FSVP Compliance for Botanical Ingredient Importers: What FDA Expects When Your Raw Materials Cross a Border

There’s a misconception that runs through the herbal supplement industry, and it costs brands every year. The belief is that if your overseas supplier sends you a certificate of analysis — especially one from a third-party lab — you’re covered under FDA’s supplier verification requirements. You’re not. Not even close.

FDA’s Foreign Supplier Verification Program (FSVP), codified under 21 CFR Part 1, Subpart L, is a separate and distinct set of obligations that applies to anyone who imports food or dietary supplement ingredients into the United States. Under FSMA’s framework, botanical raw materials — dried herbs, botanical extracts, plant powders — are classified as food ingredients. That classification makes you, if you’re bringing them in from overseas, a regulated importer with specific, documented responsibilities that go well beyond reviewing a COA.

FDA has been conducting FSVP inspections since the rules took effect for most importers in May 2017, and the dietary supplement sector accounts for a substantial share of citations. A supplier’s lab report sitting in your inbox feels like protection. It isn’t — you didn’t commission it, you can’t audit the sampling method, and it wasn’t collected under your oversight. FSVP was designed precisely to close that gap.

Who Qualifies as an FSVP Importer — and Why It’s Almost Certainly You

The definition is broader than most people expect. Under 21 CFR §1.500, an importer is the U.S. owner or consignee of the food at the time of entry — or, if there’s no U.S. owner or consignee, the U.S. agent or representative of the foreign owner. If you’re a supplement brand in Chicago, Cincinnati, or Milwaukee that purchases ashwagandha root powder from an Indian supplier and has it shipped directly to your 3PL, you are almost certainly the importer of record under FSVP.

There are exemptions. Importers with less than $1 million in total annual food sales may qualify for modified requirements, and some tailoring exists for very small suppliers. But that threshold is easier to cross than smaller brands assume — especially once you aggregate revenue across a growing product line. And even the modified requirements include a hazard analysis obligation. There’s no version of FSVP where you simply rely on what the supplier tells you.

The first question to answer honestly: has your company ever formally declared itself the FSVP importer for each botanical ingredient it sources overseas? Many haven’t. They’re listed in other roles on import documentation, or they’ve assumed a broker or freight forwarder handles this dimension of compliance. Usually, that assumption is wrong — and FDA’s inspectors know it.

The Four Verification Activities FDA Actually Accepts

This is where FSVP gets substantive. Section 1.506 of the rule requires that importers conduct one or more of four types of supplier verification activities, selected based on the hazard analysis for each ingredient:

Onsite audits. A qualified individual — someone with the education, training, or experience to assess food safety hazards — visits the supplier’s facility and evaluates their controls. This is the gold standard under FSVP for hazards with high severity of harm, particularly when no finished-product control will catch the issue after the material arrives.

Sampling and testing of the food. This is where an independent analytical testing laboratory becomes a direct regulatory requirement, not just a best practice. Under §1.506(e), sampling and testing can serve as a primary verification activity — but only when the samples are collected in a way that gives you a representative picture of what you actually received. A single test per shipment may not be sufficient, and the analytical testing laboratory must apply methods appropriate to the hazard being controlled.

Review of the supplier’s relevant food safety records. COAs, internal test results, audit reports, corrective action records — reviewed by your qualified individual with the expertise to assess them. Note the distinction: this means reviewing records, not receiving them. A CoA forwarded to your inbox and filed unchecked doesn’t satisfy this activity.

Other appropriate procedures. FDA leaves room for additional verification methods, particularly for lower-risk supplier relationships. Third-party certification from a recognized body, supplier questionnaires, and allergen control attestations have all appeared in FDA guidance as supporting activities.

The critical point: FSVP doesn’t let you pick any of these arbitrarily. Under §1.504, the required verification activities must follow from the hazard analysis your qualified individual completed before the first shipment was released into commerce. Botanical raw materials typically carry multiple relevant hazards — heavy metals from soil contamination (cadmium, lead, inorganic arsenic), microbial risks (Salmonella, E. coli O157:H7, high total mold), pesticide residues, and botanical identity fraud. Each hazard category needs its own verification logic.

Building a Risk-Tiered Supplier Program That Will Hold Up to FDA Review

FDA’s FSVP framework is explicitly risk-based, and the agency expects to see that risk logic documented. The most defensible programs in practice tier suppliers by two variables: the severity of the potential hazard and the supplier’s demonstrated history of control.

A new supplier in a region with documented soil contamination, providing a botanical ingredient with known heavy metal accumulation tendencies, belongs in your highest verification tier. Certain mushroom powders and root botanicals fall into this category routinely — cadmium levels in particular have been a consistent finding across ICP-MS screening programs. For those suppliers, onsite audits or robust sampling-and-testing protocols are appropriate, ideally in combination until the relationship has a track record behind it.

