FDA Warning Letter

Regulatory Event

On July 13, 2026, FDA issued Warning Letter 320-26-103 to BioMylz Pvt. Ltd., a contract drug manufacturer operating at Facility Establishment Identifier (FEI) 3013697420 in Bengaluru, Karnataka, India, following an inspection conducted February 4 to 9, 2026. What FDA investigators documented is not a discrete recordkeeping gap. It is a data integrity collapse severe enough that investigators recovered a garbage bag containing discarded original Current Good Manufacturing Practice (CGMP) records — executed production batch records, media preparation logs, incubation and sterilization cycle logbook pages, finished product sample collection forms, environmental monitoring sample forms, and product complaint and change control log forms.

The primary citation is 21 CFR 211.22 — failure of the quality unit (QU) to ensure drug products conform to CGMP and meet established specifications for identity, strength, quality, and purity. The firm failed to maintain complete laboratory records, including original data supporting release testing of its over-the-counter (OTC) topical psoriasis cream, and could not produce that data on request. Laboratory logbooks had unnumbered pages with no reconciliation process, so missing pages could not be detected. In one example FDA documented, personnel initially recorded volume entries for a weight check activity in pencil, then overwrote those entries in ink after the activity was complete — a practice that destroys the contemporaneous, original nature of the record and makes the true first-recorded value permanently unrecoverable.

BioMylz’s response to the Form FDA 483 attributed the torn and discarded documents to a single former employee — an ex-plant manager who, the firm claimed, falsified entries to inflate yield in an isolated incident with no impact on controlled documents, and who had since been terminated. FDA rejected this framing outright: its evidence showed the same manager had been repeatedly observed, on multiple separate occasions, destroying batch production records, destroying laboratory-controlled records, and falsifying production and laboratory data. A pattern repeated across multiple occasions is not an isolated incident, and data integrity failures are systems and culture failures that surface through an individual’s actions — rarely resolved by removing that individual alone. BioMylz’s response offered no comprehensive evaluation of the impact of these breaches and no detailed, systemic remediation plan, which is precisely what FDA found inadequate.

What the Record Documents

This pattern has direct precedent in FDA’s enforcement history. At Ranbaxy Laboratories’ Paonta Sahib facility in India, FDA’s documentation of systemic data manipulation — including chromatographic data deletion and retesting without protocol authorization — led to Import Alert 66-40 in 2008, a recall covering more than 30 marketed drug products, and criminal charges filed against senior executives in 2013 under the Foreign Corrupt Practices Act and the Federal Food, Drug, and Cosmetic Act (FD&C Act). At Sun Pharmaceutical Industries’ Halol facility, FDA’s 2014 Warning Letter cited backdated laboratory records, manipulated audit trail entries in the Empower chromatography data system, and shared analyst login credentials that made individual attribution impossible; the corrective action required a complete data integrity audit of all marketed batches, re-evaluation of more than 40 stability studies, and an 18-month FDA reinspection cycle before Halol was released from heightened scrutiny.

BioMylz’s mechanism was paper rather than electronic — a garbage bag instead of a deleted acquisition file, a pencil-to-ink overwrite instead of a manipulated audit trail timestamp — but the ALCOA+ analysis (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available) is identical regardless of medium. A record altered after the fact to conceal the true first-recorded result violates the Contemporaneous and Original attributes whether the alteration happens in a chromatography audit trail or a logbook margin. Unnumbered, unreconciled logbook pages violate the Complete attribute the same way a gap in an electronic acquisition sequence does.

FDA’s second major finding, under 21 CFR 211.100(a) and (b), addressed process and cleaning validation following commercial scale-up. BioMylz could not demonstrate that its process assured consistent quality after scale-up; critical process parameters were not adequately documented in batch records, and the firm had not conducted adequate in-process hold time or stability studies to support shelf life. Cleaning validation was equally unsupported — the firm could not demonstrate effective removal of active pharmaceutical ingredient (API) residue or control of microbial contamination on shared equipment after scale-up. Its response stated that validation was performed in 2019, before the scale-up, with a commitment to revalidate for upcoming orders, but provided no supporting documentation or timeline. A validation study performed before a documented scale-up does not establish a state of control for the process as it currently runs — the core lifecycle principle underlying FDA’s 2011 Process Validation Guidance, under which qualification data must reflect the process and equipment configuration actually used commercially, not a prior configuration that has since changed.

