Medicine serialisation and track-and-trace explained

Substandard and falsified medicines are a persistent global health risk. The World Health Organization estimates that roughly one in ten medical products in low- and middle-income countries is substandard or falsified, and the problem is not absent from higher-income markets. Falsified medicines may contain too little, too much, or none of the stated active ingredient, or may be packaged to imitate a registered product while containing something else entirely. The danger is twofold: patients do not receive the treatment they expect, and infectious pathogens may be exposed to subtherapeutic drug levels that accelerate resistance.

One of the most effective structural responses has been serialisation — giving every medicine pack a unique, traceable identity — combined with verification systems that allow pharmacists, regulators, and in some cases patients to check that a pack is legitimate before it is dispensed. Two of the largest such systems are the European Union's Falsified Medicines Directive (FMD) framework and the United States Drug Supply Chain Security Act (DSCSA). Both rely on the same basic principle: if every pack carries a serial number that can be checked against a secure registry, a duplicate or fabricated pack becomes far easier to detect.

How serialisation works

Serialisation means assigning a unique identifier to each individual saleable pack of a medicine — not just to the product or batch, but to the pack itself. The identifier typically encodes several data elements: a product code (such as a GTIN), a serial number, a batch or lot number, and an expiry date. These are printed on the pack as a two-dimensional (2D) barcode — usually a GS1 Data Matrix — which can be read quickly by scanners at any point in the supply chain.

The 2D Data Matrix is preferred over older linear barcodes because it is compact, holds substantially more data, and can still be read even if part of the code is damaged. When a pack is scanned, the serial number is checked against a database. If the same serial number appears on two different packs, or if a serial number was never registered by the manufacturer, the system flags a potential falsification. Some systems also support end-to-end track-and-trace, recording each transaction as the pack moves from manufacturer to wholesaler to pharmacy, so that the full ownership history of a medicine can be reconstructed if a problem is identified.

The EU Falsified Medicines Directive

The EU's Falsified Medicines Directive, adopted in 2011, introduced mandatory safety features on prescription medicine packs placed on the European market. Since February 2019, most prescription medicines in the EU must carry two features: a unique identifier (the 2D barcode containing serialisation data) and an anti-tampering device that shows whether a pack has been opened or interfered with before reaching the pharmacy.

Verification is coordinated through a network of national medicines verification systems connected by a central European hub — the European Medicines Verification System (EMVS). When a pharmacist scans a pack at the point of dispensing, the system checks the serial number against the registry and returns a green or red result. Each pack's serial number is also decommissioned once dispensed, so that the same identifier cannot be reused on a falsified pack later. The system is designed to catch duplicates, fabricated serial numbers, and packs diverted from their intended market without disrupting legitimate dispensing.

The US Drug Supply Chain Security Act

The Drug Supply Chain Security Act (DSCSA), enacted in 2013, takes a somewhat different route to the same destination. Rather than mandating point-of-dispensing verification for every pack in the way the EU system does, DSCSA requires an interoperable, electronic track-and-trace system across the entire US pharmaceutical supply chain. Manufacturers, repackagers, wholesale distributors, and dispensers must exchange transaction information, history, and statements at each handover, so that any authorised party can trace a product back to its origin.

Implementation has been phased over ten years, with requirements for lot-level tracing, then package-level serialisation, and finally interoperable electronic systems. The FDA has periodically extended compliance stabilisation periods to allow trading partners to resolve technical and operational challenges, particularly around data exchange formats and aggregation (the ability to associate individual pack serial numbers within a case or pallet). Like the EU system, DSCSA uses 2D barcodes — typically GS1 Data Matrix — as the physical carrier of the serialisation data on each pack.

What this means for patients and verification tools

For most patients, serialisation operates invisibly: the pharmacist scans the pack, the system confirms legitimacy, and the medicine is dispensed. However, the infrastructure also creates opportunities for direct patient-facing verification. In some markets, national systems allow patients to scan a pack's 2D barcode with a smartphone app and see whether the product is registered and the serial number is valid. These tools vary in availability and capability, and not all countries offer public-facing verification yet.

In South Africa, the South African Health Products Regulatory Authority (SAHPRA) is responsible for medicine registration and post-market surveillance, and packs of registered medicines carry specific marking requirements. While South Africa's own track-and-trace framework is less mature than the EU or US systems, patients and healthcare professionals can use HealthSA to confirm whether a medicine is registered and check its Single Exit Price — a useful first step in distinguishing legitimate products from unregistered or suspicious ones. Verifying registration details, checking that packaging matches what the regulator has approved, and reporting suspected falsified medicines to the relevant authority all form part of a layered defence that serialisation makes substantially stronger.