Factory audit: verify that a Chinese supplier is a real manufacturer

On B2B sourcing platforms, everyone calls themselves a "manufacturer." Behind the storefront there may be a real factory, a transparent trader, an intermediary that subcontracts without saying so, or even a deregistered company. Before paying a deposit, you need to know who the supplier legally is, what it can actually produce, and under what conditions.

This guide follows the order of a professional qualification, from remote checks to the on-site audit. To find candidates first, see our method for finding a supplier in China.

Why verify before the first order

The most costly import problems often start when the supplier is chosen:

• The hidden intermediary: an unknown workshop produces your order, with an extra margin and less control.
• Overstated capacity: the factory accepts a volume it cannot deliver on time.
• Social risk: in the United States, the European Union, the UK and Canada, the law expects importers to keep forced labor out of their supply chains (see step 4).
• Payment fraud: a real license borrowed, paired with a bank account that does not belong to the company.

Step 1: read the business license

In mainland China, every registered company holds a business license (营业执照). Asking for it from the first exchanges is standard practice: a serious supplier sends it without hesitation.

The Chinese legal name, often different from the English trade name, is the one that must appear on the contract. The legal representative binds the company by law; any other signatory must hold written authority, usually stamped with the company seal (公章).

The business scope is the most telling field: a Chinese company may only operate within its registered scope. Look for production terms such as 生产 (production), 制造 (manufacturing) or 加工 (processing), not just 销售 (sales), 进出口 (import-export) or 咨询 (consulting).

Decoding the 18-character code

The Unified Social Credit Code (USCC) identifies the company to every government authority. Its structure is set by the national standard GB 32100-2015 (GB for guobiao, "national standard" in Chinese): digits and uppercase letters, never I, O, S, V or Z.

Check the official registry

The public registry is the National Enterprise Credit Information Publicity System (NECIPS), at gsxt.gov.cn (new tab), run by the State Administration for Market Regulation (SAMR). It is in Chinese only, with a captcha in Chinese characters. Search by code rather than by name, which may have variants. The record shows:

• the status: 存续 or 在营 (active), 吊销 (license revoked), 注销 (deregistered);
• shareholders and their contributions, change history, branches;
• any listing on the list of operational anomalies (经营异常名录) or the list of seriously illegal and dishonest enterprises (严重违法失信名单, called 严重违法失信企业名单 before September 2021);
• administrative penalties and pledges.

China's revised Company Law, in force since July 1, 2024, requires shareholders of a limited liability company (LLC) to pay in their subscribed capital within five years of incorporation. Older LLCs have until June 30, 2027 to bring their schedule down to five years or less, meaning full payment by June 30, 2032 at the latest.

A large capital that is only subscribed (认缴) therefore proves little: compare it with the capital actually paid in (实缴), which companies must now publish in the registry. Finally, the China IP SME Helpdesk, a European Commission service for SMEs, notes that the registry is not always complete or up to date: it is a first filter, not an investigation.

Cross-check with the supplier's documents

You still need to confirm that your contact is indeed the company listed in the registry:

• The red seal (公章) stamped on contracts bears the full legal Chinese name, and often the USCC code;
• the seller's tax number on its official invoices (fapiao, 发票) is in principle that same code;
• if the license carries a QR code, it must lead to the official registry, not to a third-party site;
• payment goes to a corporate account (对公账户) in the seller's exact legal name, never to a personal account or that of a third-party company.

Step 2: Factory or trading company?

There is nothing illegitimate about a trading company: it brings together several factories, accepts small quantities, handles exports. The real risk is not knowing: an extra margin, an invisible workshop, your drawings circulating out of your control.

No single indicator is enough on its own. The China IP SME Helpdesk describes the case of an SME whose "manufacturer" was registered as a consulting company, with low capital and a contact who was not the legal representative: three discrepancies found in a single search, before any transfer of know-how.

Step 3: Export history and references

A manufacturer that exports to your markets should be able to prove it. Ask for:

• its main export countries and the share of exports in its revenue;
• two or three reference customers you can reach, ideally in your market;
• recent export documents (bills of lading, declarations), with prices masked;
• test reports already carried out for Europe, the UK or North America.

In the United States, cargo data from import sea manifests may be published, under section 103.31 of title 19 of the Code of Federal Regulations (CFR). The importer can only have its own name and address, and those of its shippers, masked. Commercial databases use this data: a manufacturer that claims to export to the United States often leaves a trace there, but its absence proves nothing.

