FDA Registration, Prior Notice and FSVP: What US Importers Need from a Sri Lankan Supplier

Compliance snapshot

• FDA treats any food facility registration not renewed by 31 December 2026 as expired. The renewal window runs 1 October to 31 December of every even-numbered year, and there is no fee (US FDA, 29 September 2026).
• The Foreign Supplier Verification Program (FSVP) duty sits with the US owner or consignee, not the supplier: hazard analysis, supplier evaluation, verification, and re-evaluation at least every three years (US FDA, FSVP final rule).
• Prior notice must reach FDA at least 2 hours before arrival by road, 4 hours by rail or air, and 8 hours by water (21 CFR 1.279).
• Silk Foods Ceylon in Matale is US FDA-registered and audited to BRCGS and FSSC 22000 V6, and Silk Route Ventures sends the supplier-side document set before a first purchase order.
• For importers of record and their compliance teams bringing Ceylon spices into the US.

FDA data from 79 countries put Salmonella in 6.6 percent of imported spice shipments offered for US entry, about twice the rate for other FDA-regulated imports (2013 analysis of FDA import data, Journal of Food Protection). That one number explains why the Foreign Supplier Verification Program asks so much of a US importer buying spice. The importer has to show, on paper, that it checked the supplier before the container sailed.

Silk Route Ventures (SRV) works through the same document set with US buyers ahead of the first order. This post covers three obligations that touch a Sri Lankan supplier directly: the FSVP file, food facility registration, and prior notice. It does not repeat the full by-owner list in the 2026 Ceylon export compliance checklist. It goes one level deeper on what the importer actually asks the supplier to send.

Who carries the FSVP duty, and what does it require?

The importer carries it. FDA defines the importer as the US owner or consignee of the food at entry, and where there is none, the US agent or representative of the foreign owner (US FDA, FSVP final rule). The rule asks for five things in sequence.

1. Hazard analysis. The importer identifies known or reasonably foreseeable biological, chemical and physical hazards for each food and decides which need a control.
2. Supplier evaluation. The importer reviews the hazard analysis, the party that controls each hazard, the supplier’s food safety procedures and compliance history, and then approves the supplier.
3. Verification. The importer chooses activities: an onsite audit, sampling and testing, or a review of the supplier’s food safety records (21 CFR 1.506).
4. Corrective action. If the supplier’s food is adulterated or its allergen labelling is wrong, the importer acts, which can mean stopping purchases.
5. Re-evaluation. The whole file is revisited at least every three years, or sooner when new information about a hazard or the supplier appears.

Records are kept for at least two years after they are created or obtained (21 CFR 1.510). At entry, the importer also gives CBP a unique facility identifier that FDA accepts, which in practice is a DUNS number, a requirement in force since 24 July 2022 (US FDA).

What does a Sri Lankan supplier need to hand over?

Every step in the FSVP file has a supplier-side document behind it. Most already sit in the audit file of a BRCGS and FSSC 22000 V6 certified site.

FSVP step	What the importer needs to see	Supplier document that answers it
Hazard analysis	The supplier’s own view of hazards for this food	HACCP plan summary: hazards, critical control points, critical limits, last validation date
Supplier evaluation	Procedures and compliance history	Current BRCGS and FSSC 22000 V6 certificates with full scope, plus the complete final audit report
Allergen control	Which allergens the site handles and how cross-contact is managed	Site allergen list, cross-contact assessment by line, cleaning validation method
Verification by records	Evidence the controls ran on the lot	Batch certificate of analysis against the agreed spec; traceability test result
Verification by testing	Independent data on the parameters that matter	Third party laboratory report for pesticide residues, heavy metals and microbiology as named in the RFQ
Corrective action	How the supplier handles a failed lot	Non-conformance and corrective action procedure, last mock recall report
Entry identification	Facility identity that matches the registration	FDA food facility registration number and the DUNS number tied to the site address

Source: SRV supplier-approval desk mapping against 21 CFR part 1 subpart L and the BRCGS and FSSC 22000 V6 documentation requirements.

The questionnaire layer on top of this is covered in what a certified exporter sends back to a supplier approval questionnaire. The FSVP file is the importer’s record of having read those answers and decided what to do with them.

Does a GFSI audit report satisfy the onsite audit requirement?

It can, but not automatically. For a serious hazard that the foreign supplier controls, the importer must obtain documentation of an onsite audit before first importing the food, then repeat it at least annually unless the importer writes down why other activities or a longer interval are adequate (21 CFR 1.506(d)). The auditor must be qualified, and the audit must consider applicable FDA food safety regulations and review the supplier’s written food safety plan and how it is carried out for the hazard concerned (21 CFR 1.506(e)).

