Supply chain Trade and logisticsReference pages
FSVP: what US importers verify, and what suppliers owe
US FSVP puts the duty on the importer: hazard analysis, supplier verification, records. The provisions, with dates, and what Chinese suppliers provide.
Living page — numbers read from the sources on 2026-10-13, re-checked yearly.
FSVP is the FSMA rule addressed to the buyer rather than the factory. The US importer of a food must run a documented programme for each food and each foreign supplier, and produce it on request. What reaches a Chinese supplier is a set of requests carrying a citation, plus a few documents that are asked for by name and do not exist.
The duty belongs to the US owner or consignee
The rule implements section 805 of the Federal Food, Drug and Cosmetic Act (21 U.S.C. 384a) and sits in 21 CFR part 1, subpart L, sections 1.500 to 1.514. It was published on 27 November 2015 (80 FR 74340, 27 November 2015) and took effect on 26 January 2016 (FDA rule page, read 12 October 2026).
Importer is defined narrowly: the US owner or consignee of a food offered for import, meaning the person in the United States who at entry owns the food, has bought it, or has agreed in writing to buy it. Where there is no US owner or consignee, the importer is the US agent of the foreign owner, confirmed in a signed statement of consent. That is not the same person as the Customs importer of record, and FDA states the two can differ (guidance, question A.12).
Scope runs per food and per supplier: five products from one supplier means five programmes; one product from three plants means three. Every compliance date has passed, staggered by the foreign supplier’s size and category rather than the importer’s (FDA compliance dates, read 12 October 2026).
| Foreign supplier | Importer’s first compliance date |
|---|---|
| Not subject to the preventive controls or produce safety rules | 30 May 2017 |
| Human food PC rule, all other businesses | 30 May 2017 |
| Human food PC rule, small businesses | 19 March 2018 |
| Human food PC rule, qualified facilities and very small businesses | 18 March 2019 |
| Animal food CGMP subpart B, small businesses | 19 March 2018 |
| Produce safety rule, all other businesses | 26 July 2018 |
| Produce safety rule, small businesses | 29 July 2019 |
| Produce safety rule, very small businesses | 27 July 2020 |
Whole categories sit outside the rule. The list is in 21 CFR 1.501 and repeated on the FDA page:
| Outside the FSVP rule | Note |
|---|---|
| Juice and fish and fishery products | Where covered by, and in compliance with, the HACCP rules in parts 120 and 123 |
| Food for research or evaluation | Labelled, small quantity, not sold to the public, declared at entry |
| Food for personal consumption | Small quantity, non-commercial, not sold or distributed |
| Alcoholic beverages | Foreign supplier of a type that would need Treasury approval, and registered under section 415 |
| Transshipped, or imported for processing and export | Not sold or distributed to the public in the US |
| US food returned | Exported and returned without further manufacturing abroad |
| USDA-inspected meat, poultry, egg products | Under the federal inspection acts at the time of importation |
| Low-acid canned foods | Only the microbiological hazards part 113 controls; an FSVP covers the rest (21 CFR 1.502(b)) |
Five obligations, and who may perform them
An FSVP is a written programme the importer develops, maintains and follows. Subpart L sets five recurring duties, plus one timer.
| Duty | Provision | What it covers |
|---|---|---|
| Written hazard analysis | 1.504(a) | Biological, chemical and physical hazards, evaluated by probability of occurrence against severity; written whatever the conclusion |
| Evaluation of supplier and food risk | 1.505(a) | The supplier’s procedures, the FDA rules applying to it, warning letters and import alerts naming it, and its food safety history |
| Documented approval | 1.505(b) | Approval on the strength of that evaluation |
| Verification activities | 1.506 | Chosen and documented in advance, with frequency, before the first import |
| Corrective action | 1.508 | Where the hazard is not controlled, or the food is adulterated or allergen-misbranded |
| Reevaluation | 1.505(c) | On new information, and otherwise if three years pass without one |
All of it must be done by a qualified individual: someone with the education, training or experience the activity needs, who can read and understand the language of the records they review. That person need not work for the importer and need not be in the United States (21 CFR 1.503(a)). FDA sets no required course or credential (guidance, question C.3), and auditing carries its own role, the qualified auditor — a qualified individual with auditing expertise, and somebody other than the supplier’s own staff (1.503(b), 1.506(e)(2)(ii)). Another entity may perform an activity, but the importer must review it and document that review (guidance, questions A.6 and B.6).
