LegitScript Opens Certification to BPC-157 and 5 Other Peptides

What changed at LegitScript on November 2, 2026

LegitScript, the US company that certifies pharmacies, telehealth providers, med spas and other healthcare businesses, published "HHS's Peptide Compounding Policy: What Healthcare Businesses Need to Know" by Naomi Moono on November 2, 2026¹. In it, the company says it has updated its certification review approach, "effective November 2, 2026," to reflect the new federal policy's conditional allowances¹. It notes that this is its own implementation date and should not be confused with the policy's issuance or publication date¹.

The core change: according to LegitScript, offering one of these peptides "should not, by itself" prevent a merchant from achieving certification, provided the offering meets the enforcement discretion policy's conditions and all other certification standards and compounding laws¹. Businesses whose offerings meet those conditions will not face certification enforcement action "solely" for offering those peptides¹.

Why a private certifier matters

LegitScript is not a regulator, but many commercial doors run through it. Its certification page says the seal is trusted by Google, Meta, Microsoft, TikTok, LinkedIn, Netflix, Nextdoor, Yahoo, Visa and Mastercard⁵. Google, for example, allows US telemedicine ads only from providers accredited by LegitScript's certification program, and online pharmacy ads from those accredited by LegitScript or NABP⁶.

Until now the line was clear. In July, after the FDA's Pharmacy Compounding Advisory Committee (PCAC) meeting, LegitScript wrote that the recommendations "do not change" its certification standards because they do not change the regulatory framework, and that it would evaluate any future FDA changes⁴. In September it went further, naming BPC-157 and TB-500 among substances that "are not currently eligible" for compounding, sale or use, and warning that even offering them through a partner created a certification concern³. In July it said it would evaluate any regulatory change; with the HHS policy, it adjusted its review¹⁴.

The HHS policy that made it possible

The change follows the notice the Department of Health and Human Services (HHS) filed on October 28 and published in the Federal Register on October 30, 2026 (docket HHS-OASH-2026-0496), signed by Secretary Robert F. Kennedy Jr.². In it HHS says it "does not intend to take enforcement action" against State-licensed pharmacies, Federal facilities or licensed physicians compounding products with the peptides in Appendix A while FDA builds the 503A bulks list through rulemaking². We covered the full text, the clash with FDA scientists and the evidence in HHS Lets Pharmacies Compound 6 Peptides: What It Says; here we focus on what changes for businesses.

According to LegitScript, the policy applies to 503A pharmacies and physician compounders, and also matters to businesses that facilitate prescribing, sale or dispensing through them, including telehealth providers¹. 503B outsourcing facilities are not covered¹⁹. And the policy is interim: HHS may revisit it if a safety signal or product quality issue arises², and LegitScript adds that it can be revised or withdrawn at any time¹.

Forms, routes and the 10 conditions

Each peptide is covered only in one form and by specific routes¹⁸:

• BPC-157 (acetate): subcutaneous, intramuscular, oral and topical.
• TB-500, epitalon and MOTS-c (acetate): subcutaneous and intramuscular.
• Semax (free base): intranasal.
• KPV (acetate): topical and oral.

The ten conditions, as summarized by LegitScript and Foley & Lardner¹⁷:

• Registered sourcing: the substance must come from an FDA-registered facility with a valid certificate of analysis (COA)¹⁷.
• Verified original manufacturer: FDA-registered, following good manufacturing practice, with its physical location on the COA; an intermediary must document manufacturer qualification and validate the COA¹¹⁰.
• Testing beyond the COA: identity, potency, impurities, residual solvents, elemental impurities and microbiological quality, including endotoxins for injectables⁹¹⁰.
• Reporting of products compounded, serious adverse events and quality issues to FDA and the states¹⁷.
• Label: "This is a compounded drug product. Not for resale."¹⁷
• A single active ingredient: combinations such as BPC-157 with TB-500 or with semaglutide do not qualify¹⁹.
• Documented oral bioavailability for oral products; an allowed oral route alone is not enough¹⁷.
• Device: only a 510(k)-cleared syringe; an injector pen does not satisfy it¹.
• A patient-specific prescription and other federal requirements¹¹³.

What LegitScript will review and what does not change

Certification review "will consider the specific ingredient, formulation, route of administration, compounding facility, supply chain compliance" and other requirements¹. LegitScript asks businesses to be ready to provide formulation, ingredient form, route, pharmacy, manufacturer and sourcing documentation, COAs, labels and device details¹. It also notes that a peptide's inclusion in the policy "does not establish that every source or formulation is acceptable"¹.

Outside the six, nothing changes: offering other peptides or formulations that fall outside the policy and are not eligible under 503A or 503B "remains a barrier" to certification¹. Drug Topics notes that CJC-1295, ipamorelin, AOD-9604 and emideltide are not in Appendix A⁹. In its 2025 guide for payment processors, LegitScript already listed BPC-157 among peptides FDA had declared impermissible for compounding, and distinguished possession in research labs for legitimate professional study from sale for human consumption¹⁶. Frier Levitt adds that suppliers who want to serve human compounding will need to distinguish themselves from traditional research-use-only suppliers¹⁰.

Advertising doesn't change overnight either. LegitScript says it does not control the policies of ad platforms, payment processors, acquirers or card brands, that their rules may differ from its own, and that their updates may take time and not match its timeline¹. Certification "does not guarantee" access to those services¹.

What it means for physicians, pharmacies and telehealth

For the industry, the message is positive and concrete: there is now a documented path to certification for a compounded offering of these six peptides, with rules that can be audited¹. The American Med Spa Association (AmSpa) says the policy "eases one of the main barriers" to using these treatments, while warning it is not a blanket authorization to prescribe¹³. RAPS notes the policy will stay in effect until FDA completes the list through rulemaking¹¹, and the FDA Law Blog says it is unclear whether states will follow it⁸.

LegitScript advises businesses to confirm the exact ingredient form and route, verify that the pharmacy falls within 503A scope, gather documentation, review labels and messaging so nothing suggests enforcement discretion equals FDA approval, and separately check the rules of each ad or payment platform¹. A review in the International Journal of Pharmaceutical Compounding examines the proposed uses of these peptides, the concerns raised by the PCAC and the practical implications for compounders¹⁷.