PlatformPlatform overviewCOA reviewSupplier qualificationSupplier follow-up (Vera)Mock inspections (Cato)Patient traceabilityRelease workflowsChain of custodySupplier document collectionAPIPricing
SolutionsCompounding pharmacies503B outsourcing facilitiesClinicsMed spasTelehealth platformsConsultantsSolutions overview
ResourcesMethodologyOrder-level COA traceabilitySupplier packet diligenceResource libraryPublic toolsIntelligenceTrust Center
CompanyAbout VerituraWhy independentPartnersFor counselContact
Log inBook a demo

Guide: COA requirements for 503A pharmacies. Source by source.

The statute, the FDA's guidance, USP, a state rule and ICH Q7, each on what a certificate of analysis carries. Last reviewed November 11, 2026.

Five sources, one certificateStanding of each
  • 21 U.S.C. 353aFederal statute
  • The FDA's interim policy, 2025Guidance, nonbinding
  • USP <795> and <797>USP chapters
  • 16 CCR 1736.9(d)California regulation
  • ICH Q7 section 11.4ICH guideline

Each fills in part of what a COA carries. None sets out a method for checking one.

COA requirements for a 503A pharmacy, source by source.

This guide sets out what each source says about the certificate of analysis for a bulk drug substance used in 503A compounding: the federal statute, the FDA's guidance, USP <795> and <797>, and state boards. Each is quoted and cited, and the page says plainly where the sources stop.

Reviewed November 11, 2026. Quotations are the source's own words. Where this page gives our practice, it says so; that part is Veritura's reading, not a rule of the FDA, a board or USP.

The statute: 21 U.S.C. 353a(b)(1)(A)

Section 503A of the Federal Food, Drug, and Cosmetic Act is 21 U.S.C. 353a. Paragraph (b)(1)(A) sets three conditions on the bulk drug substances a 503A compounder uses. Two of them are about the supplier's paperwork.

Clause (ii). Bulk drug substances "that are manufactured by an establishment that is registered under section 360 of this title (including a foreign establishment that is registered under section 360(i) of this title)".

Clause (iii). Bulk drug substances "that are accompanied by valid certificates of analysis for each bulk drug substance".

Clause (i) is about the substance itself. Its first route reads: "comply with the standards of an applicable United States Pharmacopoeia or National Formulary monograph, if a monograph exists, and the United States Pharmacopoeia chapter on pharmacy compounding". The clause continues with two more routes for substances with no monograph. Read the full text at the source.

The section does not define "valid", and it does not say how a pharmacy is to check a certificate.

The FDA's guidance

The FDA's January 2025 interim policy on 503A bulk drug substances restates the two conditions. It is guidance and is marked nonbinding.

It says: "Bulk drug substances used in compounding under section 503A must also meet certain other requirements, including: (1) the bulk drug substance must be manufactured by an establishment registered under section 510 of the FD&C Act (21 U.S.C. 360) and (2) the bulk drug substance must be accompanied by a valid certificate of analysis (COA)."

The FDA's page for compounders on bulk and excipient suppliers adds a point about what stands behind the certificate. It asks compounders to "know the quality of the materials you get from your suppliers, including what testing the supplier does to determine the quality of the components you purchase".

Neither document sets out what makes a certificate valid.

USP <795> and <797>

We did not read the USP chapters themselves for this page. We read the Washington State Pharmacy Quality Assurance Commission's 2026 self-inspection worksheets, which restate both chapters item by item and are public. Each worksheet says it does not replace the chapter. Check every line below against your own copy of USP.

Chapter and sectionWhat the worksheet says about an APISource
<795> 6.2.1The API meets its USP-NF monograph where one exists. It has a COA with specifications and test results that "show the API meets expected quality". In the United States, it is made at an FDA-registered facility.Washington DOH 690-326, item 15
<795> 6.2.2On receipt, the pharmacy documents the date, the quantity, the supplier's name, the lot number, the expiration date and the results of any testing done in house or by a third party.Washington DOH 690-326, item 17
<797> 9.3Written procedures cover how the components of a sterile preparation are selected, received, evaluated, handled, stored and documented.Washington DOH 690-296, item 99
<797> 9.3.1The same three points as <795> 6.2.1 for an API. In addition, every API and other component is evaluated for suitability for use in sterile preparation.Washington DOH 690-296, item 100
<797> 9.3.2Packaging is examined when each lot arrives, and labeling and condition are verified. A component of unacceptable quality is rejected, labeled as rejected and kept apart from stock in use.Washington DOH 690-296, item 102
<797> 9.3.3Before use, staff confirm the component's identity and quality, that it is within its expiry date and that it was stored under the right conditions. Every package is inspected again.Washington DOH 690-296, item 104

As Washington restates them, the chapters say what a COA for an API includes: specifications and test results. They put checks on the pharmacy at receipt and before use. We did not find in either worksheet a method for checking the certificate itself.

State boards

State rules differ. Two examples follow. They are examples and not a survey, so read your own board's rule.

Washington adopts the chapters by rule. WAC 246-945-100(1): "All licensees of the commission must comply, at a minimum, with the following chapters of the United States Pharmacopeia (USP) when engaged in compounding nonsterile and sterile products for patient administration or distribution to a licensed practitioner for patient use or administration". The list that follows names USP General Chapter <795> and USP General Chapter <797>, each "official as of November 1, 2023".

California writes its own COA rule for sterile compounding. 16 CCR 1736.9(d): "All APIs used to compound a CSP shall be manufactured by an FDA-registered facility, be accompanied by a Certificate of Analysis (COA), and be suitable for use in sterile pharmaceuticals. A COA that includes the compendial name, the grade of the material, and the applicable compendial designations on the COA must be received and evaluated prior to use, unless components are commercially available drug products. When the COA is received from a supplier, it must provide the name and address of the manufacturer. An API provided with a COA without this data shall not be used in a CSP."

California's paragraph is the most specific text we read for this page. It names fields the COA carries, says the COA is evaluated before use and says what follows when the data is missing.

The sources, side by side

SourceWhat it says about the COAIts standing
21 U.S.C. 353a(b)(1)(A)(iii)"accompanied by valid certificates of analysis for each bulk drug substance"Federal statute
The FDA's interim policy, January 2025"must be accompanied by a valid certificate of analysis (COA)"Guidance, nonbinding
USP <795> 6.2.1 and <797> 9.3.1A COA with specifications and test results, as Washington's worksheets restate the chaptersUSP chapters. Washington adopts them by rule.
16 CCR 1736.9(d)Compendial name, grade, compendial designations, and the manufacturer's name and address. Received and evaluated before use.California regulation, sterile compounding
ICH Q7 section 11.4"Authentic Certificates of Analysis should be issued for each batch of intermediate or API on request."ICH guideline, addressed to API manufacturers. See the repackaged API guide.

What none of them says

Each source fills in part of what a COA carries. None of the texts we read sets out a method for checking one. That is left to the pharmacy's own procedure and to the pharmacist who decides on the lot.

Our published reading of what a valid certificate carries is at the valid certificate standard. It is Veritura's reading, not a rule of the FDA, a board or USP.

When we read a COA against it, each item comes back in one of three words: Verified, Not verified or Decision owed. A pharmacist makes the decision on the lot.

The six peptides in HHS's policy

HHS's 2026 policy on 503A compounding with six named peptide bulk drug substances adds a COA condition for those substances.

Condition 3. "The bulk drug substance is from a facility registered under section 510 (21 U.S.C. § 360) and characterized and identified in a valid certificate of analysis (COA) that includes test results consistent with existing guidance-based criteria described by FDA (see Appendix B)."

Appendix B lists the criteria. We set them out line by line at Appendix B and go through the whole policy at HHS's peptide policy, condition by condition. The policy is a draft, interim policy of enforcement discretion for six named peptides. It does not place them on the 503A bulks list.

Sources

Every source below was opened and read for this page. Last reviewed: November 11, 2026.

ICH holds the copyright in ICH Q7 and its Questions and Answers. The passages on this page are quoted with that copyright acknowledged.

We read documents. We do not test material.