FSVP Explained: Who the Importer Is and What They Must Do

FSVP at a Glance

• 1,404FSVP inspections FDA classified in FY2025, human and animal food combinedFDA-TRACK
• #1"You did not develop an FSVP" was FDA's most-cited food inspection observation in FY2023, FY2024 and FY2025FDA inspection observations
• 331FDA warning letters with an FSVP subject, January 2021 to August 2026FDA warning letter database
• 153Importers on FDA's FSVP import alert list as of October 2, 2026Import Alert 99-41

Updated October 6, 2026. Checked against the eCFR (21 CFR part 1, subpart L, unchanged since 2016), FDA's January 2023 FSVP guidance, FDA compliance and inspection data, and warning letters issued through August 2026. This article is general information based on FDA sources, not legal advice. Confirm current requirements with FDA before you rely on them.

What Is the Foreign Supplier Verification Program?

FSVP is a Food Safety Modernization Act (FSMA) rule, codified at 21 CFR 1.500 to 1.514, that makes the U.S. importer responsible for verifying that its foreign suppliers produce food safely. Each importer must verify that the supplier gives the same level of public health protection as FDA's preventive controls or produce safety rules, where they apply, and that the food isn't adulterated or missing a required allergen declaration.^[1][2]

FDA published the final rule on November 27, 2015.^[3] The first compliance date was May 30, 2017, later dates followed for importers whose suppliers had later deadlines, and FDA says all compliance dates have now passed.^[4][5] The rule text hasn't changed since technical amendments in 2016.^[6]

The rule sets duties for importers, not for foreign suppliers, although importers can ask suppliers for help.^[7] FDA's "foreign supplier" is the establishment that makes, processes, grows or raises the food, not a broker or trading company that only buys and resells it.^[6][8]

Who Is the FSVP Importer?

The FSVP importer is the U.S. owner or consignee of the food at the time of U.S. entry: the person in the United States who owns the food, has purchased it or has agreed in writing to purchase it. If no one in the U.S. fits that test, the importer is the foreign owner's U.S. agent or representative, who must sign a statement agreeing to take the role.^[6][1]

FDA's guidance fills in the details. "Time of U.S. entry" means when the entry is submitted to U.S. Customs and Border Protection (CBP). A purchase order the seller accepts in writing, including electronically, is a written agreement to buy. The importer must reside or keep a place of business in the United States, and a mailbox or answering service isn't enough. The FSVP importer may be, but isn't necessarily, the customs importer of record.^[12] FDA publishes a quarterly list of the companies named as FSVP importers at entry, and notes they may not be the importers of record.^[13]

The test is ownership or a written agreement to buy when the entry is filed. Who writes the specifications or oversees the supplier doesn't decide it. A carrier or express consignment operator that clears the food isn't the FSVP importer unless it owns the food, has agreed in writing to buy it or has consented to act as a foreign owner's U.S. agent.^[6][12]

Based on FDA's FSVP guidance (Q&A A.5 to A.14) and the 2015 final rule. FDA doesn't address "drop shipments" by name; apply the same ownership-at-entry test.^[12][3]

When there is no U.S. owner or consignee, the foreign owner must name its U.S. agent before the food is imported or offered for import, and the designation isn't valid without the agent's signed consent. An FSVP agent carries all the FSVP duties. That is a different role from the U.S. agent in a foreign facility's food facility registration, who is a point of contact, although one person can hold both roles.^[14][15]

FDA does treat agents as importers. In March 2026 it sent a warning letter to a food consultant that served as U.S. agent for a foreign firm, after FDA samples of the imported pet treats tested positive for Salmonella. The letter cited the consultant for having no FSVP for some foods, no hazard analysis for several products, no supplier evaluation or approval, and no written verification procedures. FDA also rejected the consultant's view that a foreign firm that only labeled the treats was the foreign supplier. It said the systems recognition arrangement the consultant relied on doesn't cover animal food.^[16]

What Food Does FSVP Cover, and What's Exempt?

FSVP covers almost all food imported or offered for import into the United States, including food for animals, unless an exemption in 21 CFR 1.501 applies. Exempt food is flagged at entry with an FSX code, or RNE for research and evaluation samples.^[17][18]

Exemptions carry conditions; check 21 CFR 1.501 and 1.502(b) for your product.^[17][2]

Location matters too. FDA doesn't apply FSVP to food imported into Guam, the U.S. Virgin Islands, the Northern Mariana Islands and other territories outside the U.S. customs territory, but it does apply in Puerto Rico. Food that arrives in a foreign-trade zone or bonded warehouse is covered unless an exemption applies, and the importer is identified whenever the entry is filed.^[19]

What Must the FSVP Importer Do?