A BRCGS or FSSC 22000 V6 audit report therefore helps, because the importer can review and assess it and keep the assessment on file. It does not replace that assessment. The importer may rely on another party’s verification only after documenting its review of the results.

There is a second route for some products. If the food cannot be eaten without a hazard being controlled and a downstream customer will control it, 21 CFR 1.507 can replace the supplier evaluation and verification steps. If that customer is not itself covered by the preventive controls rules, the importer must say on the accompanying documents that the food is “not processed to control” the hazard and must collect a signed written assurance from the customer every year. For a spice buyer the question is who owns the pathogen control step, and where that is written down.

Buyer’s checklist: documents to request from a Ceylon supplier for the FSVP file

1. Current BRCGS and FSSC 22000 V6 certificates, full scope statements and the complete final audit reports
2. HACCP plan summary stating which hazards the supplier controls and which it leaves to the buyer
3. Site allergen list and cross-contact assessment for the line your product runs on
4. Sample batch certificate of analysis against your spec, and the laboratory’s accreditation scope
5. Last traceability test (date, elapsed time, lot) and last mock recall report
6. FDA food facility registration number and the DUNS number matching the site address
7. Confirmation that the facility’s FDA registration was renewed in the 2026 window
8. The name of the party who will act as the importer of record

What changes for food facility registration in 2026?

Every food facility that manufactures, processes, packs or holds food for US consumption must renew its FDA registration between 1 October and 31 December of each even-numbered year. 2026 is one of those years. On 29 September 2026 FDA reminded registrants that it will consider the registration expired for any facility that does not renew by 31 December 2026 (US FDA, 29 September 2026). Renewal is filed through the FDA Industry Systems account, free of charge.

The renewal is the supplier’s job, but the consequence lands on the importer. A shipment from a facility whose registration has lapsed is a shipment from an unregistered facility. Registration also needs a unique facility identifier, which FDA currently accepts as a DUNS number, and the name and address on the registration have to match the DUNS record.

Silk Foods Ceylon (SFC) in Matale is a US FDA-registered facility. The practical step for any US buyer is the same for every supplier: ask for the current registration number, ask for confirmation that the 2026 renewal has been filed once the supplier has done it, and check that the address on the invoice is the address on the registration. The 2026 checklist lists facility name mismatch as one of the most frequent paper failures on Ceylon consignments, and the registration is where it starts.

When must prior notice be filed?

Prior notice is filed per shipment and has the least recovery room of the three. The minimum lead time depends on the mode of arrival, and the earliest filing date depends on the system used (21 CFR 1.279).

Mode of arrival	Minimum before arrival
Road	2 hours
Rail	4 hours
Air	4 hours
Water	8 hours

A filing through FDA’s Prior Notice System Interface can be made no more than 15 calendar days before arrival, and one made through the ABI/ACE customs route no more than 30 calendar days before. Food that arrives without adequate prior notice is subject to refusal and must be held (US FDA, 2008 final rule). A Ceylon shipment travels by sea, so the working number is eight hours, not four.

That detail matters because the notice is only as good as the data the supplier gave the filer. It names the manufacturer, and either that facility’s registration number or its full address with the reason no number is given (21 CFR 1.281). A supplier that sends the registration number and the exact commodity description with the shipping documents saves the broker a correction at the worst possible moment.

How the three obligations fit together on one shipment

Registration is the supplier’s filing, prior notice is the shipment’s, and the FSVP file is the importer’s record. If the registration number, the DUNS record and the certificate scope all name the same site, the three agree.

Sourcing from the manufacturer rather than through a trading layer shortens that chain, because the party that holds the registration is also the party that holds the audit file, a point covered in manufacturer-direct versus broker supply. For buyers specifying the commodity side of the same RFQ, how to write a spice RFQ sets out the certification and test lines, and per-lot heavy metal and pesticide testing explains how to read the certificate of analysis that becomes part of the verification record. How tightly lots trace back to a farm is set out in traceability depth and COA cadence.

Where SRV walks away Silk Route Ventures does not sign a buyer’s FSVP file and does not act as importer of record. The rule puts that duty on the US owner or consignee. SRV supplies the supplier-side documents. The decision to approve the supplier stays with the buyer.

Frequently asked questions

What documents does a US importer need from a Sri Lankan supplier under FSVP?

