Direct answer: A botanical supplement — whether a standardised extract, a spray-dried powder, or a finished sachet or beverage — should meet four heavy-metal ceilings and a five-point microbial panel before it clears release. The commercial-standard heavy-metal limits are lead (Pb) ≤2.0 ppm, cadmium (Cd) ≤1.0 ppm, mercury (Hg) ≤0.1 ppm, and arsenic (As) ≤1.5 ppm, tested by ICP-MS (inductively coupled plasma mass spectrometry) for parts-per-billion sensitivity. The microbial panel requires total plate count (TPC) ≤10,000 CFU/g, yeast and mould ≤1,000 CFU/g, and absence of E. coli, Salmonella spp., and Staphylococcus aureus in 25g. These are the same limits Bionutricia applies across its Certificate of Analysis (CoA) stack for every botanical extract and finished OEM format — powder, liquid and gel sachets, pouch beverages, chewable tablets, and liquid bottles — under FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA, and MeSTI certification. If a supplier’s CoA is missing any of these nine values, ask for it before you sign off on a batch; a botanical ingredient without full heavy-metal and microbial data is not release-ready, regardless of how clean its active-marker assay looks.

Why botanical supplements carry heavy-metal and microbial risk that synthetic actives don’t

A synthetic vitamin or mineral premix is manufactured in a controlled chemical process with a known, consistent input. A botanical extract starts as a crop — a root, leaf, calyx, or rhizome grown in soil, exposed to water, air, and whatever else is in that environment. Two risk categories follow directly from that fact.

Heavy metals are agronomic, not manufacturing, contaminants. Lead, cadmium, mercury, and arsenic occur naturally in soil and can bioaccumulate in plant tissue, especially in root and rhizome botanicals grown in industrial or high-traffic areas. No amount of good manufacturing practice removes a heavy metal that the plant already absorbed before harvest — which is why heavy-metal testing has to happen on the raw material and again on the finished extract, not just at the factory gate.

The heavy-metal panel: four elements, ICP-MS, and why the limits sit where they do

Botanical-extract heavy-metal limits are built around the “big four” toxic elements that regulatory and pharmacopoeial bodies (USP, Ph. Eur., and Malaysia’s own Food Act 1983 framework) converge on:

These four are tested by ICP-MS, which detects elemental concentration down to parts-per-billion — the sensitivity needed to confirm a botanical extract sits safely under a parts-per-million ceiling. A CoA that reports heavy metals only as a single “total heavy metals” figure, without breaking out each of the four elements, is giving you less information than you need: mercury and arsenic can each be a problem independently, and a bundled figure can mask one element sitting close to its individual limit.

The microbial panel: total count, yeast/mould, and the three named pathogens

Microbial testing on a botanical extract or finished supplement covers two tiers.

Tier 1 — bioburden ceilings

• Total plate count (TPC): ≤10,000 CFU/g — the aggregate count of viable aerobic bacteria, a general indicator of how clean the harvesting, drying, and processing chain was.
• Yeast and mould: ≤1,000 CFU/g — particularly relevant for botanicals dried in humid conditions, where fungal growth is the dominant spoilage risk.

Tier 2 — named pathogen absence

• E. coli: absent/25g — an indicator of faecal contamination, typically from irrigation water or handling.
• Salmonella spp.: absent/25g — tested regardless of the low prior probability, because a single positive result is a recall-triggering event.
• S. aureus: absent/25g — an indicator of poor personnel hygiene during handling or packing.

Unlike the heavy-metal ceilings, the pathogen tier isn’t a “low but acceptable” number — it is a strict absent/present test. A single positive on Salmonella or E. coli fails the batch outright, no exceptions for otherwise-clean CoA data elsewhere.

Do the limits change by format?

The underlying ceilings stay the same across Bionutricia’s OEM formats — powder sachets, liquid sachets, gel sachets, pouch beverages, chewable tablets, and liquid bottles — because they’re expressed per gram of active material, not per finished-unit serving size. What changes by format is where in the process testing happens:

• Powder-based formats (powder sachets, chewable tablets): tested on the dried extract or premix before filling, and again on a finished-batch retain sample.
• Liquid-based formats (liquid sachets, liquid bottles, pouch beverages): tested on the concentrate before dilution/filling, with microbial testing repeated post-fill because liquid matrices carry higher spoilage risk over shelf life than a dry powder.
• Gel sachets: tested at the gel-base stage, since the higher water activity of a gel format (versus a dry powder) raises the bar for microbial control during shelf life.

