COA Authenticity Verification: How Falsified Certificates of Analysis Survive Scrutiny

COA authenticity verification is the step almost no research peptide buyer performs, and it is the only step that distinguishes a genuine analytical report from a PDF someone edited. A certificate of analysis is a document, not a measurement, and documents are trivially forged. The World Health Organization has confirmed at least one falsified manufacturer certificate of analysis inside an active pharmaceutical supply chain contamination event, and the United States Food and Drug Administration issues warning letters every year to firms that accepted supplier certificates without independent confirmation.

The research peptide market has spent the last three years converging on certificate of analysis publication as a trust signal. Nearly every serious vendor now links a PDF. That convergence has quietly destroyed the signal value of simply having a certificate, because the marginal cost of producing a convincing but fictitious document is now close to zero. What remains meaningful is whether the document resolves back to the laboratory that supposedly issued it, and whether the sample the laboratory tested bears any traceable relationship to the vial in a researcher’s freezer.

What a Certificate of Analysis Actually Proves

A certificate of analysis is a summary attestation. It states that a named laboratory received a sample, applied specified analytical methods, and obtained specified results on a specified date. Every one of those claims is an assertion by the issuing party. The certificate itself contains no cryptographic proof, no chain of custody record, and in most cases no raw chromatographic data. A purity figure of 99.1 percent printed on a page is a claim about a sample that a researcher has never seen and cannot re-examine.

This distinction matters because the peptide category has trained buyers to read certificates as though they were measurements. They are closer to receipts. The underlying analytical work may be excellent, mediocre, or entirely fictional, and the document looks identical in all three cases. Reading the numbers correctly is necessary but not sufficient, which is why the interpretive skill covered in our guide to reading a peptide certificate of analysis has to be paired with an authenticity check that operates on the document itself.

The Documented Record of Falsified Certificates

WHO Medical Product Alert No. 4/2024

On 10 October 2024 the World Health Organization published Medical Product Alert No. 4/2024 concerning falsified DOW USP/EP propylene glycol detected in Pakistan in August 2024. The alert is unusually explicit about the document layer of the fraud. WHO recorded that DOW confirmed in September 2024 that the materials were falsified and had not been manufactured or supplied by DOW, that all three batch numbers printed on the container labels were themselves falsified, and that at least one falsified DOW certificate of analysis for one of the batches was identified. Laboratory analysis confirmed by the Drug Regulatory Authority of Pakistan on 8 October 2024 found batch F8900L8PPD6 contaminated with ethylene glycol at 0.7624 percent v/v.

The structure of that event is worth sitting with. The falsified certificate was not a crude fake circulating on a forum. It was a document good enough to move material through a regulated pharmaceutical supply chain into finished oral liquid medicines, and it accompanied batch numbers that were also invented. The only thing that broke the chain was independent laboratory testing of the incoming material, not scrutiny of the paperwork. WHO had issued a parallel alert, Medical Product Alert No. 1/2024, in April 2024 covering five earlier falsified batches of the same excipient.

The Heparin Precedent

The 2008 heparin contamination event remains the canonical case of an adulterant engineered to defeat routine identity testing. Guerrini and colleagues reported in Nature Biotechnology in 2008 that the contaminant in suspect heparin lots was oversulfated chondroitin sulfate, with the structural assignment independently confirmed by four laboratories. The contaminant carried a disaccharide repeat of glucuronic acid linked beta-1,3 to N-acetylgalactosamine with sulfation at the 2-O and 3-O positions of the glucuronic acid and the 4-O and 6-O positions of the galactosamine.

Oversulfated chondroitin sulfate was selected precisely because it mimicked heparin in the standard in-vitro assays of the period while costing a small fraction of genuine crude heparin to produce. Certificates issued against those assays would have been arithmetically correct and substantively meaningless. Detection ultimately required orthogonal methods, principally proton nuclear magnetic resonance and capillary electrophoresis, which were not part of the routine specification. The lesson generalizes directly to peptides: a certificate can only fail to detect what its method was never designed to see, a limitation examined further in our analysis of what a purity number does not tell you.

