Commercial Kitchen, Ghost Kitchen, and Health Department Permit Diligence in Restaurant M&A

FDA Food Code 2022 Framework: State and Local Adoption, and the Food Service Establishment Permit

The FDA Food Code is a model document published by the U.S. Food and Drug Administration that provides a uniform scientific and regulatory framework for food safety in retail food establishments, including restaurants, food service operations, and institutional food service facilities. The 2022 edition, published in 2023, represents the most current version of the model code and incorporates updated provisions on HACCP plan requirements, allergen management, temperature control for safety, and personnel health policies. The Food Code is not itself a federal regulation and has no direct legal force. It becomes binding only when a state or local government adopts it as law through the applicable legislative or rulemaking process.

State adoption of the FDA Food Code varies in timing and version. As of 2026, most states have adopted a version of the Food Code ranging from the 2009 to the 2017 edition, with adoption of the 2022 version still in early stages in most jurisdictions. States that have adopted an earlier version of the Food Code may have regulations that differ from the 2022 model in areas such as allergen labeling, HACCP scope, and certified food protection manager requirements. Local health departments further modify and supplement state food codes through local ordinances and regulations, creating a layered regulatory environment in which the applicable standard for any given establishment depends on the interaction between the state food code, local health department rules, and any establishment-specific permit conditions.

The food service establishment permit is the foundational document that authorizes a specific entity to operate a food service business at a specific location. The permit is issued by the local health department or, in some states, by a state-level agency with delegated local authority, and it is specific to the owner, the location, and the type of food service operation approved at that location. The permit type approved for a given location reflects the scope of food preparation and service activities that the health department has reviewed and approved: a full-service restaurant permit authorizes a different scope of operations than a limited-service permit, and neither authorizes the holder to expand into activities that were not part of the approved permit scope without a plan review and permit modification.

In almost every jurisdiction, the food service establishment permit is non-transferable in the conventional sense. It is issued to the permit holder, who is the legal entity or individual who applied for and received the permit, and it does not convey automatically to a new owner when the business changes hands. The consequence for M&A transactions is that a change of ownership of a restaurant or food service business is a trigger event that the local health department must be notified of and that typically requires the new owner to apply for a new permit or to have the existing permit re-issued in the new owner's name before operations can legally continue under the buyer's ownership. A buyer who closes a restaurant acquisition without addressing the health permit transfer is operating under a permit held by the seller, which is an unauthorized use of the permit and a potential basis for enforcement action by the health department.

The practical effect of permit non-transferability on deal structure is significant. The buyer must initiate the permit transfer or re-issuance process before or immediately upon closing, must understand the health department's processing timeline for the applicable jurisdiction, and must build a bridge between closing and the date the new permit is issued. In many jurisdictions, this bridge takes the form of a conditional approval that allows operations to continue under specified conditions while the full permit review is completed. Understanding the conditions that the health department will impose during the conditional approval period, and ensuring that the acquired business can satisfy those conditions from day one of the buyer's ownership, is a pre-close task that cannot be delegated to post-close administration.

Food Service Establishment Categories: Full-Service, Limited-Service, Commissary, Shared Kitchen, Ghost Kitchen, and Mobile Food Unit

Health department permitting distinguishes between different types of food service establishments based on the scope of food preparation, the risk level associated with the foods prepared, and the physical configuration of the facility. These categories determine not only the type of permit issued but also the inspection frequency, the plan review requirements for any modifications, and the standards applied to assess compliance. A buyer acquiring a food service business must understand the permit category under which the target operates, because the category governs the applicable regulatory standards and affects how the permit can be transferred or re-issued in connection with a change of ownership.

