What NPRA notification means — and why it is the ad-status question
Malaysia regulates cosmetics, health supplements, traditional medicines and over-the-counter pharmaceuticals under the Sale of Drugs Act 1952 and the Control of Drugs and Cosmetics Regulations 1984.
The National Pharmaceutical Regulatory Agency (NPRA), a division of the Ministry of Health, is the competent authority; every notifiable product sold in Malaysia must be entered on NPRA's Quest3+ system (quest3plus.bpfk.gov.my (opens in a new tab)) before it may be sold or advertised.
A public fact
The registered/notified status is a public fact — the Quest3+ search is designed to be used by consumers, brand owners, distributors, marketers and enforcement officers alike.
For a brand owner or agency preparing a Meta, TikTok or Xiaohongshu campaign for a Malaysian audience, checking Quest3+ is not a courtesy step; it is the compliance precondition for the campaign to run legally.
Advertising an unregistered product
The consequences of advertising an unregistered or expired-registration product are set out in the same regulations that govern the sale — Section 12 of the Sale of Drugs Act 1952 and the Control of Drugs and Cosmetics Regulations 1984, both administered by NPRA.
Platform-side ad review
Platform-side ad review layers on top: Meta's Business Help Centre and TikTok Ads Manager both require Malaysia-market health-adjacent creative to reference a valid regulatory number, and Xiaohongshu's Malaysia-facing brand-account discipline includes the same check as part of business-account verification (see the XHS verification service page for the operational side of that).
A campaign paused mid-flight because the ad-review team asked for a Quest3+ screenshot the brand did not have is a common, avoidable, expensive category.
How to run an NPRA product search on Quest3+
An NPRA product search is done on Quest3+, NPRA's public product portal. Open quest3plus.bpfk.gov.my and select the appropriate search category — the portal separates registered products (pharmaceuticals, traditional medicine, health supplements) from notified cosmetics under different tabs, because the two routes carry different regulatory frames.
Search by product name, MAL number (for registered products), notification number (for cosmetics), or holder/company name.
A currently-active entry returns the product's registration or notification number, the holder of registration, the status (Active, Cancelled, Expired), the registered indications or claims, and — for cosmetics — the ingredients declared in the notification.
If the search returns no row
If the search returns no row against a specific MAL or notification number, the number is either invalid, mistyped, or refers to a product that has been cancelled or has lapsed.
For any Malaysia-market advertising of the product, that status is the ad-run authority; a currently-active Quest3+ row is what a Meta or TikTok ad-review team will ask to see if the campaign draws a review.
MAL numbers — what they are, where they appear, what they cover
A MAL number is the product registration number issued by NPRA under the Control of Drugs and Cosmetics Regulations 1984 for scheduled products going through the full pharmaceutical/traditional-medicine/health-supplement registration route (as distinct from the cosmetic notification route, which produces a different number format).
The MAL number appears on the primary packaging of the registered product, on the artwork approved during registration, and in the Quest3+ entry the product was registered under.
A MAL number check
A MAL number check is straightforward: paste the number into Quest3+ and read the returned row.
If the number resolves to an entry whose holder, product name and status match the physical product, the product's registration is current; if it resolves to an entry whose status is Expired or Cancelled, or if no row is returned, the registration is not current and the product should not be advertised or sold until it is.
Traditional medicine and health supplements
Traditional medicine and health supplements in Malaysia go through the same registration route as OTC pharmaceuticals and receive MAL numbers under NPRA's scheduled-product framework — this is why a "health supplement registration Malaysia" search returns to NPRA rather than to a separate body.
A brand owner considering a supplement launch in Malaysia should start at NPRA's Registration Section pages on npra.gov.my (opens in a new tab) and its guidance on health supplements specifically — we do not quote the current filing fees or processing time, because NPRA updates both periodically.
The current fee schedule and current processing time are on the NPRA site; cite those directly rather than a secondhand summary.
“KKM approval” — what brands usually mean, and what to check
On Malaysian social media, “KKM approval” is the phrase sellers use to reassure buyers, and it is used loosely.
For a health product it usually means one of three different things: a MAL number, showing the product is registered with NPRA; a cosmetic notification number, showing a cosmetic has been notified; or, for an advertisement that makes a medicinal claim, a KKLIU approval from the Medicine Advertisements Board.
They come from different processes and cover different things, so “KKM approval” on its own tells a buyer — or a platform ad reviewer — very little.
The useful check is specific
For a brand, the useful check is specific: which number does the product carry, does an NPRA product search on Quest3+ return an active entry, and does the advertisement itself need its own approval because of the claim it makes?
