Why state board verification matters

Every legitimate 503A compounding pharmacy in the United States holds an active license from the state board of pharmacy where its physical facility sits, plus a separate nonresident or out-of-state permit for every state into which it ships product. Licensure is not optional and it is not a marketing badge. It is the statutory authority that lets a facility compound, label, and dispense a sterile injectable like a GLP-1 peptide. A pharmacy without that authority is, by definition, operating outside the law, and any product it ships is unverified by the regulator that is supposed to be inspecting it.

The scale of the problem is well documented. The National Association of Boards of Pharmacy (NABP) has identified more than 40,000 websites that fail to comply with patient safety standards, and roughly 95 percent of websites offering prescription-only drugs operate illegally. That is not a fringe number. It is the base rate of the open internet for prescription medication. The good news is that a deliberate, five-to-ten-minute check using three publicly available tools will reliably separate a licensed facility from an imposter.

This guide walks you through that check. It is the operational companion to the full 503A verification framework. Use it before you authorize a refill, before you switch providers, and any time a fulfillment pharmacy name changes on your shipping notification.

The three-tool verification stack

Three tools, in order, will tell you almost everything a regulator would want to know about a compounding pharmacy. Each one answers a different question. None of them is sufficient alone.

Total elapsed time for a complete check on a typical compounding pharmacy is 5 to 10 minutes.

Step 1: NABP Verify Before You Buy

Open the NABP Safe Pharmacy lookup at safe.pharmacy/buy-safely/. Enter the pharmacy's website URL or business name into the search field.

NABP returns one of four statuses:

• Verified Online Pharmacy. The site has been reviewed against NABP's patient-safety criteria and is currently in good standing.
• Not Recommended. NABP has reviewed the site and identified compliance problems. Stop here. Do not order.
• Under Review. Investigation is open. Treat as not yet verified and proceed with extra caution at the state-board step.
• Not Listed. NABP has not reviewed the site. This is not the same as fraudulent. Only NABP-accredited pharmacies appear in the Verified list, and many legitimate small or regional 503A compounders have never sought NABP accreditation. A "Not Listed" result simply means you cannot use this tool to confirm the pharmacy and you must rely on the state-board check in Step 2.

One quick visual cue worth knowing: the .pharmacy top-level domain is controlled by NABP and cannot be forged. A site that ends in .pharmacy has, at minimum, been through NABP's accreditation process. Logos and badges on a site can be copied; the TLD cannot.

Step 2: Look up the license on the state board directly

This is the definitive step. State board records are the legal source of truth for whether a pharmacy facility is licensed.

1. Identify the pharmacy's physical state. Look on the pharmacy's About page or in the website footer for a physical address. Legitimate pharmacies are required to disclose this. If you cannot find a physical address anywhere on the site, treat that as a red flag and walk.
2. Open that state's pharmacy lookup tool. Use the table below for the ten most common states, or use the NABP member directory at nabp.pharmacy/about/boards-of-pharmacy/ for any other state.
3. Search by pharmacy name or DBA. Try the consumer-facing brand first. If nothing returns, try the legal entity name from the About page (see Common gotchas below for why this matters).
4. Confirm four data points on the record. License type must be a pharmacy facility license, not an individual pharmacist license. Status must read Active. The expiration date must be in the future. The address on the license must match the address the pharmacy publishes. Then scan for any recent disciplinary actions on the same record.
5. Check your own state's board too. Most states require an out-of-state pharmacy to hold a "nonresident pharmacy permit" before it can ship inbound. If the pharmacy is licensed in its home state but has no nonresident permit in your state, it may be shipping to you illegally, regardless of how clean its home-state license looks. The 503A vs 503B distinction shows up in license type on most state board records, so note which one is listed.

For all other states, start at the NABP member directory, which links out to every state board's verification page.

Step 3: FDA outsourcing facility check (503B only)

Compounding pharmacies fall into two regulatory categories. A 503A traditional compounding pharmacy compounds patient-specific prescriptions and is regulated almost entirely by the state board of pharmacy. It is not registered with the FDA as a manufacturer and will not appear in any FDA database. A 503B outsourcing facility compounds in larger volumes, can sell without a patient-specific prescription, is FDA-registered, is subject to current good manufacturing practice (cGMP) requirements, and is listed in the FDA's outsourcing facility database.

If a pharmacy claims 503B status, verify that claim at the FDA's Registered Outsourcing Facilities page. Each facility must re-register annually under section 503B(b) of the FD&C Act. The Outsourcing Facility Product Report posted on that page contains data for the most recent four reporting periods, roughly two years.

If the pharmacy claims 503B status but does not appear on the FDA list, that is a serious red flag. If the pharmacy explicitly identifies itself as a 503A traditional compounder, an absence from the FDA list is expected and not a problem. The mistake is treating the FDA database as a universal registry. It is not. For a deeper view of why the 503A/503B split is more consequential right now than it was two years ago, see the regulatory context for why this verification matters more now.

How to interpret the results

Four outcomes cover essentially every result you will see. Map your findings to one of them, then act accordingly.

Licensure is the floor, not the ceiling. Accreditation is the next layer beyond licensure, and a fully verified pharmacy with PCAB, ACHC, or URAC accreditation gives you a meaningfully higher floor of quality assurance than license-only verification.

Common gotchas

Four recurring patterns trip up patients trying to verify a pharmacy. Knowing them in advance saves a lot of confusion.

1. Multiple DBAs. The license is held under the legal entity name, which often does not match the consumer-facing brand on the website. If a search by brand name returns nothing, look on the pharmacy's About page or terms of service for the legal entity, then search again.
2. Parent company licensed, fulfillment site not. A national brand may hold a license at a corporate address while the warehouse that actually ships your medication is in a different state and unlicensed. Each physical site needs its own license. Ask which facility is fulfilling your prescription and verify that specific address.
3. Active in home state but not in your state. A pharmacy can be in perfect standing in its home state and still be unauthorized to ship to you. Most states require a nonresident pharmacy permit. Check your own state board's lookup with the pharmacy's name to confirm.
4. Pharmacist license vs pharmacy facility license. State board records often include both. The individual pharmacist's license is not what you want. You want the facility (pharmacy) license, which is held by the business and tied to the physical address.

Once you have run the full check and it comes back clean, you have done the work. For a curated short list of providers with verified pharmacy partners, see our compounded tirzepatide review.