Full-service restaurants hold the broadest category of food service establishment permit. They are authorized to prepare a full menu from raw ingredients, serve alcohol where licensed to do so, provide table service, and engage in all cooking processes including those that involve raw animal foods, high-risk temperature control for safety items, and complex multi-step preparation. Full-service restaurant permits require a comprehensive plan review before issuance and are subject to routine inspection at frequencies that vary by jurisdiction but typically range from one to four times per year based on the establishment's risk category. Limited-service establishments, including quick-service restaurants, cafes, and food kiosks, operate under a narrower permit that reflects a more limited scope of food preparation. Many limited-service permits restrict the types of food that can be prepared on-site and require that high-risk processes be conducted elsewhere and brought in as pre-prepared items.

Commissary kitchens are permitted food preparation facilities that supply food to other establishments, food trucks, or other food service operations. A commissary permit authorizes the preparation, storage, and distribution of food to authorized users who are covered by the commissary's permit or who hold their own permits and use the commissary for supplemental production. Shared kitchens are multi-tenant facilities that hold a commissary or shared kitchen permit and allow individual operators to use the kitchen space for their food preparation activities under an arrangement with the facility operator. The key question in shared kitchen permitting is whether each tenant operator must hold an independent food service establishment permit, must be listed as an authorized user under the facility's permit, or can operate under the facility's permit through a sub-permit or commissary agreement that the health department has formally recognized.

Ghost kitchens are facilities that produce food exclusively for delivery, with no dine-in service, and that may house multiple distinct brands or virtual restaurant concepts within a single physical kitchen space. The ghost kitchen category does not exist as a distinct permit type in most jurisdictions; ghost kitchen facilities are typically permitted as commissary kitchens, shared kitchens, or full-service food service establishments depending on the jurisdiction's classification approach and the specific operations conducted at the facility. Mobile food units, including food trucks and push carts, are permitted under a distinct category that involves both the unit's operational permit and, in most jurisdictions, a commissary agreement with a fixed permitted facility that provides food storage, preparation, and cleaning support for the mobile unit.

For M&A purposes, the permit category of the target establishment determines the scope of the regulatory framework applicable to the transaction. An acquisition of a ghost kitchen brand that operates out of a shared kitchen facility under a commissary agreement requires different diligence than an acquisition of a full-service restaurant chain. The ghost kitchen brand may have no independent health permit of its own, and its authorization to operate may rest entirely on the commissary agreement with the facility operator. If that agreement is not assignable or if the facility operator does not consent to the assignment, the buyer has acquired a brand without the operational authorization needed to produce food at the facility. This is a structurally different risk profile from the non-transferability of a full-service restaurant permit, and it requires different diligence, different contractual protections, and different pre-close coordination with the facility operator.

Ghost Kitchen Facility Models: CloudKitchens, Kitchen United, and Reef - Permit on Facility vs. Individual Operator

The three dominant ghost kitchen facility models, CloudKitchens, Kitchen United, and Reef, each present a distinct permitting structure that a buyer must understand before acquiring a brand that operates within one of those facilities. The structural distinction that matters most in the M&A context is whether the brand operator holds an independent food service establishment permit for its operations at the facility, or whether the operator's authorization to produce food at the facility derives from the facility operator's permit rather than the brand operator's own permit. The answer to this question determines what happens to the brand's authorization to operate when the brand is acquired.

CloudKitchens, the largest network of ghost kitchen facilities in the United States, operates individual kitchen pods within a shared facility. In most CloudKitchens markets, each kitchen pod is permitted as a separate food service establishment, with the individual brand operator holding its own food service establishment permit for its designated pod space. This structure provides brand operators with independent regulatory standing: the brand's permit is its own, and a change of ownership of the brand triggers the standard permit transfer or re-issuance process applicable to any food service establishment in that jurisdiction. The buyer must address the permit transfer with the local health department, but the brand's authorization to operate at the facility does not depend on the facility operator's consent or on the terms of the facility use agreement beyond any assignability provisions.

Kitchen United uses a different model in some markets, with the facility holding the food service establishment permit and individual brand operators receiving authorization to operate under a sub-permit, commissary letter, or license agreement with the facility. In this structure, the brand operator's authorization to produce food is contingent on both the facility's permit and the facility operator's agreement to include the brand operator as an authorized user. A change of ownership of the brand operator triggers not only the standard health department notification but also a review by the facility operator of whether the new owner is acceptable under the terms of the facility use agreement. If the facility use agreement is not assignable to the buyer, the buyer's post-close authorization to operate at the facility depends on negotiating a new agreement with Kitchen United before or promptly after closing.

