How to Verify API Suppliers: GMP Status, CEP, ASMF and DMF
Verify an API supplier’s GMP and regulatory position by checking official evidence for the exact manufacturing and testing sites; reviewing the inspection and enforcement lifecycle; confirming the current identity, holder, scope and status of every CEP, ASMF or DMF; establishing the applicant’s access rights; and matching the documents to the offered API, grade, manufacturing route and supply chain. The result should be an advance, advance with conditions, pause or reject decision before audit and representative sampling.
A GMP certificate, CEP or Drug Master File should never be treated as a badge attached to a company name. Its value depends on whether it supports the exact API source that the buyer intends to use.
Part 1 of this series established the material, original manufacturer, sites, intermediaries, physical grade, technical requirements and commercial route. Part 2 tests the regulatory claims against that controlled source profile.
This remains desktop verification—not final supplier approval. A candidate that passes can proceed to the risk-based audit, representative sample testing and source-approval process described in Part 3.
Five regulatory verification gates
Every claimed status or document must pass all five tests.
Existence is only the starting point. A genuine document may still be irrelevant, outdated, inaccessible or mismatched to the proposed source.
Verify GMP Status and Regulatory History
The same manufacturer may operate several sites with different functions and different regulatory histories. Evidence for a warehouse, testing laboratory or finished-product operation cannot automatically support API synthesis at another location.
Convert every GMP claim into an exact identity
For every claimed certificate, inspection or compliance status, record:
- Issuing authority and document or inspection reference
- Exact legal entity and site address
- API or product scope, where stated
- Manufacturing, testing or other operations covered
- Applicable GMP standard
- Inspection, issue, expiry and validity information
- Current status and any limitation, exclusion or remark
“EU GMP,” “FDA registered,” “WHO GMP” and “PIC/S approved” are not sufficiently precise claims. The assessment must identify the authority, instrument, site, operation and present status.
Verify the regulatory record independently
Use the issuing authority’s database or official publication whenever available and compare it with the supplier’s copy. Look for altered numbers or dates, another legal entity or site, expired or superseded evidence, finished-product scope presented as API-manufacturing evidence, registration presented as GMP certification, or a genuine historical certificate with no support for the current position.
Where no public database exists, seek authority confirmation where practical or obtain sufficient original evidence to assess the issuer, legal basis and scope. A polished certificate should not receive greater weight than a less attractive but directly verifiable authority record.
Review the inspection lifecycle—not one document
A complete history may include recent and earlier inspections, GMP certificates and non-compliance statements, FDA Form 483 observations, inspection classifications, warning letters, import alerts, licence restrictions, recalls, manufacturer responses, CAPA and follow-up inspection or authority closure.
An FDA Form 483 records inspectional observations; it is not FDA’s final compliance determination. Interpret it together with the manufacturer’s response, the final NAI, VAI or OAI classification and later compliance actions. FDA Form 483 FAQ, FDA Inspection Classification Database
Assess findings by their relevance to the actual API, operation, laboratory and quality system; their potential effect on identity, purity or data reliability; whether they are isolated or systemic; recurrence; root cause; CAPA completion and effectiveness; and the subsequent authority position.
Data-integrity concerns deserve particular caution because they can weaken confidence in CoAs, stability data, investigations, validation and other evidence used throughout qualification. The absence of a public enforcement action, however, is not proof that no deficiencies exist: authority databases differ in coverage, publication timing and detail.
Understand GMP evidence across major regulatory systems
Some authorities issue GMP certificates; others license sites, record inspection outcomes or assess evidence through a local importer or sponsor. In every case, confirm that the instrument applies to the exact site and operations being evaluated.
