How to qualify a peptide API supplier: a documentation and audit checklist for EU and US buyers

Qualifying a peptide API supplier is the work of proving two things before you place the first commercial order. First, that the manufacturer can consistently make material that meets your specification under GMP. Second, that its regulatory documents will stand up in your filing. Both have to be true. An excellent batch from a site your Qualified Person or FDA cannot rely on is as unusable as a well-documented site that cannot hit the impurity profile.

This checklist follows the order most buyers work in: desk review, samples, audit, agreements and ongoing monitoring. It covers the EU and US requirements side by side, then the checks that are specific to peptides. Links to the underlying regulations are in the sources at the end.

Who carries the obligation

Market	Legal obligation on the buyer	What it means in practice
EU	Article 46(f) of Directive 2001/83/EC: use only active substances made under GMP and distributed under GDP, verified by audits	An audit of the API site, and a QP declaration in the marketing authorisation dossier
US	21 CFR 211.84: test each component, or rely on a supplier Certificate of Analysis with an identity test and periodic verification	A supplier qualification programme and incoming testing; FDA reviews the DMF and may inspect the API site
Both	ICH Q10, section 2.7: the pharmaceutical company remains responsible for the quality of purchased materials	Supplier oversight is part of your own quality system, not a one-off exercise

Stage 1: desk review of documents

Request these before investing in samples or an audit. A supplier that cannot produce most of them quickly is not ready for a regulated filing.

Regulatory documents

Document	EU	US	What to check
Written confirmation from CDSCO (for Indian sites)	Required unless an Article 46b(4) waiver applies	Not applicable	Names the specific site and active substance; in date
GMP certificates and inspection history	Look up the site in EudraGMDP	Search FDA’s Data Dashboard for inspections and compliance actions	Recent outcomes, open non-compliance reports, warning letters, import alerts
Dossier route	ASMF (Applicant’s Part and letter of access) or full 3.2.S data; CEP only if a Ph. Eur. monograph exists	Type II DMF number, completeness-assessment status for ANDAs, letter of authorisation	The file covers your molecule, grade and site
Establishment registration	EU importer registered under Article 52a	FDA registration and listing under 21 CFR Part 207, US agent named	Registration current for the manufacturing site

Technical documents

• Specification and analytical method summaries, including how impurities are separated and quantified. For synthetic peptides, EMA requires LC purity methods with a quantification limit able to support the 0.1% reporting threshold.
• Certificates of Analysis for at least three recent batches, with actual numbers, not “complies”.
• Impurity profile, listing identified peptide-related impurities and their levels, against the Ph. Eur. thresholds (report above 0.1%, identify above 0.5%, qualify above 1.0%) or FDA’s product-specific guidance where one exists.
• Route of synthesis and starting materials. EMA’s synthetic peptides guideline applies ICH Q11 to starting material selection: protected L-amino acid derivatives are generally acceptable, short fragments only when justified.
• Stability data under ICH Q1A(R2) conditions, with the proposed retest period and storage condition.
• Residual solvents (ICH Q3C) and elemental impurities (ICH Q3D) assessments.
• Nitrosamine risk assessment, following FDA’s guidance on the control of nitrosamine impurities and the equivalent requirements of your target market.
• TSE/BSE statement where animal-derived materials could be involved.

Quality system documents

• Site master file and organisation chart, with a named quality unit independent of production.
• Change control procedure and a commitment to notify you of changes before implementation.
• Deviation, out-of-specification, complaint and recall procedures.
• Data integrity controls for chromatography data systems, in line with FDA’s data integrity Q&A and the MHRA GxP data integrity guidance.

Stage 2: samples and in-house testing

Test samples from several batches against your own specification, using your methods or methods transferred from the supplier. ICH Q7 sets the benchmark API manufacturers use for their own suppliers: full analysis of at least three batches before reducing in-house testing, and periodic full analysis afterwards to check the reliability of Certificates of Analysis (section 7.31).

For generic programmes, compare the supplier’s impurity profile with the reference product early. FDA’s draft guidance for semaglutide injection, for example, expects common impurities not to exceed the reference product level or 1.0%, whichever is greater, and EMA expects a full comparison at 0.1–0.5% against the EU reference product. An impurity that cannot be brought into line will stop a filing, whatever the price.