A MAL number that resolves to an active entry covers the product, not every sentence written about it; the KKLIU side is explained on our healthcare advertising guidelines page.
Brands that want kkm approval stated correctly in their ads get it right by naming the actual number rather than the ministry.
Cosmetic notification (notifikasi kosmetik) — a distinct, faster route
Cosmetic products in Malaysia are subject to a mandatory pre-market notification under the Guidelines for Control of Cosmetic Products in Malaysia published by NPRA, rather than the full registration route pharmaceuticals go through.
The notification (notifikasi kosmetik) is submitted through Quest3+ by the notification holder — typically a Malaysian company acting as the brand owner or as an appointed local representative for a foreign brand — and returns a notification number (commonly in a NOT-XXX-YYY shape).
The cosmetic notification malaysia route is faster than pharmaceutical registration but still mandatory; selling or advertising a cosmetic in Malaysia without a current notification is an offence under the same Control of Drugs and Cosmetics Regulations 1984 that govern the pharmaceutical route.
Guidelines for Control of Cosmetic Products
The Guidelines for Control of Cosmetic Products in Malaysia (current edition on npra.gov.my (opens in a new tab)) is the primary source for what must be notified, what claims may be made, what ingredient prohibitions apply, and what post-market surveillance the notification holder must maintain.
Because the guidelines are revised periodically we do not quote specific ingredient thresholds or claim-language schedules here — read the current Guidelines directly for those.
For a brand owner running Xiaohongshu creator campaigns for a Malaysian audience, the notification number is what the platform's brand-account review will ask for; running seeding or paid amplification without a current notification is a compliance and platform risk simultaneously.
Before you run ads — the pre-launch NPRA checklist
For any Malaysia-market campaign that mentions a notifiable product (cosmetic, supplement, traditional medicine, OTC pharmaceutical), the pre-launch checklist is short and enforceable:
- pull the current Quest3+ entry and archive it as evidence,
- confirm the product name and claim language on the creative match the notified/registered indications,
- confirm the MAL or notification number appears on the creative where required by platform policy, and
- confirm the notification holder named in Quest3+ is the party authorising the campaign.
A brand agency that runs a Malaysian ad on a product whose Quest3+ entry has expired is exposed twice: the platform can take the campaign down and the regulator can take enforcement action against the notification holder for advertising outside registration. Neither is worth the campaign speed the check would have cost.
Where the product's Quest3+ status is Cancelled or Expired at the moment the campaign is being scoped, the correct action is to pause creative production and route the client back to NPRA registration/notification renewal before the shoot and the ad build proceed.
shakalakaa's brand-side campaigns for Malaysian cosmetic and supplement operators run this check as a scoping-stage item rather than a launch-day item — the answer determines whether the campaign is a launch campaign or a renewal-and-launch sequence, and the two are different projects with different timelines.
For brand owners and agencies commissioning the check
For a Malaysian brand owner or an agency preparing a campaign on behalf of a brand, the practical workflow is: brand owner (or its notification holder) opens Quest3+, confirms the product's current registration/notification, exports or screenshots the current entry for the campaign file, and hands the artefact to the marketing team as the "campaign may run" evidence.
Where the brand outsources the check, the agency does exactly this at scoping — before creative, before shoot, before media plan. shakalakaa's performance marketing, content creation, XHS marketing and KOL / creator service lines all treat NPRA notification status as a Yes/No scoping condition for Malaysia-market health-product creative.
Where the answer is No, the campaign becomes a notification-plus-launch project and the timeline extends accordingly.
Services shakalakaa runs for Malaysian cosmetic, supplement and health-product brands: Performance Marketing, Content Creation, XHS Marketing (with XHS Business Verification), KOL / Creator Campaigns.
shakalakaa does not perform NPRA notification filing or regulatory-advice work — this page is public-service check intelligence and marketing scoping, not a regulatory consultancy. The notification holder and its regulatory advisers own the filing; shakalakaa builds and runs the marketing inside its outcome.
Related: Healthcare advertising guidelines (KKM), KPKT licensed money-lender list (MY), Aesthetic clinic marketing (MY), Healthcare marketing for hospitals and health groups (MY), CIDB contractor check (MY).
- Cite this
- shakalakaa (Plixitt Solutions). “NPRA Product Notification Check Malaysia.”
- https://shakalakaa.my/resources/npra-product-notification-check-malaysia · Updated 2026-10-09
- Licensed under CC BY 4.0.