Reef Technology operates ghost kitchen facilities primarily from parking structures and uses a combination of fixed commissary kitchens and mobile food production units. The Reef model introduces mobile food unit permitting requirements in addition to or instead of fixed kitchen permitting, because the food preparation may occur in a permitted mobile unit that is parked at a fixed location under an agreement with the property owner. Mobile food unit permits are jurisdiction-specific and are typically renewed annually, and the permit holder is the operator of the mobile unit rather than the brand whose food is being produced. A brand that contracts with Reef for production capacity may have no direct permitting relationship with the local health department at all, relying entirely on Reef's mobile unit permits to authorize the production of its food.

For each ghost kitchen facility model, diligence must establish three facts before closing. First, whether the brand operator holds an independent food service establishment permit for its operations at the facility or relies on the facility's permit for its authorization. Second, whether the brand's facility use agreement is assignable to the buyer and on what terms. Third, what the applicable health department requires when the brand operator changes ownership, regardless of whether the brand holds its own permit or operates under the facility's permit. The answers to these three questions determine the pre-close and post-close permitting steps required and whether the buyer can operate the brand at the facility from day one of its ownership or faces a permitting gap that must be managed through interim arrangements.

Shared Kitchen Permitting Issues: Virtual Brands Under Commissary Permits and Multi-Brand Compliance

Shared kitchen facilities that host multiple virtual brands under a single commissary permit present a distinctive compliance structure that is not well addressed by most standard food service permitting frameworks. The commissary permit authorizes the facility to prepare, store, and distribute food to specified authorized users, but the permit does not automatically contemplate or authorize the simultaneous production of multiple distinct brands with different menus, allergen profiles, and preparation processes. When a single shared kitchen facility houses five or ten different virtual restaurant brands, each with its own menu and customer base, the facility's commissary permit must be adequate to cover all of those operations, and the facility operator must have systems in place to manage the compliance obligations that arise from multi-brand operations.

The first compliance issue in multi-brand shared kitchen operations is the scope of the commissary permit. A commissary permit issued to cover the production of a single brand's menu items may not authorize the facility to produce a materially different menu under a different brand using different ingredients and preparation processes. When a new virtual brand is added to a shared kitchen facility, the facility operator should confirm with the local health department whether the existing permit scope covers the new brand's operations or whether a permit modification or plan review is required. A facility that has added multiple brands over time without seeking permit modifications may be operating some of those brands outside the approved scope of its permit.

The second compliance issue is allergen cross-contamination management in a multi-brand shared kitchen. When multiple brands are producing different menus using different allergen profiles in a shared space, the facility must have written procedures for preventing allergen cross-contact between brands. These procedures must address equipment cleaning and sanitizing between uses by different brands, dedicated storage for allergen-containing ingredients, labeling of allergen-containing items in shared storage areas, and employee training on cross-contact prevention for the specific allergen profiles of each brand in the facility. A shared kitchen that lacks documented allergen cross-contact prevention procedures for multi-brand operations is both a compliance risk and a tort liability risk, because an allergen cross-contact incident that injures a customer of one brand may have originated in the production process of a different brand at the same facility.

The third compliance issue is the authorized user documentation that the commissary permit requires. Most commissaries are required to maintain a list of authorized users covered by the commissary permit, and each authorized user must be listed in the commissary's permit or in an approved commissary agreement that the health department has reviewed. When an authorized user changes ownership, the health department may require an updated commissary agreement reflecting the new owner's identity. A buyer acquiring a virtual brand should confirm whether the commissary agreement covering the brand's operations at the shared kitchen facility identifies the brand operator by entity name, and if so, whether the agreement must be updated or reissued in the buyer's name after closing.

