What a Certificate of Analysis should contain — and the red flags that indicate a problem.
A Certificate of Analysis is the single most important document in the peptide supply chain. It's the analytical proof that a batch of peptide API meets its stated specifications — identity, purity, potency, and safety. For compounding pharmacies sourcing bulk peptide ingredients, the CoA is your primary quality assurance tool and your front line of defense during a regulatory inspection.
The problem is that not all CoAs are created equal. Some are thorough, batch-specific documents from accredited laboratories. Others are generic templates with recycled data, fabricated results, or missing critical information. In the peptide market — where supply chains span multiple countries and regulatory oversight varies dramatically — knowing how to read a CoA is knowing how to protect your practice.
A legitimate, GMP-grade peptide CoA should contain, at minimum, the following elements:
| Section | What to Look For |
|---|---|
| Product identification | Peptide name, sequence (if applicable), catalog/product code, and CAS number |
| Batch/lot number | Unique identifier matching the product label |
| Manufacturing date | When the batch was produced |
| Testing date | When analytical testing was performed |
| Expiry date | Based on stability data, not arbitrary |
| HPLC purity | Percentage purity with method details (column, mobile phase, gradient) |
| Mass spectrometry | Observed vs. theoretical molecular weight — confirms identity |
| Endotoxin testing | LAL test results (required for injectable-grade material) |
| Residual solvents | Per ICH Q3C guidelines |
| Water content | Karl Fischer titration results |
| Heavy metals | ICP-MS or ICP-OES results for lead, arsenic, cadmium, mercury |
| Microbial testing | Total aerobic count, yeast/mold, absence of specified pathogens |
| Testing laboratory | Named lab with accreditation (ISO 17025 or GMP) |
| Analyst signature | Named QC personnel who approved the results |
GMP-grade CoAs are typically multi-page documents with supporting data — chromatograms, spectra, and in-process records. A single-page CoA with a purity number and nothing else should immediately raise questions.
High-Performance Liquid Chromatography (HPLC) is the standard method for measuring peptide purity. It separates the target peptide from synthesis byproducts — deletion sequences, truncated fragments, oxidized forms — and reports purity as a percentage of the total UV-absorbing peaks.
A CoA showing "98.7% purity by HPLC" means the target peptide accounts for 98.7% of the detected peptide-related material. The remaining 1.3% consists of closely related impurities from the synthesis process.
What HPLC purity does not capture is equally important: water content, counterion salts (typically TFA or acetate), and non-UV-absorbing contaminants. This is why HPLC purity and net peptide content are different numbers — a peptide can show 99% HPLC purity while the actual peptide content of the powder is 75-85% by weight, with the rest being water and salts.
For GMP pharmaceutical-grade material, expect purity of ≥98%, often 99%+. Research-grade peptides typically range from 95-98%. Anything below 95% warrants scrutiny.
Where HPLC tells you how pure a peptide is, mass spectrometry tells you what it is. The mass spec result confirms the molecular identity by comparing the observed molecular weight against the theoretical weight calculated from the amino acid sequence.
A common source of confusion is multiply charged ions. In electrospray ionization (the most common MS technique for peptides), molecules can pick up multiple protons. A 3,000 Da peptide might appear at m/z 1,501 — that's the doubly charged form [M+2H]²⁺, and it's perfectly normal. The CoA should specify the charge state. If you see an unexplained mass discrepancy with no charge state notation, that's a genuine red flag.
A CoA with HPLC data but no mass spectrometry is incomplete. HPLC can tell you a substance is pure, but without MS confirmation, you can't verify that the pure substance is actually the peptide you ordered.
In-house testing means the manufacturer's own QC lab ran the analytical work. Third-party testing means an independent, accredited laboratory performed or verified the analysis.
Both can be legitimate, but they carry different weight. In-house testing is standard at GMP manufacturers who maintain validated analytical methods and calibrated equipment. Third-party verification adds an independent check — particularly valuable when evaluating a new supplier or when the stakes are high.
The gold standard is a manufacturer with validated in-house testing plus third-party verification available on request. A supplier who only provides in-house results and refuses to send samples for independent testing is waving a yellow flag.
In the peptide market, fabricated and misleading CoAs are common enough that every buyer needs to know the warning signs. Here are the most reliable indicators that a CoA may not be what it claims:
No lot number, or lot number doesn't match the product. Every CoA should reference a specific batch. If the lot number on the CoA doesn't match the lot number on the product label, the CoA isn't for your material. This is the most basic check, and it catches a surprising number of problems.
Identical CoAs across different peptides or batches. If the same template, fonts, layout, and even values appear across multiple different peptides, the documents may be mass-produced rather than batch-specific. Legitimate testing produces different chromatographic profiles for different peptides.
Purity number with no supporting data. A CoA that states "Purity: 99.1%" without a chromatogram, method description, or testing laboratory identification is just a number someone typed. It's not analytical evidence.
Missing mass spectrometry. HPLC alone doesn't confirm identity. If a supplier provides purity data without MS confirmation, they either didn't run the test or don't want you to see the results.
No endotoxin testing on injectable-grade material. If the peptide is intended for compounding into an injectable preparation, endotoxin (LAL) testing is not optional. Its absence on a CoA for injectable-grade API is a serious gap.
Verification markers removed. Some third-party labs include QR codes, verification keys, or database lookup numbers on their reports. If these have been cropped, blurred, or removed from a CoA, someone is trying to prevent you from verifying the document independently. This is one of the strongest indicators of fraud.
Testing date predates the manufacturing date. Sounds obvious, but it happens. Check the dates — if the analytical testing was supposedly performed before the batch was manufactured, the CoA is fabricated.
Suspiciously round numbers. Real analytical results produce specific values: 98.73%, 99.14%. A CoA showing exactly "99.0%" or "98.5%" across every test parameter suggests the numbers were invented rather than measured.
Most buyers focus on HPLC purity because it's the headline number on every CoA. But net peptide content (NPC) is arguably more important for anyone doing precise work — it tells you how much actual peptide is in the powder, by weight.
A vial labeled "5 mg BPC-157" with 99% HPLC purity might contain only 3.75-4.25 mg of actual peptide, with the rest being water, TFA salt, and residual solvents. If the CoA doesn't report NPC, you're guessing about the actual amount of active ingredient in every batch.
GMP-grade CoAs from quality manufacturers will include NPC measured by amino acid analysis (AAA) or nitrogen determination. Research-grade CoAs often omit it entirely. This is another reason pharmaceutical-grade sourcing matters for clinical compounding.
Every time you receive a CoA from a supplier, run through this checklist:
Does the lot number match the product? Is the testing date after the manufacturing date? Does the document name a specific testing laboratory? Is HPLC purity reported with method details? Is MS identity confirmation included? For injectable-grade material, is endotoxin testing present? Are verification markers (QR code, report ID) intact and functional? Are the results consistent with previous batches from this supplier?
If any of these checks fail, request clarification from the supplier before using the material. A supplier who can't answer basic questions about their own CoA is a supplier you should reconsider.