Under the EU Falsified Medicines Directive, most prescription packs carry a unique identifier and an anti-tampering device. FMD wholesaler verification means risk-based authenticity checks on returns and certain inbound stock, plus verification and decommissioning before packs leave the Union — by the wholesaler who physically holds them. The Commission’s safety-features Q&A version 22 (10 July 2026) clarifies those duties and audit-trail access. Here is what to verify, when to decommission, and what to ask partners.

This article is an industry briefing for operational awareness, not legal advice. It is based on Commission Delegated Regulation (EU) 2016/161 and the Commission’s safety-features Q&A version 22. The Q&A is not a formal interpretation of Union law and is not legally binding. Confirm requirements with competent authorities and qualified counsel.

What FMD wholesaler verification means, and why the 2026 Q&A matters

Safety features in brief

Safety features are two elements on certain human medicines: a unique identifier (a unique sequence in a two-dimensional barcode that identifies and authenticates the individual pack) and an anti-tampering device (showing whether the packaging has been tampered with). Most prescription medicines must bear them; some non-prescription products are listed separately; veterinary medicines are out of scope.

Operators check the unique identifier against the repositories system and the anti-tampering device. A unique identifier is authentic when the system holds an active record with the same product code and serial number.

Binding rules vs the Commission Q&A

The binding rules sit in Commission Delegated Regulation (EU) 2016/161, in force since 9 February 2019. The Commission also publishes a Q&A for national experts. Version 22 was published on 10 July 2026; it revises several answers and adds one on audit-trail access. The Q&A states it is not a formal interpretation of Union law and is not legally binding. Use it as guidance; cite the Regulation for obligations.

When wholesalers must verify authenticity

Article 20 triggers

FMD wholesaler verification under Article 20 is risk-based, not a scan of every pack. A wholesaler must verify the unique identifier of at least:

• products returned by persons authorised to supply the public, or by another wholesaler; and
• products received from a wholesaler who is neither the manufacturer, nor the marketing authorisation holder’s wholesaler, nor a wholesaler designated by the MAH by written contract to store and distribute those products.

What Article 20 does not require

Article 21 derogates from the second trigger when ownership changes but possession stays with the same wholesaler, or stock moves between that wholesaler’s (or legal entity’s) warehouses with no sale.

The Commission Q&A (not binding) adds that Article 20(b) looks at physical transfer: stock shipped directly from the manufacturer, MAH or a designated wholesaler need not be verified under that limb even if bought from a third party. For Articles 20–22, wholesalers need not verify anti-tampering-device integrity — though they may. Checks before physical possession are extra; they do not replace Article 20 once stock is in hand.

Decommissioning: export outside the Union and other Article 22 cases

Decommissioning means changing the unique identifier’s status in the repositories so the pack is no longer active. Under Article 22, a wholesaler must verify authenticity and decommission products that: they intend to distribute outside the Union; were returned and cannot return to saleable stock; are for destruction; are authority samples while in possession; or go to Article 23 persons or institutions where national law requires it.

Who must decommission for export

For packs leaving the Union, the duty sits with the wholesaler who physically holds them. Verification and decommissioning cannot be delegated to another wholesaler — the audit trail must reflect the real chain. If sold to a party outside the EU but the packs stay on EU premises, do not decommission under Article 22(a).

Member-State options under Article 23

Member States may require wholesalers to verify and decommission before supply to listed categories (for example some non-pharmacy suppliers, armed forces, prisons or research establishments). It is a national option, not an EU-wide rule. Parallel-traded packs use the same safety-feature framework.

Alerts, suspected falsification and the audit trail

Do not supply or export; notify authorities

A wholesaler must not supply or export if packaging may have been tampered with, or verification suggests the product may not be authentic, and must inform competent authorities immediately. If the 2D code is damaged but human-readable data still allow verification, further distribution may be possible; otherwise do not distribute further.

Audit trail and NCA access

Each repository keeps a complete audit trail of operations on a unique identifier, the users and the nature of those operations, from upload until at least one year after expiry or five years after release for sale or distribution, whichever is longer.

New in Q&A version 22 (guidance only): national competent authorities get full access to all audit-trail data upon request, including corporate names and addresses of wholesalers and persons supplying the public who verify or decommission. Keep records and system-user identity inspection-ready.

Checklist: what distributors and buyers should prepare

Evergreen checklist

1. Map verification duties by flow: returns, non-designated inbound, EU-to-EU supply, and distribution outside the Union.
2. Confirm who physically holds stock at export decommissioning — that holder cannot pass the scan on.
3. Document Article 20 triggers and Article 21 derogations per inbound lane, including MAH-designated contracts.
4. Check anti-tampering-device integrity on receipt as good practice (optional under Arts 20–22).
5. Define an alert route to the national competent authority.
6. Keep audit-trail-ready records (who verified or decommissioned). Re-check partners via pharmaceutical supplier qualification.
7. Treat a decommissioned-pack or broken anti-tampering-device offer as a red flag.
8. Ask partners about Article 20 verification, Article 22(a) export decommissioning, and Article 23 destinations.
9. Log Q&A v22 (10 July 2026) as current guidance — not binding — and re-read new versions.

Questions to ask EU supply partners

• Are you the manufacturer, the MAH, or an MAH-designated wholesaler under written contract?
• Who physically holds stock when packs leave the Union, and who decommissions?
• How do you handle returns under Article 20(a)?
• What is your alert path if verification fails or the anti-tampering device looks compromised?
• Can you confirm pack status (active or decommissioned) before shipment?

Sourcing EU-authorised medicines and want help with product and documentation questions? You can request a quote.

FAQ

What is FMD wholesaler verification?

Wholesaler duties under Delegated Regulation (EU) 2016/161 to check unique-identifier authenticity in defined cases (Article 20) and to verify and decommission packs under Article 22, including distribution outside the Union.

Do wholesalers have to verify every pack?

No. Article 20 sets a minimum for returns and for stock from wholesalers who are not the manufacturer, MAH or an MAH-designated wholesaler. Further checks are optional extras.

Who decommissions packs leaving the EU?

The wholesaler who physically holds them and intends to distribute outside the Union. Per the Commission Q&A (not binding), that duty cannot be delegated; Article 22(a) is the binding base.

Is the Commission safety-features Q&A legally binding?

No. Version 22 says it is not a formal interpretation of Union law and is not legally binding. Obligations come from Delegated Regulation (EU) 2016/161.

What changed in Q&A version 22?

Published 10 July 2026, superseding version 21. It revises several answers and adds Q&A 7.21: NCAs get full audit-trail access on request, including wholesaler identities involved in verification and decommissioning.

Sources

1. European Commission — Safety features for medicinal products for human use: Questions and Answers, Version 22 (published 10 July 2026). Not legally binding. Q&A PDF.
2. European Commission — Falsified medicines overview (Directive 2011/62/EU; safety features apply from 9 February 2019; Q&A listing). Commission page.
3. Commission Delegated Regulation (EU) 2016/161 of 2 October 2015 (OJ L 32, 9.2.2016). Arts 10–11, 20–24, 35(1)(g). Commission-hosted PDF. EUR-Lex: eli/reg_del/2016/161/oj/eng (verify in browser; automated access blocked).