| Authority or system | Relevant evidence and essential limitation |
|---|---|
| EU/EEA | EudraGMDP may contain GMP certificates, manufacturing or import authorisations, active-substance registrations and non-compliance statements. These instruments have different purposes and must match the site and activity. APIs imported from certain third countries may also require written confirmation. EMA EudraGMDP |
| US FDA | Inspection classification, Form FDA 483, warning letters and import alerts may be relevant. Establishment registration is not a GMP certificate or FDA approval. FDA pharmaceutical inspections and compliance |
| MHRA, United Kingdom | Use MHRA-GMDP for applicable UK records, while considering the authority and date of older records in EudraGMDP. Active-substance registration is separate from a GMP certificate. MHRA GMP guidance |
| Health Canada | A foreign-building listing may support the Canadian importer’s Drug Establishment Licence. The exact foreign building, activities and API information must align with the accepted evidence. Health Canada GUI-0080 |
| TGA, Australia | Australian manufacturing licences and overseas GMP clearances or certifications are different instruments. Confirm that the required site and manufacturing steps are covered. TGA overseas-manufacturer guidance |
| MHLW/PMDA, Japan | GMP certificates, compliance-inspection notifications or related evidence may be relevant. Foreign-manufacturer accreditation is separate from GMP compliance, and inspections may be product- or category-based. PMDA GMP guidance |
| Swissmedic | SwissGMDP covers Swiss establishments. Foreign manufacturers may instead be supported by evidence from a recognized authority or an acceptable inspection or audit report. SwissGMDP |
| ANVISA, Brazil | A CBPF applies to a particular manufacturing unit and inspected scope. Confirm the API, manufacturing approach and operations covered. ANVISA CBPF guidance |
| COFEPRIS, Mexico | The certificate category, establishment, operations and product scope must match the API source. COFEPRIS GMP certification guidance |
| INVIMA, Colombia | BPM certificates and establishment records distinguish manufacturers from companies importing or storing active substances. An importer or warehouse listing is not API-manufacturing certification. INVIMA certification records |
| NMPA, China | China discontinued routine drug GMP certification in 2019. Evaluate the current manufacturing certificate or licence, inspection outcomes and regulatory actions instead of accepting a claimed universal NMPA GMP certificate. NMPA announcement |
| CDSCO and Indian State Licensing Authorities | Manufacturing licences, product permissions, Schedule M inspection evidence, CoPP or EU written confirmation serve different purposes and are not interchangeable. CDSCO written-confirmation records |
| Eurasian Economic Union | An EAEU GMP certificate has a defined site, manufacturing scope and validity. Its relevance within the EAEU does not establish acceptance in another market. EAEU GMP certificate guidance |
| WHO API prequalification | The status covers a defined API dossier and associated manufacturing arrangement; it is not approval of every product or site belonging to the company. WHO prequalified APIs |
| PIC/S | PIC/S does not inspect manufacturers or issue GMP certificates. Evidence is issued by individual participating authorities, and participation does not create automatic universal recognition. PIC/S FAQ |
The table is representative rather than exhaustive. Evidence from MFDS, HSA, SFDA, TFDA, SAHPRA, NPRA, Medsafe, TİTCK and other authorities may also be relevant depending on the source and intended market.
Standards are not certificates
ICH Q7 is the internationally harmonized GMP guideline for API manufacture. WHO API GMP guidance and PIC/S Part II reflect the same framework. They describe how API manufacture should be controlled; they do not issue a universal approval to an individual company.
A claimed “ICH Q7 certificate” or “WHO-GMP certificate” must therefore be traced to the national authority or organization that actually issued it. Identify the issuer, legal basis, document number, inspected site, scope, inspection date and current status. ICH Q7, PIC/S GMP Guide Part II
Verify That the CEP, ASMF or DMF Is Genuinely Usable
A supplier may truthfully state that it has a CEP, ASMF or US DMF while still being unable to support the buyer’s application. The document may belong to another company, cover different sites or a different process, exclude the offered grade, remain inaccessible to the applicant or no longer be maintained.
The correct question is not “Does the supplier have a dossier?” It is: Can this exact document support this exact API source, applicant, product and market throughout the regulatory lifecycle?
Establish the exact document identity
| Supplier claim | Minimum information required |
|---|---|
| CEP available | Complete CEP number and current revision, substance, certificate type, holder, status, covered grade and access authorization |
| ASMF available | Holder, reference number, Applicant’s Part and Restricted Part versions, target authority, submission history and Letter of Access |
| US DMF available | DMF number, type, subject, holder, FDA activity status, intended regulatory use and Letter of Authorization |
| Full or local dossier available | Owner, current version, covered process and sites, access mechanism and responsibility for updates |
Compare these identities with the manufacturer and supply-chain profile created in Part 1. A dossier held by Company A cannot automatically support material produced by Company B, and a document covering synthesis at one facility may not cover micronization, sterilization or another operation performed elsewhere.
