The two directions of the obligation
Looking upstream, medicines should be obtained only from persons who hold a wholesale dealer’s licence or a manufacturer’s licence covering that supply. Looking downstream, supply should only be made to persons entitled to receive medicines for the purpose concerned.
Both directions require verification against the relevant register or licence rather than reliance on the counterparty’s assertion. A copy of a licence supplied by the counterparty is a starting point, not verification.
What a qualification check should establish
- That the entity exists and trades from the address given.
- That it holds the authorisation, licence or registration the transaction requires.
- That the authorisation covers the specific categories of product being traded.
- That the named contacts have authority to place or receive orders.
- Where relevant, that delivery addresses correspond to authorised sites.
- The date of the check, the source consulted and the person who performed it.
Ongoing review, not one-off approval
Licences lapse, scopes change, and companies are restructured. A qualification performed at onboarding tells you about the counterparty on that date only. GDP expects periodic re-verification, with the frequency justified by risk.
Practical triggers for re-checking outside the routine cycle include a change in ordering pattern, a request to deliver to a new address, a change of contact, a payment irregularity, and any approach that pressures for unusual speed or discretion.
Warning signs worth procedural attention
Diversion and falsified-product cases frequently begin with an ordinary-looking counterparty and an unusual request. Procedures that name the signals make it easier for staff to escalate without needing to justify suspicion.
- Unsolicited offers of stock at prices materially below market.
- Requests to deliver to an address that is not the authorised site.
- Orders disproportionate to the customer’s size or usual profile.
- Reluctance to provide licence details or to accept verification.
- Pressure to supply outside normal process or documentation.
- Product offered without full traceability documentation.
The RP’s role
Chapter 2 places responsibility for ensuring suppliers and customers are approved with the RP. That does not mean the RP performs each check, but it does mean the approval process, its criteria and its exceptions sit under RP oversight, and that records of any delegation exist.
Common questions
- How often should we re-verify a customer?
- GDP does not set a period. The frequency should be risk-based, documented in your procedure, and actually followed. Annual re-verification is common for routine accounts, with more frequent checks for higher-risk relationships.
- Is a copy of the customer’s licence enough?
- It is evidence but not verification. Checking the relevant public register directly establishes current status, which a supplied copy does not.
- What do we do if a check fails mid-relationship?
- Supply should stop until the position is resolved, and the event should be recorded as a deviation. Continuing to supply while investigating is difficult to justify.