Coffee Roaster Food Safety Guide: FDA Rules, Hazards & SQF

Coffee Roaster Food Safety at a Glance

• Dec 31, 2026Deadline to renew FDA food facility registration; FDA treats unrenewed registrations as expiredFDA, September 29, 2026
• $1,372,952Three-year average (2023 to 2025) of human food sales, plus the value of food made or held for others without sale, below which a roaster is a very small business. Affiliates' sales countFDA inflation-adjusted cut-offs; 21 CFR 117.3
• 29Coffee product recall events in FDA enforcement reports, 2019 to 2026, by our countopenFDA, our analysis
• 3.0 µg/kgEU limit for ochratoxin A in roasted coffee. The U.S. sets no limitRegulation (EU) 2023/915

Updated October 2, 2026. Rules were checked against the eCFR, FDA guidance and enforcement data, California and EU law, and SQFI's published codes. Regulations change: confirm your own requirements before you plan an audit.

Does a Coffee Roaster Need to Register With FDA?

Yes, unless an exemption applies, and for most roasters the one that matters is the retail food establishment exemption. Any facility that manufactures, processes, packs or holds food for U.S. consumption must register with FDA, and coffee roasting counts. You're retail, and exempt, only if your sales directly to consumers are worth more than your sales to all other buyers. Registrations must be renewed every even-numbered year.^[1][2]

Businesses don't count as consumers, so the cafés, grocers, offices and online retailers you supply all sit on the wholesale side. The retail definition covers establishments that make the food they sell, so roasting on site doesn't by itself remove the exemption. FDA's registration guidance gives the example of a bakery with 40% wholesale sales that is still exempt because most of its sales are to consumers. A roaster that sells to consumers online or by mail order may also be a retail food establishment. FDA's answer is only "maybe": it depends on whether the roaster meets the rest of the definition. FDA also says a warehouse at a different location from the store must register, because it doesn't sell to consumers there. By the same reasoning, a separate roastery that supplies your cafés will usually need its own registration.^[1][3]

The exemptions in 21 CFR 1.226 also cover farms, restaurants and nonprofit food establishments. Roasting isn't a farm activity, so a coffee farm that roasts beans it sells off the farm is a farm mixed-type facility and registers unless the retail exemption applies. Check your sales mix every year.^[1][3][4]

Registration is free. You renew through your FDA Industry Systems account, include a unique facility identifier (FDA currently accepts a DUNS number) and assure FDA that it may inspect the facility. FDA says it will treat registrations not renewed by December 31, 2026 as expired, and failing to register is a prohibited act. In 2024, FDA's warning letter to Brewing Market Coffee in Boulder, Colorado cited an unrenewed registration, along with missing process filings for the company's shelf-stable chai.^[5][6][7]

Which FDA Food Safety Rules Apply to Roasters?

A registered roastery falls under FDA's preventive controls rule, 21 CFR Part 117. Every roastery must follow the current good manufacturing practices in subpart B. Unless you're a qualified facility, you also need a written food safety plan with a hazard analysis and preventive controls (subpart C), prepared or overseen by a PCQI. If you rely on a supplier to control a hazard you identify, the plan also needs a supply-chain program (subpart G).^[8][9][10]

Roasting fits FDA's definition of manufacturing/processing, and FDA's 2016 draft classification guidance lists roasting among its examples. Apart from the size-based qualified facility exemption below, none of the Part 117 exemptions covers roasting off the farm.^[11][12][8]

You're a qualified facility if you're a very small business. That means your human food sales, plus the market value of food you make, pack or hold without selling it (for example, coffee you toll-roast for a fee), averaged less than $1,372,952 a year over 2023 to 2025, counting subsidiaries and affiliates. You also qualify if your average food sales were under $686,476 and more than half was sold directly to qualified end-users. Those are consumers, or restaurants and retail food establishments in your state or within 275 miles that buy the food to sell directly to consumers.^[13][11]