A supplier used to CE or UKCA (UK Conformity Assessed) marking also knows which tests to plan: see our guide to product compliance in Europe and the UK.

Step 4: What certifications really prove

A certification attests that a system was audited by a third party, on a given date, for a given site. It does not guarantee the quality of your order.

• amfori BSCI (Business Social Compliance Initiative) is not a certification, amfori points out. The audit has 81 questions across 13 areas, for an overall rating from A (very good) to E (unacceptable). The next full audit takes place two years after an A or a B, one year after a C or lower, with a possible follow-up audit in between.
• SMETA (Sedex Members Ethical Trade Audit) is not one either. Its 2-pillar version covers labor and health & safety; the 4-pillar version adds environment and business ethics. SMETA 7 dates from 2024.
• ISO 9001: the address and scope of the certificate must cover the factory and the product. Check it in IAF CertSearch, the global database of accredited certificates, or in writing with the certification body. The database keeps the name of the IAF (International Accreditation Forum), which ceased operations on January 1, 2026, handing over to the Global Accreditation Cooperation.

Forced labor: what the law expects from importers

In the United States, the Uyghur Forced Labor Prevention Act (UFLPA) presumes prohibited any goods produced in whole or in part in Xinjiang or by an entity on the UFLPA list. This presumption is rebuttable: the importer can overturn it, but only with "clear and convincing" evidence.

In Canada, the Customs Tariff prohibits goods produced in whole or in part by forced labor; the Fighting Against Forced Labour and Child Labour in Supply Chains Act (2023) added child labor. It also requires an annual report, by May 31 at the latest, from entities listed in Canada or that meet two of these three thresholds, in Canadian dollars: CAD 20M in assets, CAD 40M in revenue, 250 employees.

The UK and Canadian statements only cover companies above their thresholds, but these large customers will ask their smaller suppliers for evidence. A social audit alone does not prove the absence of forced labor upstream (raw materials, components): it is a first piece of your due diligence file.

Step 5: Remote or on-site audit?

The most effective approach: screen remotely, then audit the finalists on site, especially for a technical product, a large first order or a single supplier. An audit can be announced, semi-announced or unannounced; an amfori BSCI audit is often semi-announced, with the factory knowing a time window but not the exact date. An organized factory visit complements the audit without replacing it.

Step 6: The on-site audit checklist

The auditor cross-checks what they see, what they are told and what the records show:

• Identity and capacity: original license matching the registry and the address visited, staff on site, machines actually running, the bottleneck operation for your product, measured cycle time, capacity load plan.
• Quality: incoming (IQC, Incoming Quality Control), in-process (IPQC, In-Process Quality Control) and final (FQC or OQC, Final/Outgoing Quality Control) controls; calibrated instruments, reference sample, batch traceability, complaint handling.
• Subcontracting: processes outsourced (surface treatment, printing, packaging). A half-empty workshop for an advertised "huge" capacity is a red flag.
• Social, health and safety: workers' age, contracts, timekeeping and pay slips, overtime, wages against the local minimum, emergency exits, fire extinguishers, chemicals, dormitories.
• Warehouse and shipping: stock kept dry, off the floor and labeled, packaging compliant with the specification, clean loading area.

Step 7: Scoring the factory

A useful audit ends with a score and a decision, not with impressions. Indicative grid, to be adapted to your product:

Each criterion is scored (for example from 0 to 2), each area converted into a percentage and then weighted. Some findings are disqualifying regardless of the score: child or forced labor, falsified documents, access denied to part of the factory, serious danger such as locked emergency exits.

Step 8: What to do with the result

1. Approved: formalize the specification and contract, then an inspection plan during and after production.
2. Conditional: require a corrective and preventive action plan (CAPA, Corrective and Preventive Action) with deadlines, verify it, start with a small order and step up inspections.
3. Rejected: record the reasons and move on to the next candidate.

Related guide

In-factory inspections: PPI, DUPRO, PSI and loading check

Pre-production, during production, final, loading: what each inspection checks, when to book it, how to read the AQL report and accept or reject a batch.

12 min read

Then translate the audit into clauses: no subcontracting without written agreement, right to audit, protection of your drawings and molds (see our guide to NNN agreements: non-disclosure, non-use, non-circumvention). Recheck the registry before every large order and re-audit on every change (site, owner, quality drift). The full process of an independent audit is detailed on our factory audit page.