Almost every peptide sourcing decision we see was made on a phone call. Someone asked “is this all above board?”, someone confident said yes, and product started shipping. Nothing was written down, because asking for documents felt like an accusation.
It is not an accusation. It is the ordinary way regulated businesses buy from each other, and the reason it matters here is simple: if this goes wrong, the supplier’s verbal assurance is not evidence of anything. The practice that administered, the entity that sold and the clinician who signed carry their own exposure. Here is the document pack to ask for, in the order that resolves the relationship fastest.
Tier 1 — authority to supply you at all
Start here, because a failure at this tier ends the conversation and you can find out in a day.
- Pharmacy licence for the state where the facility operates, current and unexpired.
- Non-resident or out-of-state pharmacy licences for every state you intend to have product shipped into. This is the one most often missing, and it is the practice’s problem as much as the pharmacy’s.
- 503B outsourcing facility registration, if they are describing themselves as one. Registration is with the FDA and it is verifiable.
- A written statement of the specific authority under which they supply the substance for administration to patients — naming the section, on their letterhead, signed.
- If office stock is being offered, the basis on which office use is permitted in each relevant state. Patient-specific requirements differ, and “everyone does it” is not a basis.
The letterhead request is the single most efficient filter in this entire article. A supplier operating lawfully finds it unremarkable. A supplier operating on ambiguity will not put it in writing, and their reluctance is your answer.
Tier 2 — the substance itself
Authority to operate is not authority to compound this. Separate question, separate documents.
- Regulatory status of the bulk substance: on the 503A or 503B bulks list, the subject of a USP monograph, or a component of an approved drug. One of those three, identified specifically.
- The API manufacturer’s name, site address and FDA Establishment Identifier. Not the trading company — the site that made it.
- Confirmation the site is registered with the FDA, which you should verify yourself rather than take on trust.
- Whether a Drug Master File exists and whether a letter of authorisation is available.
Remember the direction the pathway runs: it works by inclusion. A substance appearing on no list has not been permitted. Background in the statutory map.
Tier 3 — the batch in front of you
A certificate that is not batch-specific is a brochure. What a real one carries:
| Item | Why you want it |
|---|---|
| Batch/lot number matching the vials | Ties the paper to the product |
| Named analytical methods | A result without a method is not reproducible |
| Identity by mass spectrometry | Molecular weight consistent with the sequence |
| Purity by HPLC, with wavelength stated | Tells you what was measured, not just the number |
| Net peptide content | How much of the powder is actually peptide |
| Water content and residual solvents | What else is in the cake |
| Counterion / salt form | TFA versus acetate |
| Endotoxin and sterility results | Non-negotiable for anything injected |
| Manufacture date, expiry or beyond-use date | And the basis for it |
| Testing laboratory and signatory | Someone accountable for the result |
Then run the comparison that catches template certificates: ask for the certificates for two different lots. If every value is identical to the decimal place, nobody tested anything. Why each line matters is set out in how peptides are actually made.
Tier 4 — the operation behind the batch
- Most recent FDA or state board inspection and its outcome, including any observations and the responses.
- Warning letter and recall history — verifiable in public databases, so ask and then check.
- Certificate of insurance, with products liability, and confirm the coverage is not excluded for the category you are buying.
- A quality agreement setting out specifications, change control and who tells whom when something moves.
- Complaint, adverse event and recall procedures. Specifically: how would they reach you, and how fast, if a lot you already administered were withdrawn?
That last question is the one that separates a supplier from a seller. If they cannot describe how they would find you, they cannot recall product from you.
Tier 5 — the commercial terms that give it away
The paperwork can look adequate while the deal structure tells you what is really happening.
- How do they want to be paid? Cryptocurrency, personal transfer apps, or a wire to an entity with a different name than the invoice, are not the payment terms of a regulated pharmaceutical supplier.
- Who is the importer of record if anything crosses a border? If the answer is your business, you have assumed liability that the price did not reflect.
- Is there a named US agent for a foreign establishment?
- Will they indemnify you for regulatory or product defect claims? A supplier certain of their position usually will, at least in part. Total refusal is informative.
- Does the invoice describe what is in the box? An invoice that calls an injectable a chemical or a sample is a document you do not want in your file.
The red flags, ranked
| Signal | What it usually means |
|---|---|
| Will not put authority in writing | There is no authority to write down |
| Identical certificates across lots | No batch testing |
| “Research use only” on an injectable sold for patients | Known unapproved drug — see why the disclaimer fails |
| Cannot name the API site or its FEI | They are a reseller who does not know either |
| Crypto or personal payment apps | Avoiding a paper trail deliberately |
| Pressure to buy volume for a discount | Moving inventory ahead of a change |
| “Everyone in the industry is doing this” | An admission phrased as reassurance |
The request, in a form you can send today
Paste this, adapted, into an email:
- Current pharmacy licence, and non-resident licences for [states].
- FDA 503B registration, if applicable.
- A signed statement on letterhead of the specific authority under which you supply [substance] for administration to patients.
- The regulatory status of the bulk substance, identified specifically.
- API manufacturer name, site address and FEI number.
- Batch-specific certificates of analysis for the two most recent lots, including net peptide content, endotoxin and sterility.
- Outcome of your most recent inspection.
- Certificate of insurance including products liability.
- Your recall and adverse event notification procedure.
Nine items. A compliant supplier returns them within a few business days. Everything you learn from the reply — including how long it takes and what gets skipped — is diligence.
Then keep it current
File the pack, note the expiry date of every licence, and re-verify annually and whenever the supplier changes an API source, a site, or a formulation. Regulatory status in this category moves in both directions, and a file assembled once and never opened is a snapshot of a world that has moved on.
Where MDside sits
We run this pack for the practices we support rather than leaving it to a founder to negotiate alone, and we confirm the supplying pharmacy’s specific authority in writing. Where a substance has no completed pathway, no document pack rescues it and our providers do not prescribe it.
See how our peptide programs are structured, or read 503A versus 503B sourcing.
Related reading
Frequently asked questions
What should I ask a peptide supplier before buying?
For written proof of licensure in every state product ships into, a signed statement of the specific authority under which they supply the substance, the regulatory status of the bulk substance, the API site and its FEI number, batch-specific certificates for two recent lots, inspection outcome, insurance, and their recall procedure.
How do I know a certificate of analysis is genuine?
Compare certificates for two different lots. Identical values across batches indicate a template rather than testing. A real certificate carries a matching batch number, named methods, dates, and an identifiable laboratory and signatory.
Is a supplier’s verbal assurance worth anything?
Not in an enforcement context. The practice that administered the product carries exposure independently of what it was told, which is why the specific authority should be on letterhead and in your file.
What is net peptide content and why ask for it?
It is the proportion of the powder that is actually peptide, after water and counterion. Without it you cannot know how much active substance a labelled milligram amount contains, and two suppliers quoting the same purity can be selling materially different quantities.
How often should supplier documents be refreshed?
At least annually, on every licence expiry, and immediately whenever the supplier changes API source, manufacturing site or formulation. Regulatory status in this category changes in both directions.
General information about supplier due diligence, not legal advice. The document list is a starting point rather than a complete compliance programme; have healthcare counsel and, where appropriate, a qualified quality consultant review your sourcing arrangements.