Heavy Metals and Microbial Limits: How Cosmetic and Supplement Brands Test for Contaminants

Most product testing asks whether a product does what it promises: does the cream moisturise, does the capsule dissolve, does the sunscreen reach its SPF. Contaminant testing asks a different question — what is in the product that nobody put there on purpose? Heavy metals carried in from minerals and botanicals, bacteria and moulds introduced by water, equipment or people, and residues from farming or processing can all end up in a finished cosmetic or supplement. For a brand owner, knowing which contaminants are tested, what the limits are and who is responsible for the result is part of knowing what is actually being sold.

Quick answer: Contaminant testing checks a finished product, and the raw materials behind it, for substances that should not be there — mainly heavy metals (mercury, lead, arsenic, cadmium) and microorganisms (total bacteria, yeasts and moulds, plus specific pathogens). In Malaysia, cosmetic limits are published by the National Pharmaceutical Regulatory Agency (NPRA): mercury no more than 1 ppm, lead 20 ppm, arsenic 5 ppm and cadmium 5 ppm, with stricter microbial limits for eye-area and children’s products. Health supplements follow separate NPRA registration requirements. A passing result applies only to the batch tested, so testing needs to be built into raw material approval and batch release, not done once before launch.

Key takeaways

• Contaminants are unintended substances. They are controlled mainly by choosing clean raw materials and a hygienic process, and confirmed by testing.
• The four heavy metals most often specified are mercury, lead, arsenic and cadmium. NPRA publishes numerical limits for all four in cosmetics.
• Microbial limits cover total viable count and the absence of specific organisms such as Pseudomonas aeruginosa, Staphylococcus aureus and Candida albicans.
• Products for children under three, the eye area and mucous membranes have a tighter microbial limit (≤500 cfu/g) than other cosmetics (≤1,000 cfu/g).
• Botanical, mineral and marine ingredients carry the highest heavy-metal risk; water-based formulas carry the highest microbial risk.
• A certificate of analysis is only as useful as its test method, its detection limit and whether it matches the batch actually delivered.

Who this is for: founders and brand owners launching skincare, colour cosmetics, herbal or mineral-rich products, and health supplements, who need to understand what their manufacturer tests for, which results to ask for, and where the responsibility sits if a product is later tested by a regulator.

What counts as a contaminant in cosmetics and supplements?

A contaminant is any substance present in a product that was not intentionally added as an ingredient and does not serve a function in the formula.

That separates contaminants from prohibited ingredients. Mercury deliberately added to a skin-lightening cream is a banned ingredient; a trace of mercury carried in from a clay or a seaweed extract is a contaminant. Regulators treat both seriously, but the controls are different: prohibited ingredients are controlled by formulation rules, contaminants by raw material specifications, process hygiene and testing.

For health and beauty products, contaminants fall into four practical groups:

• Heavy metals — naturally present in soil, rock and seawater, and therefore in minerals, pigments, clays, botanicals and marine ingredients.
• Microorganisms — bacteria, yeasts and moulds introduced by water, air, equipment, packaging or people.
• Agricultural and processing residues — pesticide residues and residual solvents in botanical extracts, and mycotoxins such as aflatoxins in some plant materials.
• Adulterants — undeclared active drug substances found in some illegal supplements and traditional products. These are deliberate additions rather than accidental contamination, but they are detected through the same kind of laboratory screening.

Which heavy metals are tested, and why?

Mercury, lead, arsenic and cadmium are the four heavy metals most consistently specified for cosmetics and supplements, because each is toxic at low levels and can accumulate in the body with repeated exposure.

The World Health Organization’s fact sheet on mercury and health specifically identifies skin-lightening creams and soaps as a source of mercury exposure, which is why mercury is the contaminant most often associated with cosmetic enforcement actions in Southeast Asia. Lead is commonly associated with mineral pigments and some traditional cosmetics; arsenic and cadmium with minerals, clays, rice-based and marine ingredients, and some herbs.

In Malaysia, NPRA publishes the limits it applies when testing cosmetic samples collected through post-market surveillance. According to Annex I, Part 14 of NPRA’s Guidelines for Control of Cosmetic Products in Malaysia (August 2022 edition), the limits are:

Heavy metal	NPRA cosmetic limit	Typical sources in a formula
Mercury	Not more than 1 ppm	Marine extracts, some minerals; illegal intentional addition in lightening products
Lead	Not more than 20 ppm	Mineral pigments, clays, talc, some botanicals
Arsenic	Not more than 5 ppm	Clays, rice-derived materials, seaweed, some herbs
Cadmium	Not more than 5 ppm	Some inorganic pigments, zinc-based minerals, marine ingredients

These figures follow the ASEAN harmonised approach to cosmetic contaminants. Other markets set their own numbers. In the United States, for example, the Food and Drug Administration has published its own survey testing of cosmetics for arsenic, cadmium, chromium, cobalt, lead, mercury and nickel, and has issued guidance recommending a lower maximum lead level for lip products and externally applied cosmetics. An export brand should check the destination market’s limits rather than assume the Malaysian figures apply everywhere.

