Quiet week in the Federal Register — which is its own finding, and below is the dated record of having looked. One clock does run out tomorrow.
Then: the regulator nobody elected, and the five-year consequence most owners have never read.
📡 The Radar
1. Empower’s response window to FDA closes on or about tomorrow. FDA’s September 18 warning letter to Empower Clinic Services, LLC d/b/a Empower Pharmacy — by most counts the largest 503A source of compounded semaglutide and tirzepatide in the country — gave the company “fifteen (15) working days of receipt of this letter” to respond in writing (FDA warning letter 738238, 09/18/2026). Counting working days from the letter’s own date puts that window closing on or about October 9; receipt dates aren’t public, so treat the date as approximate. As of October 7, FDA has posted no written response, no closeout letter and no further action on that page. Empower’s spokesperson has said publicly that the company already remediated many of the issues raised and continues to cooperate. The letter’s enforcement language is the part to read twice: “Failure to adequately address any violations may result in legal action without further notice, including, without limitation, seizure and injunction.” What it means for your clinic: “without further notice” is the operative phrase — there is no second letter, and no warning shot you get to plan around. If Empower is anywhere in your supply chain for compounded semaglutide or tirzepatide, directly or through a telehealth platform you resell, your continuity answer needs to exist on paper before anything is announced: the named second pharmacy, confirmation it’s licensed in your state, and the exact script for a patient mid-titration on the day supply changes. The clinics that get hurt in these episodes are the ones who find out from a patient.
2. The 503B decision on semaglutide, tirzepatide and liraglutide is still pending — ten weeks after comments closed. FDA proposed not to include semaglutide, tirzepatide or liraglutide on the 503B Bulks List, the list of bulk drug substances outsourcing facilities are permitted to compound from. The comment period closed July 30, 2026 (Docket FDA-2018-N-3240, Federal Register, 06/26/2026), and no final determination has posted since. What it means for your clinic: this is the 503B question, not the 503A one everyone tracks — different list, different facility type, and it is specifically about compounding from bulk API. Most clinics cannot tell you which section their pharmacy operates under, which is the actual problem. Find out, in writing, and ask that pharmacy the direct question: what changes for our patients if this proposal is finalized as written? Their answer tells you whether they have a plan or a hope.
3. The 503A peptide list hasn’t moved. Still — and now we know the next five. Term-scoped Federal Register searches confirm the April 16 notice announcing the July advisory meeting remains the most recent entry on 503A bulk drug substances. The only compounding items since July are an outsourcing-facility registration paperwork notice (Aug 31), an animal-drug draft guidance (Aug 28) and a neonatal parenteral-nutrition guidance (Sept 9) — none of them touching the 503A bulks list. The announced next step is still a second Pharmacy Compounding Advisory Committee meeting “before the end of February 2027,” and FDA has now named the five substances on that agenda: cathelicidin (LL-37), GHK-Cu, dihexa acetate, melanotan II, and pegylated mechano growth factor (PEG-MGF) (FDA PCAC meeting page); specific dates “will be scheduled in the coming months.” What it means for your clinic: if any of those five are on your menu, you have roughly four months of notice — which is more than anyone got last round. That is enough time to do the review while it’s still voluntary and cheap: what you stock, what you’d substitute, what the consent language says, and what you’d tell a patient on a protocol you can no longer refill. Last round, the clinics that waited for the vote spent August rewriting consents under time pressure.
🔭 The Watchlist
After October 9 — Empower. Whichever lands first: a posted written response, an FDA closeout letter, or an enforcement action. We’ll report it either way, including if nothing happens for months, because “nothing happened” is also information you can’t get from a vendor.
The 503B final determination on semaglutide, tirzepatide and liraglutide (Docket FDA-2018-N-3240). No statutory deadline forces it, so this could sit indefinitely.
PCAC round two, before the end of February 2027 — the five substances named above. Dates not yet set.
January 1, 2027 — Novo Nordisk’s list price cut. List prices for Wegovy, Ozempic and Rybelsus drop to $675 per month (announced February 24, 2026 — roughly 50% for Wegovy, 35% for Ozempic). The release is explicit that “These changes in list price do not have an impact on direct-to-patient, self-pay prices.” So your cash-pay comparison does not move on January 1 — but some of your patients’ insured out-of-pocket will, and every one of them will have seen a headline. Have the answer ready before they ask it in the room.
🔧 The Operator Lesson: the regulator nobody elected
There is a body that decides what your clinic may sell, how fast you get paid, how much of your own revenue it will hold back, and whether you may advertise at all. It publishes its rules, changes them without notice, and answers to no patient.
It’s your payment processor. And most owners treat it like plumbing.
1. The prohibited-products list is your real formulary
Your medical director sets a clinical formulary. Your processor sets the one that actually governs, because a product you cannot get paid for is a product you do not sell.
Every acquirer maintains a prohibited-and-restricted list. In this sector it reaches compounded injectables, peptides, hormones, anything marketed for weight loss, and anything the underwriter decides looks like a research chemical. The lists are not identical between processors, they are not always published in full, and they are revised when the bank’s own risk appetite changes — which can happen because of something another merchant did.
The action: get your processor’s current prohibited-and-restricted list in writing, and physically compare it line by line against your live catalog. Not from your sales rep — from the underwriting or compliance contact. Do it this quarter, and again whenever you add a SKU. If a product on your menu appears on that list, you are one review away from a freeze, and you’d rather find that out on your own schedule.
