A THCA COA is a third-party lab report verifying what’s actually in your cannabis flower. To read it, check six things: lab name and accreditation, batch ID and date, cannabinoid panel (THCA %, delta-9 %, total THC), pesticides, heavy metals, and microbials. If any section is missing or blurry, walk away.
Here’s the thing. Forged and cropped COAs are everywhere in the THCA resale market right now. Screenshots pulled off Google. Batch IDs that don’t match the jar in front of you. Pesticide panels conveniently chopped off the bottom of the page. This guide exists to show you what a real lab report looks like, using an actual Passion Farms COA, so you can spot a fake in about thirty seconds flat.
Get this wrong and it costs you. Could be wasted money on a half-ounce that smells like hay. Could be moldy flower that makes your chest tight for three days after you smoke it. And if you’re running a dispensary, it could be a delta-9 reading over the legal line that takes your license with it. Knowing how to read a THCA COA is the cheapest insurance in cannabis. We’re walking through all six panels, the Farm Bill math that actually matters, the four tricks shady sellers run, and the thirty-second verification move. Lab report’s the only flex that holds up in court.
What a THCA COA Actually Is (and Why You Need to Read It)
The short version, a lab’s receipt for your weed
A Certificate of Analysis is the paperwork a licensed, third-party lab puts out after testing a batch of flower. Think of it as a receipt. Not for the money you spent. For the plant itself.
It says this sample, pulled from this specific batch, on this exact date, contained these cannabinoids, these terpenes, and was clean (or wasn’t) on pesticides, heavy metals, and microbial contaminants.
Buying THCA flower anywhere in the country? A real COA is the only way to know what you’re actually getting. Jar says “Zkittlez 26% THCA.” The COA says whether that number is real, whether the flower is federally compliant hemp, and whether somebody sprayed pesticide on the plant halfway through flower.
Why COAs exist (2018 Farm Bill and state compliance)
The 2018 Farm Bill legalized hemp federally. Meaning any cannabis plant with less than 0.3% delta-9 THC by dry weight. THCA flower threads that needle on purpose. High THCA. Low delta-9. Legal hemp until you apply heat. Every legit THCA operation tests every batch to prove that compliance, and states layered their own testing requirements on top, especially around pesticides, solvents, and mold.
No COA, no compliance. No compliance, no legal product. Really is that simple. For the broader category context, our THCA flower buyer’s guide walks the whole picture.
What happens when you don’t check one
Most people buy blind.
Jar looks good. Bud looks good. Price feels fair. They never open the COA. When the flower hits weak they blame the strain. When a dispensary gets cited the owner acts shocked. But nine times out of ten, the COA would have told the whole story before money changed hands.
Reading the COA is a skill. Also the cheapest insurance in cannabis. Free, really.
The 6 Sections of Every Legit THCA COA
Every real COA has the same anatomy. Labs format it differently. Bones are the same.
The six core sections:
- Header. Lab name, address, accreditation, sample ID, batch ID, date received, date reported, and the client (producer) name.
- Cannabinoid panel. THCA, THC, delta-9 THC, delta-8, CBDA, CBD, CBG, total THC, total CBD.
- Terpene profile. The aroma and effect compounds. Myrcene, limonene, caryophyllene, linalool, pinene, and others.
- Pesticides. A long list of chemicals tested. Each line either passes (ND or below the action limit) or it fails.
- Heavy metals. Arsenic, cadmium, lead, mercury. All four must come in under state and federal thresholds.
- Microbials. Mold, yeast, E. coli, salmonella, aspergillus. The stuff that sends people to urgent care.
Miss one of those six on the report you’re looking at? That’s not a COA. That’s a partial COA, which is basically a rumor with a lab logo stamped on it.
Header
The header tells you who tested it, when, and what they tested. You want an ISO 17025 accreditation stamp somewhere on the document. That’s the international standard for testing labs. No stamp, no trust.
Cannabinoid panel
Main event. We go deep on this in the next section.
Terpene profile
Not every COA includes terps. The ones that do are telling you the flower was grown and cured with enough care to still have its aroma compounds intact. Myrcene over 0.5% usually means couch-lock. Limonene means citrus, uplift. Caryophyllene runs peppery and relaxing.
Pesticides
This is the panel shady sellers crop off. Thirty to sixty pesticides get tested depending on the state. You want “ND” (not detected) or readings below the action limit on every single line. One failed pesticide is enough to condemn the whole batch.