Verification: four activities, one annual default
Verification runs before the first import and periodically after, against a choice fixed in advance.
| Activity | Provision | Constraint |
|---|---|---|
| Onsite audit | 1.506(e)(1)(i) | Performed by a qualified auditor; must consider the FDA rules applying to the supplier and review its written food safety plan, if any, and its implementation |
| Sampling and testing | 1.506(e)(1)(ii) | Documented by lot, sample count, method, dates, results, laboratory and operator |
| Review of the supplier’s food safety records | 1.506(e)(1)(iii) | Documented by review dates, the nature of the records, conclusions and corrective actions |
| Other appropriate activity | 1.506(e)(1)(iv) | Described, dated and evidenced like the rest |
Where the hazard is controlled by the supplier and exposure could cause serious adverse health consequences or death — FDA’s shorthand is SAHCODHA, keyed to the Class I recall designation in 21 CFR 7.3(m)(1) — the default is an onsite audit before the first shipment and at least annually after, read by FDA as every 365 days. Displacing that default takes a written determination that other activities, or a longer interval, give adequate assurance (1.506(d)(2); guidance, questions F.10 and F.11).
Written inspection results from FDA or another authority may substitute for an audit if the inspection fell within one year of the date the audit was due (1.506(e)(1)(i)(E)). One restriction matters to suppliers: the importer may not rely on the foreign supplier or its staff to carry out verification activities, with sampling and testing the single exception (1.506(e)(2)(ii)). Payment for an activity may not be tied to its result (1.506(e)(4)).
Records: what is kept, and for how long
Retention has two branches. Records generally are kept at least two years from creation or receipt; records of processes and procedures, including the results of evaluations and determinations, are kept at least two years after their use is discontinued (21 CFR 1.510(c)). FDA’s worked example: an audit result relied on for two years is kept two years beyond that, four years after it was first used (guidance, question J.3).
| Record | Provision | Retention |
|---|---|---|
| Hazard analysis, or the importer’s review of another entity’s | 1.504(a), (d) | 2 years |
| Evaluation and documented approval of the supplier | 1.505(a)(2), (b) | 2 years after use ends |
| Reevaluation at three years or on new information | 1.505(c) | 2 years after use ends |
| Written procedures for buying only from approved suppliers | 1.506(a) | 2 years after use ends |
| Determination of verification activities and their frequency | 1.506(d) | 2 years after use ends |
| Onsite audit: procedures, dates, conclusions, corrective actions, auditor qualification | 1.506(e)(1)(i)(D) | 2 years |
| Sampling and testing: lot, sample count, method, dates, results, laboratory, qualified individual | 1.506(e)(1)(ii) | 2 years |
| Record review: dates, nature of records, conclusions, corrective actions | 1.506(e)(1)(iii) | 2 years |
| Corrective actions and any investigation of the programme | 1.508 | 2 years |
| Importer name, email and unique facility identifier at entry | 1.509(a) | 2 years |
| Evidence relied on for very small importer status | 1.512(b)(5)(iii)(C) | 3 years |
Availability is where the clocks bite: records go to an authorised FDA representative promptly, offsite storage is allowed if they can be produced onsite within 24 hours, and a written request must be answered, which FDA reads as a 72-hour expectation (1.510(b); guidance, question J.5). They need not be kept in English, but an English translation is owed on request within a reasonable time (1.510(b)(1)). No format is prescribed: “FDA has not created FSVP templates or examples of FSVP records” (guidance, question J.9).
At entry the importer’s name, email and an acceptable unique facility identifier go in for each line. DUNS is the identifier FDA recognises; the transition period for entering “UNK” ended on 24 July 2022 (FDA rule page). The rest of the entry file is in the customs clearance documents piece.
What a Chinese supplier is asked to provide
The entity the importer buys from may not be the foreign supplier. The definition is the establishment that manufactures or processes the food, raises the animal or grows the food exported to the US without further manufacturing elsewhere, apart from de minimis labelling. A trading company, warehouse or consolidator that only packs or holds food is not the foreign supplier; the last entity doing real manufacturing is (21 CFR 1.500; guidance, question A.20).
