NPRA’s Cosmetic Manufacturer List: 293 on the Web Page, 502 in the Open Data. Which One Is Right?

Quick answer: how many cosmetic manufacturers does NPRA list?

Both numbers are official, and neither is the whole picture. NPRA’s web page “List of Cosmetic Manufacturers in QUEST System” carried 304 rows covering 293 companies when we checked it on 28 September 2026. The Ministry of Health’s open-data file of cosmetic manufacturers, which NPRA describes as a copy of its own QUEST3+ administrative records and updates daily, carried 629 rows covering 502 companies on the same day. The gap is 209 companies. On top of that, 11 manufacturers named on 424 live product notifications appear on neither list. If you are checking a factory, use the daily open-data file first, then confirm with the product registry — and treat a missing name as a question, not a verdict.

Top 3 differences between NPRA’s two official lists

The two lists are published by the same agency but built differently, and the differences explain part of the gap.

Why the web page’s own explanation does not hold

The web page says it excludes licensed manufacturers that also run a cosmetic line — in other words, plants whose main business is registered medicines. That would explain the gap only if the missing companies were medicine manufacturers. Most of them are not.

We took eight companies that appear in the daily open-data file but not on the web page and searched QUEST3+ for registered products — pharmaceuticals, traditional medicines and health supplements — under the same manufacturer name.

One of the eight fits the explanation. The rest are cosmetics-only operations, and one of them — Intramiles, with 735 live cosmetic notifications — is larger than almost every factory on the web page it is missing from. The likeliest reading is simpler than a policy: the page is a manual artefact that has fallen behind the system it summarises.

What being named on a cosmetic notification actually proves

It proves NPRA has verified that plant’s GMP status, and this is the most useful fact in this article. A Malaysian manufacturer cannot be typed into a cosmetic notification by the person submitting it. The applicant has to search NPRA’s database and select the plant, and NPRA’s own submission manual states the rule plainly:

“Only Local Manufacturer/Local Primary Assembler with verified Good Manufacturing Practice (GMP) status by NPRA is listed in the database.”

— Guidelines for Control of Cosmetic Products in Malaysia, Annex I Part 4 (August 2022), pages 8–9

Only foreign manufacturers may be added by the applicant, and then only with a GMP certificate attached. So if a product is on sale in Malaysia and the registry names a Malaysian plant as its manufacturer, that plant has cleared NPRA’s check — whether or not either published list happens to show it. This is why a factory’s absence from a list is not evidence of anything, and why the notification registry is the better place to start.

The 11 manufacturers that appear on neither list

Eleven plants are named as manufacturer on live cosmetic notifications while appearing on neither the web page nor the daily open-data file. Between them they hold 424 live notifications, and several are still filing new products this year. Every count below was taken from QUEST3+ on 29 September 2026 by matching the manufacturer column exactly, not by keyword.

Three things are worth saying about that table, because a list of names invites the wrong conclusion.

First, this is a publishing gap, not a compliance finding. By the rule quoted above, each of these plants is in NPRA’s database with verified GMP status; what is missing is their appearance in either list NPRA publishes for the public.

Second, the sizes vary enormously. MM Cosmetic’s 223 notifications make it a substantial factory by any measure, and 99 of them were filed this year. At the other end, three entries hold a single product each — including one where the manufacturer field carries the regulator’s own Malay name, Biro Pengawalan Farmaseutikal Kebangsaan, which is a data-entry artefact rather than a factory.

Third, the last column is easy to misread, so here is what it does and does not mean. A cosmetic notification can be filed two ways: under the brand owner’s own QUEST3+ account, in which case the holder is the brand and the manufacturer is the factory; or under the factory’s account on the client’s behalf, in which case the factory appears as both holder and manufacturer. Brand owners frequently ask the factory to file for them because it is simpler. So a high figure in that column means the factory does the paperwork for its customers — it is not evidence of an in-house brand, and reading it that way would put other people’s brands on the factory’s books.

How to check a Malaysian factory’s GMP status in 3 steps

Three checks, in this order, settle most questions in under ten minutes.

1. Start with the product registry, not a list. Open NPRA’s QUEST3+ product search, choose Cosmetic, set “Search By” to Manufacturer Name, and enter the distinctive word in the factory’s name. If products come back with that plant in the manufacturer column, its GMP status has been verified by NPRA. The brand-owner column also shows you who it actually makes for, which no list will tell you.

