Receiving Products From Vendors

Almost every retail compliance duty in this course — valid COA, compliant label, child-resistant packaging, nothing misleading, nothing nonconforming — is easiest to satisfy at one moment: when the box arrives and before anything is shelved. Once a product is on the shelf, you are selling it; and Texas law prohibits 'introducing hemp-derived cannabinoids into commerce that do not conform to the provisions of this chapter' — and prohibits causing that, too (25 TAC §300.602(1)).

This lesson turns the rules you've already learned into a receiving routine. It works down the same stages as the COA Intake Checklist — document intake, identity matching, results review, file and decide — and adds the receiving-specific layer around it: is this vendor legitimate, is the shipment what the invoice says, and what do you do when something doesn't clear?

Texas splits the supply chain into credentials. A person must hold a consumable hemp products license issued by DSHS before manufacturing or processing consumable hemp products, and must hold a wholesaler license under Health and Safety Code Chapter 431 before distributing them (25 TAC §300.201(a)). A 'distributor' — someone who distributes consumable hemp products for resale — is expressly required to hold that wholesaler license (§300.101(16)). And one structural detail worth knowing: manufacturers may only distribute products they manufactured (§300.101(24)) — so a 'vendor' offering you five other brands alongside their own may be acting as a distributor, and the wholesaler-license question applies.

Here's the honest part: we found no provision in Chapter 300 that requires a retailer to verify a supplier's license before buying. The supplier-documentation record duties in the rule (§300.203(d)(3)) sit on manufacturers and processors, not on you. But 'not required to check' is not the same as 'safe not to check' — if nonconforming product crosses your counter, §300.602(1) and the detention, embargo, and destruction machinery (§§300.603–300.604) land on the product in your store, and the cost and disruption land on you.

The check is cheap, because DSHS makes it public. The Consumable Hemp Program's 'Current Licensees and Registrants' page publishes downloadable lists of Consumable Hemp Product licensees and Retail Hemp Registrations, plus an online search tool: 'Verify that an establishment has a current license or registration with DSHS. Search by name, license type, city or county.' No login is needed. Before onboarding a Texas manufacturer, look them up; keep a dated screenshot or the row from the list in your vendor file. If a Texas manufacturer isn't on DSHS's list, ask them why before you buy — don't assume the list is stale in their favor.

Out-of-state product is legal to sell in Texas — with strings. A person selling consumable hemp products in Texas that were processed or manufactured outside Texas must comply with Chapter 300, and must, on DSHS's request, submit evidence that the products were manufactured in another state or foreign jurisdiction in compliance with a USDA-approved plan, the USDA plan under 7 U.S.C. §1639q, or (for foreign products) laws plus Texas-compliant testing (25 TAC §300.403). Read that carefully: the duty to produce that evidence sits on the person selling in Texas — you. At receiving, that means asking the out-of-state vendor for their state license or plan documentation up front, because DSHS asks you, not them.

A related transport rule: substances with total delta-9 THC above the acceptable hemp THC level may not be transported into Texas for further processing (§300.404). That provision is aimed at processing inputs rather than retail stock, but it's part of why an over-threshold COA on an inbound shipment is a full stop, not a judgment call.

Where the rules go quiet, stay closed. One piece has since been answered in agency guidance: DSHS now states a Retail Hemp Registration is required for sellers who retail consumable hemp products online without a storefront. Chapter 300 still doesn't clearly address out-of-state sellers shipping into Texas or online marketplaces, and an out-of-state vendor won't appear on DSHS's Texas licensee list — that absence proves nothing either way. For out-of-state vendors, the working substitute is: their home-state credential on file, §300.403 evidence on file, and Texas-compliant COAs lot by lot. If a vendor can't produce those, that's your answer.

Chapter 300 doesn't prescribe an invoice or manifest format for retail deliveries — the receiving-record duties written into the rule (§300.203(d)(3), §300.406(c)) are manufacturing-side. So treat this as operating discipline, not rule text: reconcile the physical delivery against the invoice or packing list, and make sure every line item resolves to a lot number you can find on the physical product. A delivery you can't tie to lots is a delivery you can't tie to COAs.

Then run the COA Intake Checklist — the job aid built from the Understanding COAs lesson — for every lot in the delivery, one lot at a time, because a COA belongs to one lot. In brief: Stage 1, the document is complete and valid (the 12 required elements of §300.301(d), including the expiration date — expired COAs are not valid, and products with expired COAs must be retested, §300.301(f)); Stage 2, the identity matches — product name, matrix type, lot number, and manufacturer name and address on the COA match the physical product, and the QR code actually resolves to this COA at the laboratory; Stage 3, the numbers clear — all requested analyses reported, total delta-9 THC reviewed with the laboratory's measurement of uncertainty under the applicable compliance process, contaminant panels present and passing; Stage 4, file it where you can retrieve it by lot number and put the expiration date on your calendar.

Test results you rely on are also a retention item: test results must be retained for at least three years from the date results are received (§300.303(f)), and records described in the chapter generally carry a three-year minimum (§300.203(c)). Filing the COA at intake is what makes that possible later.

The product-labels lesson covers the label in full; at receiving you spot-check it. Every unit intended for individual retail sale must carry, on its outer packaging, the required label elements: batch (lot) number, batch date, product name, manufacturer or processor name, their telephone number and email address, the COA URL, and recommended serving size in milligrams with servings per container (25 TAC §300.402(a)); the statute adds a certification that delta-9 THC is not more than 0.3 percent (HSC §443.205(a)(6)). The five required warnings must be present (§300.402(b)), and the COA URL must be conspicuously marked and reach the COA in three or fewer steps (§300.402(a)(6)(A)–(B)) — try it on one unit per lot. And the label's lot number must match the COA you just checked: label ↔ COA consistency is the whole point of doing these together.

Packaging is a duty that sits squarely on the retailer: before sale or distribution, the product must be prepackaged — or placed at the time of sale — in packaging that is tamper-evident, child resistant, and resealable if multi-serving, while keeping the child-resistant mechanism intact (§300.405). If a delivery arrives in packaging that doesn't meet that standard and isn't something you repackage compliantly at sale, that's an intake problem, not a register problem. Also scan the trade dress: packaging that would likely mislead a person to believe the product contains no hemp-derived cannabinoid, or is intended for medical use, cannot be sold (§300.407). Finally, remember these products sell only to customers 21 and over (§300.701) — receiving is the moment to route them to age-restricted handling in your store, not the open floor.

The rule tells you what an invalid state looks like — expired COA, missing elements, nonconforming product — but it does not prescribe a retail rejection procedure. The following is HempDash operating guidance, not rule text.

The decision rule comes from the intake checklist and doesn't bend: no matching, current, verifiable COA — the product doesn't go on the shelf. From there: segregate the affected lot somewhere it cannot be sold or mixed with cleared stock; tell the vendor the same day, in writing, what failed and what you need (the right COA for this lot, a corrected label, a retest); and document what you did — date, lot, what failed, who you told, and how it resolved. If the vendor can't cure it, return or refuse the delivery per your terms. Two reasons for the paper trail: DSHS's enforcement process expressly gives retailers notice and an opportunity to resolve unintentional or negligent violations (§300.606(b)), and a dated record that a lot never reached your shelf is the documentation you would bring to that process.

One thing this lesson deliberately does not answer: who bears the cost of a retest when a COA has expired, and what your exposure is while you wait. The rule is silent — it's written in the passive voice. Settle it in your supplier agreements, with your attorney, before the first delivery, not during a dispute.