Virginia Dispensary and Delivery Rules (2026)

Virginia dispensary and delivery rules today apply to one kind of store: the medical dispensing facilities run by the state’s pharmaceutical processors. The Virginia Cannabis Control Authority (CCA) enforces them day to day under Chapter 16 of Title 4.1 and the CCA’s medical regulations in 3VAC10. Adult-use stores, delivery operators and microbusinesses join the market when sales start on July 1, 2027.

The core idea is the same for both markets: a closed, tracked supply chain. Every plant, package and sale is logged in the state’s Metrc seed-to-sale system, product moves only between licensees on a manifest, and nothing reaches a customer without passing lab tests and an ID check.

It covers the medical rules in force in November 2026 and the adult-use rules already in the Code, with the CCA’s draft regulations marked as proposed. This guide is general information, not legal advice. Confirm current rules with the Virginia Cannabis Control Authority.

Key takeaways

Medical dispensaries run under pharmacist supervision, and the dispensing area can’t open without one on site.
Adult-use stores will buy only from licensed growers and processors, never from another store or an unlicensed hemp supplier.
Delivery is legal for medical patients once the CCA approves your drivers and vehicles in writing, and adult-use delivery arrives with the retail market.
Advertising is tightly limited: no billboards, no ads aimed at minors, no giveaways and an age gate on every website.
Rules differ by state, and Virginia’s adult-use rules are still drafts. Check the CCA before you change any procedure.

Who enforces Virginia dispensary rules?

The Virginia Cannabis Control Authority, governed by a board appointed by the governor, licenses and inspects every cannabis business in the state. It took over the medical program on January 1, 2024, and hemp enforcement from the Department of Agriculture and Consumer Services (VDACS) in August 2026.

Your rulebook depends on which license you hold:

Medical operators: Code of Virginia 4.1-1600 to 4.1-1606, plus 3VAC10-40 (operations, security, transport and delivery), 3VAC10-70 (labeling and packaging) and 3VAC10-80 (enforcement).
Adult-use licensees from 2027: The Cannabis Control Act, Title 4.1, Chapters 6 to 14, rewritten by the 2026 budget law. The CCA’s draft rules, released September 9, 2026, are expected to take effect in January 2027.

Localities control zoning and may limit adult-use store hours. Since 2026 the CCA can also issue notices of violation, cease-and-desist orders and civil penalties against unlicensed sellers.

Buying inventory as a Virginia dispensary

Medical dispensing facilities

The medical market is vertically integrated. Each pharmaceutical processor grows, extracts and packages its own products indoors and stocks the dispensing facilities it owns. Processors may sell to one another under the wholesale distribution rules in 3VAC10-40-50, and the receiving facility must get the lab results, or electronic access to them, before taking the product. Both sides keep distribution records.

Every product must be registered with the CCA and pass lab testing before sale. Outdated, damaged or adulterated product is quarantined and destroyed with a written record, and processors need written recall procedures (3VAC10-40-210).

Adult-use stores from 2027

Who you can buy from: Section 4.1-1202 lets a retail store buy only from licensed cultivation and processing facilities. Buying elsewhere is a Class 1 misdemeanor. Product arrives with a licensed transporter or the supplier’s own staff.
Transfers between your stores: Allowed only when authorized and carried out by your employees or a licensed transporter (4.1-1203).
Testing: Product can’t be sold until a licensed lab confirms contaminant limits and label accuracy (4.1-1403 and 4.1-1404). Failed batches are quarantined and destroyed unless they can be remediated, and labs must report failures to the board. Licensees must hand over random samples on request.
Purchase minimums or caps: Not set in the rules; ask the CCA.

Medical processors that want to sell to adults need dual-use verification and a one-time conversion fee; see the FAQ.

How product moves through a Virginia dispensary

Flow chart of how cannabis moves through a Virginia dispensary: licensed processor or grower, manifest and secure transport, receiving and Metrc check-in, vault storage and inventory counts, then sale after an ID check, either at the counter or by approved delivery — The licensed supply chain from source to sale. Source: 3VAC10-40; Code of Virginia 4.1-802 to 4.1-805 and 4.1-1202; CCA.