For health supplements, heavy-metal requirements sit within NPRA’s product registration framework rather than the cosmetic notification guidelines. The applicable specifications are set out in NPRA’s guidelines for health supplements and the related registration documentation, and registration dossiers are expected to include finished-product test results for heavy metals and microbial quality. Because supplements are swallowed and often taken daily for long periods, brand owners should expect their specifications to be at least as strict as those for leave-on cosmetics.

What do microbial limits cover?

Microbial limits set a maximum for the total number of living microorganisms in a product and require that certain harmful organisms are absent altogether.

Microbial testing counts the colonies that grow from a measured sample. Photo: Pexels

NPRA’s same Annex I, Part 14 sets the following limits for cosmetics:

Test	Children under 3, eye area, mucous membranes	Other cosmetic products
Total viable aerobic count (bacteria, yeasts and moulds)	≤ 500 cfu/g or ml	≤ 1,000 cfu/g or ml
Pseudomonas aeruginosa	Absent in 0.1 g or ml	Absent in 0.1 g or ml
Staphylococcus aureus	Absent in 0.1 g or ml	Absent in 0.1 g or ml
Candida albicans	Absent in 0.1 g or ml	Absent in 0.1 g or ml
Burkholderia cepacia (aqueous products only)	Absent in 0.1 g or ml	Absent in 0.1 g or ml

The tighter limit for babies, eyes and mucous membranes reflects higher vulnerability: an eye infection from a contaminated mascara or a skin infection in an infant is a more serious outcome than the same count in a body wash. Water-based products — lotions, gels, toners, liquid soaps — carry the greatest microbial risk, because water is what microorganisms need to grow. Anhydrous products such as oils, balms and pressed powders are lower risk but not zero risk, especially if they contain botanical powders.

Microbial limits and preservative performance are related but not the same. The limit test shows how clean a batch is on the day it is tested; a challenge test of the preservative system shows whether the formula can stay clean once the consumer opens it. A product needs both. Process water is also a frequent root cause, which is why how a factory controls its purified water is a direct input to microbial results.

Where do contaminants come from?

Most contaminants enter a product through its raw materials or its manufacturing environment, so control starts well before the finished product reaches the laboratory.

• Raw materials. Plant materials absorb metals from soil and water; minerals and clays carry whatever was in the deposit; marine ingredients concentrate metals from seawater. Supplier specifications and certificates of analysis are the first line of control, which is why raw material sourcing and supplier documentation matters as much as the formula itself.
• Water. Poorly maintained water systems can introduce bacteria, including Pseudomonas and Burkholderia species that tolerate low-nutrient conditions.
• Equipment and cleaning. Residues in tanks, pipes and filling heads can seed microbial growth or carry material from one product into the next.
• People and air. Operators and unfiltered air are routine sources of skin bacteria and mould spores, which is why gowning and room classification are part of Good Manufacturing Practice (GMP).
• Packaging. Components stored in dusty or humid conditions can introduce contamination at filling.

How is contaminant testing done?

Heavy metals are measured by instrumental chemical analysis, and microorganisms by culturing a measured sample and counting what grows.

Each sample is traceable to a batch number before it is tested. Photo: Pexels

Heavy metals

The sample is first digested, usually with acid and heat, to release the metals into solution. It is then analysed by techniques such as inductively coupled plasma mass spectrometry (ICP-MS), inductively coupled plasma optical emission spectrometry (ICP-OES) or atomic absorption spectroscopy (AAS). ICP-MS is the most sensitive and can detect several metals in one run; AAS is older and slower but still widely used. Mercury is often measured with a dedicated cold-vapour method because of its volatility.

Microorganisms

A weighed sample is diluted, neutralised so that the preservative does not suppress growth artificially, and spread on growth media. After incubation, colonies are counted to give colony-forming units (cfu) per gram. Separate selective tests look for the specific pathogens. Method suitability matters: if the laboratory does not neutralise the preservative properly, the result can look clean when it is not.

What a result means

Two details on a test report decide how useful it is. The first is the limit of detection: a report that says “not detected” means little if the method cannot detect below the regulatory limit. The second is the sample identity: the batch number on the report must match the batch being released. These are the same checks covered in how to read a certificate of analysis.

Contaminant tests compared

Test	What it detects	Highest-risk products	When it is usually done
Heavy metals	Mercury, lead, arsenic, cadmium (sometimes others)	Mineral makeup, clay masks, herbal and marine supplements	Raw material approval; finished product per batch or on a risk-based schedule
Microbial limits	Total count, yeasts and moulds, specified pathogens	Water-based cosmetics, baby and eye products, botanical powders	Every finished batch before release
Pesticide residues	Agricultural chemical residues	Herbal supplements, botanical extracts	Raw material approval, supplier certificate
Mycotoxins (e.g. aflatoxins)	Toxins produced by moulds on crops	Nut, grain and some herbal materials	Raw material approval
Adulterant screening	Undeclared drug substances	Slimming, energy and traditional-style products	Registration testing; regulator surveillance

Who is responsible for contaminant results?

