How to Verify a Cosmetic Manufacturer in Malaysia Before You Place an Order

Anyone can publish a website with a photograph of a factory floor. Verifying that the company behind it manufactures anything takes about fifteen minutes, costs nothing, and almost nobody does it.

If you are sourcing from a cosmetic manufacturer in Malaysia, here are five checks you can run before the first call, in order of how much they tell you. We pass all five, and we have included how to check us specifically, because a guide you cannot apply to its author is not worth much.

Check 1: the NPRA licensed manufacturer register

This is the strongest check available and the least used.

Malaysia's National Pharmaceutical Regulatory Agency, part of the Ministry of Health, publishes a public list of licensed cosmetic manufacturers. It is a regulator's record, not a self-declaration, and it is free to search.

What to do: open the NPRA cosmetic manufacturer list and search for the company name. Then compare the address on the register against the address the company gave you.

How to read the result:

Listed, at the address they gave you. The strongest possible confirmation. The regulator records them as manufacturing cosmetics at that site.

Listed, at a different address. Not necessarily a problem, but ask. Companies relocate, and some operate an office separately from a plant. You want to know which site your product would be made at.

Not listed at all, while describing themselves as a manufacturer. This is the finding that matters. Ask directly which licensed facility manufactures the product. A trader or a brand-side intermediary can be a perfectly legitimate partner, but you should know that is what you are dealing with, because it changes what you can control.

Spelling varies on the register. We appear as "H E Manufacturing (M) Sdn. Bhd." with a space, rather than the "HE Manufacturing" used on our own site. Search on a distinctive fragment of the name rather than an exact string.

Check 2: ask for certificates, not certification logos

A logo on a website is a graphic. A certificate is a document with an issuing body, a scope and an expiry date.

Ask for the document, then read three things on it.

The issuing body. ISO certificates are issued by certification bodies, which are themselves accredited by national accreditation bodies. Our ISO 9001:2015 certificates are issued by Bureau Veritas under both UKAS and Standards Malaysia accreditation. Two accreditations on the same standard is unusual and worth asking about if you see only one.

The scope. A certificate covers specific activities at specific sites. A company with two plants may have certified only one. Ask explicitly whether the scope covers the plant that would make your product. Ours covers both plants on our site.

The expiry date. Certificates lapse. A valid-looking scan can be years out of date.

We publish four certificate documents on our quality page: ISO 22716:2007 cosmetics GMP, two ISO 9001:2015 certificates, and GMP compliance issued by the NPRA. Signatures, QR codes and certificate numbers are deliberately obscured on the published scans, which is normal practice to prevent misuse; the unredacted documents are available on request.

One honest note on Halal, because it illustrates the point. Our facility is JAKIM Halal certified and we do not publish that certificate online. We provide it on request. The absence of a document from a website is not evidence that the certification does not exist, which is exactly why asking is the check, not browsing.

Check 3: separate registration from approval

This is where buyers are most often misled, usually by companies that do not realise they are doing it.

"FDA registered" is not an FDA endorsement. Under US MoCRA, cosmetic facilities exporting to the United States are required to register with the FDA. Registration is mandatory paperwork, not a quality assessment, and the FDA states plainly that it does not approve cosmetics or cosmetic facilities.

We describe ourselves as "US MoCRA facility registered" and say in the same breath that this is a mandatory registration and not an FDA approval or endorsement. A supplier claiming to be "FDA approved" for cosmetics is either careless with language or hoping you will not check. Either is worth noting.

The same care applies to RSPO. Membership of the Roundtable on Sustainable Palm Oil describes a sourcing commitment. Whether a specific product may carry an RSPO claim depends on the supply chain model used for that order. Our membership record is published by the RSPO itself, under member number 9-1840-16-000-00, which you can verify without asking us.

Check 4: ask who holds the market notification

Ask a direct question: who notifies the product in my market?

The honest answer is almost never "we do". In most markets the notification is held by a locally established party: the importer, the local licence holder, or an appointed responsible person. In the European Union, the importer is normally the Responsible Person unless another EU-established party is formally designated. Across ASEAN, requirements are harmonised in substance by the ASEAN Cosmetic Directive, but notification is national and sits with a local party in each market.

