
Incoming QC: 3 Checks That Stop Bad Batches on Arrival
A supplier COA is a declaration, not proof. Run incoming QC on arrival: seven checks that decide whether to release or reject a batch.
Table of Contents
If you work in pharmaceutical sourcing, API procurement, or drug development, you’ve probably seen the acronym DMF pop up in supplier qualification documents, FDA filings, and contract negotiations. But what exactly does it mean, and why does it matter so much in the global pharma supply chain?
Let’s cut through the jargon.
DMF = Drug Master File.
That’s the short answer. A DMF is a confidential technical document submitted to a regulatory authority (the U.S. FDA, European EMA, Health Canada, Japan’s PMDA, or China’s NMPA) that contains detailed information about how an Active Pharmaceutical Ingredient (API) is manufactured, controlled, and tested.
The key thing to understand: a DMF is not an approval. The FDA does not “approve” DMFs. Instead, when a drug company submits a New Drug Application (NDA) or Abbreviated New Drug Application (ANDA), it can reference a supplier’s DMF to support its filing without revealing the supplier’s proprietary manufacturing process.
Think of it as a secure vault where your CMC (Chemistry, Manufacturing, and Controls) data sits, accessible only to regulators.
This is spelled out directly in the FDA’s own regulations under 21 CFR 314.420: the agency reviews DMF content only in the context of an application that references it.
Before DMFs became standard practice, API manufacturers faced a dilemma:
Disclose your proprietary synthesis route and process details to every customer? Or lose business because you can’t provide the data they need for regulatory submission?
DMFs solved this by creating a third option: submit your data once to the regulator, keep it confidential, and let customers reference it by number. Your trade secrets stay protected. Your customers get what they need for their filings. Regulators get full visibility into quality and safety.
It’s a three-way win, which explains why DMFs have become the backbone of global API commerce.
Not all DMFs are created equal. The FDA categorizes them into five types, but one dominates the industry:
Type | Covers | Who Uses It |
Type I | Manufacturing facilities, personnel, SOPs | Contract manufacturers |
Type II | APIs, intermediates, materials used in drug production | API manufacturers (by far the most common) |
Type III | Packaging materials | Packaging suppliers |
Type IV | Excipients, colorants, flavors | Excipient suppliers |
Type V | Reference info, clinical data | Specialty cases |
Type II is the one you’ll encounter 90% of the time if you’re dealing with APIs. It covers everything from starting materials through intermediates to the final API — synthesis route, purification methods, impurity profiles, analytical specifications, stability data, packaging, and storage conditions.
According to Dr. Reddy’s API division, which maintains extensive DMF portfolios across multiple markets, a well-prepared Type II DMF typically runs 15 major sections covering facility information, drug substance characterization, complete manufacturing process documentation, stability studies, and regulatory compliance history.
If you’re evaluating whether a supplier’s DMF is robust, here’s what should be inside:
The impurity control section deserves special attention. According to ICH Q3A/Q3B guidance (which is embedded into modern DMF submissions), every identified impurity above the reporting threshold needs a qualified analytical method and a justified acceptance criterion. This is where many first-time filers get pushback from reviewers.
The pharmaceutical world has multiple ways to document API quality for regulators. Here’s how DMF stacks up against the alternatives:
Document Type | Region | Confidential? | Publicly Searchable? |
DMF | U.S. (FDA), Canada | Yes — fully confidential | No |
ASMF | Europe (EMA) | Yes — fully confidential | No |
CEP/COS | Europe (EDQM) | Partial — process section confidential | Yes, certificate is public |
MF | Japan (PMDA) | Yes | No |
The key practical difference: CEPs are public certificates, meaning anyone can look up who holds a CEP for a given substance on EDQM’s database. DMFs are black boxes — you can find out that a DMF exists and who holds it, but the contents remain between the holder and the regulator.
This confidentiality advantage is why many Asian API manufacturers prefer DMF over CEP when entering Western markets.
Knowing what a DMF is is one thing. Knowing how to check whether a supplier’s DMF is actually worth something is a different skill entirely. Here’s a practical walkthrough.
Ask your supplier for two pieces of information:
If they can’t provide a number, that’s a red flag. A filed but unnumbered DMF hasn’t completed the FDA’s administrative intake process.