Seed-to-sale tracking in Virginia: Metrc

The CCA chose Metrc as the state’s tracking system, and it went live for the medical program in mid-2025. Licensed processors must use it, and the CCA now uses the data for a public program dashboard. The budget law requires tracking from immature plant to retail sale for adult-use licensees too, and transporters must track product from pickup to transfer or disposal (4.1-804).

You log every plant, batch and package with a unique identifier (3VAC10-40-40), every transfer and receipt, every sale with date, recipient, product and quantity (3VAC10-40-60 G), and all waste and adjustments.

Dispensing facilities keep a perpetual inventory, reconcile it on a set schedule with written explanations for any difference, and do a full count every year. Theft, diversion, loss or unexplained shortfalls must be reported to the CCA and police right away, followed by a signed written statement. The operating rules table lists each deadline.

Selling to customers

Medical counters today

Who dispenses: A pharmacist, or a pharmacy technician under the pharmacist’s direct supervision. Technicians can’t counsel patients or suggest a different formulation.
Who can buy: Patients, parents or guardians of minor patients, and registered agents. Patients must live in Virginia or be staying there temporarily, and out-of-state medical cards aren’t accepted.
ID check: Before the first sale under a certification, keep a copy of the certification, view a photo ID and verify any agent’s registration. Check ID at every later visit.
Limits: Enforce both the rolling supply limit and the separate flower limit shown in the table, across all visits.
No samples or gifts: Dispensaries can’t hand out product samples (3VAC10-40-30). Coupons and free-product giveaways are banned in advertising (3VAC10-40-170).

Adult-use counters from 2027

Section 4.1-802 sets the basics. Customers must be 21 or older. Sales happen face to face, through a licensed delivery operator, or by your own in-person delivery. No vending machines, no drive-throughs, and no orders that come through a third-party online platform. No sales to anyone intoxicated or buying for a minor, and no giveaways unless the board allows them. Stores must post risk information and a human trafficking hotline notice.

The law sets no statewide store hours; localities may restrict them. Discounts and loyalty programs aren’t addressed in the statute; check the final rules before you launch one. See our loyalty program ideas for what other states allow.

Virginia cannabis delivery rules

Medical delivery

A dispensing facility may deliver to patients only after it sends the CCA a list of delivery agents with copies of their driver’s licenses and details of each vehicle, and receives written approval (3VAC10-40-235). Changes to drivers or vehicles need written notice.

Where: The regulation limits delivery to Virginia residences and excludes dorms, hotels, motels, bed-and-breakfasts and commercial businesses. The statute (4.1-1603) mentions a patient’s residence or business, so confirm with the CCA before delivering to a workplace.
Never to: Military bases, schools, child day centers, correctional facilities, the State Capitol, hospitals, port marine terminals or public gatherings.
At the door: Check photo ID and the patient’s certification or registration. If identity, age or eligibility is in doubt, the order goes back to the dispensary.
Paperwork: The driver carries a copy of the delivery manifest.
Vehicles: Unmarked, Virginia-registered, with a locked hidden compartment, always-on GPS, two-way radio or phone and an alarm (3VAC10-40-245), tested before the first trip each day.
Cash and load limits: Not set in the rules; ask the CCA. Its industry bulletin 2025-02 covers delivery and transportation.

Adult-use delivery from 2027

Retail stores and microbusinesses may deliver in person or hand orders to a licensed marijuana delivery operator (4.1-802 and 4.1-805). Deliveries go to a residence, including a temporary one, or a business, never to the prohibited places listed above. Drivers verify age at the door. For a broader look, see how to start a cannabis delivery business.