For M&A purposes, multi-brand shared kitchen compliance requires diligence at both the facility level and the individual brand level. At the facility level, the buyer should confirm that the commissary permit covers all of the brand's production activities at the facility, that the permit scope is adequate for the menu items and preparation processes used by the brand, and that the facility operator has documented procedures for the allergen management and food safety compliance issues arising from multi-brand operations. At the individual brand level, the buyer should confirm that the brand's authorization to operate at the facility is formally documented in a commissary agreement or sub-permit that is current, assignable, and consistent with the brand's actual operations.

HACCP Plan Requirements for High-Risk Foods: Seafood, Juice, Raw Animal Foods, and Complex Preparation Processes

Hazard Analysis and Critical Control Point plans are formal food safety management systems that identify biological, chemical, and physical hazards in a food production process, establish critical control points where those hazards can be controlled, set critical limits for each control point, and require monitoring, corrective action, verification, and recordkeeping procedures to ensure that the control points are functioning as intended. HACCP plans are required by federal regulation for seafood processors under 21 CFR Part 123 and for juice processors under 21 CFR Part 120. They are required or strongly recommended for food service establishments under the FDA Food Code 2022 when certain high-risk food processes are used, and many state and local health departments have implemented mandatory HACCP plan requirements for specific categories of high-risk food service operations.

FDA Food Code 2022 Section 8-201.13 requires that food service establishments submit a HACCP plan for health department approval when they engage in specialized food processes including smoking food as a method of preservation rather than for flavor, curing food using salt or acid, using reduced oxygen packaging, operating a molluscan shellfish life support system display tank, custom processing of animals slaughtered on the premises, and certain other high-risk processes specified in the Food Code. These processes are identified as high-risk because they involve methods of food preservation or preparation that, if improperly controlled, create a significantly elevated risk of pathogen growth and foodborne illness. A food service establishment that engages in any of these processes without a submitted and approved HACCP plan is in violation of the Food Code and is subject to enforcement action by the health department.

For seafood, HACCP requirements apply not only at the federal processor level under 21 CFR Part 123 but also at the food service level for certain high-risk preparations. Retail food service establishments that serve raw or undercooked molluscan shellfish, including raw oysters, clams, and mussels, must comply with requirements for sourcing shellfish only from approved sources, maintaining shellfish tags for a specified retention period, and following temperature control and handling requirements designed to minimize the risk of Vibrio and other shellfish-associated pathogens. Establishments offering raw or undercooked seafood are required to provide consumer advisories informing guests of the associated risks, and failure to provide the required advisory is a health code violation.

Raw animal foods served undercooked, including beef, poultry, pork, and eggs, require consumer advisories and must be sourced from approved suppliers. Establishments that offer undercooked animal foods must be able to document the source of those products and must maintain temperature logs and cooking process records as part of their food safety management system. In a restaurant acquisition, the health department may review the establishment's consumer advisory compliance and raw animal food sourcing documentation as part of the change-of-ownership inspection, and any deficiencies identified during that inspection must be corrected before the new permit is issued.

In the M&A context, HACCP plan diligence requires identifying every high-risk process conducted at the target establishment, confirming that a written HACCP plan exists and has been submitted to and approved by the health department for each process, and reviewing the plan's critical control points, critical limits, and monitoring records for the preceding two to three years. A HACCP plan that exists on paper but that is not followed in practice, as evidenced by monitoring records that are incomplete, irregular, or systematically outside the critical limits without documented corrective action, is not a functional food safety management system. The buyer should receive a representation that all required HACCP plans are current, have been approved by the applicable health department, and are being actively followed with the monitoring and corrective action records required by the plan.

