How to Check if Your Skincare Is KKM Approved: A Malaysian Doctor's Step-by-Step Guide

What does "KKM approved" actually mean for skincare?

In Malaysia, skincare products are never technically "KKM approved". Cosmetics fall under a notification system, not an approval system. The company selling a product must notify the National Pharmaceutical Regulatory Agency (NPRA), the regulatory arm of the Ministry of Health (KKM), before placing it on the market. Once notified, the product receives a notification number in the format NOT followed by digits and a letter, for example NOT230100123K. This number must appear on the product packaging. Medicines go through a different and much stricter route called registration, which grants a MAL number and requires a review of safety and efficacy data before sale. So when a seller claims a cream is "KKM approved", the accurate question to ask is whether it is KKM notified, and whether that notification is still active. Both can be checked free of charge on the NPRA website in under two minutes.

This distinction is not pedantic. It changes what the label can honestly promise you. A notification tells you the product has been declared to the authorities and can be traced to a responsible company in Malaysia. It does not tell you the product was tested by KKM before it reached the shelf. I will come back to that gap, because it is the single most misunderstood part of skincare safety in this country.

How to check your skincare on the NPRA product search

To check whether a skincare product is KKM notified, search it on the official NPRA product database, often called the Quest portal. Go to npra.gov.my, open the "Products Search" function under the consumer section, and type the product name or the NOT number printed on the packaging. A notified product will appear with its full name, notification number, notification holder (the responsible company), and status. If the status shows as cancelled, the product has been pulled from the market, most often because laboratory testing found a banned substance. If the product does not appear at all, it was never notified, and selling it in Malaysia is illegal under the Control of Drugs and Cosmetics Regulations 1984. The search is free, works on a phone, and takes less time than reading the product's marketing claims.

Here is the exact sequence I give patients:

1. Find the NOT number on the box or tube. Check the back and the bottom. The format is NOT, followed by digits, ending with a letter.
2. Visit the NPRA registered and notified product search.
3. Paste the NOT number into the search field. Searching by number is more reliable than by name, because product names are often shared or slightly misspelled on listings.
4. Confirm three things: the product name matches exactly, the notification holder is a real company you can find, and the status is active.
5. If anything fails to match, do not buy. If you already own it, stop using it until you have clarity.

One Malaysian habit worth changing: many shoppers on Shopee, Lazada and TikTok Shop rely on the seller posting a screenshot of a "KKM certificate" in the listing photos. Screenshots are trivially easy to fake or borrow from another product. The database is the source of truth, not the listing.

Does KKM test skincare products before they are sold?

No. Under Malaysia's cosmetic notification system, KKM does not test skincare products before they go on sale. Notification is a self-declaration by the company: it declares that the product complies with the ASEAN Cosmetic Directive, which Malaysia adopted in 2008, and that it contains no prohibited substances. NPRA then polices the market after products are already on the shelf, through random sampling, laboratory screening and complaint investigation. This is called post-market surveillance. When a lab test finds a banned ingredient, NPRA cancels the notification and issues a public alert through the Ministry of Health. In other words, an active notification means a company has taken legal responsibility for the product and nothing has been found against it yet. It is a meaningful baseline and I always insist on it, but it is a floor, not a ceiling, for product safety.

This is the honest nuance most "KKM approved" marketing skips. The system is built on traceability and deterrence rather than pre-market testing, which is also how cosmetics are regulated across ASEAN, the European Union and most developed markets. It works reasonably well, but it means the first line of defence is the company's integrity, and the second line is you.

Is there a "KKM sticker" on genuine skincare products?

There is no KKM sticker for skincare. The hologram security sticker Malaysians sometimes look for, called the Meditag, is used on registered pharmaceutical products, the ones carrying MAL numbers, not on notified cosmetics. A face cream, cleanser, sunscreen or body lotion will not carry a Meditag hologram, and its absence means nothing about authenticity. The reverse is the real warning sign: cosmetics printed with an official-looking "KKM Approved" logo, a fake hologram, or a Ministry of Health crest are decorating themselves with endorsements that KKM does not issue for cosmetics. NPRA's own consumer guidance is that verification is done through the product database, not through any mark on the packaging. If a seller's main proof of legitimacy is a sticker, a stamp or a certificate photo rather than a searchable NOT number, treat that as a red flag and check the database yourself.

