FSVP Requirements: A Guide for US Food Importers

The Foreign Supplier Verification Program isn't optional, and FDA isn't bluffing. Here's what you actually need to do — in plain language — to stay compliant and keep your shipments moving.

Your container just cleared customs. Forty thousand pounds of dried fruit from Turkey, released without a hitch. You're feeling good. Two weeks later, you get a letter from FDA. They're conducting an FSVP inspection and would like to review your records for this supplier. All of them. They'd like them within 24 hours.

You open your laptop, pull up a shared Google Drive, and start hunting. There's a folder called "Supplier Docs 2025" and another called "FSVP — NEW." Neither is organized the way you remember. Your hazard analysis is somewhere in an email thread with your food safety consultant from last year. The supplier's audit report? You think it's the PDF titled "audit_final_FINAL_v3.pdf," but you're not sure if that's the one for this facility or their other one.

This isn't a hypothetical. It's happening to food importers every week. And the fix isn't complicated — it just requires understanding what FSVP actually demands and building a system that can deliver it. Let's break it down.

What is the Foreign Supplier Verification Program?

The Foreign Supplier Verification Program is an FDA regulation under the Food Safety Modernization Act (FSMA) that puts the compliance burden squarely on the US importer. The logic is straightforward: if you're bringing food into the country, you're responsible for making sure it's safe. Not your supplier. Not your broker. You.

Before FSMA, the FDA's approach to imported food was mostly reactive — inspect it at the border, test what you can, hope for the best. FSVP flipped that model. Now, importers have to proactively verify that their foreign suppliers are producing food that meets US safety standards. It's preventive rather than reactive, and it applies to virtually all food imports.

The rule went into full effect in 2017, but FDA enforcement has ramped up significantly over the past few years. If you've been skating by with minimal documentation, that window is closing fast.

Who needs to comply with FSVP?

Short answer: if you're the US owner or consignee of imported food at the time of entry, you're the FSVP importer. That's true whether you're a large distributor importing containers of ingredients, or a small brand bringing in a single specialty product from overseas.

There are a few narrow exemptions. You don't need a full FSVP program for:

• Juice and seafood products already covered by HACCP regulations (though you still need to verify your supplier has a HACCP plan)
• Food for personal consumption (not for resale)
• Alcoholic beverages other than certain wines, as regulated by TTB
• Food imported for research or evaluation that won't be sold
• Very small foreign suppliers who meet specific conditions — but you still need to document why the exemption applies

Everyone else? You need a program. And "I didn't know" isn't a defense FDA has patience for anymore. If you're also managing PFAS requirements or Prop 65 warnings on the same products, the documentation burden stacks up quickly — which is exactly why spreadsheets start failing once you scale past a handful of SKUs.

The 5 core FSVP requirements for food importers

FSVP boils down to five things. They're not conceptually difficult, but they each require documentation that FDA expects you to maintain and produce on demand.

1. Hazard analysis. For each food you import, you need to identify known or reasonably foreseeable hazards — biological, chemical (including radiological), and physical. This isn't a generic exercise. It needs to be specific to the food, the supplier's process, and the country of origin. If you're importing dried spices from India, your hazard profile looks different than frozen seafood from Vietnam.

2. Supplier evaluation. You need to evaluate each foreign supplier's performance and the risk posed by the food they produce. This means looking at their food safety record, the results of any inspections or audits, and whether they're complying with applicable FDA regulations. You're essentially building a risk profile for every supplier.

3. Verification activities. Based on your hazard analysis and supplier evaluation, you need to determine what verification activities are appropriate. This could include onsite audits of the supplier, sampling and testing of the food, reviewing the supplier's food safety records, or some combination. The higher the risk, the more rigorous the verification needs to be.

4. Corrective actions. When something goes wrong — a failed test result, a supplier audit that reveals issues, a recall — you need a documented process for how you'll respond. That might mean additional testing, temporary suspension of the supplier, or terminating the relationship entirely. Whatever you do, document it.

5. Reassessment. Your FSVP isn't a set-it-and-forget-it document. You need to reassess your program at least every three years, or sooner if new information comes to light — like a recall, a change in the supplier's process, or updated FDA guidance. Each reassessment needs to be documented with dates and findings.

