Exporting Food from Malaysia to China Under GACC Decree 280: CIFER Registration, the 17 Recommendation Categories, and What Changed on 1 June 2026

On 1 June 2026 China replaced the rulebook that governs every food factory on earth that ships to it. GACC Decree No. 280 — the Regulations on the Registration and Administration of Overseas Producers of Imported Food, issued on 14 October 2025 — superseded the Decree 248 regime that had run since January 2022. For Malaysian exporters this is not a cosmetic renumbering. The scope of who must register changed, several primary agricultural products fell out of the system entirely, overseas cold stores came in for the first time, renewals became automatic for most categories but conspicuously not for others, and a new "list registration" pathway was opened for countries whose food-safety systems China recognises. If your Malaysian entity produces, processes or stores food destined for China, your registration status, your renewal calendar and possibly your competent authority have all moved. This is the map.

1. What actually changed on 1 June 2026

Decree 248 built China's overseas food facility register from scratch. It worked, but it was blunt: every producer in a listed category had to apply, everyone had to re-apply before expiry, and the boundaries of "food" were drawn so widely that operations with almost no food-safety risk were pulled into a heavyweight process.

Decree 280 keeps the architecture — registration before export, a registration number that must travel with the goods, five-year validity — and rebuilds the administration around risk. GACC published the implementing detail in Announcement [2026] No. 27 on 18 March 2026, just 75 days before the effective date, which is why a great many exporters across Southeast Asia spent the second quarter of 2026 re-reading their own registrations.

2. Does it apply to you? Three tests, in order

Decree 280 applies to overseas enterprises that produce, process or store food exported to China as cargo, where the food enters the Chinese domestic market for human consumption or as an ingredient for further food processing. Three questions settle almost every borderline case.

Test one: are you a facility, or a trader? Registration attaches to the physical production, processing or storage site. A Malaysian trading company that buys finished goods and ships them does not register itself; the factories it buys from must be registered, and their numbers are what the Chinese importer declares. This is the single most common structural misunderstanding among Malaysian exporters, and it has an expensive corollary: if you switch contract manufacturers, your China channel stops until the new factory's registration is live.

Test two: is it cargo, or cross-border e-commerce? Decree 280 governs general trade cargo. Goods entering China through the bonded cross-border e-commerce channel have historically been treated differently, and GACC has continued to allow a temporary exemption for retail imports moving through that channel. If your entire China business is direct-to-consumer through a cross-border platform, your obligations are shaped by that channel's rules rather than by CIFER — but the moment a Chinese distributor wants to import in general trade, registration becomes the gate. Plan the general-trade registration before you succeed at e-commerce, not after.

Test three: is it food for human consumption? Food additives, food-contact materials and products destined for animal feed sit outside this decree and under other Chinese regimes. So does food you send as samples in personal quantities. Everything else that a Chinese consumer will eat, or that a Chinese factory will use as an ingredient, is in.

3. The two doors: official recommendation and self-registration

The heart of Decree 280 is a fork. Higher-risk categories may only be registered on the recommendation of the exporting country's competent authority — the Malaysian government has to put your facility forward. Everything else is self-registration: the enterprise, or an agent it appoints, applies directly through CIFER.

Announcement [2026] No. 27 fixed the recommendation catalogue at 17 food ranges, retaining the health-food and special-dietary-food categories that the January 2025 consultation draft had proposed to drop.

Two operational consequences follow. First, the recommendation route means your file is assembled twice: once to satisfy a Malaysian agency that you are worth recommending, and again to satisfy GACC. Second, the routes have different consequences at the border. Goods from an officially recommended facility remain importable if they were produced during a valid registration period and are within shelf life; a self-registered facility must hold a valid registration at the moment of declaration. For self-registered exporters, a lapse is not a paperwork problem — it stops shipments already on the water.

4. Who your competent authority is in Malaysia — and why exporters get it wrong

Malaysia does not have a single food-export regulator. Responsibility is split by commodity across the Ministry of Agriculture and Food Security (MAFS) family and the Ministry of Health, and the split is the reason so many first-time exporters spend a month in the wrong queue.