A qualified facility skips subparts C and G but still follows the CGMPs and the modified requirements in 117.201. You determine your status by July 1 each year. Every two years, in the October to December window that is open now, you file an attestation online or on Form FDA 3942a. It confirms you're a qualified facility and states either that you've identified your hazards and are implementing and monitoring preventive controls, or that you comply with state or local food safety law. If you choose the state-law option, your labels must show the facility's name and complete business address. If your July 1 check shows you no longer qualify, notify FDA by July 31 and meet subparts C and G by December 31 of that year.^[14][5]

Some FSMA rules ask less of coffee. FDA treats green coffee as a raw agricultural commodity that can't be consumed without an appropriate control, so a facility that handles green beans without roasting them can document that and leave the control to the roaster. The Produce Safety Rule doesn't cover coffee, and coffee isn't on the Food Traceability List, so FSMA 204's extra records apply only if a product contains a listed food that stays in its listed form, such as a nut butter.^[15][16][17]

If you import green coffee yourself, you're the importer under the Foreign Supplier Verification Program (FSVP) rule. A roastery that must follow subparts C and G and controls the hazards in that coffee is treated as meeting FSVP, apart from identifying itself as the importer at entry. A qualified facility doesn't get that shortcut and needs its own FSVP, though very small importers can follow simpler requirements. Under FSMA, FDA must inspect domestic facilities that aren't high-risk at least once every five years.^[18][19]

What Are the Food Safety Hazards in Coffee Roasting?

FDA's draft hazard guide lists Salmonella as the biological hazard for roasted beans, whole or ground, and ochratoxin A, a mold toxin, as the chemical hazard for every form of coffee. FDA's guide also flags foreign material, allergen cross-contact and label errors, and acrylamide formed at high heat. For refrigerated ready-to-drink coffee and concentrates, it adds Clostridium botulinum and Bacillus cereus, depending on pH, water activity and process. Recall records add decaf mix-ups.^[20][21]

Most hazards here appear in FDA's draft Appendix 1 (January 2024), which is nonbinding. Stones, twigs and leaves come from Codex, the solvent limit from 21 CFR 173.255 and decaf mix-ups from recall records. Controls are common practice; your own hazard analysis decides which you need.^{[20][22][23][21]}

For physical hazards, FDA names metal and hard plastic as the most relevant ones from the process, plus glass when the product is packed in glass. Codex describes removing stones, twigs and leaves when coffee cherries are selected, and sorting foreign matter and defective beans out of green coffee. FDA's compliance policy treats a hard or sharp object 7 to 25 mm long in ready-to-eat or minimally prepared food as adulterated. Other sizes, or food that needs more preparation, can also count if FDA finds a health hazard.^[20][22][24]

Plain coffee contains no major allergen, but flavorings can. Under the FD&C Act, a flavoring that contains protein from a major food allergen must be declared, even though flavors are otherwise listed generically. The U.S. has nine major allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. FDA's January 2025 guidance lists the tree nuts that count as major allergens, and coconut is no longer on that list. In 2024, a Texas coffee company recalled 540 pounds of bagged coffee for potential contact with almonds, pecans and coconut.^{[25][26][27][21]}

Acrylamide forms from sugars and the amino acid asparagine at roasting temperatures. FDA's draft hazard guide names it as a chemical hazard the process can create, but FDA sets no limit. Its 2016 guidance said FDA knew of no proven way to reduce acrylamide in coffee, and it notes that dark roasts have less acrylamide than light roasts and robusta somewhat more than arabica. For decaf, FDA limits methylene chloride residue to 10 ppm in decaffeinated roasted and instant coffee.^{[28][20][29][23]}

What Are the Limits for Ochratoxin and Acrylamide?