Heavy metals
Cannabis pulls metals out of the soil like a sponge. Bad soil means lead or cadmium in your flower. A legit COA shows all four metals at or below state limits. This one isn’t negotiable, ever.
Microbials
Mold is the silent killer in the THCA game. Improper cure, humid storage, or a sloppy trim room can push aspergillus counts into dangerous territory. The COA tells you. Your lungs don’t get a second chance to find out.
How to Read a THCA COA’s Cannabinoid Panel (The Part That Matters Most)
This is the section buyers open first and understand least.
What THCA % means vs. what you smoke
THCA is the non-intoxicating acid form of THC. That number on the COA, say 26.4%, represents the raw THCA content of the sample by dry weight. Apply heat (lighter, vaporizer, joint) and THCA converts to delta-9 THC through decarboxylation. You lose some mass in that conversion. So the total THC number matters more than the raw THCA number when you’re thinking about what you’ll actually feel.
If the difference between THCA and THC is still fuzzy, our THCA vs. delta-9 THC breakdown clears it up in about four minutes.
Delta-9 THC %, the federal legality line
This number has to stay under 0.3%. Every single time. That’s the federal Farm Bill threshold separating legal hemp from federally controlled marijuana. Real THCA flower runs somewhere between 0.1% and 0.28% delta-9. Anything at or above 0.3%? You don’t have hemp anymore. You have a compliance problem.
Total THC, the math that keeps it hemp
Total THC is the calculated number that accounts for how much THC you’d end up with if all the THCA decarbed. States handle this differently, federal guidance has been inconsistent, and we cover the actual math in the next section.
The Farm Bill Math, Without the Jargon
The <0.3% delta-9 rule
Rule is simple. Enforcement isn’t.
Federal law cares about one number. Delta-9 THC must be below 0.3% by dry weight. THCA can be anything, including 30%+, as long as delta-9 stays under 0.3%.
The total THC formula
Here’s the formula enforcement agencies use:
Total THC = (THCA × 0.877) + Delta-9 THC
That 0.877 is the molecular weight ratio. When THCA loses its acid group during decarb the resulting molecule is lighter, so 1% of THCA converts to about 0.877% of delta-9 THC. Not a trick. That’s just chemistry.
Worked example with realistic numbers:
Say the COA shows 26.4% THCA and 0.21% delta-9 THC. Plug it in.
Total THC = (26.4 × 0.877) + 0.21 = 23.15 + 0.21 = 23.36%
That’s the number you’ll effectively hit when you smoke it. Also why people feel like THCA flower is indistinguishable from traditional weed. Because chemically, after you light it, it is.
Why THCA flower can hit 25%+ and still be federal hemp
Farm Bill doesn’t care about total THC. It cares about delta-9 THC in the raw, pre-combusted sample. Some states care about total THC. Texas, as of the latest court rulings, still tracks the federal delta-9 threshold for hemp-derived products. If you’re in the state, our breakdown of whether THCA is legal in Texas has the current picture.
People love to act outraged about the loophole. Isn’t a loophole. It’s what the bill says. Read it.
4 Things Shady Sellers Hide or Fake on Their COAs
Screenshot this section. The four plays that separate real operators from people running a website out of their apartment.
Red flag #1: The COA doesn’t match the batch
Oldest trick in the book. Seller posts one COA and uses it for five different batches. Sometimes fifty. You order Gelato, they send you something else, and then they point at the COA for the good Gelato they had three months ago. The batch ID on the jar has nothing to do with the batch ID on the paperwork.
We’ve watched Houston smoke shops (we’ll leave names out of it) run this exact play for months. Same COA showing up on five different jars, batch numbers no longer matching anything physical on the shelf, and when a customer asks the counter guy shrugs and says the lot “happened to match.” That COA “happened to match” five different strains in a row. Pattern’s real. Name the pattern, not the shops.
How to catch it: the batch ID and sample ID on the COA must match what’s printed or stickered on the jar. Letter for letter. Number for number.
Red flag #2: No pesticide or heavy metals panel shown
Some sellers post a screenshot of the cannabinoid panel only. Nothing else on the PDF. They’ll say something like “that’s the part you care about, right?” No. The cannabinoid panel tells you how you’ll feel. The pesticide and heavy metals panels tell you whether the flower is going to hurt you.
