The Paradigm Peptides case is a warning about proof, not just one seller. A certificate of analysis (COA), a lab report saying what was tested and what the lab found, can look convincing on a website and still be false. What protects a patient is the chain behind the document: a licensed prescriber, an identifiable pharmacy, traceable ingredients and records a regulator can inspect.
That distinction is easy to miss when every site uses the same clean vials and confident language. Our broader guide to whether peptides are safe looks at the medical evidence; this article stays with what the federal case tells us about the seller.
What happened in the Paradigm Peptides case
As of September 6, 2026, the day this article was written, the latest official record is the Justice Department's July 30 sentencing announcement. Matthew Kawa, who ran Paradigm Peptides, received 70 months in federal prison and a $5 million money judgment. His sister and employee, Jennifer Stechkober, received 16 months. Both had pleaded guilty to putting unapproved drugs into interstate commerce with intent to defraud and mislead, and Kawa also pleaded guilty to illegal importation (U.S. Attorney's Office, July 30, 2026).
The scale was not small. Prosecutors said the business sold to more than 54,000 customers in all 50 states and more than 80 countries from 2019 through 2024. Products came from China, India and elsewhere, although the company claimed American manufacturing and quality testing. The Justice Department said no quality testing was done before sale and that many products sold as selective androgen receptor modulators, or SARMs—lab-made compounds intended to act somewhat like testosterone—were actually testosterone.
The products were labeled for laboratory use even though prosecutors said they were sold for people to consume. CBS News, which attended the sentencing and reviewed court filings, reported that Kawa admitted the business forged lab certificates to make the peptide products look independently tested.
Why the Paradigm Peptides COA was not enough
A COA can be useful. But a PDF hosted by the same seller taking the money is not independent verification. A buyer usually cannot tell whether the sample came from the vial being sold, whether the lot number was copied, whether the laboratory issued the report or whether the result was edited.
This is not only a paperwork problem. In a 2017 JAMA investigation, researchers bought 44 products marketed online as SARMs. Only 23 contained a SARM, 11 contained an ingredient missing from the label, and just 18 contained the labeled amount (Van Wagoner et al., JAMA 2017). That study did not examine Paradigm, but it shows why the label and the contents need separate evidence.
A 2024 study made the same point with peptide vials. Researchers bought semaglutide from six websites selling without a prescription; only three vials arrived. All three contained more semaglutide than their labels stated, had measured purity between 7.7% and 14.4% despite 99% claims, and contained endotoxin, bacterial residue that can trigger fever and dangerous inflammation (Ashraf et al., Journal of Medical Internet Research 2024). Three delivered vials cannot tell us how common the problem is. They do show that a purity claim on a page is not a quality system.
What a licensed pharmacy changes
The difference is accountability, not perfection. A compounded medication can still have a quality problem. But a prescription filled by a licensed pharmacy creates named people and records around the vial instead of leaving the website as the only source of truth.
For patient-specific compounding, federal law says a bulk ingredient must come with a valid COA and be made by an FDA-registered establishment. The COA is one part of supplier qualification, not a public badge that ends the inquiry (FDA's 503A bulk-substance requirements).
The FDA explains that state boards of pharmacy usually handle day-to-day oversight of state-licensed pharmacies, while FDA primarily oversees registered outsourcing facilities. Testing requirements differ by pharmacy type and preparation, but the underlying sourcing, compounding and dispensing records sit inside a system regulators can examine. How compounded medications are made walks through that chain in plain language.
| Question | Seller-controlled website | Prescribed compounded medication |
|---|---|---|
| Who checks the patient? | No clinical review is required | A licensed provider reviews medical history |
| Who made the vial? | May be unclear or based on a claim | A pharmacy of record is identified |
| What supports the contents? | A seller-posted report may be the only evidence | Sourcing and dispensing records are tied to pharmacy oversight |
| Who can act if something is wrong? | Often no clinician or pharmacy is attached | The prescriber, pharmacy and regulator have defined roles |
The point is not that a pharmacy logo makes risk disappear. It is that the evidence no longer begins and ends with the person selling the vial.
What the sentencing does not mean
The government's published substitution finding concerned Paradigm's SARM products. It does not establish that every peptide the business sold contained testosterone, and it does not show that all online peptide products are falsely labeled. The fair lesson is narrower: shoppers could not verify the company's claims from the website materials it controlled.
The case also did not create a blanket rule against prescribing compounded peptides. BPC-157 has never had an FDA-approved U.S. product, and the compounded formulation offered here is not FDA-approved. A licensed provider may still prescribe a compounded formulation when appropriate; that decision is between the patient and doctor. The same accountability question matters when someone is considering recovery-related compounds such as BPC-157 or TB-500.
What to check before an online peptide visit
Start with the people, not the PDF. The service should identify the dispensing pharmacy, require a medical intake and provide a real clinician who can ask questions or decline. The prescriber must be licensed where the patient is located; it is possible to check a telehealth doctor's state license directly.
At Promise, a licensed provider reviews every request, and not everyone qualifies. If a prescription is written, a licensed U.S. compounding pharmacy dispenses it. That process gives the patient a prescriber and pharmacy to contact if the vial, label or reaction raises a concern.
There is also a current enforcement signal to watch. FDA's public log shows five warning letters issued to online peptide sellers on August 24, 2026, and posted September 1. The letters focused on products the agency considered unapproved new drugs or misbranded drugs (FDA warning-letter log). A warning letter is not a criminal sentence, but the timing shows that regulators are still examining the same seller-first model.
A website certificate can be part of the evidence. It should never have to carry all of it. The useful question is who remains accountable after the page closes.