By Dustin Robinson, JD, CPA | Founding & Managing Attorney, LumaLex Law | November 2026
BPC-157 is not legal. Not federally, and in many cases not under your state’s law either, despite what you may have seen in the headlines.
Since HHS announced its peptide enforcement discretion policy on October 28, 2026, my inbox has been flooded with the same question: “So BPC-157 is legal now, right?” Short answer: no. And that is only the first of several misconceptions spreading across social media, telehealth marketing, and peptide vendor websites.
I come at this from two angles. As an attorney, I represent compounding pharmacies, telehealth companies, and peptide businesses navigating FDA regulation. As an investor in frontier health and clinical trials, I look at the evidence the way a funder has to: what has actually been proven in humans, and what hasn’t. I like peptides. They are one of my favorite classes of molecules. That is exactly why it matters to get the facts right.
Here are the three biggest myths about BPC-157 right now, and what the law and the science actually say.
Key Takeaways
- BPC-157 is not legal or FDA-approved. HHS announced a draft, temporary enforcement discretion policy. It does not change the law or add BPC-157 to the 503A bulks list.
- State law still applies. The HHS policy does not override state pharmacy or medical board rules, which can still restrict BPC-157.
- The human evidence is thin. A 2026 review identified only three published human studies, with fewer than 30 participants combined and no randomized controlled trials.
- Research-use-only (RUO) peptides are not covered. The policy applies only to licensed 503A compounders using FDA-registered, fully tested API, one peptide per product, for patient-specific prescriptions.
- The comment period closes November 13, 2026. The long-term answer will come from FDA rulemaking, not this policy.
What HHS Actually Announced
On October 28, 2026, HHS released its “Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances.” It was published in the Federal Register on October 30 and signed by HHS Secretary Robert F. Kennedy Jr.
The policy covers six peptides: BPC-157, TB-500, KPV, MOTS-c, Epitalon, and Semax. For those six, HHS says it does not intend to take enforcement action against state-licensed pharmacies, federal facilities, and licensed physicians that compound them, but only while FDA works through rulemaking on the 503A bulks list, and only if every one of ten conditions is met.
Some context on how we got here:
- BPC-157 sat in FDA’s “Category 2” (substances that may present significant safety risks) from September 2023 until April 22, 2026. Removal from Category 2 did not, by itself, make it legal to compound.
- In July 2026, FDA’s Pharmacy Compounding Advisory Committee voted 8-6 (with one abstention) to recommend BPC-157 for the 503A bulks list.
- FDA’s own drug center (CDER) recommended against listing it. HHS sided with the advisory committee instead.
- Unusually, the policy came from the HHS Office of the Secretary rather than FDA, the agency that actually administers Section 503A.
Myth #1: “BPC-157 Is Legal Now”
Reality: Enforcement discretion is not legalization.
Enforcement discretion means the government is choosing, for now, not to enforce a rule that still exists. The underlying law has not changed. Under Section 503A of the Federal Food, Drug, and Cosmetic Act, a bulk substance used in compounding must have a USP monograph, be a component of an FDA-approved drug, or appear on the 503A bulks list. BPC-157 still meets none of those criteria.
Here is what the policy does not do:
- It is not FDA approval. Compounded BPC-157 remains an unapproved drug. Nothing in the policy establishes that it is safe or effective.
- It does not add BPC-157 to the 503A bulks list. That still requires notice-and-comment rulemaking by FDA, which could go either way.
- It is a draft, it is interim, and it creates no rights. HHS can revise or withdraw it at any time, including if a safety signal or product quality issue emerges.
- It does not cover 503B outsourcing facilities. It is limited to 503A compounders.
- It does not override state law. This is the piece almost everyone is missing. See below.
The state law problem nobody is talking about
Even if a pharmacy checks every federal box, HHS’s policy only addresses federal enforcement under the FDCA. It does not preempt state law, and it does not stop a state from acting.
That matters because compounding pharmacies are regulated mainly by state boards of pharmacy and state health departments, not by FDA. Prescribers answer to state medical boards. In practice, that creates several risks the HHS announcement does nothing to solve:
- State law may still prohibit it. Many state pharmacy laws write federal compounding standards into state law or impose their own limits on which bulk substances may be used. A non-binding federal policy statement does not change the text of those statutes and rules.
- Boards can act even when FDA won’t. A state board of pharmacy can discipline a pharmacist, and a state medical board can discipline a physician, for dispensing or prescribing an unapproved drug, even if the federal government has chosen to stand down.
- States may go different directions. Some states may adopt the HHS framework, some may ignore it, and some may reject it outright. Expect a patchwork.
- Telehealth multiplies the exposure. A telehealth company shipping BPC-157 nationwide must satisfy the pharmacy law of the state where the drug is compounded and the law of every state where a patient receives it. One compliant state does not make a 50-state business compliant.
Before you compound, prescribe, or ship, confirm the position of the board of pharmacy (and medical board) in every state you touch. Federal enforcement discretion is a floor, not a green light.
The 10 conditions for enforcement discretion
HHS’s non-enforcement position applies only when all of the following are true:
- On the list. The peptide is one of the six in Appendix A.
- Correct identity and route. For BPC-157, that means BPC-157 acetate in subcutaneous, intramuscular, oral, or topical form.
- Fully characterized. The API comes from an FDA-registered facility with a valid certificate of analysis (COA) covering identity, purity, potency, and contaminants like endotoxins, heavy metals, and microbes.
- Registered original manufacturer. The original manufacturer, not just a distributor or repacker, is FDA-registered, CGMP-compliant, and lists its facility location on the COA.
- Adverse event reporting. Serious adverse events and quality issues are reported to FDA MedWatch and relevant states.
- Required labeling. The label states: “This is a compounded drug product. Not for resale.”
- Single active ingredient. No blends.
- Oral bioavailability documentation. Oral versions require records showing the formulation is adequately absorbed in humans.
- Simple delivery device. Only an FDA 510(k)-cleared syringe may be co-packaged.
- Everything else still applies. Patient-specific prescriptions, sanitary conditions, and state pharmacy rules remain in full force.
Miss any one of these and the policy offers no protection at all.
Myth #2: “The Research Proves BPC-157 Works”
Reality: Anecdotes and animal studies are not clinical evidence.
BPC-157 has a passionate following, and I understand why. The testimonials are everywhere, and there are hundreds of preclinical papers. But as someone who invests in clinical trials, I have to separate what is promising from what is proven.
The human evidence is remarkably thin:
- A 2026 systematic review in the journal Pharmaceuticals looked at 36 musculoskeletal studies of BPC-157. Thirty-five were preclinical (rats, rabbits, and other animals).
- Across the entire published literature, there are about three small human pilot studies, with fewer than 30 participants combined.
- None of those human studies was a randomized, placebo-controlled trial, which is the gold standard for proving a drug works.
- A Phase I safety trial registered in 2015 (NCT02637284) was cancelled without published results.
Animal data does not reliably translate to humans. Immune responses, metabolism, and long-term tissue behavior differ across species. Most compounds that look good in animals fail in human trials.
What we still don’t know about BPC-157 in humans:
- Whether it actually works for any specific condition
- What dose is effective, and by which route
- How well it is absorbed orally
- What it does with long-term use
- How it interacts with other drugs or conditions
That is not a knock on BPC-157. It is a call for real research. Anecdotes are where science starts, not where it ends. The fact that HHS cited “historical use” to justify interim access doesn’t substitute for controlled trials, and FDA’s own scientists flagged the lack of adequate human data.
Athletes should also note that BPC-157 is on the World Anti-Doping Agency’s prohibited list.
Myth #3: “My Research-Use-Only Vial Is the Same Thing”
Reality: Same name on the label, completely different legal and quality picture.
This may be the most dangerous myth, because it is the one people act on. Many consumers assume that because HHS “approved” BPC-157, the vial they bought from an online peptide vendor is now fine. It isn’t.
HHS was explicit that a core purpose of the policy is to steer patients away from RUO peptides made by foreign manufacturers, which it described as a safety risk, and toward a more controlled alternative. The policy expressly does not extend to RUO API.
Here is how the two compare:
- Source: Policy-compliant BPC-157 must trace to an FDA-registered, CGMP-compliant original manufacturer. RUO products often come from unverified overseas sources.
- Testing: Compliant API needs a full COA meeting FDA criteria. An RUO vendor’s COA may be incomplete, unverifiable, or not tied to your lot.
- Prescription: Compliant products require a patient-specific prescription from a licensed prescriber. RUO products are sold as “not for human consumption.”
- Formulation: Compliant products are single-ingredient. Popular blends like BPC-157 plus TB-500 (“Wolverine stacks”) do not qualify, even from a pharmacy.
- Oversight: Compliant pharmacies report adverse events and answer to state boards. RUO vendors typically do neither.
For businesses, the risk is real. Selling RUO peptides with implied human-use claims has drawn FDA warning letters, state board actions, and CBP seizures. The HHS policy did nothing to change that exposure.
What This Means for Peptide Businesses
If you operate in this space, here is where I would focus now:
- Compounding pharmacies: Requalify your supply chain back to the original manufacturer, audit every COA against Appendix B, update labeling, and implement MedWatch reporting procedures. Confirm your state permits compounding these peptides.
- Telehealth and med spas: Make sure every prescription follows a genuine clinical evaluation, that you work with a named 503A pharmacy, and that your marketing makes no approval, safety, or efficacy claims. Drop blends from your menu.
- RUO vendors: The policy offers you no protection. If you are considering a pivot to a compliant model, the structure and sequencing matter.
- Investors: Diligence regulatory risk carefully. A business model built on a revocable, non-binding policy is not the same as one built on an approved product or a final rule.
What Happens Next
- Comment deadline: Written comments are due by November 13, 2026, on Regulations.gov (Docket No. HHS-OASH-2026-0496).
- FDA rulemaking: The 503A bulks list rulemaking will decide whether BPC-157 becomes formally eligible for compounding. That is the decision that will matter long term.
- Possible challenges: Because the policy departs from FDA scientific recommendations and typical agency practice, expect continued scrutiny from consumer and patient-safety groups.
- State action: Watch your state board of pharmacy, which can move independently of HHS.
Frequently Asked Questions
Is BPC-157 legal in the United States?
BPC-157 is not FDA-approved and is not on the 503A bulks list. Under HHS’s October 2026 draft policy, the federal government does not intend to take enforcement action against licensed 503A compounders that meet ten strict conditions. That is enforcement discretion, not legalization, and it can be withdrawn at any time.
Does the HHS policy make BPC-157 legal in my state?
No. The policy addresses only federal enforcement and does not preempt state law. State boards of pharmacy and medical boards can still restrict BPC-157 compounding or take action against pharmacists and prescribers. Check every state where you compound, prescribe, or ship.
Is BPC-157 FDA-approved?
No. BPC-157 is not approved by FDA for any use, and compounded versions remain unapproved drugs.
Can I buy BPC-157 online legally?
Products sold as “research use only” or “not for human consumption” are not covered by the HHS policy. Only BPC-157 compounded by a licensed 503A pharmacy, from compliant API, under a patient-specific prescription falls within it.
Are there human clinical trials on BPC-157?
Very few. As of 2026, published human data consists of about three small pilot studies with fewer than 30 total participants and no randomized controlled trials.
Can pharmacies compound BPC-157 and TB-500 together?
Not under the policy. One of the ten conditions is that each compounded product contains only a single active ingredient.
Does the HHS policy apply to 503B outsourcing facilities?
No. It applies to 503A compounders: state-licensed pharmacies, federal facilities, and licensed physicians.
Talk to a Peptide Attorney
LumaLex Law advises compounding pharmacies, telehealth platforms, med spas, and peptide companies on FDA and state compliance, supply chain structuring, marketing review, and enforcement response. If you are trying to figure out what the HHS policy means for your business, contact us to schedule a consultation.
Disclaimer: This article is for general informational purposes only and is not legal or medical advice. Reading it does not create an attorney-client relationship. The regulatory landscape is changing quickly; consult qualified counsel about your specific situation and a licensed healthcare provider before using any peptide. Attorney advertising.