For each food and each foreign supplier, the importer must develop, maintain and follow an FSVP. A qualified individual must develop it and do its activities. It covers a written hazard analysis, supplier evaluation and approval, verification activities, corrective actions, identification at entry and records.^[2][8][20]

1. 01Use a qualified individualSomeone with the education, training or experience to do each FSVP activity, who can read the records they review. They don't have to be your employee.^[6][20]21 CFR 1.503
2. 02Analyze the hazardsWrite a hazard analysis for each food: biological, chemical (including radiological, allergens and natural toxins) and physical hazards, including any introduced for economic gain. You may review and document another entity's analysis.^[21]21 CFR 1.504
3. 03Evaluate and approve the supplierWeigh the hazards, who controls them, the supplier's procedures, its FDA compliance history, including warning letters and import alerts, and its safety record. Reevaluate when you learn something new, and at least every three years.^[22]21 CFR 1.505
4. 04Verify the supplierImport only from approved suppliers, using written procedures. Before you import, choose onsite audits, sampling and testing, records review or other activities, and how often. Then do them, or get records of them, before importing and periodically after. Review and document the results.^[23]21 CFR 1.506
5. 05Take corrective actionIf a supplier isn't meeting the required protection, act promptly and document it, for example by suspending the supplier until the cause is fixed.^[24]21 CFR 1.508
6. 06Identify yourself at entryMake sure your name, email address and DUNS number go to CBP for every entry line of food subject to FSVP.^[14][25]21 CFR 1.509
7. 07Keep recordsKeep signed, dated records for at least two years, make them available promptly and translate them into English on request.^[26]21 CFR 1.510

FSVPs are supplier-specific. One FSVP can cover versions of the same food from one supplier, such as pack sizes or flavors, but it must address any hazard that differs between them.^[8]

If your hazard analysis finds no hazard that requires a control, you don't have to do the supplier evaluation and verification steps. You still need the FSVP, the hazard analysis, entry identification and records. Covered produce is the exception: its biological hazards are treated as needing control.^[21]

What Goes on the Entry and in Your Records?

Every entry line of food subject to FSVP must carry the FSVP importer's name, email address and a DUNS number, the only unique facility identifier FDA accepts. The "UNK" placeholder ended on July 24, 2022, and CBP's system rejects a covered line without a valid DUNS number. FDA can refuse admission if the importer isn't identified.^[18][25][27]

The DUNS number must match a U.S. location and is free from Dun & Bradstreet. If you have several U.S. sites, you may use the DUNS for the site where you keep your FSVP records, or for another site; once you pick one, use it on all your FSVP entries. A food facility registration number or EIN can't stand in for it, and foreign suppliers don't need a DUNS number for FSVP.^[18][25]

Records don't have to be kept in English, but you must provide an English translation within a reasonable time if FDA asks. Records stored offsite must be retrievable within 24 hours. If FDA asks in writing, you must send the records electronically or by another fast method, and FDA's guidance says it generally expects them within 72 hours. Keep records at least two years after you create or obtain them, and procedure records for two years after you stop using them.^[26][28]

FDA runs an FSVP Importer Portal for uploading records after a written request, and its June 2025 remote assessment guidance treats these records requests as mandatory and says they function as inspections.^[29][30]

How Does Supplier Verification Work?

The importer picks verification activities and their frequency from its supplier evaluation. When the supplier controls a hazard with a reasonable probability of causing serious adverse health consequences or death, the default is an onsite audit before the first import and at least once a year after, unless you document that other activities or less frequent audits are enough.^[23] FDA ties these hazards to Class I recall situations. Its examples include pathogens or their toxins in ready-to-eat foods, pathogens in pet foods and undeclared food allergens.^[31]

21 CFR 1.506(d) and (e). The importer must promptly review and assess all verification results, its own or others', and document that review. If the results fall short, it must take corrective action.^[23]

FDA says "annual" means once every 365 days, with practical timing taken into account. When an importer decides annual audits aren't needed for a serious hazard, FDA expects some auditing in most cases, for example every two to three years.^[31] Written results of an inspection done within a year of the audit due date can substitute for the audit. The inspection must be by FDA or another U.S. federal, state, local, tribal or territorial agency checking FDA food safety rules, or by the food safety authority of a country whose system FDA has recognized, for food covered by that recognition.^[23]

