The peptide website compliance checklist - 18 items, pass or fail

How to use this checklist - and what a fail actually risks

The FDA does not read your disclaimer and stop. Under the intended-use doctrine, the agency infers what your products are for from the totality of your site: product names, descriptions, images, blog posts, emails, even the accessories you cross-sell. In the March 31, 2026 batch of warning letters to seven peptide vendors, the FDA quoted product pages, marketing emails, and cart add-ons back to the operators as evidence of intended human use - while the "research use only" banner sat on every one of those pages.

So the scoring rule is brutal but honest: each item below is pass or fail, and a single fail can convert your entire catalog into unapproved new drugs in the agency's framing. A warning letter is the polite outcome. The expensive ones are the downstream effects - processors read the same letters, and a public FDA action is how stores end up on the MATCH list with funds held 90-180 days.

Work through the five surfaces in order. Products first, because no amount of clean copy saves a banned compound.

Products: the do-not-list and the compounds that end stores

1. No GLP-1 compounds. Semaglutide, tirzepatide, and retatrutide are the compounds most consistently named in recent FDA letters - they are approved or investigational drugs, and "research" framing does not change that. If any are in your catalog, this is the first thing an investigator will screenshot. Fail here and nothing else on the checklist matters.

2. No HGH, no approved drugs, no active-investigation drugs. Same logic, wider net: human growth hormone, anything with an active IND, anything already approved. The 2026 letters made a point of piercing catalog code names - a vendor listing an investigational compound under an internal SKU still got cited by chemical identity.

3. No renamed or code-named banned compounds. Worth its own line because it is the most common "clever" move we see in audits. Renaming a do-not-list compound, misspelling it, or listing it under an invented alias does not change its regulatory status - it just adds evidence of intent to evade. If your platform cannot reject these at product-create, a tired employee will eventually list one.

4. No human-use goods on the research store. Creams, topicals, personal-care items on the same domain as your RUO catalog hand the FDA its totality argument for free: this store sells things people use on their bodies. If you want to sell them, sell them - on a physically separate domain with its own catalog.

Copy: no dosing, no disease, no benefit language - on any surface

5. No dosing or administration language. Reconstitution instructions, "typical protocols," injection guidance - all of it reads as instructions for human use. The 2024 and 2025 letters to peptide retailers quoted this material verbatim, straight off the product pages.

6. No disease or condition claims. Naming any condition next to a compound is a drug claim. It does not matter that a published study said it - repeating a study's health finding in sales copy is marketing, and the FDA has cited exactly that pattern, including claims lifted from literature with the citation still attached.

7. No benefit or outcome language. "Recovery," "anti-aging," "fat loss," "performance" - softer than a disease claim, same doctrine. Benefit language tells the agency who your customer is, and it is not a laboratory.

8. Product pages read like spec sheets. Pass state: compound name, purity, mass, format, storage conditions, CAS number, COA link. Nothing addressed to a person who might use the contents. This is also the item most likely to regress - every new product, every description edit, every SEO rewrite is a fresh chance to fail. It is why we enforce it with a copy linter in code rather than a policy document nobody rereads.

Imagery: the narrow rule most people overstate

9. No media depicting or implying use. The actual rule is narrower than the folklore. A vial photo is fine. A lab shot is fine. A molecule render, an athlete in a lifestyle banner, abstract art - all fine. What fails: imagery showing a person or animal using the compound, before/after body transformations, clinical-treatment scenes, and any dosing or benefit text baked into an image or its alt text (that text is copy, held to the copy bar). Operators who nuke every photo off their site are solving the wrong problem; operators running transformation photos are handing over Exhibit A.

Sitewide surfaces: RUO banner, FDA footer, age + qualified-researcher gate

10. RUO banner on every page. Not just the homepage - every product page, every policy page, every blog post. Disclaimers do not immunize a site whose copy contradicts them, but a missing banner on even one indexed page is a free point for the other side. The exact wording matters too; see our breakdown of what an RUO disclaimer actually has to say.

11. FDA disclaimer in the footer, sitewide. The "not approved by the FDA, not for human or veterinary use" statement, rendered by the layout template so no page can ship without it. If it is pasted per-page by hand, it will eventually be missing from a page.

12. Age gate plus qualified-researcher attestation. An 18+ checkbox alone signals a consumer site. The pass state is a gate where the visitor affirms they are a qualified researcher purchasing for laboratory use, before browsing. It will not stop a determined consumer - its job is to be evidence of your intended audience, and its absence is evidence of the opposite.

Checkout and consent: the log you'll wish you had

13. A logged, per-order RUO consent. Not a checkbox that vanishes into the void - a record: order ID, timestamp, the exact attestation text the buyer agreed to. When a processor's risk team or a regulator asks "how do you ensure research use," a database of signed attestations is an answer. A checkbox you cannot produce records for is not. Our platform refuses to create an order without one; that is what "enforced in code, not memory" means in practice.

14. No copy leakage in the purchase flow. Cart, checkout, order confirmation page, packing-slip text. These surfaces get written once at launch and never re-read, which is exactly why warning letters end up quoting them. Anything a buyer sees between "add to cart" and "delivered" is copy and gets the same bar as a product page.

If you want the first fourteen items graded without doing it by hand, the free 60-second scan reads your live site the way an investigator would and emails you the report. Takes about a minute.

Email - the surface everyone forgets is copy

15. Marketing email passes the same copy bar. The FDA quotes emails in warning letters; so do processor underwriters, who join your list during review. An abandoned-cart email that says what a compound "helps with" fails the whole store, and it fails it silently, from a surface you cannot see by browsing your own site.

16. Transactional and automated flows are scanned too. Welcome sequences, restock alerts, order confirmations, review requests. The pass state is a linter that gates every send - "a human reviews every automated email" is a promise, not a system, and promises drift. This is the single most common fail we find in stores that look clean on the surface.

The cross-sell trap: bac-water, syringes, kits

17. No administration supplies, anywhere. Bacteriostatic water, syringes, alcohol wipes, "starter kits" that bundle them. This is the totality doctrine's favorite exhibit: a store that sells a compound and the exact tools to inject it has told the FDA what the compound is for, no copy required. The margin on a $4 syringe pack is not worth your catalog.

18. Reviews and testimonials are off. User-generated content is copy you do not control. One customer writing about their results puts a human-use claim on your domain, under your brand, indexed by Google. Letters have cited testimonial content the operator never wrote. Pass state: reviews disabled at the platform level, not moderated after the fact.

Scoring yourself, and why the same checklist passes processor underwriting

Count your fails. The honest bands:

• 18/18 - defensible today. Now the real question: what enforces it next month, when someone adds a product at 11pm?
• 15-17 - typical for a careful operator. The fails are usually email (items 15-16) and consent logging (item 13), the invisible surfaces.
• Below 15 - you are one competitor report or routine sweep away from a letter. Fix products and copy first, in that order.

Here is the part that makes the work pay twice: payment underwriters run something close to this exact list. High-risk acquirers reviewing a peptide merchant account application check your disclaimers, your product claims, your gates, and your email before they price you - and after approval, their monitoring re-checks all of it. The same 18 items that keep the FDA off your site keep your processing alive. Two audits, one checklist.

One honest caveat, because we do not sell guarantees: passing all 18 reduces risk, it does not eliminate it. No checklist can promise a regulatory outcome, and anyone promising you one is selling you something.

Questions, answered straight

This page is general information for store operators, not legal advice. Compound names appear only as examples of what FDA letters have cited.