The COA gaming problem — why "third-party tested" doesn't always mean what you think

"Third-party tested" has become table stakes language in the peptide space. Almost everyone uses it. The phrase costs nothing to include on a website. What it means in practice depends entirely on what testing was actually done, by which lab, on which sample, and whether any of it can be independently verified.

The COA — certificate of analysis — is the document meant to answer those questions. A legitimate COA is a formal report issued by a testing laboratory that identifies the specific lot tested, lists the test methods used, and states the results. It's the paper trail between a claim ("this product is 99% pure BPC-157 at the stated concentration") and the analytical work that would support that claim. In the pharmaceutical and pharmaceutical compounding world, COA standards are defined by practice and regulation. In the research peptide gray market, COA standards are whatever any individual company decides they are, which is a meaningful problem.

The forms of COA misrepresentation in the broader peptide market are worth naming specifically, because they're not all the same and they're not all equally easy to detect.

Lot recycling is one of the most common. A company tests one batch of a compound — a legitimate test, conducted by a real lab — and then uses that COA for multiple subsequent production runs. If the synthesis quality varies across batches, which it typically does to some degree and can vary dramatically in less-controlled operations, the COA from batch one tells you nothing meaningful about batch six. The lot number on the COA doesn't match the lot number of what you received, because the company didn't bother to print different lot numbers on the product, or because you have no way to check. Lot recycling allows a company to demonstrate good quality once and coast on that demonstration indefinitely. It's also extremely difficult to detect without access to batch production records that most gray-market suppliers don't maintain or share.

Testing for identity but not for potency is a separate problem. Mass spectrometry — particularly high-resolution LC-MS or MALDI-TOF — is the standard method for confirming that a peptide is what it claims to be. It verifies the molecular weight and fragmentation pattern. What it does not verify, on its own, is how much of the compound is present. A vial that contains a detectable trace of BPC-157 will pass a mass spec identity test. If the actual concentration is a fraction of what the label states, the identity test won't catch it. Potency verification requires a separate quantitative assay — HPLC with a calibration standard, for example — and many COAs in the research peptide market either omit potency testing or use methods that aren't rigorous enough to catch significant underdosing.

Testing for the compound of interest but not for impurities is related. Even a product with correct identity and approximately correct potency can carry impurities that matter: incomplete synthesis byproducts, degradation products, residual synthesis reagents, residual solvents from the manufacturing process. A COA that lists identity and purity by a single HPLC trace using the compound itself as the only reference point will miss many of these impurities. Comprehensive impurity profiling requires multiple analytical approaches and appropriate reference standards. It's not commonly done in the research peptide gray market.

Reference sample testing is a subtler problem. Some testing is done not on the actual finished product but on a reference sample — a small quantity of highly purified material prepared specifically for the test. If the reference sample is not drawn from the actual production batch but is instead the manufacturer's own high-quality benchmark material, the COA reflects the purity of that benchmark, not the purity of what's in the vials you receive. This practice is not always detectable from the COA document itself, because the COA may accurately describe what was tested. The question is whether what was tested represents what was sold.

Outright fabricated COAs exist as well. This is the extreme end, but it happens. A COA is a document, and documents can be created with design software. Labs named on COAs sometimes don't exist, or exist but didn't conduct the testing attributed to them. Some testing labs are real entities but are not accredited and operate with no meaningful external oversight — a lab is a lab only in the sense that it has a name and issues documents. Verifying that a lab is legitimate requires checking for recognized accreditation: ISO 17025 is the international standard for testing and calibration laboratories, and accreditation to that standard means the lab has been audited by an accrediting body for its technical competence and quality management. Without that accreditation or an equivalent, a lab is self-describing its own competence, which tells you relatively little.

The legitimate COA — the document that actually demonstrates what a COA is supposed to demonstrate — has a specific structure. It names an accredited independent laboratory, not the manufacturer's own internal lab. It references a specific lot number that corresponds to the product as sold. It includes identity verification by mass spectrometry with the mass and fragmentation results stated. It includes potency quantification by a validated method — HPLC with stated methodology and comparison to a reference standard — with the result expressed as a percentage of label claim. For injectables, it includes sterility testing results showing absence of viable microorganisms, and endotoxin testing results using LAL or a comparable method with results stated in EU per mL or equivalent units. It includes purity results, typically by HPLC, showing the area percentage for the main compound and the profile of related impurities. It may include residual solvent testing if solvent use is part of the synthesis pathway.

The prescription compounding pharmacy environment operates with COA standards that are structurally more rigorous than the gray market. Licensed 503A pharmacies are required to conduct or obtain testing on their compounded preparations, and state pharmacy boards and FDA oversight mean there is accountability for the testing practices that a gray-market supplier simply doesn't face. This doesn't mean every compounding pharmacy COA is perfect, or that there's no variability in testing quality across the compounding pharmacy sector. There is variability. But the structural requirement for COA documentation as part of a licensed operation — with a pharmacist's license on the line and audit risk from multiple regulatory bodies — creates a different baseline than the research peptide market where testing is voluntary and unverified.

The questions that let you evaluate a COA critically are not complicated, but they require actually asking them and being skeptical of inadequate answers. Which laboratory conducted the testing, and is that laboratory ISO 17025 accredited or holds equivalent recognized accreditation? What is the lot number on the COA, and does it match the lot number of the product you received? Was potency tested quantitatively, with what method, and what was the result relative to label claim? Was sterility tested, and what was the result? Was endotoxin tested, and what was the result? Was purity tested by HPLC, and what does the impurity profile look like? Can you request the actual COA for your specific lot rather than a generic document on the website? A supplier that has genuinely done this work will have answers. A supplier that is using COA language as marketing will either deflect, provide vague responses, or share documents that fail one or more of these criteria on inspection.

The underlying market dynamic that drives COA gaming is straightforward: rigorous testing is expensive, and the buyers who would catch inadequate testing are a small fraction of the market. Most buyers do not have the background to evaluate a COA technically, and most do not request lot-specific documentation. This means the competitive pressure runs toward testing just enough to make a credible-sounding claim rather than toward comprehensive quality verification. That dynamic is not going to self-correct. It's one of the structural reasons why supply chain and regulatory framework matter alongside — and arguably more than — any individual supplier's claims about their testing practices.

The thing to walk away with isn't that all testing claims are lies or that every COA is fabricated. Some research peptide suppliers do real testing. Some do partial testing. Some recycle COAs. Some fake them. The identical-sounding claim — "third-party tested, COA available" — covers all of these situations equally. Evaluating a supplier means going past the phrase and into the specifics: which lab, which lot, which tests, what results, and can you verify it. The answers to those questions tell you far more than the marketing language does.