Under the Foreign Supplier Verification Programs rule, the US owner or consignee of a coconut shipment carries the verification duty. The Sri Lankan or Filipino mill does not. FSVP for coconut imports is a records obligation, and FDA inspects the records at your office, usually without touching a container.
The file must exist before the first container moves, and it runs per food and per foreign supplier (21 CFR 1.502(a)). Buyers rarely fail on the hazard science. They fail because nobody inside the company owns the paperwork.
That gap now has its own enforcement route. Import Alert 99-41, published 15 September 2026, lets FDA divisions detain without physical examination any food offered by a named importer, on the charge that the importer “is in violation of section 805”. If the detention is not overcome, the shipment is refused, then re-exported or destroyed.
Who is the FSVP importer on a coconut contract?
Section 1.500 defines the importer as “the U.S. owner or consignee of an article of food that is being offered for import into the United States.” On FOB Colombo or CIF Los Angeles terms, that is the US buyer. On DDP terms where the seller holds title past the border, there may be no US owner or consignee at the moment of entry, and the foreign owner must designate a US agent or representative to act as the importer before the food is offered for import.
Settle this in the contract. The port is too late. Our incoterms guide covers where title sits on each term.
The importer’s name, email address and a unique facility identifier acceptable to FDA must be transmitted electronically at entry filing (1.509(a)). FDA recognises a Dun & Bradstreet DUNS number as that identifier, filed in the PG19 field under the FSV entity role code in ACE. Your broker can transmit it. Your broker is not your FSVP importer unless it owns or is consigned the goods.
What has to be in the file?
Six record sets, each on its own clock.
| Record | Rule | Refresh cycle |
|---|---|---|
| Written hazard analysis: biological, chemical including radiological, physical | 1.504(a), 1.504(b)(1) | When the food, process or evidence changes |
| Written procedures for importing only from approved suppliers | 1.506(a)(1), 1.506(b) | Reviewed with each evaluation |
| Supplier evaluation and approval decision | 1.505(a), 1.505(b) | Every 3 years, or promptly on new information (1.505(c)) |
| Determination of which verification activity applies, with the reasoning | 1.506(d)(1) | With each evaluation |
| Verification results: audit, sampling and testing, or records review | 1.506(e)(1) | Per that activity’s own cycle |
| Corrective actions and investigations | 1.508(a), 1.508(b) | Per event |
The hazard analysis is the one most often missing. It “must be written regardless of its outcome” (1.504(a)). A conclusion that desiccated coconut carries no hazard requiring a control is still a document you have to produce, and you will have to defend it against the Salmonella record.
You may rely on a hazard analysis someone else performed, including one from a co-packer or a third party, if you document your review of it and document that a qualified individual did the work (1.504(d)).
Does coconut trigger the annual onsite audit?
Sometimes. Where a hazard has a reasonable probability of causing serious adverse health consequences or death, and the foreign supplier controls it, you must obtain an onsite audit before first import and at least annually after that (1.506(d)(2)).
Salmonella in a ready-to-eat coconut ingredient sits in that class. If the mill’s thermal step is the control, the annual audit clock starts. If your own US plant applies a validated kill step downstream, the control moves, and so does the verification burden.
The annual audit is not absolute. You may substitute other activities if you make an adequate written determination that they are appropriate. An FDA inspection, or an inspection by a food safety authority in a country with an FDA-recognised comparable system, counts in place of the audit when conducted within one year of the audit due date (1.506(e)(1)(i)(E)). A supplier-run audit does not count.
Why Import Alert 23-12 changes your supplier evaluation
Supplier evaluation is not discretionary reading. Section 1.505(a)(1)(iii)(B) requires you to consider “whether the foreign supplier is the subject of an FDA warning letter, import alert, or other FDA compliance action.”
Coconut has a live one. Import Alert 23-12, “Detention Without Physical Examination of Coconut Due to the Presence of Microbiological Contamination”, published 17 July 2025, red-lists firms in Sri Lanka, India, the Philippines, Vietnam, Thailand and seven other origins. The basis: a 1991 cholera outbreak traced to a coconut milk dessert that also carried Salmonella, and a 2008 Listeria monocytogenes finding in shredded coconut from India. The charge is refusal under section 801(a)(3), the food being adulterated under 402(a)(1).
