How to Verify a Compounding Pharmacy's License and Testing

Key takeaways

• To verify a compounding pharmacy, first find out exactly which pharmacy makes your drug, then check its license with the state board where it is located and in your state, using the links on FDA's BeSafeRx page. If it is not listed, FDA says not to use it.
• For an outsourcing facility, FDA's registered 503B list shows its last inspection, whether a Form 483 was issued and what action followed. For any compounder, search FDA's warning-letter database and its compounding inspections page by name.
• Ask for the certificate of analysis for your lot. It should name the exact substance, match the drug, strength and lot on your vial, and report potency, sterility and endotoxin results against stated specifications.
• Read the label: your name, the pharmacy's name, the concentration, a lot number and a beyond-use date. FDA recommends discarding multi-dose GLP-1 vials 28 days after first use and never using one that arrives warm.
• PCAB accreditation is voluntary and comes in separate sterile and nonsterile versions; for an injectable, only sterile compounding accreditation is relevant. NABP's Safe Site Search checks websites, not compounding quality.

Verifying a compounding pharmacy takes about 15 minutes and five checks: identify the pharmacy, look up its license with the state board, check its FDA record, ask for the test results for your lot, and read the label. Every tool below is free and was opened on October 10, 2026. Which kind of compounder you are dealing with, a 503A pharmacy or a 503B outsourcing facility, changes which records exist; our 503A vs 503B guide explains the difference. If the drug is tirzepatide, read how to check a tirzepatide compounding pharmacy as well.

The checks at a glance

Step 1: Find out exactly which pharmacy makes your drug

Telehealth programs often sell a drug under their own brand. FDA's March 3, 2026 warning letters to 30 telehealth companies cited branding that implied the telehealth firm was the compounder (FDA, March 2026), and FDA has found compounded GLP-1 labels naming pharmacies that do not exist, or licensed pharmacies that did not make the product (FDA GLP-1 page). Before paying, ask for the pharmacy's legal name, street address, state and license number, and whether it is a 503A pharmacy or a 503B outsourcing facility. When the vial arrives, call the pharmacy printed on the label and confirm it compounded your prescription.

Step 2: Check the license with the state board

FDA's BeSafeRx page links to the license database of every state board of pharmacy, plus DC, Guam, Puerto Rico and the Virgin Islands. FDA's instruction is direct: if the pharmacy is not listed, do not use it; if it is listed, confirm that it requires a prescription, gives a US address and phone number and has a licensed pharmacist to answer questions (FDA BeSafeRx).

Check two states. NABP's criteria for a legitimate online pharmacy include a license from regulators where the pharmacy is located and where the patient is (NABP). While you are on the board's site, look at:

• License status and type. Some states license sterile compounding separately. A 2025 secret-shopper study of clinics selling compounded GLP-1s in West Virginia and Oklahoma found that 4 of the 21 compounding facilities it could check were not licensed for sterile compounding (DiStefano 2026).
• Discipline. The same study found 3 of 22 facilities had faced state disciplinary action since 2023 (DiStefano 2026). FDA's own outsourcing-facility list does not include state actions and tells you to check the state board for them (FDA registered facilities).

If the pharmacy sells online, NABP's Safe Site Search returns one of three results: verified, Not Recommended, or not reviewed. A web address ending in .pharmacy means NABP has accredited the site (NABP). Many pharmacies that fill telehealth prescriptions have no consumer website, so 'not reviewed' is common and proves nothing either way.

Step 3: If it calls itself 503B, check FDA's list

Outsourcing facilities must register with FDA every year, and FDA publishes the list with each facility's initial and latest registration, last inspection, whether a Form 483 was issued, whether a recall followed and what action FDA took (FDA registered facilities). On the list updated September 30, 2026 we counted roughly 100 facilities, 42 marked 'not yet inspected'. Two notes from FDA's own footnotes: a Form 483 lists what investigators observed and is not a final determination of a violation, and 'Open' means FDA has not yet decided on further action.

FDA's Outsourcing Facility Product Report database shows which drugs each facility reported compounding in each six-month period since 2019 (FDA product reports). A facility claiming to make your drug that never reported it is worth a question. And a claim to be '503B' from a company that is not on the list is a red flag on its own.

Step 4: Search FDA's enforcement record

Two FDA pages cover both kinds of compounder:

• Compounding: Inspections, Recalls, and other Actions lists compounders alphabetically, marked 503A or 503B, with links to Form 483s, warning letters, close-out letters and referral letters to state boards (FDA compounding actions). FDA suggests searching the warning-letter database for 'telehealth' to find letters to telehealth companies.
• The warning-letter database is searchable by company name (FDA warning letters). FDA notes that matters in a letter may have changed since, so look for a response or close-out letter.

