503A Pharmacy List: Which Peptides Are Still Legal to Compound in 2026

What Is a 503A Pharmacy and Why Does the List Matter?

A 503A pharmacy is a state-licensed compounding pharmacy that prepares medications for individual patients under a valid prescription from a licensed prescriber. The legal authority comes from Section 503A of the Federal Food, Drug, and Cosmetic Act (FDCA), which was added by the Drug Quality and Security Act of 2013. [1] Unlike a 503B outsourcing facility, a 503A pharmacy cannot produce large batches for general distribution. Every vial it compounds must trace back to a specific patient and a specific prescription.

The practical significance: only substances on the FDA's approved 503A bulk-drug substance list (or in an FDA-approved finished drug product) may be used as active ingredients. If a peptide is not on that list, a 503A pharmacy cannot legally compound it, regardless of how widely it circulates online or in biohacking communities. [2]

The FDA maintains two designation categories. "Category 1" substances are nominated and under review, meaning they may be used pending a final decision. "Category 2" substances have been reviewed and rejected, barring them from 503A compounding. [3] BPC-157 and thymosin beta-4 (TB-500) are Category 2. This is not a technicality. It is a hard prohibition.

The 503A framework also prohibits compounding any substance that is a component of an FDA-approved drug when the compounded version would be a copy with no demonstrable clinical difference for the individual patient. [4] That clause has become relevant as more peptide-based biologics receive approval.

BPC-157 FDA Status in 2026

BPC-157 is prohibited from 503A compounding. The FDA placed it in Category 2 during its bulk substance evaluation cycle, citing insufficient data to support safety or a clinical need that cannot be met by an approved drug. [3]

BPC-157 (body-protective compound 157) is a synthetic pentadecapeptide derived from a gastric protein sequence. Animal studies, including rodent models published in peer-reviewed journals, have reported accelerated tendon-to-bone healing and anti-inflammatory effects. [5] A 2021 review in the journal Current Pharmaceutical Design summarized the preclinical evidence but noted that no randomized controlled trials in humans had been completed at the time of publication. [6] The absence of human trial data is precisely what the FDA cited as a basis for its Category 2 designation.

Patients who were using BPC-157 sourced from a 503A pharmacy before the prohibition took effect needed to transition to alternatives or enroll in clinical research protocols. There is no grandfather clause. Pharmacies that continue to compound BPC-157 after its Category 2 designation are operating outside federal law and risk FDA Warning Letters, injunctions, and potential criminal referral. [7]

Buying BPC-157 from offshore vendors or websites labeling it "for research use only" does not create a legal workaround. See the section on the "research use only" myth below.

TB-500 (Thymosin Beta-4) FDA Status

TB-500 is also Category 2. The FDA evaluated thymosin beta-4 as a bulk substance for 503A compounding and rejected it. [3] The agency noted that thymosin beta-4 is a component of Thymanax, a product that had received investigational new drug status, which creates a statutory barrier to 503A compounding under FDCA Section 503A(b)(1)(D). [8]

Thymosin beta-4 is a 43-amino-acid actin-sequestering protein present in most human cells. Preclinical data from animal models showed promotion of angiogenesis and tissue repair. [9] A small Phase I safety trial in healthy volunteers (N=10) reported no serious adverse events at single doses up to 1 to 200 mcg/kg, but the study was not powered to assess efficacy. [10] The total human data remain sparse, and no Phase III trial has been registered or completed as of the date of this article.

The "TB-500" sold online is frequently described as a synthetic fragment. That description does not change its regulatory status. Any substance matching the thymosin beta-4 sequence, regardless of what a vendor calls it, falls under the same FDA determination.

Which Peptides Can Still Be Compounded Under 503A?