A supplier with a 5-year history, consistent ICP-MS results across 20 or more lots, and a verified GMP certification from a recognized third party can reasonably shift to a lighter verification cadence — periodic confirmatory testing from an analytical testing laboratory plus record review, rather than lot-by-lot sampling.

Document the tiering rationale. During an FSVP inspection, FDA will ask to see the hazard analysis that drives each supplier’s verification requirements. A tiered supplier list without the underlying logic is nearly as problematic as having no list at all — it suggests process without substance.

For Midwest supplement brands receiving botanical ingredient shipments in the Chicago area, FSVP compliance has an added logistical dimension: your records must be available within 24 hours of an FDA written request, and they need to be accessible at the point of each import entry. That’s a records management challenge if your hazard analyses and verification documentation live in a purchasing manager’s email archive.

What Your Analytical Testing Laboratory Records Need to Show

If sampling and testing is your primary verification activity for a botanical ingredient, the records you generate need to do considerably more work than a standard product release test. Here’s what separates an FSVP-defensible testing record from a routine CoA:

Chain of custody from your control. Samples should be collected under your authority or by a qualified agent — not submitted by the supplier from their own stockpile. This is the fundamental gap that a supplier-provided lab report can never fill: you didn’t control sample collection, so you can’t establish that the sample represents what you actually received.

Hazard-specific method selection. Your analytical testing laboratory needs to test for the hazards identified in your hazard analysis, not just run a standard panel. If your valerian root hazard analysis identifies species substitution as a process hazard, you need botanical identity testing — HPTLC fingerprinting, DNA barcoding, or targeted marker compound quantification — in addition to heavy metals and microbiology. A panel that doesn’t address the documented hazard doesn’t satisfy §1.506.

Methodological defensibility. ISO 17025 accreditation for the specific test methods in use isn’t a FSVP requirement per se, but it matters in practice. If FDA reviews your testing records and the laboratory can’t produce a current scope of accreditation covering those methods, the evidentiary weight of those results in an enforcement context is materially weaker. Accredited methods are significantly harder to challenge.

Lot-level trend records. A single passing result doesn’t demonstrate a supplier’s ongoing control. Over 12 to 24 months, your testing records across multiple lots from the same supplier constitute evidence that their controls are working — or that something has changed. The trend matters as much as any individual data point.

For brands shipping samples through our Countryside, IL receiving hub, chain of custody documentation is handled from the moment a shipment is logged in — samples collected under your company’s account number, from your incoming lot, not from a pre-selected grab sample prepared by the supplier before shipment.

The Qualified Individual Requirement — Don’t Let It Be an Afterthought

Every FSVP importer must identify a Qualified Individual (QI) responsible for hazard analysis, supplier verification, and ongoing program management. FDA defines this as a person with “the education, training, or experience (or a combination thereof) necessary to perform the required activities.” This is a named role with real accountability — and FDA inspectors will ask for credentials.

Many supplement brands — particularly lean, growing companies sourcing 8 to 15 botanical ingredients from overseas suppliers — have no one formally filling that role. A purchasing manager without food safety training, a quality manager whose background is in pharmaceutical cGMPs rather than food safety, or an outsourced consultant who isn’t actually reviewing records all represent gaps that surface quickly under inspection.

The QI role can be filled by an outside party under the rule. A quality consultant or contract laboratory providing FSVP support services is explicitly permitted — as long as they’re actually conducting or reviewing verification activities and signing off on hazard analyses before shipments arrive, not just appearing on paperwork. The difference between a nominal QI and a functional one is exactly what FDA’s inspection process is designed to find.

Start Before the Next Shipment Arrives

FSVP isn’t retroactive, but your exposure compounds with every uninspected shipment. FDA can issue import refusals, initiate warning letter proceedings, and — for documented repeat violations — pursue injunctive relief against importers who lack a program.

The starting point for any brand that’s been importing botanical ingredients informally is a supplier inventory: every foreign supplier, every ingredient, and an honest assessment of which have documented hazard analyses behind them. That exercise takes an afternoon and almost always reveals more gaps than people expect. From there, hazard analysis, verification activity selection, and QI assignment follow a predictable sequence — one that an experienced analytical testing laboratory or quality consultant can help structure before your next shipment clears customs.

The CoA your supplier emails you will never be enough on its own. But with the right program behind it, it becomes one piece of a defensible record — instead of the only piece.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days Contact us

Related from our network

• ISO 17025 Accredited Botanical Testing Methods — Qalitex Laboratories provides the accredited ICP-MS, HPTLC, and microbiology testing that makes FSVP sampling-and-testing records defensible under FDA review.