The importer needs enough to evaluate and verify the supplier: a HACCP plan summary, BRCGS and FSSC 22000 V6 certificates with scope and the full audit report, an allergen list and cross-contact assessment, batch certificates of analysis, traceability and recall test results, and the FDA registration and DUNS details. The importer keeps them for at least two years (21 CFR 1.510).

When does FDA food facility registration have to be renewed in 2026?

Between 1 October and 31 December 2026. Registration renews every two years, in even-numbered years, and FDA treats a facility that has not renewed by 31 December 2026 as expired. Renewal is filed electronically through the FDA Industry Systems account, there is no fee, and the facility needs a DUNS number that matches its registered address (US FDA, 29 September 2026).

How early must prior notice be filed for a sea shipment of spices?

At least eight hours before the shipment arrives at the US port, and no more than 15 calendar days before arrival through FDA’s own interface or 30 calendar days through the customs route. Food without adequate prior notice is subject to refusal and must be held at the port until the filing is corrected (21 CFR 1.279).

Can Silk Route Ventures send a supplier document set before a first order?

Yes. Silk Route Ventures sends a pre-built set from the BRCGS and FSSC 22000 V6 audited Silk Foods Ceylon site in Matale: certificates with scope and the audit report, HACCP summary, allergen list, trace and mock recall results, a sample batch certificate of analysis, and the FDA registration details. US buyers use it to build their own FSVP file. First orders start at 50 kg per SKU.

How Silk Route Ventures can help

Silk Route Ventures supplies Ceylon spices, herbs and related ingredient lines to US importers under one certification stack (BRCGS, FSSC 22000 V6, and USDA Organic and EU Organic on the relevant SKUs) from the Silk Foods Ceylon facility in Matale, which is US FDA-registered. The supplier document set above goes out before the first purchase order, so a buyer’s compliance team has the HACCP summary, audit report, allergen list and registration details when it writes the FSVP file. First-order MOQ is 50 kg per SKU, and samples ship by international courier in 3 to 5 business days. To request the document set and a sample batch certificate of analysis, contact us, or see the range of Ceylon spices supplied to US brands.

Sources

• US FDA, “FSMA Final Rule on Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals.” https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-foreign-supplier-verification-programs-fsvp-importers-food-humans-and-animals. Retrieved 13 October 2026.
• US FDA, “FDA Reminds Food Facilities of Biennial Renewal Requirements” (29 September 2026). https://www.fda.gov/food/hfp-constituent-updates/fda-reminds-food-facilities-biennial-renewal-requirements. Retrieved 13 October 2026.
• 21 CFR 1.506, Foreign supplier verification and related activities. https://www.law.cornell.edu/cfr/text/21/1.506. Retrieved 13 October 2026.
• 21 CFR 1.507, Foods that cannot be consumed without the hazards being controlled. https://www.law.cornell.edu/cfr/text/21/1.507. Retrieved 13 October 2026.
• 21 CFR 1.510, FSVP recordkeeping. https://www.law.cornell.edu/cfr/text/21/1.510. Retrieved 13 October 2026.
• 21 CFR 1.279, When must prior notice be submitted to FDA? https://www.law.cornell.edu/cfr/text/21/1.279. Retrieved 13 October 2026.
• 21 CFR 1.281, What information must be in a prior notice? https://www.law.cornell.edu/cfr/text/21/1.281. Retrieved 13 October 2026.
• US FDA, “Prior Notice of Imported Food Under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002,” final rule, 73 FR 66294 (7 November 2008). https://www.federalregister.gov/documents/2008/11/07/E8-26282/prior-notice-of-imported-food-under-the-public-health-security-and-bioterrorism-preparedness-and. Retrieved 13 October 2026.
• Food Safety News, “FDA updates spice risk profile” (2018), reporting FDA import data and the 2013 Journal of Food Protection analysis (6.6 percent of imported spice shipments Salmonella positive). https://www.foodsafetynews.com/2018/02/fda-updates-spice-risk-profile/. Retrieved 13 October 2026.

Further reading

• US FDA, “Registration of Food Facilities and Other Submissions.” https://www.fda.gov/food/guidance-regulation-food-and-dietary-supplements/registration-food-facilities-and-other-submissions

Written by the Silk Route Ventures Trade Team. Silk Route Ventures (E-Silk Route Ventures (Pvt) Ltd, T/A Silk Route Ventures) is a Sri Lankan B2B supply-chain operator for the Food, Beverage, Wellness, and Nutraceuticals sectors. The Silk Foods Ceylon manufacturing arm holds BRCGS and FSSC 22000 V6 certifications. Questions or to request a sample: contact https://www.esilkroute.com.lk/contact or email info@esilkroute.com.lk.