How to Verify a Peptide COA Is Genuine: A Step-by-Step Check

Published September 29, 2026 · ROVIQ Research

A Certificate of Analysis (COA) is only as useful as its provenance. Before reading the numbers on one, it is worth answering three separate questions. Is the document genuine, meaning it was issued by the laboratory named on it and has not been altered? Does it describe your material, meaning the same product and the same lot? And what does it actually show? This guide covers the first two. For the third, see How to Read a Peptide Certificate of Analysis.

First, know which kind of COA you are holding

Two different documents are both called a COA, and they answer different questions.

• A manufacturer's batch release certificate. The ICH Q7 good manufacturing practice guideline for active pharmaceutical ingredients says that "Authentic Certificates of Analysis should be issued for each batch", that they should list each test performed "including the acceptance limits, and the numerical results obtained", and that they "should be dated and signed by authorised personnel of the quality unit(s)" (ICH Q7, §11.4). This is the maker's own statement about its batch.
• An independent laboratory's test report. Here an outside laboratory tests a sample it was sent and reports what it found. The World Health Organization's model certificate of analysis is "essentially designed for" quality control laboratories not related to manufacturers (WHO TRS 1010, Annex 4).

Both guidelines come from pharmaceutical manufacturing and are reference points, not rules that research-market reports are held to. Many research-market reports follow them only partly: it is common, for example, to see results reported without acceptance limits or a pass/fail conclusion. That does not make a report false, but it helps to know what a complete certificate looks like. The WHO model lists, among other items: the name and address of the issuing laboratory; an identification number for the certificate; the number the laboratory assigned to the sample on receipt; the date the sample was received; the batch number; the test procedures used; the results; and the date and signature of an authorized person (WHO TRS 1010, Annex 4).

Step 1: Identify the issuer, independently

A genuine report names the laboratory that performed the tests and gives a way to contact it. Look the laboratory up yourself, through a search engine, rather than following a link, email address or phone number printed in the PDF. Contact details are the easiest thing on a document to fake, and a forged report can point to a forged contact.

Step 2: Verify the report with the laboratory

Many testing laboratories run a public lookup on their own website, where anyone can enter a report number, accession number or verification code and retrieve the laboratory's copy of the report. Go to the laboratory's site directly, enter the code from the COA, and compare the laboratory's copy with the one you were given, field by field: product, lot, dates, results. Where the laboratory's copy can be downloaded, the two files can be compared directly; an unaltered copy is often identical to the byte. If the laboratory has no lookup, email it the report number and ask it to confirm the result.

Step 3: Tie the report to your material

A COA describes one sample from one lot. Check that the product name, the strength or fill, and the lot or batch number on the report match the material it is being offered for. A genuine report for a different lot says nothing about yours, and a report with no lot number cannot be tied to any particular vial at all.

Step 4: Check that the report is internally consistent

• Identifiers and dates. Look for a laboratory sample or accession number, a received date and a reported date, in that order.
• Methods. The report should say how each result was obtained, for example HPLC with UV detection for purity and mass spectrometry for identity. A purity figure alone does not establish identity.
• The chromatogram. If one is shown, it should look consistent with the stated purity: a high-purity result should show one dominant peak. How to read an HPLC chromatogram explains what to look for.
• The identity result. Where a mass spectrum or observed mass is shown, it should be consistent with the compound's expected mass. Remember that a spectrum reports mass-to-charge ratio (m/z), so a multiply charged ion appears at a fraction of the molecule's mass.
• Plausible values. Synthetic peptides generally carry related impurities from synthesis and degradation (D'Hondt et al., 2014). A purity of exactly 100% with no visible minor peaks is therefore worth a question about how the chromatogram was integrated.

Step 5: File-level signs, which are weak evidence

Some signs sit in the file itself: a report that is a flat image with no selectable text, fonts that change within a line, or fields that do not line up with the rest of the template. On their own these prove nothing. Laboratories and vendors legitimately scan and re-save documents. Combined with a failed lookup, though, they are a good reason to ask the laboratory directly.

Red flags at a glance

• No laboratory named, or a laboratory you cannot find independently.
• No report, accession or sample number, or one the laboratory's lookup does not recognize.
• No lot number, or a lot number that does not match the material.
• The same report offered for several lots, or by several unrelated sellers.
• Results with no method stated, or a purity figure with no identity test.
• Dates missing or out of order.
• Exactly 100% purity with a featureless chromatogram.

What even a genuine COA does not tell you

A verified report is a statement about the sample the laboratory received. It covers one sample from one lot, tested once. Purity is not quantity: an HPLC purity figure does not measure how much peptide is in a vial, which is a separate result, net peptide content. Tests that were not run, such as endotoxin or sterility, are not covered by the ones that were. And a report cannot show what happened to material after the sample was taken.