Verify CEP status, scope and access
Compare the supplier’s CEP with the public EDQM Certification Database. Confirm the complete number and current revision, holder, substance, certificate type, current status, listed sites, accepted grade or subtitle, additional tests or conditions, container system and retest period where stated.
Only one version of a CEP is valid at a given time. A genuine older copy cannot be accepted merely because it was valid when issued. The database should be checked again shortly before filing, variation or commercial approval. EDQM guidance on identifying the latest CEP version
A valid database entry establishes current certificate status; it does not establish that the applicant has permission to use it. The CEP holder—not merely a distributor selling the API—must provide the appropriate access authorization. Check whether the authorization covers the applicant, product, countries and corporate entities involved and who will issue revised access documents after a CEP change.
Also determine exactly what the CEP covers. Review the manufacturing route and sites, physical or micronized grade, polymorphic form, sterile status, additional impurity controls, packaging and retest period. A TSE CEP addresses the applicable TSE risk requirements; it is not a chemical-purity CEP or general approval of the substance.
A CEP does not remove the applicant’s responsibility to understand and control the API. Product-specific information may still be needed for impurity and nitrosamine risks, physical properties, microbiological quality, testing sites, packaging, stability and changes introduced since certification. EMA guidance on using a CEP
For example, a valid CEP may cover a standard non-micronized API while the offered material is micronized at another site. Additional GMP evidence, batch data, stability support and dossier information may be required before the micronized source can be considered covered.
Verify the ASMF arrangement
An ASMF contains an Applicant’s Part and a confidential Restricted Part. The applicant receives the information needed to evaluate and take responsibility for the API, while the authority receives both parts and can assess the complete drug-substance package. EMA ASMF procedure guideline
The buyer should not request disclosure of the Restricted Part. It should establish that:
- The complete current Applicant’s Part will be supplied
- Matching Applicant’s and Restricted Parts will be submitted to the relevant authority
- The versions and dates are controlled and reconcilable
- A valid Letter of Access will be issued
- The proposed process, sites and API grade are covered
- The holder will answer confidential authority questions and coordinate updates
- The applicant will receive changes affecting its application or authorised product
“ASMF available” is therefore not a one-time document claim. It is a commitment to maintain synchronized confidential and non-confidential information throughout the product lifecycle.
Assess a US Type II DMF without treating it as FDA approval
Confirm that the file is a Type II DMF covering the exact drug substance, holder, sites and manufacturing arrangement being offered. FDA publishes a list of received DMFs that includes the number, type, holder, subject and activity status.
An active status does not mean that FDA has approved the API, found the technical content adequate or resolved all deficiencies. FDA reviews DMF content when a particular application references it and states that DMFs are neither approved nor disapproved. FDA Drug Master File overview
For a Type II API DMF intended to support an ANDA, determine whether it has passed the applicable completeness assessment and is available for reference. Passing that assessment does not replace the later scientific review.
Verify the current activity status, manufacturing arrangement, Letter of Authorization process, date of annual update, known deficiency correspondence, regulatory contact and commitment to notify the applicant of relevant changes. Without appropriate authorization, FDA cannot rely on the confidential DMF information for the application.
Match every document to the actual supply arrangement
| Element | Required alignment |
|---|---|
| API identity | Same substance, salt, hydrate, solvate or other defined form |
| Manufacturer and sites | Same original manufacturer and synthesis, processing, testing, micronization or sterilization facilities |
| Manufacturing route | Same route and starting-material framework |
| Physical grade | Same particle-size, polymorphic or sterile status |
| Specification and packaging | Compatible controls and the same stability-supported commercial container |
| Holder and access | Current document owner with authority to maintain the file and authorize the applicant |
| Supply route | No undeclared operation that changes the material after the documented process |
A mismatch does not automatically make the supplier unacceptable, but the document cannot be assumed to cover the source until the gap and any additional regulatory action are understood.
