Supplier Bona Fides and the Falsified Medicines Directive

Establishing supplier bona fides is one of the most decisive controls a pharmaceutical quality team operates, and it sits at the heart of the EU Falsified Medicines Directive (FMD). Knowing precisely who you are buying from, who is broking the deal, and whether every party in the chain holds the right authorisation is what separates a resilient supply chain from one that quietly admits falsified product. This article sets out how to verify supplier credentials properly and how the FMD reshapes that obligation for UK and EU quality teams.

Why supplier bona fides sits at the centre of falsified medicines defence

Falsified medicines do not enter the legitimate chain through obvious fraud; they enter through gaps in oversight. A plausible website, a copied authorisation certificate, a broker offering scarce stock at an attractive price — these are the vectors. Verifying supplier bona fides means confirming, with documented evidence, that a counterparty is who they claim to be and is legally entitled to supply the products in question.

The FMD, transposed in the EU through Directive 2011/62/EU and operationalised by Delegated Regulation (EU) 2016/161, introduced two physical safeguards — unique identifiers and anti-tampering devices — alongside reinforced obligations on wholesale dealers and a duty to deal only with authorised persons. Following EU exit, the UK retains its own safety-features framework, and the position differs between Great Britain and Northern Ireland, with Northern Ireland continuing to align with the EU system. Quality teams operating across both must understand which regime applies to each transaction.

The regulatory backbone: from EU GMP to GDP

Bona fides checks are not a discretionary nicety; they are an explicit expectation of the EU Guidelines on Good Distribution Practice (2013/C 343/01). Wholesale dealers must verify that suppliers are authorised, that customers are entitled to receive medicines, and that procurement and supply are traceable. Within the manufacturing space, EU GMP Chapter 5 and the relevant chapters on outsourced activities require that starting materials and contracted services are sourced from approved, qualified parties.

The discipline is reinforced by ICH Q9 on quality risk management and ICH Q10 on the pharmaceutical quality system: supplier risk should be assessed, proportionate controls applied, and the whole arrangement governed under a defined quality system. Data supporting these decisions — certificates, declarations, audit records — must meet ALCOA+ expectations so that the evidence is attributable, legible, contemporaneous, original and accurate. A verification that cannot be reconstructed during inspection is, in practice, no verification at all.

Great Britain and Northern Ireland after EU exit

The FMD safety features (unique identifier and anti-tampering device) and decommissioning at supply continue to apply in Northern Ireland under the EU framework. In Great Britain, the statutory safety-features requirements that depended on the European hub no longer operate in the same way, and the MHRA has set out its own expectations for supply-chain controls. The practical lesson is that a single, blanket procedure is rarely sufficient; your processes must reflect the regime governing each leg of the transaction.

How to verify supplier bona fides in practice

Robust verification is methodical and repeatable. For each new supplier, broker or trader, confirm the following before any transaction proceeds:

• Authorisation status — confirm the wholesale dealer (WDA), manufacturer (MIA) or relevant licence directly against the issuing regulator's public register, not against a document the supplier has emailed you.
• Identity and registered details — reconcile company name, registered address and site address against official company and licensing records; investigate any mismatch.
• Scope of authorisation — check that the licence actually covers the dosage forms, activities and territories relevant to your purchase.
• Brokers and traders — confirm registration as a broker where required, and remember that a broker never takes ownership of product; an entity behaving inconsistently with its stated role is a warning sign.
• Responsible Person — establish that a named RP (or RPi for imports) is in place and accountable for the relevant activities.

Re-verification on a risk-based cycle matters as much as the initial check, because authorisations are varied, suspended and revoked. Structured, periodic supplier management ensures credentials are revalidated and that any regulatory action against a counterparty is detected promptly rather than after product has changed hands.

Red flags that warrant a stop

Certain signals should halt a transaction until resolved: pricing markedly below market for scarce lines; pressure to buy immediately; reluctance to provide a verifiable licence number; packaging, language or batch documentation that does not match the stated origin; and payment routed to a third party unconnected to the named supplier. None of these is conclusive alone, but each justifies escalation and a documented decision under your quality system.

Building bona fides into your quality management system

Verification only protects you if it is embedded, not improvised. The supplier qualification process should be defined in an SOP, owned by Quality, and integrated with change control, deviation management and the approved-supplier list. Decisions to approve, restrict or reject a supplier should be risk-assessed and signed off by the appropriate quality authority — frequently the QP or Responsible Person.

Inspectors increasingly probe whether bona fides checks are genuinely performed and recorded, rather than asserted on paper. Our case studies show how proportionate, well-documented qualification withstands scrutiny while keeping legitimate trade moving. Where in-house resource is stretched, contract QP, RP and RPi support can provide the necessary oversight, and our wider services are designed to slot into an existing quality system rather than replace it.

Key takeaways

Verifying supplier bona fides is a frontline defence against falsified medicines, not a box-ticking formality. The strongest programmes share a few traits:

1. Authorisations are confirmed at source, against the regulator's own records, and re-verified on a risk basis.
2. Processes distinguish clearly between the GB and Northern Ireland regimes and reflect each transaction accordingly.
3. Evidence meets ALCOA+ and is governed under an ICH Q10 quality system with QP or RP oversight.
4. Red flags trigger a documented stop, not a quiet exception.

If you would like an independent review of how your organisation establishes supplier bona fides under the FMD and GDP, contact our team to discuss a proportionate, inspection-ready approach.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.