Virginia dispensary operating rules at a glance

Rule	Requirement	Where it comes from
Medical dispensing limit	A 90-day supply per patient in any 90 days; no more than 4 oz of flower per 30 days	Code 4.1-1603 A
Adult-use sale limit (from 2027)	2 oz per transaction; draft equivalents 8 g concentrate or 800 mg THC in edibles	Code 4.1-802 B; CCA draft rules
Medical opening hours	At least 35 hours a week; notify the CCA of closures over 2 business days	3VAC10-40-20 G, H
Pharmacist ratio	Up to 6 pharmacy technicians per pharmacist	Code 4.1-1602 M; 3VAC10-40-110
Staff age	18 for medical employees; 21 for adult-use employees and volunteers	3VAC10-30-160 I; Code 4.1-1200 A
Delivery hours	6 a.m. to midnight	3VAC10-40-275 E
Transport manifest	Sent to the receiver at least 24 hours before transport	3VAC10-40-255 A
Product left in a vehicle	Not after hours, and never beyond 24 hours unless inside a secure facility	3VAC10-40-265 K
Transport incidents	Report stops or breakdowns over 2 hours within 24 hours	3VAC10-40-285 A
GPS records	Keep at least 90 days	3VAC10-40-265 I
Camera footage	Keep at least 30 days; failure alert within 5 minutes	3VAC10-40-140 G
Security system testing	At least every 6 months	3VAC10-40-140 H
Alarm outage	Report outages over 8 hours	3VAC10-40-150 C
Inventory counts	Perpetual inventory reconciled monthly; full count yearly	3VAC10-40-60 E, H
Theft or loss	Report at once; signed statement within 24 hours	3VAC10-40-150 B
Record retention	3 years for inventory, lab and dispensing records	3VAC10-40-200
Edible potency (adult-use)	10 mg THC per serving, 100 mg per package	Code 4.1-1406 A
Ad audience	Medical: 85% expected to be 18+; adult-use broadcast: 71.6% expected to be 21+	3VAC10-40-170 A; Code 4.1-1401 C
Outdoor ads	Not within 500 feet of schools, playgrounds and substance use facilities	3VAC10-40-170 C; Code 4.1-1402 A
Retail sales floor (proposed)	Up to 2,500 sq ft	CCA draft rules

Packaging and labeling

Medical products follow 3VAC10-70. Packaging must be child-resistant, tamper-evident and opaque, and can’t look like candy or snack packaging. The universal symbol goes on every container and layer, including vape cartridges. Labels list the processor, product name, serial number, test and expiration dates, terpenes, cannabinoids and CCA-approved warnings.

Adult-use labels under 4.1-1405 add a QR code to the certificate of analysis, net weight, ingredients and a board-set warning. Packages must also be resealable. Products can’t be shaped like a human, animal, vehicle or fruit, and edibles can’t contain alcohol or nicotine. The edible potency caps are in the table above. Our packaging and labeling guide compares states.

Advertising and marketing rules

Medical rules (3VAC10-40-160 to 190) and the adult-use law (4.1-1401 and 4.1-1402) overlap heavily:

No billboards, no ads at sporting events and no digital pop-up ads.
Nothing that targets or appeals to people under 21, including cartoons, and no images of anyone under 21.
No misleading claims, implied government endorsement, or talk of intoxicating effects.
Medical websites and social accounts need a neutral age screen. Adult-use ads must name the business and carry the line “For use by adults 21 years of age and older.”
Signs on your property can help customers find you but can’t show cannabis imagery, appeal to minors or draw undue attention.
Medical ads can’t use coupons or free-product offers, and any claim about benefits must be supported by clinical evidence and include risks.

For compliant ways to grow, see dispensary marketing and local SEO.

Security, staff and records

Under 3VAC10-40-140, cameras record around the clock over storage, dispensing and sales areas and every door. The alarm needs backup power, panic buttons and an automatic dialer. Product sits in a locked vault after hours, with access limited to essential staff. Our dispensary security requirements guide covers equipment choices.

Processors run criminal background checks, can’t hire anyone with a felony conviction in the past five years, and need pre-employment and random drug screening policies (4.1-1602). Adult-use stores must train staff under 4.1-802. See budtender training requirements and budtender interview questions.

Taxes the business collects and remits

Medical cannabis is exempt from the state marijuana tax (4.1-1004). Sales tax returns go to Virginia Tax monthly or quarterly, due the 20th after the period ends; ask Virginia Tax which medical sales are taxable.

From July 1, 2027, adult-use sellers collect:

The state marijuana tax of 6%, rising to 8% on July 1, 2029. Sales between licensees are exempt.
A local marijuana tax of 1% to 3.5%, which every city and county must adopt. Localities must notify stores within 30 days of passing the ordinance, and a rate stays in place for at least three years.
Regular retail sales tax, which ranges from 5.3% to 7% depending on location.