What to put in your supplier contract or CoA request

For any botanical extract or finished-format procurement, the CoA requirement should specify, in writing:

• Heavy metals broken out individually: Pb, Cd, Hg, As — each with its own ppm figure, tested by ICP-MS
• Total plate count (CFU/g) and yeast/mould count (CFU/g) as numeric values, not a pass/fail statement
• E. coli, Salmonella spp., and S. aureus reported as absent/25g, with the test method referenced
• Solvent residuals where the extraction used ethanol (typically ≤5,000 ppm residual ethanol)
• Testing frequency: per-batch, not per-supplier-relationship — ask whether the CoA you’re shown is batch-specific or a generic “typical values” sheet

A supplier who can only provide a generic specification sheet rather than a batch-specific CoA is not giving you release data — they’re giving you a marketing document. Insist on the actual test result for the lot you are buying.

How certification underpins the testing chain

Heavy-metal and microbial limits are only as reliable as the quality system that enforces them. Bionutricia’s contract extraction and OEM manufacturing run under six quality certifications — FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA registration, and MeSTI — plus NanoVerify validation, at the Sungai Buloh facility. HACCP in particular is the framework that identifies heavy-metal and microbial contamination as critical control points in the process, while FSSC 22000 (SGS-audited) governs the food-safety management system that keeps batch-level CoA testing consistent across every run, not just the ones a buyer happens to ask about.

Related guides

• How to Read a Supplement Certificate of Analysis (CoA): A Buyer’s Guide
• Supplement Stability Testing Explained: ICH Zones, Shelf Life & What Buyers Ask
• MeSTI vs GMP for Food & Supplement Makers: What Each Certification Means

Frequently asked questions

What are the standard heavy-metal limits for a botanical supplement?

Lead (Pb) ≤2.0 ppm, cadmium (Cd) ≤1.0 ppm, mercury (Hg) ≤0.1 ppm, and arsenic (As) ≤1.5 ppm, tested individually by ICP-MS. A CoA that only reports a bundled “total heavy metals” figure is giving you less assurance than one that breaks out each element.

What microbial limits should a botanical extract meet?

Total plate count ≤10,000 CFU/g, yeast and mould ≤1,000 CFU/g, and absence of E. coli, Salmonella spp., and S. aureus in 25g. The bioburden ceilings are numeric thresholds; the three named pathogens are strict absent/present tests with no acceptable positive result.

Do heavy-metal limits differ between raw botanical material and the finished extract?

The ceiling itself doesn’t change, but testing typically happens at both stages — on incoming raw material and again on the standardised extract — because processing can concentrate or dilute trace elements depending on the extraction ratio.

Why is mercury’s limit so much lower than the others?

Mercury bioaccumulates in biological tissue more readily than lead, cadmium, or arsenic at equivalent exposure levels, so toxicological risk assessments set its acceptable ceiling an order of magnitude lower — 0.1 ppm versus 1.0–2.0 ppm for the others.

Does Bionutricia test every batch, or only representative samples?

Every batch is tested under Bionutricia’s HACCP and FSSC 22000 framework at the Sungai Buloh facility, with CoA data specific to that batch — not a generic specification sheet applied across multiple production runs.

Ready to specify heavy-metal and microbial testing on your next batch?

Bionutricia’s contract extraction and OEM manufacturing run full heavy-metal (ICP-MS) and microbial panels on every batch, under FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA, and MeSTI certification, across powder, liquid and gel sachets, pouch beverages, chewable tablets, and liquid bottles.

Request a quotation · See our OEM services · View our certifications · WhatsApp +60 16-661 8510

Article by Bionutricia R&D Team — in-house registered pharmacist, nutritionist, dietitian, and PhD biomedical scientist. Last updated: July 20, 2026.