How to Source APIs Safely in a Market Full of Counterfeits

The World Health Organisation (WHO) released an alert regarding international medical products in January 2025. There were also reports of anti-cancer drugs, known as IMFINZI, which is a life-saving immunotherapy, being counterfeited in Lebanon, Turkey and Armenia. None of the chemicals were actually present in the fakes. Patients with cancer were being injected with virtually no medicine.

This was not a side-issue. Based on the findings of the Pharmaceutical Security Institute, law enforcement agencies reported 7,152 cases of pharmaceutical counterfeits, diversions and theft in 2025, which is an increase from the previous year's 6,064 reported cases. Counterfeit medicine costs the pharmaceutical industry $250 billion per annum, whereas WHO claims that 10% of medicines in LMICs are substandard or fake.

Unfortunately, copy-cat drug manufacturing occurs at every stage in the process, not only at the end. It occurs upstream, at the raw material level, in the API supply chain, and many times before you realize that there's a problem.

This guide is for you if you are building APIs for use in large quantities. Here are some guidelines on how to do it safely.

Why Bulk API Sourcing Carries the Highest Risk

The greater the number of orders, the more appealing the target for fraudulent substitution. Often fake APIs show up in packages that are not remotely threatening. They have documents that appear valid, reasonable prices, and certificates that seem to have come from a valid source — until a proper lab test is done.

There are a few truths that complicate this problem:

The regular supply chain is the most likely route for counterfeit drugs to enter the system as they are either mixed in with real drugs during a legitimate intermediate step or are packaged within a network of brokers who intentionally disguise the name of the original manufacturer. Especially high value excipients are at risk. For instance, the glycerin used in pharmaceuticals has been economically adulterated several times in recent history; over a century of time, more than 800 deaths have been attributed to glycerin adulteration events, according to Pharmaceutical Technology.

In fact, the FDA's own 2025 State of Pharmaceutical Quality Report revealed an intriguing statistic: API manufacturing sites that serve compounding pharmacies account for 18% of the FDA's registered API manufacturers, but 72% of its warning letters, import alerts and regulatory meetings over the past five years.

It's an obvious pattern. There are a disproportionate risk in unverifiable sourcing channels. It's especially in bulk buying, where the cost savings are most enticing, that shortcuts in quality hurt the most.

How to Source APIs Safely : 7-step framework for verifying the safety of APIs to source.

Step 1: Start on a Verified Platform, Not a Search Engine

The place where you start your sourcing journey will determine the risk you take on during the journey.

You cannot be certain that you have any way to filter for certifications, manufacturing site information, or regulatory filing status by beginning a bulk API search on a general search engine or an unverified trade directory. You essentially have a raw deal with suppliers and that includes fake suppliers.

That's how a purpose-built bulk API sourcing platform, such as ChemDmart, functions. All suppliers on the platform are verified before they list. Search system enables buyers to narrow down the list based on certification type (US-FDA, WHO-GMP, EDQM, EU-GMP), company type (Manufacturer, CDMO, Trader, CRO), and geography, prior to the first enquiry. That's a significant drop in false exposure in the discovery stage, before your QA team has a chance to perform due diligence.

Step 2: Verify GMP Certification — Independently, Not Just on the Supplier's Word

For any API supplier working in a regulated market, it is the minimum regulatory requirement. The emphasis is, however, to verify, and not accept.

A true GMP certificate includes an issuing authority reference number which can be verified on public databases. If the supply is being shipped to the United States, consult the FDA Drug Master File (DMF) database and FDA Warning Letter database which are both informational and open to the public and are both free. Using the EUDRAGMDP database for EU-bound supply.

At least, you need to look for the following:

ChemDmart company profiles feature all of the active certifications from each supplier, eliminating hours of top-to-bottom database cross-checking for procurement teams. However, always doublecheck with the public source. Do not accept any certificate as is.

Step 3: Audit the Product Portfolio and DMF Filing Status

The depth of expertise and regulatory seriousness of a supplier is reflected in the product portfolio. Don't just check out the product list, check out the underlying product.

If the APIs are being sold in the U.S. market, the supplier should have a Drug Master File (DMF) on file with the FDA. The DMF number is publicly searchable — if the supplier says they have FDA approval, but the supplier is unable to provide a DMF number that is in the FDA database, this is a false statement. The equivalent for EU supply is a Certificate of Suitability (CEP) submitted to EDQM.

A weak or fraudulent portfolio is easily identified by the following characteristics: products are listed without CAS numbers; the pharmacopeial references are obscure; claims of regulatory approval are made but no filing numbers can be provided; and Certificates of Analysis are not provided on request for batch level items.

Strong portfolios, on the other hand, contain the accurate CAS numbers, pharmacopeial specification references (BP, USP, EP), verifiable regulatory filings, and stability and impurity profile documentation (upon request).

Step 4: Ask for, Check and Test Certificate of Analysis on their Own

The most frequently used fake document used with API scams is the Certificate of Analysis (CoA).

A true Certificate of Analysis should include batch number, manufacturing date, expiration date, testing results against the pharmacopoeia requirements (assay, purity, residual solvents, moisture content and microbial limit), and a qualified qualified QC person's signature.

It would not be enough just to accept the CoA from the supplier as it is, particularly for risk-prone APIs. All lots from all suppliers must be tested independently under FDA 21 CFR 211.84.

