3PL Providers and Controlled Substances. How to Audit a Logistics Partner’s Right to Handle Narcotic Drugs
When outsourcing the storage and transportation of narcotic drugs (ND) and psychotropic substances (PS) to a third-party logistics (3PL) operator, a company hands off operational tasks. Liability stays with the cargo owner. It is the cargo owner’s license that gets revoked, even if the violation was committed by the warehouse due to an oversight, such as forgetting to renew a warehouse worker’s clearance. A driver-forwarder’s criminal record or an expired certificate of a private security company usually surfaces during a Roszdravnadzor inspection, after the contract has already been signed.
This is exactly why selecting a 3PL provider in this sector must rely on a comprehensive legal and technical audit. Commercial tariff evaluation is secondary here. Below, we break down what constitutes a logistics provider’s legal compliance and what an auditor needs to verify at every stage.
Why Checking a Logistics Provider Cannot Be Reduced to Commercial Due Diligence
The circulation of ND and PS is governed by Federal Law No. 3-FZ dated January 8, 1998, «On Narcotic Drugs and Psychotropic Substances» (hereinafter referred to as Federal Law No. 3-FZ). This law classifies the storage, transportation, and distribution of controlled substances as licensed activities and holds the legal entity in whose interest the circulation occurs liable for any violations.
For an employee whose actions lead to the theft or shortage of ND and PS, the law imposes financial liability amounting to one hundred times the direct damage caused to the employer. This rule, set out in Article 59 of Federal Law No. 3-FZ, illustrates the scale of risks embedded into the very structure of the industry and explains why the regulator demands verified eligibility from every participant in the supply chain.
Since 2022, the licensing of ND and PS has operated under a registry-based model. A paper license certificate is merely informational; legal validity rests entirely on the electronic entry in the official Roszdravnadzor registry. Verifying a counterparty simply by company name is unreliable due to potential name matches, so verification must be conducted using the Taxpayer Identification Number (INN) or Primary State Registration Number (OGRN).
The License and Registry as the First Screening Filter
Licensing activities related to the circulation of ND, PS, and precursors are regulated by Government Decree No. 1007 dated June 2, 2022, «On Licensing Activities Related to the Circulation of Narcotic Drugs, Psychotropic Substances, and Their Precursors, and the Cultivation of Narcotic Plants» (hereinafter referred to as Decree No. 1007). Licenses are issued for specific types of work, specific schedules of substances, and specific addresses. The mere formal existence of a license proves very little; therefore, the auditor’s primary task is to cross-reference its contents with the actual requirements of the cargo.
A typical mistake is uncovered at the intersection of schedules. A provider might hold the right to store Schedule III substances without the right to handle Schedule II, even though the cargo owner plans to store Schedule II substances in the warehouse. The difference in security requirements between these schedules is substantial. Employing an operator without the exact required line item in their license turns the logistics operation into a violation of the law, regardless of the parties’ intentions.
It is prudent to request the provider’s articles of association, an extract from the Unified State Register of Legal Entities (EGRYUL), and the license appendix listing the full scope of authorized works in advance. The basis for verification must be a direct data pull from the official Roszdravnadzor registry. A screenshot of the provider’s online account portal can easily be doctored, whereas a direct check by INN rules out data tampering.
When checking the Roszdravnadzor registry, the auditor should verify and record four parameters:
| Registry Parameter | What it Confirms | Risk if Non-compliant |
|---|---|---|
| License Status | The legality of the provider’s current operations | Operating outside the legal framework, cargo seizure |
| List of Authorized Works | The right to perform storage, transportation, or dispensing | Executing operations without regulatory permission |
| Schedules of Substances (I, II, III) | The product nomenclature the provider is legally allowed to handle | Circulation of substances outside the permitted schedule |
| Address of Place of Activity | The binding of the license to a specific warehouse facility | Storage at an uncertified, non-licensed facility |
Warehouse Categories and Engineering Security Requirements
This is an area where online briefs and reference manuals frequently provide outdated information. Prior to September 1, 2022, the storage of ND and PS was regulated by Government Decree No. 1148 dated December 31, 2009. That decree has lost force and was replaced by Government Decree No. 809 dated April 30, 2022, «On the Storage of Narcotic Drugs, Psychotropic Substances, and Their Precursors» (hereinafter referred to as Decree No. 809). If a provider’s internal documents still reference Decree No. 1148 during an audit, this reference alone is a reason to question when the company last updated its regulatory compliance base.
Decree No. 809 divides storage facilities into five distinct categories. Outdated sources still mention four categories based on the old rules, which is something to watch out for when reading third-party materials. Category I applies to facilities of manufacturers, as well as wholesale trade organizations dealing with ND and PS and the processing of precursors — meaning this is exactly the type of facility that most frequently acts as a 3PL warehouse. Category II is reserved for pharmacies maintaining a 3-month or 6-month supply, while facilities with a minimal daily or 3-day supply fall into the lower categories and are intended for medical and veterinary organizations. For a 3PL provider audit, Category I is usually the relevant tier, and its engineering security requirements are the most stringent in the entire system.
