Certificate of Analysis for Compounded Semaglutide: How to Read It
A certificate of analysis (COA) is a lab report tying one specific lot of drug to test results: identity, potency, purity, and for injectables, endotoxin and sterility. For compounded semaglutide or tirzepatide there are usually two COAs that matter, one for the raw ingredient the pharmacy bought and one (sometimes) for the finished vial you inject, and federal law only guarantees the first exists. Knowing which is which, and what each line means, tells you what you can reasonably ask a pharmacy to show you.
Key takeaways
- Federal law requires the bulk ingredient a 503A pharmacy compounds with to come with a "valid certificate of analysis," per 21 U.S.C. 353a.
- A finished-vial COA is not always required. Under USP <797>, sterility testing depends on the category and beyond-use date the pharmacy assigns.
- The ingredient name on the API COA is where a salt form (semaglutide sodium or acetate) would show up, which state boards prohibit.
- A pharmacy may decline to hand over supplier paperwork, but it should be able to answer direct questions about source, form, and testing.
Two different COAs, two different questions
The first COA comes from the manufacturer of the active pharmaceutical ingredient (API), the raw peptide powder. It answers: is this really semaglutide (or tirzepatide), how pure is it, and who made it? The second COA, when it exists, comes from testing the finished compounded product. It answers: does this lot of vials contain the labeled strength, and is it free of bacteria and endotoxin?
The legal requirement attaches to the first. Section 503A of the Food, Drug, and Cosmetic Act says bulk drug substances used by a compounding pharmacy must be made by an FDA-registered establishment and must be "accompanied by valid certificates of analysis for each bulk drug substance" (21 U.S.C. 353a(b)(1)(A)).
State boards have spelled this out for GLP-1s specifically. The Kansas Board of Pharmacy's statement, last updated April 22, 2026, says the API must arrive with "a valid certificate of analysis that identifies the original manufacturer" and must be pharmaceutical grade, not research, investigational, food, or supplement grade (Kansas Board of Pharmacy, 2026). The phrase "original manufacturer" matters: a distributor's COA that hides the actual maker is a weaker document.
The anatomy of a COA, line by line
COA layouts vary, but a credible one has a header that identifies the material and a results table that lists each test, the method, the specification (acceptance range), and the actual result. The header should include the product name, lot or batch number, manufacture date, retest or expiry date, manufacturer name and address, and a dated quality-unit signature.
The results table is where most of the information lives. These are the tests that matter most for an injectable peptide:
| Test | Question it answers | What a complete entry shows | What should worry you |
|---|---|---|---|
| Identity | Is the molecule what the label says? | A named method (often chromatography and/or mass spectrometry) compared against a reference standard, with a "conforms" result | No method named, or identity listed only as "white powder" |
| Assay (potency) | How much active ingredient is present? | A numeric result alongside the specification range | A result with no specification to compare it against |
| Purity / related substances | What else is in there? | Total impurities and largest single impurity, each with a limit | Purity stated only as a single headline percentage with no impurity breakdown |
| Bacterial endotoxins | Are fever-causing bacterial fragments below the limit? | A result in endotoxin units (EU) against a stated limit, referencing the USP method | Missing entirely on a product intended for injection |
| Sterility | Did microbes grow in culture? | A pass result referencing USP <71> or a validated alternative | "Sterile" claimed with no method or test date |
Source: test categories drawn from USP <797> testing requirements as summarized in the USP <797> FAQ and FDA's CGMP release-testing rule, 21 CFR 211.165.
An API COA usually carries identity, assay, purity, water content, and appearance. Sterility may not appear on an API COA at all, because the compounder, not the API maker, is responsible for producing a sterile final injection. Endotoxin may or may not appear on the API COA. Its absence there shifts more weight onto the finished-product testing.
