Introduction
When sourcing pharmaceutical Active Pharmaceutical Ingredients (APIs) from international suppliers — especially from China — verifying supplier credentials is one of the most critical steps in the procurement process. A Certificate of Analysis (COA), GMP certificate, and Drug Master File (DMF) are the three pillars of API quality documentation that every pharmaceutical buyer must understand and verify.
This practical guide breaks down each of these key documents, explains what to look for, how to spot red flags, and provides actionable verification steps. Whether you're a pharmaceutical manufacturer registering a new product, a procurement officer qualifying a new supplier, or a regulatory affairs professional preparing a dossier, this guide will help you make informed decisions.
Why This Matters: Regulatory agencies worldwide (US FDA, EMA, WHO, NMPA) require documented evidence that every API used in a finished pharmaceutical product was manufactured under controlled conditions and meets quality specifications. Failure to properly verify supplier credentials can result in regulatory rejection, product recalls, and significant financial losses.
1. Certificate of Analysis (COA) — The Batch Quality Passport
A Certificate of Analysis is the most frequently encountered document in API procurement. It accompanies every batch of API shipped and provides the analytical test results confirming that the specific batch meets quality specifications.
Essential COA Elements
Every legitimate COA should contain the following elements. If any of these are missing, it's a red flag:
| Element | What to Check |
|---|---|
| Company Header | Full company name, address, logo, and contact details of the manufacturer |
| Product Name & CAS | Must match your order — verify the exact INN name and CAS number |
| Batch / Lot Number | Unique identifier — must match the physical batch label on the packaging |
| Manufacture Date | Date of production; should not be unreasonably old |
| Expiry / Retest Date | Date until which the API is guaranteed to meet specifications |
| Reference Standard | Pharmacopoeial standard cited (USP, BP, EP, or CP) |
| Test Results Table | Each test item with specification, method, and actual result |
| Test Conclusion | Statement confirming whether the batch meets specifications |
| Signatures & Date | Authorized by QC manager and/or responsible person with signature and date |
Key Tests to Verify on the COA
- Assay / Potency: The active ingredient content — should be within the pharmacopoeial range (typically 98.0–102.0% or similar)
- Related Substances: Individual and total impurity levels — must be within limits; watch for impurities approaching specification limits
- Water Content: Karl Fischer result — critical for hygroscopic APIs
- Residual Solvents: Must comply with ICH Q3C limits — Class 1 solvents should be "not detected"
- Heavy Metals: Should meet pharmacopoeial limits (≤10–20 ppm typically)
- Microbial Limits: Total aerobic count, absence of specified pathogens (Salmonella, E. coli, etc.)
- Particle Size: D10/D50/D90 values — important for formulation performance
COA Red Flags
- COA issued by a different company than the manufacturer — ask why
- All results exactly at specification midpoint with no natural variation — may indicate fabricated data
- Missing test items that are required by the referenced pharmacopoeia
- No authorized signatures or unsigned COA
- Batch numbers don't match between COA and physical packaging labels
- Reference standard not specified or outdated pharmacopoeial edition cited
- COA format, font, or layout differs significantly between batches — suggests inconsistency
2. GMP Certificate — The Manufacturing Quality Assurance
A GMP (Good Manufacturing Practice) certificate confirms that an API manufacturer operates under a recognized quality management system. For Chinese suppliers, the GMP certificate is issued by the NMPA (National Medical Products Administration, formerly CFDA).
Types of GMP Certificates
| Certificate Type | Issued By | Significance |
|---|---|---|
| Chinese NMPA GMP | NMPA (China) | Basic requirement for Chinese API manufacturers; confirms domestic compliance |
| WHO-PQ GMP | WHO | Accepted by many regulatory agencies globally; essential for WHO-funded procurement programs |
| EU GMP | National authority in EU member state | Required for APIs used in EU-marketed medicines; highest standard for many buyers |
| US FDA GMP | US FDA (via inspection) | No formal "GMP certificate" but a satisfactory inspection record is equivalent; confirms compliance for US market |
| PIC/S GMP | PIC/S member authority | Mutual recognition among PIC/S members; widely accepted internationally |
How to Verify a GMP Certificate
- Check the Issuing Authority: Verify that the certificate was issued by the claimed regulatory body. Cross-reference with the authority's official database if available.
- Confirm Product Scope: The GMP certificate should specifically list the API(s) manufactured at the facility. A certificate for "pharmaceutical intermediates" is not equivalent to an API GMP certificate.
- Verify the Manufacturing Address: The certificate must specify the exact manufacturing site address. If the supplier has multiple facilities, ensure the correct one is covered.
- Check Validity: GMP certificates have expiry dates (typically 5 years). Confirm the certificate is current.
- Check for Inspection History: For US FDA and EU GMP, review the inspection history. FDA Form 483 observations and warning letters are publicly available on the FDA website.
Common Scam: Some suppliers share GMP certificates from affiliated companies or sister factories that are not the actual manufacturing site. Always confirm that the GMP certificate covers the exact facility and product you are purchasing. Request a factory visit or virtual audit to verify.
3. Drug Master File (DMF) — The Regulatory Filing
A Drug Master File (DMF) is a confidential document submitted to a regulatory authority (primarily US FDA) that contains detailed information about an API's manufacturing process, quality controls, and facility. The DMF allows a finished product manufacturer to reference the API supplier's quality information in their own drug application (ANDA/NDA) without revealing proprietary manufacturing details.
