STONEGATE SYSTEMSThe letter in one paragraph
On March 31, 2026, FDA issued warning letter MARCS-CMS 721805 to Prime Sciences, one of seven letters sent to research-peptide sellers in the same enforcement wave. The core finding: unapproved new drugs and misbranding under the FD&C Act. What makes this letter the one every operator should read twice is a single move Prime Sciences made and the FDA dismantled in writing - the company listed its GLP-1 compounds under coded product names. The agency identified each one by its actual pharmacology, named the real compound next to the code in the letter, and cited them as if the codes had never existed. The code names bought Prime Sciences nothing except a paper trail showing they knew what they were selling.
The coded SKUs: GLP1-R, GLP1-S, GLP1-T
The catalog pattern was simple enough that you can see the logic from the outside. Three products, three codes:
| Listed as | FDA read it as | Why it matters |
|---|---|---|
| GLP1-R | Retatrutide | Investigational drug in active clinical trials |
| GLP1-S | Semaglutide | Active ingredient in FDA-approved drugs |
| GLP1-T | Tirzepatide | Active ingredient in FDA-approved drugs |
Look at the naming scheme for two seconds and the "code" decodes itself: GLP1 plus the first letter of the real compound. R for retatrutide, S for semaglutide, T for tirzepatide. This was not encryption. It was a label that said "we know these are the compounds we should not be listing" - which is exactly how an enforcement agency reads it. A generic name would at least have been ambiguous. A systematic cipher is an admission with extra steps.
How the FDA pierced the code names - instantly, and in writing
There was no investigative saga here. No subpoena, no lab seizure, no months of forensic chemistry. FDA staff looked at the product pages, matched the codes to the compounds, and wrote the real names into the letter alongside the listed ones. The whole "piercing" happened at the reading-comprehension level, because the agency does not identify a drug by the string on your product card. It identifies a drug by what the substance is - and everything on a product page that describes what the substance does points straight at the answer.
Think about what surrounds a coded SKU on a real storefront. The molecular weight. The sequence. The category it sits in. The compounds it is cross-sold with. The search terms the page ranks for. The questions customers ask in the contact form. Every one of those signals identifies the compound independently of the name field. Renaming one field out of a dozen does not obscure anything - it just proves intent. This is the same totality-of-the-website logic the agency applies to intended use: the FDA reads the whole site, not the one field you sanitized.
The FDA reads the pharmacology, not your product name. A code name is not a disguise - it is a confession with a filing system.
Prime Sciences was not alone in the March 31 wave, and it was not even the only letter where naming games came up. The Pekcura Labs letter from the same date shows the agency running the identical playbook against a different catalog, and the Gram Peptides letter rounds out the picture of what the 2026 wave actually targeted. Seven letters, one day, one consistent method: read the site as a whole, identify the compounds by what they are, cite accordingly.
Also cited: cagrilintide, mazdutide, and the bac-water
The letter did not stop at the three coded GLP-1s. FDA also cited cagrilintide and mazdutide - both investigational compounds in clinical development - listed under their own names. That detail matters for operators who think the lesson is "don't use code names." The compounds listed plainly got cited exactly the same way as the compounds listed in code. The name treatment changed nothing in either direction, which is the entire point.
And then there is the quieter citation that most coverage skipped: the bacteriostatic water. Selling bac water alongside research compounds reads, to the FDA, as supplying the means of administration - one of the clearest intended-use signals a site can emit, because there is no research-bench story for why a customer buying a lyophilized compound also needs sterile diluent and nothing else. It is the same reason a compliant store never runs a syringe-and-supplies cross-sell. The supply aisle is not a revenue line; it is an exhibit.
Stack it up and the letter cited: three coded GLP-1s, two plainly-named investigational compounds, and the accessory product that implied how all of them were meant to be used. That is a totality case, assembled from the seller's own catalog, in one read-through.
Why renaming can never change regulatory status
Here is the structural reason the trick cannot work, ever, for anyone. Regulatory status attaches to the substance, not the label. Semaglutide is the active ingredient in approved drug products whether you call it semaglutide, GLP1-S, "Compound S," or a lot number. Retatrutide is an investigational drug in active trials under any alias. The FD&C Act's definitions run on chemical identity and intended use - there is no clause anywhere in the statute where the product name enters the analysis. A name is marketing metadata. The agency's jurisdiction is over molecules and conduct.
This means renaming is not a low-percentage play. It is a zero-percentage play with negative side effects:
- It cannot succeed, because the thing being regulated is unchanged.
- It documents knowledge. A systematic code shows you knew the real identity and knew it was a problem - the worst possible posture if enforcement escalates past a warning letter.
- It burns the good-faith defense. An operator who listed a gray-area compound openly can argue confusion about a moving line. An operator who ciphered the name cannot.
