NPRA Rules for Cosmetics and Supplements in Malaysia 2026: Notification vs Registration, the Local-Holder Requirement, the Real Fee and Timeline Tables, and What Circulars 1/2026 and 2/2026 Changed

A Chinese skincare brand ships its first pallet into Port Klang, a distributor takes it to market, and eighteen months later the brand wants to change distributors — only to discover that the legal right to sell its own product in Malaysia belongs to the distributor, not to the brand. That is not a contract failure. It is what Malaysian law says: under the Control of Drugs and Cosmetics Regulations 1984 (CDCR), nobody may manufacture, sell, supply, import or even possess a cosmetic unless it is a notified cosmetic and the person doing it is the notification holder or someone authorised in the notification note. For health supplements and traditional remedies the rule is stricter still: the registration holder must be a locally incorporated company registered with SSM. This guide walks the whole route — which of your products need a two-week RM50 notification and which need a nine-month registration, what the National Pharmaceutical Regulatory Agency (NPRA) actually charges, how long each category really takes, the three licences that come after approval, the KKLIU rule that governs your advertising, and what NPRA Circulars 1/2026 and 2/2026 just banned from your formula.

Notification or registration: the fork that decides your whole timeline

Malaysia runs two completely different regimes out of the same agency. Getting the classification right is the single most consequential decision in your market-entry plan, because one path takes weeks and the other takes the better part of a year.

Cosmetics have been on a notification system since 1 January 2008, in line with the ASEAN Cosmetic Directive. You submit product particulars through NPRA's online QUEST system, pay RM50, and receive a notification note. NPRA does not pre-approve your formula; it holds you responsible for it and can cancel the notification at any time.

Pharmaceuticals, health supplements and natural/traditional products go through registration under Regulation 8 CDCR: a full dossier, processing and analysis fees, and an evaluation clock measured in working days. You get an MAL number and a registration valid for five years.

What is a cosmetic — and what your marketing copy can turn it into

A cosmetic is a substance applied to the external parts of the body (or to teeth and oral mucous membranes) principally to clean, perfume, change appearance, correct body odour, protect or keep in good condition. The definition is about where it goes and what it does, and the second half is where foreign brands lose control of their own classification.

The moment your label, box, website or livestream script claims that a cream treats eczema, that a serum repairs the skin barrier at a physiological level, that a supplement lowers blood sugar or that an oil relieves arthritis, the product stops being a cosmetic and becomes something NPRA regulates as a medicine or a health supplement with a therapeutic claim — a longer, dearer and much more evidence-hungry pathway. Chinese brands are especially exposed here, because claim language that passes as ordinary marketing at home ("修复", "祛痘", "抗炎") reads as a therapeutic claim in Malaysia.

Products that are neither cosmetics nor NPRA-registered goods have their own doors: medical devices go to the Medical Device Authority, foods and general beverages to the Ministry of Health's food safety division, and electrical or telecommunications goods to ST or MCMC. We map those boundaries in the full product market-access guide; this article stays inside the NPRA fence.

The local-holder rule: why your Chinese company cannot hold the approval

This is the part of the system that most often costs foreign brands real money, and it is written plainly in the rules.

For registered products, the Drug Registration Guidance Document (DRGD, 3rd Edition, 11th Revision January 2026) states at paragraph 5.1 that the applicant — the Product Registration Holder (PRH) — "must be a locally incorporated company, corporate or legal entity, with permanent address and registered with the Companies Commission of Malaysia (SSM)", with a business scope related to health or pharmaceutical products. Your Guangzhou or Shanghai entity cannot be the PRH. Someone in Malaysia will hold your registration.

For cosmetics, Regulation 18A(1)(b) CDCR says no person may manufacture, sell, supply, import or possess a notified cosmetic "unless he is the person responsible for placing the notified cosmetic in the market or a person authorized in accordance with the notification note". In practice the Cosmetic Notification Holder (CNH) is a Malaysian-registered company holding QUEST membership, and everyone else in the chain sells only under its authorisation.

So the real question is not whether a local entity holds your approvals, but which local entity — and there are only two answers:

Transferring a registered product to a new holder is possible — change of Product Registration Holder carries a processing fee of RM1,000 for pharmaceuticals and RM500 for natural products — but it requires the outgoing holder to act. For cosmetics, a change of CNH is a Type 2 change: a fresh RM50 notification and a new notification number, which in turn means new labels and new artwork on everything already printed.

