Offering BPC-157 and five other peptides no longer blocks LegitScript certification: what qualifies

On November 2, 2026, LegitScript said that offering one of the six peptides covered by HHS’s new enforcement discretion policy “should not, by itself, prevent a merchant from achieving certification” [1]. The six are BPC-157, TB-500, Epitalon, Semax, KPV and MOTS-c [1][2]. The offering has to fit the conditions of the HHS policy and meet every other LegitScript standard and applicable law [1]. Peptides outside the policy are still a barrier [1].

This is not an approval. LegitScript certifies merchants. It doesn’t approve drugs. HHS didn’t approve these peptides either: its policy says HHS “does not intend to take enforcement action” against compounders who meet set conditions, and it adds that compounded drugs “are not FDA-approved” [2]. None of the six is on the 503A bulks list [8][9].

Key points

• What changed: a covered peptide on your menu no longer blocks certification by itself, if the offering meets the HHS policy’s conditions and LegitScript’s other standards [1].
• What did not change: peptides outside the policy, and formulations outside it, are still a barrier [1]. That includes blends [1][10].
• What LegitScript will review: the ingredient, formulation, route, compounding facility and supply chain [1].
• What LegitScript does not control: ad platforms, payment processors, acquirers and card brands set their own rules, and certification doesn’t guarantee access to them [1].
• Deadline: comments on the HHS policy are due two weeks after its October 30 publication, November 13, 2026 [2][8].

LegitScript changed its position before any final rule

In July, after FDA’s Pharmacy Compounding Advisory Committee voted to recommend six of seven peptides for the 503A bulks list, LegitScript said the votes did not change its Certification Standards. It said it would evaluate changes if FDA adopted them through formal rulemaking [4]. In September it explained why so many popular peptides were still off-limits: its standards follow current law, and “only a final rule actually changes the regulatory status of a substance” [3].

The HHS policy changed the picture without a final rule. HHS published it on October 30 under docket HHS-OASH-2026-0496 [2]. The notice calls it a draft and an interim policy, says it applies while the 503A bulks list is developed through rulemaking, and says it “is not binding on HHS or the public” [2]. It was issued by the HHS Office of the Secretary, not by FDA [2][13]. LegitScript’s November 2 update is its answer: a covered offering that meets the policy’s conditions will not face certification enforcement solely because it includes one of these peptides [1].

The history of this space explains why the rules are strict. LegitScript reported in December 2025 that ads for problematic peptides rose 308% in 2024 over 2023, and that BPC-157 and TB-500 were among the products it saw most often [6]. For the full status of each peptide, see the peptide status tracker. The advisory vote is covered at what has to happen after the FDA advisory vote.

Who the HHS policy covers

HHS does not intend to take enforcement action against a state-licensed pharmacy, a federal facility or a licensed physician compounding a drug product with a peptide listed in the policy’s Appendix A [2]. The policy is built around section 503A, which means patient-specific compounding on a prescription [1][2][12]. Frier Levitt’s analysis says the policy does not separately extend enforcement discretion to 503B outsourcing facilities [10].

The six peptides and their permitted routes

Each peptide is covered only in a specific form and only by specific routes [1][9][10]:

A route that isn’t in the table is outside the policy. Drug Topics’ analysis gives injectable KPV, injectable Semax and intravenous use as examples [11].

The conditions an offering must meet

LegitScript summarizes ten conditions [1]. Law firm and trade press summaries list the same set [8][9][11]:

1. A listed peptide. The bulk substance is one of the six [1].
2. The listed identity and route. It meets the policy’s identity specifications and is used by a permitted route [1].
3. A registered source. The bulk substance comes from an FDA-registered facility with a valid certificate of analysis [1].
4. A qualified original manufacturer. The original manufacturer is FDA-registered and meets manufacturing requirements, and its location appears on the certificate of analysis. Intermediaries need documented qualification and certificate validation [1]. A distributor’s registration does not stand in for the manufacturer’s [10][11].
5. Reporting. Compounders report compounded products, serious adverse events and quality issues [1]. Foley and Drug Topics note adverse events go to FDA’s MedWatch program [8][11].
6. Labeling. The label states: “This is a compounded drug product. Not for resale.” [1][11]
7. One active ingredient. The product contains a single API from Appendix A. LegitScript reads this as excluding combinations with other active ingredients [1].
8. Oral bioavailability. Oral products need documentation of adequate human oral bioavailability for that formulation [1].
9. Syringes only. The only delivery device is an FDA 510(k)-cleared syringe. Clearance of another device, such as an injector pen, doesn’t satisfy this [1].
10. Everything else in the FD&C Act. That includes patient-specific prescriptions and sanitary compounding [1].

What still blocks certification

Other peptides. Offering peptides or formulations outside the policy remains a barrier, including peptides not otherwise eligible for 503A or 503B compounding [1]. Drug Topics names CJC-1295 and Ipamorelin as peptides the policy does not cover [11]. Emideltide (DSIP), which the advisory committee did not recommend, is not included either [4][8].

Blends. A BPC-157 and TB-500 combination is outside the policy [10]. So is a covered peptide mixed with any other active ingredient [1].

The wrong route or device. An injectable form of a peptide limited to topical, oral or intranasal use is outside the policy [11]. So is a covered peptide dispensed in a pen [1].

Research-use-only supply. The policy does not authorize importing peptides or excuse manufacturers and distributors from registration, import, supply-chain and state licensing rules [10]. “Research use only” and “not for human consumption” labels are red flags in LegitScript’s own data [6]. See why “research use only” is not a legal shield.

Promotion of products you can’t offer. LegitScript’s Transparency Standard treats promotional content as impermissible even when a business doesn’t sell the product. Educational content is generally permitted [3]. A website that promotes a blend or an uncovered peptide can hold up an application even if the clinic never dispenses it [3].

Certification is not ad or payment approval

LegitScript certification is recognized by Google, Meta, Microsoft Ads, TikTok and LinkedIn for healthcare ads, and by Visa and Mastercard for card-not-present transactions [5]. Google’s policy requires US telemedicine providers to be accredited through LegitScript’s Healthcare Merchant Certification Program, and advertisers must also apply to Google to serve prescription drug ads [7].

LegitScript’s update does not change any of those platforms’ rules [1]. Its post says certification doesn’t guarantee access to their services, that their requirements may differ from LegitScript’s, and that they may restrict activity that otherwise qualifies [1]. Check each platform’s current policy and the date any change takes effect before you launch a campaign [1].

HHS can change this

The policy can be revisited, in whole or in part, if a safety signal or product quality issue arises [2]. It is open for comment until November 13 [2][8], and future FDA rulemaking may propose adding some or all of the six to the 503A bulks list [2]. A certification that rests on this policy rests on a policy that can move. Watch the docket and the peptide status tracker.

What this means for you

MDside is LegitScript certified and has a partnership with LegitScript. If you want to add a covered peptide and keep or pursue certification, the order of work matters.

• Clean the menu first. Remove blends, uncovered peptides and off-policy routes from your site, not only from your formulary [1][3].
• Get the pharmacy’s answers in writing. Confirm it compounds under 503A, names the original API manufacturer and its location on the certificate of analysis, uses one listed API per product, labels with the required statement, ships only with 510(k)-cleared syringes, and reports to MedWatch [1][8][10].
• Prescribe per patient. Every dispense needs a patient-specific prescription [1][15].
• Have your medical director sign the protocol before the first order. It should name the peptide, form, route, pharmacy, screening, consent and adverse event reporting path.
• Check each ad and payment platform separately [1][5].

For the wider legal picture, read are peptides legal? and what LegitScript reviewers ask about peptides. For a physician-led peptide program, see peptide programs or medical director services, or book a call.

Related reading

• LegitScript and peptides
• Peptide status tracker
• Are peptides legal?

