FSVP

FSVP stands for Foreign Supplier Verification Program. It is an FDA rule under FSMA (21 CFR Part 1 Subpart L) that requires U.S. importers to verify that the foreign suppliers of the food they bring into the country produce it to the same safety standards required of domestic food. If you import food into the United States, FSVP almost certainly applies to you.

What Is FSVP?

FSVP is the FDA's mechanism for extending U.S. food safety standards across the border. Before FSMA, imported food was largely checked reactively at the port of entry or after a problem surfaced. FSVP flips that. It puts the burden of proactive verification squarely on the U.S. importer.

What FSVP Stands For, in One Sentence

FSVP stands for Foreign Supplier Verification Program, an FDA rule under 21 CFR Part 1 Subpart L that requires you, as the U.S. importer, to verify that your foreign food suppliers produce food meeting the same safety standards that apply to domestic manufacturers.

Why FSVP Exists

The logic is straightforward: food grown or processed outside the United States is still eaten inside the United States. If a foreign supplier has unsafe practices, U.S. consumers bear the consequences. FSVP shifts that accountability onto the party with the commercial relationship with the supplier.

This fits the broader FSMA philosophy. Rather than waiting for outbreaks and then reacting, FSMA asks food businesses to anticipate hazards and prevent them. FSVP is the import-side expression of that idea. You can read more about what FSVP means for consumers directly from FDA.

FDA provides a useful overview in the FDA's FSVP final rule at-a-glance, and the full regulatory text is at 21 CFR Part 1 Subpart L, the FSVP regulation.

FSVP Is the FDA's Most-Cited Import Violation

FSVP enforcement has been consistent and public. Year after year, FSVP citations appear more frequently in FDA warning letters than almost any other import-related regulation.

What FDA Warning Letters for FSVP Look Like

The most common citation is not a documentation technicality. It is the absence of an FSVP altogether. Many importers assume that because they purchase a GFSI-certified ingredient or use a supplier questionnaire, they are covered. They are not.

The next most common trigger is an FSVP that exists only on paper: a document created but never used to actually evaluate the supplier. FDA inspectors ask for evidence that verification activities were performed. When importers cannot produce hazard analyses, supplier evaluations, or records of verification activities, the warning letter follows. A third trigger is failing to produce records on request, which is itself a violation independent of whether the underlying FSVP is sound. You can review a recent example in FDA warning letters for FSVP violations.

The Real Cost of Non-Compliance

The immediate consequence of a serious FSVP violation is an import refusal. Your shipment does not enter. A refusal that is serious enough, or repeated, leads to detention without physical examination (DWPE), meaning every future shipment from that supplier is automatically detained. Warning letters are public, indexed by search engines, and reviewed by retail buyers. Losing shelf access or a key customer relationship because of a public FSVP warning letter compounds far beyond the cost of the original fix.

Most FSVP warning letters come down to one thing: records the importer could not produce. See how Allera's supplier management keeps every supplier approval, verification activity, and corrective action in one place.

Who Is the FSVP Importer?

This is the question that trips up more companies than any other aspect of FSVP. The FDA definition of "importer" does not match the customs definition, and confusing the two is one of the leading causes of warning letters.

The FDA Definition of "Importer"

Under FSVP, the importer is the U.S. owner or consignee of the food at the time of U.S. entry. If there is no U.S. owner or consignee at the time of entry, the importer is the U.S. agent or representative of the foreign owner, and that designation must be in writing.

Are You the FSVP Importer?

Walk through this decision logic:

1. Is there a U.S. company that owns or is the consignee of the food at the U.S. border? If yes, that company is the FSVP importer.
2. If no U.S. owner or consignee exists at time of entry, is there a U.S. agent or representative of the foreign owner designated in writing? If yes, that entity is the FSVP importer.
3. If neither exists, there is a structural problem with your import arrangement that needs to be resolved before the food enters the country.

Most food manufacturers and distributors sourcing internationally fall into category one. Contract manufacturers and trading companies are more likely to fall into category two.