Stage 3: the GMP audit

The audit confirms what the documents claim. Under EMA’s QP declaration guidance, it can be carried out by your own auditors or a contracted third party, and the QP declaration records which. An ICH Q7-based audit of a peptide API site normally covers:

Area	Peptide-specific points to examine
Quality management	Independence of the quality unit; batch release; annual product review
Materials management	Qualification of amino acid derivative and resin suppliers; specifications covering enantiomeric purity and dipeptide impurities
Production	Synthesis records (SPPS, LPPS or hybrid); cleavage conditions and scavengers; in-process controls; pooling strategy for purification fractions
Purification and isolation	Chromatography column use and cleaning between products; lyophilisation or other isolation steps
Cross-contamination	Cleaning validation in multi-product areas; EMA expects controls for purifying different peptides on the same column
Quality control	Method validation; system suitability; audit trails on chromatography systems; reference standard qualification, including peptide content and moisture
Storage and distribution	Temperature control and monitoring; traceability to the original manufacturer
Change control	Process changes since registration; how customers are notified

If the material reaches you through a distributor, ICH Q7 section 17 requires the distributor to comply with GMP and keep full traceability, including the name and address of the original manufacturer. Your audit and your regulatory file must cover the site where the API is actually made.

Stage 4: agreements and ongoing monitoring

• Quality agreement. Define who does what: specifications, release, change notification, deviation and complaint handling, audit rights and regulatory support.
• Supply agreement. Volumes, lead times, safety stock and what happens if the supplier’s regulatory status changes.
• Routine controls. An identity test on every lot, periodic full testing against the Certificate of Analysis, and annual review of supplier performance.
• Requalification. Re-audit on a risk-based frequency, and whenever there is a significant change, a failed batch or a regulatory finding at the site.

Keeping the regulatory file aligned after approval

Qualification does not end with the first approval. The supplier’s regulatory file and your application have to move together for the life of the product.

• US DMF changes. Under 21 CFR 314.420(c), when a DMF holder adds, changes or deletes information in the file, it “shall notify in writing, each person authorized to reference that information”. Your quality agreement should go further and require notice before a change is implemented, so you can assess whether your own application needs a supplement.
• EU ASMF changes. Under the ASMF procedure, the Applicant’s Part comes to you and the Restricted Part goes only to the authority. Changes to either part have to be reflected in each marketing authorisation that relies on the ASMF, so agree in advance how the ASMF holder will inform you and supply updated documents.
• Written confirmations and GMP certificates. Both carry validity dates. Track them, and request the renewed documents before expiry rather than at the next import.
• Inspection outcomes. Check EudraGMDP and FDA’s Data Dashboard periodically for new findings at the site, not only at requalification.
• Product quality review. Include supplier performance, deviations and changes in your annual review, and use it to set the next audit date.

Peptide-specific red flags

Any of these should pause a qualification until resolved:

1. “Research grade” or “research use only” material offered for a medicinal product. RUO material is not made or released as a GMP API and cannot be qualified for human medicines.
2. No defined starting materials or a route that starts from undefined, purchased peptide fragments.
3. A single HPLC method used for all impurities, without evidence that it separates closely related sequences, diastereomers and deletion variants.
4. No counter-ion or residual TFA control. EMA expects counter-ion identity and content, and residual TFA, to be controlled in the specification.
5. Purity reported without assay. Chromatographic purity is not peptide content; water, counter-ion and other non-peptide content must also be measured.
6. No information on aggregates or other high-molecular-weight impurities.
7. Reluctance to name the manufacturing site or to accept an audit.

Where Winhycare Pharma fits

Winhycare Pharma supplies Semaglutide API to pharmaceutical manufacturers and R&D organisations on a B2B basis, and offers peptide CRDMO services and peptide lyophilisation CMO services from Hyderabad, India. During qualification we will tell you which of the documents above are available today for your programme and target market, and which would need to be generated. Our lyophilisation CMO service is intended for research and development applications and is not intended for human or veterinary use unless separately authorised and appropriately regulated. Our wider peptide range and custom peptides are supplied for research use only and, as above, cannot be qualified as the API for a medicinal product.

For the market-specific rules, see our buyer guides for Europe and the USA, or the Winhycare Pharma overview.