Allergen Management, Big 9 Disclosure Requirements, and Preventive Controls Qualified Individual Training

Food allergen management is a distinct compliance dimension from general food safety, and it is one that creates both regulatory exposure and material tort liability in a restaurant or food service M&A transaction. The Food Allergy Safety, Treatment, Education, and Research Act, known as FASTER, expanded the list of major food allergens recognized under federal law from eight to nine by adding sesame as a major allergen, effective January 1, 2023. The Big 9 allergens are now milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame. FDA regulations under 21 CFR Part 117 require that food manufacturing facilities conduct hazard analysis for allergen hazards and implement preventive controls to manage allergen cross-contact in the food production process.

For retail food service establishments regulated under state and local health codes rather than federal FDA manufacturing regulations, allergen disclosure requirements are governed primarily by the applicable state food code provisions and, in some states, by separate food allergen awareness statutes. Massachusetts, for example, has one of the most comprehensive food allergen awareness laws in the country, requiring food service establishments to designate an allergen awareness contact person, post allergen information in the kitchen, and provide staff training on allergen management. Other states have adopted similar requirements based on the Massachusetts model. The FDA Food Code 2022 includes provisions on allergen cross-contact prevention and employee knowledge requirements that apply in jurisdictions that have adopted the 2022 code.

For food manufacturing facilities and commissary kitchens that are subject to the FDA's Preventive Controls for Human Food rule under 21 CFR Part 117, allergen management must be addressed through a written Food Safety Plan that includes a hazard analysis covering allergen cross-contact and intentional allergen introduction, preventive controls for identified allergen hazards, monitoring procedures, corrective action procedures, and verification activities. The Food Safety Plan must be prepared, implemented, and reviewed by a Preventive Controls Qualified Individual, defined in the regulation as a person who has successfully completed training that meets specified competency standards or who is otherwise qualified through job experience to develop and apply a food safety system. The PCQI requirement is separate from and in addition to the Certified Food Protection Manager requirement, and it applies to facilities subject to the FDA's Preventive Controls rule rather than solely to retail food service establishments.

Ghost kitchen facilities that function as food manufacturers for third-party delivery, rather than as retail food service establishments serving identified customers directly, may be subject to the FDA's Preventive Controls rule in addition to or instead of the retail food service permitting framework. A ghost kitchen that produces packaged food items for sale through third-party delivery platforms, with those items labeled and sold to end consumers, may be classified as a food manufacturing facility rather than a food service establishment, triggering different regulatory requirements including facility registration with the FDA, compliance with the Preventive Controls rule, and PCQI designation.

In an M&A transaction involving a food service business that serves a significant volume of customers with food allergy concerns, the allergen management compliance record is a material diligence item. The buyer should review the target's written allergen management procedures, confirm whether those procedures address the Big 9 allergens including sesame, review any customer complaints or incident reports related to allergen reactions or cross-contact, and confirm whether any state food allergen awareness training or designation requirements applicable to the target's jurisdiction have been satisfied. A prior allergen-related incident that resulted in customer harm creates both tort liability exposure and regulatory exposure, and should be addressed through specific representations, disclosure schedules, and special indemnification rather than general compliance representations.

Health Permit Transferability: Non-Transferable Rule, Application Timing, and 10-Day to 90-Day Processing Windows

The non-transferability of food service establishment permits is the foundational principle of health permitting in the M&A context, and understanding its practical implications requires analysis of three distinct questions: what triggers the transfer requirement, what the applicable jurisdiction requires from the new owner, and how long the processing period takes from submission of a complete application to issuance of the new permit. The answer to each question varies by jurisdiction, and a multi-location restaurant acquisition requires this analysis to be conducted independently for every location.

The transfer trigger is typically a change of the legal entity that holds the permit, a change in majority ownership of that entity, or a change in the trade name or operating concept under which the establishment operates. An asset acquisition, in which the buyer acquires the restaurant's assets rather than the equity of the operating entity, almost universally triggers the transfer requirement because the permit holder changes. An equity acquisition, in which the buyer acquires the equity of the operating entity without changing the entity's identity, may or may not trigger the transfer requirement depending on whether the jurisdiction defines a change of control of the permit-holding entity as a transfer event. Buyers who structure restaurant acquisitions as equity deals to avoid the permit transfer process should confirm with the applicable health department whether a change of control in the permitted entity constitutes a change of ownership for permitting purposes, because in many jurisdictions the answer is yes.