Check the red list by firm name and address before you sign. A red-listed supplier is not automatically disqualified, but importing from one without recording that you knew is indefensible. The desk re-runs this check at every renewal, alongside the wider supplier qualification pass.
How long do you keep it, and how fast must you produce it?
Two years from creation, and for discontinued processes, two years after use stops (1.510(c)).
Production speed is the part buyers underestimate. Records must be made “available promptly to an authorized FDA representative, upon request, for inspection and copying” (1.510(b)(1)). Offsite storage is allowed only if the records “can be retrieved and provided onsite within 24 hours of request” (1.510(b)(2)). An FSVP inspection is frequently unannounced. A file sitting in a supplier’s inbox in Colombo, in a language nobody in your office reads, fails twice over: the qualified individual must be able to read the records they review (1.500).
What does failing an FSVP inspection cost?
The first output is a Form 483, then a warning letter. FDA issued one to Life & Food Inc. on 15 June 2026 citing the standard finding: “You did not develop, maintain, and follow an FSVP, as required by section 805 of the FD&C Act and 21 CFR 1.502(a).” The firm had 15 working days to respond with corrective actions and documentation.
From there the cost stops being administrative. FDA can refuse admission of the food under section 801(a)(3), add the importer to Import Alert 99-41, and pursue action under section 301(zz). Detention without physical examination applies to the importer by name, across products, which means an unrelated coconut water container is held because a coconut flour file was thin. Recovery from there follows our claims playbook.
Are you exempt, or on modified requirements?
Some coconut trade sits outside the rule. Section 1.501 exempts food imported for research or evaluation, food for personal consumption, food transshipped through the US, food imported for processing and future export with no US distribution, and alcoholic beverages. Juice and seafood already under HACCP parts 120 and 123 are exempt. None of those cover a normal coconut ingredient import for the US market.
Very small importers get a lighter file. An importer averaging under USD 1 million a year in human food sales, adjusted for inflation, across the three preceding years may skip 1.504 through 1.508 and 1.510 entirely (1.512(b)(2)). In their place: written assurance from the supplier of compliance with sections 418, 419, 402 and 403(w) of the FD&C Act, obtained before importing and at least every two years after (1.512(b)(3)).
That threshold is company-wide, including subsidiaries and affiliates. Most buyers who think they qualify do not.
What this means for buyers
- Procurement (Persona A): name the FSVP importer entity and its DUNS in the contract, and hold the hazard analysis, evaluation and verification records in one folder retrievable in 24 hours.
- Importers and distributors (Persona B): Import Alert 99-41 attaches to your company name, not to a product, so one weak file can stop every line you bring in.
- Brand owners (Persona C): if your co-packer performs the kill step, document that the control moved, or you will be asked for an annual audit you never scheduled.
- All buyers: screen every approved mill against Import Alert 23-12 red lists at each renewal and write down the result, including a clean result.
- Timing: build the file before the first shipment. FSVP has no grace period tied to the first container.
FAQ
Is the exporter responsible for FSVP? No. The duty sits on the US owner or consignee at the time of entry. Where no US owner or consignee exists, the foreign owner must appoint a US agent to act as the importer before the food is offered for import.
Does a GFSI certificate satisfy FSVP? Not on its own. The rule recognises onsite audits, sampling and testing, records review, and other activities you justify in writing. A certificate can support supplier evaluation, but it is not a verification activity by itself.
How long do FSVP records have to be kept? Two years after creation, or two years after a discontinued process stops being used. They must be produced promptly on request, and within 24 hours if stored offsite.
Does one FSVP cover all my coconut suppliers? No. The programme runs per food and per foreign supplier. Adding a second desiccated coconut mill in Indonesia means a new evaluation, a new verification determination, and new records.
What happens if FDA finds no FSVP at inspection? A Form 483, then typically a warning letter with 15 working days to respond. Unresolved, the importer can be placed on Import Alert 99-41 and have shipments detained without examination and refused.
Need the FSVP file mapped against your origins before the first container books? Send the desk an RFQ.