• DVS (Jabatan Perkhidmatan Veterinar) — animals and animal products: meat, poultry, dairy, eggs, casings, honey and edible bird's nest. DVS audits establishments and abattoirs and coordinates with JAKIM on halal slaughter. It is DVS that negotiated the edible bird's nest export protocol with GACC.
• DOF (Jabatan Perikanan) — fish, crustaceans, molluscs and their products, including aquaculture.
• DOA (Jabatan Pertanian) — plants and plant products, and the issuer of health certificates for food of plant origin.
• MAQIS (Act 728) — the quarantine and inspection service at the border. MAQIS is the focal agency for plant health and issues the phytosanitary certificate that travels with plant consignments, and handles export permits for animal and fish products.
• MOH / KKM — food safety under the Food Act 1983 and the Food Regulations 1985, and the natural home for processed, formulated and functional foods that are not animal or plant primary products.

5. Registration mechanics: CIFER, the number, and the new automatic renewal

Applications and the register itself live in CIFER, the China Import Food Enterprise Registration system. Registrations run for five years. Each registered facility receives a China registration number, and the public query portal shows every live registration with its product category and expiry date — which means your Chinese buyer can check you, and your competitor can check you too.

The registration number is not a filing reference. It must appear on the inner and outer packaging of the goods in the form GACC requires, alongside the facility name and country. Chinese customs check the declared number against CIFER at clearance. A correct product with a wrong, stale or missing number is a detained consignment.

Decree 280's headline concession is automatic renewal: where a registered enterprise continues to meet GACC's requirements, the registration rolls over for a further five years without a re-application. This is a genuine reduction in administrative load — but read the exceptions before you delete the reminder from the calendar.

For categories excluded from automatic renewal, the renewal application window opens well before expiry — the drafting contemplates filing in a window measured in months, not weeks. Malaysian bird's nest and meat exporters should treat the renewal date as a hard project milestone with an owner, because these are precisely the two categories where a lapse also means a fresh competent-authority recommendation.

6. Cold stores are in scope, and "list registration" is the new fast lane

Decree 280 brings overseas cold storage facilities handling terrestrial animal and aquatic products into the registration system for the first time. This matters more in Malaysia than the sentence suggests. A large share of Malaysian frozen seafood and processed meat destined for China passes through third-party cold chain operators in Port Klang, Pasir Gudang and Penang. Those operators are not the exporter, they are not the producer, and until now they were nobody's registration problem. From 1 June 2026 they are their own registrants — and an unregistered link in the cold chain is a defect in your shipment, not in theirs.

If you are an exporter, the practical step is to obtain, in writing, the CIFER status of every cold store your China-bound product touches, and to write that obligation into your storage contracts. If you are a cold chain operator serving China-bound cargo, the registration is now a commercial prerequisite for that customer segment.

The counterweight is list registration. Where GACC recognises an exporting country's food-safety system, that country's competent authority may submit lists of facilities for batch registration rather than pushing every enterprise through an individual application. For Malaysia this is a policy opportunity rather than a self-service option — its value depends on how far MAFS and MOH can carry system-recognition discussions with GACC. Exporters cannot invoke it themselves, but it is the reason to keep your Malaysian authority file impeccable: when a list goes to Beijing, you want to be on it.

7. Durian is a different regime entirely — and that is why it took so long

Fresh fruit does not travel the CIFER manufacturer route. It travels the phytosanitary protocol route: a bilateral protocol between GACC and the exporting country's plant-quarantine authority, followed by registration of individual orchards and packing houses, pest surveillance obligations, treatment and traceability requirements, and a phytosanitary certificate for every consignment. Two entirely separate systems, frequently confused, with different applicants and different lead times.

Malaysia's fresh durian access illustrates the difference. Frozen whole durian and durian pulp had China access for years under the processed-food regime. Fresh durian required a new protocol, signed on 24 June 2024 between MAFS Minister Datuk Seri Mohamad Sabu and the GACC Minister — after which GACC published the list of approved Malaysian exporters: 33 companies with a combined annual capacity of roughly 17,685 tonnes, heavily concentrated in Johor.