| The importer needs | Under | Held by |
|---|---|---|
| Written food safety plan for the hazard in question, and evidence it is implemented | 1.506(e)(1)(i)(B) | the supplier |
| Process control logs, monitoring records, product and environmental testing, temperature and transport records | guidance F.24 | the supplier |
| Sampling and testing results, with lot, method, dates and laboratory | 1.506(e)(1)(ii) | the supplier |
| Written assurance of compliance, renewed at least every two years | 1.512(b)(3) | the supplier |
| Annual confirmation of small-supplier status, by 31 December for the year following | 1.512(b)(1)(ii) | the supplier |
| Statement of controls, or of compliance with non-federal food safety law, from a qualified facility | guidance L.15 | the supplier |
| English translation of records on FDA request | 1.510(b)(1) | the importer, from the supplier |
The written-assurance route is narrow: it applies where the importer is a very small importer or buys from one of a defined set of small suppliers, and the assurance must carry either a brief description of the preventive controls applied to that hazard or a statement of compliance with applicable non-federal food safety law (1.512(b)(3)). Very small importer means averaging under 1 million dollars a year in human food sales plus the US market value of food handled without sale, or 2.5 million for animal food, over the three years before the applicable calendar year; FDA’s inflation-adjusted 2023–2025 averages are 1,372,952 dollars and 3,432,379 (FDA inflation adjusted cut-offs, read 12 October 2026).
Language is the everyday friction: a qualified individual reviewing Chinese-language records must read Chinese, or a translation must be obtained (guidance, question C.5). Compliance history is public and does get checked, with warning letters, import alerts, refusals, recalls and inspections named as searchable material (guidance, questions E.4 and E.13; FDA Data Dashboard, read 12 October 2026).
Separately from FSVP, a supplier that is a facility must register under 21 CFR part 1, subpart H: before handling food for US consumption, renewed between 1 October and 31 December of each even-numbered year, carrying a unique facility identifier, a US agent’s name, address, phone and email, and an assurance that FDA may inspect (1.230, 1.232). Farms, retail establishments and restaurants are outside it (1.226). FDA treats the two US agent roles, FSVP and registration, as separate (guidance, question A.17).
Documents that are asked for and do not exist
No FDA page I found provides for a supplier verification certificate, or for a certificate covering a local purchase.
Nothing is filed at entry to show a food is covered by an equivalence arrangement; FDA requires no certificate or other evidence of that kind when entry is filed with Customs (guidance, question M.8). An audit certificate carries no standing either: a document saying a supplier “passed” would not be enough, because the record must show the procedures, dates, conclusions, corrective actions and the auditor’s qualification (guidance, question F.17).
The list FDA does publish names importers, not suppliers. Section 805(g) requires a public list of importers identified at entry as FSVP importers; FDA publishes it quarterly and warns it conveys no approval or endorsement (FDA list of participants, content current as of 1 July 2026).
The consequences are written down. Food is subject to refusal of admission where the importer appears not to comply with subpart L for it, and importing without a conforming FSVP is a prohibited act under section 301(zz) (21 CFR 1.514). FDA keeps a detention-without-physical-examination alert for this: Import Alert 99-41 covers food offered by importers on its Red List, naming the food or supplier where the agency knows them, with a route to request removal (Import Alert 99-41, published 2 October 2026). Its Red List names importers rather than factories.
How I checked this
Everything was read on 12 October 2026. Regulation text comes from the eCFR, which carried the note “up to date as of 10/08/2026” for Title 21. Bare section numbers above resolve in subpart L or subpart H; guidance citations resolve in the industry guidance PDF linked here (FSVP guidance for industry, January 2023), which carries that date on its cover.
FDA’s own domain refused direct requests: fda.gov served an abuse-detection page in place of the document, including on its PDF media paths. That is an anti-scraping response rather than a missing page, and I treated it as one — every FDA page and PDF came through the text proxy r.jina.ai, which returned the underlying documents, while the eCFR and Federal Register documents came back directly. The records requirements list carries a file date of 7 October 2019 and the inspection fact sheet 18 August 2020. No consultancy or broker material was used.
What I could not check
- Whether enforcement has tightened. Import Alert 99-41 is public, but I did not count listings or read cases; listing data sits inside the alert, which I opened but did not parse.
- The practice of audits. What an importer commissions, how long it takes and what it costs are commercial matters with no official published figures. Nothing above describes practice.
- An inconsistency in FDA’s own table. The FSVP section of the cut-offs page prints 1,337,083 dollars as the 2023 value for a 1,000,000-dollar human food baseline; the preventive controls section prints 1,337,873. I used the three-year averages, where the sections agree.
- Chinese-language material, and templates. I did not find an FDA FSVP page in Chinese, and FDA states it has not created FSVP record templates, a negative I can support only with that statement.
- Registration in practice. I did not query FDA’s registration database, and nothing above asserts that any facility is registered.
- Which countries are on the equivalence list. Subpart L’s modified requirements turn on countries FDA has recognised as comparable or equivalent. I cite the mechanism and did not verify the current list.