Quick answer: When importing spices and botanicals into Europe or North America, your supplier must operate under a documented HACCP plan — either as a standalone system or embedded within ISO 22000 or FSSC 22000. EU importers should additionally require pesticide residue and mycotoxin COAs tested to EC 396/2005 and EC 1881/2006 limits; US importers must confirm the supplier has a current FDA Food Facility Registration and written Foreign Supplier Verification Programme (FSVP) records. GFSI-benchmarked schemes (FSSC 22000, BRCGS) are the most widely accepted single credential for wholesale buyers.
Regulatory scrutiny on spices, herbs and botanical ingredients has intensified sharply across both the EU and North America over the past decade. Border rejection notices, FDA import alerts and EU Rapid Alert System for Food and Feed (RASFF) notifications show that the most frequent triggers are excess pesticide residues, aflatoxin contamination (particularly in nutmeg and chilli), Salmonella and undeclared allergens. For wholesale importers, roasters and manufacturers, the cost of a failed lot — detention fees, re-exportation, destroyed cargo, and damaged customer relationships — vastly exceeds the time invested in qualifying a supplier's food safety documentation up front.
This guide breaks down the key certifications and standards your supplier should hold, what each one actually means in practice, the contaminant limits that apply in your target market, and the documentation you should request before placing a first commercial order. Where relevant, Cakglo's own quality infrastructure is described so you can benchmark it against other origin suppliers.
The Seven Principles of HACCP — What They Mean for a Spice Supplier
Hazard Analysis and Critical Control Points (HACCP) is a systematic, science-based methodology mandated by EU Regulation 852/2004 and the US Food Safety Modernization Act (FSMA) for all food businesses, including origin processors. The seven principles are:
- Conduct a hazard analysis. The supplier identifies biological (Salmonella, E. coli, moulds), chemical (aflatoxins, pesticide residues, heavy metals) and physical (extraneous matter, metal fragments) hazards at each processing step.
- Determine Critical Control Points (CCPs). For dry spices this typically includes steam sterilisation or ethylene oxide-free decontamination, drying to target water activity (<0.70 aw to inhibit mould), and metal detection before sealing.
- Establish critical limits. For example, drying chamber temperature and duration sufficient to reduce Salmonella by 5-log.
- Establish monitoring procedures. Continuous or periodic measurement at each CCP.
- Establish corrective actions. Defined response when a CCP limit is exceeded — segregation, re-processing or destruction of the lot.
- Establish verification procedures. Routine microbiological swabs, finished-product testing, and internal audits.
- Establish record-keeping. Traceability from farm/collection point through processing to the shipped lot.
A supplier who can share their HACCP plan, CCP monitoring records and most recent internal audit is demonstrably more prepared than one who merely claims compliance. Always ask for the document, not just the statement.
ISO 22000, FSSC 22000 and GFSI Recognition — The Hierarchy Explained
ISO 22000:2018 is an international management system standard that integrates HACCP principles into a formal quality management framework (compatible with ISO 9001's Plan-Do-Check-Act structure). Certification is issued by accredited third-party bodies and requires an on-site audit. It covers interactive communication along the food chain, prerequisite programmes (PRPs) such as pest control, sanitation and allergen management, and HACCP-based hazard control.
FSSC 22000 (version 6) builds on ISO 22000 by adding sector-specific additional requirements published by the Foundation FSSC. Crucially, FSSC 22000 is benchmarked by the Global Food Safety Initiative (GFSI) — the coalition of major retailers and food manufacturers (Walmart, Carrefour, Nestlé, Unilever) who recognise GFSI-benchmarked schemes as equivalent for supplier qualification. Holding a current FSSC 22000 certificate typically satisfies the supplier quality requirements of most large European retail and food service buyers without the need for additional retailer-specific audits.
BRCGS Food Safety (Issue 9) is another GFSI-benchmarked scheme, widely demanded by UK and Northern European retailers. It places particular emphasis on site security, product authenticity and labelling accuracy — areas of growing concern for premium botanical ingredients subject to adulteration risk (e.g., saffron, vanilla, turmeric diluted with starch).
US Market Requirements: FSMA, FDA Registration and FSVP
For US importers, the Food Safety Modernization Act (FSMA) shifted food safety responsibility up the supply chain. The key obligations are:
- FDA Food Facility Registration (21 CFR Part 1, Subpart H): Any foreign facility that manufactures, processes, packs or holds food for US consumption must be registered with the FDA and renew every two years (odd-numbered years). An unregistered facility cannot legally export to the USA. Verify the registration number directly on the FDA's website.