Technical and Quality Context

The laboratory controls citation under 21 CFR 211.160(b) compounds the risk. BioMylz’s topical psoriasis cream had no testing program for objectionable microorganisms, specifically Staphylococcus aureus and Pseudomonas aeruginosa. United States Pharmacopeia (USP) <61> and <62> identify these organisms as objectionable for topical products and require testing for their absence; for a cutaneous product applied to compromised skin, this is not a theoretical gap. A product released without this testing carries an unassessed contamination risk in every batch disposition decision made during the relevant period.

The letter’s fourth finding carries independent legal consequence. BioMylz’s drug listings for Soraresal Cream, National Drug Code (NDC) 73526-002, and Equate Medicated Vaporizing Steam Liquid, NDC 73559-011, omitted required manufacturing-site information under 21 CFR 207.49(a)(12), because the contract laboratories performing release testing for these products — an activity that constitutes “manufacture” under 21 CFR 207.1 — were not registered with FDA under 21 CFR 207.17(a), confirmed by FDA’s search of the electronic Drug Registration and Listing System (eDRLS). That combination misbrands both products under section 502(o) of the FD&C Act, independent of the CGMP adulteration findings under section 501(a)(2)(B). BioMylz manufactures Soraresal Cream under a quality agreement with product owner Atrimed Pharmaceuticals Private Limited, and FDA’s letter is explicit that such an agreement does not transfer CGMP responsibility away from the contract facility: FDA regards contractors as extensions of the manufacturer, fully responsible for CGMP compliance regardless of the agreements layered on top.

FDA’s requested response is instructive because of what it is not: not a request for a corrected batch record or a revised SOP. It asks for a comprehensive investigation with a documented protocol, third-party employee interviews, a facility-wide deficiency assessment, a current patient risk assessment, and a corrective and preventive action plan — encompassing root cause analysis, corrective action, preventive action, and effectiveness checks — commensurate with the investigation’s findings, plus independent annual audits for at least two years and consideration of a chief integrity officer empowered to receive anonymous employee complaints. A remediation program built around terminating one employee, without a documented investigation establishing the full scope of affected batches and systems, does not meet the bar FDA has applied at comparable facilities, including Ranbaxy and Sun Pharma.

Decision Relevance

For quality and regulatory leaders managing contract manufacturing, three points apply broadly. First, contractor oversight cannot stop at the quality agreement; product owners and contract manufacturers alike must verify that every laboratory in the testing chain, including subcontracted release testing labs, is properly registered with FDA, because an unregistered lab performing release testing renders the finished product misbranded regardless of whether the manufacturing itself is compliant. Second, when an investigation attributes a systemic data integrity finding to a single terminated employee without evidence bounding the scope of the problem, that attribution is itself a root cause failure, not a resolution — FDA’s own evidence here showed repeated conduct over time, not an isolated act. Third, paper-based quality systems face exactly the same ALCOA+ scrutiny as electronic ones; unnumbered, unreconciled logbooks and pencil-to-ink overwrites are the paper equivalent of a deleted chromatography acquisition file, and FDA investigators are trained to find both the same way, by comparing what should exist against what actually does.

Companies operating contract manufacturing sites, particularly those managing data integrity remediation after adverse findings or preparing for a first FDA inspection following commercial scale-up, should assess whether their own investigation procedures would survive the same test FDA applied here: does the root cause analysis document the actual scope of the problem, or does it stop at the first available explanation? XGene’s quality system remediation practice works with pharmaceutical manufacturers and product owners to build data integrity remediation programs — comprehensive investigation design, ALCOA+ implementation, and quality risk management per International Council for Harmonisation (ICH) Q9(R1) — structured to withstand exactly this level of FDA scrutiny.