Certificates of Analysis for Peptide Merchant Accounts

A certificate of analysis, usually shortened to COA, is a lab report that states what is actually in one batch of your product. It is one of the first documents a payment underwriter asks a peptide seller for. Often it is the difference between a file a risk team can score and one it declines without reading. What it will not do is make your business legal or cancel out what the rest of your website says.

Key takeaways

• A COA is a per-batch document. It names the compound, the lot, the date, the lab, and the test methods, and one report covers one batch rather than your whole catalog.
• Card network rules push this down to you. Visa requires acquiring banks to run enhanced due diligence on what it calls high integrity risk merchants, and to complete an annual control self-assessment for the categories they board (Visa, October 2024).
• A purity claim is not a test result. Researchers who bought semaglutide from online sellers advertising at least 99% purity measured polypeptide concentrations of 7.7% to 14.37% in the products that arrived (Journal of Medical Internet Research, 2024).
• Lab reports are also dispute evidence. Accertify’s 2023 to 2024 client data puts the median win rate on non-fraud chargebacks near 57%, against about 37% on fraud-coded ones.

What is a certificate of analysis?

A certificate of analysis is a document from a laboratory reporting what a specific batch of product contains. It names the compound, states the measured purity, records the methods used, and ties all of it to a lot number and a test date. One report covers one batch. It is not a certificate for your company, and it is not a certificate for a product line.

Two tests do most of the work. High-performance liquid chromatography, usually written as HPLC, separates a sample into its parts so the lab can measure how much of it is the compound you claim. Mass spectrometry confirms identity by measuring molecular weight, which tells you whether the peptide is the sequence on the label.

Those are separate questions, and that trips people up. A sample can be highly pure and still be the wrong compound. A good report answers both.

Reports on injectable formats often add sterility and endotoxin results. Endotoxins are bacterial byproducts that survive normal sterilization, and testing for them is standard practice even when a product is sold strictly for research.

Why underwriting asks for one

Because the bank behind your merchant account is required to check, and a lab report is one of the few things it can actually check.

Visa’s guidance to acquiring banks is direct about this. Merchants in what Visa calls high integrity risk categories must be underwritten, and the acquirer has to confirm that “controls are in place to detect and prevent activities that may potentially harm the Visa payment system.” Acquirers are told to “assess the Merchant’s business plan, review URLs (if applicable), type of goods or services offered, delivery methods, return policies.” Registered acquirers then complete an annual control self-assessment for each approved high integrity risk category, and are “subject to periodic reassessments (up to annually at Visa’s discretion)” (Visa, Visa Ecosystem Risk Programs Guide, October 2024).

Read that as a workflow and the request stops feeling like paperwork. Somebody at a bank signs their name to an assessment that covers businesses like yours, and does it again every year. Your product copy does not help them do that. A dated report from a named lab, tied to a lot you actually shipped, does.

This is also why the request usually arrives early rather than late. A reviewer whose own file gets reassessed wants the evidence before terms are set, not after a problem surfaces.

A purity claim is not a test result

A number printed on your product page is a claim. A report from a laboratory is a measurement. The distance between the two has been measured, and it is wide.

Researchers publishing in the Journal of Medical Internet Research in November 2024 identified 59 illegal online pharmacies selling semaglutide without a prescription, then made test purchases from six of them. The sellers advertised purity of at least 99%. Analysis of the three products that arrived measured polypeptide concentrations of 14.37%, 8.97% and 7.7% (Journal of Medical Internet Research, 2024).

That study looked at a prescription drug sold without a prescription, which is a different business from research supply. The lesson still carries. A risk reviewer landing on your site cannot tell your numbers from those numbers. A bare purity claim is worth close to nothing to them. Third-party documentation is how you separate yourself, and it is the only route that costs the reviewer no effort to verify.