The name line is a salt-form check
Read the product name on the API COA closely. Ozempic and Wegovy contain semaglutide base, and state boards including Washington and North Carolina have said no salt form of semaglutide may be used in a compounded drug. Kansas extends the same rule to tirzepatide salts (Kansas Board of Pharmacy, 2026). An API COA reading "semaglutide sodium" or "semaglutide acetate" is a document showing the pharmacy bought an ingredient FDA says has no lawful compounding basis. Our separate explainer on salt forms covers why.
"Research use only" ends the conversation
Some peptide suppliers print "for research use only" or "not for human use" on their paperwork. The North Carolina Board of Pharmacy has stated that products labeled for research use, or made by unregistered facilities, may not be used for compounding under any circumstances (NCBOP). That label on a COA is disqualifying regardless of how good the numbers look.
Prefer an FDA-approved option?
Brand-name GLP-1s come with manufacturer quality controls and no COA homework.
Paid links. We may earn a commission; it never changes what we write. See all options. Compounded medications are not FDA-approved.
When a finished-product COA should exist
This is where patients often expect more paperwork than the rules require. For 503A pharmacies, finished-product testing is driven by USP General Chapter <797>, and it depends on how the pharmacy categorizes the preparation and how long a beyond-use date (BUD) it assigns.
- Category 1: USP states that sterility testing is not required for Category 1 preparations, which carry BUDs of hours, not weeks (USP <797> FAQ).
- Category 2: Sterility testing is required only when the pharmacy assigns a BUD that requires it. Injectables compounded from nonsterile components with such a BUD must also get bacterial endotoxin testing (USP <797> FAQ).
- Category 3: Sterility testing is required, plus endotoxin testing for injectables compounded from nonsterile components (USP <797> FAQ).
The practical upshot: if your vial carries a BUD long enough to fall in a sterility-tested tier, a sterility result for that lot should exist somewhere. USP also caps batches that require sterility testing at 250 final dosage units and, for batches of 1 to 39 units, requires testing 10% of units rounded up (USP <797> FAQ). Our USP <797> explainer walks through the BUD tiers in detail.
Notably, the USP <797> FAQ describes sterility, endotoxin and stability-related testing but does not list routine potency (assay) testing of every batch as a requirement for a 503A pharmacy (USP <797> FAQ). That is why it is worth asking directly whether your lot's strength was tested.
Outsourcing facilities (503B) work under a different regime. FDA says registered outsourcing facilities "are subject to CGMP requirements" (FDA), and CGMP requires lab results showing each batch meets its final specifications, "including the identity and strength of each active ingredient," before release (21 CFR 211.165). So a 503B lot should always have release data covering identity and strength.
What a missing COA actually means
"No COA" covers several very different situations. Sorting them out keeps you from either panicking or shrugging off a real problem.
| Situation | Is it a violation? | How to read it |
|---|---|---|
| Pharmacy won't share its supplier's API COA with a patient | Not necessarily | Supplier documents can be treated as confidential business records. Ask your questions in writing instead. |
| Pharmacy says it has no API COA at all | Yes, for 503A compounding | Federal law requires a valid COA for each bulk drug substance (353a). |
| No finished-product sterility test, short BUD | Possibly compliant | Category 1 and some Category 2 BUDs do not require sterility testing under <797>. |
| No sterility test, long BUD | Worth a hard question | Longer Category 2 and all Category 3 BUDs depend on passed sterility testing. |
| 503B lot with no release testing | Yes | CGMP requires identity and strength results before release (21 CFR 211.165). |
Source: 21 U.S.C. 353a; USP <797> FAQ (December 2023); 21 CFR 211.165.
What you can reasonably ask a pharmacy
You are a patient, not an inspector, so frame requests around information the pharmacy should know offhand. These questions are fair to ask in writing and a legitimate pharmacist can answer them without revealing trade secrets:
- Is the API the base form? "Is the semaglutide (or tirzepatide) you compound with the base form, not a sodium or acetate salt?"
- Who made it? "Is the API from an FDA-registered manufacturer, and does your COA identify the original manufacturer?" This mirrors the Kansas language.
