The Supplier Due Diligence File: Every Document a Research Peptide Vendor Should Be Able to Produce

A supplier you can evaluate is one that produces eight documents on request, promptly and without asking why you want them: proof of the legal entity behind the invoice; a plain statement of its role in the chain — manufacturer, repacker or broker; a batch-matched certificate of analysis for the lot being shipped; the analytical data behind that certificate; a safety data sheet in the format your jurisdiction requires; written storage and transport conditions; a documented complaints, returns and traceability procedure; and terms of sale stating the research-use-only status in the same words the label uses. Six of the eight is workable, provided you know which two are missing and why. Two, plus reassurance for the rest, is not an evaluation at all.

This is procurement governance, not chemistry. None of it measures your material — that is what a certificate attempts and what independent testing settles. What a due diligence file measures is a counterparty: whether the entity receiving your money is identifiable, whether it can describe its own position in the chain, and whether it has any defined process for the day something is wrong. The framework is not improvised for this category. Supplier qualification is written into ICH Q7 ^[1], into clause 8.4 of ISO 9001 ^[4], into the WHO guidance on trade and distribution of pharmaceutical starting materials ^[5], and into US drug manufacturing regulation ^[2]. None of those govern a research purchase. All of them describe what a competent counterparty looks like, and they cost nothing to borrow.

The eight documents, and what each one proves

Read the third column as the source of the expectation rather than as a rule that binds anyone here. The fourth column is the useful one: the answer that ends the evaluation.

Start with the legal entity, not the storefront

The first question is not about purity. It is whether there is an identifiable company at the other end of the transaction, and whether it is the same company that appears on the invoice, on the customs paperwork and on the payment routing. Divergence between those is the most common structural warning sign in this trade: a brand presented from one country, invoicing from a second, shipping from a third, and collecting payment through a fourth entity unrelated to any of them. Each hop alone may be ordinary. Together they mean that if the shipment is wrong, no single party carries an obligation to you.

• Registered legal name, jurisdiction of incorporation and company number — checkable in a public registry in minutes.
• A physical address for the entity, not only a support email or a contact form.
• The name on the commercial invoice, and whether it matches the entity that takes payment.
• Declared country of origin and country of dispatch, which for a US or Canadian buyer determine customs treatment and who the importer of record is.
• A denied-party screen: for US buyers the Consolidated Screening List aggregates eleven Commerce, State and Treasury restriction lists into one free search ^[11].
• Which entity holds title at the point of sale, in writing — ISO 9001 expects selection criteria to be defined before contracting, not after ^[4].

Manufacturer, repacker or broker — which one are you buying from?

This single question changes the meaning of every other document in the file, and most suppliers in this category will not answer it unprompted. ICH Q7 devotes an entire section to agents, brokers, traders, distributors, repackers and relabellers, and its core requirement is traceability rather than capability: such parties should maintain full traceability of the material they handle, should be able to name the original manufacturer, and — where they issue a certificate of analysis — should reference the laboratory that performed the analysis and attach a copy of the original manufacturer's batch certificate ^[1]. A broker who declines to name the manufacturer is not protecting a commercial secret so much as ending the audit trail at themselves.

The WHO guidance on pharmaceutical starting materials makes the same point from the other direction, treating traders and distributors as links that must preserve the identity and quality of what passes through them rather than as neutral conduits ^[5]. The useful version of the question is narrow and hard to deflect: who synthesised this lot, who filled it, who labelled it, and which of those steps happened after the certificate was issued. Repackaging after release is the specific event that silently breaks the link between a certificate and a container, and it is invisible unless you ask.

Quality-system evidence you can verify in a register

Three claims are commonly made and each has a public, checkable form. A supplier claiming ISO 9001 certification should give a certificate number and a certification body; the certificate carries a defined scope — which activities at which sites — worth reading, because a scope covering distribution says nothing about manufacture ^[4]. A supplier claiming third-party testing should name the laboratory and, where it is accredited to ISO/IEC 17025, give the accreditation body and certificate number for lookup on that body's register; accreditation likewise has a scope limited to specific methods and matrices ^[3]. A supplier claiming manufacture under GMP should be able to say which authority inspected the site, and when.