This myth persists because medicines and supplements genuinely do carry the hologram, so shoppers reasonably assume skincare should too. The categories are regulated differently, and counterfeiters exploit exactly this confusion.

Which products need notification, and which need full registration?

Every cosmetic sold in Malaysia requires notification: facial skincare, body lotions, cleansers, sunscreens, shampoos, hair dyes, deodorants, toothpaste, makeup and perfumes all fall under the cosmetic notification system and should carry a NOT number. Products that claim to treat, cure or prevent disease are not cosmetics. They are regulated as medicines or health supplements and require full registration with a MAL number, which involves pre-market evaluation. The boundary is drawn by claims and ingredients, not by where the product sits on the shelf. A moisturiser is a cosmetic; a cream claiming to treat eczema is making a medicinal claim. This boundary matters for shoppers because sellers sometimes push a product's claims well beyond its category, promising treatment outcomes from something that was only ever notified as a cosmetic. If a product promises to cure a skin condition but carries only a NOT number, the claim itself is the warning.

Two practical corollaries. First, "dermatologist formulated" or "clinically tested" on a cosmetic label are marketing phrases, not regulatory categories, and KKM does not certify them. Verifiable specifics beat label phrases, which is the same reason cleanser pH matters more than the ingredient list. Second, if you are ever unsure which category a product belongs to, the same NPRA search shows both notified cosmetics and registered products, so one search covers both possibilities.

Why do notified products get cancelled? Mercury, hydroquinone and steroids

Products lose their notification when post-market testing finds scheduled poisons or banned substances, and the pattern in Malaysia is depressingly consistent: mercury, hydroquinone, tretinoin and potent steroids, almost always in whitening or "glow" creams. In February 2025, the Ministry of Health cancelled the notifications of five cosmetic products after laboratory tests confirmed these exact substances, including mercury and betamethasone 17-valerate, a prescription steroid. Mercury is prohibited in cosmetics under the Minamata Convention, which caps it at 1 mg/kg, a trace-contamination threshold rather than a permitted dose. The World Health Organization links mercury-added skin lightening products to kidney damage, skin rashes and discolouration, and nervous system effects, with risks extending to children in the household. A 2025 risk assessment of skin-lightening creams sold online across Asian countries found that over 58% of mercury-positive samples exceeded the limit, some by extraordinary margins.

The cruel irony is that mercury and strong steroids do produce fast visible lightening, which is why they keep appearing in unnotified creams. The damage arrives later. Steroid-laced creams thin the skin and cause rebound redness and skin darkening after whitening products are stopped. Mercury accumulates quietly.

I saw this play out in my own clinic. A woman in her thirties came in with patchy darkening and burning across both cheeks. It began after she stopped a whitening cream she had bought through a live-selling session, a cream that had worked "amazingly" for four months. We searched the product together during the consultation. Its notification had been cancelled the previous year. Nothing about the packaging looked suspicious: nice box, ingredient list, even a NOT number that had once been real. The two-minute check she did in my clinic is the same one she could have done before the first purchase. Her skin needed months of careful barrier repair with ceramides, and some of the pigment change may be long-term. I do not share this to frighten anyone. I share it because the database check is genuinely the highest-value two minutes in Malaysian skincare.

Red flags to check before you buy any skincare in Malaysia

Before buying skincare in Malaysia, check five things: a NOT number you can verify on the NPRA database, a named notification holder you can find, realistic claims, a traceable seller, and an ingredient list in INCI format. A missing NOT number on any cosmetic sold locally is disqualifying on its own. Beyond that, the highest-risk signals cluster together: promises of visible whitening within days, "guaranteed" results, before-and-after photos with dramatic lightening, products sold only through social media accounts or live sessions with no registered business behind them, and prices dramatically below comparable products. None of these individually proves a product is dangerous, but in the Ministry of Health's open data on cancelled notifications, the products found to contain mercury or steroids overwhelmingly fit this profile. Legitimate brands, local and international, survive scrutiny on every one of these points, and reputable sellers will give you the NOT number without hesitation when asked.

