Ask who regulates the pharmacy filling a compounded prescription and the honest answer names two authorities with unequal reach, a standards body that is not a regulator at all, and a private accreditor that says outright it is doing something other than what a state inspection does. Which legal category the pharmacy sits in is settled in the 503A and 503B article. What follows is who turns up afterward, and what the record shows they did. Compounded drugs are not FDA-approved and are not reviewed by the agency for safety, efficacy or quality before dispensing, which is the premise rather than the finding.
FDA states the division itself
The agency’s compounding questions-and-answers page, current as of September 16, 2025, answers “who inspects facilities that compound drugs” in two sentences. “Generally, state boards of pharmacy have primary responsibility for the day-to-day oversight of state-licensed pharmacies that are not registered with FDA as outsourcing facilities. FDA does conduct surveillance and for-cause inspections of state-licensed pharmacies that are not registered as outsourcing facilities.”[1] The same page states that regardless of where compounding occurs, “other federal law applies, including provisions regarding insanitary conditions.”[1]
So federal authority over a 503A pharmacy is real but residual: it is surveillance and cause, not a schedule, and it rests on provisions that no exemption switches off. The clearest of those is adulteration through insanitary conditions. FDA’s November 2020 guidance on the subject states that although compounded products can qualify for exemptions from specified provisions, “neither section provides an exemption from section 501(a)(2)(A) of the FD&C Act,” and that drugs produced under insanitary conditions are deemed adulterated regardless of those exemptions.[11]
The same guidance says what that authority runs into. “While FDA conducts inspections of such state-licensed pharmacies, it does not inspect the vast majority of them unless, for example, FDA receives a complaint, such as a report of a serious adverse event or product quality issue. As a result, the Agency is often not aware of these pharmacies, their conditions and practices, and potential problems with the quality and safety of their drug products.”[11] The power is unconditional; the visibility that would trigger it is not.
The most common federal action on a 503A is a letter to its state board
FDA publishes a per-firm list of compounding inspections, recalls and other actions, covering 2019 onward, with earlier entries moved to the agency archive. In the version current as of August 6, 2026, that list names 469 firms: 392 marked as 503A facilities and 77 as 503B outsourcing facilities. Counting firms carrying at least one document of each type, 190 of the 392 503A entries carry a Form 483 line and 72 carry a dated warning letter, against 74 and 32 of the 77 outsourcing facilities.[2] Nearly every outsourcing facility on that list has been inspected. Fewer than half the pharmacies on it have.
The entry that separates the two categories is the one nobody advertises. 183 of the 392 503A entries — 46.7% — carry a state referral or state handoff letter. Zero of the 77 outsourcing facility entries do. Nearly half the time FDA records an action against a compounding pharmacy, the action is a letter to the agency that licensed it.
FDA has published the volume of that traffic once. In fiscal year 2021, its compounding surveillance program “issued 72 notification letters to 19 states,” to recipients that included boards of pharmacy, boards of medicine, boards of nursing, boards of chiropractic examiners, a physician assistant board and departments of health.[13]
Those letters are public and they say what they are. One issued to the Missouri Board of Pharmacy on June 16, 2022 opens: “The purpose of this letter is to refer to you, the Missouri Board of Pharmacy (MO-BOP) for appropriate follow up, the U.S. Food and Drug Administration’s (FDA) concerns about poor sterile practices observed during an FDA inspection at a pharmacy you licensed.” It notes that FDA investigators were accompanied by state investigators for part of the inspection, and points the board to the Form 483 and, on request, the full establishment inspection report.[3]
Read that pattern as it is, rather than as a complaint. Referral is cooperation working the way the statute contemplates. It is also the point at which the public trail ends, because what the board did next is recorded, if at all, in fifty separate state systems with no common format. What a federal warning letter does and does not establish is set out in the warning letter article.
The quality standards are written by a private convention
The rules a state inspector applies to sterile and nonsterile compounding are not federal regulations. They are United States Pharmacopeia general chapters — <795> for nonsterile preparations and <797> for sterile — and USP is, as a survey of state boards puts it, “a private, nongovernmental organization which independently develops guidelines for pharmaceuticals.”[4] Both revised chapters became official on the same day, November 1, 2023.[5] A USP chapter carries force only where a state board, or federal law, adopts it.
How much of the country enforces them is partly unknown
The best available measurement invited executive directors or administrative representatives of each of 51 state boards of pharmacy to answer six open-ended questions. 36 of 51 responded, a 71% response rate. Of those, 35 of 36 (97%) indicated that they implement USP compounding standards at least in part. Of the 28 who addressed the scope question, 18 (64%) reported that some but not all standards are enforced — most commonly <795> and <797> but not <800> — while 10 (36%) said all are. Of 21 addressing timing, 18 (86%) implement only finalized chapters.[4]
Notice the denominators shrinking from 51 to 36 to 28 to 21. Fifteen boards did not respond at all, and among those that did, a third to a half declined the more specific questions. A patchwork in which two-thirds of responding boards enforce a subset they choose is not the same regulatory regime in every state, and it is not fully documented in any of them.
