Groucho Marx famously said, “I wouldn’t want to belong to a club that would have me as a member.” For years, many state-legal medical marijuana operators pleaded to be allowed into the club, essentially making this promise: “Bring us into the federal fold, and we’ll play by federal rules.”
Having finally gotten that wish, at least one Mississippi dispensary owner is finding out what “federal rules” really means. Not just lower tax bills and easier banking, but also 1970s-vintage security regulations that were written for pharmacies and hospitals, not for state-licensed cannabis dispensaries that weren’t allowed anywhere near a DEA registration until a few months ago.
The Setup: What Rescheduling Actually Did
As we’ve covered before, DEA’s April 2026 final rule moved FDA-approved marijuana products and marijuana covered by a state medical marijuana license into Schedule III, while leaving adult-use (recreational) marijuana in Schedule I.
The rule didn’t just relabel the drug and walk away. For the first time, it created a pathway for state-licensed medical marijuana businesses to register with DEA as manufacturers, distributors, or dispensers so they can operate under federal law rather than merely under a prosecutorial non-enforcement policy.
DEA went out of its way to say that a state license constitutes “conclusive evidence” of state-law authorization, and that state-required reports, records, order forms, labeling, packaging, disposal, and physical-security measures will generally substitute for the generally applicable federal versions of those requirements. The agency’s stated rationale was to leverage state regulatory infrastructure that has “matured significantly” over the last three decades, rather than build a parallel federal bureaucracy from scratch.
So far, so good. Except registering with DEA doesn’t just mean submitting a state license and collecting a certificate. It means becoming a DEA registrant subject to the same web of security regulations that has applied to every pharmacy, hospital, and drug manufacturer in the country for decades.
And buried in that web is 21 C.F.R. § 1301.76(a), which has nothing to do with cannabis and everything to do with who a registrant is allowed to put on the payroll.
The Mississippi Dispute
According to reporting from Marijuana Moment, Nicole Huff, CEO of Wildflower Medical Dispensary in Aberdeen, Mississippi, received an email from a DEA diversion investigator in the agency’s Jackson District Office. DEA had concluded that two of Wildflower’s employees have felony convictions, and that Wildflower has to pick one of three doors: (1) waive her right to expedited processing and seek an employment waiver; (2) withdraw her DEA application altogether; or (3) have the application shipped off to DEA headquarters for an Order to Show Cause proceeding before an administrative law judge in Washington, D.C.
Huff reportedly plans to fight it, requesting employment waivers for both workers and, if necessary, taking the case in front of an administrative law judge. Her argument, as reported, leans on the fact that both employees have worked at Wildflower for more than a year without incident, and Wildflower wants the court to recognize something akin to grandfathering in nonviolent offenders who were already on staff, in good standing, before the DEA application was submitted.
Whether or not that argument succeeds, the underlying regulation is worth sitting with for a second, because it did not appear out of nowhere for cannabis. Section 1301.76(a) provides that a DEA registrant “shall not employ, as an agent or employee who has access to controlled substances, any person who has been convicted of a felony offense relating to controlled substances,” or who has had a DEA registration denied, revoked, or surrendered for cause.
That is a flat prohibition, not a suggestion, and it has applied to every pharmacy and drug wholesaler in the country since the early 1970s. DEA regulations do contemplate waivers, but only where “there are valid reasons to believe that diversion is unlikely to occur,” weighed against factors like the nature of the prior offense, the extent of proposed access to controlled substances, and the registrant’s own security safeguards.
Be Careful What You Wish For?
After years of no banking access, no interstate commerce, no ordinary tax treatment under Section 280E, no federal registration, and no path to legitimacy, the industry’s collective complaint about the CSA boiled down to “let us in.”
Rescheduling addresses a big chunk of that wish. Section 280E no longer applies to state licensees who deal exclusively in FDA-approved or state-licensed marijuana, an actual registration pathway now exists, and DEA has said it intends to accept state-law compliance in lieu of duplicative federal paperwork wherever it reasonably can.
But “let us in” was always going to mean the whole regulatory apparatus, not just the parts that help. DEA registrants have never gotten to pick and choose which security regulations apply to them, and nothing in the rescheduling rule suggests cannabis businesses are getting a menu. Employee felony screening under Section 1301.76 sits alongside employee reporting obligations for suspected diversion, criminal background check procedures, and a whole subpart of physical security requirements that plenty of state-licensed dispensaries have never had to think about in quite the same terms. Federal registration is a package deal.
This isn’t a reason to think rescheduling was a mistake, and it isn’t an indictment of DEA for enforcing a rule that predates the cannabis industry by half a century. It’s simply what “joining the federal system” actually looks like on the ground: real benefits that arrive alongside real compliance burdens that don’t disappear just because the industry wanted the benefits more than it wanted the burdens.
