Peptide CoA Certificate: How to Read, Verify, and Use One to Stay Legal in 2026

What a Peptide CoA Certificate Actually Is

A certificate of analysis is a formal document, issued by an accredited analytical laboratory, that records the test results for a specific batch of a chemical compound before that batch is released for use. For peptides sold or compounded in the United States, a CoA must cover at least four domains: chemical identity, purity, potency, and safety (microbial and endotoxin limits). Without all four, the document is incomplete regardless of how official it looks.

The FDA defines a compounded drug as one that is "prepared, mixed, assembled, packaged, or labeled" by a licensed pharmacist or physician, and it holds compounded peptides to the same adulteration and misbranding standards that apply to manufactured drugs under 21 U.S.C. § 351 and § 352. [1] A CoA is the primary instrument a 503A or 503B pharmacy uses to demonstrate that the active pharmaceutical ingredient (API) it received from a supplier met specification before compounding began.

Patients receiving peptide therapy from a licensed compounding pharmacy should receive, or at minimum be able to request, a copy of the CoA for their specific lot. If a vendor refuses that request, that refusal is itself a red flag.

How to Read Every Field on a Peptide CoA

The document looks dense. Each field has a specific clinical meaning worth understanding.

Lot or batch number. This ties the CoA to exactly one production run. Any discrepancy between the lot number on the vial and the lot number on the CoA means the document does not cover the product in hand.

HPLC purity percentage. High-performance liquid chromatography separates the peptide from related impurities and reports what fraction of the sample is the target compound. USP guidance and standard compounding practice require 98% or greater for APIs destined for parenteral (injectable) use. [2] A reading of 95% might look acceptable at a glance, but the remaining 5% may include truncated sequences, oxidized variants, or solvent residues that carry their own biological activity.

Mass spectrometry (MS) identity confirmation. HPLC alone cannot confirm the compound is what it claims to be; it only measures how much of the main peak is present. MS confirms molecular weight and fragmentation pattern. A CoA for BPC-157 should show a monoisotopic mass consistent with the sequence Gly-Glu-Pro-Pro-Pro-Gly-Lys-Pro-Ala-Asp-Asp-Ala-Gly-Leu-Val (molecular formula C62H98N16O22, MW approximately 1419.5 Da). If MS data is absent, the CoA cannot confirm identity.

Endotoxin limit test. Bacterial endotoxins cause fever, septic shock, and in severe cases, death when injected. The USP <85> limulus amebocyte lysate (LAL) test sets the acceptable limit for most parenteral small-molecule drugs at 0.5 endotoxin units per mL (EU/mL). [3] An injectable peptide CoA that omits endotoxin data is missing one of the most patient-safety-critical fields on the document.

Residual moisture (Karl Fischer). Lyophilized (freeze-dried) peptides are hygroscopic. Excess moisture promotes aggregation and degradation. Acceptable residual moisture is typically below 6% for lyophilized APIs. [4]

Sterility or bioburden. A CoA for a compounded injectable must reference sterility testing per USP <71> or, for in-process bulk, at minimum bioburden data. [5] The compounding pharmacy performs a final sterility test after filling, but the API CoA should also report bioburden to confirm the starting material was not grossly contaminated.

Solvent residues. Peptide synthesis uses organic solvents including DMF, NMP, and acetonitrile. ICH Q3C limits govern acceptable residual levels. [6] Class 2 solvents like acetonitrile have a permitted daily exposure of 4.1 mg/day. A CoA for an API used at doses of 1 to 5 mg per injection should report residual solvents at levels that keep daily exposure well below that threshold.

BPC-157 FDA Status in 2026

BPC-157 is prohibited from compounding under both 503A and 503B pathways as of 2024. The FDA placed it on the list of bulk drug substances that present demonstrable difficulties for compounding (the so-called Category 2 list) because there is no evidence of a clinical need that cannot be met by an FDA-approved alternative and because its safety and efficacy have not been established in adequate and well-controlled human trials. [7]

That regulatory outcome matters for CoA interpretation. Any CoA for BPC-157 arriving at a U.S. licensed pharmacy in 2026 cannot be used to justify compounding that peptide for human administration. The CoA may be technically accurate, but the underlying compounding act would violate 21 C.F.R. Part 216. [8] Patients who were receiving compounded BPC-157 before the 2024 prohibition should have had their prescribers transition them to alternative protocols.

The preclinical literature on BPC-157 is substantial. A 2018 review in Current Neuropharmacology described cytoprotective and angiogenic effects in rodent models of gastrointestinal injury, tendon repair, and neuroprotection. [9] Those findings support the biological plausibility of human benefit, but plausibility is not the legal or clinical standard for compounding eligibility. The FDA requires data from adequate human trials, which do not yet exist for BPC-157 at published doses used in clinical practice.

