What are the rules for dispensing cannabis-based medicinal products in the UK?

What makes a CBPM prescription valid?

A CBPM prescription is valid only if it satisfies the Schedule 2 prescription requirements, comes from a prescriber entitled to initiate it and is presented within its 28-day life. Prescriptions for Schedule 2, 3 and 4 controlled drugs are valid for 28 days from the appropriate date— the signing date, or any later start date the prescriber has indicated. Repeats are not permitted on Schedule 2, so every supply needs a fresh prescription. Two operational consequences follow. An owing balance on a Schedule 2 prescription cannot be supplied more than 28 days after the appropriate date, which matters in a category with import-driven stock gaps. And good practice limits quantities to 30 days' supply — most clinics in this sector follow it, and pharmacies should query the ones that do not.

The prescriber question is where CBPMs differ from every other Schedule 2 drug: unlicensed medicinal cannabis can only be initiated by a doctor on the General Medical Council (GMC) Specialist Register. The pharmacy's check is therefore two-layered. Confirm the prescription meets the CD formalities, and confirm the prescriber holds specialist registration. The standing forgery duty applies with full force: before dispensing any Schedule 2 drug, the pharmacist must take reasonable steps to be satisfied the prescription is genuine. For a clinic the pharmacy has not dealt with before, that means verifying the prescriber against the GMC register and, where doubt exists, speaking to the clinic. Record what you checked and when. The point of verification is being able to evidence it months later.

This article covers the dispensing law. The operational workflow that carries it, from prescription receipt to signed-for delivery, is the subject of building a compliant CBPM dispensing workflow. The business context sits in how to set up a medicinal cannabis dispensing pharmacy.

How do private CD prescriptions actually work?

Almost all CBPM prescriptions are private. In England, a private prescription for a Schedule 2 or 3 controlled drug is only dispensable if it is written on the designated form FP10PCD. It must also carry the prescriber's six-digit private controlled drug prescriber identification number, issued by the relevant NHS agency.

The paper then has a destination. Dispensed FP10PCD forms are submitted monthly to the NHS Business Services Authority (NHSBSA) for monitoring. They go with the FP34PCD submission document, no later than the fifth day of the month following supply, kept strictly separate from the pharmacy's NHS prescription bundle. The submission runs on a private CD account number distinct from the pharmacy's NHS account, obtained through the local NHS England team or integrated care board. A new CBPM pharmacy should treat obtaining that account as a launch task, not a first-month discovery. The pharmacy retains its own record of the private supply for two years.

Collection formalities complete the picture. Best practice remains to obtain the signature of the person collecting a Schedule 2 drug — the FP10PCD carries space on the reverse for it — and for Schedule 2 supplies the pharmacy asks for identification. In a distance model nobody signs at the counter. That is exactly why the delivery leg needs designing to carry the same assurance: tracked, signed-for handover to the patient, with the delivery record retained. It is counter practice translated into courier practice, and the workflow article treats it in full.

What do safe custody and the CD register require?

Safe custody means CBPMs are stored in an approved controlled drugs cabinet or safe whenever not in immediate use. The CD register means every receipt and every supply is recorded, with a running balance that reconciles to the cabinet. Schedule 2 drugs are subject to the safe custody requirements, so the storage question is settled by law rather than judgement. The pharmacy's judgement goes into specification. The practical trap in this category is volume: flower formats are bulky against conventional Schedule 2 stock, and an undersized cabinet becomes a standing compliance defect the day stock arrives.

The register is the discipline inspections test hardest. It is the record that proves the pharmacy controls its stock rather than merely storing it. The requirements in practice: entries for every receipt and supply in the prescribed form, made promptly; a separate part of the register for each drug class and strength; running balances maintained and physically reconciled against holdings at regular intervals; corrections made by dated marginal note or footnote, never by obliteration; and the register retained for two years from the date of the last entry. Investigate discrepancies and document the investigation. A balance that was quietly adjusted reads to an inspector exactly as it sounds. At CBPM volumes this is real daily work, and it should be staffed as such. A controlled drugs register module is scheduled for release on Dataforge PMR at the end of 2026. Until then, the register is a process the pharmacy runs and evidences alongside its PMR — a perfectly inspectable position, provided the process is actually run.

What does the specials regime add on top?

The specials regime adds supply conditions and a second, separate record, because the product is unlicensed. Under the Medicines and Healthcare products Regulatory Agency (MHRA) framework, an unlicensed medicine may only be supplied to meet the special clinical need of an individual patient, against a bona fide unsolicited order from an authorised prescriber. The supplier must keep records demonstrating exactly that, retained for five years. In this category, the specialist's prescription is what evidences the special clinical need — one more reason prescriber verification is a gate rather than a courtesy.

Three specials obligations deserve explicit workflow status. First, the transaction record itself: what was supplied, when, to whom, against whose prescription, from which source — kept for five years. That is a different retention clock from the two-year CD records, and it must be managed as such. Second, batch traceability. The record should tie the batch number of what was dispensed to the patient who received it, because in an import-dependent unlicensed supply chain the recall question is when, not if.

Third, pharmacovigilance. Adverse reactions to unlicensed products are reported, and the SOP should name who reports and how, rather than assuming someone would.

The specials regime also settles the marketing question structurally. Unlicensed medicines cannot be advertised, and prescription-only medicines cannot be promoted to the public. Together, the two rules mean a CBPM pharmacy's public presence describes the service and the pathway, never the products. Regulators have already signalled concern about adult-use-style branding in this sector, so treat this boundary as load-bearing.

How are destruction and returns handled?

Expired or obsolete CBPM stock may only be destroyed in the presence of an authorised witness, with the destruction recorded in the CD register. Patient-returned CBPMs are recorded separately and destroyed promptly, witnessed as good practice by a second member of staff. The distinction matters and is regularly blurred. Stock destruction is the register event demanding the authorised witness. Returns never re-enter stock, never touch the running balance and live in their own record. A distance selling pharmacy adds one more scenario worth an SOP of its own: the failed or refused delivery. A Schedule 2 parcel comes back and must be receipted, quarantined and either returned to stock or destroyed, with the paperwork matching whichever happened.

Destruction is also where the two-regime overlap shows one final time. A destroyed batch should be traceable through the specials records as well as struck through the register. The clean habit is one destruction log referencing both.

Where do the two regimes overlap, and what records satisfy both?

They overlap everywhere and satisfy each other nowhere — the single most useful sentence in this article. The CD regime asks whether controlled drugs were controlled. The specials regime asks whether an unlicensed supply was justified and traceable. Every CBPM transaction must answer both. The map:

Run the table as an audit twice a year and the category holds no terrors. The pharmacies that struggle are not the ones that find the rules complex — they are the ones that let one record stand in for another. The wider data protection duties wrapped around all of these records, from retention discipline to supplier contracts, are covered in the patient data security briefing.

Key takeaways

FAQs