On 28 October 2026 HHS filed an "Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances" (FR doc 2026-22192, Federal Register publication 30 October). HHS says it does not intend to take enforcement action against state-licensed pharmacies, Federal facilities or licensed physicians compounding BPC-157, TB-500, epitalon, KPV, MOTS-c or semax, each limited to set routes, when ten conditions are met: a valid patient-specific prescription, a single active ingredient, an FDA-registered CGMP original manufacturer named on a full certificate of analysis, and MedWatch reporting among them. It is interim, not a rule, and runs until each peptide is settled by final rule. It does not cover research-use-only vials sold online. Comments close two weeks after publication, which is 13 November 2026.
HHS says it will not take enforcement action against licensed pharmacies that compound six peptides under ten conditions. The policy covers BPC-157, TB-500, epitalon, KPV, MOTS-c and semax, each limited to specific routes. Other peptides, such as thymosin alpha-1, are not on the list. Research vials sold online are outside it. We read the Federal Register filing and the HHS policy with both appendices on 29 October 2026.
| What it covers | What it does not |
|---|---|
| State-licensed pharmacies, Federal facilities and licensed physicians compounding under section 503A | 503B outsourcing facilities, which the no-enforcement statement does not name |
| Six peptides in Appendix A, each with a set identity and route | Any other peptide, including GHK-Cu, LL-37 and DSIP |
| Single-ingredient products against a valid patient-specific prescription | Blends, such as BPC-157 with TB-500 |
| API from an FDA-registered CGMP original manufacturer, with a full COA | Research-use-only vials sold online |
| Interim enforcement discretion until a final rule settles each peptide | Drug approval, or a place on the 503A Bulks List |
The Federal Register notice calls the document a draft and says it "is not binding on HHS or the public." The policy itself says HHS may revisit it if a safety signal or product quality issue arises.
Which peptides and routes does the HHS policy cover?
Appendix A lists six bulk drug substances. Appendix B fixes each one's identity (sequence, formula, molecular weight, salt form) and the dosage forms the discretion applies to.
| Peptide | Form named in Appendix B | Routes covered |
|---|---|---|
| BPC-157 | acetate | subcutaneous, intramuscular, oral, topical |
| TB-500 | acetate, Ac-LKKTETQ, MW 949.1 | subcutaneous or intramuscular |
| Epitalon | acetate | subcutaneous or intramuscular, "dispensed in intermittent courses" |
| Semax | free base | intranasal |
| KPV | acetate | topical and oral |
| MOTS-c | acetate | subcutaneous or intramuscular |
Two details matter if you read vendor labels. HHS defines TB-500 as the seven-residue fragment, not full thymosin beta-4. And semax is the free base; N-acetyl semax amidate is a different molecule. Where an oral form is compounded, condition 8 expects the pharmacy to document "adequate level of oral bioavailability in humans" for that formulation.
What conditions does the policy set?
Ten, and all must be met:
| # | Condition |
|---|---|
| 1 | The peptide is on the Appendix A list |
| 2 | It matches the Appendix B identity and route limits |
| 3 | The API comes from a section 510 registered facility with a valid COA meeting the Appendix B testing standard |
| 4 | The original manufacturer, not a repacker or distributor, is FDA-registered, CGMP-compliant and its physical site is on the COA |
| 5 | Compounded products, serious adverse events and quality issues are reported to FDA MedWatch and to the states |
| 6 | The label reads "This is a compounded drug product. Not for resale." |
| 7 | One active ingredient only |
| 8 | Oral forms carry documented human bioavailability |
| 9 | The only device is an FDA 510(k)-cleared syringe |
| 10 | All other FD&C Act requirements, including a patient-specific prescription |
Appendix B sets a full testing table for the COA. It asks for identification by at least two orthogonal methods, HPLC assay against a reference standard, net peptide content, peptide-related impurities under ICH Q3A, nitrosamines, residual solvents by gas chromatography, elemental impurities by ICP-MS, residual TFA, counter-ion content, water content, bioburden and bacterial endotoxins under USP <85>. The certificate must also give the manufacturer's FDA establishment identifier and address, an "Intended for human drug compounding" grade and a CGMP compliance statement.
Why does HHS say it is doing this?
