By Justin Abril, Principal, Vatic Global Advisors

I have spent about a decade working as a regulatory officer for one of the first DEA registered Schedule I cannabis operations, the same facility my co-founder Nigel Boast, LLB, MBA, later carried to EU GMP and export readiness. The story out of Mississippi this month is one I have been expecting since the Final Order rescheduled state medical cannabis earlier this year.

Conflicts between state and federal law were inevitable, given that states permit certain actions by their licensees that federal law does not, employment practices being one of them. I saw it firsthand when we first entered the federal framework. At the time we could not hire anyone who had participated in a state cannabis program, medical included, so we consulted foreign cannabis operators instead to stay federally compliant. The lesson then is the same one now. Even where state law allows a practice, DEA will object when that practice weighs against the public interest factors every registrant is measured against.

What rescheduling actually did

The April 2026 final order moved marijuana covered by a state medical license into Schedule III and left adult use in Schedule I. It created a registration pathway for state licensed manufacturers, distributors, and dispensers, and it leaned on state infrastructure wherever it reasonably could. Under 21 CFR 1301.13(k)(2), a state license is conclusive evidence of state law authorization.

What it did not do is create an excepted category for cannabis DEA registrants. Medical cannabis applicants are subject to the same regulations that have governed pharmacies, hospitals, and drug manufacturers for fifty years.

The Mississippi dispute

Marijuana Moment recently reported that Nicole Huff, CEO of Wildflower Medical Dispensary in Aberdeen, received an email from the Diversion Investigator (DI) handling their application, flagging two Wildflower employees with felony convictions. The DI gave the dispensary three options: waive expedited processing and seek an employment waiver, withdraw the application, or send the matter to headquarters for an Order to Show Cause before an administrative law judge. Huff intends to seek waivers for both employees, arguing that they have worked more than a year without incident and were on staff before the application was filed.

I understand the argument, but I also know how DEA enforces the regulation.

The rule

21 CFR 1301.76(a) provides that a registrant shall not employ, as an agent or employee who has access to controlled substances, any person convicted of a felony offense relating to controlled substances, or who has had a DEA application denied, a registration revoked, or a registration surrendered for cause. Exceptions can be requested in writing, where DEA considers whether diversion is unlikely, the nature of the offense, the degree of access involved, and the safeguards the registrant already has in place.

Non-practitioners carry a parallel obligation under 21 CFR 1301.90, which assumes two questions in any screening program. One covers felony convictions in the past five years, misdemeanors in the past two, and pending charges. The other covers unauthorized use of narcotics, amphetamines, or barbiturates in the past three years. DEA’s registrant letter clarifying that section confirms it reaches prospective employees at a registered location where controlled substances are handled, and not employees at unregistered locations such as corporate offices. That same letter states that disclosed information will not necessarily preclude employment and is weighed as part of an overall evaluation.

DEA recognizes the value of workforce reentry for convicted felons, and its clarification of the screening rule was issued for that reason. The requirement reaches registered locations where controlled substances are stored, distributed, manufactured, or otherwise handled. It does not reach corporate offices, administrative offices, or unrestricted areas.

In practice, the screening questions belong in the application for employment itself, paired with a signed authorization allowing inquiries of courts and law enforcement agencies, and with plain language telling the applicant that a disclosure will not automatically end the process while an omission will. The list of people with access to controlled substances should be short, current, and defensible, because every name on it is a name a Diversion Investigator will ask about.

Why state law does not resolve employment issues

Registrant eligibility is a federal question and the rescheduling order’s deference to state practice is limited to specific categories covering reports, records, ordering, state patient certifications, labeling, packaging, disposal, and physical security. Employee and owner eligibility appears nowhere in that list.

Congress settled this in 1970 under 21 U.S.C. 903, where state law stands only where it can consistently align together with federal provisions, and a state that affirmatively permits employment the federal rule forbids cannot. Every applicant is also subject to the public interest factors in 21 U.S.C. 823, which for dispensing registrations include compliance with federal law relating to controlled substances and any other conduct that may threaten public health and safety. State permission does not remove those factors from DEA’s analysis, and I would not advise any operator to proceed as though it does.

Mississippi happens to bar employment of anyone convicted of a disqualifying felony under its own medical cannabis statute, so both regimes point the same direction there. The dispute is over which felonies disqualify whom, and DEA has no obligation to harmonize the two.

What I tell operators

Screen every owner, officer, and employee against the federal standard before you file. Build the screening questions into hiring at every registered location. Decide which positions actually require access to controlled substances, because the rule focuses on access rather than on employment, and job design is one of the few areas you still control. Where a waiver is warranted, prepare it alongside the application rather than under a four day deadline from a Diversion Investigator.

An operator in Huff’s position should be documenting how access is controlled at the facility rather than arguing about how long an employee has been on staff, because access and safeguards are what DEA weighs. For everyone still preparing to file or is under evaluation, the same review of your staff liabilities should be done now, don’t wait until you get a letter like Wildflower.

Registration delivers the benefits and the obligations at the same time. Anyone who has operated under a DEA registration already knows that. The operators entering the system now are learning it in public.

Personnel and ownership screening is part of every Vatic Global Advisors engagement, whether you are preparing to file or already have an application pending with DEA, and Nigel covers the EU GMP and GACP standards international regulators expect once global trade is established. If you want your employee list reviewed, or other aspects of your application, schedule a time with us.

Sources

Back to Insights

When DEA Registration Collides With State Law