How to Verify a Pharmaceutical Supplier: WHO-GMP, EU-GMP, CoPP, CoA and Red Flags

Last updated: 24 September 2026.

You verify a pharmaceutical supplier by checking the manufacturing site, not the brochure: confirm who actually makes the product, look the site up in the regulators' own public databases, check the Certificate of Pharmaceutical Product with the authority that issued it, and read every certificate of analysis line by line. This guide explains what WHO-GMP, EU-GMP, PIC/S, a CoPP and a CoA really prove, where to check each one for free, and the red flags that should stop a purchase.

Why this matters more than price

WHO estimates that at least 1 in 10 medical products in low- and middle-income countries is substandard or falsified. That isn't an abstract statistic. In 2022 and 2023, cough syrups contaminated with diethylene glycol and ethylene glycol, industrial solvents that should never be in a medicine, were linked to more than 300 deaths, mostly children, across three countries.

For a distributor or hospital, a bad supplier costs far more than a bad price. It can mean a product recall, a lost licence, or worse. The good news is that most of the checks that matter are free, public and take less than an hour.

Rule one: verify the site, not the company

GMP certificates, inspections and approvals all relate to a specific manufacturing site, at a specific address, often for specific dosage forms. A company can have one excellent plant and one that has just failed an inspection. A trader can hold no manufacturing licence at all and still send you an impressive company profile.

So the first question for any new supplier is simple: who manufactures this product, and at which site address? Every check below depends on that answer. A supplier who can't or won't give it to you has already told you something important.

What each certificate really proves, and where to check it

"WHO-GMP"

This is the most misunderstood term in pharma trade. WHO does not inspect or certify manufacturers for GMP. A so-called "WHO-GMP certificate" is issued by the exporting country's own regulator under the WHO Certification Scheme. In India, for example, it follows a joint inspection by CDSCO and the State Licensing Authority.

WHO's own guidelines say these certificates should not carry the WHO logo. A "WHO-GMP certificate" with a WHO logo on it isn't a sign of quality. It's a sign that someone has misunderstood the scheme, or is hoping you have.

How to check: ask which authority issued it, and confirm with that authority.

WHO Prequalification

This is different, and it's genuinely WHO's own assessment. WHO Prequalification evaluates medicines, mainly for HIV, TB, malaria, reproductive health and other priority areas, for procurement by UN agencies and donors. More than 1,700 products were listed by the end of 2025. If your product and manufacturer are prequalified, that's one of the strongest quality signals available.

How to check: WHO publishes searchable lists of prequalified finished products and APIs, and its public inspection reports (WHOPIRs), free online.

EU-GMP

An EU-GMP certificate means an inspectorate of an EU member state, or one working on its behalf, has inspected the site. It matters most if you supply regulated markets or tenders that ask for it.

How to check: search EudraGMDP, the EU's public database. It lists GMP certificates by site and, crucially, statements of non-compliance, which have been public since 2013. Always search for both. A site can hold an old certificate and a newer non-compliance statement.

US FDA

If a supplier says it's "FDA-approved" or "FDA-inspected", check it:

• FDA Data Dashboard and Inspection Classification Database: inspection outcomes are classified as NAI (no action indicated), VAI (voluntary action indicated) or OAI (official action indicated, meaning an unacceptable state of compliance).
• Warning Letters: searchable by company.
• Import Alert 66-40: the "Red List" of firms whose drugs the FDA detains at the border because they haven't met GMP. A site on this list may still be selling elsewhere.

PIC/S

PIC/S, the Pharmaceutical Inspection Co-operation Scheme, is a network of 57 regulatory authorities that apply harmonised GMP standards. Membership belongs to the regulator, not to the factory. "Our country is a PIC/S member" doesn't mean a particular plant has passed a PIC/S-standard inspection. Ask for that site's own GMP certificate from its own regulator.

India: revised Schedule M

India notified a revised Schedule M, its GMP standard, in December 2023, bringing it closer to international standards. Larger manufacturers had to comply first. Smaller firms, with turnover up to ₹250 crore, were given until 31 December 2025 after an extension, and CDSCO asked state authorities to begin Schedule M inspections in November 2025. When buying from India, it's reasonable to ask whether the site has been inspected against the revised Schedule M.

China: no GMP certificates since 2019

China abolished GMP certificates on 1 December 2019 and replaced them with ongoing inspections. A Chinese "GMP certificate" dated after that should be treated as a red flag. For marketing status and inspection history, ask for the CoPP. Chinese CoPPs issued by provincial regulators are published in Chinese and English on the NMPA website.

The Certificate of Pharmaceutical Product (CoPP)

A CoPP is issued by the exporting country's regulator under the WHO Certification Scheme. Many importing regulators require one for registration. Under WHO's guidelines it confirms three things:

• whether the product is authorised to be placed on the market in the exporting country;
• whether the manufacturing site is inspected at suitable intervals for GMP compliance;
• whether the product is actually on the market there.

Read the answers, not just the letterhead. A product "authorised for export only" and never sold at home is not automatically a problem, but you should know it. To verify a CoPP, contact the issuing authority directly, using contact details you find yourself, not ones printed on the certificate. Some authorities now issue electronic certificates that can be checked online.