The honest position: in the research-compound market most vendors hold none of these, and a checklist treating their absence as disqualifying would eliminate the entire field, which is not a useful result. Absence of certification is not evidence of bad material. It does mean the assurance has to come from somewhere else — traceability, named laboratories, consistency across successive lots, and ultimately your own testing. The regulated world resolves that residual uncertainty the same way: under 21 CFR 211.84 a supplier's report of analysis may substitute for full incoming testing only if the receiving party performs at least one specific identity test itself and validates the supplier's results at appropriate intervals ^[2] — a pairing that only makes sense once you know how much a single identity confirmation actually settles. ICH Q7 puts a number on the transition — full analyses on at least three batches before in-house testing is reduced, with full analysis still repeated periodically and compared against the certificates ^[1]. Three lots, not one, is the benchmark before a buyer trusts a supplier's paperwork.

The safety data sheet is a statutory test, not a courtesy

This is the cheapest discriminator in the file, because it is a legal obligation on the seller in both the US and Canada rather than a favour. Under the OSHA Hazard Communication Standard, chemical manufacturers, importers and distributors must provide a safety data sheet in a prescribed sixteen-section format; sections 1 to 11 and section 16 are mandatory, sections 12 to 15 may be included but are not enforced by OSHA, and any subheading with no available information must say so explicitly rather than be left blank ^[6]. In Canada, the Hazardous Products Regulations require a supplier to provide a compliant safety data sheet as a condition of sale or importation of a hazardous product intended for workplace use, with the information elements available in both English and French ^[7]. A seller who cannot produce an SDS, or who returns a single paragraph asserting the material is non-hazardous with no classification reasoning, has failed a test that has nothing to do with peptides and everything to do with whether the business runs on process or improvisation.

What happens when something is wrong

Every supplier looks identical while orders arrive intact. The differences appear the day a lot is visibly off-specification, arrives warm, or fails a check you ran yourself. ICH Q7 expects quality-related complaints to be recorded and investigated — the record naming the complainant, the material and lot, the nature of the complaint and the response — and expects a written recall procedure that can be activated at any time ^[1]. WHO's distribution guidance expects transport conditions to be defined and controlled rather than assumed, with deviations recorded ^[5]. Neither is exotic. Both reduce to four questions worth asking before you need the answers.

• What is the written procedure if a lot fails an incoming check on my side — who investigates, on what timescale, and what evidence do you require from me?
• Have you ever withdrawn a lot from customers, and by what mechanism did you contact them? A supplier with no lot-to-customer mapping cannot recall anything, whatever the terms of sale say ^[1].
• Under what conditions was this shipment transported, and how would a temperature excursion in transit be detected and recorded ^[5]?
• How long are batch records, certificates and analytical data retained, and can I obtain the certificate for a lot I bought two years ago?

Does the paperwork match how the product is actually sold?

A due diligence file has an internal consistency test that costs nothing to apply. Research-use-only status either appears everywhere — label, certificate, invoice, terms of sale, catalogue copy — or it appears in the small print while the marketing says something else. The FDA's only formal written policy on research-use-only labelling addresses in vitro diagnostic products rather than chemicals, but its reasoning transfers cleanly: the agency treats the labelling statement as one piece of evidence among many and reads it against the product's actual intended use, as shown by how it is promoted, to whom it is sold and what claims accompany it ^[10]. A disclaimer contradicted by the surrounding copy is not a shield; it is a documented inconsistency, and a supplier willing to publish one is telling you what its other documents are worth.

Where this method is weak

Documentation review narrows uncertainty; it does not close it, and pretending otherwise would be the same overselling the method exists to detect. Paperwork can be fabricated, and fabricating it is cheaper than testing. The published analytical work on material circulating under research labelling is blunt about the gap between declaration and content, and the record of what analysts have found inside grey-market vials runs the same way: an LC–MS/MS screening study of illegal peptide preparations encountered by control agencies found that nearly all the products examined contained less peptide than declared, alongside identity and impurity findings no accompanying document had disclosed ^[8]. A later study of nootropic research peptides sold online reached a comparable conclusion — freely available preparations of compounds that had completed no clinical trials, requiring new analytical methodology simply to characterise what was in them ^[9]. Both examined seized or online-sourced samples rather than a random sample of the legitimate research supply, so neither gives a market-wide failure rate; what they establish is that the divergence is real and common enough to warrant methodological attention.

The practical conclusion is unglamorous. A complete due diligence file raises the cost of deceiving you and gives you somewhere to go when something fails, which is genuinely most of the value. It does not verify a molecule. That verification comes from an orthogonal test on your own bench or at a laboratory you selected — which is exactly the structure regulated buyers use, where the supplier's certificate is accepted only alongside an identity test performed by the receiving party ^[2]. Treat the file as the thing that decides whether a supplier is worth testing at all.