21 CFR 123.12(a)(2)(ii) gives a US seafood importer six ways to verify that the fish and fishery products it imports were processed under HACCP conditions equivalent to Part 123. Choose at least one per product, per processor. The regulation ranks none of them. The differences that matter are operational: what you have to collect, how often, and what breaks.
(a) Obtain the processor's HACCP and sanitation monitoring records for the lot
What you hold: monitoring records for the specific lot — the CCP records, the sanitation monitoring, per shipment.
Cadence: every shipment.
What it costs: the highest ongoing effort of the six, and it scales linearly with entry lines. It also asks a foreign processor to send you its internal records repeatedly, which is a relationship question as much as a compliance one.
Why anyone picks it: it is the most direct evidence there is. If you are importing a small number of high-risk lots from one plant, this is defensible and cheap in absolute terms.
Where it fails: records arrive incomplete, unsigned, undated, or in the wrong language. §123.9(a) requires records to be signed and dated at the time of the activity; a record signed later, in a batch, is a different kind of problem.
(b) A continuing or lot-by-lot certificate from a foreign government authority or a competent third party
What you hold: the certificate, and its expiry.
Cadence: continuing certificates renew; lot-by-lot arrive per shipment.
What it costs: low, once established. Expiry tracking is the whole job.
The catch worth knowing: FDA maintains lists of foreign government authorities whose approved-processor lists it recognizes for this purpose. That recognition is narrow — it does not extend to every national competent authority, and an importer relying on a certificate from an authority FDA does not recognize under this program is relying on step (f), not step (b), and should document it that way. Check the current list before you rely on it; the recognition arrangements change.
Where it fails: an expired certificate is the single most common paperwork failure in this whole area, and it fails silently.
(c) Regularly inspect the processor's facility
What you hold: visit reports, dated, describing what was examined.
Cadence: FDA's suggested cadence is annual.
What it costs: the highest per-supplier cost of the six, and it does not scale past a handful of plants. Travel to a shrimp plant in the Mekong Delta is a real budget line.
Why anyone picks it: for a strategic supplier you already visit commercially, the marginal cost is a form. If your buyers are on the ground anyway, this is close to free — but only if someone writes the report.
Where it fails: the visit happens and the report does not get written, or gets written as a commercial trip note that says nothing about HACCP.
(d) An English copy of the processor's HACCP plan plus a written guarantee
What you hold: the plan, the guarantee, both renewed annually.
Cadence: annual.
What it costs: lowest paperwork volume of the six, which is why it is the most chosen — and the most written up. FDA's inspection program treats the step as inadequate where the plan you are holding does not address a significant hazard the Hazards and Controls Guidance (Fourth Edition, June 2022) identifies for that species and process. Holding the plan is not the work; reading it against the Guide is.
Where it fails: see the separate piece on this. It is the single largest source of importer findings in this area.
(e) Periodically test the product plus a written guarantee
What you hold: test results on a stated cadence, plus the guarantee.
Cadence: FDA's suggested pattern is testing the first three entries from a new processor, then quarterly.
What it costs: lab fees, plus the discipline of a written sampling plan. Real money per test, predictable.
Why anyone picks it: it produces objective evidence about the product you actually received, which is the only step that does. For antibiotic residue in farmed shrimp it is the step that maps most directly to the hazard.
Where it fails: the cadence slips, or the test panel does not cover the hazard the Guide identifies. Testing for chloramphenicol does not verify a histamine control.
(f) Other appropriate verification measures
What you hold: the measure, described in writing, plus its evidence.
What it costs: depends entirely. The cost that catches people out is the written rationale — (f) is the only step where you must explain why what you are doing provides an equivalent level of assurance. Without that rationale written down, (f) reads as "we did something."
Why anyone picks it: it is where a real supplier-management program lives — a third-party audit scheme plus your own testing plus a plan review is a perfectly good (f), and better than any single named step. It just has to be described.
Three things that apply whichever you pick
The trained individual. §123.10 requires a trained individual to develop the HACCP plan and perform certain review functions — and it says expressly that this person need not be an employee of the firm. Importers without in-house seafood expertise routinely engage one.
The records rule. §123.9: in English, signed and dated at the time of the activity, available for official review and copying at reasonable times, kept one year for refrigerated product and two for frozen, preserved or shelf-stable. Electronic records are permitted under §123.9(f) with appropriate controls.
"Importer" means something specific. §123.3 defines the importer as the US owner or consignee at the time of entry — which is not necessarily the customs importer of record. If you own the fish when it lands, this is your obligation even if a broker's name is on the entry.
Citations: 21 CFR 123.3, 123.9, 123.10, 123.12. FDA, Fish and Fishery Products Hazards and Controls Guidance, Fourth Edition, June 2022. Cadences described as "suggested" are FDA's guidance, not regulatory minimums. Nothing here is legal advice.