirements and expirations are tracked, bring your DEA license verification checklist to a demo.

Frequently asked questions

Is there a public DEA registration lookup for organizations that are not registrants?

DEA's validation tool and registrant datasets sit behind a login that asks for the user's own DEA number. An organization that is not a registrant can apply through the Registration for Controlled Substances Act Data-Use Request, which DEA says gives the names and registration statuses of registrants and has to be renewed annually. Without that access, the file rests on the certificate and the date it was checked.

Does a provider need a separate DEA registration in every state?

DEA requires a separate registration in each state where a practitioner has a practice location, and the state's authorization to handle controlled substances comes first. A registration based on one state's license cannot authorize dispensing outside it. Within one state, an extra location where the practitioner only prescribes does not need its own registration.

Which states require a state controlled substance registration as well?

DEA's undated table lists 25 jurisdictions with a second controlled substance license requirement: Alabama, Connecticut, Delaware, the District of Columbia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Louisiana, Maryland, Massachusetts, Michigan, Missouri, Nevada, New Jersey, New Mexico, Oklahoma, Puerto Rico, Rhode Island, South Carolina, South Dakota, Utah and Wyoming. Confirm each requirement with the state.

Does a current DEA registration prove a provider completed MATE Act training?

It shows the provider attested, by checking a box on the online registration form. DEA does not ask for training certificates, and the Justice Department's inspector general reported in July 2026 that DEA "cannot verify an applicant's actual compliance with this federal law unless an investigation is initiated". Any further evidence is your organization's choice to collect.

References

1. DEA Diversion Control Division, CSA Registration Tools: Login, undated, read November 11, 2026, https://apps.deadiversion.usdoj.gov/webforms2/spring/validationLogin
2. Electronic Code of Federal Regulations, 21 CFR Part 1301, Registration of Manufacturers, Distributors, and Dispensers of Controlled Substances (sections 1301.11, 1301.13, 1301.22, 1301.35 and 1301.51), current to November 9, 2026, https://www.ecfr.gov/current/title-21/chapter-II/part-1301
3. DEA Diversion Control Division, Registration Q&A, entries EO-DEA089 (October 21, 2020) and EO-DEA181 (November 2, 2020), https://www.deadiversion.usdoj.gov/faq/registration-faq.html
4. DEA Diversion Control Division, Registration, undated, read November 11, 2026, https://www.deadiversion.usdoj.gov/drugreg/registration.html
5. NCQA, Corrections, Clarifications and Policy Changes to the 2020 UM-CR-PN Standards and Guidelines, November 23, 2020, https://wpcdn.ncqa.org/www-prod/wp-content/uploads/2020/11/20201123_2020_UM-CR-PN_Policy_Updates.pdf
6. Centers for Medicare and Medicaid Services, Medicare Managed Care Manual, Chapter 6, Relationships With Providers, Rev. 82, April 27, 2007, https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/mc86c06.pdf
7. NCQA, FAQs, DEA or CDS Certificates, November 15, 2017, https://www.ncqa.org/FAQs/?faq=000010275&print=1
8. The Joint Commission, Joint Commission Requirements for Hospital Programs, report generated September 30, 2025, https://digitalassets.jointcommission.org/api/public/content/6af7e77646254ef89894bdb37ad730c7?v=e89f4141
9. DEA Diversion Control Division, Practitioner's Manual, 2023 Edition (EO-DEA226), revised 2023, https://www.deadiversion.usdoj.gov/GDP/(DEA-DC-071)(EO-DEA226)_Practitioner's_Manual_(final).pdf
10. DEA Diversion Control Division, Practitioner's State License Requirements, undated, read November 11, 2026, https://www.deadiversion.usdoj.gov/drugreg/reg_apps/pract-state-lic-require.html
11. Drug Enforcement Administration, Implementation of the Substance Use-Disorder Prevention That Promotes Opioid Recovery and Treatment for Patients and Communities Act of 2018: Dispensing and Administering Controlled Substances for Medication-Assisted Treatment, final rule, 91 FR 34754, June 9, 2026, https://www.federalregister.gov/documents/2026/06/09/2026-11526/implementation-of-the-substance-use-disorder-prevention-that-promotes-opioid-recovery-and-treatment
12. Electronic Code of Federal Regulations, 21 CFR 1300.01, Definitions relating to controlled substances, current to November 9, 2026, https://www.ecfr.gov/current/title-21/chapter-II/part-1300/section-1300.01
13. DEA Diversion Control Division, Opioid Use Disorder, MATE Act Q&A, first entry EO-DEA268 dated August 31, 2023, read November 11, 2026, https://www.deadiversion.usdoj.gov/faq/MATE_Act_faq.html
14. US Department of Justice, Office of the Inspector General, Audit of the Drug Enforcement Administration's Registration Process for Medical Practitioners, Audit Division 26-069, July 2026, https://www.oversight.gov/sites/default/files/documents/reports/2026-07/26-069_non508.pdf
15. Drug Enforcement Administration and Department of Health and Human Services, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, 90 FR 61301, December 31, 2025, https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled
16. NAMSS, The Ideal Credentialing Standards for Initial-Practitioner Applicants: Best-Practice Criteria and Protocol for Healthcare Organizations, January 2024, https://www.namss.org/Portals/0/NAMSS_1260700-23_ICS_Document_UpdateFINAL%20(1).pdf
17. Drug Enforcement Administration, Agency Information Collection Activities; Proposed eCollection; eComments Requested; Revision of a Previously Approved Collection; Title-Registration for Controlled Substances Act Data-Use Request, 30-day notice, 91 FR 18881, April 13, 2026, https://www.federalregister.gov/documents/2026/04/13/2026-07129/agency-information-collection-activities-proposed-ecollection-ecomments-requested-revision-of-a
18. Office of Information and Regulatory Affairs, Reginfo.gov, View ICR, Registration for Controlled Substances Act Data-Use Request, OMB control number 1117-0059, ICR reference 202407-1117-003, with DEA's supporting statement (uploaded August 14, 2025) and the request form (V11.03.2021), approved August 19, 2025, https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=202407-1117-003