Key DMF Information
- DMF Number: A unique identifier assigned by the FDA (e.g., DMF 023456). This number is referenced in the finished product's application.
- Type II DMF: The most common type for API substances, covering the drug substance, its manufacturing process, and quality controls.
- DMF Status: Check whether the DMF is "active" (available for reference) or "inactive" (withdrawn or not maintained). Inactive DMFs cannot be referenced in new applications.
- Letter of Authorization (LOA): The DMF holder must provide an LOA to the finished product manufacturer, authorizing them to reference the DMF in their filing.
DMF vs. ASMF (EU Equivalent)
In the European Union, the equivalent of a DMF is called an ASMF (Active Substance Master File). The key difference:
| Feature | US DMF | EU ASMF |
|---|---|---|
| Authority | US FDA | EDQM / National CAs |
| Numbering | DMF number (e.g., 023456) | ASMF number |
| Reference | LOA (Letter of Authorization) | ASMF access letter |
| Public Status | Available on FDA DMF list | Registered in EudraGMDP database |
How to Verify a DMF
- Go to the FDA DMF Database (available on the FDA website) and search by DMF number or company name
- Verify that the DMF status is listed as "Active" — not "Withdrawn", "Inactive", or "Closed"
- Confirm the DMF holder's company name matches your supplier
- Check the last "Letter of Authorization" date to confirm the DMF is being actively maintained
- Request the LOA from the supplier for inclusion in your ANDA/NDA filing
4. CEP (Certificate of Suitability) — The European Quality Passport
The CEP (Certificat d'Adaptation Européen) is issued by the EDQM (European Directorate for the Quality of Medicines) and confirms that an API meets the quality requirements of the European Pharmacopoeia. It is widely recognized beyond the EU.
CEP Verification Steps
- Check the EDQM Public Database: Visit the EDQM website (cepdatabase.edqm.eu) and search by CEP number, substance name, or company name
- Verify Substance Scope: The CEP should specifically cover the API you are purchasing — some companies hold CEPs for specific salts or forms
- Check CEP Status: Should be "Active" or "Valid" — if "Suspended" or "Withdrawn", investigate the reason
- Review the Revision History: CEPs are periodically updated. The latest revision date should be within the past 5 years
Tip: A supplier with an active CEP generally indicates a high-quality manufacturer, as the EDQM conducts thorough reviews and periodic inspections. CEP-holding Chinese API suppliers are among the most qualified in the industry.
5. Complete Supplier Qualification Checklist
When qualifying a new API supplier, use this comprehensive checklist to ensure thorough due diligence:
- GMP certificate verified — correct product scope, facility address, and valid expiry date
- DMF or ASMF status confirmed as active through official regulatory databases
- CEP verified through EDQM database (if applicable)
- Evaluation sample received and independently tested against pharmacopoeial standard
- Sample COA reviewed — all required test items present with acceptable results
- MSDS/SDS reviewed for safety and transport compliance
- Company profile reviewed — years in operation, production capacity, key client references
- Regulatory inspection history checked — FDA Form 483s, warning letters, EDQM inspection reports
- Quality Agreement drafted and signed covering specifications, change control, deviation reporting
- First commercial batch COA received and verified against approved specifications
6. Special Considerations for Chinese Suppliers
When sourcing APIs from Chinese suppliers, there are some specific points to keep in mind:
- NMPA Database Verification: The NMPA maintains an online database of licensed pharmaceutical manufacturers. Cross-reference the supplier's license number.
- Language Barrier: Chinese GMP certificates and COAs are sometimes issued in Chinese only. Request English translations for regulatory submissions.
- Trading Company vs. Manufacturer: Clarify whether your supplier is the actual manufacturer or a trading company. Trading companies can add value (logistics, documentation support) but you need the manufacturer's GMP certificate for regulatory purposes.
- Environmental Compliance: China's environmental regulations have tightened significantly. Suppliers with strong environmental compliance records are more likely to maintain stable production.
- Business License: Request a copy of the supplier's Chinese Business License (营业执照) to verify the company's legal status and registered scope of business.
Working with CN-ConnectWorld: As a specialized API trading company, CN-ConnectWorld helps buyers navigate the supplier qualification process. We pre-qualify all our manufacturing partners, maintain copies of GMP certificates, DMF references, and CEPs, and can provide COAs and other documentation directly. This significantly reduces the time and effort required for supplier qualification.
Key Takeaways
- The COA, GMP certificate, and DMF form the three essential pillars of API supplier qualification
- Always verify GMP certificates and DMF status through official regulatory databases — don't rely solely on supplier-provided documents
- Pay close attention to COA completeness: all pharmacopoeial test items, authorized signatures, matching batch numbers, and realistic results
- CEP-holding suppliers represent the highest quality tier for European and international markets
- Conduct independent sample testing as the final quality gate before placing commercial orders
- A structured supplier qualification checklist ensures consistency and thoroughness across your supply chain
- Working with an experienced trading partner can significantly simplify the qualification process for buyers new to international API sourcing
Need Help Verifying API Supplier Credentials?
CN-ConnectWorld works exclusively with GMP-certified Chinese API manufacturers. We provide COAs, GMP certificates, DMF references, and can assist with supplier qualification for your regulatory submissions.