When Your API Supplier Quietly Moves Production: Detecting Undisclosed Site Changes

On 3 November 2026, the United States Food and Drug Administration issued a warning letter to Nanjing Hanxin Pharmaceutical Technology, an active pharmaceutical ingredient (API) maker in China. The finding that should worry every buyer of foreign API was not a dirty cleanroom or a failed test. It was that, after November 2025, the company moved production of an API to an undisclosed subsidiary, so the name on the registration was no longer the site actually making the drug.

FDA reached that conclusion without setting foot in the plant. It reviewed records the company sent in response to a formal request, concluded the quality unit had failed to qualify the suppliers of critical raw materials, and placed the firm's drugs on an import alert. For any Canadian importer or drug establishment licence holder that relies on foreign API, the case is a clear warning: your GMP evidence is only as good as your knowledge of where the drug is actually made.

This article explains what an undisclosed site change is, why it quietly voids your supplier qualification, how regulators detect it, and the practical controls that catch it before an inspector or an import alert does.

Executive summary

An undisclosed site change happens when a supplier moves fabrication, packaging or testing of a drug to a site you have not qualified, and does not tell you. The GMP evidence you hold, which is tied to the original site, no longer describes reality, so the material you receive is effectively unqualified.

What happened at Nanjing Hanxin?

FDA reviewed records that Nanjing Hanxin submitted after a November 2025 request, found that its quality unit had failed to qualify the suppliers of critical raw materials, and learned that production had been moved to an undisclosed subsidiary after November 2025. FDA placed all of the firm's drugs on Import Alert 66-40 and warned that misidentifying the real manufacturer may have been an attempt to circumvent safeguards.

The APIs involved were destined for further processing into sterile drug products and for pharmaceutical compounding, which raises the stakes. FDA found that the firm qualified a supplier for a critical starting material, that FDA had separately inspected that supplier and found its drugs adulterated, and that those drugs were already on an import alert. In other words, a weak supplier-qualification chain let non-compliant material feed into APIs bound for the United States, while the paperwork pointed at a different, cleaner-looking entity.

What is an undisclosed site change, and why is it a GMP problem?

An undisclosed site change is when a supplier shifts fabrication, packaging, labelling or testing to a building you have not evaluated, without notifying you. It is a GMP problem because every piece of evidence you hold, from the GMP certificate to the audit report to the certificate of analysis, describes the original site, not the one now making your material.

Supplier qualification is site specific. When you qualify a supplier, you are really qualifying a building and the quality system that runs inside it. If the material starts coming from a different building, your qualification no longer applies, even if the corporate name on the invoice is unchanged. The risk is sharpest where a trading company or a parent entity holds the registration while the physical work happens somewhere else, because the entity you contracted with may not be the entity in the cleanroom.

This is exactly the gap FDA flagged. Relying on the name of a registered or trading entity, rather than confirming the actual manufacturing site on a risk-tiered, qualified basis, leaves a company exposed to receiving material from an unqualified and possibly non-compliant source.

Why this matters for Canadian importers and DEL holders

Under Health Canada's drug establishment licence framework, an importer must hold evidence that each foreign building where a drug is fabricated, packaged, labelled or tested meets good manufacturing practices. An undisclosed site change breaks that link, because the evidence on file no longer matches the building actually doing the work.

A Canadian importer's licence lists the foreign buildings in its supply chain and is supported by GMP evidence for each one. If a foreign API maker quietly moves fabrication to a subsidiary or a different plant, the importer is, on paper, importing from a building that is not supported by current GMP evidence. That is a finding waiting to happen at the next inspection, and it can interrupt supply if Health Canada or a foreign regulator acts on the real site. The accountability does not shift to the contractor; the importer and the licence holder remain responsible for knowing where their drugs are made.

The same logic runs through the European system, where written confirmations and third-country API controls depend on the stated manufacturing site being the real one. Across all three systems, the control objective is identical: tie your evidence to the building, and keep it current.

