The exact rules our scanner audits against.

FDA PEPTIDE WARNING LETTER PATTERNS — 2024-2026 ENFORCEMENT
(Synthesized from public warning letters to Summit Research, Xcel Peptides, Prime Peptides, SwissChems, USApeptide.com, and related vendors.)

FDA cited the following violations under FD&C Act §§ 301(a), 301(d), 505(a), and 502(f)(1):

CLAIM PHRASES FDA HAS CITED VERBATIM:
- "supports recovery", "speeds healing", "regenerates tissue"
- "promotes fat loss", "for weight loss", "comparable to Ozempic / Wegovy / Mounjaro"
- "enhances performance", "boosts endurance", "increases muscle"
- "libido-enhancing", "improves sexual function"
- "anti-aging", "reverses aging", "increases lifespan"
- "improves cognition", "neuroprotective", "boosts mood"
- "tans skin", "increases melanin" (Melanotan II)
- Any cycle, dose, mg/kg, IU, or administration route ("subcutaneous", "IM", "twice weekly")

PRODUCT CATEGORIES FDA HAS DETERMINED CANNOT BE SOLD RUO:
- GLP-1 receptor agonists (semaglutide, tirzepatide, retatrutide, cagrilintide) — these are FDA-approved drugs; selling OTC under any disclaimer is misbranding + unapproved new drug.
- Compounds on FDA's 503A/503B Difficult to Compound and Category 2 lists: BPC-157, Thymosin Beta-4 (TB-500), Melanotan II.
- Investigational new drugs without an active IND.

CONTEXTUAL VIOLATIONS FDA HAS USED TO DEFEAT "RUO" DISCLAIMERS:
- RUO label paired with consumer-friendly checkout (no gate, no institutional verification, retail pricing).
- Blog posts or linked educational content describing human dosing protocols.
- Sale of bacteriostatic water, insulin syringes, or reconstitution kits alongside peptides.
- Customer reviews describing personal results (weight loss, muscle gain, libido) left visible on the site.
- Social media accounts (linked from site) making human-use claims.
- Meta descriptions or image alt text containing therapeutic language for SEO.
- Prior FDA correspondence on file: continued sale after a Warning Letter constitutes evidence of objective intent under §201.128.

RETATRUTIDE COVER NAMES — DECODED BY ELI LILLY AND FDA:
Eli Lilly has published the list of names vendors use in place of "Retatrutide":
- "GLP-3"
- "Reta GLP-3"
- "GLP-1-R"
- "GLP1-R"
- "GLP-3 RT"
FDA decoded each of these aliases in warning letters and named which vendor was selling under which label. One vendor was cited for advertising "triple the fat burning power."
Renaming retatrutide to any GLP-derived label is NOT remediation — those labels are already decoded. The only defensible naming is an in-house research code containing no GLP string (e.g. "ABC-3RT (Research Peptide)").

ENFORCEMENT VOLUME (as of 2026):
- 16 FDA warning letters issued on retatrutide specifically.
- Over 100 warning letters on compounded GLP-1s since September 2025.
- 30 telehealth companies warned in March 2026.
- FDA has publicly described this as a new phase of enforcement.

ENFORCEMENT OUTCOMES:
- Warning Letter → 15 business days to respond
- Failure to respond → Import Alert, seizure, injunction, criminal referral
- Payment processors (Stripe, Square, Authorize.net) terminate accounts within 7-30 days of any FDA Warning Letter being public on fda.gov

21 CFR §201.128 — MEANING OF "INTENDED USES" (VERBATIM)

"The words 'intended uses' or words of similar import in §§ 201.5, 201.115, 201.117, 201.119, 201.120, 201.122, and 1100.5 of this chapter refer to the objective intent of the persons legally responsible for the labeling of an article (or their representatives). The intent may be shown by such persons' expressions, the design or composition of the article, or by the circumstances surrounding the distribution of the article. This objective intent may, for example, be shown by labeling claims, advertising matter, or oral or written statements by such persons or their representatives. Objective intent may be shown, for example, by circumstances in which the article is, with the knowledge of such persons or their representatives, offered or used for a purpose for which it is neither labeled nor advertised; provided, however, that a firm would not be regarded as intending an unapproved new use for an approved drug … based solely on that firm's knowledge that such drug was being prescribed or used by health care providers for such use."

REGULATORY CONSEQUENCE:
An "RUO" or "not for human use" disclaimer does NOT cure intended-use liability if surrounding evidence (product positioning, advertising, customer base, dosing language, social posts, accessories sold, prior FDA correspondence) shows the firm knows or has reason to know the product will be used in humans. FDA has cited §201.128 to override RUO disclaimers in every recent peptide warning letter.