- Preventive Controls for Human Food (21 CFR Part 117): Equivalent to HACCP — the foreign supplier must have a written Food Safety Plan covering hazard analysis, preventive controls, monitoring, corrective actions and supply-chain programme for any raw materials they themselves source.
- Foreign Supplier Verification Programme (FSVP) (21 CFR Part 1, Subpart L): The US importer (not the foreign supplier) is legally required to maintain an FSVP for each foreign supplier, documenting hazard analysis, supplier verification activities (onsite audits, testing, certificates), and annual review. This means you, as the importer, bear legal responsibility for your supplier's compliance — making thorough supplier qualification a regulatory, not just commercial, obligation.
- Voluntary Qualified Importer Programme (VQIP): Expedited review at the US border for importers who meet FDA's quality standards. Holding suppliers with GFSI-benchmarked certification significantly strengthens a VQIP application.
EU Import Compliance: Contaminant Limits, Pesticide MRLs and Phytosanitary Certificates
The EU operates some of the most stringent maximum residue levels (MRLs) for pesticides in the world. EU Regulation (EC) No 396/2005 sets MRLs for pesticides in herbs and spices; where no specific MRL is established the default limit is 0.01 mg/kg. EU Regulation (EC) No 1881/2006 (as amended) sets maximum levels for contaminants including:
- Aflatoxin B1: 5 µg/kg in spices and dried herbs; total aflatoxins (B1+B2+G1+G2): 10 µg/kg
- Ochratoxin A: 15 µg/kg in dried herbs and spices
- Lead: 0.1 mg/kg in herbs and spices (stricter limit applies to some botanical supplements)
- Cadmium: 0.2 mg/kg (1.0 mg/kg for dried mushrooms)
- Pyrrolizidine alkaloids (PA): 400 µg/kg in dried herbs and spices (Regulation (EU) 2020/2040)
Every commercial shipment of spices and botanicals entering the EU must be accompanied by a phytosanitary certificate issued by the Indonesian Plant Quarantine authority (BPSBTPH), confirming the consignment is free from regulated pests. Some commodity-specific EU Enhanced Monitoring programmes (e.g., for pepper, chilli, dried herbs from certain origins) require a mandatory Certificate of Analysis (COA) at the point of entry.
Certificate of Analysis: What a Credible COA Must Include
A COA is only as useful as the laboratory behind it. For spices and botanicals, a compliant COA should include:
- Accredited laboratory details: ISO/IEC 17025-accredited laboratory name, address and accreditation number
- Lot or batch number matching the shipping documents
- Test methods referenced (e.g., EN 15662 for pesticide residues, EN 12955 for ochratoxin, ISO 21527 for yeast and mould)
- Results for: total plate count (TPC), yeast and mould, Salmonella (absence in 25g), Escherichia coli, pesticide multi-residue screen (minimum 200+ compounds), and key mycotoxins (aflatoxins B1/B2/G1/G2, ochratoxin A)
- Heavy metals panel (Pb, Cd, As, Hg) if the ingredient is destined for supplement or nutraceutical use
- Water activity or moisture content
- Date of analysis and sample receipt date (results more than 12 months old should not be accepted for a new lot)
At Cakglo, representative samples of 250–500g per lot are offered before commercial orders are confirmed, typically dispatched within 5–7 business days of order confirmation. Samples are not free — a sample charge is invoiced and deducted from the first commercial order. This approach ensures the sample genuinely reflects the production lot rather than a selectively prepared showcase batch. Full lot-level COAs from third-party accredited laboratories accompany every commercial shipment. Learn more about our quality inspection and supplier survey services.