Several peptides remain available through compliant 503A pharmacies with a valid prescription. The list is not static. FDA reviews can move a substance from Category 1 to either approved or rejected status at any time. [2]

Sermorelin. Sermorelin acetate is a 29-amino-acid growth-hormone-releasing hormone (GHRH) analog. A commercially manufactured formulation (Geref) was once FDA-approved and later voluntarily withdrawn by the manufacturer for business reasons. Because the withdrawal was not for safety or efficacy concerns, sermorelin has been permitted for 503A compounding. [11] Subcutaneous dosing typically ranges from 100 to 500 mcg administered nightly. A 2019 study in Growth Hormone and IGF Research (N=46) reported a statistically significant increase in serum IGF-1 after 12 weeks of sermorelin treatment in adults with growth hormone deficiency (P<0.001 for change from baseline). [12]

Ipamorelin. This selective growth-hormone secretagogue is on the Category 1 nominated list and may currently be used by 503A pharmacies pending final review. [3] It is commonly combined with a GHRH analog such as sermorelin or CJC-1295 (without DAC) in clinical protocols targeting growth hormone optimization.

PT-141 (bremelanotide). PT-141 is the compounded precursor to Vyleesi, an FDA-approved drug for hypoactive sexual desire disorder in premenopausal women. Because Vyleesi is an approved product, 503A pharmacies face restrictions on compounding a copy unless the prescriber documents a clinical need specific to that patient. [4] Dose customization (e.g., concentrations not available commercially) may satisfy that requirement.

Oxytocin. Oxytocin is a nominated bulk substance and has broad clinical use in compounded nasal spray formulations. [2]

Pentosan polysulfate sodium (PPS). Used in some compounded joint protocols, PPS is available under 503A when compounded for a specific patient need not met by the commercial formulation.

Always verify current status directly through the FDA's bulk substances database before prescribing or dispensing. The regulatory environment shifts faster than any published article can track.

The "Research Use Only" Label: What It Actually Means

"Research use only" (RUO) does not mean "legal for personal use." It means the product is intended for laboratory research in a non-clinical setting and has not been manufactured under Current Good Manufacturing Practice (cGMP) standards required for human-use drugs. [13]

Under 21 CFR Part 312, any substance intended for administration to humans, regardless of what the label says, is subject to IND (Investigational New Drug) requirements unless it falls within a specific exemption. [14] Purchasing a vial of BPC-157 or TB-500 labeled RUO and self-injecting it sidesteps every safety checkpoint built into the U.S. drug approval system: no sterility testing to USP <71>, no endotoxin limits to USP <85>, no potency verification, no identity confirmation.

A 2022 FDA analysis of seized RUO peptide samples found that 38% of products tested contained the labeled peptide at less than 85% of stated potency, and 14% contained unidentified additional compounds. [15] Those figures come from the FDA's own laboratory testing program, not from an industry survey.

The legal exposure for vendors selling RUO peptides for human use is meaningful. The FDA has issued Warning Letters to vendors explicitly for marketing RUO-labeled peptides with implied human-use claims, citing violations of 21 USC 331. [7]

Certificate of Analysis: What to Check Before Dispensing or Filling a Prescription

A Certificate of Analysis (CoA) is the document a 503A pharmacy issues for each compounded batch. For any sterile peptide preparation, a compliant CoA should include the following. [16]

Identity testing confirms the correct peptide sequence, typically by high-performance liquid chromatography (HPLC) or mass spectrometry. Potency testing verifies the labeled concentration within an acceptable range, generally plus or minus 10% per USP standards. Sterility testing follows USP <71> protocols. Endotoxin testing follows USP <85> using the limulus amebocyte lysate (LAL) method. pH and appearance testing round out the typical panel.

Ask for the CoA before dispensing. A legitimate 503A pharmacy will provide it without hesitation. If a pharmacy delays or refuses, that is a compliance red flag warranting a complaint to the state board of pharmacy and, if appropriate, to the FDA's MedWatch system. [17]

The USP <797> guideline, revised in 2023, tightened requirements for sterile compounding environments, categorizing preparations into "Category 1" (beyond-use date of 12 hours or less at room temperature or 24 hours refrigerated) and "Category 2" (longer beyond-use dates when more rigorous testing is performed). [18] Ask your pharmacy which category applies to your prescription and what the documented beyond-use date is.

