STONEGATE SYSTEMSIf you sell research peptides and you've ever considered listing a restricted compound under a code name, this letter is the clearest evidence yet that the idea is already dead. Here's the whole story in the time it takes to drink a coffee.
The letter in one paragraph
On March 31, 2026, the FDA issued warning letter MARCS-CMS 721709 to PekCura Labs. The core finding: the company was marketing unapproved new drugs and misbranded drugs, because products sold under the labels GLP-1-S, GLP-2-T, and GLP-3-R were, per the agency's own review, semaglutide, tirzepatide, and retatrutide - active ingredients in approved or investigational drug products that cannot be sold as "research chemicals" to the public. The letter walked through the site's totality: the coded product pages, the surrounding marketing context, and the accessories sold alongside them. PekCura got the standard 15 business days to respond with corrective actions. The letter went up on the FDA's public warning-letter database, where every payment processor's risk team and every merchant underwriter can - and does - read it.
It was one of a batch of letters the FDA sent to peptide vendors that same day - seven companies in one sweep. If you want the full landscape, our index of FDA warning letters to peptide companies tracks every letter in the category with dates and citations.
The codes: GLP-1-S, GLP-2-T, GLP-3-R
Look at the naming scheme for a second, because it tells you how thin the disguise was:
| Listed as | What the FDA identified it as | Regulatory status |
|---|---|---|
| GLP-1-S | Semaglutide | Active ingredient in approved drug products |
| GLP-2-T | Tirzepatide | Active ingredient in approved drug products |
| GLP-3-R | Retatrutide | Active ingredient in an investigational drug |
The trailing letter is the first letter of the compound. S for semaglutide, T for tirzepatide, R for retatrutide. This wasn't cryptography - it was a nod and a wink, designed so that buyers arriving from a Reddit thread or a Telegram group would know exactly what they were ordering while the product page technically never said the word. The FDA's investigators are the one audience that scheme cannot work on, because they don't need the label to tell them what's in the vial. They test, they read the community chatter, and they read the sequence data on the certificates of analysis vendors publish themselves.
The intended-use doctrine makes the code name legally worthless anyway. Under it, the FDA infers a product's intended use from the totality of the circumstances - the site, the marketing, the customer base, the surrounding product mix - not from what the seller chooses to call it. A name never changes the regulatory status of the molecule behind it. We break down how that doctrine works, letter by letter, in our guide to the FDA intended-use doctrine for peptides.
Prime Sciences, same day - obfuscation as a category, not a one-off
Here's the part that should change how every operator thinks about this. The same day PekCura's letter went out, March 31, 2026, the FDA issued a warning letter to Prime Sciences - a different company, a different site, but the identical playbook: GLP-1 compounds sold behind coded product names. We covered that letter in full in the Prime Sciences warning letter breakdown.
One vendor getting caught with code names could be bad luck - an investigator happened to be looking, a competitor filed a complaint, a customer got hurt and reported it. Two vendors caught running the same disguise, cited in letters issued the same day, is something else entirely. It means the agency treated obfuscated GLP-1 listings as a category of violation, worked the category systematically, and released the results as a batch. The letters even share structure: same statutory citations, same walk through the intended-use evidence, same accessory-product findings.
The batch wasn't limited to code-name cases either. The same sweep produced letters for vendors selling restricted compounds under their real names - the Gram Peptides letter is the clearest example - which tells you the scan wasn't keyed to a keyword list. It was keyed to the compounds themselves, however they were spelled.
What the pairing tells you: the FDA scans for this pattern now
Put yourself in the agency's chair. GLP-1 compounds are the highest-profile drug category in America. The FDA knows gray-market vendors want to sell them, knows the approved versions are protected, and knows the obvious workaround is a coded listing. Finding those listings does not require heroics:
- The naming patterns are guessable. "GLP-1-S", "GLP #1", compound abbreviations, molecular-weight references - there are only so many ways to hint at semaglutide without writing it, and all of them are searchable.