What a letter can tell you is concrete. In January 2026 FDA wrote that one 503A pharmacy had distributed 9 lots that failed sterility testing and about 25 that failed potency testing between July 2024 and May 2025, including tirzepatide lots at 86.8 and 89.1 percent of labeled strength, and that its procedures suggested potency testing only on a selective basis (Boothwyn letter).

Step 5: Ask for the certificate of analysis, and read it

There are two kinds of certificate, and you want both.

The bulk ingredient's certificate. A 503A pharmacy may compound only from bulk substances made by an FDA-registered manufacturer and accompanied by a valid certificate of analysis (21 U.S.C. 353a). It should name the exact substance, the manufacturer, the lot, and the assay or purity result next to its specification. The name matters: FDA says semaglutide sodium and semaglutide acetate are different active ingredients from the approved drug, with no lawful basis for compounding (FDA GLP-1 page).

Results for your finished lot. For an injectable, the results that matter are potency (measured strength against the labeled strength), sterility and bacterial endotoxins. Under the federal manufacturing rules that bind outsourcing facilities, each batch claimed to be sterile or pyrogen-free must be laboratory-tested (21 CFR 211.167); 503A pharmacies are exempt from those rules, and their testing depends on their procedures and state requirements. A useful report names your drug and strength, shows the same lot number as your vial, gives each result beside its specification, and names the testing laboratory and the date. A certificate for another lot, a summary with no specifications, or a refusal to share anything is information too.

Step 6: Read the label and the beyond-use date

A compounded vial should show your name, the pharmacy's name and phone number, the drug, its concentration in mg per mL, a lot number and a beyond-use date. A survey of compounded semaglutide and tirzepatide products sold online in early 2025 found that only 18 percent reported beyond-use date and storage information (Belcourt 2026). For multi-dose GLP-1 vials, FDA recommends discarding the vial 28 days after first use, even if medication remains and even if the compounder's instructions allow longer; and not using a product that arrives warm or with inadequate ice packs (FDA GLP-1 page). Use the label concentration for every dose, with our peptide calculator.

Step 7: Treat accreditation as a bonus, not a license

The Accreditation Commission for Health Care accredits compounding pharmacies under the PCAB brand, separately for nonsterile compounding (referencing USP chapter 795) and sterile compounding (referencing USP chapter 797); its revised standards took effect June 1, 2024 (ACHC). Accreditation is voluntary and is not a license. For an injectable, only sterile compounding accreditation is relevant, and a logo on a website is not proof: check ACHC's own search of accredited organizations.

If something is wrong

Stop using the product and contact your prescriber. Report adverse events or quality problems to FDA's MedWatch program, online or by fax (FDA GLP-1 page), and file a complaint with the state board of pharmacy that licenses the pharmacy. NABP takes reports of suspicious pharmacy websites (NABP). And before any of this, make sure the substance is one a pharmacy may legally compound at all: no amount of verification makes a BPC-157 vial a lawful compounded drug, as our legal tracker explains. For how a legitimate telehealth prescription works, see can telehealth prescribe peptides.

Bottom line

A compounding pharmacy you can verify is one that tells you its name, holds an active license in its state and yours, shows a clean or closed-out FDA record, shares the test results for the lot in your hand, and prints a beyond-use date on the label. A pharmacy that cannot or will not do those things has told you what you need to know.

Frequently asked questions

+−How do I verify a compounding pharmacy's license?

Look the pharmacy up in the license database of the state board of pharmacy where it is located, and in your own state if it ships to you. FDA's BeSafeRx page links to every state's database. Check that the license is active, that it covers sterile compounding if you are getting an injectable and your state licenses that separately, and whether the board lists any disciplinary action. FDA's advice is blunt: if the pharmacy is not listed, do not use it.

+−How do I know if a compounding pharmacy is legit?

A legitimate pharmacy has an active state license, requires a valid prescription, gives a US address and phone number and has a pharmacist you can reach. Beyond that, check FDA's warning-letter database and compounding inspections page for its name, confirm it is a 503A pharmacy or a registered 503B outsourcing facility, ask for the test results for your lot, and make sure the substance is one a pharmacy may legally compound.

+−What should a certificate of analysis show?

For the bulk ingredient: the exact substance (tirzepatide, not a salt form, for example), the manufacturer, the lot, and the assay or purity result next to its specification. For your finished vial: the drug and strength on your label, the same lot number as your vial, and results for potency, sterility and bacterial endotoxins with the specification and the testing laboratory named. A certificate for a different lot, or one with no specifications, tells you little.