The exact technical parameters for equipment (door classes, lock types, alarm configurations, and minimum security perimeters) are established by the Joint Order of the National Guard (Rosgvardia) No. 335 and the Ministry of Internal Affairs (MVD) of Russia No. 677 dated September 15, 2021, «On Approving the Requirements for Equipping Facilities and Premises with Engineering and Technical Security Measures…» (hereinafter referred to as Order No. 335/677), issued pursuant to Government Decree No. 1035 dated December 17, 2010. This order came into force on March 1, 2022, replacing an earlier 2018 version of the requirements. It uses the same five-category system as Decree No. 809; therefore, the category of the facility stated in the license must match the category in the MVD inspection report word for word. If a provider’s inspection report cites regulations from 2012 or 2018, the document is obsolete and must be reissued.
The auditor must request the provider’s current facility inspection report and the MVD conclusion confirming compliance with the specific requirements of the joint order. General descriptions of categories from public sources are insufficient for this purpose.
The general principle of protecting a Category I facility relies on multiple security perimeters: the perimeter of the premises, the walls and floors/ceilings of the vault itself, door openings, and window or ventilation openings. Doors must be equipped with a dual-circuit security system, and safes or vaults must be selected according to their burglary resistance class. The exact parameters regarding the class, thickness, and diameter of structural reinforcement elements vary depending on the facility category and are detailed in the appendices to Order No. 335/677. The audit agreement should explicitly request these appendices rather than relying on averaged figures from third-party articles.
Personnel Clearance as a Common Area for Violations
The procedure for clearing individuals to work with ND and PS has been governed since September 1, 2022, by Government Decree No. 911 dated May 20, 2022 (hereinafter referred to as Decree No. 911), which replaced Decree No. 892 (in force since 1998). The objective of this procedure is singular: to prevent individuals with criminal records under relevant statutes or medical contraindications from gaining access to controlled substances.
A complete set of documents for each warehouse employee must include four mandatory elements:
A medical certificate confirming the absence of relevant diseases. The form and issuance procedure are established by Ministry of Health Order No. 303n dated May 4, 2022. The certificate must confirm the absence of exactly three diagnoses: drug addiction (narcomania), substance abuse (toxicomania), and chronic alcoholism. During an audit, it is vital to verify this exact wording against what is written in the provider’s certificate. Only state or municipal medical organizations holding a license for psychiatric and narcology care and laboratory diagnostics are authorized to issue such certificates. Consequently, a certificate from a private clinic lacking the required scope of work in its license does not legally validate the clearance.
An MVD clearance certificate confirming the absence of a criminal record for crimes related to illicit drug trafficking, as well as other serious crimes.
A signed acknowledgment by the employee confirming they have been familiarized with the legislation governing the circulation of ND and PS.
An official clearance order issued by the executive management naming the specific individual authorized to work and detailing the schedules of substances to which access is granted.
An employee working without a properly executed clearance is considered a gross licensing violation and strips the provider of any presumption of good faith during any subsequent regulatory inspection.
A distinct requirement of Decree No. 1007 applies to the executive head and specialists responsible for the circulation of ND and PS: their ranks must include an individual possessing additional professional education in the field of handling controlled substances. In practice, this is verified by a certificate of advanced training. The auditor must check its date of issuance, as expired training effectively strips the specialist of their right to sign entries in the operations registration logs.
Transportation and Intermediate Cargo Storage
Transportation rules are set forth in Government Decree No. 526, dated March 31, 2022 (hereinafter referred to as Decree No. 526). Mandatory security during transit applies to all Schedule I substances and precursors. For Schedule II and III substances, security escort is mandatory if they are being transported for further production, processing, distribution, or sale to wholesale trade organizations. This contrasts with the oversimplified assumption that «all substances in Schedule II and III must always be escorted by armed guards,» which is frequently found in some briefs, and should be clarified with respect to the specific logistics operation.
A 3PL provider can ensure security using one of three methods: deploying units of the National Guard (Rosgvardia), utilizing their own or contractually engaged departmental security forces, or entering into an agreement with a private security organization that holds a license for armed security and cargo escorting. The auditor should explicitly review the agreement with the security entity and ensure that liability for the safety of ND and PS is spelled out as a distinct clause. A generic phrase regarding the «protection of property» does not establish such specific liability.
Beyond the transport vehicles themselves, the auditor must verify the qualifications of the drivers and forwarders accompanying the cargo. They are subject to the same clearance requirements as the warehouse personnel; therefore, the availability of a driver’s valid medical certificate and MVD clearance must be verified separately from the corresponding documents of warehouse pickers. The transit route manifest stipulated by Decree No. 526 should be cross-referenced with actual transit times and intermediate stop locations.
Vehicles used for transportation must prevent unauthorized access to the cargo compartment and, as a rule, are equipped with satellite monitoring systems featuring a panic button linked to an emergency response center. If the cargo demands a specific temperature profile — such as certain narcotic analgesics in glass ampoules — thermostatic safes that maintain the temperature in accordance with the specific drug’s instructions must be used. The auditor must verify the calibration certificates for such thermostatic units and review the temperature logs. Verbal assurances of temperature profile compliance are not sufficient.
