QUEST3+ System Operation Guide: NPRA's Portal for Drug/Cosmetic Registration and Notification

In Malaysia, any medicine, health supplement, traditional/natural product or cosmetic that is to be legally placed on the market almost always has to go through the same portal—NPRA's (National Pharmaceutical Regulatory Agency) QUEST3+ system. QUEST3+ is NPRA's online "product registration and licensing system": medicines go through registration to obtain a MAL number, and cosmetics go through notification to obtain a notification number—both paths are completed on the same platform. Understanding the account tiers and workflow of QUEST3+ is the first practical hurdle to entering the Malaysian market. To grasp the overall path first, you can read the complete compliance roadmap for entering the Malaysian market.

What QUEST3+ regulates

QUEST3+ covers the many categories of products regulated by NPRA, which according to the official classification broadly include: biologics, combination products, cosmetics, generic drugs, natural products (traditional formulas), health supplements, new chemical entities and veterinary drugs. The system handles three things at once:

• Product operations: drug registration, cosmetic notification, variation, and renewal.
• Licensing: licence applications for manufacturers, importers and wholesalers.
• Compliance reporting: such as follow-up reporting for notified cosmetics.

The general public uses a separate public front end—the QUEST3+ product search—to check whether a product is genuinely registered/notified.

Account tiers: Pre-Membership → Full Membership → USB Token

QUEST3+ accounts are divided into three stages, and the order cannot be skipped:

NPRA states clearly: registering for QUEST3+ does not require hiring a consultant or agent, and companies can complete it themselves. To actually submit registrations, variations, licensing, renewals and other transactions, you must first complete Full Membership and purchase a digital certificate in the form of a USB Token; only after the certificate is installed can transactions be executed in the system.

Practical operating process

1. Pre-Membership registration: register with a company email, and after verifying via email, log in to the pre-membership module.
2. Fill in the Full Membership form: complete the company details and submit for review; NPRA notifies approval or rejection by email after review.
3. Arrange the USB Token: purchase from the designated certificate provider and install and configure it according to the official manual (including Java/browser settings); NPRA has a dedicated chapter for Google Chrome use.
4. Enter the right module: cosmetics go through the Cosmetic Notification module, and medicines/health supplements go through the Product Registration module; payment supports individual B2C, company B2B and credit card.
5. Track after submission: check the review status, supplementary documents and final issuance within the system.

Cosmetic notification is a relatively lightweight path; for details see the cosmetic notification process and CNH; medicines/traditional medicines are subject to "registration," with stricter review and longer timelines.

Import vs local: who acts as the Holder

QUEST3+ Full Membership is bound to the "company," which brings out the key difference between importers and local manufacturers:

• Local manufacturing/local company: register Full Membership directly with your own Malaysian legal entity, act as your own holder, and take full responsibility for the product.
• Overseas brands/pure imports: an overseas company usually cannot be listed directly on QUEST3+ and needs a local holder within Malaysia (which may be a self-established subsidiary, a local importer or an authorised agent) as the applying and listed party. Once the holder is determined, the MAL number/notification number is listed under its name, and the responsibility for future renewals, variations and delisting follows accordingly.

Therefore, before going to market, overseas businesses need to think clearly: whether to establish a local company to act as your own holder (high control, higher cost), or to entrust a local agent/importer to be listed (quick to get started, but the product registration is led by the other party). This choice affects who leads all subsequent QUEST3+ operations, so it must be settled before submission.

Common mistakes

• Skipping Pre-Membership and trying to submit directly—the system won't let you into the formal form.
• Not buying a USB Token and assuming you can submit—without a digital certificate, transactions cannot be completed.
• Treating notification as registration (or vice versa)—if a cosmetic claims therapeutic effects, it will be classified as a medicine and must switch to registration.
• The certificate environment is not set up properly—if the Token/Java/browser settings are not done according to the manual, you often get stuck at the signing step.

Frequently asked questions (FAQ)

Q: Do you have to find an agent to register for QUEST3+? No. NPRA clearly states that companies can register for QUEST3+ themselves, without hiring a consultant or agent. But if you do not have a local legal entity in Malaysia, you usually need a local holder as the applying party.

Q: What is a USB Token? Is it mandatory? A USB Token is the hardware form of a digital certificate, used to make a legally effective electronic signature within the system. To execute registration, variation, licensing, renewal and other transactions, you must install it first.

Q: Do cosmetics also go through QUEST3+? Yes. Cosmetics make a "notification" rather than a "registration" in the Cosmetic Notification module of QUEST3+, and can be sold legally only after obtaining a notification number.

Q: What is the difference between registration and notification? Medicines, natural products, health supplements, etc. must be "registered" to obtain a MAL number, with stricter review; cosmetics only need "notification," with the business bearing responsibility for quality and safety itself, while NPRA reserves the power to audit and delist.

Q: Can ordinary consumers check whether a product is registered? Yes. By entering the product name or registration number through the public QUEST3+ product search, you can verify it—this is the first step to identifying legitimate products.

Self-check list

• [ ] Completed Pre-Membership and passed email verification
• [ ] Submitted the Full Membership form and obtained NPRA approval
• [ ] Purchased and installed the USB Token digital certificate (including Token/Java/browser settings)
• [ ] Confirmed whether the product should go through "notification" (cosmetics) or "registration" (medicines/health supplements/traditional)
• [ ] Continuously track the review status and supplementary documents in the system after submission

Conclusion: QUEST3+ is NPRA's single portal; first pass the three gates of "Pre-Membership → Full Membership → USB Token," then choose the right module according to the nature of the product, and you can complete notification or registration yourself, without necessarily relying on an agent.

Run a free label check now

This article is compiled from official sources and is for reference only; actual compliance is subject to the latest official text and review by the competent authority.