The Foreign Supplier Verification Program (FSVP) is an FDA rule, in 21 CFR Part 1 Subpart L, that requires the U.S. importer of a food to verify, before and while importing, that the food was produced to give the same level of public health protection as U.S. law demands, and that it is not adulterated or misbranded for allergens.
In plain terms: when food crosses the border, FDA does not chase the factory overseas. It holds the U.S. importer accountable. FSVP is the program that importer has to build, follow, and be able to show an FDA investigator on request. This guide covers who counts as the importer, the hazard analysis, how you evaluate a foreign supplier, the verification activities FSVP expects, and the DUNS number that ties the whole thing to your customs entry.
What is the Foreign Supplier Verification Program?
FSVP is one of the seven foundational rules of the FDA Food Safety Modernization Act (FSMA). It moved the point of control for imported food from the border inspection to the importer's own supply chain program. Instead of relying on port-of-entry sampling, FDA requires importers to know their suppliers, understand the hazards in each food, and verify that those hazards are being controlled.
The rule applies to food for humans and animals. It sits alongside the domestic HACCP-style preventive controls that U.S. plants follow: FSVP is essentially the importer's version of the same hazard-based logic, pointed outward at a supplier you do not own and cannot walk through on a Tuesday morning. FDA has posted the full text on eCFR and a plain-language overview on its FSVP rule page.
Who is the FSVP importer, and who needs a program?
The FSVP importer is the U.S. owner or consignee of the food at the time of U.S. entry. If there is no U.S. owner or consignee at entry, the importer is the U.S. agent or representative of the foreign owner or consignee, designated in writing. Getting this right matters, because the named FSVP importer is the party FDA holds responsible, not the broker and not the factory.
You need a separate FSVP for each food from each foreign supplier. Some importers cover many lines; some cover one. There are also modified, lighter requirements for a handful of cases: very small importers (roughly under $1 million in annual human-food sales, or under $2.5 million for animal food, averaged over three years), food from suppliers in countries whose food-safety systems FDA has officially recognized or found equivalent, and certain dietary supplements. Most commercial importers do not qualify for those and run the full program.
What are the importer's core responsibilities?
FSVP is a loop, not a one-time filing. You analyze hazards, evaluate the food and the supplier, decide and perform verification activities, take corrective action when something is off, and reevaluate on a schedule. A qualified individual, someone with the education, training, or experience to do it, has to perform or oversee each step.
How do you do the hazard analysis and evaluate the supplier?
Start with the hazard analysis for each food: identify the known or reasonably foreseeable biological, chemical (including radiological), and physical hazards, then decide which require a control. If none require a control, some foods genuinely carry no hazard needing one, you document that and your obligations are lighter. When a hazard does require a control, you move to evaluation.
Evaluation asks two linked questions: how risky is the food and hazard, and how well does this supplier perform? You weigh the hazard analysis, the entity that will control each hazard (the supplier, you, your customer, or another party downstream), the supplier's food-safety history, its compliance status, and any FDA warning letters or import alerts. That combined judgment sets the approval decision and drives how hard you verify. This is the same discipline as a strong supplier quality management program, applied under a federal rule.
What verification activities does FSVP require?
Verification is how you confirm the hazard is actually being controlled, not just promised. The rule does not let you pick the cheapest option freely: when a supplier controls a hazard that could cause serious adverse health consequences or death to humans or animals (FDA calls this a SAHCODHA hazard), the default verification activity is an annual onsite audit of that supplier, unless you document a written determination that another activity gives adequate assurance.
| Situation | Default verification activity | Typical frequency |
|---|---|---|
| Foreign supplier controls a SAHCODHA hazard | Onsite audit of the supplier (unless a documented alternative is justified) | At least annually |
| Supplier controls a non-SAHCODHA hazard | Onsite audit, sampling and testing, or review of the supplier's food-safety records, chosen to give adequate assurance | Appropriate to the risk |
| You, your customer, or another party controls the hazard | Written assurance the hazard is controlled downstream, plus disclosure that the food is "not processed to control [hazard]" | Per the assurance terms |
Two practical notes. First, an acceptable audit has to be conducted by a qualified auditor against applicable FDA food-safety regulations; a certificate from a GFSI-benchmarked scheme audit can support your program but does not automatically replace the FSVP audit requirement. Second, when verification, or any signal, shows a supplier is not controlling a hazard, you must take prompt corrective action, which can mean additional verification, corrective work with the supplier, or discontinuing the supplier until it is fixed.
