Russia's New Serialization Regulations: What Pharma Companies Need To Know

By Christoph Krähenbühl, senior director, Excellis Europe

On January 1, 2020, Russia will introduce a new, compulsory system for tracking pharmaceuticals from manufacturer to end user. This new legislation should be considered alongside wider global efforts to enhance quality control and put in place protection against fake and counterfeit medicines. Recent reports evidence the devastating impact of counterfeit medicines around the world, making the need for fully traceable pharmaceuticals more relevant than ever before.

While Russia’s approach to compulsory serialization follows that of many other regions, there are technicalities and complications specific to Russian regulations that must be addressed by companies in the pharmaceutical supply chain — if they are to remain compliant next year. Here, we explore the issues pertinent to organizations looking to commence or continue in the new Russian market, including background to track and trace, reporting to Russian authorities, the unique new cryptographic approach, and the challenging timeline faced by all parties involved.

Track-And-Trace Approach: An Emerging Global Standard

First and foremost, the deadline introduced by the legislation in Russian is approaching quickly. Any organizations in the supply chain that have not yet started to investigate the changes required are unlikely to be prepared in time for the January 1, 2020 deadline. There are many moving parts that need to come together to make this transition work, including the supply chain, IT structure, partner processes, and product coding. Companies can build on what has been accomplished in other regions (such as the U.S.), but there are some issues and challenges specific to Russia.

The new legislation includes a full track-and-trace approach with item-level coding and aggregation. Track and trace is already in place in other regions of the world. It’s designed to make it more difficult for counterfeit drugs to enter the pharmaceutical supply chain, and if they do, the system makes it simpler for authorities to identify at what point they infiltrated the system. These approaches in the EU, U.S., and other regions use 2D barcodes and randomized serial numbers on each individual pack. The authenticity of each pack is then verified by entering its unique identifier number into a repository system at the time of manufacture and checking the identifier against its entry in the system at one or more points in the supply chain.

While there are many similarities between track-and-trace requirements across different regions, there are also many differences. It is clear Russia's requirements present significant exceptions, most notably the requirement for cryptographic key to be included in the 2D DataMatrix. Also, in most markets, prescription drugs alone are in scope for serialization, whereas over-the-counter drugs are not. In Russia, all human medicines will need to be traceable starting in January 2020.

Put simply, just because a company is currently compliant with other international regions, it does not automatically follow that the company will be compliant with the new Russian legislation.

Reporting To Russian Authorities

The process towards this new legislation in Russia first started in February 2017, when the pilot program launched, and to date, it arguably has not received the sector attention that it deserves. Suppliers in this pilot program are targeting the different objectives stated in the legislation, and some of the companies who started the process in its early stages are already in a reasonable state of compliance with the legislation, including the complicated cryptographics. These companies clearly had a head start with the process change, but they have also proven that reaching compliance in a short time frame is achievable. Companies that have not started their engagement, however, now face a tougher challenge.

The second milestone in the process came in December 2017, when the Federal Law No. 425-FZ “On Amendments to the Federal Law 'On circulation of medicines'" was implemented. In November 2018, the management of the pilot moved to the public-private partnership CRPT, and in December 2018, more specific laws and decrees came into force.

In Russia, CRPT is the equivalent of the European Medicines Verification Organisation (EMVO) in Europe, and we expect to see some of the same challenges in Russia as were seen in Europe in terms of timeline and changes to legislation. Looking specifically at Europe, in the three years between the publication of the regulation and its coming into force, there were 13 versions of the questions and answers, and various aspects of the legislation shifted during that time. Although the process of implementation in Russia is likely to be more top-down, there will remain some shifting dynamics in regard to practical application of the requirements.

Another issue for companies facing the new legislation is the language barrier, as non-native companies are required to fully understand and respond to complicated legislation and laws written in Russian. This issue is not always given the full attention that it needs. There is a complex lexicon being used, and companies must ensure that the intricacies of the new law are not lost in translation.

However, there is some good news for companies who will have products on the market before January 1, 2020 — any products released to market prior to that date do not need to comply with the new requirement. Companies may choose to release products to market before January 2020 in order to delay their transition to the new legislation. Those who choose this route will need to carry out a cost-benefit analysis, as the expiration date of medicines will affect how long these products can remain in the supply chain.

