Oct 28, 2026 · Dustin Robinson
On October 28, 2026, HHS announced it will not take enforcement action against licensed 503A pharmacies and physicians that compound six peptides, BPC-157, TB-500, KPV, MOTS-C, epitalon, and Semax, while FDA decides whether to formally add them to the 503A Bulks List. For an industry that has spent the last year facing warning letters, CBP seizures, and Eli Lilly lawsuits, this is the most significant federal signal yet that these peptides may have a path into mainstream medicine.
But the headline “peptides are now legal” is wrong, and businesses that read it that way could face serious consequences. What HHS issued is enforcement discretion: a decision not to take enforcement action against certain conduct, under certain conditions, for now. The law did not change. The opportunity is real, but so is its fragility.
Below is what the policy actually does, what it means for telehealth platforms and research-use-only (RUO) sellers, how compounding pharmacies can participate under the policy, and what to watch next.
What the policy actually says
The document is titled Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances (Docket No. HHS-OASH-2026-0496). It is scheduled for Federal Register publication on October 30, 2026, with a two-week comment period. It covers state-licensed pharmacies, federal facilities, and licensed physicians compounding under Section 503A. It does not cover 503B outsourcing facilities.
The discretion is narrow. It applies only to specific chemical forms of each peptide, and only for specific routes:
| Peptide | Covered routes |
|---|---|
| BPC-157 (acetate) | Subcutaneous, intramuscular, oral, topical |
| TB-500 (acetate) | Subcutaneous, intramuscular |
| Epitalon (acetate) | Subcutaneous, intramuscular, intermittent courses |
| MOTS-C (acetate) | Subcutaneous, intramuscular |
| Semax (free base) | Intranasal |
| KPV (acetate) | Topical, oral |
A few details matter more than the headline:
-
Single API only. A compounded product may contain only one listed peptide. The “Wolverine stack” of BPC-157 plus TB-500 in one vial falls outside the policy, as does pairing a listed peptide with another API.
-
Emideltide is out. The PCAC recommended against its inclusion in July, and the policy does not cover it or any other unlisted peptide.
-
HHS took a different position from FDA scientists. The policy acknowledges that FDA’s drug center (CDER) recommended against listing these peptides, while the advisory committee voted in favor. HHS chose to follow the committee’s recommendation.
-
Explicitly non-binding. The notice states it creates no legal rights and can be revisited, in whole or in part, if safety or quality problems emerge.
HHS’s stated rationale is the part every operator should read twice: the policy is meant to discourage widespread use of RUO peptides from foreign manufacturers and move patients toward a supervised channel. More on that below.
Enforcement discretion is not legalization
Under Section 503A, a pharmacy may compound with a bulk substance only if it has a USP monograph, is a component of an approved drug, or appears on the 503A Bulks List. None of these six peptides meets that test today. Compounding them remains outside those statutory criteria. HHS has simply said it will not pursue certain violations if the policy’s conditions are met.
That distinction has real consequences:
-
It can disappear overnight. Adding a peptide to the Bulks List requires notice-and-comment rulemaking. Withdrawing enforcement discretion does not require the same process. A new Secretary, a new FDA Commissioner, a serious adverse-event report, or a contaminated lot could lead HHS to reconsider the policy.
-
Courts may offer little protection. Under Heckler v. Chaney (1985), an agency’s decision not to enforce is presumptively unreviewable. That makes the policy difficult for critics to attack in court, and it may also make a reversal difficult for the industry to challenge.
-
It applies to HHS enforcement, not everyone else. State boards of pharmacy retain their own authority, and some, like Ohio, have already sent peptide warning letters. Private plaintiffs are not bound either. Eli Lilly’s campaign against peptide sellers relies in significant part on state consumer-protection and false-advertising theories that a federal non-enforcement policy does not resolve.
-
Step outside the conditions and you lose the policy’s protection. A combination vial, an API source that does not meet registration requirements, or a missing required adverse-event report could put the compounder outside the scope of enforcement discretion.