- The community indexes vendors publicly. Forums and social groups list which code maps to which compound, because buyers need the decoder ring too. Investigators read the same threads.
- Vendors publish their own evidence. A certificate of analysis showing a molecular weight of 4113.6 identifies semaglutide regardless of what the product page says.
Once the detection method exists and has produced public results, it doesn't get retired - it gets rerun. Every operator should assume that coded GLP-1 listings are now a standing search, the way processors run standing searches for card-brand violations. The March 31 batch was the first harvest, not the last.
And the FDA is only the first reader. Warning letters are public. Payment processors, banks, and shipping carriers all screen against the warning-letter database, and a letter is one of the fastest routes to a frozen merchant account and a place on the MATCH list. The regulatory hit and the payments hit arrive as a package.
The bac-water citation, again
Buried below the headline findings is a citation that repeats across nearly every letter in this category: the accessory products. Selling bacteriostatic water, syringes, or injection supplies alongside "research-use-only" peptides was cited as evidence of intended human use. The logic is blunt and hard to argue with - a research lab buying a lyophilized compound for in-vitro work doesn't need a sterile-injection kit in the same cart. The cross-sell is the tell.
This is the cheapest violation to have, because the accessory products barely make money and they convert the entire catalog into evidence. It shows up in the 2024 and 2025 letters too - the Summit Research Peptides letter and the Pinnacle Peptides letter both cite the same pattern - which means vendors had two years of public warning before the 2026 sweep and many kept the cross-sell anyway. Our peptide website compliance checklist puts "no supply products, ever" near the top for exactly this reason.
The only safe move: don't carry the compound at all
After PekCura and Prime Sciences, the decision tree for restricted compounds is short:
- List it under its real name? That's the Gram Peptides letter. Direct citation, no defense.
- List it under a code? That's PekCura and Prime Sciences. Same citation, plus you've demonstrated you knew it was prohibited - which reads worse in every follow-up interaction with the agency, and worse still to a processor's risk team deciding whether you're a merchant who plays games.
- Don't list it. The only branch that ends with your store still standing.
There is no fourth branch. No disclaimer strengthens branch one, and no naming cleverness rescues branch two - the intended-use doctrine pierces both. The margin on a restricted compound is real, and so is the math against it: one letter and you lose the whole store, the merchant account, and 90-180 days of held funds, against a few months of extra revenue on one SKU. Operators who did that math late are a large part of why peptide companies keep shutting down.
How product-create enforcement makes the mistake impossible
Here's the operational lesson, and it's the reason this letter matters to stores that would never dream of coding a GLP-1 listing. PekCura's violation wasn't a copy mistake - it was a catalog mistake. It happened at the moment someone created a product. Any compliance process that runs after that moment (a monthly review, a lawyer's read-through, a linter on your copy) is auditing a violation that has already been live and archived by crawlers.
The fix is to move enforcement to product-create time. Every store we build runs a do-not-list guardrail in code: when anyone - owner, admin, or a hired VA who doesn't know the rules - tries to create a product, the compound is checked against a maintained restricted list before the row ever exists. The check normalizes names, so semaglutide, sema, and a cute code with an S bolted on all resolve to the same rejection. There is no override in the admin panel. The mistake PekCura made cannot be made on the platform, because the software refuses to store it.
That's the difference between compliance as a policy and compliance as construction. A policy depends on every person who ever touches the catalog knowing and caring. Code doesn't forget, doesn't get a new hire, and doesn't rationalize one high-margin exception at 11pm. The rules will keep moving - the restricted list gets longer, not shorter - so ours is reviewed by a human monthly and updated fleet-wide. Enforced in code, watched by a human. That's the whole model.
This guide is general information for store operators, not legal advice. Facts are drawn from the FDA's published warning letter (MARCS-CMS 721709, March 31, 2026); read the primary source on the FDA's warning-letter database before making decisions about your own catalog.