The policy says the Secretary determined it will discourage "research-use-only peptides supplied by foreign manufacturers" that pose a risk to US patients. For BPC-157, HHS says the record now includes "a lot-specific certificate from an FDA-registered facility" reporting results FDA's drug center had found missing. HHS makes similar characterization claims for the other five. FDA's reviewers recommended against all six at the July advisory meeting, covered in our FDA peptide vote explainer.
How did the policy reach the Federal Register?
14 OCT 27 OCT 28 OCT 30 OCT 13 NOV
┌──────────┐ ┌──────────┐ ┌────────────┐ ┌───────────┐ ┌───────────┐
│ OIRA │ → │ OIRA │ → │ Filed for │ → │ Published │ → │ Comments │
│ receives │ │ concludes│ │ public │ │ in Federal│ │ close │
│ RIN │ │ review │ │ inspection │ │ Register │ │ (2 weeks) │
│ 0910-ZD94│ │ │ │ 11:15 am │ │ 2026-22192│ │ │
└──────────┘ └──────────┘ └────────────┘ └───────────┘ └───────────┘
The 28 October filing time and the 30 October publication date are printed on the notice. The two OIRA dates come from OIRA's completed-review listing on reginfo.gov for RIN 0910-ZD94. The notice says comments can be submitted "until 2 weeks after date of publication" on regulations.gov docket HHS-OASH-2026-0496. Two weeks from 30 October is 13 November 2026, by our count.
What does it mean for research-use-only vials?
Nothing changes for them. The no-enforcement statement names state-licensed pharmacies, Federal facilities and licensed physicians, compounding against a prescription. A vendor selling lyophilised vials labelled for research is none of those, and its product is not a compounded drug. FDA's warning letters to online sellers sit on a separate track the policy does not mention.
Our reading, not the policy's words: the text treats research-use-only supply as the problem it is trying to displace. Expect vendor copy calling BPC-157 "HHS-approved" or "legal now". Neither is true for a research vial, and no peptide here was approved. Our peptide legality tool tracks each compound's status.
Do research-peptide certificates meet the HHS checklist?
Kovera is a third-party lab whose public certificates we mirror and index on our Kovera page. We counted every certificate whose product name or listed blend components name one of the six peptides: 447. Fourteen KLOW or GLOW blend certificates that list no components are left out.
| Peptide | Certificates naming it | Single-ingredient | Share in blends |
|---|---|---|---|
| BPC-157 | 220 | 68 | 69.1% |
| TB-500 | 179 | 28 | 84.4% |
| KPV | 87 | 34 | 60.9% |
| MOTS-c | 86 | 86 | 0.0% |
| Semax | 50 | 45 | 10.0% |
| Epitalon | 24 | 24 | 0.0% |
A blend certificate counts once for each peptide it names, so the column sums past 447. Across the 447, 162 (36.2%) are blends, which condition 7 bars. That leaves 285 single-ingredient certificates. This is what they report against the Appendix B table:
| HHS checklist item | Single-ingredient certificates reporting it (of 285) |
|---|---|
| Identity (LC-MS) | 285 (100%) |
| Purity (HPLC) | 285 (100%) |
| Net content | 285 (100%) |
| Bacterial endotoxin | 208 (73.0%) |
| Microbial or sterility screen | 142 (49.8%) |
| Heavy-metal table (As, Cd, Pb, Hg) | 132 (46.3%) |
| Heavy metals as numeric results against a limit | 6 (2.1%) |
| Endotoxin, microbial and heavy metals together | 105 (36.8%) |
| Residual solvents, TFA, counter-ion, water, nitrosamines | 0 |
| Original manufacturer, FEI number and site | 0 |
| "Intended for human drug compounding" grade | 0 |
Most heavy-metal tables in the snapshot print "Negative" for each of four metals without a method or limit on the face of the certificate. HHS asks for ICP-MS against USP <232> and ICH Q3D. Six certificates print numeric upper bounds. Kovera's sterility screens test the finished vial for growth; the HHS table lists bioburden testing of the API under USP <61> and <62>. Our endotoxin explainer covers how to read those lines.