How to catch it: if the PDF you’re looking at is one page, it is not a full COA. Real reports run two to four pages minimum. Ask for the full document, not the screenshot.
Red flag #3: Watermark stripped, logo edited, PDF flattened
Labs put watermarks, QR codes, and digital signatures on their reports for a reason. A flattened PDF (no embedded links, no metadata, no copy-paste) has usually been run through Photoshop. The logo looks slightly off. The spacing feels weird. The batch number font doesn’t match the rest of the document.
How to catch it: if the PDF won’t let you copy-paste text, or the QR code won’t scan, or the lab’s name is spelled two different ways on the same page, that’s forged paperwork.
Red flag #4: The lab doesn’t exist (or doesn’t recognize the sample)
The final tier, and the laziest of all of them.
Seller fabricates the whole document. The “lab” is a name somebody made up at 2 a.m. Or the lab is real, but they’ve never heard of this sample. So call them. Labs verify samples by phone or email. Real labs do. The fake ones don’t have a phone.
How to catch it: Google the lab. Confirm the physical address. If the sample ID is on their portal, you’re good. If not, walk. For a broader trust-side read, check how to buy THCA without getting burned.
Legit COA vs. Suspicious COA (quick scan):
| Check | Legit | Red Flag |
|---|---|---|
| Lab name and accreditation visible | Yes, with ISO 17025 stamp | Missing, logo only, or misspelled |
| Batch ID matches the jar | Identical, letter-for-letter | Close but not exact, or blank |
| QR code scans to lab website | Opens the lab’s portal | Dead link, wrong domain, or no code |
| All 6 panels present | All 6 on the document | 1 or 2 panels only, cannabinoid-only screenshot |
| Watermark / digital signature intact | Present, readable | Flattened, stripped, or oddly spaced |
| Date within 12 months | Recent batch | Over a year old or no date |
How to Verify a COA Is Real in Under 30 Seconds
You don’t need to be a lab tech. You need four moves.
Step 1. Find the lab’s website. Open a new tab. Type the lab’s name from the COA header straight into Google. Confirm the site is a real lab (usually a domain with “labs” or “analytical” in it) and not a blog with the same name pretending.
Step 2. Match the batch ID and sample ID. Compare the numbers on the COA to what’s printed on the jar or order confirmation. Exact match or you have a problem.
Step 3. Scan the QR code. Most legit labs put a QR code directly on the report that links to a verification page on their own site. Scan it. URL should be the lab’s official domain. If the code opens a Dropbox link, Google Drive, or some random domain, that’s tampered paperwork.
Step 4. Call the lab if anything looks off. Thirty seconds on the phone ends most questions. Give the sample ID. Ask if it’s real. Legit labs answer this question all day long, every day, and they answer it for free.
Four steps, under a minute, and you’ll never smoke mystery flower again.
A Real Passion Farms COA, Annotated
This is our paperwork. Look at it.
Every batch that comes off our California grow or our Oklahoma grow gets tested. Full panel. Every time. The COA lives with the product from harvest to the jar in your hand. Here’s how to read ours.
Walk-through of the header
Lab name at the top. Accreditation stamp right below it. Our name (Passion Farms LLC) listed as the client. Sample ID. Batch ID. Date received and date reported. The header alone tells you who grew it, where it went for testing, and when. If any one of those lines is missing on any COA you ever look at, that’s not a full report.
Walk-through of the cannabinoid panel (with the math done for you)
Pick a line off the panel. Say our current Jealousy batch runs 27.2% THCA and 0.19% delta-9 THC. Here’s the math:
Total THC = (27.2 × 0.877) + 0.19 = 23.85 + 0.19 = 24.04%
Federal compliance on delta-9 (0.19% is well under 0.3%). Strong total THC. That’s the full story in two lines. You don’t need a chemistry degree. You need the formula and about thirty seconds.
What “ND” and “<LOQ” mean on pesticide/metals lines
ND means “not detected.” The instrument ran the test and found zero.
<LOQ means “below the limit of quantification.” The test detected a trace amount but less than the instrument can reliably measure. Regulators treat <LOQ and ND as effectively the same. Both mean you’re clean on that compound.
On a legit PF COA, every pesticide line reads ND or <LOQ. Every heavy metals line reads well below action limit. Every microbial line reads “pass.” That consistency is what clean cultivation looks like on paper.
