FSVP on Shopify: How to Verify a Foreign Food Supplier

If you are the US owner or consignee of the food when it is offered for entry, the FSVP importer role is yours, and the sections below cover what it asks you to do, what you can hand to someone else, and the shorter routes the rule offers small importers and small suppliers.

The rules sit in 21 CFR part 1, subpart L, and FDA explains them in its January 2023 guidance for industry.

What FSVP Asks of a Shopify Food Importer

Section 1.502 sets the unit of work: for each food you import, you must develop, maintain, and follow an FSVP that gives adequate assurances your foreign supplier produces it with at least the same level of public health protection US food safety rules require, and in compliance with the FD&C Act's adulteration and allergen-labeling provisions.

In practice that means one file per pairing. The same type of food from two suppliers is two supplier evaluations, and two types of food from one supplier each need their own hazard analysis. Every task in those files falls to a qualified individual, covered in the next subsection.

Shopify's own content acknowledges the duty without walking through it. The one mention we found on shopify.com is a sentence in an enterprise blog post about coffee distribution:

No Help Center page we read, including the pages on restricted and prohibited products, describes a verification activity, a qualified individual or the very small importer route (see the search boundary below). The procedure on this page therefore comes from FDA's regulation and its guidance.

FSVP verifies the supplier; it is not the shipment filing. FDA Prior Notice is a separate notice about each shipment, and the importer identification FSVP adds at entry — your name, email address and unique facility identifier on every line entry, under section 1.509 — travels with the entry filed with US Customs and Border Protection.

Who Can Be Your Qualified Individual?

Section 1.503 puts every FSVP task in one pair of hands: a qualified individual must develop your FSVP and perform each of the activities the subpart requires. The definition asks for the education, training or experience, or a combination, that the activity needs, plus one practical test: the person must be able to read and understand the language of any records they review.

It does not have to be you. The definitions in section 1.500 say a qualified individual may be, but is not required to be, an employee of the importer, and a government employee, including a foreign government employee, can qualify. FDA's guidance adds the point that matters when you hire help: a qualified individual retained as your contractor or consultant is not considered to be “another entity,” so an evaluation they do for you needs no separate review and assessment. The results of verification activities must still be promptly reviewed, assessed and documented by your qualified individual, and the consultant can be that person.

Who Is the Importer When the Supplier Ships to Your Customers?

Some stores never touch the goods: the producer ships to a US warehouse or straight to the buyer, and the store only takes the order. The importer is the US owner or consignee at the time of entry, and our answer on who counts as the FSVP importer covers that test in full. FDA's guidance works through the closest e-commerce case:

The guidance we read does not name the case where a supplier ships from abroad straight to your store's US customer (see the search boundary above). The rule's test still decides it: the importer is the person in the US who owns the food, has purchased it or has agreed in writing to purchase it at the time of entry, and if there is no such person, the importer is a US agent or representative of the foreign owner or consignee, who confirms it in a signed statement of consent.

If your store buys the stock before it is offered for entry, you are its US owner at entry, and the role is yours.

The Very Small Importer Route

The full program described below — a hazard analysis, a supplier evaluation, verification activities and records — is what this route replaces.

The rule gives a lighter route to importers whose food business is small. A very small importer, for human food, is one that, including any subsidiaries and affiliates, averages less than $1 million per year, adjusted for inflation, during the 3-year period preceding the applicable calendar year, counting human food sales plus the US market value of human food imported, manufactured, processed, packed or held without sale.

Section 1.512 fixes which 3 years count: the period ending 1 year before the calendar year you intend to import in. FDA's guidance works one example: to import as a very small importer in 2023, you make the determination by December 31, 2022, using sales from 2019, 2020 and 2021. On the same count, importing in 2026 rests on 2022–2024 sales, and importing in 2027 on 2023–2025 sales, documented by December 31, 2026.

The inflation adjustment runs from a 2011 baseline, and sales made in another currency convert at the exchange rate in effect on December 31 of the year of the sale.

FDA adjusts the dollar figure for inflation and says it intends to update the values at the beginning of April each year. Its cut-off table, with content current as of May 13, 2026, puts the human-food cut-off at $1,372,952 for a 2023–2025 sales average — on the count above, the window for importing in 2027. The table FDA had posted before, with content current as of July 17, 2025, gave $1,331,894 for a 2022–2024 sales average — on the same count, the window for importing in 2026. FDA's table does not say which import year a window serves; that step is ours, from the guidance example above.

Choosing the route is optional, and it is documented. You must document that you meet the definition before initially importing as a very small importer, and thereafter annually by December 31, and keep the records behind your status for at least 3 years.

If your business began operations after the initial FSVP compliance date for the food, FDA's guidance says you can rely on a projected estimate of revenue, or market value, at the time you begin, and once you have records for 1 or 2 preceding years, you should calculate from the records you have.