Cosmetic notification, step by step

1. Set up QUEST membership. The holder registers for membership and buys a digital certificate with USB token: RM260 for one year or RM290 for two for a main user, RM245/RM275 for a supplementary user, plus RM10 postage in Peninsular Malaysia (RM20 to Sabah/Sarawak). Renewal of the certificate alone is RM48 (1 year) or RM95 (2 years).
2. Confirm the formula against the Annexes. Every ingredient is checked against Annex II (prohibited), Annex III (restricted, with limits and conditions), Annex IV (colourants), Annex VI (preservatives) and Annex VII (UV filters) of the Guidelines for Control of Cosmetic Products in Malaysia.
3. Assemble the Product Information File (PIF). The PIF is not submitted, but it must exist and be producible on demand: formula and specifications, manufacturing method and cGMP evidence, safety assessment, claim substantiation, and adverse-event records.
4. Submit through QUEST and pay RM50 per product and per variant. Documents must be in Bahasa Malaysia or English; translations from other languages must be endorsed.
5. Generate the notification note. Once payment is confirmed and requirements are met, the note can be generated immediately from QUEST, and only then may the holder manufacture or import the product.
6. Maintain it. The notification is valid 2 years, and renewal must be done no later than one month before expiry — miss that window and the product gets a new notification number, not the old one back.

Changes after notification split into two types: Type 1 changes are amendments to the existing notification — no fee, same number. Type 2 changes require a new notification at RM50 and generate a new number. If you export from Malaysia afterwards, NPRA issues a Certificate of Free Sale on request at RM50 per copy; it is not mandatory, but many importing countries ask for it.

Product registration: the fee table that decides your launch budget

Registration fees are set under Regulation 8 CDCR and published in Appendix 9 of the DRGD (current edition: 3rd Edition, 12th Revision, July 2026). They are payable per product, non-refundable, and split into a processing fee plus an analysis fee that scales with the number of active ingredients.

Read that table alongside the claim discussion above and the commercial logic becomes obvious: the same herbal capsule can cost RM1,200 as a traditional-claim natural product or RM5,000 as a multi-ingredient disease-risk-reduction supplement — and the difference is not the powder in the capsule, it is the sentence on the box.

How long it actually takes

NPRA publishes evaluation timelines in working days, counted from confirmation of payment — not from the day you first log into QUEST. Screening, queries and your own response time sit outside these numbers, which is why real-world calendars run longer than the table suggests.

Where two numbers appear, the first is for a single active ingredient and the second for two or more. A 120-working-day evaluation is roughly six calendar months before you add screening and query cycles; plan a health-supplement launch on a 9–12 month horizon and a cosmetic launch on a 4–8 week horizon.

Once granted, a registration is valid five years. Re-registration must be applied for within the six months before expiry; NPRA sends a reminder three months out. Miss the expiry date and the status flips automatically to "expired" — at which point re-registration cannot be submitted and, per the DRGD, no appeal is entertained. You start again, with a new dossier and a new fee.

After approval: the three licences you still need

A registration number is permission for the product to exist. It is not permission for you to make, import or wholesale it. Regulation 12 CDCR sets out the licences, and Regulation 13 sets the fees:

Two details in that table decide real calendars. First, "1 year or until 31 December of the same year" means a licence issued in October may be worth ten weeks, not twelve months — build the renewal into your Q4 compliance calendar. Second, Regulation 12(6) makes every licence personal to the licensee and non-transferable: buying the shares of a licensed Malaysian company is one thing, buying its business as an asset deal is quite another. NPRA certificates carry their own tariff too — a Certificate of Pharmaceutical Product, a GMP certificate, a Certificate of Declaration or a Certificate of Indication is RM50 each.

Sitting alongside all of this is the trade licence layer that has nothing to do with NPRA: a foreign-owned company that wants to import and distribute in Malaysia generally also needs a WRT distributive-trade licence from KPDN, and if the product is sold through a direct-selling or MLM model, an AJL licence under Act 500 as well. Muslim-market positioning adds JAKIM halal certification, which is voluntary in law and close to mandatory in practice for supplements and personal care.