The U.S. sets no legal limit for ochratoxin A or acrylamide in coffee. The EU caps ochratoxin A at 3.0 µg/kg in roasted coffee and 5.0 µg/kg in instant coffee. Its acrylamide benchmark levels aren't legal limits. California's Prop 65 rule says cancer-listed chemicals created by roasting and brewing pose no significant risk, so they need no warning.^{[30][29][31][32][33]}

The EU lowered its ochratoxin limits for roasted and instant coffee to these levels on January 1, 2023. FDA's mycotoxin program aims partly to gather data that could support future U.S. limits.^{[30][29][34][31][35][32][33][36]}

FDA tested 514 coffee bean samples, mostly green, for ochratoxin A from 2008 to 2022. Only 14 (2.7%) had a measurable level, and 10 of those were above the EU roasted-coffee limit. Codex says roasting cuts ochratoxin A by 65% to 100% depending on the process. Prevention therefore focuses on green coffee: dry it to no more than 12.5% moisture, keep it at or below that through storage and shipping, and keep tolerance for black and sour defective beans low.^[30][22]

FDA detains imported green coffee lots that fail its insect and mold criteria, and lots detained for insect-damaged or moldy beans must be fully reconditioned before they move to the roasting plant.^[36][37]

In the EU, coffee producers must find and control the roast conditions that keep acrylamide down. Businesses that only sell at retail or supply local shops follow lighter rules with no coffee steps. EU café chains supplied centrally may buy only from producers that apply the coffee measures, so a U.S. roaster supplying an EU chain should expect questions.^[32]

California's coffee rule has been in effect since October 1, 2019. It covers only chemicals created by roasting or brewing, and only those listed by March 15, 2019. Chemicals added through flavorings, creamers or other ingredients, or that get in as contaminants, are outside the rule, and OEHHA says the same of methylene chloride residue in decaf. Businesses with fewer than 10 employees are exempt from Prop 65 warnings. In 2022, a California appeals court affirmed that the rule was a complete defense in the long-running acrylamide case CERT v. Starbucks.^{[33][38][39][40]}

Is Cold Brew Coffee a Botulism Risk?

It can be. Cold brew is often made with no heat step, and a 2018 study of light roasts found cold brews at pH 4.96 to 5.13, close to hot brew's pH. That's above 4.6, the line FDA uses, along with water activity above 0.85, to define a low-acid food, so acidity won't stop Clostridium botulinum. Refrigerated cold brew depends on cold storage and a "Keep Refrigerated" label, and shelf-stable canned or bottled coffee needs an FDA-filed thermal process.^{[41][42][43][4]}

Products labeled "Keep Refrigerated" are outside FDA's low-acid and acidified canned food rules, Parts 113 and 114. They rely on refrigeration and Part 117 controls instead. Shelf-stable low-acid coffee in sealed cans or bottles is different. The processor must register as a food canning establishment within 10 days of starting. It must also file a scheduled process for each product and container size within 60 days of registering, and before packing any new product.^[43][4]

Recalls show what goes wrong:

• June 2024: co-packer Snapchill recalled all its canned coffee after FDA told it the low-acid canned food process hadn't been filed. FDA's product list named about 285 products sold under about 145 roaster brands.^[44]
• 2022: Lyons Magnus recalled shelf-stable cold coffees, including Stumptown, Intelligentsia and Café Grumpy products, as Class I for potential Cronobacter sakazakii and C. botulinum.^[21]
• 2017: Death Wish Coffee recalled its canned nitro cold brew after it and an outside process authority found the process could allow botulinum toxin to form. FDA's enforcement report lists 80,777 cans.^[45][21]
• July 2026: Brooklyn Roasting Works recalled 1,219 bag-in-box units of pasteurized cold brew concentrate because storing it at room temperature could allow toxin to form.^[21]
• May 2026: Fairhope Roasting Company recalled cold brew concentrate whose label lacked a "Keep Refrigerated" statement.^[21]