A manufacturer that claims it will handle all regulatory matters for you is either taking on duties it cannot legally hold, or has not thought it through. Our United States, European Union and Southeast Asia pages set out which tasks sit where, and we state plainly which ones remain yours.

Check 5: ask the questions a factory can answer and a trader cannot

Five questions, asked on a call, that are difficult to answer without a plant.

• Can we follow one batch from issued raw materials to the finished pallet?
• Where is the retention sample for a batch stored, and for how long?
• Which specific tests release a batch, and who signs that release?
• What happens when a batch fails a specification?
• Can we visit, and when?

Specific answers to these indicate an operating facility. Generalities indicate someone describing a facility they do not control. Our quality process page documents our answers, and our contract manufacturing page explains the project structure.

The last question is the simplest. A manufacturer with nothing to hide will host a visit. Our two plants are adjacent on one site in Rawang, so a single visit audits both.

Check 6: do they publish their commercial terms?

A softer signal, but a telling one. Most manufacturer websites in this market will not state a minimum order or a lead time anywhere, and will not give you one until you have had two calls.

Sometimes that is reasonable, because a minimum genuinely does depend on the pack. Often it means the company does not set the minimum, because it is not the one manufacturing, and has to go and ask.

For the record, ours: minimum order starts at 5,000 units, and typical production lead time is 3 to 4 weeks after formula and artwork approval. The exact minimum for a project depends on the bottle, closure and decoration method, because packaging components carry their own supplier minimums, and we will say which part of your spec is driving it.

You do not have to take a published figure at face value either. Ask what drives it. A manufacturer can tell you immediately that it is the pump minimum or the carton tooling. An intermediary will be vague, because the answer is somebody else's.

Frequently asked questions

How do I check if a Malaysian cosmetics company is a real manufacturer?

Search the licensed cosmetic manufacturer register published by Malaysia's National Pharmaceutical Regulatory Agency, and compare the address listed there against the address the company gave you. It is free, it is a regulator's record rather than a self-declaration, and it is the single most informative check available. Allow for spelling variations in the company name.

Is a company that is not on the NPRA register necessarily a problem?

Not necessarily, but it changes what you are buying. A trading company, agent or brand-side intermediary can be a legitimate partner. What matters is knowing which it is, because it determines whether you can adjust a formula, audit the site, or get a batch record. If a company describes itself as a manufacturer and is not on the register, ask which licensed facility makes the product.

What is the difference between FDA registered and FDA approved for cosmetics?

The FDA does not approve cosmetics or cosmetic facilities. Under US MoCRA, facilities exporting cosmetics to the United States must register, which is mandatory paperwork rather than an assessment of quality. Any supplier describing itself as "FDA approved" for cosmetics is using language the FDA itself rejects.

Should I be worried if a manufacturer will not publish a certificate online?

No, as long as they provide it on request. Publishing certificate scans invites misuse, and many manufacturers redact signatures and certificate numbers on any version they do publish. We publish four documents in redacted form and provide our JAKIM Halal certificate on request rather than online. Ask for the document and read the issuing body, the scope and the expiry date.

Does a certification cover a manufacturer's whole operation?

Not automatically. A certificate names specific activities at specific sites, so a company with more than one plant may have certified only one of them. Ask explicitly whether the scope covers the plant that would produce your product. Ours covers both plants on our Rawang site.

Why will most manufacturers not tell me their minimum order?

Partly because it genuinely varies with the packaging rather than the formula, and partly because some suppliers are not the ones setting it. Our minimum starts at 5,000 units with a 3 to 4 week production lead time after approval, and when we quote a higher minimum we tell you which component is driving it. The useful follow-up question for any supplier is not what the minimum is, but what determines it.

Who is responsible for notifying my product in its market?

In almost all cases, a locally established party rather than the manufacturer: the importer, the local licence holder, or a designated responsible person. The manufacturer supplies the formula, specification, test and manufacturing documentation those submissions need. Be cautious of any supplier that claims to take on the legal duties assigned to a party in your own market.

Verifying us

Everything above applies to us. We are on the NPRA register at our Rawang address, four certificate documents are published on our quality page, our RSPO membership is published by the RSPO, and we will host a visit. If you would like the unredacted certificates or a factory visit, get in touch.