Two other modified regimes sit beside this one. Importers of dietary supplements and their components follow section 1.511, which turns on the dietary supplement good manufacturing practice rules; those rules themselves are covered in our supplement store guide. And food not intended for further manufacturing or processing, from a supplier in good compliance standing in a country whose food safety system FDA has officially recognized as comparable or determined equivalent, can follow section 1.513 when the food is within that recognition; that section drops sections 1.504 through 1.508 but keeps the qualified individual, importer identification and records.

Buying From a Small Foreign Supplier

The same modified route opens from the supplier's side. It applies when you import:

• Food from a supplier that is a qualified facility under FDA's preventive-controls rules
• Produce from a farm that grows produce and is not a covered farm under the Produce Safety rule
• Shell eggs from a producer outside FDA's shell egg rule because it has fewer than 3,000 laying hens

Before first approving such a supplier for a calendar year, and annually by December 31 after that, you obtain written assurance that it meets one of those criteria. Then, before importing and at least every 2 years, you obtain written assurance about the food itself; from a qualified facility, that assurance includes either a brief description of its preventive controls or a statement that it complies with applicable non-federal food safety law.

If you are not a very small importer, three duties come back on this route. You evaluate the supplier's FDA compliance history, including warning letters and import alerts, and approve it on that basis; you reevaluate on new information and at least at the end of any 3-year period; and you keep written procedures to import only from approved suppliers.

How to Write the Hazard Analysis

Section 1.504 asks you to identify and evaluate, based on experience, illness data, scientific reports and other information, the known or reasonably foreseeable hazards for each type of food you import, and to decide whether any of them requires a control. Your hazard analysis must be written regardless of its outcome, so a clean result is still a document.

The analysis has to cover three types of hazard:

• Biological hazards, including microbiological hazards such as parasites, environmental pathogens and other pathogens
• Chemical hazards, including radiological hazards, pesticide and drug residues, natural toxins, decomposition, unapproved food or color additives, and food allergens
• Physical hazards, such as stones, glass and metal fragments

It must also consider why a hazard might be there: because it occurs naturally, because it may be introduced unintentionally, or because it may be introduced intentionally for economic gain. The evaluation weighs the probability of each hazard against the severity of the illness or injury, and looks at factors such as the formulation, ingredients, transportation, packaging, storage and intended use of the food.

You do not have to start from a blank page. If another entity, including your foreign supplier, has analyzed the hazards using a qualified individual, you can meet the requirement by reviewing and assessing that analysis. You then document the review and assessment, and the fact that a qualified individual did the work.

When the Hazard Is Controlled After Import

Section 1.507 covers foods whose hazard is dealt with after they reach you. It applies when your hazard analysis has identified a hazard requiring a control, and it replaces both the supplier evaluation of section 1.505 and the verification activities of section 1.506.

The first case matters to anyone importing green coffee to roast: you determine and document that the type of food could not be consumed without application of an appropriate control. The rule's own examples are raw agricultural commodities such as cocoa beans and coffee beans.

Import duty on those beans is a separate question from FSVP; see whether the US charges duty on green coffee beans.

The next three cases apply when a business customer, such as a wholesale buyer, deals with the hazard. In each, the documents accompanying the food must disclose, in accordance with the practice of the trade, that it is “not processed to control [identified hazard]”, and you obtain an annual written assurance:

1. Your customer is subject to FDA's preventive-controls requirements and assures you it follows procedures that will significantly minimize or prevent the hazard
2. Your customer is not subject to those requirements and assures you it manufactures, processes or prepares the food in accordance with applicable food safety requirements
3. Your customer assures you that a later entity in the distribution chain will process the food to control the hazard, and that it will pass the same disclosure along and sell only to an entity that agrees in writing to control the hazard or to obtain a similar assurance

The last case needs no customer at all: you establish, document and implement your own system that ensures the hazard is controlled at a subsequent distribution step. Every written assurance under these cases must contain three things:

• An effective date
• The printed names and signatures of authorized officials
• The assurance the applicable case requires

How to Evaluate and Approve a Foreign Supplier

Section 1.505 turns the hazard analysis into a supplier decision. Before you approve a foreign supplier and choose how to verify it, you must consider four things:

1. The hazard analysis for the food, including the nature of each hazard requiring a control
2. Which entity will significantly minimize or prevent those hazards: the supplier, the supplier's own raw material supplier, or another entity in your supply chain
3. The supplier's performance: its food safety procedures and practices, its compliance with applicable FDA food safety regulations — including whether it is the subject of an FDA warning letter, import alert or other compliance action related to food safety — and its food safety history, such as test results, audit results and how it responds to correcting problems
4. Any other factors that are appropriate and necessary, such as storage and transportation practices

The evaluation and the approval are both documented, and you then need written procedures that make sure you import only from suppliers you have approved. The rule allows a temporary exception when necessary and appropriate: an unapproved supplier whose food you subject to adequate verification activities before importing it.

Approval is not permanent. When new information about any of those factors reaches you, you reevaluate promptly and document it, and if at the end of any 3-year period no reevaluation has happened, you must do one. Another entity's evaluation can stand in for yours if you review and assess it, but that entity cannot be the foreign supplier itself.

Which Verification Activity, and How Often?