Cryptographic Approach

The cryptographic approach to serialization is one of the most noteworthy aspects of the new Russian legislation — it is a globally unique requirement.

So, how is this different from the EU Falsified Medicines Directive (FMD)? Under the EU FMD, all new packs of prescription medicines put on the market since February 2019 must have two safety features: a unique identifier (UI) and an anti-tampering device. The barcode allows each pack to be serialized with a unique, randomized number, which is authenticated before dispensing. This identification data is stored in a database managed by the EMVO and supported at national level. Manufacturers check packs into the database, and they are authenticated, decommissioned, or “checked out” in the pharmacy by scanning the barcode. This sends a message to the database, which then considers the authenticity of that pack, sending confirmation back to the pharmacy.

The new Russian legislation takes this approach one large step further. Russia is adopting a cryptographic method, whereby every serial number generated by the manufacturer is paired with a second set of codes that encrypt the original serial number, which is generated centrally. This means that there is an additional need for serial number exchange with the authorities, alongside the internal serial number exchange with the site/serialization equipment or contract manufacturer.

There are several benefits to this new cryptographic system over the EU FMD model: It enables offline authentication by black box using a secret algorithm, and it provides unequivocal authentication without the need for a database or internet access. But it also presents two challenges: a bigger code and the additional data exchange.

Manufacturers will generate serial numbers, and these need to be uploaded to the cryptoserver. For every serial number, the cryptographic elements are issued a key signature. The cryptographic elements need to be downloaded again by the manufacturer and applied in the DataMatrix to every pack that is put on the market. Plus, the cryptographics are reported on numerous occasions along the distribution line.

The cryptographic codes are significantly larger than those in Europe, nearly doubling in symbol size. In terms of production line, this directly affects the size of the label, but there also may be implications on printing capability. Not all production lines will have the ability to print the code size and resolution required, and this can affect line speed as well as vision and aggregation systems. Case packing stations need to be assessed as soon as possible to ensure that they can be managed to operate within these new circumstances.

Unlike the EU FMD, there are no anti-tamper requirements in the Russian regulations. Despite this, we would recommend that companies employ anti-tamper mechanisms to protect their product and ultimately their patients.

The cryptocode brings several requirements that your current EU FMD and DCSCA capabilities will be pushed to provide. One is that data exchange must be examined very closely. Second, being able to manage aggregation is now a must-have, not a nice-to-have as it is for EU FMD

Timeline And Processes

Russia is demanding full traceability throughout the pharmaceutical supply chain by January 2020. Multiple events must be captured across the entire supply chain to be reported to the MDLP, the federal repository and tracking information system. CRPT are requiring many reporting transactions from manufacturer to dispenser and for some products, 50 or more transactions need to be monitored and reported in the chain. To understand what is happening at each stage in a supply chain, an in-depth analysis is needed, including clarification of where the obligations for reporting lie and which parts of the chain needs to be involved.

2024 Ambition And Beyond

This development is indicative of a larger objective — this new reporting in Russia will provide a lot more information and visibility to the government. This pharmaceutical initiative sits alongside other areas of the supply chain beyond medicine — tobacco and some luxury goods are already covered by similar requirements, and we expect to see this evolve over time into many other sectors. Russia is being watched very closely by the Eurasian market, and there is a possibility that this model will be adopted in other regions. Getting ready for Russia could help secure your supply chain, sales potential, and success for other markets in the future.

If you are currently, or plan to, export to Russia, item level serialization, cryptocode exchange, and additional reporting are challenges that must be addressed as soon as possible to meet the January 2020 deadline. Significant changes are required, unlike any that have come before. However, with the proper analysis and a holistic approach to assessing all elements in the supply chain, you can make sure that your organization can continue to operate, and indeed prosper, within this growing market.

About The Author:

Christoph Krähenbühl, senior director at Excellis Europe, has been involved in serialization projects since 2006, as global serialization project manager and product security manager at AstraZeneca and as a leading consultant for a breadth of pharma customers. He brings practical experience gained from working with clients in all areas of the industry, from leading global pharmaceutical companies to contract packers and specialized manufacturers. Krähenbühl has also been a part of the team readying the industry for the EU-FMD requirements since the beginning and is a member of the EMVO (European Medicines Verification Organisation) management team. He has been part of the group setting up the EMVO EU Hub onboarding process and is currently supporting the smaller-market National Medicines Verification Organisation (NMVO) project teams.