Controlled substances DEA Schedule II–V — how does CSOS integrate?

CSOS (Controlled Substance Ordering System) is the DEA’s electronic equivalent of the paper DEA Form-222 for Schedule II ordering between DEA registrants (manufacturer → distributor → pharmacy). Required if you sell Schedule II to other registrants.

Magento integration:

• Buyer-account validation at registration: DEA registration number checked against DEA “Active Registrants” database via DEA’s subscription API (~$300/yr), state board license validated, business address geocoded and matched. Mismatch = signup blocked.
• Buyer’s CSOS digital certificate (X.509, issued by DEA) — uploaded to buyer profile, used to digitally sign each Schedule II order. CSOS certificate expiry triggers admin alert + buyer email at 60 / 30 / 7 days out.
• Schedule II checkout — buyer signs the order with their CSOS certificate, signature embedded in a CSOS-formatted XML order, transmitted to the seller’s Magento. Seller’s admin reviews, signs the response, ships.
• Suspicious order monitoring (SOM) — per Combat Online Pharmacy Consumer Protection Act + DEA expectations: any order >3× the buyer’s 12-month average for that drug, or any order containing both an opioid + benzodiazepine + skeletal muscle relaxant ("Holy Trinity"), triggers a hold + manual review. Ignoring SOM is what got distributors fined $260M+ in 2018–2024.

Schedule III–V is simpler — no CSOS, but DEA recordkeeping (Form 41 destruction, biennial inventory, transfer records) still required. State-by-state quirks layer on: pseudoephedrine quantity caps under CMEA, Massachusetts Schedule III tracking, MAT-prescriber-only buprenorphine rules in many states.