Analysis per HPLC for purity and assay confirmation

• HPLC — purity and assay confirmation
• NMR — identity verification
• FTIR — identity screening
• GC-MS — residual solvents and volatile impurities
• Karl Fischer titration — water content
• ICP-MS — elemental impurities per ICH Q3D

This testing only adds to the time and expense. It also captures the counterfeits which paperwork would never capture.

Step 5: Supplier Audit

An audit is the only alternative for high-risk suppliers, such as API manufacturers and CDMOs. Both on-site and off-site are now commonplace. It's what matters that you do one.

An API supplier audit includes the following:

• Valid GMP Certificate with verifiable reference from the issuing authority
• Generate a new Site Master File if it doesn't exist or is outdated
• Manufacturing processes for the API being sourced validated
• Documentation involving the SOP and batch records, as well as deviation logs for the QMS.Documentation related to the QMS, such as SOP, Batch records and Deviation logs
• Dedicated and documented CAPA system, closed in a time-limited manner.Active, documented and closed CAPA system within a time frame.
• No paper-based system without audit trail — Data integrity controls
• Raw material traceability – back up the chain to starting materials traceability
• Change control process — does the buyer get notified of changes affecting quality?

Before formal engagement, your team will have the advantage of ChemDmart supplier company profiles, which contain manufacturing site locations as well as site specific certifications.

Step 6: Diversify Geographically

Single source API procurement is a cost burden from the supply chain that 2025 made very apparent.

In early 2025, the threat of a US-China tariff escalation occurred on the API cost and availability front directly affecting the cost of API sourced from China. In 2025, the US government's SAPIR (Strategic Active Pharmaceutical Ingredients Reserve) executive order was enhanced to mandate the establishment of national reserves of APIs for some 26 critical medicines, specifically due to the concentration risk of foreign sources.

The practical advice: always have at least two different, verified suppliers for each and every API. The natural diversification triangle for most generic APIs is India, China and Europe. The country-of-origin filter makes it easy to create a shortlist of sources that are geographically diverse when using ChemDmart.

Step 7: SQA Will Be Signed Before the First Order Is Placed

A Quality Agreement isn't a tedious paperwork procedure. It's the legal and regulatory document that provides your procurement team with a contractual foundation for enforcing CoA requirements, batch documents, audit rights and advance notification of manufacturing changes.

Without one, you're doing nothing but trusting, not verifying. A Quality Agreement is expected practice between every critical API supplier and ICH Q10 and FDA guidance. It should include: specifications and pharmacopeial references, analytical methods and acceptance criteria, timelines for change notification, audit rights, batch documentation requirements, complaint and recall procedures.

8 Warning Signs You're Working With a Counterfeit or Substandard API Supplier

Before considering any new raw material supplier for API, look out for these red flag concerns:

1. No GMP certificate number — Real certificates will have a reference number that you can check from a public database of the regulatory authorities.
2. Claims "US-FDA approved" but does not have a DMF number — A DMF number is publicly searchable. No number, no approval. Full stop.
3. Denies or delays in giving a Certificate of Analysis — All batches of pharma raw materials are shipped with a Certificate of Analysis. Do not hesitate if not disqualifying.
4. Selling more than 20-25% below market — Counterfeit raw materials are priced to undercut. Don't order if the economics are not in favor.
5. Refuses Access to Audit or Quality Agreement – Legitimate GMP suppliers expect both of these. If either shows resistance it's a deal-breaker.
6. More than one company name or address for the same "manufacturer" — An old trick of fraudulent API brokers to give the appearance of an origin. Specifically request the address of the manufacturing site.
7. Does not confirm the input traceability — According to ICH Q7 and ICH Q11, input traceability must be performed at the API manufacturer. An inability to do so is a GMP failure.
8. Immediate availability of high-demand API during known shortage — In high-demand API shortages, fake versions are distributed to unverifiable channels. Availability that is disproportionate shouldn't be an opportunity; it's a warning sign.

How ChemDmart Helps You Source APIs Safely at Scale

ChemDmart is a verified B2B Pharma e-marketplace with 5000+ verified suppliers, 2 Million+ product listing and supplier reach is in 50+ countries. It is designed for purchase and sale of medicines and chemicals, not for a general trade directory.

Here are some things the platform offers procurement teams for API sourcing:

• Filtering of suppliers using their US-FDA, WHO-GMP, EDQM, EU-GMP certification — from the first search result filtered GMP suppliers
• Company profiles — complete certification listings, manufacturing site information, product portfolios, CAS numbers, direct contact information
• Real-time price intelligence — Daily pricing feeds of 1,000+ pricing signals for chemicals to ensure real-time price intelligence, helping to spot oddly low prices
• Rfq management – centralised, documented, with 80% of responses within 4 hours
• Case studies of verified suppliers on the platform — Cipla Ltd, Zydus Lifesciences, Glenmark Pharmaceuticals, Supriya Lifescience, IPCA Laboratories, GSK India

ChemDmart is not a substitute for an audit or a Quality Agreement. What it does is dramatically shorten the pre-screening process — by the time your QA team gets to the formal due diligence process they are already dealing with a short list of suppliers that have passed a basic screening test.

Final Thought

The counterfeits make no announcement. They come in packages that are packaged correctly, their documentation is legible and their price seems reasonable. The only sure way to protect yourself is to have a sourcing process that isn't solely based on trust. One that relies on verification, documentation, independent testing, and a supplier network screened before you pick up the phone.

A well-defined API sourcing framework is what you get. It's what ChemDmart was created for!