Late returns cost 5% of the tax per 30 days, up to 25%, and a fraudulent return adds 50% (4.1-1206). Our cannabis tax rates by state guide compares markets.

Inspections and penalties for businesses

The CCA can inspect transport vehicles at any time without notice. Under 3VAC10-80-20, it can suspend, revoke or condition a medical permit for weak diversion controls, lending a permit, failing to cooperate, closing for more than 60 days without approval, fraud or breaking the rules.

For adult-use licensees, the board may suspend or revoke a license, accept a consent agreement or impose a civil penalty in place of suspension (4.1-900 to 4.1-903). Dollar ranges will come from a board penalty schedule that hasn’t been published yet. The statute already sets some penalties:

Selling without a CCA decal, or with a fake one: $10,000 a day (4.1-1106.1 and 4.1-1207).
Gifting cannabis or using it on the premises: civil penalty up to $500, then revocation or firing for a second offense (4.1-1201).
Selling outside your license, buying from unlicensed sources or hiring anyone under 21: Class 1 misdemeanor. Knowingly allowing a convicted person’s conduct means revocation and a 10-year bar for the licensee and premises (4.1-1200).
Hemp retailers selling over-limit products or without registration: up to $10,000 per day of violation (4.1-1704).

So far the biggest enforcement wave hit hemp shops, a program that now sits with the CCA.

Virginia compliance at a glance

19medical dispensing facilities licensed at the end of fiscal year 2025 (CCA annual report, 2025)

1,957new medical cannabis products registered with the CCA in fiscal year 2025 (CCA, 2025)

424hemp retail inspections by VDACS from July 2023 to June 2024 (Cannabis Business Times, 2024)

$12.4Min hemp civil penalties assessed from July 2023 through July 2024 (VDACS via Cannabis Business Times, 2024)

Your Virginia dispensary compliance checklist

Daily: Confirm a pharmacist or supervisor is on site, test vehicle systems, check ID and limits on every sale, log it in Metrc, and vault product at close.
Every delivery: Approved drivers and vehicles only, manifest on board, ID at the door.
Weekly: Review camera coverage and alerts, check quarantined and waste product, and spot-check counts against Metrc.
Monthly: Reconcile the perpetual inventory and write up every difference. File sales tax on time.
Twice a year: Test all security equipment and keep the record.
Yearly: Full physical inventory, permit renewals, staff training and recall plan review.
Before July 2027: Track the final CCA rules, apply for dual-use status if you’re a processor, and set up local tax collection.

See our dispensary compliance checklist and seed-to-sale tracking explained.

Get found on WhereLeaf

Patients search for licensed dispensaries now, and adult shoppers will start before stores open. A WhereLeaf listing shows them your hours, menu and delivery area. Add your listing for free or compare listing packages. Point customers to our Virginia cannabis laws guide, and see cannabis license guides or how to get a cannabis license in Virginia.

Frequently asked questions

Can a dispensary buy from another dispensary in Virginia?

Medical processors can sell to each other under the wholesale rules, with lab results passed along. Adult-use stores can’t buy from other stores at all; they may only move stock between their own locations with their staff or a licensed transporter.

Can delivery drivers carry cash?

No cash limit for drivers is set in the rules. Write a cash-handling policy and ask the CCA how it fits your approved delivery plan.

Can we take orders through an online marketplace?

Your own website can show a menu and take orders, within the age-gate rules. Adult-use stores can’t fill orders referred by a third-party sales platform, so marketplace-style ordering apps are out.

Can a hemp shop convert to a marijuana license?

A limited number of qualifying hemp growers and processors can apply to convert, with applications opening by February 1, 2027. Shops selling products over the hemp THC limit before then risk daily civil penalties and losing their hemp registration.

Will medical dispensaries automatically sell to adults in July 2027?

No. A processor needs CCA dual-use verification and must pay the conversion fee. Under 4.1-1602, a processor permit without that verification stops being valid on June 1, 2027.

Sources

Last updated: November 2026. Laws and prices change; always check your state or provincial regulator.