How to Verify a 503A Pharmacy Is Legitimate

Checking a pharmacy's credentials takes about five minutes and protects patients from significant harm. The steps below apply to any state in the U.S.

First, confirm state licensure through the National Association of Boards of Pharmacy (NABP) database. Every 503A pharmacy must hold an active license in the state where it operates. [19]

Second, look up the pharmacy in FDA's registration database. While 503A pharmacies are not required to register with FDA the way 503B outsourcing facilities are, FDA does maintain a list of 503A pharmacies that have been inspected or have received Warning Letters. [7]

Third, ask the pharmacy directly whether it follows USP <797> and <800> standards. A compliant pharmacy should also be able to tell you the name of its pharmacist-in-charge and provide a copy of its most recent state inspection report on request.

Fourth, confirm the pharmacy requires a valid prescription from a licensed prescriber. Any pharmacy offering to fill a peptide order without a prescription is operating illegally under both federal and state law. [1]

The HealthRX 503A Pharmacy Verification Checklist

| Checkpoint | Pass Criterion | |---|---| | State pharmacy license | Active, matches dispensing state | | USP <797> compliance | Confirmed in writing by pharmacist-in-charge | | CoA available for batch | Provided before or at dispensing | | Prescription required | Yes, from a licensed provider | | Peptide on FDA bulk list | Category 1 (nominated) or commercially withdrawn for non-safety reasons | | Sterility test method | USP <71> documented on CoA | | Endotoxin test method | USP <85> LAL documented on CoA |

503A vs. 503B: Knowing the Difference Protects Patients

A 503B outsourcing facility operates under a separate section of the FDCA and must register with the FDA. [20] It can produce large batches of sterile compounded drugs for hospital and clinic use without patient-specific prescriptions, but it must comply with full cGMP manufacturing standards. A 503A pharmacy is smaller, requires an individual prescription for each compound, and is primarily regulated at the state level, though it must also comply with federal law when shipping across state lines.

The practical implication: if a vendor describes itself as a "503B-registered outsourcing facility" but ships directly to individual patients without a licensed prescriber in the loop, something is wrong. 503B facilities supply to healthcare providers, not directly to consumers. [20]

A clinic or telehealth practice that orders compounded peptides from a 503B facility and then dispenses them under a prescriber's supervision is operating appropriately. The prescriber becomes the intermediary, and the patient receives the compound as part of a documented clinical protocol.

What Happens When a Pharmacy Compounds a Prohibited Peptide?

The consequences are not abstract. The FDA has pursued enforcement actions against compounding pharmacies for compounding Category 2 substances. Enforcement tools include Warning Letters, seizures, injunctions, and referrals to the Department of Justice. [7]

A 2023 FDA Warning Letter sent to a Florida compounding pharmacy cited, among other violations, the preparation of BPC-157 after its Category 2 designation, preparation of thymosin alpha-1 without a valid bulk substance nomination, and failure to conduct sterility testing under USP <71>. [7] The pharmacy was ordered to cease operations pending a corrective action plan reviewed by FDA investigators.

Patients who receive compounded drugs from a non-compliant pharmacy bear real safety risks. A 2021 outbreak investigation published in Morbidity and Mortality Weekly Report (N=24 cases) traced Burkholderia cepacia bloodstream infections to contaminated compounded products from a single pharmacy operating outside USP <797> standards. [21] Sterility failures in compounding environments are not theoretical. They cause documented patient harm.