The commercial result has been dramatic. Malaysian durian exports to China reached US$77 million (about RM310.9 million) in the first quarter of 2026 alone — more than double the value of the entire 2025 fresh durian export year — against a backdrop of Chinese fresh durian imports growing 294% over the same quarter. Malaysia is now negotiating an overland route through Thailand to cut logistics cost, and in August 2026 the Agriculture Minister led a delegation to Beijing's Xinfadi wholesale market seeking wider access for pineapples, jackfruit, mangosteen, seafood and halal poultry.

8. The document chain, from your factory floor to a Chinese declaration

Registration is one link. A China-bound consignment from Malaysia normally has to assemble the following, and a gap anywhere stops the container.

The tariff document is the one most often left to the freight forwarder and most often worth money. Under ACFTA, a correctly issued Form E is what converts a Chinese MFN duty rate into a preferential one, and the rules of origin behind it are unforgiving about transformation and consignment. We set out how the Malaysian side of that works — ePCO, direct consignment, and the back-to-back cases that trip up regional traders — in our guide to rules of origin and certificates of origin for Malaysian exporters. If your China route is direct-to-consumer rather than general trade, the sales-tax and clearance mechanics are different again; see cross-border e-commerce, LVG and the CPE/TTR regime.

9. Five ways Malaysian exporters lose a registration they already had

Most failures we see are not initial rejections. They are live registrations that quietly stopped being usable.

• The wrong product code. The registration covers the product categories you declared. Adding a new SKU in an adjacent category does not extend the registration to it, and shipping under a registration that does not cover the goods is a declaration error, not a technicality.
• Details drift out of date. A change of registered address, legal representative, company name after a restructuring, or a new production line — none of these update CIFER by themselves. A mismatch between the CIFER record and the shipping documents is enough to hold a consignment.
• The agent owns the account. Many Malaysian producers let a Chinese importer or a service agent create and hold the CIFER account. When the commercial relationship ends, the producer discovers it cannot access, amend or renew its own registration. Insist on control of the account and the contact email from day one.
• The renewal that was assumed to be automatic. Meat and bird's nest are expressly excluded from automatic renewal. So, in practice, is any facility carrying an unresolved compliance finding.
• An unregistered link in the chain. Since 1 June 2026, that includes cold stores. Your own registration being perfect does not save a consignment that spent a week in an unregistered warehouse.

10. What to do now

A sequence that reflects how the work actually lands:

• Classify the finished product against the GACC catalogue first. This determines whether you self-register or need a Malaysian recommendation, and which agency recommends. Do this before you open a file with anyone.
• Confirm whether Decree 280 still applies to you at all. If your goods are raw oilseeds, fresh vegetables, dried beans or green coffee or cocoa beans, you are out of the registration regime and into pure quarantine compliance.
• Audit every existing CIFER entry. Check the product categories against what you are actually shipping, the corporate particulars against your current SSM record, and the expiry date against the automatic-renewal exceptions.
• Map the physical chain and check each node. Producer, processor and — new since June 2026 — every cold store. Get CIFER numbers in writing and put the obligation in the contract.
• Fix ownership of the CIFER account. If an agent controls it, take it back while the relationship is still good.
• Build the Malaysian file to recommendation standard. Facility layout, HACCP documentation, pest control, traceability records and, for animal products, the DVS audit history. This is what a recommendation rests on, and it is also what puts you on any future list registration.
• Do not forget the tariff side. Registration gets the goods in; a correctly issued Form E decides what they cost when they arrive.

ONEKEY BIZ works on both ends of the Malaysia–China corridor: incorporating and licensing the Malaysian entity, assembling export certification, and coordinating the agency files that sit behind a GACC recommendation. If you are building a Malaysian food, agri-food or aquaculture business with China as the destination market — or you already export and have not re-examined your position since Decree 280 took effect — that review is worth doing before your next renewal date rather than after a detained container. Talk to us through our export certification and certificate-of-origin service, or contact our team directly on WhatsApp at +60 12-321 1349.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.