What is the DUNS number, and how does FSVP show up at entry?
FSVP has a hard, unmissable touchpoint at the border. For each line of food offered for import, the FSVP importer must be identified by name, email address, and a unique facility identifier (UFI). FDA recognizes the DUNS number, issued by Dun & Bradstreet, as the acceptable UFI. Since July 24, 2022, the earlier "UNK" (unknown) placeholder is no longer allowed, every FSVP entry line needs a valid DUNS number or the entry can be held or refused.
Get the DUNS number well before you plan to import, confirm it matches the physical address of the FSVP importer, and make sure your customs broker files it correctly in the entry transmission. A missing or mismatched DUNS is one of the most common and most avoidable reasons FSVP shipments get stuck. This entry data also connects to broader import traceability expectations, including the recordkeeping under FSMA 204 for foods on the Food Traceability List.
What records does FSVP require, and how is it inspected?
FSVP is enforced almost entirely through records. You have to keep the documents that show the program is real: the hazard analyses, the supplier evaluations and approval decisions, the verification activities and their results, corrective actions, and the periodic reevaluations. Records generally must be kept for at least two years, be available to FDA promptly on request, and be in English or translatable into English on request.
What surprises many importers is how the inspection happens. FDA conducts FSVP inspections that are often remote or scheduled with limited notice, and the investigator may simply ask you to send your FSVP for a specific food and supplier. There is no factory tour to fall back on and no chance to build the file after the request lands, the records either exist and hold together, or they do not. That is why the strongest FSVP programs keep everything current and retrievable rather than scattered across email threads and personal drives. The same discipline that makes a food-safety-qualified individual's preventive-controls records audit-ready makes an FSVP survive a no-notice review.
How do you build an FSVP? Seven steps
- List every food and foreign supplier you import. One FSVP is required per food, per foreign supplier, so the inventory defines the scope of your whole program.
- Assign a qualified individual. The person developing and performing the FSVP needs the education, training, or experience to do it; document how they qualify.
- Run the hazard analysis for each food. Identify biological, chemical, and physical hazards and decide which require a control.
- Evaluate food risk and supplier performance. Combine the hazard analysis with the supplier's history and compliance status, and decide who controls each hazard.
- Choose and perform verification activities. Default to an annual onsite audit for SAHCODHA hazards the supplier controls; document any alternative.
- Wire up entry data. Secure a DUNS number, and confirm your broker files the FSVP importer name, email, and DUNS on every line.
- Reevaluate and keep records. Reevaluate each FSVP at least every three years, or sooner on new information, and keep records available to FDA in English.
Key facts and dates to pin
- FSVP lives in 21 CFR Part 1 Subpart L (sections 1.500 through 1.514), published on eCFR.
- The DUNS number has been required as the UFI on FSVP entries since July 24, 2022; the "UNK" placeholder was rescinded that day (FDA).
- For a SAHCODHA hazard a supplier controls, the default verification is an annual onsite audit unless a written determination justifies otherwise (FSVP at-a-glance).
- Importers must reevaluate each FSVP at least every three years or promptly when new information about a hazard or supplier appears.
- FDA's full guidance for industry is posted on the FDA guidance page.
Where FSVP fits with the rest of your food-safety system
FSVP is a records program under pressure. An FDA investigator can ask for your FSVP and give you little notice, sometimes conducting the review remotely, and the finding is almost always the same when things go wrong: the program existed on paper but the records were incomplete, the audit was overdue, or the reevaluation never happened. It is the same failure mode plants hit with GMP compliance and internal audits, good intentions, thin evidence.
That is why importers increasingly keep supplier approvals, verification schedules, audit results, and corrective actions in structured digital workflows instead of a shared drive and a spreadsheet, so an overdue audit surfaces before it becomes a held shipment and every record carries a timestamp. It is the same approach Harmony takes when it digitizes quality records and supplier documentation on the plant side. When your supplier program runs like a living system rather than an annual scramble, an FSVP inspection stops being an emergency and starts being a printout.