You cannot compute a rate over a population nobody counts
FDA publishes a table of registered outsourcing facilities. As of its update of September 8, 2026 it lists 96 facilities, of which 41 carry “Not yet inspected” in the inspection column.[6] That is a known denominator with a known gap inside it.
No equivalent exists on the other side, and FDA says so in the plainest terms it has published: “States are primarily responsible for day-to-day oversight over the vast majority of the thousands of compounders in the U.S., most of which do not register with FDA.”[12] “Thousands” is the whole of the published precision. A 503A pharmacy does not register with FDA as a compounder, so there is no federal roster of them, no federal count, and therefore no rate: the 392 firms on the actions list are a numerator with no published denominator, and the share of 503A compounders that have ever been federally inspected cannot be calculated from public sources. What a buyer can check about a specific pharmacy is covered in the vetting article.
The reporting duty runs one way
Adverse event reporting is the clearest asymmetry in the whole arrangement, and the agency states it plainly on its page about unapproved GLP-1 drugs: “federal law does not require state-licensed pharmacies that are not outsourcing facilities to submit adverse events to FDA so it is likely that adverse events from compounded versions of these drugs are underreported.”[7] Every national safety figure for compounded product is therefore a floor rather than a count, and a low number of reports about a pharmacy is uninformative in a system that does not require it to file any. What the phrase “not FDA-approved” carries is set out in the approval-status article.
The size of that distortion has been measured, and it points the opposite way to intuition. FDA’s compounding surveillance program published a fiscal-year 2022 breakdown of compounding incidents by firm type: 125 adverse events and 39 other complaints attributed to 503B outsourcing facilities, against 85 adverse events and 70 other complaints attributed to 503A compounders, with 13 and 7 from other firm types and 1 from an ingredient supplier.[13]
Fewer than a hundred registered outsourcing facilities generated half again as many adverse event reports as the thousands of 503A pharmacies did. Read as a safety ranking that is nonsense. Read as a measurement of the reporting duty it is exact: the cohort that must file, files. Any comparison of the two categories built on report volume is measuring the obligation and calling it the risk.
What accreditation is, in the accreditor’s own words
Nothing in section 503A requires accreditation, and no state board substitutes it for a license. The PCAB program, run by the Accreditation Commission for Health Care, describes its purpose on its own page as providing “compounders with the resources to guide them through complex and sometimes competing regulations,” noting that pharmacies are regulated by FDA federally and by boards of pharmacy at state level and that this “often results in a patchwork of expectations.” The same page separates its product from state requirements: a compounder shipping across state lines may need a nonresident license from the receiving state’s board, dependent on a nonresident inspection, and “this is not the same as accreditation.”[8] That sentence is the most useful thing on the page, because it is the distinction most buyers collapse. What the page does not contain is also worth recording: across its accreditation pages, including its terms of use, there is no statement that the program is voluntary and no disclaimer that accreditation is not an FDA or government approval.[8]
From inside the field, a 2026 article on 503A accreditation argues that traditional checklist-based inspections “are effective at verifying compliance with published standards, but they often fail to distinguish minor documentation lapses from conditions that pose significant risk to patients, staff, or the viability of the pharmacy itself,” and proposes risk-based auditing instead.[9] No study comparing outcomes at accredited against unaccredited 503A pharmacies was located, so accreditation is neither endorsed nor dismissed here.
Paperwork status does not predict conduct
A cross-sectional secret shopper study conducted from August to October 2025 identified 75 weight-loss clinics and medical spas offering compounded GLP-1 receptor agonists in two states, and traced them to 23 supplying compounding facilities. 4 of 21 (19.0%) were not licensed to perform sterile compounding. Since 2023, 1 of 23 (4.3%) had received multiple FDA warning letters and 3 of 22 (13.6%) had been subject to state-level disciplinary action.[10] Roughly one supplier in five lacked the license for the category of preparation being sold, in a channel where the buyer usually never learns the pharmacy’s name. State licensure rules for the prescribing side are a separate layer, described in the state rules article.
What could not be established
Three things, stated as gaps rather than left implied. A national aggregation of state board discipline does exist and the public cannot see it: the NABP Clearinghouse is “a national database of disciplinary and administrative information” that member boards “must report all disciplinary actions” to, and “all information reported is confidential and not available to the general public.”[14] It publishes no record count and no as-of date, which is why the referral letters above have no published outcome column. No count of 503A compounding pharmacies in the United States was found, federal or otherwise. And PCAB’s public page does not state how many pharmacies hold its accreditation, so the share of the market it covers is unknown. The FDA actions list is also bounded: it begins in 2019, and the counts above are of firms carrying at least one document of a type, not of documents. How each figure here was established before publication is described in the methodology.