How FDA caught it without an inspection

FDA used its authority under section 704(a)(4) of the Food, Drug, and Cosmetic Act to request records and other information in advance of, or in place of, an on-site inspection. The company's own records revealed the site change and the supplier-qualification gaps, and FDA acted on them directly.

Section 704(a)(4) lets FDA ask a drug establishment for records and information remotely. If a firm does not provide what is requested, its drugs can be deemed adulterated for that reason alone. In the Nanjing Hanxin case, the records the firm did provide showed that production had moved and that critical raw material suppliers were not properly qualified. FDA then placed the firm on Import Alert 66-40, which allows detention without physical examination of drugs from firms that have not met drug GMP requirements.

Two lessons follow for anyone who exports to the United States or imports foreign API. First, a regulator does not need to visit a plant to find an undisclosed site change; the records tell the story. Second, a records request is itself an event to be ready for, in the same way you would prepare for an on-site inspection or a Form 483.

Warning signs that your API supplier may have moved production

None of these signals proves a site change on its own, but two or three together justify a hard look:

• The site address or manufacturer name on the certificate of analysis changes, or stops matching the address on the GMP certificate and the registration.
• A new or unfamiliar subsidiary, trading company or intermediary appears on invoices, shipping documents or the certificate of analysis.
• Batch numbering, packaging, labels or the look of the certificate of analysis change without explanation.
• Lead times, pricing or capacity shift suddenly, which can signal a move to a different plant.
• The supplier resists a request to confirm the fabricating site, to share a recent regulatory inspection outcome, or to allow an audit.
• Analytical results drift, or impurity profiles change, pointing to a different process or starting material.
• A regulator posts an import alert, warning letter or inspection outcome for the supplier or one of its affiliates.

The change-notification clause your quality agreement needs

The single most effective contractual control is a prior written notification clause: the supplier must tell you, in writing and in advance, of any change to the site, process, critical raw material supplier or testing arrangement, and must not ship affected material until you have assessed and approved the change.

A quality agreement that inspectors expect to see should spell out that notice period, give you the right to approve or reject a proposed change, and give you the right to audit the new site before it supplies you. It should also require the supplier to identify the actual fabricating building, not just the contracting entity, and to flag any use of subcontractors or affiliates. A change the supplier makes silently is a breach you can act on, but only if the agreement made the obligation explicit in the first place.

How to detect and prevent undisclosed site changes

Prevention rests on verifying the real site at qualification, re-verifying it on every receipt, and building change control and audit rights into the relationship. Detection rests on comparing what arrives against what you qualified.

1. Map your supply chain to the building. For each API, record the actual fabricating site, its address and its regulatory identifier, not just the name of the company you buy from.
2. Verify the site on every certificate of analysis. Check that the manufacturer name and address match the qualified building and the GMP evidence on file, and investigate any mismatch before release.
3. Build a prior written change-notification clause into the quality agreement, with approval and audit rights over any site, process or critical supplier change.
4. Risk-tier your suppliers and set audit depth accordingly, giving sterile-use and compounding-use APIs the closest scrutiny.
5. Check public regulatory databases for import alerts, warning letters and inspection outcomes against the supplier and its affiliates before and during the relationship.
6. Requalify the supplier when any element of the site, process or critical raw material chain changes, and keep the evidence current on your licence.
7. Run a mock records request so your own supplier-qualification file could withstand a remote review, the same way FDA conducted this one.

API site-change compliance checklist

Use this checklist to protect your supply chain against undisclosed site changes:

• The actual fabricating site for each API is documented, with address and regulatory identifier, not just the supplier's trading name.
• GMP evidence on file matches the building that is actually making the material, and is current.
• Every certificate of analysis is checked against the qualified site before release, with mismatches investigated.
• The quality agreement requires prior written notice of any site, process, critical supplier or testing change, with approval and audit rights.
• Suppliers are risk tiered, with the deepest oversight for sterile-use and compounding-use APIs.
• Public import alert and warning letter databases are screened for the supplier and its affiliates.
• The supplier is requalified whenever the site or critical raw material chain changes.
• The supplier-qualification file is complete enough to survive a remote records request.

