Under EU GDP (2013/C 343/01), a wholesale dealer may only supply medicinal products to people who are themselves authorised to receive them. For UK medical cannabis wholesalers, that means every customer — whether a specials pharmacy, a clinic dispensary, another wholesaler, or an exporter — must be verified before the first order, and re-verified on a defined cycle. Inspectors call this the "bona fide check", and it is one of the most common areas where wholesalers lose marks at MHRA inspection.

This guide sets out what bona fide really means in practice, what evidence to collect, and how to build a process that scales without breaking.

What GDP actually requires

Chapter 5 of the EU GDP guidelines requires the wholesale distributor to obtain supplies only from holders of a wholesale distribution authorisation or manufacturing authorisation — and, by the same logic, to supply only to those legally entitled to receive them in the destination country.

For a UK wholesaler dealing in medical cannabis (a Schedule 2 controlled drug under the Misuse of Drugs Regulations 2001), the bona fide check has two layers:

  • The MHRA-side check: confirming the customer holds the correct human medicines authorisation (WDA(H), MS, or equivalent overseas authorisation), and that the products you intend to supply fall inside their scope.
  • The Home Office-side check: confirming the customer holds a valid Schedule 2 controlled drugs domestic licence (or import/export licence, as relevant), with the right chemical entities listed.

Either check failing on its own is enough to make a supply unlawful. Both checks must be documented, dated, and traceable to a named person.

A practical bona fide checklist

A defensible bona fide file for a UK customer typically contains:

  • A copy of the customer's current WDA(H), MS, or MIA(IMP) — including the schedule of activities and product types.
  • A copy of the Home Office Schedule 2 domestic licence covering the specific cannabinoid(s) being supplied.
  • The Responsible Person (RP) name and contact details.
  • The Senior Responsible Officer name for controlled drugs.
  • Confirmation of the delivery address and that it matches the licensed site(s).
  • A signed customer declaration confirming the products will be handled only by authorised staff and stored under labelled conditions.
  • For overseas customers: the equivalent national authorisation, plus written confirmation that import of medical cannabis is permitted in the destination country.

For the controlled drugs layer specifically, our Home Office Schedule 2 controlled drugs licence guide covers what each licence permits and how to read it.

On-going monitoring, not a one-off

Inspectors expect:

  • A defined re-verification cycle (commonly 12 months, shorter where risk is higher).
  • Automatic flags when an authorisation is approaching expiry.
  • A documented trigger to suspend supply if a licence has lapsed or been varied.
  • Records of any customer-notified changes — change of RP, change of premises, change of scope.

A register listing every active customer, their authorisation references, expiry dates, last verification date, and next-due date is usually enough — provided it is genuinely kept up to date and owned by a named person.

Red flags that should pause supply

  • Delivery requested to an address not on the customer's licence.
  • Order quantities inconsistent with the customer's normal pattern.
  • Payment from a third party not on file.
  • Pressure to ship before bona fide checks are complete.
  • A new customer contact who is not on the named-staff list.

None are automatic refusals, but each deserves a logged review and a written decision by the RP before the order ships.

How this lands at MHRA inspection

Inspectors typically pick three to five customer files at random, trace them end-to-end, cross-check against actual orders shipped, and test what happens when a customer's authorisation lapses. To pressure-test your process before a real inspection, the drills in our MHRA GDP inspection readiness guide cover exactly this scenario.

How Medicexum supports bona fide design

Medicexum helps UK medical cannabis wholesalers design, document, and operationalise customer due diligence: building bona fide SOPs and registers, drafting customer declarations and RP review templates, running mock inspection drills, and supporting recruitment of a permanent Responsible Person to own the framework — see Responsible Person services and the broader MHRA compliance offering.

If you are preparing to ship to your first UK customer, get in touch.