TB-500 FDA Status

TB-500 is a synthetic fragment of thymosin beta-4 (TB4), typically corresponding to the actin-binding domain sequence Ac-LKKTETQ. Its FDA status mirrors that of BPC-157. The agency has not approved any drug containing TB4 or TB-500, and the compound appears on the Category 2 bulk substance list, barring licensed 503A and 503B compounding pharmacies from using it as an API. [7]

Thymosin beta-4 itself has been studied in phase II trials for cardiac repair and wound healing. A 2012 trial in the Journal of the American College of Cardiology examined TB4 in acute myocardial infarction survivors and found it was well tolerated, but the study was not powered to detect efficacy endpoints. [10] TB-500 as a truncated fragment has no published randomized controlled trial data in humans.

For patients asking a compounding pharmacy to fill a TB-500 prescription in 2026, the honest answer from any compliant pharmacy is that it cannot legally do so under current FDA guidance. Vendors selling TB-500 as an injectable "research peptide" for human use are operating outside FDA drug regulations regardless of what their CoA says.

The "Research Use Only" Label: What It Does and Does Not Mean

"For research use only. Not for human use." This phrase appears on the label of a large fraction of peptides sold online. Many buyers assume it creates a legal workaround that lets a vendor sell an unapproved drug for human use without FDA oversight. It does not.

FDA's position, stated in multiple warning letters and in guidance published on fda.gov, is that the intended use of a product determines whether it is a drug under the Federal Food, Drug, and Cosmetic Act. [11] If a vendor markets a peptide through testimonials about muscle recovery, fat loss, or injury healing, that marketing establishes human therapeutic intent. The "research use only" label does not change the legal status. The product is still an unapproved drug, and selling it for human use violates 21 U.S.C. § 331. [12]

A CoA attached to a "research use only" peptide may be perfectly accurate. The HPLC purity might be 99.2%. The MS might confirm identity. But that CoA does not make the compound legal for human administration, and it does not tell you anything about sterility, endotoxin levels, or residual solvents unless those tests were specifically ordered and reported. Research-grade peptides are often synthesized without the solvent-residue controls or endotoxin testing required for pharmaceutical-grade material. [13]

The 503A Pharmacy List and What It Covers in 2026

Under Section 503A of the Federal Food, Drug, and Cosmetic Act, a licensed compounding pharmacy may compound a drug from a bulk substance that appears on the FDA's 503A Bulks List (also called the "positive list") without that substance being a component of an FDA-approved drug, provided it meets specific conditions. [14] The conditions include: a valid patient-specific prescription, state licensure of the pharmacy, and compliance with USP <797> sterile compounding standards. [15]

Peptides currently on or proposed for the 503A positive list as of early 2025 include:

• Sermorelin (GHRH analog, used for growth hormone deficiency evaluation)
• Ipamorelin (GHRP, combined with CJC-1295 in some protocols)
• PT-141 (bremelanotide; FDA-approved as Vyleesi but also on 503A list for compounding at non-standard doses)
• Oxytocin (for specific indications where FDA-approved alternatives are unavailable or clinically inappropriate)

BPC-157, TB-500, GHK-Cu, Selank, Semax, and several other popular longevity peptides are not on the positive list and remain prohibited from 503A compounding. [7] The distinction matters because a CoA, however pristine, cannot authorize a pharmacy to compound a prohibited substance.

Under Section 503B, an outsourcing facility may produce drugs in bulk for office use without patient-specific prescriptions, but only from substances that appear on the FDA's 503B Bulks List. That list is even more restrictive. As of January 2025, no performance or longevity peptide beyond sermorelin appears on the 503B Bulks List. [16]

How to Verify a Peptide CoA Is Not Forged

CoA fraud is real. A 2023 investigation published in Drug Testing and Analysis found that roughly 27% of "research peptide" products purchased from online vendors failed to match the identity or purity stated on their accompanying CoAs when retested by an independent laboratory. [17]

The HealthRX verification protocol for any peptide CoA received by a patient or prescriber runs in five steps:

1. Locate the testing lab's contact information independently. Do not use any phone number or email printed on the CoA itself. Search the lab's name directly and call or email to confirm the report number exists and matches the stated results.
2. Check accreditation. The testing laboratory should hold ISO/IEC 17025 accreditation for chemical testing. In the United States, accreditation bodies include A2LA and NVLAP. A CoA from a non-accredited lab carries no regulatory weight.
3. Cross-check lot number against pharmacy dispensing records. The CoA lot number should match what the compounding pharmacy received from its API supplier. Ask the pharmacy for its API supplier CoA separately from the finished-product CoA.
4. Confirm the test date predates compounding. A CoA dated after the pharmacy's receipt date is logistically implausible and suggests the document was generated retroactively.
5. Look for the raw chromatogram. A legitimate HPLC CoA should be able to supply the underlying chromatogram trace on request. A vendor that provides only a summary table but refuses to produce the raw data file is a significant concern.

