GDP Transport & Supply Chain · 7 min read
Bona Fide Checks: Verifying Customers and Suppliers
How UK and EU quality teams run GDP bona fide checks to verify customers and suppliers, with a step-by-step method, red flags and QMS controls.
By Balasubramanian Ramaiah · 9 June 2026 · Updated 29 August 2026
Under Good Distribution Practice, you may only source from, and supply to, parties who are genuinely authorised to handle medicinal products. Bona fide checks are the documented verifications that confirm a counterparty really is who it claims to be and holds the correct licence for the transaction in front of you. Get them wrong and you risk admitting falsified or diverted product into the legitimate chain; get them right and you have a defensible, inspection-ready control at the perimeter of your supply network.
What bona fide checks actually are
A bona fide check answers two linked questions before any medicine changes hands: is this organisation a real, identifiable legal entity, and is it authorised for the activity it is asking you to perform or perform for it? The European Commission's Guidelines on Good Distribution Practice of Medicinal Products for Human Use (2013/C 343/01), retained in UK law after EU exit and enforced by the MHRA, make this a non-negotiable expectation for holders of a Wholesale Dealer's Authorisation. The check applies in both directions of trade.
Crucially, this is broader than a one-off onboarding form. Authorisations can be varied, suspended or revoked at any time, so verification is an ongoing obligation owned by the Responsible Person and built into your quality management system. The principle is simple: trade only with the licensed, and be able to prove you checked.
Customer verification versus supplier verification
The two directions test different things. When you buy, you are confirming that the supplier is entitled to sell that category of product to you and that the goods are genuine. When you supply, you must satisfy yourself that the recipient is permitted to receive medicinal products at all, and is not, for example, a member of the public, an unlicensed trader or a healthcare professional buying outside their entitlement. A common deficiency is treating customer due diligence as a sales formality rather than a GDP control with the same rigour as supplier qualification.
The regulatory basis for verifying customers and suppliers
The GDP guidelines require wholesalers to obtain supplies only from persons who themselves hold a distribution authorisation or a manufacturing authorisation covering the product, and to supply only to those entitled to receive medicines. In the UK this maps to checking a counterparty's WDA(H) or Manufacturer's/Importer's Authorisation (MIA) against the MHRA's own published registers rather than relying on a copy they email you. For products within scope of falsified-medicines safety features, the obligations differ between Great Britain and Northern Ireland following EU exit, so confirm the current MHRA position for each leg before you act.
Verification sits within the wider quality framework. Quality risk management under ICH Q9 should determine how much scrutiny a given counterparty attracts, and your pharmaceutical quality system under ICH Q10 must capture the activity through change control, CAPA and management review. Brokers introduce a particular wrinkle: a registered broker never takes physical possession of product, yet still falls within GDP and must be verified before you transact through them.
How to run a defensible bona fide check
A robust check is a short, repeatable sequence rather than a single document request. The steps below scale from a routine repeat customer to a first-time cross-border supplier.
- Confirm legal identity. Capture the registered company name, number and trading address, and reconcile them against an independent register such as Companies House. A mismatch between the entity on the licence and the entity on the invoice is a classic red flag.
- Verify the authorisation at source. Check the WDA(H), MIA, broker registration or equivalent on the MHRA register or the relevant competent authority database, confirming it is current, not suspended, and covers the specific product categories in question.
- Check scope and product class. Authorisation to wholesale general medicines does not automatically extend to controlled drugs, refrigerated lines or specials. Match the licence scope to the actual order.
- Validate contact and banking details independently. Confirm details through known, official channels, not a phone number printed on the unsolicited document itself, to defend against impersonation.
- Record the evidence. Save dated screenshots or register extracts, the name of the person who performed the check and the outcome. Apply ALCOA+ so the record is attributable, legible, contemporaneous, original and accurate.
Our GDP and supply chain service builds these steps into a workflow the Responsible Person can stand behind at inspection, and our case studies show how a structured approach shortens onboarding without weakening control.
Red flags that should halt a transaction
- Unsolicited offers of high-demand or shortage lines at prices that undercut the legitimate market.
- Pressure to transact quickly, pay to a personal or recently changed account, or skip paperwork "just this once".
- A registered identity, licence holder and bank account that do not all align to the same legal entity.
- Reluctance to provide a verifiable authorisation number, or documents that cannot be reconciled with the regulator's register.
Building bona fide checks into your QMS
One-off diligence at onboarding is not enough. Verification should run on a risk-based cycle, with defined triggers for re-checking: a change of ownership, a new product category, a lapse in trading, or any regulatory action against the counterparty. Higher-risk relationships, new traders and anyone introducing third-country product warrant tighter intervals and deeper scrutiny than a long-standing, low-risk customer.
Make the control auditable end to end. A procedure should define who performs checks, what evidence is retained and for how long, and how an adverse finding escalates to suspension of trading. Linking the activity to your quality and compliance services and to the approved supplier and customer lists ensures the same discipline you apply to manufacturers extends across the whole network.
If you cannot show, on demand, that a counterparty was licensed at the moment product moved, then for inspection purposes the check did not happen.
Key takeaways
Bona fide checks are the frontline GDP control that keeps falsified and diverted product out of the legitimate chain, and they apply equally to the customers you supply and the suppliers you buy from. Verify identity and authorisation at source against the MHRA register, match licence scope to the actual order, document the evidence to ALCOA+ standards, and re-verify on a risk-based cycle owned by the Responsible Person within your ICH Q10 quality system. Treated this way, verification is not friction; it is proof that your supply chain trades only with the licensed.
If you want a verification framework that holds up under MHRA scrutiny and scales as you onboard new partners, talk to our team about embedding bona fide checks into your GDP system.
Regulatory sources
This guidance reflects current UK and EU GMP/GDP requirements. Primary references:
- EMA — GMP/GDP Questions & Answers
- MHRA Inspectorate Blog
- MHRA — UK Medicines & Healthcare products Regulatory Agency
Always confirm against the latest published version of each source.
Frequently asked questions
What is a bona fide check in pharmaceutical distribution?+
It is a documented verification that a customer or supplier is a genuine, identifiable legal entity and holds the correct authorisation for the medicines being traded. Under Good Distribution Practice you may only buy from and supply to appropriately licensed parties, and you must be able to evidence that you confirmed this at source. It is a core GDP control and a frontline defence against falsified or diverted product entering the legitimate supply chain.
How are customer checks different from supplier checks?+
Supplier checks confirm that the party selling to you is authorised to do so and that the goods are genuine, while customer checks confirm that the recipient is actually entitled to receive medicinal products. A frequent failing is treating customer due diligence as a sales formality rather than applying the same rigour used to qualify suppliers. Both directions must be verified against the regulator's own registers, not on documents supplied by the counterparty alone.
How often should bona fide checks be repeated?+
Verification should follow a risk-based cycle rather than a single check at onboarding, because authorisations can be varied, suspended or revoked at any time. Defined triggers, such as a change of ownership, a new product category, a lapse in trading or any regulatory action, should prompt re-verification. Higher-risk traders and third-country relationships warrant tighter intervals, and the schedule should be set out in your quality management system.