+−What does a Form 483 mean?

A Form FDA 483 lists the objectionable conditions FDA investigators observed during an inspection. FDA states that it is not a final agency determination that the law was violated. What matters is what followed: a closed inspection, a regulatory meeting, a warning letter or a recall, which FDA's registered outsourcing facility list and its compounding inspections page record.

+−Is PCAB accreditation required?

No. PCAB accreditation, run by the Accreditation Commission for Health Care, is voluntary and is not a license. It is offered separately for nonsterile compounding, measured against USP chapter 795, and for sterile compounding, measured against USP chapter 797. For an injectable peptide or GLP-1, the relevant one is sterile compounding; check it on ACHC's own search rather than trusting a logo.

+−How long can I use a compounded vial after opening it?

Use it no later than the beyond-use date on the label. For multi-dose vials of compounded GLP-1 drugs, FDA recommends discarding the vial 28 days after first use even if medication remains and even if the compounder's instructions allow longer, and not using a vial that arrived warm. Ask your pharmacist about other peptides.

+−Which pharmacy does my telehealth company use?

Ask before you pay, and check that the answer matches the vial. FDA's March 2026 warning letters cited telehealth companies whose branding implied they were the compounder, and FDA has found GLP-1 labels naming pharmacies that do not exist or did not make the product. A legitimate program names the pharmacy, its state and whether it is 503A or 503B.

Sources

1. RegulatoryFDA. BeSafeRx: locate a state-licensed online pharmacy (links to each state board of pharmacy's license database; what to confirm). Content current as of November 13, 2024; read October 10, 2026. (2024)
2. SourceNational Association of Boards of Pharmacy. Buy safely: Safe Site Search Tool, Not Recommended list, .pharmacy domains and the criteria for a legitimate online pharmacy. safe.pharmacy; read October 10, 2026 in the Internet Archive copy of September 21, 2026. (2026)
3. RegulatoryFDA. Registered outsourcing facilities (last inspection, Form 483, recall and action columns; notes on registration and inspection). Updated as of September 30, 2026; read October 10, 2026. (2026)
4. RegulatoryFDA. Outsourcing Facility Product Report database (drugs reported by outsourcing facilities since 2019). Read October 10, 2026. (2026)
5. RegulatoryFDA. Compounding: inspections, recalls, and other actions (Form 483s, warning letters and state referral letters for 503A and 503B compounders). Content current as of October 5, 2026; read October 10, 2026. (2026)
6. RegulatoryFDA. Warning letters database (searchable by company name, issuing office and date). Read October 10, 2026. (2026)
7. Regulatory21 U.S.C. 353a (FD&C Act section 503A): bulk drug substances from FDA-registered manufacturers with valid certificates of analysis; USP standards. Legal Information Institute, Cornell Law School; read October 10, 2026.
8. Regulatory21 CFR 211.167: special testing requirements (laboratory testing of each batch purporting to be sterile or pyrogen-free). Legal Information Institute, Cornell Law School; read October 10, 2026.
9. RegulatoryFDA. FDA's concerns with unapproved GLP-1 drugs used for weight loss (28-day multi-dose vials, warm shipments, fraudulent labels, salt forms, MedWatch). Content current as of October 1, 2026; read October 10, 2026. (2026)
10. RegulatoryFDA. FDA warns 30 telehealth companies against illegal marketing of compounded GLP-1s (branding that implies the telehealth firm is the compounder). Press release, March 3, 2026; read October 10, 2026. (2026)
11. RegulatoryFDA. Warning letter to Boothwyn Pharmacy, LLC: 9 lots with sterility failures and about 25 with potency failures distributed between July 2024 and May 2025; selective potency testing. MARCS-CMS 717525, January 16, 2026; read October 10, 2026. (2026)
12. SourceAccreditation Commission for Health Care. Pharmacy accreditation: PCAB accreditation for nonsterile (USP 795) and sterile (USP 797) compounding, revised standards effective June 1, 2024. Read October 10, 2026. (2026)
13. StudyDiStefano MJ, Tilley A, Paratane D, et al. Postshortage compounded GLP-1 RA market in 2 states with potentially high demand. JAMA Health Forum 2026;7:e262207. (2026)
14. StudyBelcourt J, Sapowadia A, White CM. Compounded semaglutide and tirzepatide products use unique formulations but efficacy and safety largely unknown. Ann Pharmacother 2026;60:902-6. (2026)