What FDA inspectors actually look for

Here's the thing most importers don't realize until it's too late: FDA inspectors aren't showing up to evaluate whether your food is safe. They're showing up to evaluate whether your program is adequate. There's a meaningful difference.

An FSVP inspection typically starts with FDA requesting your records. They want to see your hazard analysis, your supplier evaluations, your verification activities, and your corrective actions — all documented, all organized, all accessible. They'll usually focus on a specific product-supplier combination and trace through your entire FSVP for that pairing.

What they're checking:

• Do you have a qualified individual? Someone with the education, training, or experience to perform FSVP activities. This person needs to be identifiable in your records.
• Is your hazard analysis product-specific? Generic templates that say "biological, chemical, physical" without specifics won't cut it.
• Are your verification activities appropriate to the risk? High-risk foods (like ready-to-eat products) with minimal verification is a red flag.
• Can you produce records promptly? FDA expects records within 24 hours of a request. If your documentation lives in a dozen different places, that timeline gets tight.
• Are your reassessments current? If your last review was four years ago, that's a finding.

Most FSVP violations aren't about unsafe food. They're about importers who can't demonstrate they have a system in place. The paperwork is the compliance.

FDA has been issuing warning letters and import alerts at an increasing rate for FSVP deficiencies. The consequences range from warning letters (public and embarrassing) to import holds (expensive and disruptive) to injunctions in serious cases.

Common FSVP mistakes that get importers in trouble

After talking to dozens of food importers, I've seen the same mistakes over and over. None of them are hard to fix, but all of them can cause real problems during an inspection.

Treating FSVP as a one-time exercise. You set up your program when you first started importing, and you haven't touched it since. Your suppliers have changed, your product line has expanded, and your hazard analysis is two years stale. FDA will notice.

Using the same verification for every supplier. A supplier in a country with a robust food safety infrastructure doesn't need the same level of verification as one in a country with weaker oversight. Your program needs to reflect risk-based decision-making, and that thinking needs to be documented.

No qualified individual on record. Somebody at your company needs to be designated as the qualified individual for FSVP purposes, and their qualifications need to be documented. "Our CEO handles compliance" without any supporting documentation about their training or experience is a gap.

Records scattered across email, drives, and filing cabinets. This is the most common one. You have the records, technically, but producing them in an organized fashion within 24 hours is a scramble. If you're managing multiple suppliers across multiple product lines, this gets out of hand fast. It's the same problem we see with CPC documentation — the records exist, but nobody can find them when it matters.

Ignoring corrective actions. A supplier fails a test. You switch to a different lot and move on. But there's no documentation of what happened, what you did about it, and whether you reassessed the supplier's risk profile. That gap will show up in an inspection.

How to build an FSVP program that works

Building an effective FSVP program isn't about creating a mountain of paperwork. It's about creating a system — one that's organized, maintained, and accessible. Here's what that looks like in practice:

Start with your product-supplier pairs. Every unique combination of food product and foreign supplier needs its own FSVP documentation. List them all. If you've got 15 products from 8 suppliers, you might have 20+ unique pairs to manage. This is your scope.

Do the hazard analysis properly. For each product, identify the specific hazards. Use FDA's guidance documents, your industry knowledge, and the supplier's process information. Don't copy-paste generic hazard lists. Be specific about which hazards are significant and why.

Match verification to risk. High-risk products (raw agricultural commodities, ready-to-eat items, products with a history of safety issues) need more rigorous verification — typically onsite audits. Lower-risk products might get by with testing and records review. Document your rationale.

Set up a calendar. Reassessments every three years minimum, supplier evaluations on a regular schedule, verification activities as planned. Don't let these slip. If your approach is "I'll get to it when I have time," you won't get to it.

Keep everything in one place. This is where most importers struggle, and it's where the right tool makes all the difference. Whether it's a purpose-built compliance platform or an extremely well-organized shared drive, the point is that when FDA asks for your records, you can produce them quickly, completely, and confidently. If you're juggling FSVP alongside PFAS documentation and Prop 65 records, a centralized system isn't a luxury — it's a necessity. That's exactly why we built Aleph.