What an underwriter actually reads on a report

Reviewers are not chemists and they are not trying to be. They are checking whether the document is real, current, and about you. A short list decides that:

• The lot number. It has to match a batch you actually sell. A report with no lot is a graphic.
• The date. A report from a batch you sold out of last year says nothing about the inventory on your shelf now.
• The laboratory. A named lab with an address can be looked up. “In-house testing” with no name cannot.
• The methods. HPLC and mass spectrometry results tell a reviewer that identity and purity were both tested.
• Finished product or raw material. A report on the powder your supplier shipped is not a report on the vial your customer receives, and reviewers do notice which one they are holding.
• Consistency across the catalog. Reports for two of eleven products raise the question of what happened with the other nine.

Notice what is missing from that list. Nobody is grading your purity number against a standard. They are checking whether you can produce a dated, verifiable document about a named batch. A business that can do that is a business that keeps records.

Third-party lab or supplier paperwork?

Both are useful, and they answer different questions.

A supplier report tells a reviewer what your vendor says it shipped you. An independent test tells them what is in the container that leaves your warehouse. Only the second one is evidence about your business, because it is the only one where you are the party being tested.

Most sellers who clear underwriting cleanly carry both. They keep supplier reports for every batch received, and they send samples to an independent lab on a fixed schedule rather than when somebody asks. Use a lab accredited to ISO/IEC 17025, the international standard for testing laboratories. That accreditation is itself a fact a reviewer can look up. It costs more and it is worth it.

Then publish them. A report linked from the product page it covers does more than a folder you email later. The reviewer reading your site is the one making the decision. The same logic drives the lab-report expectation in CBD and hemp payments, where a measured result is what moves a claim from assertion to something a reviewer can confirm.

What a certificate of analysis cannot do

It cannot make a sale lawful, and it cannot repair what your marketing says.

Research-use-only framing only reads as credible to a reviewer when the whole catalog points the same way. It still does not settle the legal question, which turns on how the product is advertised and sold. A lab report sitting on a page that also carries a dosing chart does not change how that page reads. It can make things worse, because purity is exactly what matters to somebody planning to inject a product. That is the pattern behind most of the declines covered in why processors decline peptide sellers.

Documentation also has nothing to say about the federal questions hanging over these compounds. A federal advisory committee made a recommendation on peptide compounding in 2026. The FDA has not adopted it. It also concerns pharmacies filling prescriptions, not research supply sold online. Whether your specific product is lawful to sell is a question for your own counsel and your own lab. A merchant account prices payment risk, which is a different question with a different answer.

Nor does a report override a written policy. Stripe’s prohibited list names “incorrectly labeled research chemicals,” and no COA cures a labeling problem. You can read the exact wording each major processor publishes in our prohibited businesses lookup.

Where lab records help after approval

Reports keep earning after the account is open, and this is the use most sellers never make of them.

Non-fraud chargebacks are the disputes where a buyer says the product was not what you described. Those are the winnable ones. Accertify’s 2023 to 2024 client data puts the median win rate on non-fraud disputes near 57%, against about 37% on fraud-coded disputes. The difference is evidence, and a lot number tied to a dated lab report is evidence.

Keep the records so you can pull them by order. When a dispute names a shipment, you want the report for that exact lot, the ship date and the tracking. That should take an hour to assemble, not a week. General dispute management practice applies here as it does anywhere. Peptide sellers just start with an advantage most merchants lack, because the product already comes with a paper trail.

Building the package before you apply

Have this ready before you fill anything in, rather than assembling it while a reviewer waits:

1. Current reports for every product you sell, each with a lot number that matches live inventory.
2. An independent test for at least your top sellers, from a named and accredited laboratory.
3. A page on your site where the reports live, linked from the products they cover.
4. Your research-use-only labeling and disclaimers, consistent across product pages, packaging and checkout.
5. Three months of prior processing statements, which pricing gets discussed against later on a call. If you are brand new and have none, see what a peptide startup sends instead of statements.

That set answers the questions a reviewer has to answer anyway. Our peptide merchant accounts page covers the rest of what a research-use review looks at, including age-gating and the dispute profile.

If you have already been declined, fix what the reviewer saw before applying again. Pull the dosing language, get current reports for the catalog, and put them somewhere visible. If an account was closed rather than declined, read what to do after a merchant account termination first, because that clock starts on its own.