Reading COAs for Different Product Types
A COA for a jar of flower and a COA for a disposable vape are not the same document. Different panels matter for different products. Run this table before you buy.
| Product | Key panel to check | Unique red flag | PF category |
|---|---|---|---|
| Flower | Cannabinoid + microbial | No moisture reading | our bulk THCA flower lineup |
| Preroll | Cannabinoid + microbial + pesticide | COA is for the flower, not the finished preroll | PF prerolls |
| Moonrock | Cannabinoid + residual solvent (concentrate coating) | Solvent panel missing | PF moonrocks |
| Edible / gummy | Per-piece dose + full panel on the batch | “Total batch” potency without per-piece math | PF edibles |
| Disposable vape / cart | Residual solvents + heavy metals + cannabinoid | No solvent panel, hardware metals not tested | PF disposables |
Flower COAs
Straightforward. Cannabinoid panel, terpenes (bonus if they’re there), and the full contaminant sweep across pesticides, metals, and microbials. Browse our current batch on the bulk flower page if you want to see what a real flower menu with complete paperwork looks like.
Preroll COAs
The flower inside the cone should have been tested. Some brands test the rolled product too. Ask which one the COA covers. If the preroll has infused kief or concentrate, the residual solvent panel should be there. Our prerolls ship with the flower-batch COA attached.
Moonrock and concentrate COAs
Moonrocks are flower dipped in concentrate and rolled in kief. Three products in one jar. You want a COA on the flower and a separate COA on the concentrate if you’re being thorough. Bare minimum, the concentrate’s residual solvent panel has to show up. Our moonrocks carry both.
Edible and gummy COAs
Look for per-piece potency, not just batch potency. A gummy lab reports something like “10 mg per piece, tolerance ±10%.” That’s the number you care about. A COA that only shows total batch milligrams is incomplete paperwork for a dosed product. Every Passion Farms edible is tested per-piece before it leaves.
Disposable vape and cart COAs
This is where the fraud concentrates. Residual solvents from extraction (butane, ethanol, heptane) have to clear. Heavy metals from cheap hardware coils also have to clear. A cart COA without a residual solvents panel is a straight-up deal-breaker. See what full-panel testing looks like on a real disposable.
What Wholesale & Bulk Buyers Should Additionally Check
B2B buyers, this part’s for you.
Batch-size consistency across shipments
A legit supplier runs consistent batch sizes and documents each one. If you’re getting a pound from a 50-pound batch and that same supplier is somehow shipping to a dozen other people from that same 50-pound batch, the math stops working. Ask for the batch weight. Ask how many units were harvested. Numbers tell the truth when people won’t.
Pesticide classes beyond the state minimum
Texas and California require testing on specific pesticide panels. Some labs test the minimum. Some test 60+ compounds across all major classes. On wholesale orders, request the extended panel. Clean flower stays clean on the extended panel. Dirty flower starts throwing hits as soon as the panel expands.
Lab-of-record vs. self-commissioned testing
Anyone can pay a lab to run a sample they cherry-picked. What matters is whether the supplier uses a lab-of-record (same lab, every batch, on file with the state) or whether they’re shopping around for favorable results. Passion Farms uses the same accredited labs for every batch, every product, every time. That’s traceability. That’s what a compliance officer is looking for when they audit you.
Requesting per-lot COAs before a pound+ order
On any order over a pound, the per-lot COA should be sitting in your inbox before the truck leaves our dock. If a supplier can’t produce one, they either don’t have it or they’re hiding something. Either way, not your problem, and not your order. Want a live wholesale conversation? Talk to the wholesale desk and we’ll send you current COAs before you commit a dollar.
Your COA Checklist Before You Buy (and Where to Get Verified PF Flower)
One page. Keep it on your phone. Run it before you spend.
The 10-point checklist
- Lab name and ISO 17025 accreditation visible on the header.
- Batch ID on the COA matches the batch ID on the jar or packaging, character for character.
- Sample ID is present and verifiable with the lab directly.
- Date on the COA is within the last 12 months.
- Cannabinoid panel shows THCA %, delta-9 %, and total THC clearly.
- Delta-9 THC reads below 0.3%.
- Pesticide panel is included and every line reads ND, <LOQ, or below action limit.
- Heavy metals panel (arsenic, cadmium, lead, mercury) is present and all four pass.
- Microbial panel is present and all pass, including aspergillus.
- The COA is a multi-page PDF with intact watermarks, a working QR code, and matching lab name across the document.