2. Underwriting is not an event. It’s a subscription.
The dangerous assumption is that approval is permanent. It isn’t. Acquirers re-inspect — triggered by volume growth, a chargeback cluster, a change in your website copy, a news story about your category, or nothing you’ll ever be told about.
When the re-inspection comes, it arrives as questions with short deadlines: what exactly do you sell, who supplies it, show us the labels, explain this product page. Clinics that can answer in a day keep processing. Clinics that need three weeks to find out who their pharmacy actually is get a hold placed on settlement while they look.
The action: keep a one-page merchant file current — legal entity, DBA, MCC, catalog with sourcing for each line, licensure, certifier status, and your named compliance contact. When underwriting asks, you send a document instead of starting an investigation.
3. The certifier gates the payments and the advertising
For US telemedicine advertisers, Google’s healthcare policy allows telemedicine providers only “if they’re accredited by LegitScript’s Healthcare Merchant Certification Program”; online pharmacies need LegitScript or the National Association of Boards of Pharmacy; and in both cases “advertisers must also be certified with Google” separately (Google Ads healthcare and medicines policy). The other large platforms run their own health-category reviews on top of that.
So one certifier’s opinion of your catalog decides two independent things: whether you can acquire patients through the largest ad platforms, and — because acquirers lean on the same signal — how your merchant account gets underwritten.
The action: treat certification status as infrastructure, not marketing paperwork. Know its renewal date. Know which products on your site were actually reviewed. Before you add a category, ask whether it survives certification — then build the page.
4. The consequence that follows you personally
This is the part most owners have never read, and it’s why the stakes aren’t merely “we’d switch processors.”
Visa and Mastercard operate terminated merchant files — Mastercard’s MATCH and Visa’s VMSS. Acquirers must screen every applicant against them before approval and must report any merchant they terminate for fraud, severe policy violations, or excessive chargebacks (terminated merchant files). The specifics are worse than the summary:
Listings last five years. Only the acquiring bank that filed the listing can remove or correct it, and only if it was filed in error — or, for PCI-DSS non-compliance specifically (Code 12), once full compliance is verified.
The record is personal. It includes the principal owner’s name, address, phone number and tax ID, not just the business entity’s. A new LLC does not walk away from it.
Closing the account first doesn’t help. Acquirers must list a qualifying merchant even when the violation surfaces or the relationship ends months later.
A listing must be filed within one business day of termination or eligibility. There is no cooling-off period in which to negotiate.
The Mastercard chargeback threshold is lower than almost anyone assumes. Code 4, Excessive Chargebacks, triggers when monthly Mastercard chargebacks exceed 1% of total monthly Mastercard sales transactions and total $5,000 or more — both in the same calendar month. There is no minimum number of individual chargebacks required.
Run the arithmetic on a clinic your size. The published qualification example: 125 Mastercard transactions and 6 chargebacks totalling $6,250 in one month — a 4.8% ratio. Both thresholds crossed, so the business qualifies for listing on termination. Six disputes. And winning or reversing those chargebacks later does not undo the listing.
Visa’s equivalent is far harder to trip — Excessive Disputes needs 1,000 disputes and a 1.8% ratio in a single month. Which means for a clinic doing ordinary volume, Mastercard’s threshold is the one that actually binds. Measure against that one.
There are also codes for Illegal Transactions and Violation of Standards — which is where a prohibited-product finding lands.
Most processors automatically reject anyone listed. That is not a bad quarter. That is five years of explaining yourself, personally, to every acquirer in the industry.
5. What to actually do
Never run on one rail. A second, underwritten, occasionally-used merchant account is cheap insurance against a freeze. Setting one up after the freeze takes weeks you won’t have payroll for.
Watch your chargeback ratio monthly, not quarterly. You now know the exact threshold, and the dollar figure is small. Measure against it.
Refund fast and early. A refund costs you the sale. A chargeback costs the sale, a fee, and a data point in a formula with a five-year consequence.
Make your billing descriptor obvious. A large share of disputes are patients who simply don’t recognize the line on their statement.
Know your MCC. It drives your rate, your reserve, and your review frequency. Being miscoded is common and expensive.
Write down who to call at the acquirer, the certifier and the pharmacy — before you need all three in one afternoon.
None of this is glamorous and none of it shows up in a marketing plan. It’s the difference between a clinic that has a bad week and a clinic that can’t take a card on Monday.
Before you go
New here? The Clinic Brief is a weekly read on what changed in the regulatory and business environment for cash-pay clinics, with the primary source attached every time.
The free Processor-vs-EMR Reconciliation Worksheet surfaced $58,000 in silently declined charges at one practice — the same category of money this issue is about. Download it →
The Clinic Operator’s Toolkit includes the Payment-Rail Map — every processor, pharmacy and platform you depend on, with the single point of failure marked. Reply “toolkit” for the founding-price list.
And tell us: do you have a second merchant account underwritten and ready to go? Hit reply. We read everything.
— Devin & Ryan
Who writes this. Devin Casey, MBA and Ryan Arvizo, FNP-C. We operate Revive Medical Care, a cash-pay practice in Phoenix, and BioPeakRx, a LegitScript-certified telehealth platform. That’s why this brief is about compounding supply chains, payment rails and documentation — we run them, and we usually get the decision wrong once before we write it up. When we have a stake in something we mention, we say so in the same sentence. Who we are, and what we own →
The Clinic Brief is business and regulatory information, not legal or medical advice. Talk to qualified healthcare counsel about your specific situation.