The FSVP Importer Is Not Always the Customs Importer of Record

Your customs broker files the entry with CBP on your behalf and may appear as the "importer of record" in that filing. That is a customs role, not an FSVP role. At time of entry, your FSVP data (your name, email address, and DUNS number) must be transmitted to CBP in the entry filing. Failing to transmit that data, or transmitting the broker's data instead, is itself an FSVP violation. See 21 CFR 1.503 on who must develop an FSVP for the full regulatory definition.

FSVP Exemptions and Modified Requirements

Not every imported food is fully subject to FSVP, and not every importer faces the same obligations.

Foods and Importers Fully or Partially Exempt

The following categories are fully exempt from FSVP:

• Juice and seafood already subject to FDA's HACCP regulations (21 CFR Parts 120 and 123), which have their own mandatory verification structure.
• Food imported for research or evaluation, personal consumption, transshipment, or future export without entering U.S. commerce.
• Alcoholic beverages regulated under the Federal Alcohol Administration Act, and certain ingredients used solely in those beverages.
• Meat, poultry, and egg products regulated by the USDA under applicable federal inspection acts.

Modified FSVP Requirements

A modified, lighter-touch FSVP applies in several situations: very small importers (annual average of $1 million or less in U.S. food sales), importers buying from very small foreign suppliers, dietary supplements and their components under 21 CFR 1.511, foods from countries with an FDA-recognized food safety system, and low-risk produce from very small foreign farms.

"Exempt" Still Means "Confirm and Document It"

Being exempt does not mean you can ignore the question. You must affirmatively determine that an exemption applies to a given food from a given supplier, and you must document that determination. If you cannot produce that documentation, you may face the same citation as an importer who simply did nothing.

The 6 Core FSVP Requirements

FDA's summary of FSVP key requirements lays out what every FSVP importer must do. Here is each requirement mapped to its regulatory section.

1. Hazard Analysis (21 CFR 1.504)

For every food you import, conduct a written hazard analysis identifying all known or reasonably foreseeable hazards: biological (Salmonella, Listeria, E. coli), chemical including radiological (pesticides, heavy metals, mycotoxins), and physical (glass, metal, hard plastic). The analysis must consider the nature of the food, its origin, the processing methods, and distribution conditions.

2. Evaluate Risk Posed by the Food and the Supplier's Performance (21 CFR 1.505)

Evaluate the risk each hazard poses and assess your supplier's ability to control it. Hazard severity matters: a pathogen in a ready-to-eat food is evaluated differently from a physical hazard in an ingredient that will be cooked. Supplier compliance history, food safety procedures, certifications, and prior FDA interactions all factor into the documented evaluation that drives your verification activity choices.

3. Conduct Supplier Verification Activities (21 CFR 1.506)

This is where you actually verify that your foreign supplier is producing the food safely. The regulation gives you a menu of options, but the choice must match the hazard and the risk. See 21 CFR 1.506 on required verification activities for the full regulatory detail. The next section covers how to match the activity to the hazard.

4. Take Corrective Actions (21 CFR 1.508)

When a verification activity reveals a problem, or when new information suggests a hazard is not adequately controlled, you must take documented corrective action: requiring supplier remediation, stopping imports temporarily, increasing verification frequency, or terminating the relationship.

5. Re-evaluate Every 3 Years (or Sooner)

Your FSVP must be re-evaluated at least every three years, but that is the floor. Re-evaluate promptly whenever new information emerges: an FDA import alert, a supplier recall, changes to the supplier's process or certification status, or a corrective action that points to something systemic.

6. Keep Records and Identify Yourself at Entry (21 CFR 1.509, 1.510)

Maintain FSVP records for at least two years after creation. At time of entry, transmit your name, email address, and DUNS number to CBP, linking every shipment to the responsible importer in FDA's systems.

Supplier Verification Activities: Which One, and When?