Certification Comparison: What to Require by Use Case
| Certification / Document | Issued by | GFSI recognised | Required for EU wholesale | Required for US import (FSMA) | Required for supplement / nutraceutical |
|---|---|---|---|---|---|
| HACCP plan (documented) | Internal (supplier) | Foundation only | Mandatory (Reg. 852/2004) | Mandatory (21 CFR Part 117) | Mandatory |
| ISO 22000:2018 | Accredited CB (e.g., SGS, Bureau Veritas) | No (not alone) | Strongly preferred | Supports FSVP verification | Strongly preferred |
| FSSC 22000 v6 | Accredited CB under FSSC scheme | Yes | Widely accepted | Accepted for FSVP audit substitute | Widely accepted |
| BRCGS Food Safety (Issue 9) | Accredited CB under BRCGS scheme | Yes | Required by UK/NL retailers | Accepted for FSVP audit substitute | Accepted |
| FDA Food Facility Registration | US FDA (self-registration) | N/A | Not required | Mandatory | Mandatory if selling to US |
| ISO/IEC 17025 COA (per lot) | Accredited laboratory | N/A | Required at border for enhanced monitoring | Required under FSVP | Mandatory (GMP compliance) |
| Phytosanitary certificate | National plant protection authority | N/A | Mandatory | Mandatory | Mandatory |
| Organic certificate (NOP / EU Bio) | Accredited certification body | N/A | Required for organic label claims | Required for USDA Organic claims | Required if claimed |
Incoterms, Pre-Shipment Inspection and Chain of Custody
Food safety compliance does not end at the factory gate. The choice of Incoterms 2020 determines at what point risk and responsibility transfer from seller to buyer. FOB (Free On Board) and CIF (Cost, Insurance and Freight) are most common in Indonesian commodity exports; under both terms, the buyer bears the risk of transit contamination and must ensure the vessel or container meets food-grade hygiene standards (particularly important for bulk coffee and spice shipments in big bags or supersacks).
An independent pre-shipment inspection (PSI) — conducted by a third-party inspector such as SGS, Intertek or Bureau Veritas at the origin warehouse — verifies that the shipped lot matches the contracted specification (grade, moisture, appearance, weight) and that packaging and container hygiene standards are met before the container is sealed. For buyers who cannot visit Indonesia in person, a PSI is one of the most cost-effective risk mitigation tools available. Cakglo supports independent PSI at all its export facilities as a standard part of its quality process; see our pre-shipment inspection and supplier survey services for details.
For Indonesian specialty and commercial coffee, lot traceability from the wet mill or dry mill to the export container is documented through the Indonesian Coffee Export Certificate (Surat Keterangan Asal) issued by the relevant trade ministry office. For vanilla and cacao, post-harvest handling and grading documentation forms part of the export file. For herbal and botanical ingredients including turmeric, moringa, ginger and jamu blends, the COA and phytosanitary certificate are the primary compliance instruments — and our full herbal product range is processed under documented PRPs aligned with HACCP principles.
Frequently asked questions
Is HACCP certification the same as ISO 22000 or FSSC 22000 certification?
No. HACCP is a set of seven food safety principles that a supplier implements internally — it is not a third-party certification scheme. ISO 22000 is an auditable international management system standard that formally embeds HACCP, and FSSC 22000 adds further sector requirements on top of ISO 22000. Only ISO 22000 and FSSC 22000 result in a certificate issued by an independent accredited certification body; a HACCP "certificate" from a non-accredited body carries little regulatory weight with EU or US buyers.
What contaminant tests should I always request in the COA for Indonesian spices?
At minimum, request a pesticide multi-residue screen (covering 200+ compounds), aflatoxins B1/B2/G1/G2 and ochratoxin A, Salmonella absence in 25g, total aerobic plate count, yeast and mould count, and moisture or water activity. For turmeric, curcumin content and heavy metals (lead, cadmium, arsenic, mercury) are additionally important given the supplement market's stricter limits. All tests should be performed by an ISO/IEC 17025-accredited laboratory and the report should reference the specific EN or ISO test method used.
As a US importer, am I legally responsible even if my Indonesian supplier has all the right certifications?
Yes. Under FSMA's Foreign Supplier Verification Programme (FSVP) regulation (21 CFR Part 1, Subpart L), the US importer is legally the responsible party and must maintain written FSVP records — including a hazard analysis for each foreign supplier, records of verification activities (COAs, audit reports), and an annual FSVP review. A supplier's FSSC 22000 or BRCGS certificate can be used as evidence to satisfy the onsite audit requirement, but it does not transfer the importer's FSVP obligation. You must still document that you evaluated and accepted the evidence.
Conclusion
Food safety certification is not a formality — it is the commercially and legally rational baseline for any importer sourcing spices, botanicals, coffee or herbal ingredients from a third-country origin supplier. HACCP is the foundation; ISO 22000 and FSSC 22000 are the internationally recognised structures built on it; and FSMA FSVP places direct legal accountability on the US importer regardless of what certifications the supplier holds. Cakglo's origin facilities operate under documented HACCP-aligned prerequisite programmes, and we routinely facilitate independent pre-shipment inspection, issue lot-level COAs, and support buyers with the supplier documentation needed for their own FSVP or EU food business compliance files. To discuss your specific import documentation requirements or to request representative samples of our herbal and botanical range, vanilla and cacao, or specialty and commercial coffee, please reach out via our contact page.