If a co-packer cans or bottles shelf-stable coffee under your brand, ask it to show that it is registered as a food canning establishment and has filed a scheduled process for each of your products and container sizes before it packs them.^[4][44] Importers carry their own duty. In 2021, FDA warned UCC Ueshima Coffee Company America for having no FSVP for its imported ready-to-drink coffee and for not verifying that the low-acid canned coffee was made under Part 113.^[46]

At retail, state food codes set the rules. Wisconsin's guidance, for example, treats cold brew made without heat as a time/temperature control for safety (TCS) food that must be refrigerated, unless testing shows otherwise. It requires a HACCP plan and a variance if cold brew is brewed, held or served above 41°F, or if it is kegged or packed with reduced oxygen, such as under nitrogen, and held more than 48 hours. Cold brew brewed, held and served at 41°F or below, date-marked for no more than 7 days and, if kegged, held in the keg no more than 48 hours needs neither.^[47] A study commissioned by the National Coffee Association (NCA) found no pathogen growth or toxin in black cold brew held at 85°F for up to 11 days, but NCA cautions that health departments may still treat retail cold brew as TCS.^[48]

What Do FDA Coffee Recalls Show?

From 2019 to mid-2026, FDA enforcement reports list 70 coffee product recall records in 29 recall events, by our count. Cold brew and canned coffee processing failures account for the most products. Allergens and foreign material account for the most separate recalls. No coffee recall in the dataset, which goes back to 2012, cited mold, ochratoxin or acrylamide.^[21]

Our count of openFDA food enforcement data, last updated September 23, 2026 (report dates July 2019 to July 2026). We kept recalls where the product itself is coffee and left out coffee-flavored foods. One recall event can cover many products. By class: 9 Class I, 54 Class II and 7 Class III records. Two allergen recalls also named coconut, which is no longer on FDA's list of tree nuts that count as major allergens. Import detentions aren't in this dataset.^[21][27]

For roasted beans, recalls have come from labels, allergen cross-contact and foreign material. The biggest and riskiest recalls have involved liquid coffee. A Class I recall can still happen with beans: in 2012, a Wisconsin roaster recalled three flavors of whole bean and ground coffee that contained undeclared walnut.^[49]

Do Buyers Require SQF or GFSI Certification for Coffee?

Many retail buyers require it for private label. Walmart requires GFSI-recognized certification, or an approved alternative, at every site making its private-brand food. Kroger requires a GFSI-benchmarked scheme at plants making its Our Brands products, and Target has required GFSI certification for its owned-brand food since 2009. None of these documents names coffee specifically.^[50][51][52]

For national-brand products, Walmart requires an annual food safety audit at every manufacturing site and encourages GFSI certification; our guide to Walmart's supplier requirements covers the details.^[53] The Global Food Safety Initiative (GFSI) doesn't certify anyone itself. It recognizes certification programs, including SQF, BRCGS, FSSC 22000 and IFS.^[54]

SQFI-licensed certification bodies certify coffee makers to the SQF Food Safety Code: Food Manufacturing. Edition 9 places "dried tea and coffee products" in food sector category (FSC) 19 and "liquid tea and coffee" in FSC 16. A retorted or UHT low-acid coffee drink may instead, or also, fall under FSC 15. Coffee roasting isn't named in any category, so your certification body confirms your FSC.^[55][56]

All three categories use the SQF Food Safety Code: Food Manufacturing. A site can hold more than one category.^[55][56]

Edition 9 is the only GFSI-recognized SQF edition today. SQFI expects Edition 10 audits to start no earlier than January 2, 2027, depending on GFSI benchmarking, and the edition used depends on your audit date. SQF certification is valid for one year, so you re-certify every year. The certification body also runs one unannounced audit every three years.^{[57][58][59][55]} The SQF certification guide walks through the process.