We have watched this happen before. During the GLP-1 shortage, FDA used enforcement discretion to allow certain compounding of semaglutide and tirzepatide. When the shortages were declared over, FDA ended that discretion with wind-down windows measured in weeks, and businesses built around it had to scramble. BPC-157 itself was moved to Category 2 of FDA’s interim bulks list in 2023, which is how it became subject to heightened restrictions in the first place. Regulatory status in this space can move in both directions.
Build on this policy, but build with the possibility that it could end. The businesses best positioned for the long term will be those that can adapt when the Bulks List rule is finalized or if enforcement discretion is withdrawn.
How compounding pharmacies can compound under the policy
A 503A pharmacy can now compound these six peptides with meaningfully lower federal enforcement risk, but only if every condition is met. Based on the policy as summarized by Frier Levitt and NCPA, the checklist looks like this:
-
Source from a registered, CGMP-compliant manufacturer. The original API manufacturer must be registered with FDA under Section 510 and comply with CGMP, and its facility address must appear on the certificate of analysis. A registered distributor or repacker is not enough; the underlying manufacturer has to qualify.
-
Get real analytical testing, not a generic COA. The policy sets expectations for identity, sequence, purity, potency, impurities, residual solvents, elemental impurities, microbial limits, and endotoxins. Repackagers must validate both the manufacturer and its COA.
-
Match the exact substance and route. The covered salt form, sequence, and route must line up with the table above. Oral BPC-157 is included; injectable KPV is not.
-
One API per product. No blends or stacks in a single vial.
-
Patient-specific prescriptions only. No office-use stock, no anticipatory bulk compounding beyond what 503A already allows, and no wholesale distribution.
-
Report and label. Report product information (API, strength, manufacturer and facility, dosage form, route) to FDA and state authorities, report serious adverse events and quality issues through MedWatch, explain adverse-event reporting on patient labeling, and include the statement “This is a compounded drug product. Not for resale.” There are also conditions on oral bioavailability documentation and which delivery devices can be packaged with the product.
-
Clear your state. Confirm your state board permits it. Federal non-enforcement does not override state pharmacy law.
The practical bottleneck will likely be API supply. Much of the peptide material that has fed the market has come through RUO supply chains that may not meet the registration and testing requirements. Pharmacies that secure qualified API sources early could have a real advantage, while API manufacturers that can document compliance may have a new market to serve.
What it means for telehealth companies
For telehealth, this is the opportunity many founders have been waiting for. A licensed clinician evaluates the patient, writes a patient-specific prescription, and a 503A pharmacy compounds and ships a single-API product under the policy’s conditions. That is the kind of supervised channel the policy is designed to support. Analysts estimate a potential peptide market of $2 to $3 billion, and public companies like Hims & Hers have reportedly been preparing peptide offerings. Competition could arrive quickly.
The platforms that succeed will be the ones that get the details right:
-
Your pharmacy partner is one of your biggest compliance risks. Review its API sourcing, COAs, state licenses, and adverse-event reporting process. If the pharmacy operates outside the policy, prescriptions your platform routes to it may be affected. Address those obligations, and indemnities, in your pharmacy agreement.
-
Rebuild protocols around single-API products. If your clinicians were planning stack protocols, separate prescriptions for separately compounded products may be the more conservative approach, subject to clinical judgment and applicable rules. Do not market a branded “stack” as though it were one covered product.
-
Watch the marketing. These are still unapproved drugs. Never say or imply “FDA-approved” or “FDA-cleared,” and avoid unsupported disease-treatment claims. FTC substantiation rules and state consumer-protection laws still apply, and plaintiffs’ lawyers may review your landing pages.
-
Get the medical structure right. The usual telehealth fundamentals still determine whether you are compliant: a proper MSO/PC structure where corporate practice of medicine rules apply, licensed prescribers in each patient’s state, and a genuine clinical evaluation, not a checkbox questionnaire.
-
Build an exit ramp. Because enforcement discretion can end, your model should not depend entirely on these six peptides. Platforms with a broader menu of lawful offerings may be better positioned to absorb a policy reversal than single-product peptide businesses.
The opportunity is real. But the policy favors operators building genuine medical services, not supplement-style storefronts with a physician added as an afterthought.
What it means for research-use-only companies
To understand what this means for RUO, go back to the July 23–24 Pharmacy Compounding Advisory Committee meeting. Much of the discussion behind the vote was not simply about whether BPC-157 or TB-500 had been proven safe and effective. FDA’s own reviewers said the data was insufficient, and the committee voted narrowly in favor anyway.