Operations Registration Logs and Reporting
The procedure for maintaining and storing special logs is governed by Government Decree No. 2117, dated November 30, 2021, in force since March 1, 2022 (hereinafter referred to as Decree No. 2117). Every operation involving ND and PS must be recorded in the log on the day it occurs, based on a primary accounting document whose number and date are entered into the record. On the last day of every month, a physical inventory must be conducted, cross-referencing actual physical stock levels against the log data.
Logs and all supporting primary documentation must be stored inside a safe within the ND and PS storage room for a period of five years following the completion of the logbook. Decree No. 2117 permits maintaining the log in electronic form, provided that access to the information system is restricted to the personnel officially responsible for its maintenance. During an electronic log audit, it is important to verify who exactly holds editing privileges and whether the system is secured against retroactive changes (backdating).
The provider is also required to submit regular reports on activities related to the circulation of ND and PS, including the annual Form No. 1-P, to the territorial body of Roszdravnadzor or the Ministry of Health. Copies of such reports bearing an official receipt stamp confirm transparent cooperation between the provider and the regulator.
Cargo Returns and Destruction as a Separate Risk Area
Audits frequently stop at the straightforward forward logistics route («receiving – storage – dispatch») and overlook what happens to the cargo beyond those boundaries. If a buyer returns ND or PS — for example, due to damaged secondary packaging — the provider must have a distinct procedure for receiving returns into quarantine storage, with mandatory recording in the operations registration log. Storing returned items mixed in with the main commercial stock is already a violation, even if the quantity and quality of the substance are beyond doubt.
The destruction of ND and PS constitutes a separate type of licensed activity and requires compliance with Article 29 of Federal Law No. 3-FZ and the procedure set out by Government Decree No. 647 dated June 18, 1999. If the provider does not hold the right to perform destruction within their own license, they must operate under a contract with an authorized organization that possesses this right. The auditor must request this contract separately, as its absence means that rejected or expired cargo could accumulate indefinitely at the warehouse without any legal mechanism for disposal.
Special attention must be paid to the status of precursors, particularly substances listed under Table I of Schedule IV of the official list. Structurally, their circulation is regulated more leniently than that of ND and PS proper. At substantial volumes, however, the requirements applied to precursors approach those of Schedule II. A provider that handles precursors as an afterthought — without a designated storage zone and separate accounting records — is typically unprepared for the requirements of ND and PS circulation itself.
How to Classify Identified Non-Conformances
Following the physical warehouse inspection and document review, the auditor typically compiles a list of findings. These observations are not equal in their consequences; blending a minor clerical typo with the total absence of a warehouse worker’s clearance undermines the value of the audit itself. A three-tier risk classification helps turn a raw list of observations into a decision about cooperation.
| Risk Level | Examples of Violations | Required Action |
|---|---|---|
| Critical | Missing a license for the required substance schedule; lack of Category I facility security; access to ND granted to an employee without an MVD clearance. | Transfer of cargo is ruled out until the issue is resolved. |
| Significant | Expired advanced training certificate; lack of recent calibration for a thermostatic unit; recurring errors in the registration log. | Requires a formal Corrective Action Plan (CAPA) with a set deadline. |
| Minor | Typographical errors in internal operating instructions; absence of redundant safety signage. | Written commitment from the provider to fix the shortcomings. |
Critical violations are non-negotiable, regardless of how commercially attractive the provider’s terms may be. A one-time exception to this rule creates a precedent that the provider could cite in court if a case ever escalates to cargo loss or theft.
Action Plan for the Auditor
Verify the provider’s license in the official Roszdravnadzor registry using their INN or OGRN. Cross-reference the warehouse address, the scope of permitted works, and the schedules of substances (I, II, III) against the specific parameters of your cargo.
Request the MVD inspection report on the facility’s engineering and technical security. Verify the date of issuance and the facility category under Decree No. 809, and confirm that the report explicitly covers the exact warehouse where your cargo will be stored.
Sample 3 to 5 personnel files for the warehouse staff. Each file must contain a medical certificate conforming to Order No. 303n, an MVD certificate confirming the absence of a criminal record, a signed legislative familiarity statement, and a clearance order.
Conduct an on-site inspection of the warehouse and reconcile the registration logs with actual physical stock. Walk the path of the cargo from receiving to dispatch, and match the records in the operations registration log against the physical contents of the safes at the time of your visit.
Classify all identified non-conformances by risk level. For critical violations, such as an uncleared employee or a missing schedule line item in the license, cargo placement must be ruled out. For significant violations, such as an expired training certificate, set a firm timeline for a corrective action plan before starting operations.
A comprehensive audit of a 3PL provider does not end with the signing of the logistics service agreement. A qualified warehouse specialist might resign, a security firm’s certificate might expire, and a license amendment for a new substance schedule might arrive later than the shipment does. In practice, re-checking the registry status, personnel clearances, and security contracts should be built into an audit schedule at least once a year. An unscheduled check should follow any indication of a change in the provider’s key responsible specialists. Ongoing monitoring of a logistics provider’s legal eligibility costs far less than investigating a discrepancy that nobody can explain after it turns up in the operations registration log.