Choosing the right verification activity is one of the most consequential decisions in your FSVP. Pick one too light for the hazard and you are exposed to both a real food safety failure and an FDA citation.

The Menu of Verification Activities

FDA offers four categories of verification activities:

SAHCODHA stands for Serious Adverse Health Consequences or Death to Humans or Animals. When your hazard analysis identifies a hazard with a reasonable probability of causing serious adverse health consequences or death, and that hazard is controlled at the supplier level, you must conduct an annual onsite audit by a qualified auditor. You can substitute a different activity only with a documented justification.

Matching the Activity to the Hazard

For SAHCODHA hazards controlled by the supplier: annual onsite audit is the required default. Deviating requires a written justification. For lower-risk hazards: records review, periodic testing, or a combination may be sufficient. The choice must be documented and defensible.

When the Supplier Controls the Hazard vs. When a Downstream Customer Controls It

If a hazard is controlled by a subsequent step in your supply chain rather than by the foreign supplier (a kill step at your facility, for example), you can satisfy supplier verification through a written-assurance chain. The entity controlling the hazard provides written assurance that they are controlling it as required, and that documentation becomes part of your FSVP records.

How to Build a Compliant FSVP, Step by Step

Step 1: Inventory Every Food and Foreign Supplier You Import

Every food, every supplier, every country of origin. An FSVP is food-specific and supplier-specific, not a blanket program. Identify which pairs are fully exempt, which have modified requirements, and which require the full FSVP so you focus effort where it is required.

Step 2: Assign a Qualified Individual

Every FSVP must be developed and carried out by a qualified individual with the education, training, or experience to perform the specific activities involved. They can be an employee or third-party consultant and do not have to be a U.S. resident.

Step 3: Run the Hazard Analysis for Each Food

Conduct the hazard analysis required by 21 CFR 1.504. A well-structured food safety plan gives you the framework to do this consistently. Document the analysis in writing: hazards considered, those requiring a control, who controls them, and how.

Step 4: Evaluate and Approve Each Supplier

Using the hazard analysis as your foundation, evaluate each supplier's food safety procedures, compliance history, and certifications. A structured supplier management system makes this manageable across multiple countries and product lines.

Step 5: Select, Schedule, and Document Verification Activities

Choose the appropriate verification activity for each food-supplier pair and schedule it. Document every activity as it is completed: date, who performed it, and the outcome. An unexecuted annual audit is one of the most common FSVP citations.

Step 6: Define Corrective Actions and Re-evaluation Triggers

Before you need them, define what happens when a verification activity reveals a problem: when to stop imports, increase verification frequency, require supplier remediation, or terminate the relationship. Document re-evaluation triggers in advance so decisions are not made under pressure.

Step 7: Organize Records So You Can Produce Them in 24 Hours

FDA can request your FSVP records with very little notice. Your system needs to retrieve any record for any food-supplier pair quickly. FDA's Guidance for Industry on FSVP outlines what they expect to see and how they expect it maintained.

An FSVP is only as strong as the system that runs it. See how food importers manage FSVP and the rest of FSMA in one platform with FSMA compliance software.

The FSVP Qualified Individual

Every FSVP must be developed and performed by a qualified individual. This is not a formality. FDA reviews the qualifications of the person responsible during inspections.

Who Can Be a Qualified Individual

A qualified individual must have the education, training, or experience to develop and carry out the specific FSVP activities they are responsible for. There is no single required certification, though dedicated FSVP training is strongly advisable. They can be an employee or third-party consultant and do not need to be a U.S. resident. Qualifications must match the specific foods and hazards in your FSVP and must be documented.

Qualified Individual vs. PCQI vs. Qualified Auditor

These three roles get confused regularly. Here is how they differ:

The same person can hold more than one role if their qualifications cover the relevant activities. The FSPCA FSVP training course is widely recognized and provides a strong foundation for qualified individuals.

