A Certificate of Analysis (COA) is supposed to be your proof. In practice it is also one of the most forged documents in the research-compound supply chain. A PDF is just a file — a number can be changed, a date swapped, or one legitimate report reused across an entire catalog, all after testing. Every “red-flag checklist” assumes the document in front of you is genuine, and that assumption is exactly what gets exploited.
This guide is strictly about document verification — telling a real COA from a forged or recycled one. It does not cover the handling, preparation, or use of any compound; everything here is for research-use-only evaluation of paperwork.
1. Look for the chromatogram, not just a number
A bare purity figure (“99.2%”) is a claim. The HPLC chromatogram is the evidence. A genuine trace shows a dominant target peak on a clean baseline, usually with a few small satellite peaks. Warning signs: no chromatogram at all — just a percentage; a “too perfect,” perfectly flat trace or an obvious stock graph; a single peak with no baseline detail. If there is no trace, there is no evidence.
2. Confirm identity, not just purity
Purity and identity answer two different questions. HPLC tells you the sample is clean — how cleanly the target separates from everything else. It does not tell you what the clean thing is. Only mass spectrometry (ESI-MS, ideally with MS/MS) confirms the molecular mass matches the theoretical value for the claimed sequence. A sample can read 99% pure by HPLC and still be the wrong molecule. A COA with a beautiful purity number and no MS data is telling you half the story.
3. Check that the COA is lot-specific
A genuine COA is issued for one specific batch and carries a lot or batch number unique to that run. Two tells of a recycled document: a generic COA with no lot number at all, or the same certificate appearing across multiple batches and storefronts. A report that could belong to any batch is really certifying none of them.
4. Make sure the lab is real and named
“Third-party tested” means nothing if you cannot name the third party. The issuing lab should be searchable, with a real website and contact details. Recognized analytical labs in this space publish their own verification portals. An unsearchable or unnamed “independent lab” is, functionally, an in-house number wearing a costume.
5. Sanity-check the dates and details
Small inconsistencies betray edits: a test date that predates the batch, a stale or missing date, mismatched fonts or kerning, a copy-pasted letterhead. None of these prove a forgery on their own, but together they are a pattern.
The gap every checklist shares
Here is the uncomfortable part: items 1 through 5 all assume the PDF itself is authentic. A static PDF can be altered after testing — a percentage changed, a date moved, a single real report reused across a whole product line. The checklist tells you whether a document looks legitimate. It cannot tell you whether this exact report came from the lab and has not been touched since.
So the question that actually matters is not “does this COA look clean?” It is “can I independently verify this specific report against the lab’s own record?“
What real verification looks like
The fix is not a prettier certificate — it is one you can confirm. Two mechanisms close the gap. A verification portal, where you enter a task ID and key and see the lab’s record for your batch. Or a cryptographically bound COA, where the certificate is tied to the lab’s record and fails verification the moment a single value is changed — you are confirming a live record instead of trusting a static file.
A COA with no verification mechanism is, structurally, just a claim. At Sirius Molecules every batch is third-party tested and issued with a cryptographically verifiable COA through Accumark Labs, so altering any value breaks the verification and you can confirm the report yourself rather than taking our word for it.
If you remember one line: do not grade a COA on how clean the number looks — grade it on whether you can independently verify it. Apply that standard to every supplier, us included.