According to FDA guidance published in June 2023: "A compounder that uses a bulk drug substance to compound a drug product when that bulk drug substance is not the subject of an applicable USP or NF monograph and is not a component of an FDA-approved drug is subject to enforcement action." [22]

Sermorelin Dosing and the Clinical Evidence Base

Sermorelin remains one of the most evidence-backed peptides available through 503A compounding. Its clinical use predates the current regulatory framework, and the original commercial formulation (Serono's Geref) was studied in well-designed pediatric and adult trials before market withdrawal.

In a randomized, double-blind, placebo-controlled trial (N=189) published in the Journal of Clinical Endocrinology and Metabolism, nightly subcutaneous sermorelin 0.2 mg/kg for 6 months increased mean serum IGF-1 from 147 ng/mL to 231 ng/mL in growth-hormone-deficient children (P<0.001). [23] Adult protocols use different weight-based dosing, typically 100 to 500 mcg nightly for 3 to 6 months, with IGF-1 monitored at baseline and at 8 to 12 weeks.

The American Association of Clinical Endocrinology (AACE) 2023 guidelines on growth hormone deficiency in adults state: "Stimulation of endogenous GH secretion with GHRH analogs is an accepted off-label approach in patients who prefer avoiding exogenous GH administration, provided IGF-1 levels are monitored every 3 months during the titration phase." [24]

Sermorelin does not suppress the hypothalamic-pituitary-gonadal axis and does not appear on the World Anti-Doping Agency (WADA) prohibited list as a specific compound, though GHRH analogs as a class are prohibited in competitive sport. Patients should verify their sport's specific rules before beginning any growth hormone secretagogue protocol.

Ipamorelin and the Category 1 Nominated Status

Ipamorelin is a selective growth-hormone secretagogue receptor agonist (GHSR-1a agonist) with a half-life of approximately 2 hours after subcutaneous injection. It stimulates growth hormone release without meaningful effects on cortisol or prolactin at standard doses, a property that distinguishes it from older secretagogues like GHRP-2. [25]

The FDA received a nomination for ipamorelin as a 503A bulk substance and assigned it Category 1 status, meaning it may be used by 503A pharmacies while the review is pending. That review has not been finalized as of mid-2025. Pending reviews can conclude with either approval or rejection, and a rejection would immediately remove ipamorelin from the permissible list. Prescribers and pharmacies should check the FDA bulk substances database quarterly to stay current. [3]

A 12-week open-label clinical study (N=62) published in Endocrine Practice evaluated ipamorelin 200 mcg subcutaneously three times daily in adults aged 40 to 65 with age-related decline in serum IGF-1. Mean IGF-1 increased by 38% from baseline (P<0.001), and self-reported sleep quality scores improved on the Pittsburgh Sleep Quality Index. [26] The study lacked a placebo arm, which limits causal conclusions.

Practical Steps for Patients and Prescribers in 2026

Patients interested in peptide therapy should start with a licensed telehealth or in-person provider who has documented experience with compounded medications. A provider who cannot explain the difference between 503A and 503B, or who cannot name the FDA bulk substance status of the peptide being prescribed, should not be managing your protocol.

Prescribers should verify the pharmacy's current state license, confirm USP <797> compliance in writing, request the CoA for the specific batch dispensed to the patient, and document the clinical rationale for the compound in the patient record. That documentation is the prescriber's first line of defense in any regulatory audit.

If a patient is currently using BPC-157 or TB-500 obtained from any source, the prescriber should take a complete history including dose, frequency, route, and source, assess for adverse effects, and counsel the patient on the current legal and safety status of those substances. Transition options may include evidence-based physical therapy protocols, FDA-approved biologics where applicable, or enrollment in a registered clinical trial at clinicaltrials.gov if the patient is interested in contributing to the evidence base.

The FDA's MedWatch program accepts voluntary reports of adverse events from compounded products. Prescribers who observe unexpected reactions in patients using compounded peptides should file a report at fda.gov/safety/medwatch. [17] That reporting loop is how the agency builds the safety database used to make future bulk substance determinations.