Common mistakes

• Qualifying the company, not the building. A corporate name can stay the same while the drug moves to a different, unqualified site.
• Trusting the trading entity. The firm on the invoice may not be the firm in the cleanroom, which is the exact gap FDA flagged at Nanjing Hanxin.
• Treating the certificate of analysis as proof of site. A certificate can be issued under the registered name even when the material was made elsewhere, so the site has to be verified independently.
• Leaving change control to the supplier. Without a written prior-notification clause and audit rights, a silent site change is invisible until something goes wrong.
• Assuming only an on-site inspection can expose a problem. A remote records request under section 704(a)(4) can and did surface an undisclosed site change on records alone.
• Not requalifying after a known change. A new site is a new qualification, not a paperwork update.

Frequently asked questions

What is an undisclosed API site change?

It is when a supplier moves fabrication, packaging, labelling or testing of an API to a building you have not qualified, without telling you. The material then comes from a site your GMP evidence and supplier qualification do not cover.

How did FDA find the problem at Nanjing Hanxin without an inspection?

FDA used section 704(a)(4) of the Food, Drug, and Cosmetic Act to request records in advance of or in place of an inspection. The records showed that production had moved to an undisclosed subsidiary and that critical raw material suppliers were not adequately qualified.

What is Import Alert 66-40?

It is an FDA import alert that allows detention without physical examination of drugs from firms that have not met drug good manufacturing practice requirements. FDA placed all of Nanjing Hanxin's drugs on this alert on 22 June 2026.

Why does an undisclosed site change matter to a Canadian importer?

A Canadian drug establishment licence is supported by GMP evidence for each foreign building in the supply chain. If a supplier moves production to an undisclosed site, the evidence on file no longer matches the real building, which is an inspection finding and a supply risk.

How can I detect a hidden site change?

Verify the manufacturer name and address on every certificate of analysis against the qualified site and the GMP evidence, watch for new intermediaries or subsidiaries, track changes in batch numbering or analytical results, and screen public regulatory databases for the supplier and its affiliates.

What contract clause protects us best?

A prior written change-notification clause that requires the supplier to tell you in advance of any site, process, critical supplier or testing change, to hold shipment until you approve the change, and to allow you to audit a new site before it supplies you.

How MFLRC can help

MF License and Regulatory Consultants helps importers, drug establishment licence holders, compounders and generic sponsors close the exact gap this warning letter exposed. We build and run supplier qualification programmes that are tied to the fabricating building, with risk tiering and audit depth matched to the use of the material. We draft and review quality agreements with the change-notification, approval and audit clauses that inspectors expect, and we conduct supplier requalification audits and foreign-site evidence reviews when a change is suspected or confirmed.

We also prepare your supply chain for the kind of remote records request that drove the Nanjing Hanxin case, through mock 704(a)(4) readiness reviews, document-readiness checks and CAPA support. Our gap assessments, SOP development, quality assurance person services and Compliance-as-a-Service keep your foreign-site evidence current and defensible.

Conclusion

The Nanjing Hanxin warning letter is a reminder that a supplier's weakest control can become your adulterated product. An undisclosed site change does its damage quietly, because the paperwork keeps pointing at a site that is no longer doing the work. The defence is not exotic: qualify the building rather than the brand, verify the site on every receipt, write change notification and audit rights into the quality agreement, and keep your evidence ready for a records request that can arrive without warning. Companies that do this know where their drugs are made, and can prove it, which is exactly what a regulator, and a patient, is entitled to expect.

Sources and references

• FDA, Warning Letter: Nanjing Hanxin Pharmaceutical Technology Co. Ltd. (3 November 2026)
• FDA, Import Alerts (including Import Alert 66-40)
• ICH, Quality Guidelines (including Q7, GMP for Active Pharmaceutical Ingredients)
• Health Canada, Drug and health product establishment licences