Most farmed shrimp, tilapia and salmon plants that sell into the United States hold a Best Aquaculture Practices certificate from the Global Seafood Alliance. Most importers keep a copy. The question this piece answers is narrower than whether BAP is a good program: it is whether the copy in the file is, on its own, the affirmative step §123.12 requires, and if not, what it is.
What does step (b) require?
21 CFR 123.12(a)(2)(ii)(B) lists, as one of the six affirmative steps, "obtaining either a continuing or lot-by-lot certificate from an appropriate foreign government inspection authority or competent third party certifying that the imported fish or fishery product is or was processed in accordance with the requirements of this part."
Three things in that sentence do the work. The certifier may be a private body: "competent third party" is in the text. The certificate may be continuing rather than per lot. And the certificate must certify a specific thing: that the product "is or was processed in accordance with the requirements of this part," meaning 21 CFR Part 123.
FDA's Q&A guidance on the regulation adds three answers. There is no FDA form for the certificate, but it "should" verify that the foreign processor processed the product under sanitation and HACCP procedures that comply with Part 123 (X.F.2). The importer need only keep the certificate itself, not the audit behind it, though FDA "reserves the right" to ask for supporting documents (X.F.1). And FDA "does not consider third-party verification superior" to the other steps (X.F.3). The suggested cadence for a continuing certificate is once a year (X.E.2).
What does a BAP certificate certify?
Conformance to a GSA standard. For a processing plant that is the Seafood Processing Standard, audited annually by a certification body accredited to ISO/IEC 17065. Issue 5.1 took effect January 16, 2021; Issue 6.0 was released November 5, 2025, and GSA's standards page notes that 6.0 "is not currently benchmarked by GFSI," where 5.1 had been benchmarked to GFSI's requirements since 2018.
The standard is closer to Part 123 than it is usually given credit for. Issue 5.1 lists "FDA Seafood HACCP Regulation, 21CFR 123" and the Hazards and Controls Guidance among its normative references. Clause 3.2.1 requires the plant's HACCP system to comply with "the legislation of the countries the facility exports to." Clause 3.2.2 requires the hazard analysis to include "at least those hazards identified by Codex Alimentarius, or the USFDA's 'Fish and Fisheries Products Hazards and Controls Guide'," and makes the Guide the default where no stricter rule applies. Clause 2.4.4 requires documented HACCP training for the HACCP team. For farmed species, clause 3.2.13 requires receiving-lot testing for the aquaculture drugs in the standard's Annex 4, at one sample per receiving lot unless the plant can justify less.
So an auditor working to Issue 5.1 is supposed to have looked at the plant's HACCP plan against the Guide. That is a real overlap with what an importer needs, and it is more than a generic food-safety scheme offers.
Where is the gap?
The certificate does not say the words. A BAP certificate attests that a plant conforms to the BAP Seafood Processing Standard. Step (b) asks for a certificate "certifying that the imported fish or fishery product is or was processed in accordance with the requirements of this part." Those overlap heavily and are not the same sentence, and the regulation is written around the sentence. Nothing in FDA's Q&A or in Compliance Program 7303.844 says a private certification against a standard that incorporates Part 123 counts as a (b) certificate, and nothing says it does not. What the compliance program does say is that importer inspections are meant, among other things, to "provide insight into the reliability of third party inspections and foreign certification programs." FDA treats certification as a thing to be evaluated at the file, not as a thing that closes the question.
The audit is annual and the hazard is per lot. This is the part the 2026 numbers speak to.
What did 2026 add?
The Southern Shrimp Alliance reads FDA's import refusal data each month. Its August 2026 report, published September 4, counts 56 shrimp entry lines refused so far in 2026 for veterinary drug residues, led by India, Indonesia and Vietnam, and states that "79% of shrimp entry lines refused for antibiotics in the first eight months of 2026 originated from facilities that operated with BAP certifications this year." On May 27, 2026, Senators Cassidy and Tuberville wrote to GSA, the Marine Stewardship Council and the Aquaculture Stewardship Council asking how their programs address food-safety failures in certified supply chains.
Read carefully, the 79% is not a finding about audit quality. It is what an annual audit of a plant's system can and cannot see. A certificate can be valid on the day a lot with a chloramphenicol residue leaves the plant, because the certificate is about the system and the residue is in the lot. The Guide treats aquaculture drugs as a receiving hazard controlled at the plant, and the step that produces evidence about the lot you received is step (e), periodic product testing. That is not an argument against BAP. It is an argument about which instrument measures which thing.
How should it be held in the file?
Three ways, and the point is to choose one in writing.
As step (b), if the certificate says Part 123. If the certification body or the processor issues a statement, alongside the BAP certificate, that the product is processed in accordance with 21 CFR Part 123, that document, dated and in English, is the (b) certificate and the BAP certificate is its supporting evidence. Track the expiry.
As step (f), with the rationale written down. §123.12(a)(2)(ii)(F) allows "other such verification measures as appropriate that provide an equivalent level of assurance." A BAP certificate held together with a note explaining what Issue 5.1 or 6.0 requires of the plant's HACCP plan, and together with something that reaches the lot for the hazards the Guide names for that species, is a defensible (f). Without the written rationale it reads as a certificate that does not say what (b) asks for.
As a supplier-approval input, with a different step doing the regulatory work. Many importers already do this: the certificate decides who they buy from, and the plan and guarantee under (d), or testing under (e), is the affirmative step. This is the simplest to explain at an inspection.
Whichever it is, the file should say which. FDA's February 2026 letter to a Chicago importer found that its procedures did "not identify which affirmation step(s) you have chosen to implement." A BAP certificate in a folder with no note is exactly that finding waiting to be written.
What this piece does not say
It does not say BAP certification is inadequate, deceptive or declining; it does not evaluate GSA's audits; and it does not say any importer relying on BAP is or is not in compliance. Those are judgments this piece has no basis to make. It says what the regulation asks a certificate to certify, what the BAP standard says on its own pages, and what the refusal data measured. The GFSI status of Issue 6.0 matters to buyers whose specifications require a GFSI-benchmarked scheme; it does not bear on §123.12 either way.
Citations: 21 CFR 123.12(a)(2)(ii)(B), (E), (F). FDA, Questions and Answers on the HACCP Regulation for Fish and Fishery Products, X.E.2, X.F.1 to X.F.3. FDA Compliance Program 7303.844. Global Seafood Alliance, BAP Seafood Processing Standard, Issue 5.1, effective January 16, 2021, and the BAP standards page as of September 17, 2026. Southern Shrimp Alliance, August 2026 FDA antibiotic-contaminated shrimp import refusal report, September 4, 2026, and its account of the May 27, 2026 Senate letter. FDA warning letter to a Chicago importer, February 19, 2026. Nothing here is legal advice. Where this piece and a source differ, the source is right and we would like to know.