e-Submission and Two-Factor Authentication: The 8 June 2026 Threshold

1. Key takeaways

The Myanmar FDA has announced: from 8 June 2026, two-factor authentication (2FA) is a mandatory requirement for logging in to the e-Submission portal. From that point, an account name and password alone are insufficient for access; a second factor must be configured, typically an authenticator application or the SMS and one-time-password methods provided through the portal. All authorised representative personnel who submit or track applications must open individual accounts and enable 2FA.

GRZAN note: this is the most recent, most specific and most immediately executable compliance change identified in this verification. It has two direct effects: first, account and 2FA configuration must be scheduled ahead of the first submission; second, a single-person account constitutes a single point of failure. Both effects are administrative rather than technical, which is precisely why they are overlooked: companies budget their calendars for dossier preparation and assume that portal access will simply be available when the dossier is ready, an assumption that this requirement now makes unsafe.

2. Legal basis

The table below summarises the effective date, the system, the login and account requirements, and the supporting arrangements announced alongside them. Read together, the rows describe an access regime in which the portal, the authentication method and the personal accounts are all prerequisites that must be arranged before any document can actually be filed.

3. Expert insights

Insight 1: mandatory 2FA is a procedural threshold, not a technical requirement. It does not change the review standards for any product, but it directly determines whether a company can enter the system to submit at all. Thresholds of this kind are the most expensive to discover late, because the failure appears only at the moment of submission, when the project calendar is already committed and the deficiency cannot be remedied by improving the dossier. The remedy is entirely upstream: verify access early, and the threshold never becomes visible.

Insight 2: the requirement that all operators open individual accounts changes the account management model. The former practice of having a single liaison operate the portal is no longer viable; companies must configure several authorised personnel on the AR side. This is not a formality. Individual accounts create individual failure modes, each tied to one person’s phone or authenticator, so the account inventory has to be managed as deliberately as the submission documents themselves. It also distributes knowledge: with several trained operators, a submission is never hostage to one person’s availability.

Insight 3: account registration, identity verification and 2FA configuration occupy several days. This lead time must be placed at the front of the project schedule rather than run serially after document preparation. The activities involve external parties and verification loops that the company cannot compress, which is exactly the kind of duration that belongs on the critical path, planned in parallel with dossier writing instead of appended to it. Days spent here are recoverable; days lost at the submission date are not.

Insight 4: backup contact details and recovery procedures should be written into the SOP. A change of the primary mobile number is a frequent cause of account lockout. A recovery procedure that exists only in someone’s memory fails together with the memory; one that is written into the SOP survives staff turnover and can be executed by whoever is available when access is lost.

Insight 5: 2FA credentials for Myanmar must be managed separately from other markets. Reusing passwords across jurisdictions creates account security risk, and an incident in one system can cascade into another. Separate credential sets, separate storage and separate recovery contacts confine the blast radius of any single compromise to one portal instead of the whole regional portfolio. The discipline costs little to establish at the outset and is difficult to retrofit after habits have formed around shared credentials.

4. Practical recommendations

• Start account registration and 2FA configuration immediately after the AR is appointed. Place this step ahead of the first submission, in parallel with document preparation, not after it.
• Configure at least two authorised personnel for the AR accounts. This avoids a single point of failure when one person is absent or their second factor is lost, and it keeps progress tracking available continuously rather than intermittently.
• Register backup contact details. Guard against a change of the primary mobile number, which is the most common trigger of lockouts, and record the backup in the account inventory so it is known before it is needed.
• Write the 2FA recovery procedure into the quality or regulatory SOP. Make it a standard action with a named owner, rather than an improvised exercise at the moment of failure; include the support channel contact so the first hour of a lockout is not spent searching for whom to call.
• Manage Myanmar 2FA credentials as an independent credential set. Do not reuse passwords across jurisdictions, and keep the Myanmar set out of shared credential stores used for other portals.

5. Verification checklist

• □ It has been confirmed that 2FA is mandatory from 8 June 2026
• □ Registration of the e-Submission account has been completed
• □ 2FA has been enabled for all operating personnel
• □ At least two authorised personnel have been configured
• □ Backup contact details have been registered
• □ The 2FA recovery procedure has been written into the SOP
• □ Myanmar 2FA credentials are managed independently

Regulatory information verified as of 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Myanmar. Our team prepares the technical dossier to ASEAN CSDT structure, manages submission and deficiency responses with the Myanmar FDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com