Frequently asked questions

Did LegitScript approve BPC-157?

No. LegitScript certifies merchants and does not approve drugs. On November 2, 2026 it said that offering BPC-157, or one of five other peptides covered by HHS’s enforcement discretion policy, should not by itself prevent certification, if the offering meets that policy’s conditions and every other standard and law. The peptides are not FDA-approved.

Which peptides are covered?

BPC-157, TB-500, Epitalon, Semax, KPV and MOTS-c, each in a specific salt or form and only by its permitted routes. BPC-157 covers subcutaneous, intramuscular, oral and topical use. Semax is intranasal only. KPV is topical and oral only. TB-500, Epitalon and MOTS-c are subcutaneous or intramuscular.

Can I offer a BPC-157 and TB-500 blend?

Not under the policy. It covers products with a single active ingredient from its list, and LegitScript reads that as excluding combinations with any other active ingredient. A blend, or any peptide outside the six, remains a barrier to certification.

Does LegitScript certification mean Google or Meta will run my peptide ads?

Not by itself. LegitScript says its update does not change the independent rules of advertising platforms or payment providers, and that certification does not guarantee access to them. Google, for example, also requires its own certification for prescription drug ads. Check each platform’s current policy before launching.

Is the HHS policy permanent?

No. It is an interim, draft enforcement discretion policy that applies while FDA develops the 503A bulks list through rulemaking. HHS says it is not binding and may be revisited if a safety signal or product quality issue arises. Comments are due November 13, 2026.

References

1. Moono N. HHS’s Peptide Compounding Policy: What Healthcare Businesses Need to Know. LegitScript. November 2, 2026. Link
2. U.S. Department of Health and Human Services, Office of the Secretary. Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances. Docket HHS-OASH-2026-0496, FR Doc. 2026-22192. 91 FR 68526-68527. October 30, 2026. Link
3. Moono N. The Peptide Boom: Why So Many Popular Products Are Still Off-Limits. LegitScript. September 22, 2026. Link
4. Moono N. What the July 2026 FDA Advisory Committee Meetings on Compounded Peptides Mean for Healthcare Businesses. LegitScript. July 27, 2026. Link
5. LegitScript. Healthcare Merchant Certification. Accessed November 2, 2026. Link
6. LegitScript. Problematic Peptides Market: LegitScript Data Reveals Multi-Year Surge Across Social Media, E-Commerce, and Advertisements. Press release. December 9, 2025. Link
7. Google Ads Help. Healthcare and medicines (advertising policy). Accessed November 2, 2026. Link
8. Holtz WE, Beaver NA, Rosen DL. Peptides: HHS Announces Limited Enforcement Discretion for Compounding of Six Peptides. Foley & Lardner LLP. October 30, 2026. Link
9. Palmer KL, Snow CD. The PEPTIDE-L Wave Reaches HHS: Enforcement Discretion … Not the Finish Line. FDA Law Blog (Hyman, Phelps & McNamara). October 28, 2026. Link
10. Dresser JC, Kirton WS, Asebey EJ. HHS Announces Landmark Peptide Enforcement Discretion Policy: What Compounding Pharmacies and Peptide Suppliers Need to Know. Frier Levitt. October 28, 2026. Link
11. Nowosielski B, Lee D, Morgan L. HHS Lets Pharmacies Compound Peptides as FDA Writes Official Rule. Drug Topics. October 29, 2026. Link
12. Eglovitch JS. HHS will permit compounding of six peptides ahead of formal rulemaking. RAPS. October 29, 2026. Link
13. Steinzor P. 5 Things to Know About HHS’s Interim Peptide Compounding Policy. AJMC. October 29, 2026. Link
14. American Med Spa Association. HHS Announces Interim Enforcement Discretion for Six Peptides. October 29, 2026. Link
15. Bascom E. HHS further loosens restrictions for several peptides. Healio. October 29, 2026. Link

---

This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.