Advertising: the KKLIU number is not optional

Malaysia regulates health advertising separately from products, under the Medicines (Advertisement and Sale) Act 1956 (Act 290). Section 4B prohibits taking any part in publishing an advertisement that presents an article as a medicine, appliance or remedy for treating or preventing disease unless the Medicine Advertisements Board (MAB) has approved it. Approved advertisements carry a KKLIU number, which must appear on the advertisement itself.

The exposure is broader than most foreign brands assume. "Publication" covers packaging inserts, marketplace listings, influencer posts, livestream scripts and in-store material, and section 5 makes contravention an offence carrying a fine of up to RM3,000 or one year's imprisonment for a first conviction, and up to RM5,000 or two years for a subsequent one. The penalty is modest; the commercial damage of an enforcement takedown across a marketplace account is not.

What NPRA Circulars 1/2026 and 2/2026 changed

Malaysia keeps its cosmetic ingredient annexes aligned with the ASEAN Cosmetic Directive, and 2026 brought two rounds of change:

• Circular 1/2026 (17 February 2026) updated the ingredient lists in the Guidelines for Control of Cosmetic Products in Malaysia, adopting the decisions of the 42nd ASEAN Cosmetic Committee meeting held in Jakarta on 20–21 November 2025.
• Circular 2/2026 (6 July 2026) revised Annex II (prohibited), Annex III (restricted), Annex IV (colourants) and Annex VI (preservatives) again, following the 43rd ACC meeting — banning several antifungal agents, tightening concentration limits on widely used ingredients including kojic acid and margosa extract, revising limits for CI 45430, and moving chlorophene and 2-chloroacetamide into the prohibited list. Transition periods differ by ingredient, with the longest running into 2028–2029.

For a brand selling whitening, anti-blemish or "natural preservative" formulas into Malaysia, this is not background noise. Kojic acid in particular sits in a large share of East Asian brightening ranges. The practical response is a formula audit: take your current INCI list, check it against the annexes as amended by both circulars, and for anything affected decide now whether to reformulate or to sell through the transition period and withdraw. A notification that was valid when granted does not protect a product whose ingredient has since moved to Annex II.

Penalties, recalls and the part that reaches the directors

Regulation 30 CDCR makes contravention of the Regulations — or of any condition of a licence or registration — an offence. Because the Regulations themselves specify no penalty, the general penalty in section 12 of the Sale of Drugs Act 1952 applies:

Beyond fines, the enforcement toolkit is what hurts: NPRA can direct the holder to recall, remove or withdraw a product from any premises, and where the holder knows a product has breached a directive it must stop selling and supplying with immediate effect. Cancelled notifications and products detected with scheduled poisons are published on MOH's public lists — a permanent, searchable record attached to your brand name. Section 14 of the Sale of Drugs Act even allows the court to order notification of a conviction in the newspapers.

The obligations that trigger all this sit on the holder: keeping distribution records adequate for a recall, keeping the PIF current and producible, reporting serious adverse events, keeping company particulars updated, and telling NPRA in writing when an authorisation ceases. If the holder is your distributor, so is the compliance function — and so is the record when something goes wrong.

What a foreign brand should budget

The bottom line

Malaysia's NPRA regime is not hostile to foreign brands; it is simply precise. Cosmetics are cheap and fast — RM50, two years, no pre-market vetting — provided your formula clears the annexes and your marketing does not accidentally promote the product into a therapeutic category. Health supplements and traditional products are a real project: RM1,200 to RM5,000 per product, 100 to 245 working days of evaluation, a five-year registration that must be renewed inside a six-month window, and three separate licences layered on top.

The one decision that outlives every fee in this article is who holds the approval. Malaysian law insists it be a local entity. If that entity is your distributor, your access to the Malaysian market is contractual and revocable. If it is your own Sdn Bhd, the notification number, the MAL number and the shelf position belong to you, and distributors become what they should be — replaceable partners.

ONEKEY BIZ handles the whole chain in one place: incorporating the Malaysian holding entity, obtaining NPRA notification and product registration, the WRT and import licences that sit beside it, and the accounting and secretarial work that keeps the entity in good standing. If you are planning a 2026 launch — or you have just found out that your distributor owns your notification number — talk to our team before the next shipment leaves.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.