WHO-GMP, US DMF, and CEP: What These Certifications Actually Tell an API Buyer

Buyers sourcing APIs from India ask for “FDA approval” more often than the phrase actually applies. A bulk active pharmaceutical ingredient isn’t the kind of thing the FDA approves on its own — that approval sits with a finished drug product, filed by whoever holds the ANDA or NDA. What actually exists at the API-supplier level are three separate documents, each answering a different question, and buyers who don’t know which one they need end up asking for the wrong paperwork or, worse, assuming a WHO-GMP certificate covers ground it doesn’t.

The Three Documents That Actually Get Asked For

WHO-GMP

WHO-GMP certification confirms that a manufacturing site follows the World Health Organization’s Technical Report Series quality guidelines — equipment qualification, documentation control, batch record integrity, that kind of thing. It’s issued after an audit, usually by the national regulatory authority (in India, the relevant State FDA or CDSCO), and it’s a baseline manufacturing-quality signal. It is not a market authorization. A WHO-GMP certificate tells a buyer the facility is run properly; it doesn’t tell them the API is registered anywhere, and it isn’t a substitute for a DMF or CEP where either of those is actually required.

US DMF (Type II)

A Drug Master File is confidential information — manufacturing process, impurity profile, stability data — filed directly with the FDA by the API manufacturer. Here’s the part that surprises most first-time buyers: a DMF is never itself “approved.” It sits on file, inactive, until an ANDA or NDA holder in the US references it in their own filing and the API manufacturer issues that company a Letter of Authorization (LOA) granting the FDA permission to cross-reference the confidential data. If you’re buying an API for a US-bound generic filing, the DMF number by itself doesn’t do anything for you — you need the manufacturer’s confirmation that they’ll issue an LOA when your regulatory team requests one.

CEP (Certificate of Suitability)

Issued by EDQM, the European Directorate for the Quality of Medicines (a Council of Europe body, not an EU institution, though EU regulators rely on it), a CEP confirms that an API’s manufacturing process meets the relevant European Pharmacopoeia monograph. It’s the document EU marketing-authorization dossiers usually ask for in place of a full quality module. Not every API has one — getting a CEP filed and granted typically takes EDQM upward of a year from submission, so if your registration timeline in Spain, Germany, Poland, or elsewhere in the EU depends on one existing, confirm it’s already granted, not “in progress,” before you build a launch date around it.

What to Actually Request Before You Order

For most orders, a batch-specific Certificate of Analysis and MSDS cover the immediate shipment. Beyond that, what you ask for depends on where the finished product is headed: a DMF reference number (and LOA commitment) for US filings, a CEP number for EU dossiers, and for most other markets, confirmation of WHO-GMP status plus whatever local pharmacopoeial standard (USP, BP, EP) the API is manufactured to. Asking a supplier “do you have FDA approval” gets you a vague answer either way — asking for the specific document tied to your market gets you a specific, checkable one.

Where This Fits at Aarise Pharma

Aarise Pharma’s Haridwar facility is WHO-GMP certified, and APIs are supplied with DMF references for buyers filing in DMF-recognizing markets, alongside the standard COA and MSDS on every shipment. Country-specific regulatory notes — including which documentation buyers in each market typically ask for — are covered on the export markets page, with detail for markets including Germany, the Netherlands, and the USA.

Frequently Asked Questions

Is a WHO-GMP certificate the same as FDA approval?

No. WHO-GMP certifies that a manufacturing site follows WHO Technical Report Series quality guidelines. It says nothing about whether a specific finished drug product is approved to sell in any market — that approval sits with the buyer’s own drug registration, not the API supplier’s manufacturing certificate.

What is a US DMF and why doesn’t it get “approved” on its own?

A Drug Master File is confidential process and impurity data filed with the FDA. It has no independent approval status — it sits inactive until an ANDA or NDA holder references it and the API manufacturer issues them a Letter of Authorization. Ask any US-bound API supplier for the DMF number and whether they’ll issue an LOA; if they hesitate on the LOA, the DMF number alone is not usable.

Do I need a CEP if I’m not selling into the EU?

Generally no. A Certificate of Suitability from EDQM confirms an API’s manufacturing process meets a European Pharmacopoeia monograph, and it’s typically only requested as part of an EU marketing authorization dossier. Buyers in the US, Latin America, or most of Asia will usually be asked for a DMF reference or local pharmacopoeial compliance instead.

What documents should I actually request before placing an order?

At minimum: a batch-specific Certificate of Analysis, an MSDS, and the DMF reference number if you’re filing in a DMF-recognizing market. If you’re building an EU dossier, also ask whether a CEP exists or is in progress — not every API has one, and getting one filed takes months, so it’s worth confirming before you commit to a registration timeline around it.