A qualified auditor doesn't need FDA or any other accreditation, and your own employee can audit if they're a qualified auditor. You can't rely on the foreign supplier or its employees for any verification activity except sampling and testing. The person doing a verification activity can't have a financial conflict of interest that influences the results, and payment can't depend on the outcome.^[9][23]

Recent warning letters show the gap. In 2026, FDA said a HACCP certificate and another certification on file didn't by themselves show supplier approval.^[33] In another 2026 letter, FDA said a pineapple importer's third-party audit reports were partly in a foreign language with no translation, and it wasn't clear how they applied to the importer's FSVP. The importer also said it hadn't verified that the supplier met the Produce Safety Rule.^[34] In 2024, FDA said a GLOBALG.A.P. certificate alone wasn't onsite audit documentation.^[35]

When Can You Skip Supplier Verification?

You can skip the supplier evaluation and verification steps for a hazard when it will be controlled after import. That applies when the food can't be eaten without a control, such as coffee or cocoa beans that must be roasted, or when your customer, or a later company in the chain, will control the hazard.^[36]

FDA says few foods fit the first category; besides coffee and cocoa beans it mentions some grains that must be processed or cooked. You still need a written hazard analysis, a documented determination and the rest of the FSVP.^[37]

When you rely on a customer, the rule requires you to state in documents that go with the food that it is "not processed to control" the named hazard, and to get an annual written assurance from the customer. Since 2018, FDA hasn't enforced the written-assurance part while it works on new rulemaking, but you must still make the disclosure.^[36][38]

FDA's guidance says a disclosure can name a general biological hazard, such as "microbial pathogens". For chemical and physical hazards, FDA expects a specific term, such as "aflatoxin" or "stones". FDA won't accept words like "unpasteurized" or cooking instructions alone.^[37]

How Does FSVP Fit With the Preventive Controls Rule?

If you're a receiving facility under FDA's preventive controls rule and you manufacture or process the imported ingredient, you can be deemed in compliance with FSVP for that food. That applies when you control the hazard yourself, aren't required to control it, or run a compliant supply-chain program for it. You must still identify yourself at entry. The two programs mirror each other, and FDA lets manufacturers use either one to verify an imported ingredient's supplier.^[2][39]

21 CFR 1.502(c), 1.511, 1.513 and 117.405(a)(2); animal food details from 21 CFR 1.500 and 1.504 and FDA's guidance (Q&A B.9).^{[2][39][40][41][42][6][21][8]}

The qualified facility point follows from the definitions rather than a single FDA statement: a receiving facility must be subject to the preventive controls and supply-chain subparts, and qualified facilities aren't. FDA's guidance adds that when a very small importer is also a qualified facility that processes the ingredient, FDA intends to inspect it against the qualified facility and CGMP rules.^[39][43]

What Are the Very Small Importer Rules?

A very small importer averages less than $1 million a year for human food, or $2.5 million for animal food, adjusted for inflation, in food sales plus the U.S. market value of food it imports, makes, packs or holds without selling, counting affiliates. The two tests are separate. FDA's latest posted figures, the 2023 to 2025 averages, are $1,372,952 for human food and $3,432,379 for animal food.^[6][44]

The averaging period ends one year before the year you import. So the 2023 to 2025 figures decide status for 2027, documented by December 31, 2026. FDA says it intends to update the figures each April.^[45][43][44]

• Keep an FSVP, use a qualified individual and identify yourself at entry.
• Document your very small importer status before you first import as one, and every year by December 31.
• Get the foreign supplier's written assurance before importing each food, and at least every two years.
• Take and document corrective actions if a supplier doesn't live up to its assurance.
• Keep records at least two years, and the records that support your status at least three years.

Very small importers skip the hazard analysis, supplier evaluation and standard verification steps. Similar simplified rules, with a few added supplier-approval steps, apply to food from three kinds of small foreign suppliers: qualified facilities, farms not covered by the Produce Safety Rule and shell egg producers with fewer than 3,000 laying hens. Being small doesn't excuse missing records: in February 2026, FDA cited an importer that claimed very small importer status but never sent its records after a written request.^[45][46]

What Does FDA Cite in FSVP Inspections?

