Brand owners are handed a list of acronyms and told they are all important. They are not equally important, they do not do the same job, and two of them are not optional in Malaysia at all.
Here is what each one actually is, who it belongs to, and when a buyer will ask you for it.
Which food certifications are legally required in Malaysia?
MeSTI is the legal prerequisite. A food premises must be MeSTI certified to manufacture food in Malaysia. Halal certification is not legally required, but without it a large part of the domestic market and most export routes into Muslim-majority countries are closed. GMP, HACCP and ISO 22000 are voluntary standards that buyers, distributors and retailers ask for.
| Certification | Required by law in Malaysia? | Who holds it | Who asks for it |
|---|---|---|---|
| MeSTI | Yes, to manufacture food | The factory | Regulators |
| Halal (JAKIM) | No, but commercially decisive | The factory, and often the brand owner separately | Consumers, retailers, export markets |
| GMP (MS 1514) | No | The factory | Distributors, retail buyers |
| HACCP (MS 1480) | No | The factory | Export buyers, larger retailers |
| ISO 22000 | No | The factory | International buyers, procurement teams |
What is MeSTI?
MeSTI — Makanan Selamat Tanggungjawab Industri, "safe food is the industry's responsibility" — is Malaysia's food safety scheme, administered by the Food Safety and Quality Division of the Ministry of Health. It requires a food premises to meet defined hygiene, process control and traceability requirements, and it is a legal prerequisite for manufacturing food here.
Certificates are issued and listed through the Ministry's FoSIM system, so a MeSTI claim is verifiable. If a prospective manufacturer cannot produce a MeSTI certificate, the conversation should stop there.
D&O holds MeSTI certificate ME0523069-0/1.
What is GMP, and what does MS 1514 mean?
GMP — Good Manufacturing Practice — is the standard for how a factory is actually run: personnel, premises, equipment, documentation, production and quality control. For food in Malaysia it is certified against MS 1514, with certification issued by bodies such as SIRIM QAS International.
GMP is about system and discipline rather than about any one product. It is the difference between a factory that keeps records because it is audited on them and one that keeps records when it remembers.
For a brand owner, it is usually the first document a distributor or retail buyer asks to see. D&O is certified to MS 1514:2022, cert. GMP 00203 (SIRIM QAS).
What is HACCP, and how is it different from GMP?
HACCP — Hazard Analysis and Critical Control Points — is a preventive system. It identifies where contamination could occur, sets critical control points, and monitors them continuously instead of relying on testing the finished product. GMP describes how the factory operates; HACCP describes how specific hazards in a specific process are controlled.
The framework is recognised internationally through Codex Alimentarius and, in Malaysia, certified against MS 1480. It underpins ISO 22000, and it is frequently a prerequisite for export and for supplying larger retailers.
D&O is certified to MS 1480:2019, cert. HACCP 00425 (SIRIM QAS).
What does ISO 22000 add?
ISO 22000 is the international food safety management system standard. It combines HACCP principles with a full management system covering communication, hazard control and continuous improvement across the supply chain, audited by an accredited body and reassessed on a regular cycle.
The practical difference from HACCP alone is scope and permanence: HACCP controls the hazards in a process; ISO 22000 requires the organisation around it to keep working. International buyers and corporate procurement teams tend to name ISO 22000 specifically.
D&O holds cert. FSMS 00229 (SIRIM QAS).
Which of these belong to me, and which to the factory?
All four belong to the factory. None of them transfers to your brand or your label. What you get is the right to state that your product is manufactured in a facility holding them — which is what buyers are asking about anyway.
Two things remain yours regardless of how well certified the factory is:
- Product registration or notification in the market you sell into.
- Label compliance and claims — permitted ingredients, nutrition panel format, language requirements, and what you may legally say the product does.
A factory certificate is not a defence for a non-compliant claim on your pack.
What should I actually ask a manufacturer for?
Ask for the certificates by number, and check three things on each:
- The company name — does it match the company quoting you?
- The scope — does it cover your product category? Certification is scoped, and a certificate covering beverages does not automatically cover seasoning.
- Currency — certificates renew on their own cycles. Ask for the current one rather than relying on a date printed on a website.
D&O supplies copies of all five certificates, with the certified scope, on request.
Frequently asked questions
Do I need GMP certification for my brand? No. GMP is held by the manufacturing facility. You need a manufacturer that holds it.
Is HACCP or ISO 22000 better? They are not alternatives. HACCP controls hazards in a process; ISO 22000 wraps HACCP inside an audited management system. Factories that hold both, hold both for that reason.
Is MeSTI enough on its own? It is enough to be legal. It is usually not enough to satisfy a distributor, a retail chain or an export buyer.
Does Halal certification cover food safety? No. Halal certification assesses ingredients, processing aids, equipment, cleaning and storage against MS 1500. Food safety is assessed separately under MeSTI, GMP, HACCP and ISO 22000.
How do I verify a Malaysian certificate? MeSTI through the Ministry of Health's FoSIM system, and JAKIM Halal through the MYeHALAL directory. GMP, HACCP and ISO 22000 certificates carry the issuing body's reference number — ask for the certificate itself.