The procedural requirements for permit transfer or re-issuance vary significantly by jurisdiction. At the low-complexity end, some jurisdictions require only a change-of-ownership notification accompanied by proof of the transaction, a new permit fee, and updated contact information, with the new permit issued within 10 to 14 business days following submission of a complete notification. At the high-complexity end, some jurisdictions treat a change of ownership as equivalent to a new establishment application, requiring a full plan review of the existing facility, a pre-opening inspection, and confirmation that the facility meets all current food code requirements before the new permit is issued. In these jurisdictions, the processing timeline from submission to permit issuance can range from 60 to 90 days for a straightforward application and longer if plan review issues are identified.

For multi-location acquisitions, the longest single-jurisdiction processing timeline determines the minimum period for which interim operating arrangements must be structured. If the acquisition includes locations in jurisdictions with 60 to 90-day processing timelines, those locations may be operating under interim arrangements, such as a conditional approval or a transition services agreement with the seller, for up to three months post-close. The costs and operational constraints associated with those interim arrangements must be factored into the transaction economics, and the purchase agreement must clearly allocate the obligations and risks associated with operations during the interim period.

Pre-close application filing, where the applicable jurisdiction permits it, is the most effective way to reduce the permitting gap in a restaurant acquisition. Some jurisdictions allow the buyer to submit a permit application or a conditional permit application before closing, so that the new permit can be issued at or shortly after the closing date. Other jurisdictions require proof of ownership before accepting a permit application, making pre-close filing procedurally unavailable. Where pre-close filing is available, buyers should take advantage of it by submitting the application as early in the due diligence period as the jurisdiction allows, ensuring that any plan review or inspection can be completed before the closing date.

Plan Review for Renovation and Equipment Changes: Health Department Approval and Building Department Coordination

Plan review is the process by which a health department reviews proposed construction, renovation, or equipment changes to a food service establishment to ensure that the modified facility will comply with the applicable food code requirements. Plan review is required before work begins, and operating a food service establishment with unapproved renovations or equipment changes is a health code violation regardless of whether the actual work was otherwise compliant. In the M&A context, plan review issues arise in two distinct scenarios: when the existing facility contains modifications that were made without health department approval during the seller's ownership, and when the buyer intends to make modifications after closing that will require a new plan review.

Unapproved modifications to a food service establishment are a common finding in restaurant acquisitions, particularly in businesses where the operator has incrementally added equipment, modified kitchen layouts, or changed preparation processes over time without consistently engaging the health department for approval. A health department inspection triggered by a change of ownership may identify these modifications, and the inspector may require corrective action, approval of the existing modifications, or removal and replacement of unapproved elements before the new permit is issued. Buyers should inquire specifically about any renovations, equipment additions, or process changes made by the seller during the preceding three to five years, and should confirm whether those changes were submitted for and received health department approval.

For buyer-initiated post-close modifications, the plan review requirement attaches when the proposed changes cross the applicable threshold of significance under the jurisdiction's rules. Minor equipment substitutions that involve replacing existing equipment with comparable equipment of the same type and capacity may require only a specification review or an informal notification to the health department. Modifications that involve new equipment categories, changes to the kitchen layout, addition of new cooking processes, expansion of the facility, or changes to ventilation or plumbing require a formal plan review submission with scaled drawings, equipment specifications, and a description of the proposed changes. The health department may also require a pre-opening inspection after the approved modifications are completed before authorizing resumed operations.

Building department coordination is required for modifications that involve structural work, electrical upgrades, plumbing changes, or HVAC modifications, because those changes require building permits in addition to health department plan review approval. The building permit process and the health department plan review process are independent, and approval by one agency does not constitute approval by the other. A buyer who receives building permit approval for a kitchen renovation must still submit the renovation plans for health department review, and the health department may have requirements that differ from or conflict with the building department's approval. