How to Verify Your GLP-1 Pharmacy Is FDA-Compliant: The 4-Step 503A Verification Framework

In 2026, the only legal compounded tirzepatide in the United States is dispensed by a 503A state-licensed pharmacy compounding for an identified patient against a valid prescription. Most patients on a compounded GLP-1 have never been told the dispensing pharmacy's name, much less verified its license, accreditation, or enforcement record. That gap is the verification problem this guide solves.

What follows is a four-step framework for compounded tirzepatide from a 503A pharmacy, drawn from the same pharmacovigilance methodology used for post-licensure drug safety monitoring. Patients run the four checks against the pharmacy printed on their vial label. Each step has a concrete public source, a yes/no exit criterion, and a documented record at the end. Readers who want a curated list rather than a framework can review our audit of 9 verified-safe providers, which already applies these checks at the provider level.

Verification is not panic, and it is not investigative journalism. It is structured patient-side adverse drug reaction surveillance applied to the pharmacy in the supply chain. By the end of this article, patients should have run all four checks against the pharmacy on their vial label and reached a clear pass or fail.

Why This Matters in 2026

The compounded GLP-1 landscape changed five times in roughly five months between October 2024 and March 2025. The operative timeline:

• October 2, 2024: FDA removes tirzepatide injection from the federal drug shortage list, declaring the shortage resolved (FDA Declaratory Order).
• December 19, 2024: FDA issues a second declaratory order reaffirming the resolution after a brief judicial remand.
• February 18, 2025: Enforcement discretion ends for 503A state-licensed compounding pharmacies. Compounding, distributing, or dispensing tirzepatide under 503A is no longer protected from enforcement action tied to the shortage exemption.
• March 5, 2025: The U.S. District Court for the Northern District of Texas denies the Outsourcing Facilities Association's motion for a preliminary injunction in OFA v. FDA, upholding the shortage-resolved declaration.
• March 19, 2025: Enforcement discretion ends for 503B outsourcing facilities. As the National Community Pharmacists Association summarized, "the FDA does not intend to take action against compounders for violations of the Federal Food, Drug, and Cosmetic Act arising from conditions that depend on the inclusion of tirzepatide injection products on the FDA's drug shortage list until March 19, 2025." After that date, 503B-compounded tirzepatide sits outside enforcement cover.

The operative consequence in 2026 is narrow. Lawful compounded tirzepatide must come from a 503A state-licensed pharmacy, compounded for an identified individual patient against a valid prescription, under 21 U.S.C. § 353a. Anything else (a 503B outsourcing route, a gray-market peptide reseller, a foreign import) is operating outside legal cover. For background on how the regulatory floor moved, see the March 2025 503B shutdown. The burden of confirming that 503A path now sits with the prescriber, the dispenser, and (in practice) the patient.

What a 503A Pharmacy Is (in One Paragraph)

Section 503A of the Federal Food, Drug, and Cosmetic Act describes a state-licensed pharmacy where a licensed pharmacist compounds drugs for an identified individual patient based on the receipt of a valid prescription order. FDA's Compounding Q&A is explicit: "the compounder may distribute compounded drugs under section 503A only pursuant to a valid patient-specific prescription." Three operative consequences follow. First, every dose must trace to a specific named patient and a specific prescription. Second, the pharmacy must hold an active license in the state where it operates and, for telehealth shipments, typically also a nonresident pharmacy permit in the patient's state. Third, bulk substances used in compounding must comply with United States Pharmacopeia or National Formulary monographs, be components of FDA-approved drugs, or appear on a list developed by the agency. The contrast with 503B (registered with FDA, allowed to compound bulk lots without patient-specific prescriptions, but no longer compounding tirzepatide under enforcement discretion) is covered in the bridge article: 503A vs 503B explained.

Step 1: Find Your Pharmacy's Name

Locate the dispensing pharmacy's exact legal name and state of operation. Verification is impossible if the pharmacy is hidden, and the absence of a name is itself a finding.

Patients should look in the following locations, in priority order:

1. The vial label and shipping documents. This is the definitive source. The label should show the pharmacy name, lot number, beyond-use date (BUD), and prescribing clinician. USP General Chapter <797> and basic pharmacy law require these elements on a sterile compounded preparation.
2. The provider's terms of service or fulfillment FAQ. Search the page for "pharmacy partner," "503A," or "dispensing pharmacy." Reputable telehealth providers disclose their compounding partners in plain language.
3. The formulary or prescribing-information page on the provider site. Some providers list the compounding pharmacy alongside the formulation details for tirzepatide, semaglutide, and bridging additives.
4. The patient portal order history. Receipts, shipping confirmations, and order detail pages frequently name the dispensing pharmacy even when the marketing site does not.
5. A written support ticket. If public materials do not name the pharmacy, patients should ask in writing (email or in-portal ticket, not phone) so the answer is documented.

Two concrete examples of compliant disclosure: Pomegranate publicly names BPI Pharmacy as its compounding partner, and MEDVi publicly names Belmar Pharma Solutions and Link Compound Pharmacy. In both cases the pharmacy name is verifiable through ordinary state board lookup, which is the input to Step 2.

A provider that refuses to name its 503A partner in writing fails this step. The pharmacy name is not proprietary information; it is a fact about who is putting drug substance into a sterile vial that goes into the patient's body. By now you should have a pharmacy legal name and a state of operation written down.

Step 2: Look Up the State Board License

Confirm an active, unrestricted pharmacy license in the state where the pharmacy operates and, for telehealth shipments, in the state where the patient lives. State boards of pharmacy maintain free public lookup portals. Two paths cover almost every patient.

Path A: NABP consumer search. The National Association of Boards of Pharmacy operates a consumer-facing safety check at safe.pharmacy/buy-safely. Patients enter the pharmacy's website URL and receive one of three statuses: Verified, Not Recommended, or Not Reviewed. Verified pharmacies typically use a .pharmacy domain. Most compounding pharmacies do not, so a Not Reviewed result is not automatically disqualifying; it simply means NABP has not reviewed that specific site.

Path B: The state board of pharmacy direct lookup. This is the authoritative source for license status. The 10 most common states for telehealth GLP-1 dispensing:

Patients in states not listed can locate their state board through the NABP member directory.

For each lookup, four data points need confirmation: license type (the pharmacy facility permit, not just an individual pharmacist license), status (active, in good standing), expiration date (not lapsed), and disciplinary history (no suspensions, restrictions, or open consent orders). California's portal flags disciplinary records under an "Actions" column. North Carolina's and Illinois's IDFPR portals are both recognized by The Joint Commission as primary sources for verification (Illinois also by NCQA and HFAP). The bridge article look up your pharmacy's state license walks through state-by-state nuance for telehealth nonresident permits.

A note on nonresident permits: most states require a pharmacy that ships prescriptions across state lines to hold a nonresident pharmacy permit in the destination state. A patient in Ohio receiving a vial compounded in Texas should ideally see active licenses in both Texas and Ohio. The patient's own state board lookup is the authoritative answer.

By now you should have a printed or screenshotted active-license confirmation that matches the pharmacy name from Step 1, with a clean disciplinary record on file.

Step 3: Check Voluntary Accreditations

Confirm whether the pharmacy carries voluntary accreditation that goes beyond the state license floor. State licensure is the regulatory minimum. Accreditation is the ceiling. Three bodies matter for compounding pharmacies dispensing GLP-1 medications.

PCAB (Pharmacy Compounding Accreditation Board). Originally an independent body, PCAB is now operated under ACHC. PCAB accreditation aligns pharmacies to USP General Chapter <795> (non-sterile compounding) and USP General Chapter <797> (sterile compounding); the two tracks are separate accreditations. PCAB is widely described as the benchmark for compounding-pharmacy quality systems.

ACHC (Accreditation Commission for Health Care). ACHC is the parent organization, with 27 accreditation programs covering home health, hospice, specialty pharmacy, infusion pharmacy, and PCAB compounding pharmacy. Public verification runs through the ACHC Find Organizations directory, searchable by organization name, location, or program type including "PCAB Compounding Pharmacy."

URAC (formerly Utilization Review Accreditation Commission). URAC accredits specialty, mail-service, and infusion pharmacies, plus pharmacy benefit management. The URAC Directory of Accredited Organizations is searchable by organization name, program (40+ options), city, and state. URAC is less directly tied to compounding than PCAB but relevant for telehealth dispensers and specialty pharmacies that ship across state lines.

The underlying technical standard for sterile compounding is USP General Chapter <797>, which establishes requirements for compounded sterile preparations administered by injection, intravenous infusion, intraocular injection, or intrathecal injection. Revised <797> took effect November 1, 2023 and now governs beyond-use date assignment, environmental monitoring, and personnel qualification. PCAB and ACHC accreditation map directly to these standards.

A concrete example of the strongest accreditation profile available: Eden uses a triple-accredited pharmacy partner carrying PCAB, ACHC, and URAC. That combination is rare and signals a quality system audited against three independent rubrics. The deep dive on what each body actually inspects sits in the bridge article on triple-accreditation standards.

Accreditation is voluntary. Its absence is not automatically disqualifying. Its presence, particularly across multiple bodies, is meaningful evidence of a quality system operating well above the state minimum. By now you should have a yes or no on at least one accreditation, with a directory record screenshot if yes.

Step 4: Search the FDA Warning Letters Database

Search FDA's public warning-letter record for the pharmacy name and any prior corporate names. Warning letters are the most direct public record of compliance failures at a compounding pharmacy.

The primary source is the FDA Warning Letters database, searchable by recipient name, subject keyword (for example, "compounding" or "sterile"), and date range. A companion page at Compounding: Inspections, Recalls, and Other Actions aggregates compounding-specific enforcement actions in table form.

What to look for:

• Any warning letter naming the pharmacy directly.
• Any compounding-related letter citing sterile-preparation failures, environmental monitoring deficiencies, or USP <797> violations.
• Any unresolved letter older than 12 months without a documented closeout response.
• Letters issued under a prior corporate name. Pharmacies that go through mergers, ownership changes, or rebrands sometimes leave a warning-letter history under the previous name.

A single resolved warning letter from years ago, paired with documented corrective action and no subsequent issues, is not necessarily disqualifying. Multiple letters, recent letters (within the past 24 months), or unresolved letters are. By now you should have a documented yes or no on warning-letter history, with copies of any letter found.

Red Flags That Should Stop a Patient Cold

The four steps produce a pass or fail per pharmacy. Certain findings convert directly to "stop, do not investigate further":

• The provider refuses to name the dispensing pharmacy in writing. Step 1 has to pass before the others can run. Treat as failing the framework outright.
• No active state pharmacy facility license in the state where the pharmacy operates, or a license that is suspended, restricted, lapsed, or under an active consent order.
• No nonresident pharmacy permit in the patient's state, where one is required. Most states require a nonresident permit for a pharmacy shipping prescriptions in.
• An FDA warning letter on file for sterile-compounding violations with no documented corrective action or closeout.
• A BBB rating of F driven by pharmacy-quality complaints rather than billing disputes. The distinction matters: a billing-only F pattern points to the telehealth provider's customer service, not the compounding pharmacy. A pattern of contamination, mislabeling, or wrong-formulation complaints points to the pharmacy itself.
• A provider claiming compounded tirzepatide via a 503B outsourcing facility. Since March 19, 2025, this route has been outside enforcement discretion. A current 503B claim is not a mistake; it is a misrepresentation.
• A vial label missing the pharmacy name, lot number, or beyond-use date. USP <797> and basic pharmacy law require these elements. Their absence is a labeling failure, regardless of what is actually in the vial.

Any one red flag is sufficient. The framework is not a points system, and the goal is not to count flags.

What Good Looks Like

A passing provider produces a clean four-step audit trail. The cleanest pattern: the provider names a specific 503A pharmacy in writing, that pharmacy holds an active state facility license with no disciplinary record, the pharmacy carries voluntary PCAB or ACHC accreditation, and no relevant FDA warning letter is on file.

Three concrete examples drawn from VST's audited provider set:

• Pomegranate publicly names BPI Pharmacy as its compounding partner. BPI is verifiable through standard state board lookup, which clears Steps 1 and 2 in a single chain.
• MEDVi publicly names Belmar Pharma Solutions and Link Compound Pharmacy. Patients can run both pharmacies through their respective state boards independently, which is the strongest configuration for a multi-pharmacy network.
• Eden uses a triple-accredited pharmacy partner carrying PCAB, ACHC, and URAC. That combination is the strongest accreditation profile available for a 503A and clears Step 3 with the highest possible score.

Naming the pharmacy is the gating decision. Providers that decline to name their pharmacy partner publicly are not always non-compliant, but they make Step 1 impossible, and therefore make Steps 2 through 4 impossible. They should be treated as failing the framework on Step 1 alone. A provider in this situation can re-pass simply by disclosing the pharmacy name in writing on request. The audited lineup of providers that pass the full framework is documented in the audit of 9 providers ranked by safety.

What to Do If Your Pharmacy Fails Verification

A verification failure is a switching decision, not an emergency, unless it is paired with an active adverse event. The recommended sequence:

1. Stop placing further refill orders with the failed provider. Pause auto-renewal in the patient portal.
2. Document what failed. Note the specific step, the search terms used, the result returned, and the date. Screenshots are useful if escalation is later needed.
3. Ask the prescribing clinician for an alternative source. A licensed prescriber can re-route the prescription to a different 503A pharmacy. This is a routine request.
4. Review providers that pass the framework. The audited list at /safest-compounded-tirzepatide/ applies these checks at the provider level.
5. If there is also an adverse event, file a MedWatch report at fda.gov/safety/medwatch. Adverse-event reporting is independent of the verification failure and should not be skipped on the assumption that someone else is reporting.

A regulatory or licensing failure does not always require throwing out remaining medication. If the failure is product-quality (warm-shipped vials, suspected wrong formulation, missing label, visible particulates), the medication should not be used and should be discussed with the prescriber. If the failure is purely regulatory (lapsed license, missing accreditation), finishing the current vial under medical supervision is generally reasonable. The switching decision applies to refills.

Related Safety Topics

• The March 2025 503B shutdown: the regulatory timeline that made 503A verification load-bearing.
• 503A vs 503B explained: the statutory distinction between the two compounding pathways.
• Look up your pharmacy's state license: state-by-state walkthrough of licensing portals, including nonresident permits.
• Triple-accreditation standards: what PCAB, ACHC, and URAC actually inspect.

More from VST: the audit of 9 providers and how to recognize and report adverse events.

FAQ

What is a 503A pharmacy?

A 503A pharmacy is a state-licensed pharmacy where a licensed pharmacist compounds drugs for an identified individual patient based on the receipt of a valid prescription order, under 21 U.S.C. § 353a. Compounded drugs from a 503A pharmacy are exempt from new drug approval, adequate-directions-for-use labeling, and current good manufacturing practice requirements that apply to mass-produced FDA-approved drugs, provided the statutory conditions are met.

Can a 503A pharmacy legally compound tirzepatide in 2026?

Yes, but only as a personalized formulation for a specific patient with a valid prescription, not as an essentially-a-copy duplicate of Mounjaro or Zepbound. FDA enforcement discretion tied to the tirzepatide shortage ended February 18, 2025 for 503A pharmacies. Lawful 503A tirzepatide in 2026 is a patient-specific compounded preparation (typically tirzepatide combined with B6, niacinamide, B12, or another clinically justified additive), prescribed by a licensed clinician for an individual patient.

How do I verify my GLP-1 pharmacy is FDA-compliant?

Run the four-step framework above. Step 1: confirm the pharmacy's exact legal name. Step 2: look up its state board license. Step 3: check for PCAB, ACHC, or URAC accreditation. Step 4: search the FDA warning-letter database for the pharmacy name. Each step has a public source and a yes-or-no exit. A pharmacy that clears all four is operating within the regulatory framework. A pharmacy that fails any step warrants a switching decision.

Is compounded tirzepatide from a 503B outsourcing facility legal?

Not since March 19, 2025. On that date, FDA enforcement discretion ended for 503B outsourcing facilities compounding tirzepatide. Any provider currently claiming compounded tirzepatide sourced from a 503B facility is operating outside enforcement cover. The legal pathway in 2026 is 503A, with patient-specific prescriptions, only.

What if my provider will not tell me which pharmacy ships my prescription?

That is a verification failure on Step 1. The pharmacy name is not proprietary information; it is a fact about who is compounding the medication. A provider that declines to disclose this in writing makes Steps 2 through 4 impossible to run, which means the rest of the framework cannot pass. Treat this as a switching decision and ask the prescribing clinician to redirect the prescription to a 503A pharmacy that the provider is willing to name.