The Peptide Compliance Checklist for 2026

this is the checklist we actually work through when we take a med spa or a founder from zero to live. it is not legal advice and it is not a substitute for counsel. it is the operational scaffolding that a peptide business needs before it starts spending money on traffic, and it is written the way an operator would want it: specific, ordered, and honest about what is hard.

one caveat up front. compliance in this category is not static. compound-level rules shift, platform policies change without notice, and state positions evolve. treat this as a snapshot to review with your attorney, not a permanent standard. anything here that conflicts with what your FDA regulatory counsel or state medical board tells you: listen to them, not to us.

1. pick your lane and write it down

before anything else, decide in writing what you are: a research-use-only supplier, a clinical practice prescribing and dispensing through licensed channels, or a company doing both through genuinely separate structures. this single decision determines every downstream rule.

• —RUO supplier: no claims, no dosing, no consumer positioning, COAs published, research-use terms at checkout.
• —clinical: licensed prescriber, patient evaluation, valid prescription, product from a licensed pharmacy or approved drug supply, state telehealth rules respected.
• —both: separate entities, separate brands, separate domains, separate email lists, separate support teams and scripts.

half-lane businesses are the highest-risk configuration in this category, and they are extremely common. if you cannot describe your model in one sentence without a but, you have a problem.

2. entity, insurance, and the boring paperwork

1. 1.form an entity that isolates this business from your existing practice or holdings. talk to your attorney about whether a separate entity is appropriate for your situation.
2. 2.get product liability insurance that explicitly covers your actual product category. read the exclusions. many policies quietly exclude research chemicals or nutraceuticals.
3. 3.if you have licensed providers involved anywhere, confirm with your malpractice carrier that the arrangement is covered.
4. 4.maintain supplier agreements with quality and indemnity terms in writing.
5. 5.register for any state licenses your counsel identifies as applicable to your shipping footprint.

the insurance step is the one operators skip and later regret. a certificate that does not cover what you sell is worse than no certificate, because it creates false confidence.

3. sourcing and testing

your supplier is a compliance decision, not just a cost decision. what you want is a manufacturer who can produce documentation you would be comfortable handing to a regulator or a plaintiff's attorney.

• —third-party certificate of analysis for every lot, from an independent lab, not the manufacturer's in-house paper.
• —identity, purity, and where relevant, endotoxin and heavy metals testing appropriate to the product.
• —lot traceability from supplier to shipped order, so you can execute a recall if you ever need to.
• —documented manufacturing conditions and any relevant facility certifications.
• —a written spec you hold the supplier to, so out-of-spec material is a contractual failure, not a surprise.

publish the COAs. do not hide them behind an email gate. published testing is one of the strongest signals of good faith you can send to processors, platforms, and customers simultaneously.

4. labeling

labels should be unambiguous and physically hard to miss. the general shape most compliant RUO operators use includes the compound name and quantity, lot number, storage instructions, a clear research-use-only statement, a not-for-human-or-veterinary-use statement, and the supplier name and contact.

what should not be on the label: benefit language, suggested amounts, imagery implying consumer use, or anything that resembles a supplement facts panel. we cover this in depth in the labeling article, but the principle is that the label should look like a laboratory reagent because that is what it is.

5. the website

your site is the primary evidence of your intended use. it should read like a supplier catalog, not a wellness brand. run the following audit against every page.

1. 1.no health, performance, appearance, or physiological claims anywhere, including blog, FAQ, and alt text.
2. 2.no dosing, protocols, stacks, calculators, or reconstitution guides.
3. 3.no consumer testimonials, results photos, or user-experience content.
4. 4.RUO statements on product pages, cart, checkout, and order confirmation.
5. 5.terms of sale requiring an affirmative research-use acknowledgment.
6. 6.COAs linked from each product page.
7. 7.a clearly worded disclaimer that content is not medical advice.
8. 8.no telehealth intake, quiz, or symptom-based product finder.

for context on why this matters commercially: WayyLess ran $4.3M in spend to $19.1M in revenue at 4.45 blended ROAS. that scale is only possible on infrastructure that does not break. every account freeze, processor pause, or forced site rewrite costs weeks of compounding.

6. ads and email

ad platforms enforce a stricter standard than the law does, and email carries the same evidentiary weight as your site. the failure mode here is drift: the site stays clean while the creative team, chasing performance, gradually writes copy that would never survive a legal review.

• —one written creative standard that every ad, email, and organic post is checked against.
• —a single named person who approves creative for compliance before it goes live.
• —an archive of every approved creative, so you can reconstruct what was running and when.
• —influencer and affiliate agreements with explicit claim restrictions and a takedown mechanism.
• —no personalization or segmentation based on health goals or conditions.

7. payments

assume standard processors are unavailable and plan for a high-risk setup from the start. underwriting will look at your site, your claims, your chargeback history, and your product category. expect reserves, expect higher rates, and expect to need a backup processor before you need it.

a practical resilience move: have a second processor underwritten and dormant. the cost of maintaining it is trivial compared to a week of downtime on a business doing meaningful daily revenue.

8. customer service and internal policy

write the scripts. train the team. log the refusals. specifically, your team must never answer questions about dosing, personal use, expected effects, or suitability for any condition. the correct response is a polite restatement that the product is sold for research use only and that you cannot advise on use.

audit this quarterly by reading actual tickets. policies decay silently, especially when you hire fast.

9. the review cadence

1. 1.monthly: creative spot check across ads, email, and organic.
2. 2.quarterly: support ticket audit, COA completeness check, site copy re-read, processor health review.
3. 3.twice yearly: counsel review of the regulatory landscape and your compound list.
4. 4.immediately: any time you add a new product, new channel, new market, or new partner.

compliance is not a launch task. it is a maintenance function, and the businesses that survive treat it like one.

what this checklist cannot do

it cannot tell you whether a specific compound is appropriate to sell, whether your state allows your specific clinical arrangement, or whether your particular structure holds up. those are counsel questions with fact-specific answers. what it can do is make sure that when you sit down with your attorney, you are not paying them to explain the basics.