The certificate of analysis (CoA)

Every batch should come with a CoA, and it deserves more than a glance. WHO's model certificate of analysis sets out what a proper CoA contains:

• the product name, the batch number, and the manufacture and expiry dates;
• the name and address of the original manufacturer;
• the specification and test method for each test, for example a pharmacopoeia reference;
• actual numerical results, not just "complies";
• the name and address of the laboratory that did the testing;
• a dated signature from an authorised person.

Two checks catch most problems. First, does the batch number on the CoA match the batch on the packs? Second, if the CoA comes from a trader, WHO's guidance is clear: it should name the original manufacturer and the testing lab, and a copy of the original manufacturer's CoA should be attached. A trader's CoA that hides the manufacturer is exactly the gap that falsified products slip through.

A one-hour supplier check

For a new supplier, before the first order:

1. Get the manufacturer's name and full site address for the exact product and dosage form.
2. Get the site's manufacturing licence and GMP certificate, and note which authority issued them and when.
3. Search EudraGMDP, the FDA databases and, where relevant, WHO Prequalification for the site. Look for non-compliance statements, OAI inspections, warning letters and Import Alert 66-40.
4. Ask for the CoPP and verify it with the issuing authority.
5. Ask for a recent CoA for the product, and check it against WHO's model.
6. Check that the names match: the company on the invoice, the licence, the CoPP and the CoA should connect in a way that makes sense. If they don't, ask why.
7. For high-value, high-risk or long-term supply, commission a site audit, your own or a qualified third party's.

Red flags that should stop a purchase

Regulators use a similar list. The UK's MHRA and the EU's Good Distribution Practice guidelines both point to the same warning signs:

• A price that's too good to be true, well below the market.
• Unusually large quantities of a product that's normally scarce or tightly allocated.
• Pressure to close fast, and payment demanded immediately with no credit offered.
• Unsolicited offers from suppliers you've never dealt with.
• A trader who won't name the manufacturer or the site.
• Certificates that don't match: a WHO logo on a "WHO-GMP" certificate, or a Chinese GMP certificate dated after 2019.
• A CoA with no numerical results, no testing laboratory, or a batch number that doesn't match the goods.

None of these on its own proves fraud. Each is a reason to stop and check before money moves.

How PharmaTradz approaches this

When you post a sourcing requirement, we match it only to manufacturers we've verified as GMP-certified for your destination market. If you've already found a supplier and want a second opinion on their documents before you commit, get in touch.

Frequently asked questions

Does WHO issue GMP certificates?

No. So-called "WHO-GMP" certificates are issued by national regulators under the WHO Certification Scheme. WHO's own assessment programme is WHO Prequalification, which is separate and published online.

How can I check if a manufacturer has EU-GMP?

Search the site in EudraGMDP, the EU's public database. Check for both GMP certificates and statements of non-compliance.

How do I check a manufacturer's FDA status?

Use the FDA Data Dashboard and Inspection Classification Database for inspection outcomes, the Warning Letters database, and Import Alert 66-40 for firms whose drugs are detained for GMP failures.

What is the difference between a CoPP and a GMP certificate?

A GMP certificate covers a manufacturing site. A CoPP covers a specific product: it confirms whether that product is authorised and marketed in the exporting country, and whether its manufacturing site is regularly inspected for GMP.

Can I trust a certificate of analysis from a trader?

Only if it names the original manufacturer and the testing laboratory, and the original manufacturer's CoA is attached, as WHO's guidance recommends.

Need a supplier you can trust for a specific product and market? Post your requirement. Our RFQ guide shows what to include.

Sources

• Substandard and falsified medical products, fact sheet (WHO, December 2024)
• 1 in 10 medical products in developing countries is substandard or falsified (WHO, November 2017)
• Medical Product Alert N°6/2022 (WHO, October 2022)
• WHO urges action to protect children from contaminated medicines (WHO, January 2023)
• WHO Certification Scheme (WHO)
• Guidelines on the implementation of the WHO certification scheme (WHO TRS 1033, Annex 9, 2021)
• CDSCO Guidance Document (CDSCO, 2024)
• Prequalification of medicines by WHO, fact sheet (WHO, June 2026)
• WHO prequalified finished pharmaceutical products (WHO)
• WHO public inspection reports, WHOPIRs (WHO)
• EudraGMDP database (European Medicines Agency)
• EudraGMDP public search
• Statements of non-compliance with GMP now publicly available (EMA, December 2013)
• About PIC/S (PIC/S)
• FDA Data Dashboard, inspections (US FDA)
• Inspection Classification Database (US FDA)
• Warning Letters (US FDA)
• Import Alert 66-40 (US FDA)
• Deadline extended for small pharma companies on revised Schedule M (The Statesman, February 2025)
• CDSCO asks states to start Schedule M inspections (Business Standard, November 2025)
• China abolishes GMP certification (NMPA, November 2019)
• Certificates of Pharmaceutical Product in China (NMPA, July 2026)
• WHO model certificate of analysis (WHO TRS 1010, Annex 4, 2018)
• Good storage and distribution practices for medical products (WHO TRS 1025, Annex 7, 2020)
• Too good to be true? Protecting the UK medicines supply chain (MHRA Inspectorate, July 2021)
• Qualification of suppliers under EU GDP (ECA Academy, September 2025)