SQF Fundamentals is a simpler program for small and emerging manufacturers, with Basic and Intermediate levels. SQFI says it doesn't meet GFSI benchmarking requirements, so it won't satisfy a buyer that requires GFSI certification. Only licensed SQF certification bodies can certify to it.^[60]

Does the EU Deforestation Rule Affect U.S. Roasters?

If you sell coffee into the EU, it does. The EU Deforestation Regulation (EUDR) covers green and roasted coffee from December 30, 2026. Instant coffee and other coffee extracts and concentrates are added from December 30, 2027. Coffee must be grown on land not deforested after December 31, 2020, produced legally and covered by a due diligence statement that traces it to each farm plot.^[61][62][63]

When a company outside the EU, such as a U.S. roaster, places coffee on the EU market, the first company in the EU to make it available is treated as the operator. If that company was a micro or small business established by December 31, 2024, its obligations start June 30, 2027. Your own size doesn't change that date. The operator needs the geolocation of every plot where the coffee was grown, to at least six decimal places, with polygons for plots over four hectares. It also needs the production dates and supplier and customer details, and it must keep them for five years. Expect EU buyers to ask you for farm-level data from your green coffee suppliers. The dates have already moved twice, so check EUR-Lex before you plan.^[61][62]

How Do You Build a Roaster Food Safety Program?

Start with your FDA status, then build a program a buyer or auditor can follow.

1. 01Confirm your FDA statusCheck your sales mix for registration and your three-year average sales for qualified facility status. Renew or attest between October 1 and December 31, 2026.^[2][14]
2. 02Map your products and processCover every step from green coffee receiving through roasting, cooling, grinding, flavoring, packing and storage, plus any cold brew or canned lines.
3. 03Run a hazard analysisInclude Salmonella, ochratoxin A, foreign material, allergens, decaf mix-ups and acrylamide. For liquid coffee, add C. botulinum.
4. 04Write your food safety planIt includes the hazard analysis, preventive controls, recall plan, and monitoring, corrective action and verification procedures. Add a supply-chain program if you rely on a supplier to control a hazard. FDA has said roasters can show their roast is adequate with published scientific information, kept as a record.^[9][64] See validation vs. verification for how the two differ.
5. 05Name a PCQI and train your teamThe PCQI prepares or oversees the plan. Everyone who handles food needs training in food hygiene and food safety suited to their job.^[9][65]
6. 06Test itRun a mock recall and an internal audit before a customer or certification audit.
7. 07Choose a certificationAsk buyers which schemes they accept, then choose SQF, BRCGS or FSSC 22000, or a non-GFSI option such as SQF Fundamentals if buyers don't require GFSI.

How Kiwa ASI Can Help

ASI Food Safety, LLC (Kiwa ASI) is an SQFI-licensed certification body, accredited by ANAB to ISO/IEC 17065 for ten SQF Edition 9 Food Safety Codes, including Food Manufacturing, and for the SQF Quality Code. It also audits to SQF Fundamentals, which isn't GFSI-benchmarked or part of that accreditation.^[66][67][60] Tell us what you roast, brew and pack, and we'll confirm your food sector category and whether we have an auditor qualified for it before we quote. See SQF certification for the details.

For BRCGS, Kiwa ASI audits as a listed office of Kiwa's BRCGS-approved certification bodies, Kiwa Agri Food (UKAS-accredited, UK) and Kiwa España (ENAC-accredited). For FSSC 22000, certificates are issued by a Kiwa group certification body licensed by Foundation FSSC. If your buyers don't require GFSI, cGMP Food Processing 2.0 is Kiwa ASI's own HACCP-based standard built on 21 CFR Part 117. It isn't GFSI-benchmarked or accredited.

As a certification body, ASI Food Safety, LLC doesn't consult for, train, write documents for or advise on fixes for its certification clients.^[68]

Separately, ASI Training and Consulting, LLC offers PCQI training, food allergen training, HACCP training and internal auditing training. It operates separately from the certification body and has no effect on audit outcomes.

Frequently Asked Questions