STRIPE RESTRICTED BUSINESSES — VERBATIM EXCERPTS
(Source: https://stripe.com/legal/restricted-businesses)

Restricted businesses include but are not limited to:

— "Pseudo pharmaceuticals" (including but not limited to "research chemicals," "designer drugs," and any product marketed as a research chemical that is structurally similar to a controlled or scheduled substance).

— "Products making health claims that have not been approved or verified by the applicable regulatory body."

— "Drug paraphernalia" — items "primarily intended or designed for use in manufacturing, concealing, or using a controlled substance."

— "Substances designed to mimic illegal drugs."

— "Prescription drugs or devices, including those that require a prescription but are being sold without one."

— "Items that infringe upon or violate any copyright, trademark, right of publicity or privacy, or any other proprietary right under the laws of any jurisdiction."

— "Any business that we believe poses elevated financial risk, legal liability, or violates card network or bank policies."

STRIPE RUO / RESEARCH CHEMICAL ENFORCEMENT PATTERN:
Stripe has terminated peptide merchants under the "pseudo pharmaceuticals" category when:
- Site contains any therapeutic claim language
- Products are sold without a verified researcher/institutional gate that blocks content BEFORE render
- RUO disclaimer is paired with consumer-style messaging (free shipping, "buy now", cycle guides)
- GLP-1 analogs (semaglutide, tirzepatide, retatrutide, cagrilintide) are sold without prescription verification
- Site sells injection accessories (bac water, syringes, alcohol swabs) alongside peptides

To remain in good standing, the merchant must have "preventive measures in place to ensure these are not accessible to those who would purchase research chemicals for nonresearch purposes."

STRIPE WEBSITE CHECKLIST — VERBATIM (the underwriting list)
(Source: https://docs.stripe.com/get-started/checklist/website)

"This page contains a list of the common elements—such as accurate product descriptions, clear policies, and proper security features—that each business on Stripe should address on its website. Adhering to these recommendations reduces the risk of customer confusion and disputes. It also helps you meet Stripe's standards and the standards set by the credit card networks."

1. A DESCRIPTION OF WHAT YOU'RE SELLING — "Besides only listing the name of the product or service, you can help customers with their purchasing decision by providing detailed text descriptions of what you're selling. For physical goods, include multiple pictures and information about material, colors, and other details… If we review your website and find that it isn't clear what you're selling, we may contact you with recommendations for improving the description."

2. THE PURCHASE CURRENCY — "To support international purchasers, clearly display the currency associated with the prices on your site. Listing only the currency symbol may not be enough, so be as explicit as possible when showing prices."

3. CUSTOMER SERVICE CONTACT INFORMATION — "Make sure your customers can find multiple contact methods on your site, including direct communication channels, such as email addresses, phone numbers, and live chat (something besides contact forms)… If we review your website and can't find a clear way to contact you, we may ask that you add some contact options to the site."

4. YOUR FULFILLMENT POLICIES — "For most businesses, you must clearly explain your order fulfillment policies to your customers." Required policies include:
   - "Refund policy: Describe the conditions under which customers can receive a refund."
   - "Shipping or delivery policy: Describe shipping methods, times, and rates, as well as eligible destinations."
   - "Return policy and process: Describe the conditions under which customers can return purchased goods and the return process."
   - "Cancellation policy: Describe the conditions under which customers can cancel subscriptions or reservations."

5. LEGAL OR EXPORT RESTRICTIONS APPLICABLE TO YOUR BUSINESS — "Certain products and services are subject to restrictions. Properly disclosing any applicable restrictions and how they may impact your customers helps build trust with them."

6. YOUR WEBSITE'S PRIVACY POLICY — "Clearly explaining your website's privacy policy helps you both comply with privacy laws and helps your customers understand how their data is protected, used, or disclosed."

7. YOUR BUSINESS ADDRESS — "If you have a physical address, listing it on your website adds credibility for your business."

8. THE TERMS OF ANY PROMOTIONS YOU'RE OFFERING — "Clearly disclose the conditions of any promotion, discount, or trial that you offer to customers. Display a link or disclaimer text so that it's visible when customers agree to participate."

9. THE SECURITY OF YOUR WEBSITE AND CUSTOMER PAYMENT INFORMATION — "Make sure that your customers know that you comply with the PCI standards… Ensure that your website (especially your payment form) uses HTTPS and other security best practices and isn't susceptible to card testing. You must also explain that your customer's payment information is handled safely when doing business with you."

10. THE LOGOS OF THE CREDIT CARDS YOU ACCEPT — "You can reduce friction in the checkout process by displaying the brand logos of the credit cards that you accept."

CARD NETWORK POLICIES: "As an online merchant, it's your responsibility to ensure that you're compliant with these rules, including the Visa Rules and Regulations, the Mastercard Rules, the American Express Merchant Operating Guide, and the Discover Network Rules."