The brand owner who places the product on the market carries regulatory responsibility for it, even when the manufacturer runs the tests.

In Malaysia, the company that holds the cosmetic notification or product registration is the party NPRA deals with when a surveillance sample fails. A manufacturer’s test report supports that company’s evidence, but it does not transfer the obligation. This is one reason the test results should sit in the brand’s own Product Information File, linked to batch numbers that trace back to raw material lots. If a batch fails in the market, traceability is what decides whether the problem can be contained to one lot or turns into a wider recall.

In practice, the division of work is usually agreed in the manufacturing contract: which tests the factory runs in-house, which go to an external accredited laboratory, how often, and who pays. A manufacturer’s product testing scope — which tests are routine for every batch and which are periodic or on request — is one of the more useful things for a brand owner to understand before production starts.

What should a brand owner ask before production?

Five questions cover most of the ground:

• What is the specification? Ask for the written finished-product specification, including heavy-metal and microbial limits, and check it against the target market’s rules.
• Which tests are done per batch, and which periodically? Microbial testing is normally per batch; heavy metals may be tested per batch for high-risk products and on a schedule for low-risk ones. The rationale should be documented.
• Who does the testing? In-house laboratory, external laboratory, or both — and whether the external laboratory holds ISO/IEC 17025 accreditation for the methods used.
• What happens if a batch fails? The contract should state how out-of-specification results are investigated, whether the batch is reworked or destroyed, and how the brand is informed.
• Which raw materials carry the risk? For botanical, mineral and marine ingredients, ask whether supplier certificates are accepted as they are or verified by independent testing.

Frequently asked questions

If my product is “natural”, is it less likely to fail contaminant testing?

Often the opposite. Plant, mineral and marine ingredients are the main carriers of heavy metals, pesticide residues and microbial load. Natural formulas can pass comfortably, but they usually need tighter raw material control than synthetic ones.

Does a supplier’s certificate of analysis mean I do not need to test?

Not necessarily. A supplier certificate covers the raw material lot, not the finished product. Many manufacturers accept certificates from approved suppliers but verify them periodically, and still test the finished batch for microbial quality.

My test says “not detected”. Does that mean zero?

No. It means the substance was below the method’s limit of detection. Check that the detection limit is well below the regulatory limit, otherwise the result does not prove compliance.

Are the Malaysian limits the same in other countries?

Not always. ASEAN markets largely follow a harmonised approach, but the United States, the European Union, China and others set their own limits or expectations. Export products should be specified to the strictest market they will be sold in.

How long does contaminant testing add to production?

Heavy-metal results can be available within a few working days. Microbial testing needs incubation time, typically around five to seven days including pathogen checks, so finished goods are held in quarantine until results are released.

Do products need retesting after a formula or supplier change?

Yes. A new supplier or a new grade of an ingredient can change the contaminant profile, which is why contaminant results should be reviewed as part of the change control process.

Limitations

This article explains general principles as of September 2026 and is not legal or regulatory advice. The cosmetic limits quoted are from NPRA’s August 2022 edition of Annex I, Part 14; brand owners should confirm the current version directly with NPRA before finalising specifications. Health supplement limits depend on product category and registration route and are not reproduced here. Typical turnaround times are indicative and vary by laboratory and method.

Sources

• National Pharmaceutical Regulatory Agency (NPRA), Guidelines for Control of Cosmetic Products in Malaysia, Annex I, Part 14 — Heavy Metal and Microbiological Test Limit for Cosmetic Product (August 2022).
• NPRA, Guidelines for Health Supplements.
• U.S. Food and Drug Administration, FDA’s Testing of Cosmetics for Arsenic, Cadmium, Chromium, Cobalt, Lead, Mercury, and Nickel Content.
• World Health Organization, Mercury and health (fact sheet).

---

Creaton Poh is the pen name of Poh Tze Kheng, founder of ORIZI Group — one of Malaysia's most comprehensive one-stop OEM, ODM, private label and contract manufacturing groups, spanning skincare, cosmetics, personal care, perfume and fragrance, supplements, functional food and nutrition, pet care, home care and medical devices. Across six specialised companies and three manufacturing divisions, the Group brings together 20+ years of industry experience, 5,000+ formulations, and internationally recognised quality, manufacturing and regulatory standards. These articles are written to educate, not to promote.

Written by Creaton Poh
Industry Researcher • Author • Vlogger • Manufacturing Strategist
Turning ideas into products. Turning experience into knowledge.

Connect with Poh Tze Kheng on LinkedIn.