FSVP vs. FSMA vs. the Preventive Controls Supply-Chain Program vs. VQIP

FSVP vs. FSMA

FSMA is the Food Safety Modernization Act, signed in 2011, that shifted U.S. food safety from reactive to preventive. FSVP is one specific rule under FSMA's authority. FSMA also produced the Preventive Controls rules, the Produce Safety Rule, the Sanitary Transportation Rule, and the FSMA 204 traceability rule, among others. FSMA is the law; FSVP is one of its rules.

FSVP vs. the Preventive Controls Supply-Chain Program (21 CFR 117 Subpart G)

The Preventive Controls for Human Food rule includes a supply-chain program in Subpart G requiring domestic receiving facilities to verify suppliers of raw materials and ingredients. The overlap with FSVP is intentional. If a domestic receiving facility has a Subpart G supply-chain program that meets FSVP verification requirements for a given ingredient and hazard, the importer may rely on it to satisfy some FSVP obligations. The specifics depend on the hazard, the activity, and the documentation.

FSVP vs. VQIP

VQIP (Voluntary Qualified Importer Program) is FDA's optional expedited review program. Qualifying importers receive expedited entry for shipments, but foreign suppliers must hold certification from an FDA-accredited third-party body. VQIP builds on a strong FSVP; it does not replace it. See FDA's Voluntary Qualified Importer Program (VQIP) for eligibility details.

How FSVP Relates to Your GFSI Program

If your suppliers are certified under SQF, BRCGS, or FSSC 22000, you are already collecting much of the documentation FSVP requires. GFSI supplier-approval clauses, raw-material specifications, and audit requirements overlap heavily with FSVP's evaluation and verification obligations. Structure your records so GFSI documentation explicitly satisfies your FSVP requirements and maintain them on the same re-evaluation cycle. That way you do the work once. See BRCGS certification and the SQF certification guide for detail on those schemes.

FSVP Recordkeeping and FDA Records Requests

FSVP is a documentation-heavy regulation by design. The records requirement is not a secondary obligation; it is central to the program.

What Records You Must Keep

Your FSVP records must include the written hazard analysis for each food, supplier risk evaluation and approval documentation, records of all verification activities (dates, methods, outcomes, who performed them), corrective action records, re-evaluation records, and any exemption determination. Records must generally be kept for at least two years from the date of creation.

The 24-Hour Reality

FDA may request your FSVP records electronically or by other prompt means, and in practice inspectors have requested them within 24 hours. The FDA's FSVP importer records-submission portal is the mechanism FDA uses. Your records need to be organized and retrievable on short notice. A document control system is operational infrastructure for an FSVP importer, not a nice-to-have.

Why Spreadsheets Fail an FSVP Inspection

Spreadsheet-based FSVP programs break down in three predictable ways: version control (knowing which version is current when multiple people update records over several years), missing approvals (a spreadsheet does not enforce a workflow, so steps get skipped), and no audit trail (spreadsheets do not record who changed what and when, which is what FDA looks for to confirm your FSVP is a live program). Importers who pass inspections cleanly are typically those running their program on food quality management software built for this purpose.

How Much Does FSVP Compliance Cost?

There is no single answer. Costs vary by program complexity, and the range between a minimal-scope FSVP and a large-scale import operation is significant.

The Cost Drivers

The main factors: number of foods and food-supplier pairs in scope, hazard severity (SAHCODHA hazards require annual onsite audits, the most expensive verification activity), whether you use audits versus records review versus testing, whether you build the program in-house or use a consultant, and whether your suppliers are already GFSI-certified.

Typical Cost Components

Most importers underestimate the ongoing labor cost of maintaining and re-evaluating the program each year. The initial build is one-time; the maintenance is perpetual.

The Hidden Cost Is Non-Compliance

Import refusals, DWPE status, and public warning letters are not abstract risks. A single import refusal can cost more in spoiled product, missed sales, and logistics than a full year of proper FSVP compliance. DWPE can shut down your ability to source from a supplier for months. Public warning letters affect customer relationships in ways that are slow to recover. Non-compliance is the most expensive FSVP option.