Key Research Findings

• WHO Medical Product Alert No. 4/2024 (10 October 2024) documented at least one falsified DOW certificate of analysis accompanying three falsified batch numbers of USP/EP propylene glycol detected in Pakistan.
• DRAP laboratory analysis confirmed 8 October 2024 that falsified batch F8900L8PPD6 contained ethylene glycol at 0.7624 percent v/v, a contaminant absent from the accompanying documentation.
• Guerrini et al., Nature Biotechnology, 2008, identified oversulfated chondroitin sulfate as the heparin contaminant, with structural assignment confirmed independently by four laboratories using NMR and capillary electrophoresis.
• More than half of the CGMP warning letters FDA issued to pharmaceutical manufacturers in 2025 cited 21 CFR 211.84(d)(1) on component identity testing, with reliance on a supplier certificate of analysis without independent verification appearing repeatedly (Ojeda, AssurX, June 2026).
• At least eight additional pharmaceutical warning letters since 2025 cite the same pattern of accepting supplier certificates in place of independent identity confirmation.
• FDA has stated in warning letter correspondence that comparing a certificate from a contract manufacturer to pre-approved specifications does not discharge a firm’s obligation to evaluate, qualify, audit and monitor that contractor.

How Regulators Treat an Unverified Certificate

United States regulation is unambiguous that a supplier certificate is not evidence of identity on its own. Under 21 CFR 211.84(d)(1) a manufacturer must conduct at least one specific identity test on each incoming lot and must establish the reliability of the supplier’s analyses through appropriate validation at defined intervals. The certificate may substitute for some testing only after that reliability has been demonstrated and documented, and never for identity.

Enforcement data shows how routinely this is violated. Analysis published by Stephanie Ojeda at AssurX in June 2026 found that more than half of CGMP warning letters issued to pharmaceutical manufacturers during 2025 cited 21 CFR 211.84(d)(1), and that at least eight further letters since 2025 describe the same failure mode of accepting a supplier certificate without confirming it. One cited firm accepted supplier certificates for ethanol, glycerin and chloroxylenol with no independent confirmation. Another case involved an active pharmaceutical ingredient distributor whose vendor survey recorded a supplier claiming a satisfactory FDA inspection outcome when FDA had never inspected that firm at all, a discrepancy visible in a second survey and never investigated before requalification.

The research peptide sector operates entirely outside this regulatory perimeter. No agency compels a research chemical supplier to identity-test an incoming lot or to qualify the laboratory that produced its certificate. The obligation to verify therefore transfers wholly to the purchasing researcher, which is the practical argument for treating third-party rather than in-house testing as the minimum acceptable standard.

Four Failure Modes of a Peptide Certificate

Fabrication is the crudest failure. A vendor generates a document resembling a laboratory report, populates it with plausible figures, and publishes it. Because most buyers never contact the named laboratory, this survives indefinitely. It is detectable only by resolving the report against the laboratory’s own records.

Substitution is subtler and more common. Here a real certificate exists for a real sample, but the sample is not representative of what shipped. A vendor submits material from a high-quality lot, receives a genuine report, then applies that report to subsequent lots from a cheaper source. Every element of the document is authentic. The linkage between document and vial is the fiction. This failure is invisible to any authenticity check that stops at confirming the laboratory issued the report, and it is why batch-level rather than product-level certificates matter.

Scope narrowing is a failure of omission. The certificate reports exactly what was ordered and nothing more, and the buyer reads the silence as absence of a problem. A report covering high performance liquid chromatography purity and mass spectrometry identity says nothing about endotoxin burden, residual solvents, elemental impurities, water content or counterion load. The heparin case is the extreme illustration of a specification that was fully satisfied and entirely uninformative.

Staleness is the quietest failure. A certificate is a measurement at a moment. It describes material as it existed at the analytical laboratory on a given date, under whatever storage and transport conditions preceded that measurement. It makes no claim about the same material after months in a distribution chain. A certificate dated eighteen months before shipment is a historical document, and the record-keeping conditions that determine whether it can be trusted at all are the subject of our discussion of ALCOA+ principles and audit trails behind a purity number.