The argument that carried the day was practical: people are already using these peptides, often buying them from RUO sellers. Whatever you believe about the science, that demand is unlikely to disappear. The question is which channel consumers use. The medical channel provides a physician who evaluates the patient, a 503A pharmacy, verified API, dosing instructions, and adverse-event reporting. The RUO channel is not designed to provide those same protections.
HHS adopted that reasoning in its policy. Its stated goal is to discourage widespread use of RUO peptides from foreign manufacturers and move patients into a supervised setting. That is a harm-reduction rationale, and it carries three implications for RUO businesses:
-
The RUO market for these six peptides now faces competition from a supervised prescription channel.Customers who wanted a prescription option may now have one, subject to the policy’s conditions. Price and convenience will still matter, but the argument that there is no alternative is becoming harder to make.
-
Enforcement pressure on RUO may be more likely to rise than fall. Since August, FDA has stepped up enforcement against RUO sellers. With a supervised channel available, regulators may increase their scrutiny of products that appear to be marketed for human use. Marketing, dosing content, influencer promotion, and imports remain important risk areas.
-
The policy does nothing to change RUO’s legal position. “Research use only” status still depends on the product genuinely being sold for research. And retatrutide, the focus of Eli Lilly’s lawsuits, is not on the list.
There is also an opportunity here. RUO operators understand the products, customers, and logistics. Some may be well positioned to move into telehealth, partnering with physician groups and 503A pharmacies to serve customers through the medical channel. A smaller number with genuine manufacturing capabilities may become qualified API suppliers, although the registration, CGMP, and testing requirements make that a substantial undertaking, not a simple relabeling exercise.
We still represent RUO companies, and remaining in the RUO market can be a legitimate business decision when it is operated with discipline. But if you have been considering a move toward the medical channel, this policy makes a strong case for evaluating the numbers.
What happens next
The policy is a bridge to formal rulemaking, and a lot can happen before that process concludes. Here is what we are watching:
-
The comment period. Comments are open for two weeks after the scheduled October 30 publication. Pharmacies, API manufacturers, prescribers, and telehealth operators should consider weighing in on the testing burden, the single-API rule, and which peptides should come next.
-
Opposition. The Partnership for Safe Medicines filed a citizen petition asking FDA to disregard the PCAC vote, citing alleged conflicts of interest among committee members. Former FDA official Peter Lurie has publicly criticized the policy. A lawsuit is possible, but Heckler v. Chaney makes non-enforcement decisions difficult to challenge.
-
Bulks List rulemaking. Formal addition of these peptides is estimated to take 12 to 24 months. Only a final rule can formally add a substance to the list, and even that decision may later be revisited.
-
The next batch. The PCAC plans to review five more peptides at its February 2027 meeting. Whether HHS extends similar treatment to those substances may indicate whether this is a one-time decision or the beginning of a broader approach.
-
The first safety signal. HHS reserved the right to pull back if safety or quality problems emerge. A serious quality issue could have consequences beyond the pharmacy involved, giving everyone in the channel a reason to maintain high standards.
-
States and private litigants. Watch state boards, which may respond differently from HHS, as well as Lilly and other manufacturers that have demonstrated a willingness to litigate.
The bottom line
Regulation often struggles to keep pace with innovation. We saw it in cannabis, we saw it in psychedelics, and now we are seeing it in peptides. This policy acknowledges that demand already exists and reflects a decision to encourage patients to seek care through doctors and pharmacies rather than rely on unregulated research-chemical channels.
That is a significant development. It is also temporary, conditional, and subject to withdrawal. The right move is to treat it as a window of opportunity: build compliant operations, document everything, keep marketing disciplined, and design a business that can adapt whichever way the final rule goes.
LumaLex Law advises telehealth platforms, 503A pharmacies, and RUO peptide companies on these issues, from pharmacy agreements and MSO/PC structures to RUO risk and transitions into the medical channel. If you are deciding what this policy means for your business, reach out.
This article is for general informational purposes and is not legal advice. Reading it does not create an attorney-client relationship.