Miss one of these, ask questions. Miss three, walk.
How Passion Farms handles COAs (every batch, every product)
Every batch of PF flower, every preroll, every cart, every gummy gets a full-panel COA from an accredited lab before it moves. Paperwork lives with the product. You can ask for it before you order, while you’re ordering, or after it arrives. We send it. No drama, no “let me check with the team” runaround, no slow email chain. This is how we read a thca coa ourselves before we put it in a jar with our name on it.
Next steps
If you’ve been burned before, you already know what to look for. If you haven’t, now you do. Knowing how to read a THCA COA moves you out of the “hope it’s fire” crowd and into the people buying with their eyes open.
Browse the bulk flower menu, the prerolls, the moonrocks, the edibles, or the disposables on our shop page. Check the COAs that come with each one. If something looks right, hit us. Wholesale buyers route through the contact page. Individual buyers route through the shop. Either way, the paperwork’s ready when you are.
Frequently Asked Questions
1. What is a COA for THCA flower?
A Certificate of Analysis is a third-party lab report confirming what’s in a specific batch of THCA flower. It shows cannabinoid levels, terpenes, and results for pesticides, heavy metals, and microbials. Without one, you’re guessing.
2. How do I know if a THCA COA is real?
Four-step check. Google the lab. Match the batch ID to the jar. Scan the QR code and confirm it lands on the lab’s own domain. Call the lab if anything looks off. Most fake COAs fail one of those four inside a minute.
3. What should the delta-9 THC number on a THCA COA be?
Below 0.3% by dry weight. That’s the federal Farm Bill threshold for legal hemp. Real THCA flower usually reads between 0.10% and 0.28% delta-9. Anything 0.3% or higher isn’t federal hemp anymore.
4. Is THCA flower legal in Texas if the COA shows the total THC is high?
Yes, under current federal guidance and Texas court rulings. Texas tracks the federal delta-9 threshold for hemp-derived products, meaning a high total THC number (from THCA decarbing) isn’t automatically disqualifying as long as delta-9 THC stays below 0.3%. Landscape changes. Always check the most recent legal posts on our site.
5. How do I calculate total THC from a COA?
Use the formula Total THC = (THCA × 0.877) + Delta-9 THC. So if your COA shows 26% THCA and 0.2% delta-9, your total THC is (26 × 0.877) + 0.2 = 23.0%. That’s the effective number after you light it.
6. What does “ND” mean on a THCA lab report?
ND is “not detected.” The test found zero of that compound. You’ll also see <LOQ, which is “below the limit of quantification,” meaning there’s a trace amount too small to measure reliably. For pesticides and heavy metals, ND and <LOQ are both fine.
7. Can a dispensary sell THCA flower without a COA?
No. Not legally. Not responsibly. Every licensed operator has to keep a COA on file for every batch they sell, and has to make it available on request in most states. A dispensary without COAs is a dispensary one inspection away from a problem.
8. How recent should a THCA COA be?
Within 12 months of harvest as a rule. Cannabinoid content degrades over time, and many state programs treat older COAs as expired. If the COA is dated more than a year ago, ask for a more recent one or request a retest.
9. Do Passion Farms products come with a COA for every batch?
Yes. Every batch. Full panel, accredited lab, available on request before or after your order. Wholesale orders come with per-lot COAs in the shipment email. Retail orders have them available through our team at any time, and our bulk flower lineup and prerolls ship with the paperwork attached.
10. Is it safe to smoke THCA flower that has no pesticide panel on the COA?
No. A cannabinoid-only report is not a full COA. Without a pesticide panel, you have no way to know whether the flower was grown with compliant inputs. Mold and heavy metals matter too. Full panel or no purchase.
11. How do I read a COA for THCA gummies or edibles?
Look for per-piece potency first. A 10 mg gummy should be tested as 10 mg per piece with a variance tolerance listed, something like ±10%. Then verify the full-panel contaminants on the batch. PF edibles show both per-piece dose and batch panel on every COA.
12. What’s the difference between a COA for flower and one for a disposable vape?
A vape COA adds a residual solvents panel, which tests for chemicals used during extraction (butane, ethanol, heptane). It also has to clear heavy metals tighter, since cheap vape hardware can leach metal into the oil. Flower COAs don’t need a solvent panel because there’s no extraction involved. If a disposable COA is missing that solvent panel, don’t buy it.