FDA classified 1,404 FSVP inspections in fiscal year 2025. Of the 1,323 for human food, about half found objectionable conditions, and 44 were classified Official Action Indicated, meaning FDA would recommend regulatory or administrative action. "You did not develop an FSVP" was the single most-cited food inspection observation in each of FY2023, FY2024 and FY2025.^[47][48]

FDA inspection observation data for FY2025, foods, FSVP citations only. Counts are from FDA's electronic inspection system and don't include every observation.^[48]

FDA picks importers by compliance history, such as Class I recalls and outbreaks, then by food risk, such as ready-to-eat foods, allergen risks, infant foods and covered produce, and then by size and number of suppliers. Inspections can be onsite or remote. Investigators request records on Form FDA 482d and list significant problems on Form FDA 483a.^[49][50]

If an importer doesn't respond to a 483a or doesn't fix significant violations, FDA may send a warning letter, usually asking for a response within 15 working days. A missing or weak response can lead to Import Alert 99-41. FDA can then detain the listed foods without physical examination when that importer brings them in. FDA can also refuse admission, and importing without a compliant FSVP is a prohibited act.^{[49][27][51][52]}

• August 2026: an importer had no FSVP for several foods and no documented corrective action after dried mushrooms with undeclared sulfites led to two recalls.^[33]
• June 2026: a tea importer had no FSVP for any of its imported foods, including matcha.^[53]
• February 2025: FDA said hazard analyses that covered only allergens didn't meet the rule, which requires biological, chemical and physical hazards.^[54]
• October 2024: after FDA found Listeria in imported enoki mushrooms, it cited the importer for having no FSVP. Two of the documents the importer sent after the inspection were undated and showed no review by a qualified individual, and others were in a foreign language with no translation.^[55]

Several 2026 letters said FDA couldn't evaluate responses that promised fixes without sending the FSVP documents. FDA's warning letter database lists 331 FSVP letters from January 2021 to August 2026, and 153 importers were on the Import Alert 99-41 list as of October 2, 2026.^{[33][34][56][51]}

What Should an FSVP Checklist Include?

Use this list to check an FSVP before FDA does.

• Know who the importer isFor every entry line, confirm which U.S. company owns the food or has agreed in writing to buy it at entry, and put it in your contracts.
• Get a DUNS numberIt must match a U.S. location. If you have several, you may use the one where you keep FSVP records. Then use the same one on all FSVP entries.
• List foods and suppliersOne FSVP for each food from each foreign supplier, the company that actually makes, grows or raises it.
• Write the hazard analysisBiological, chemical and physical hazards, including allergens and economic adulteration.
• Approve suppliers on paperA documented evaluation, including FDA warning letters and import alerts. Reevaluate promptly when you learn something new, and at least every three years.
• Set verification before importingWritten procedures, the activities you chose and how often.
• Keep audit documentationNot just certificates: audit procedures, dates, conclusions, corrective actions and proof the auditor was qualified.
• Make the disclosures"Not processed to control" statements when a customer controls the hazard.
• Log corrective actionsWhat happened, what you did and whether the FSVP changed.
• Check exemptions and sizeConfirm any exemption. Document very small importer status before you first import as one, then every year by December 31.
• Be ready for a requestOffsite records within 24 hours, English translations and electronic copies on request.
• Answer a 483a with documentsRespond in writing within 15 business days of the inspection, as FDA encourages, and include the new or updated records that show the fix.^[50]

Where Does Kiwa ASI Fit?

FSVP is the importer's own legal duty. FDA says no other company can take over the importer's responsibility for it.^[12] There is also no FSVP certification.^[9]

ASI Food Safety, LLC (Kiwa ASI) is an SQFI-licensed certification body accredited by ANAB (accreditation ID 1222) for ten SQF Edition 9 Food Safety Codes and the SQF Quality Code. No SQF certificate, whichever certification body issued it, meets an importer's FSVP requirements by itself; the importer decides whether an audit meets 21 CFR 1.506 and documents its review. ASI Food Safety isn't part of FDA's Accredited Third-Party Certification Program, which FSVP doesn't require.^[57][31][58]

As a certification body, ASI Food Safety, LLC doesn't consult for, write documents for or advise on fixes for the companies it certifies.^[59]

Separately, ASI Training and Consulting, LLC offers an FSVP course for importers and the people who run their programs, and PCQI training for the preventive controls rule. ASI Training and Consulting, LLC operates separately from the certification body, and its courses have no effect on audit outcomes. No course is legally required to be an FSVP qualified individual.^[9]

Frequently Asked Questions