Labels raise a separate identity question. Of 28 single-ingredient TB-500 certificates, 23 carry the product name "TB-500 (Thymosin B4)" and 1 "TB-500 (43aa)". HHS's TB-500 is the 949 g/mol fragment. Seven of 45 semax certificates are N-acetyl semax amidate, and two of 24 epitalon certificates are an N-acetyl amidate form.
What the numbers mean
Inference, labelled as ours: a Kovera certificate and the HHS COA are different documents. Kovera tests a finished, vendor-labelled vial and names the vendor as client. HHS asks for a manufacturer's lot certificate for bulk API, signed by that manufacturer's quality unit. No count of panels would turn the first into the second, because the manufacturer field is absent by design. The checklist does show the distance: the best-documented research certificates touch six of the twenty rows in the HHS table, some only in part, and none reports a solvent, TFA or water result.
The counts also cut the other way. Endotoxin appears on 73.0% of single-ingredient certificates, and we have no data on how many pharmacy-grade API certificates meet the full table either. HHS cites certificates of that kind in Appendix B but has not published them.
Bottom line
HHS has opened a conditional route for six peptides through licensed pharmacies, with a prescription, one ingredient, set routes and a full API certificate from a registered manufacturer. It changes nothing for research vials. In our 2 August 2026 Kovera snapshot, 36.2% of certificates for these peptides are blends the policy bars, and none names a manufacturer or reports residual solvents. We will update this page when the docket closes or HHS revises the text. How we read certificates is set out in our methodology.
Sources
- Federal Register, notice of availability, FR doc 2026-22192 - filed 28 October 2026, publication 30 October; comment window and docket number
- HHS, enforcement discretion policy with Appendix A and Appendix B - conditions, identities, routes and the COA testing table; read 29 October 2026
- regulations.gov, docket HHS-OASH-2026-0496 - where comments are filed
- reginfo.gov, OIRA completed EO 12866 reviews - RIN 0910-ZD94 received 14 October, concluded 27 October 2026 ("Consistent with Change")
- reginfo.gov, EO 12866 meeting log for RIN 0910-ZD94 - four meetings, 21 to 27 October 2026
- FDA Law Blog, "The PEPTIDE-L wave reaches HHS" - legal commentary (secondary)
- Internal: Kovera certificate mirror, FDA peptide vote 2026, endotoxin on a peptide COA, peptide legality tool
Frequently asked
Is BPC-157 legal to compound now?
Under conditions, HHS says it will not enforce. The 28 October 2026 policy covers BPC-157 acetate compounded by a state-licensed pharmacy, Federal facility or licensed physician against a valid patient-specific prescription, for subcutaneous, intramuscular, oral and topical dosage forms, from API made by an FDA-registered CGMP manufacturer. BPC-157 is still not on the 503A Bulks List and is not an approved drug.
Which peptides does the HHS policy cover?
Six, listed in Appendix A: BPC-157, epitalon, KPV, MOTS-c, semax and TB-500. Each has a defined identity and route limit in Appendix B. KPV is limited to topical and oral forms, semax to intranasal use, and TB-500, MOTS-c and epitalon to subcutaneous or intramuscular injection.
Does the HHS peptide policy cover research-use-only peptides sold online?
No. The policy names only state-licensed pharmacies, Federal facilities and licensed physicians compounding against a prescription. HHS says the policy is meant to discourage the use of research-use-only peptides from foreign manufacturers. Online research-chemical sales sit outside it.
Can a compounding pharmacy make a BPC-157 and TB-500 blend under the policy?
No. Condition 7 says the compounded product contains only a single active pharmaceutical ingredient from Appendix A. HHS gives adverse-event attribution as the reason.
When is the comment deadline for the HHS peptide policy?
The Federal Register notice says written comments can be submitted until two weeks after publication, via regulations.gov on docket HHS-OASH-2026-0496. Publication is 30 October 2026, so by our count the deadline is 13 November 2026.
Do research-peptide certificates meet the HHS COA standard?
None of the 447 Kovera Labs certificates for the six peptides in our 2 August 2026 snapshot names an API manufacturer, reports residual solvents or covers the full HHS test table. All 447 report identity, purity and net content; 36.2% are blends. These certificates test finished vials for vendors, a different document from the API certificate HHS describes.