Section 1.506 makes the choice an explicit, written decision. Before importing a food from a foreign supplier, you must determine and document which verification activity or activities you need, and how often, based on the evaluation from the previous step. The rule lists four appropriate activities, and it spells out what each one leaves in your file:

Documentation lists from 21 CFR 1.506(e)(1); the supplier limit from 1.506(e)(2)(ii). Source: 21 CFR 1.506, Electronic Code of Federal Regulations.

Verification runs before importing the food and periodically thereafter, at the frequency you documented. The results then need your prompt review and assessment, in writing. If they do not give adequate assurance, the corrective-action duty of section 1.508 applies: you must promptly take appropriate corrective action, which could include discontinuing use of the supplier until the cause is adequately addressed, and document it.

If you learn by means other than verification or a reevaluation that the supplier is not producing the food to the required standard, you must promptly investigate whether your FSVP is adequate, modify it when appropriate, and document the investigation, corrective actions and changes.

When an Annual Onsite Audit Is the Default

One class of hazard changes the default. When a hazard in the food will be controlled by the foreign supplier, and there is a reasonable probability that exposure to it will result in serious adverse health consequences or death, you must conduct or obtain documentation of an onsite audit before initially importing the food and at least annually thereafter.

The rule leaves a door open. You can use other verification activities, or audit less often, if you make an adequate written determination that they give adequate assurances that the supplier is producing the food to the required standard.

Two details decide who does the work. The audit must be performed by a qualified auditor. And the written results of an official inspection can substitute if it was conducted within 1 year of the date the audit was due: an inspection for compliance with applicable FDA food safety regulations by FDA, another federal agency, or a state, local, tribal or territorial agency, or an inspection by the food safety authority of a country whose system FDA has officially recognized as comparable or determined equivalent, provided the food is within the scope of that recognition and the supplier is in, and under the oversight of, that country.

FDA's own webinar on the final rule walks through the same logic; the chapter on choosing verification activities, including the annual-audit default, starts at 16:56. It dates from 2015, so treat the rule text and FDA's 2023 guidance as the current word.

What You Can Hand Off, and What Stays Yours

Delegation is written into the rule at almost every step, with one recurring limit: the entity you lean on is usually not allowed to be the supplier you are verifying. Section 1.506 states that limit plainly:

Two more limits apply to whoever does the verification. There must not be any financial conflict of interest that influences the results, and payment must not be related to the results of the activity. And you need not keep another entity's verification documents yourself, as long as you can obtain them and make them available to FDA under the records rules below.

Which FSVP Records to Keep, and for How Long

Everything above ends as paper, and section 1.510 sets the rules for it. Records must be kept for at least 2 years after you created or obtained them; records about your processes and procedures, such as evaluations and determinations, run for at least 2 years after their use is discontinued, for example when you stop using a supplier or change a verification activity.

Two provisions save work. Records kept under this subpart are exempt from FDA's part 11 electronic-records requirements, though records that other rules also require stay subject to it. And you do not need to duplicate records you already keep for other federal, state or local rules if they contain everything the subpart asks for.

Find Your Route for One Food and One Supplier

The quiz applies the same order of precedence as the table at the top, one food and one supplier at a time. Where it adds something is an input you have not settled yet — you are not sure of your three-year average, you don't know what kind of supplier this is, or you haven't written the hazard analysis — because it shows which one to settle first. Run it once for each food and supplier pair.

What Happens When FDA Reviews Your FSVP

FDA checks an FSVP by reviewing its records, and that does not always involve a visit. FDA's guidance puts it this way:

If the investigator observes potential violations, you receive a written summary of the observations on a Form FDA 483a (“FSVP Observations”). A response can go through FDA's FURLS system, by USPS certified mail or by commercial delivery.

Behind both sits the statute: importing food without an FSVP that meets the requirements is a prohibited act under section 301(zz) of the FD&C Act, and food whose importer appears not to comply is subject to refusal of admission under section 1.514.

Build the File for One Supplier

Steps 1, 7 and 8 apply on every route.

• Full program: all nine steps apply, in order.
• On the very small importer route, steps 2 to 6 and step 9 give way to one written supplier assurance before importing and at least every 2 years, plus your very small importer status documented before your first import on that route and annually by December 31 after that.
• On the small-supplier route, two written assurances from the supplier — that it meets the small-supplier criteria, before first approval and annually by December 31, and about the food, before importing and at least every 2 years — replace steps 2, 5 and 6, while steps 3, 4 and 9 stay, with the evaluation and reevaluation built on the supplier's FDA compliance history.
• On a section 1.507 route, write step 2, then replace steps 3 to 6 with the disclosure and the customer's annual assurance, or with your documented determination for food like coffee beans.
• If your hazard analysis found no hazard requiring a control and the food is not covered raw produce, go from step 2 straight to steps 7 and 8.

The Bottom Line

The work scales with pairings of food and supplier, not with sales: each pairing is its own file, and each file starts with the same two questions — who your qualified individual is, and what the hazard analysis found.

Frequently Asked Questions