2. Then check the daily file, not the web page. The Ministry of Health publishes the manufacturer file on data.gov.my and refreshes it every day; the web page is updated by hand and runs behind. Use the daily file to confirm the licensed address, which matters if a factory quotes one address and manufactures at another.

3. Ask for the GMP certificate number and check it. NPRA cosmetic GMP certificates carry numbers, and so do the ISO 22716 certificates factories often show alongside them — the difference between the two is explained in our guide to ISO 22716 for cosmetics. A factory that cannot produce a number has told you something, and it cost one email.

The same discipline applies to commercial rankings, which is a separate problem: we checked four public “top 10 manufacturer” lists for Malaysia and found not one verifiable number between them.

Top 6 questions about NPRA manufacturer records

Which NPRA list should I trust? The daily open-data file, as a starting point, because it is generated from NPRA’s own system rather than maintained by hand. Then confirm against the product registry, which is live. The web page is useful but demonstrably incomplete: 209 companies in the daily file do not appear on it.

Does a factory missing from both lists lack GMP? No. NPRA’s submission manual says only plants with verified GMP status are selectable as manufacturers on a notification, so a plant with live notifications has been through that check. Absence from the published lists reflects what NPRA publishes, not what it has approved.

Is a cosmetic manufacturer in Malaysia licensed or certified? Cosmetic products are notified rather than registered, and manufacturers are assessed against the ASEAN cosmetic GMP guidelines. That assessment is what puts a plant into the QUEST3+ database. Manufacturers of registered medicines hold a separate manufacturer’s licence, which is why some plants appear in medicine records and cosmetic records at once.

Why do rows outnumber companies in both lists? Because a company with more than one licensed address gets one row per address. Counting rows instead of companies inflates the figure, which is one reason published numbers for “how many cosmetic factories Malaysia has” disagree so widely.

If the holder and the manufacturer are the same company, is it the factory’s own brand? Not necessarily. Notifications can be submitted under the brand owner’s account or under the manufacturer’s account on the client’s behalf, and many brand owners prefer the second because the factory already knows the process. The registry records who filed, not who owns the brand, so this field cannot be used to tell an OEM apart from a house brand.

Can I see which brands a factory makes for? Yes, in QUEST3+, but only there. Neither manufacturer list carries client information, and the open-data notification file identifies the notification holder rather than the manufacturer, so the manufacturer-to-brand relationship exists in the public search interface alone.

How current are these numbers? The registry changes daily. Every figure in this article carries the date it was captured, between 27 and 29 September 2026, and should be re-checked before it is relied on commercially.

Sources and method

Official lists: NPRA’s List of Cosmetic Manufacturers in QUEST System (parsed directly from the page, 28 September 2026) and the Ministry of Health’s cosmetics manufacturers dataset on data.gov.my (downloaded 27 and 28 September 2026). Product records: NPRA QUEST3+, searched by manufacturer name in both the cosmetic and registered-product categories. Procedure: Guidelines for Control of Cosmetic Products in Malaysia, Annex I Part 4, August 2022.

Method: company names were compared after normalisation (punctuation removed, Sdn/Bhd dropped, common abbreviations aligned) plus fuzzy matching, so that a spelling variant is not counted as a missing company. Counts of the eleven manufacturers use exact manufacturer-column matches rather than keyword hits — a keyword search for one of them returned 134 rows of which a single row was actually that company. The population of manufacturers named on live notifications comes from our own full-registry extraction, described in our registry-checked assessment of Malaysian skincare manufacturers.

Limits of this analysis

We compared published records; we did not audit any plant or contact NPRA before publication. The registry is live and both lists change, so every number here is a snapshot carrying its capture date. Nothing in this article says any named company is non-compliant — the opposite is closer to the truth, since the rule quoted above means these plants have been through NPRA’s GMP check. Companies appear here because of how NPRA publishes its records, not because of anything they have done. If a company or the agency can show that we have misread a record, send the document and this article will carry a dated correction.

Update history: first published 29 September 2026. Corrected 3 October 2026: a column originally headed “filed under its own brands” was measuring which account a notification was submitted from, not brand ownership. It is now labelled accordingly, and the paragraph that drew a conclusion from it has been replaced with an explanation of the two filing routes.