A note on marketplaces: a product being listed on a major platform is not verification. Platforms remove listings when alerted, but new ones appear faster than enforcement can follow. The NPRA database does not have this lag problem, because cancellation takes effect at the source.

What should you do if your product is not notified or was cancelled?

Stop using the product, keep the packaging, and check your skin. If the product does not appear in the NPRA database or its status is cancelled, discontinue it rather than finishing the tube. Keep the product, its box and your purchase record, because these help enforcement. You can report the product and the seller to NPRA or your state health department; public complaints are a major trigger for the sampling that gets dangerous products removed. Then watch your skin over the following weeks. If you develop redness that flares easily, burning, unusual darkening or worsening sensitivity after stopping a fast-acting whitening product, see a doctor rather than treating it yourself, because rebound reactions from hidden steroids need medical management, and suspected mercury exposure can be assessed properly. If the product was used during pregnancy or on children, mention that specifically to your doctor.

Do not panic if you used a cancelled product briefly. Risk scales with duration and frequency of use. But do take the follow-up seriously, and take the two-minute database check with you into every future purchase.

The habit that protects you

Skincare safety in Malaysia does not require memorizing ingredient chemistry. It requires one habit: verify the NOT number on the NPRA database before you buy, and again occasionally for products you use long-term, since cancellations happen after products are already on the market. The system is imperfect, as every notification system is, but it is free, public and updated continuously, which makes it one of the most underused consumer tools in the country. If this guide changed how you shop, the best next step is to run the check on whatever is currently sitting on your bathroom shelf tonight: every cleanser, cream and sunscreen you use regularly. It costs nothing, takes two minutes per product, and every so often it catches something that matters. Teach the habit to the people who shop for your household, because the highest-risk purchases in Malaysia often arrive through a relative's live-selling find rather than your own careful research.

Frequently asked questions

How to check if a product is KKM approved?

Find the notification number on the packaging (format: NOT followed by digits and a letter), then search it on the NPRA product database at npra.gov.my. Confirm the product name matches, the notification holder is a real company, and the status is active. Cosmetics in Malaysia are notified rather than approved, so an active notification is what you are looking for.

What is a cosmetic product notification?

A cosmetic product notification is a declaration a company submits to NPRA before selling a cosmetic in Malaysia. The company declares the product complies with the ASEAN Cosmetic Directive and contains no banned substances, and it receives a NOT number in return. Notification establishes legal responsibility and traceability, but it does not mean KKM tested the product before sale.

What products require a KKM check?

All cosmetics sold in Malaysia require notification: facial skincare, body care, sunscreens, cleansers, shampoos, hair dyes, deodorants, makeup, perfumes and toothpaste. Products claiming to treat or cure conditions are regulated as medicines or supplements instead, and need full registration with a MAL number. The same NPRA search covers both categories, so one check works for any product type.

What is a KKM cert?

KKM does not issue an approval certificate for cosmetics. When sellers post a "KKM cert" in their listings, it is usually a screenshot of the notification acknowledgement, which is easy to fake or borrow from another product. Verify the NOT number yourself in the NPRA database rather than trusting certificate images in a listing or a WhatsApp message.

Is a KKM product check mandatory?

Notification is mandatory for companies: selling an unnotified cosmetic in Malaysia is an offence under the Control of Drugs and Cosmetics Regulations 1984. For consumers, checking is voluntary but strongly recommended, especially for whitening products, products sold only through social media, and anything promising fast visible results. The check is free and takes about two minutes.

How do I verify a product's KKM status?

Search the NOT number on the NPRA product database and read the status field. Active means the notification stands and nothing has been found against the product. Cancelled means it was pulled from the market, often after laboratory tests found banned substances such as mercury, hydroquinone or steroids. If the product does not appear at all, it was never notified. Stop using cancelled or unlisted products.

How to check KKM sticker?

There is no KKM sticker for skincare or other cosmetics. The Meditag hologram sticker appears only on registered pharmaceutical products carrying MAL numbers. A genuine cosmetic will not have one, and its absence means nothing. The reverse is the warning sign: an official-looking "KKM Approved" logo or hologram printed on a cosmetic is a red flag, because KKM issues no such mark.