FSVPForeign Supplier Verification Program (21 CFR Part 1 Subpart L)

FSVP is the FSMA implementing rule that shifts food-safety responsibility for imported food onto the US importer of record. Before FSMA, FDA's main lever on imported food was border inspection — about 1–2 % of imported food entries got physical examination. FSVP closed that gap by requiring the US importer to (1) determine the hazards reasonably foreseeable for each food they import, (2) evaluate the foreign supplier's performance and the risk posed by the food, (3) conduct supplier verification activities appropriate to that risk, and (4) maintain a written FSVP that FDA can inspect on US soil. The importer must be identified to FDA at every entry by name, email, and a Unique Facility Identifier (DUNS number).

FSVP applies to the 'importer' — defined as the US owner or consignee of the food at the time of entry, or in their absence, the US agent or representative of the foreign owner. For dietary supplements:

• Imported finished dietary supplements ARE covered by FSVP — even though the product is regulated under 21 CFR Part 111 cGMP downstream, the importer's FSVP obligations apply at entry.
• Imported dietary ingredients (botanical extracts, amino acids, vitamins, minerals, novel actives) ARE covered.
• Imported food-contact substances are NOT covered (different rule).
• Imported juice/seafood under HACCP rules have a modified FSVP regime.
• A 'very small importer' (<$1M average annual food sales) has reduced FSVP obligations but is still in scope.

For each food imported from each supplier, the importer must identify and evaluate known or reasonably foreseeable hazards that may require a control. Hazards include:

• Biological — pathogens (Salmonella, E. coli O157:H7, Listeria, etc.), parasites.
• Chemical — pesticide residues, heavy metals (lead, cadmium, arsenic, mercury), mycotoxins (aflatoxin, ochratoxin), allergens, food additives.
• Physical — glass, metal, hard plastic, stone.
• Economically motivated adulteration (EMA) — only when the importer has reason to know the food is at risk (e.g. honey adulterated with cane sugar, olive oil cut with lower-grade oils, melamine in protein concentrates).

The hazard analysis must be in writing, must identify the hazards requiring control, and must specify where control will occur (at the supplier, at the importer, downstream by a customer with disclosure, or in the consumer's normal use). For dietary-supplement ingredients, heavy metals and mycotoxins are nearly always the controlled hazards; pesticide residues and adulteration with synthetic actives (the classic 'spiked' herbal product) are increasingly added.

The importer must evaluate the supplier considering: (1) the hazard analysis for the food; (2) the entity that will be applying the controls (the supplier itself, or someone upstream of the supplier); (3) the supplier's food-safety procedures, processes, and practices; (4) FDA's compliance history with the supplier (Warning Letters, Import Alerts, refusals); (5) the supplier's compliance with applicable FDA food-safety regulations; (6) the supplier's food-safety performance history (recalls, complaints, audits).

The importer must conduct, and document, verification activities scaled to the risk. The options are:

If verification reveals the supplier is not producing the food in compliance with applicable FDA requirements, the importer must promptly take appropriate corrective action — which may include rejecting the food, discontinuing use of the supplier, or imposing supplemental verification. Corrective actions must be documented. Importantly, the importer must also investigate the cause; a one-off rejection without root-cause analysis is a Warning-Letter pattern.

FSVP records must be in English, signed and dated by the responsible party, retained for at least 2 years past the food's last importation, and available on US soil for FDA review within 24 hours of request (§1.510). The minimum record set:

• Written FSVP for each food/supplier combination.
• Hazard analysis with rationale for each identified hazard.
• Supplier evaluation, including the FDA compliance check.
• Records of verification activities (audit reports, test results, record reviews).
• Corrective action records.
• Records of the qualified individual's role and qualifications.
• Reapproval documentation (FSVP must be reassessed at least every 3 years, or when any element materially changes).

FDA inspects FSVP at the US importer's location, NOT at the foreign supplier. The inspector arrives, requests the FSVP for a specific imported entry, and walks the record set. Common 483 / Warning Letter observations:

1. No written FSVP for an imported food — automatic finding.
2. Hazard analysis is generic (template) rather than food/supplier-specific.
3. Verification = 'we get the CoA' for a SAHCODHA hazard requiring annual audit.
4. FSVP not reapproved within 3 years.
5. No qualified individual identified, or the qualified individual lacks documented training.
6. Records not available in English within 24 hours.
7. Importer of record on entry filings is the broker or freight forwarder, not the actual US owner/consignee.

FSVP coverage does not displace downstream cGMP obligations:

• Imported dietary ingredient → FSVP applies at entry → 21 CFR 111.75 identity test applies at receipt at the dietary-supplement plant.
• Imported food ingredient → FSVP applies at entry → 21 CFR 117 PCHF / supply-chain program applies at the using facility.
• Imported drug API → FSVP does NOT apply (drugs are exempt under §1.501(c)) → 21 CFR 211 cGMP applies; supplier qualification is the 211 framework.

The most common multi-layer pattern: a US dietary-supplement manufacturer imports a botanical extract from a foreign supplier. FSVP at the importer, identity test under 111.75 at the supplement plant, finished-product spec under 111.70(e) on the supplement. All three obligations apply.

• fsvp_records table keyed by (supplier_id, food_id), with status (active|expiring|expired) and reapproval_due.
• hazard_analyses + supplier_evaluations + verification_activities child tables, all e-signed by the qualified individual.
• Receiving blocks if the FSVP for the (supplier, food) pair is not active.
• Corrective-action NCRs link back to the verification activity that triggered them.
• /app/reports → 'FSVP Inspection Pack (FDA Form 482 / 483 ready)' bundles the full record set for one supplier × food combination as a single PDF.