The 2026 wave settled this question in public. If your compliance plan includes "we'll just call it something else," you do not have a compliance plan - you have a countdown. For the broader pattern across every letter the agency has sent this niche, the roundup at FDA warning letters to peptide companies walks through each one.
The guardrail version of the rule: match compound identity, not the label
The operational takeaway is that your do-not-list check has to work the way the FDA works - on identity, not strings. A guardrail that blocks the exact string "semaglutide" and nothing else would have waved GLP1-S straight through. A guardrail built correctly asks a different question at product-create time: what is this substance? It matches against known synonyms, code-name patterns, research designations, and the compound class itself, and it rejects the listing before it ever exists - in the admin panel, in the import pipeline, everywhere a product can enter the system.
That is the difference between compliance as a policy document and compliance as code. A policy says "we don't sell GLP-1 receptor agonists." Code refuses to save the row. Policies depend on every person remembering the rule under revenue pressure at 11pm; code does not get tired, does not get creative, and does not rationalize that a code name is technically a different product. On a storefront where the guardrail is enforced in the software, the Prime Sciences mistake is not a temptation someone resists - it is an input the system cannot accept.
The quieter gap: misspellings and shorthand aliases
Deliberate cipher schemes are the loud version of this failure. The quiet version is more common and almost never intentional: the accidental alias. A supplier spreadsheet arrives with "sema 5mg" in a cell. A product gets keyed in as "tirzepetide" with a typo. Someone lists "reta" because that is what everyone calls it in the group chats. A shorthand like "GLP-1 blend" goes up as a bundle name. None of these strings match a naive blocklist, and every one of them is the exact compound the blocklist exists to stop.
The FDA will catch these precisely as fast as it caught GLP1-R, because - again - it is reading the pharmacology, not running string comparison. Your guardrail has to hold itself to the same standard: bounded fuzzy matching on the known shorthands (reta, sema, tirze), tolerance for common misspellings, and a hard rule that anything ambiguous gets held for human review instead of published. An alias gap is the compliance equivalent of a silent 404 - everything looks fine, all your checks pass, and the exposure is total.
Check your own catalog for accidental aliases
If you sell research peptides, here is the concrete exercise, and it takes about fifteen minutes:
- Export every product name, SKU, and description field from your store - including drafts, hidden products, and bundle components. The FDA reads pages; you should read your database.
- Search for the class, not the name. Grep for glp, sema, tirze, reta, cagri, mazdu - the fragments, not the full spellings. Fragments catch typos and shorthands that exact matches miss.
- Look at your imports. Spreadsheet-driven catalog updates are where aliases sneak in, because nobody proofreads a 40-row paste against a blocklist by hand.
- Audit the accessory aisle. If you sell bac water, syringes, or "reconstitution kits" next to research compounds, you are emitting the same intended-use signal the Prime Sciences letter cited. The disclaimer language rules in RUO disclaimer requirements do not offset it - the totality analysis counts everything.
- Then make the check permanent. A one-time cleanup decays the day the next product gets added. The fix that holds is a guardrail in the product-create path, so the scan you just did by hand runs automatically, forever, on every write.
If you would rather not do step one through four by hand, our free 60-second audit runs the scan for you - it reads your catalog the way the FDA reads it and flags do-not-list compounds hiding under any name, coded, misspelled, or shorthanded. Sixty seconds, grade on screen, no signup.
Questions, answered straight.
Did the code names reduce Prime Sciences' exposure at all?
No - and they likely increased it. The compounds were cited identically to the plainly-named ones in the same letter, and a systematic naming cipher is documentary evidence that the seller knew the compounds' real identity and regulatory problem. If enforcement ever escalates past a warning letter, that evidence cuts against the operator, not for them.
What if I list a compound by its research designation instead of a made-up code?
Same result. Regulatory status follows the substance, so a research designation, development code, or catalog number identifies the compound just as completely as its common name. The 2026 letters pierced code names across multiple sellers - the agency treats every alias as the compound it denotes.
Is bacteriostatic water itself illegal to sell?
The problem is not the product in isolation - it is the context. Sold alongside research compounds, it functions as an intended-use signal: it implies the customer will reconstitute and administer the compound. That is why the Prime Sciences letter reached it, and why a conservatively built research store carries no supply-aisle products at all.
My blocklist already includes semaglutide, tirzepatide, and retatrutide. Am I covered?
Only against exact spellings. The gap that catches real stores is the alias layer: typos, shorthands (sema, tirze, reta), supplier spreadsheet strings, and bundle names. A blocklist that matches identity rather than strings - with fuzzy handling for the known fragments - is the version of the control that actually maps to how the FDA reads a site.
This guide is general information for store operators, not legal advice.