Verification Mechanisms That Resolve to the Laboratory

The only structural defense against fabrication is a verification path that terminates at the analytical laboratory rather than at the vendor. Several independent laboratories serving this sector now issue reports carrying a unique alphanumeric verification key, printed alongside the sample identifier, which resolves to a record held on the laboratory’s own server. Janoshik Analytical operates such a portal at janoshik.com/verify, where a report key returns the laboratory’s stored record for that test.

The architectural point is that the record lives outside the vendor’s control. A vendor can host any PDF it likes. It cannot write to the laboratory’s database. A fabricated report therefore fails not because it looks wrong but because the key returns nothing, or returns a record whose compound, date or sample identifier disagrees with the document in hand. Quick response codes printed on certificates are useful only insofar as they point at the laboratory domain. A code that resolves to a page on the vendor’s own website provides no independent confirmation whatsoever and should be treated as decorative.

Verification quality therefore has a hierarchy. Strongest is a key or code resolving to a laboratory-hosted record that matches the printed document field for field. Weaker is direct correspondence with the laboratory quoting the sample identifier, which works but does not scale. Weakest, and effectively worthless as authentication, is a vendor-hosted PDF with no external resolution path, regardless of how professional the layout appears.

What Verification Still Cannot Establish

Confirming that a laboratory genuinely issued a report closes the fabrication gap and nothing else. It does not establish that the tested sample came from the lot that shipped, because the laboratory tests whatever arrives in the envelope and has no visibility into the vendor’s inventory. It does not establish that the analytical methods were appropriate for the compound, that the reference standard was suitable, or that the method was validated for the matrix in question. Those questions belong to analytical method validation under ICH Q2(R2), and no verification portal addresses them.

Nor does verification say anything about material integrity after the measurement. Reconstitution behaviour, aggregation, adsorptive loss to labware and light-induced degradation all occur downstream of the certificate and are unrecorded by it. A verified, authentic, methodologically sound report describes a sample at a laboratory bench on one date. Everything that happened to the vial afterward is outside its scope.

A Practical Verification Sequence

Begin with resolution. Locate the verification key or sample identifier on the certificate and resolve it at the laboratory’s own domain, not through any link the vendor supplies, since a supplied link can point anywhere. Confirm that the returned record matches the document on compound identity, sample identifier, test date and reported purity. Any mismatch on those four fields is disqualifying regardless of explanation.

Next, examine linkage. Establish whether the certificate carries a batch or lot identifier and whether that identifier appears on the physical vial label. A certificate with no batch identifier, or one that cannot be matched to the container, cannot exclude the substitution failure mode no matter how authentic the document is.

Then assess scope and currency together. Read which tests were performed and treat every unlisted attribute as unmeasured rather than acceptable. Compare the analysis date against the shipment date and treat a wide interval as a gap requiring an independent stability rationale. Maple Research Labs publishes its available third-party analytical reports on the certificates of analysis page so that these checks can be performed against source documents rather than marketing summaries.

Finally, calibrate expectations. The purpose of this sequence is not certainty. It is the elimination of the cheapest and most common failure, which is a document that no laboratory ever issued. That single check removes a large class of misrepresentation at almost no cost, and the research peptide sector performs it far less often than the availability of the tooling would suggest.

Conclusion

The peptide market moved from publishing no certificates to publishing certificates universally, and treated that transition as though it resolved the trust problem. It did not. It relocated the problem from whether a document exists to whether the document corresponds to anything real. The documented cases in regulated pharmaceutical supply chains, where oversight is far denser than anything covering research chemicals, demonstrate that falsified certificates survive contact with sophisticated buyers. Verification that resolves to the issuing laboratory, batch-level linkage to the physical container, explicit attention to what was not tested, and honest treatment of the interval between analysis and shipment together form the minimum defensible standard. Anything less is document appreciation rather than quality assurance.

For research purposes only. Not for human consumption. Not for diagnostic or therapeutic use.