Sri Lanka Licence Holder versus Distributor Structure

1. Key takeaways

In Sri Lanka, the licence holder (the MAH) and the distributor may be the same entity, or may be split into two separate entities. The rules mandate the MAH but do not prohibit the combined arrangement. From a risk-control perspective, the split is the safer choice: the MAH’s name appears on the registration certificate and it carries the coordination duty for quality incidents and recalls. Separating the distribution channel from that role means that changing a distributor does not affect the certificate. The registration certificate is valid for 5 years, so the structure chosen at the outset shapes the commercial flexibility available across the whole certificate cycle. The decision should therefore be made deliberately rather than by default, because unwinding a combined arrangement mid-cycle is far harder than setting up a split one from the beginning.

• The rules require a local MAH for foreign manufacturers but do not forbid the MAH from also acting as the distributor.
• Combining the two roles puts the registration certificate at the centre of any commercial dispute.
• Splitting the roles protects the certificate when the distributor changes.
• The MAH must be capable of performing its duties: importing, vigilance reporting, market inspections, and recalls.
• GDP inspections fall on whoever actually controls warehousing and transport, regardless of nominal role.

2. Legal basis

The structural rules come from the NMRA medical device pages and related official descriptions of the enforcement bodies. The table below lists the mandatory elements: the MAH requirement, the scope of MAH duties, the surveillance mandate of the Market Control Division, the testing role of NMQAL, and the monthly evaluation cycle of MDEC.

Read together, these provisions show a system in which the certificate holder and the commercial channel can be arranged flexibly, but the enforcement apparatus — inspections, sampling, recalls, GDP checks — operates on whoever performs the underlying activity. Structure is a business choice; accountability follows function. For a manufacturer deciding between the two models, the practical question is not which structure the rules prefer — the rules are neutral — but which structure survives the stresses of a 5-year certificate cycle: distributor changes, price negotiations, quality events, and renewal filings. Planning those stresses into the agreement at the start is what keeps the structure stable for the full five years.

3. Expert insights

Insight one: under a combined structure, commercial disputes convert directly into compliance risk. If the MAH is also the distributor, the registration certificate becomes its bargaining chip in negotiations — it can withhold cooperation on renewal, or withhold import documentation. None of this breaches the rules, yet commercially it is almost impossible to counter. The manufacturer would face a choice between conceding terms and losing market access, because the certificate sits in the hands of the party it is negotiating against. This single dynamic is the strongest argument for separating the roles wherever the volume of business justifies it.

Insight two: the key to a split structure is that the MAH must have real performance capability. It must be able to import, to carry out vigilance reporting, and to cooperate with market inspections and recalls. A shell company cannot serve as the MAH. When evaluating candidate entities, manufacturers should test for operating capacity — staff, warehouse or import arrangements, and familiarity with NMRA procedures — rather than accepting any locally registered company that offers to hold the certificate for a fee.

Insight three: GDP inspections fall on the party that actually controls the warehouse. Whether the entity is nominally the MAH, the importer, or the distributor, whoever physically controls storage and transportation must accept the inspection and carry the responsibility. This allocation must be written clearly into the agreements, because the regulator will follow the operational reality rather than the contractual labels. An agreement that assigns GDP duties to a party without facilities simply creates a gap that surfaces during an inspection.

4. Practical recommendations

• GRZAN’s structural advice comes in three tiers: during the market-entry stage use an independent MAH without a channel; during the scale-up stage separate the MAH from the distributor but sign a coordination agreement; in the mature stage consider holding the licence through an owned entity.
• Whichever tier applies, write four points into the agreement: who keeps the original registration certificate, who initiates renewal, how certificate transfer is coordinated on termination of cooperation, and who is responsible for GDP compliance.
• Keep custody of the certificate original with the party least likely to use it as leverage — typically the MAH under a service-fee arrangement rather than the distributor.
• Define the renewal trigger date and the party responsible for filing, given the 5-year certificate validity.
• Specify the cooperation obligations and time limits for certificate transfer when the commercial relationship ends.
• Map GDP duties to the entity that actually controls warehousing and transport, so contractual responsibility matches inspection reality.

5. Verification checklist

• □ Whether the licence holder and distributor are separated has been decided
• □ The MAH’s capability for import and vigilance performance has been confirmed
• □ Responsibility for custody of the original certificate has been agreed
• □ The party initiating renewal and bearing the cost has been agreed
• □ Certificate-transfer cooperation obligations and time limits on termination have been agreed
• □ The party responsible for GDP compliance has been clearly identified

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com

Regulatory information verified as of 28 October 2026.