FDA Advises Food Facilities to Protect Registration Information

The U.S. Food and Drug Administration (FDA) is reminding food facilities that it is important to register their business with the FDA only when required and to protect their Food Facility Registration (FFR) information from potential misuse. 

The agency said it is aware of a number of issues regarding registration requirements and potential misuse of FFR, including:

• An uptick in businesses registering their facilities with the FDA when they are not required to. 
• Third-party businesses or "registrars" requesting FFR number, PIN, FIS-FURLS username and/or FIS-FURLS password to verify registration status.
• The TikTok Shop and other third-party seller platforms asking food companies to provide a copy of their FDA Food Facility Registration, or a certificate, as part of their product listing process. 

The above issues can create problems for both these businesses and for the FDA, the agency said, including:

• Security Risks. Having an FFR number when you don't need one, and then sharing it with third-party platforms, creates opportunities for bad actors to misuse your registration information for fraudulent purposes. When you provide your FFR number and PIN (or username and password), these entities can link your FFR to their own FIS-FURLS accounts. Once linked, they can view, change or even cancel your FFR.  To check your FFR status, use the official FDA website here.
• Regulatory Confusion. Registering when exempt or otherwise not required to may subject your facility to unnecessary inspections or create confusion about your compliance obligations.
• Straining FDA Resources. Unnecessary registrations divert FDA resources away from monitoring facilities that are required to register, including those that pose increased food safety risks. 

Below are some steps FDA recommends taking to keep your facility’s information safe: 

• Never share your FIS-FURLS username and password for any FDA registration system. Each FIS-FURLS account is designated for the individual who created it and should not be shared. If additional personnel are desired to help manage registrations or other submissions, an account holder may create subaccounts for those personnel as necessary. 
• Remember that the FDA does not require you to share your FFR number with third parties. FFR information is not public. However, for imports, a facility may need to provide its FFR number to the downstream commercial entity submitting prior notice to FDA for an imported food (see 21 CFR part 1, subpart I).  Note that the FEI (FDA Establishment Identification) number is a separate, unique public identifier that can be looked up via FEI Search Portal.

• Consider cancelling your FFR and re-registering your facility if you've already shared your number and/or PIN in error. 

Not all food businesses are required to register with the FDA. Understanding whether your company must register is the first step in compliance, said the agency. Food facilities that manufacture/process, pack or hold food must register unless exempt (21 CFR 1.225; 21 CFR 1.226). Private residences are not considered facilities (21 CFR 1.227). See Section II.B of the FDA Guidance for Industry: Questions and Answers Regarding Food Facility Registration for assistance in determining if an exemption applies.