Test regulatory support and change control
A technically sound file can fail operationally if the holder does not maintain it or respond during review. Identify who will issue access documents, submit confidential information, answer authority questions, communicate revisions, support variations and notify customers of suspension, withdrawal or loss of status.
A useful test is to submit one meaningful technical-regulatory question—for example, whether an offered physical grade is included in the dossier or how a process-specific impurity risk is communicated. The response shows whether the supplier can reach the correct document owner and return a controlled, usable answer.
The proposed agreement should require timely notification of material changes to starting materials, manufacturing route, sites, scale, recovered materials, impurity controls, specifications, analytical methods, physical grade, packaging, retest period, dossier ownership or regulatory status. “Updates will be provided when available” is not a controlled commitment.
Warning signs
Pause when the supplier provides only a document number; refuses to identify the holder; supplies an outdated revision; cannot obtain access authorization; offers a grade or site absent from the documented arrangement; describes an active DMF as “FDA approved”; or cannot explain how changes and authority questions will be managed.
Make the Pre-Audit Candidate Decision
Desktop verification should end with a controlled decision—not an accumulation of certificates, questionnaires and database screenshots. The candidate has not yet been approved; the decision establishes whether further qualification work is justified.
Apply mandatory eligibility gates
Before a candidate advances, the original manufacturer and supply chain must be traceable; the material must be technically plausible; relevant GMP evidence and regulatory history must be sufficiently established; the required dossier route must be usable; and material statements must be consistent and supported by responsible contacts.
Do not average a critical failure into a supplier score. A low price cannot compensate for an unidentified manufacturer. A successful future audit cannot make an inaccessible DMF usable. A genuine certificate for the wrong site cannot support the proposed source.
Write decision-ready risk statements
An observation states what was found. A decision-ready risk statement explains why it matters, which source or market it affects and what must happen next.
Example: The current CEP status is verified, but access for the proposed applicant and coverage of the micronized grade remain unconfirmed. The source cannot advance for the EU application until both are established.
Each material issue should identify the verified fact or uncertainty, affected API or site, potential quality or regulatory consequence, required evidence, responsible owner, deadline and effect on the candidate’s current status.
Assign one controlled candidate status
| Decision | Appropriate meaning |
|---|---|
| Advance | All mandatory desktop gates are satisfied, and the remaining questions can reasonably be evaluated during audit, representative sampling or contract finalization |
| Advance with defined conditions | No known disqualifier exists, but specified evidence or actions must be completed before a named later decision gate |
| Pause | Material uncertainty remains regarding identity, supply chain, technical fit, GMP status, regulatory usability or information integrity |
| Reject | The source is fundamentally incompatible, evidence is falsified or materially misleading, transparency is unacceptable or serious unresolved non-compliance prevents advancement |
A conditional advance must state the action, owner, completion evidence, deadline and whether it must be resolved before audit, sampling, filing or commercial approval. “Documentation to follow” is not a controlled condition.
Issue the candidate decision record
The record should connect the API and intended markets to the original manufacturer, sites, intermediaries, supply route, documents and versions reviewed, authority sources checked, material findings, conditions, decision justification and required audit or sample priorities.
Copies or controlled references should be retained because public databases, certificate versions and regulatory actions can change. The record must show what evidence supported the conclusion on the date it was made.
Advance does not mean approved. It means the evidence supports moving the defined API source into the next controlled stage of qualification.
From Verified Candidate to Qualified API Source
A candidate that advances has passed the desktop identity, technical, GMP and regulatory gates. The next stage must test those conclusions against operating evidence and representative material.
The audit should focus on the risks already identified rather than restart with a generic checklist. Sampling should establish that the tested material represents the proposed manufacturer, process, grade, packaging and commercial supply route.
Continue to Part 3
Move from desktop verification to risk-based GMP audit, representative sample testing, CAPA assessment and final source approval.
Part 3 begins with the candidate decision record and converts its residual risks into the audit, sample programme, quality agreement and final approval decision.
For teams still identifying potential sources, the GXgate Pharmaceutical Directory can be used to discover API manufacturers and other pharmaceutical companies. A directory listing is a starting point for contact and should not be interpreted as independent verification, qualification or approval.