Anyone who has spent time around other DEA-registered industries could have predicted this particular collision from a mile away. The surprise, if there is one, is only that it took until four months after the expedited registration window opened for it to become a public news story.
The Bigger Legal Question: Does Rescheduling Let DEA Override State Employment Law?
The Wildflower story raises a broader question worth working through carefully, because the answer isn’t quite as simple as “federal law wins.” If the entire premise of medical marijuana rescheduling is deference to state regulatory judgments, how can a federal employee-screening rule override state law on who a dispensary can hire?
Start with the CSA’s own preemption clause. Section 903 of the CSA provides that no provision of the act should be read as an intent by Congress “to occupy the field” to the exclusion of state law on the same subject, “unless there is a positive conflict between that provision of this subchapter and that State law so that the two cannot consistently stand together.” That is a narrow, conflict-based preemption standard, not field preemption. Congress built cooperative federalism into the CSA’s DNA in 1970, decades before anyone was drafting medical marijuana ballot initiatives.
The rescheduling rule leans into that same theme. DEA’s preamble describes state medical marijuana regulatory systems as having “matured significantly” over the last three decades and as maintaining licensing regimes with application review, inspections, and detailed recordkeeping that the agency treats as sufficient for federal purposes wherever the rule allows a state-law substitute.
Newly codified 21 C.F.R. § 1301.13(k)(2) goes so far as to make a state license “conclusive evidence” that the holder is authorized under state law. If deference to state judgment is the operating principle, why does the employee-felony rule get treated differently?
The answer starts with what the rescheduling rule actually deferred on and what it didn’t. Section 1301.13(k) is the provision creating the expedited registration pathway, and the deference it grants is narrower than the surrounding rhetoric might suggest. DEA carved out specific categories for state-law substitution: reports, records, and order forms under subsection (k)(4); the sufficiency of state-law patient certifications in place of federal prescriptions under (k)(5); labeling, packaging, and sealing under (k)(8); disposal under (k)(9); and physical-security requirements under (k)(10). Employee-eligibility screening under Section 1301.76 is conspicuously absent from that list.
DEA deferred to states on operational and recordkeeping mechanics, consistent with the public-interest factors in 21 U.S.C. § 823(e) through (g) that the agency must weigh when registering an applicant. But DEA did not purport to delegate, waive, or make state law a substitute for its own registrant-eligibility rules, including who a registrant may put on staff. That is a decision DEA reserved for itself, waiver process and all.
That distinction matters under Section 903’s positive-conflict test. Mississippi’s own Medical Cannabis Act is not a bad test case, because it turns out state and federal law aren’t actually pulling in opposite directions here. Mississippi law independently bars a medical cannabis establishment from employing anyone “convicted of a disqualifying felony offense” under its own statute.
So, in Mississippi specifically, there may be no positive conflict at all: Both sovereigns already agree, as a matter of policy, that certain felony convictions disqualify cannabis workers from certain roles. The live dispute in the Wildflower case isn’t really state law versus federal law; it’s two separate felony-screening regimes, state and federal, that don’t necessarily line up on which felonies disqualify whom, layered on top of each other with no obligation on DEA’s part to harmonize them.
Where a state’s law is more permissive than DEA’s, that’s exactly the harder Section 903 question. If a state statute affirmatively authorized employment that Section 1301.76 forbids, a positive conflict would exist under the CSA’s own preemption text: The registrant genuinely cannot comply with the federal registration condition and the state authorization simultaneously, at least not without a federal waiver bridging the gap. That is a conflict-preemption problem, not a field-preemption one, and the waiver mechanism in Section 1301.76 and DEA’s public interest factors under Section 823 are precisely the release valve the regulatory scheme provides for it. Employers in that position aren’t without recourse; they are pushed into the waiver and, if necessary, the administrative hearing process, which is exactly the door Huff says she intends to walk through.
Put differently: Rescheduling’s deference to state law was always deference within a system DEA still controls, not a wholesale handoff of authority. The CSA’s cooperative federalism, both in its 1970 preemption clause and in this rule’s implementation, tells DEA to accept state licensure as authorization, accept state recordkeeping as sufficient, and lean on state infrastructure wherever it reasonably can.
It does not require DEA to treat state employment law as displacing its own registrant-eligibility rules, and nothing in the rule’s text purports to do so. Registrants operating in states with employee-eligibility rules more permissive than Section 1301.76 aren’t shielded by state law. They are, at most, candidates for a waiver, and the waiver standard, not state law, remains the federal government’s to define and apply.
Conclusion
Medical marijuana operators finally have what they said they wanted (short of descheduling). Some of them are acting a bit like the dog who caught the car. Just another reminder the progress isn’t a straight line, but it doesn’t mean it’s not progress. Few other industries in American life are better prepared for persevering through evolving government policy. We got this.
Thanks for stopping by.