These five steps take approximately 20 minutes. They are the minimum reasonable due-diligence standard before a clinician signs off on a peptide prescription filled by an unfamiliar pharmacy.

USP Standards That Govern Compounded Peptide Quality

Compounding pharmacies in the United States that prepare sterile products, including injectable peptides, are required to comply with USP <797>, which sets environmental monitoring, beyond-use dating, and personnel training standards for sterile preparations. [15] The 2023 revised USP <797> chapter tightened beyond-use dating for Category 2 CSPs (compounded sterile preparations made from non-sterile components) to a maximum of 4 days at controlled room temperature or 10 days refrigerated without sterility testing, or 45 days refrigerated with passing sterility testing. [15]

USP <1> general notices and the USP monograph system also apply where monographs exist. Currently, no USP monograph exists for BPC-157, TB-500, or most longevity peptides, which means there is no official specification against which a CoA can be benchmarked. That absence strengthens the case for requiring ISO 17025-accredited independent testing.

For parenteral peptides, USP <1> requires that injectable preparations be essentially free from visible particulate matter. USP <788> sets limits for sub-visible particles. [18] A CoA that does not address particulate matter is technically incomplete for an injectable product.

What Prescribers Should Require From a Compounding Pharmacy

A prescriber ordering a compounded peptide for a patient takes on a co-responsibility for the quality of that product. The American Society of Health-System Pharmacists (ASHP) guidance states that prescribers should request quality documentation from compounding pharmacies before initiating a prescription program. [19]

At minimum, a prescriber should request and review:

• The API supplier CoA (covering HPLC purity, MS identity, endotoxin, residual solvents, and moisture)
• The finished-product CoA from the compounding pharmacy (covering sterility per USP <71>, endotoxin, potency, and appearance)
• Proof of 503A licensure in the patient's state
• Proof of USP <797> compliance, ideally through a recent inspection report or accreditation certificate from PCAB (Pharmacy Compounding Accreditation Board)

"Physicians who prescribe compounded medications bear responsibility for ensuring the compounding source meets applicable quality standards," according to guidance from the Endocrine Society's position on compounded hormones, a standard that applies equally to peptide therapies. [20]

Red Flags on a Peptide CoA That Disqualify the Product

These findings on a CoA, or the absence of expected data, should stop a prescription from being filled:

• HPLC purity below 98% for a parenteral API
• No MS identity confirmation
• Endotoxin not tested or result above 0.5 EU/mL
• Testing laboratory not ISO 17025 accredited
• CoA dated after the pharmacy's stated receipt date
• Lot number on document does not match lot number on vial or shipping label
• No residual solvent data for a peptide synthesized by solid-phase peptide synthesis (SPPS)
• "Research use only" notation with no accompanying pharmaceutical-grade testing for sterility or endotoxin

Any single one of these is grounds for requesting a replacement lot with compliant documentation. Two or more should trigger a report to the state board of pharmacy and, for a 503B outsourcing facility, to the FDA's MedWatch program at fda.gov/safety/medwatch. [21]

Patient Questions About CoAs and Legal Peptide Sourcing

Patients asking about peptide therapy through a telehealth platform sometimes arrive with peptides already in hand, purchased from an online vendor. The relevant clinical question is not whether the peptide is interesting from a science perspective. It is whether the product was manufactured to pharmaceutical standards, whether it is legal to prescribe in a compounded form, and whether the CoA actually covers what the patient was told it covers.

A patient arriving with a vial of BPC-157 labeled "research use only" and a CoA showing 98.5% HPLC purity is in a complicated position. The purity result is reassuring on its face, but the compound cannot be legally prescribed by a U.S. licensed prescriber under current FDA rules, the endotoxin data may be missing, and the sterility of the preparation is unknown. [7] Prescribers should not validate that product by incorporating it into a treatment plan, regardless of patient preference or anecdotal reports of benefit.

Patients who want legal peptide therapy options in 2026 should focus on compounds that appear on the 503A Bulks List (sermorelin, ipamorelin) or that have FDA-approved formulations at specific doses (bremelanotide as Vyleesi, semaglutide as Ozempic or Wegovy, tesamorelin as Egrifta). For these compounds, a compounding pharmacy can legally prepare a product, and the CoA serves its intended function: confirming that the API meets spec before a patient-specific prescription is filled.