HOW SOLRUO APPLIES ITEM 1 TO RUO PEPTIDE MERCHANTS (CRITICAL RECONCILIATION):
Stripe item 1 requires a clear description of the GOODS. FDA 21 CFR §201.128 punishes description of the COMPOUND'S BIOLOGY. These are not in conflict — they are satisfied simultaneously by describing the physical article and never its physiological effect.
- COMPLIANT (satisfies Stripe, safe under FDA): in-house research code, compound identity/CAS or molecular formula, purity ("≥99% HPLC"), quantity per vial in mg, physical form (lyophilized powder), vial/closure type, quantity per order, third-party COA availability and lot traceability, product photograph of the actual vial and label, price with explicit currency code, "For research use only. Not for human consumption."
- NON-COMPLIANT (fails FDA even though it looks "detailed"): what the compound does, how it works, receptors/pathways, what it is "studied for", outcomes, benefits, comparisons to other compounds, dosing, storage, reconstitution, or any educational/explanatory prose.
A product page that is a rich SPECIFICATION SHEET is never "unclear what you're selling" under Stripe item 1. Never remediate an FDA problem by leaving a bare two-line page — replace explanatory prose with specification detail.

MASTERCARD BRAM — BUSINESS RISK ASSESSMENT & MITIGATION
(Standard GLB 11691.1)

Acquirers and merchants are required to monitor merchant websites and transaction activity for:
- Sale of illegal or brand-damaging products
- Sale of products implicated in cyber-enabled financial crime, including unregulated pharmaceuticals
- Misrepresented merchant categories
- "Transaction laundering" — processing transactions for an undisclosed line of business

Peptide merchants flagged under BRAM face:
- Mandatory acquirer review within 7 business days
- Per-violation assessments up to USD $25,000 per occurrence
- Mandatory Global Merchant Audit Program (GMAP) listing on repeat findings

A merchant must be able to demonstrate, on request, the documented researcher verification process, audit logs of buyer credentialing, and a content monitoring program that prevents human-use claims from appearing on any indexed page.

The solRUO scanner does not stop at visible body copy. It extracts and audits the following signals on every crawled page:

**Meta tags and on-page identity**
- <title>, meta description, og:title, og:description, canonical URL, and the first <h1>.
- Any of these containing therapeutic claims ("weight loss", "healing", "muscle growth"), mechanism copy ("works by", "receptor agonist"), or GLP-1 / prescription-drug names is flagged.
- Product-page metadata that omits an RUO / "not for human consumption" framing is reported as a warning.

**JSON-LD / structured data**
- Product schema blocks are checked for pharmaceutical/INN names (semaglutide, tirzepatide, retatrutide, etc.) and GLP-derived labels.
- Missing RUO fields in product JSON-LD are flagged, because search engines and merchant-risk crawlers read this machine-readable identity directly.

**Code signals (context only, not standalone findings)**
- Presence of Stripe.js, Shopify, Recharge, PayPal scripts.
- Analytics / conversion pixels such as Google Analytics, Facebook/Meta Pixel, TikTok Pixel, Snapchat, Pinterest, Microsoft Clarity, Hotjar, Klaviyo.
- These are used as supporting context: a consumer-retargeting pixel alongside human-use copy strengthens the intended-use inference, but the scanner never emits a finding solely because an analytics script exists.

**Why this matters**
Under 21 CFR §201.128, intended use is inferred from the totality of the seller's statements. Search snippets and social previews are public, indexed statements. A meta description that promises an effect is often the first thing an FDA investigator or Stripe underwriter sees, and it is quoted in warning letters. Keeping metadata clean is a same-day fix with outsized compliance impact.

External primary sources

Bookmark these. When the scanner cites a finding, the underlying authority will be one of these documents.

• FDA — Warning Letters Database ↗

  Search 'peptide', 'semaglutide', 'BPC-157', 'tirzepatide' for the live corpus.

• FDA — Compounding & 503A/503B Difficult-to-Compound Lists ↗

  Confirms BPC-157, TB-500, and Melanotan II cannot be legally compounded.

• FDA — GLP-1 Compounded Drug Concerns ↗

  Official FDA position on compounded / OTC semaglutide & tirzepatide.

• 21 CFR Part 201 — Labeling ↗

  Full labeling regulations, including §201.5, §201.115, §201.128.

• FD&C Act §§ 301, 502, 505 ↗

  Prohibited acts, misbranding, and unapproved new drug provisions.

• Stripe — Prohibited & Restricted Businesses ↗

  Canonical source. Treat 'pseudo pharmaceuticals' as the controlling category.

• Stripe Services Agreement (US) ↗

  Master agreement — §B termination rights and reserve provisions.

• Mastercard BRAM Program Overview ↗

  Network rules acquirers must enforce; basis for $25K per-occurrence fines.

• Visa Global Brand Protection Program (GBPP) ↗

  Visa's parallel program to Mastercard BRAM.