The FDA maintains a public List of Drug Master Files (DMFs) that anyone can access. Third-party databases like DrugFuture, PharmaCompass, and YaoZhi aggregate this data with additional filtering.
What you’re looking for in the record:
Field | What to Check For |
Status | Active = current. Inactive or Withdrawn = the holder closed it. |
Holder name | Must match who you’re talking to. If it shows a different company entity, ask why. |
Type | Should be Type II for API purchases |
Subject/Description | Does it match the actual substance you’re buying? |
Initial filing date | How long has this DMF been around? Newer filings carry more uncertainty. |
A DMF listed as “Active” with the correct holder and type passes the first smell test.
This is where most buyers get stuck. Because DMF contents are confidential, you as the buyer cannot see inside the file. What you need from the supplier is an LOA (Letter of Authorization) — a formal letter from the DMF holder authorizing the FDA to let you reference their DMF in your regulatory submission.
What a valid LOA should contain:
Without this letter, the FDA will not allow you to reference the DMF in your filing — no exceptions.
An active DMF number tells you the file exists. It does not tell you if the data inside is solid. To go deeper, ask the supplier these questions:
Question | Why It Matters |
Has this DMF been referenced in an approved ANDA or NDA? | Proves a regulator has actually reviewed and accepted the quality data |
When was the last amendment filed? | Recent amendments mean the supplier is maintaining the file. No amendments in 5+ years raises questions about whether the manufacturing process still matches what’s on file |
Have there been any FDA deficiency letters or complete response letters related to this DMF? | This is the hard question. A reputable supplier will answer honestly; evasiveness is its own signal |
Do you also hold ASMF (EU) or CEP (EDQM) filings for this same API? | Multi-market coverage indicates serious regulatory commitment |
A DMF documents what the manufacturer says they do. An audit confirms whether they actually do it. The strongest position is: DMF referenced + LOA obtained + on-site audit passed + GMP certificate current. Any single pillar missing weakens your supply chain risk profile.
The scale of DMF activity reflects just how central this document is to global pharma supply chains:
These numbers tell a story: as generic drug pipelines grow and supply chain diversification becomes a priority (especially post-pandemic), more API manufacturers are treating DMF readiness as a competitive necessity rather than a nice-to-have.
From a buyer’s perspective, here’s the practical translation:
A supplier with a filed, referenced DMF saves you months of regulatory work. Instead of building CMC data from scratch for your ANDA or NDA, you reference their DMF number. The reviewer already has the manufacturing dossier. Your application moves faster.
But there are caveats worth knowing:
So here’s the plain version: DMF is how an API manufacturer hands over its manufacturing secrets to a regulator without every customer getting to see them. No other document in pharma quite does this job.
It’s not glamorous paperwork — it’s hundreds of pages of synthesis routes, impurity limits, stability charts, and analytical methods — but it’s what makes cross-border API trade actually work.
If you’re buying APIs, don’t take a supplier’s word for it that they “have a DMF.” Ask for the number. Look it up. Get the LOA. Check when it was last updated. Five minutes of verification now beats six months of FDA pushback later.
At Tianming Pharmaceutical, we’ve been through this process on both sides — filing our own DMFs and helping customers reference them in their submissions. We run cGMP-compliant production lines for intermediates and APIs, and we know that a DMF is only as good as the quality data inside it.
If you need a supply partner who can back up regulatory claims with actual documentation, get in touch — we can walk through what’s needed for your specific program. sunqian0123@gmail.com

A supplier COA is a declaration, not proof. Run incoming QC on arrival: seven checks that decide whether to release or reject a batch.

A vague request for quotation invites an inflated, inaccurate intermediate quote. This buyer’s guide shows the five costly RFQ mistakes that drive prices up and bids apart, and how to write an inquiry that gets comparable, honest quotes from pharmaceutical intermediate suppliers.

Every assay value on a COA is measured against a reference standard — if that standard is weak, every number built on it is weak. This guide explains the primary-to-working traceability chain and the seven costly mistakes buyers make when they never ask about standards.
Manufacturer and supplier of pharmaceutical APIs and intermediates. Contact us for technical support and sourcing solutions.