- What category and BUD? "What USP <797> category is this preparation, and what is the BUD for my lot?"
- Was my lot tested? "Was this lot tested for sterility and endotoxin? Was strength (potency) tested?"
- Can I see the finished-product results? Some pharmacies will share a redacted lot report on request. If they decline, ask them to confirm the results in writing.
- 503B only: "Can you confirm your facility appears on FDA's registered outsourcing facility list?" You can check that yourself, too.
Bring the answers to your prescriber. They can judge whether the product fits your situation and whether an FDA-approved version is a better fit.
Signs a COA may not be what it claims
FDA has reported fraudulent compounded semaglutide and tirzepatide bearing false label information, including labels naming nonexistent pharmacies and real pharmacies that did not compound the product (FDA, updated October 1, 2026). A COA is just as easy to fake as a label. Be skeptical when:
- The lot number on the COA doesn't match the lot number on your vial or API description.
- No testing laboratory or manufacturer address is named, or the address can't be found.
- Results are listed without methods or specifications.
- The document has no date or no signature from a quality unit.
- It carries "research use only" language anywhere.
- The seller emails a COA but you are buying without a prescription. That alone is a warning sign of an illegitimate seller.
Where the COA fits in the bigger picture
A COA is evidence about one lot, not a verdict on a pharmacy. It cannot show that the pharmacy's cleanroom met <797> on the day your vial was filled, or that the vial was stored and shipped cold. It also can't make a compounded drug equivalent to an FDA-approved one; FDA's position is that compounded drugs should only be used when a patient's medical needs cannot be met by an approved drug (FDA).
Use the COA alongside two other checks: a license lookup on the dispensing pharmacy, and a look at where the API came from under FDA's GLP-1 import alert. Together they tell you far more than any single document.
Weighing compounded vs. brand-name?
See how current providers price FDA-approved GLP-1s.
Paid links. We may earn a commission; it never changes what we write. See all options. Compounded medications are not FDA-approved.
Frequently asked questions
Is a compounding pharmacy required to have a certificate of analysis for semaglutide?
Yes, for the raw ingredient. Federal law (21 U.S.C. 353a) requires bulk drug substances used in 503A compounding to be accompanied by a valid certificate of analysis and made by an FDA-registered establishment.
Does every compounded GLP-1 vial get sterility tested?
Not always. Under USP <797>, sterility testing is not required for Category 1 preparations and is required for Category 2 only when the assigned beyond-use date calls for it. Category 3 preparations always require it.
What should the ingredient name on a semaglutide COA say?
It should identify semaglutide in its base form. A COA reading semaglutide sodium or semaglutide acetate indicates a salt form, which FDA says has no known lawful basis for compounding and several state boards prohibit.
Can I ask my pharmacy for a certificate of analysis?
You can ask. A pharmacy may decline to share supplier documents, but it should be able to tell you in writing whether the API is the base form, who manufactured it, and whether your lot was tested for sterility, endotoxin, and strength.
Sources
- 21 U.S.C. 353a, Pharmacy compounding (Cornell LII)
- Kansas Board of Pharmacy, Statement on Compounding and Dispensing of Compounded GLP-1 and GIP Receptor Agonists (updated April 22, 2026)
- North Carolina Board of Pharmacy, Statement Concerning Semaglutide Compounding (April 2023)
- Washington Medical Commission, Statement on Compounding Semaglutide (August 2024)
- USP, General Chapter <797> FAQs (updated December 11, 2023)
- 21 CFR 211.165, Testing and release for distribution (eCFR)
- FDA, Questions and Answers: Outsourcing Facility Registration
- FDA, FDA's Concerns with Unapproved GLP-1 Drugs Used for Weight Loss (updated October 1, 2026)
Medical disclaimer: This article is general information, not medical advice, and does not replace a licensed clinician who knows your history. Approvals, labels, coverage and prices change; check the linked sources and talk with your prescriber or pharmacist before making decisions about any medication.