MeDC@St Practical Guide: Accounts, Submissions and Common Errors

1. Key takeaways

Malaysian medical device applications are filed through MeDC@St, the Medical Device Centralized Online Application System, which has been upgraded to version 2.0 and beyond. Establishment licence applications and product registrations, including IVDs, are handled in this single system rather than in separate portals. It is accessible from anywhere in the world and supports several users working from one shared account, which suits a manufacturer working alongside an authorised representative and a regulatory consultant. Because both the licence and the registration live in the same place, the account is the operational centre of a Malaysian programme, and the discipline applied to it determines whether deadlines are met.

• MeDC@St is the single filing system for establishment licence applications and product registrations, IVDs included, and is now at version 2.0 and above.
• The system is accessible globally and allows multiple users to share one account, which fits the manufacturer, AR and consultant working relationship.
• One account covers both application types, so a separate account for licensing is neither needed nor desirable.
• Supporting documents must be in PDF, with a per-file size limit that the IVD guidance states as no more than 10MB, and a single module accepts multiple uploads.
• Payment notices and bank draft information are pushed to the account, which makes the account the channel through which deadlines arrive.
• The surrounding systems are separate: MeDCReSt for vigilance reports, ePermit for import permits and MedCast for MDA announcements and training.

2. Legal basis

MeDC@St is the operational channel through which the obligations in Act 737 and the Medical Device Regulations 2012 are discharged. An establishment licence application under Section 15 and a registration application under Sections 5 to 7 are both filed electronically, and the system carries the modules that correspond to the regulatory requirements: applicant and establishment information, grouping, the CSDT content, the declaration and the fee. MDA/GL/MD-01, issued in March 2019 in its third edition, describes the application process and the documentary expectations that the system implements.

Account creation follows three steps. The applicant completes the account creation form, supplying business registration information, the establishment name, a valid email address and a username and password. An activation email is then sent, and it is worth checking the spam folder since a missed activation stalls everything that follows. The applicant then logs in and the account is ready for use. Because one account covers both the licence and the registration, the same credentials serve the whole programme.

Attachments are constrained in format and size. Supporting documents must be PDF, each file is subject to a size limit that the IVD application guidance states as no more than 10MB, and a module accepts repeated uploads where the material has to be divided. The account also carries the financial correspondence: bank draft information and payment notices are delivered through it, which means the system is not only a filing cabinet but the place where a deadline is first announced.

Three other systems handle adjacent functions and should not be confused with the filing system. Vigilance reports, including mandatory problem reports, are submitted online through MeDCReSt. Import permits are handled through ePermit at newepermit.dagangnet.com.my. MDA announcements and training material are published on the MedCast platform. Four systems, four distinct roles.

3. Expert insights

The three most frequent operational failures in MeDC@St are all failures of attention rather than of regulatory understanding. The first is payment timeout: the fee must be paid within 30 days of the payment notice, and if it is not, the application is deleted from the system. Deletion is not a suspension, and a re-filing starts the process again. The second is the information round: where the MDA requests further material, the response must be provided within the period set, and a failure to respond is treated as a withdrawal under Section 6(4). The third is using the wrong channel, such as sending a mandatory problem report by email rather than through MeDCReSt, to which the framework provides an exception only for combination products.

What these three have in common is that the triggering event arrives as a notification inside an account that several people may be watching. An email that lands in a shared inbox and is read by nobody, or is read by somebody who assumes a colleague has handled it, is enough to lose an application that was otherwise complete. The remedy is procedural rather than technical: a named owner for the account, mail rules that route payment notices and deficiency letters to that owner and to a deputy, and calendar reminders set at the moment the notice is received rather than at the deadline.

A further point concerns the size limit. A 10MB ceiling per file forces the dossier to be divided sensibly, and the division should follow the CSDT structure rather than the order in which documents happen to be produced. Files that are split arbitrarily make review harder and increase the chance of a query, which then consumes one of the information rounds that the system measures so strictly. Attachment discipline is therefore not an administrative detail; it is part of what keeps the review inside a single round.

The separation between the four systems also deserves respect. A manufacturer or distributor that treats every MDA communication as something to be sent by email will eventually submit a vigilance report through the wrong channel or an import permit request to the wrong address. The cost is not only delay; in the vigilance case it is a compliance failure at the moment when speed matters most.

4. Practical recommendations

• Create one MeDC@St account for the programme and register every user who needs access, with a named owner and a named deputy rather than an unassigned shared login.
• Complete the account creation form with the exact establishment name and a monitored email address, and confirm activation immediately, checking the spam folder if the message does not arrive.
• Set mail rules and calendar reminders for payment notices and deficiency letters at the moment they arrive, since the 30-day payment window and the information round run whether or not the message has been read.
• Prepare attachments as PDF within the 10MB per-file limit, dividing them along the CSDT structure so that the reviewer can follow the file.
• Keep the four systems distinct in the standard operating procedure: MeDC@St for filings and fees, MeDCReSt for vigilance, ePermit for import permits and MedCast for announcements and training.
• Review the account activity monthly, including pending notices and open applications, so that a deadline cannot expire unnoticed between reviews.

5. Verification checklist

• □ MDA MeDC@St pages reviewed for the current account creation and fee payment rules (pending verification).
• □ MDA/GL/MD-01, March 2019, third edition, checked for the application process description (pending verification).
• □ IVD registration guidance checked for the statement that attachments must be PDF and no more than 10MB per file (pending verification).
• □ MDA Vigilance Unit pages reviewed for the MeDCReSt submission route, including the combination product exception (pending verification).
• □ MDA announcement on import permits reviewed for the ePermit address at newepermit.dagangnet.com.my (pending verification).
• □ The 30-day payment rule and the Section 6(4) response rule confirmed against the current system guidance (pending verification).

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com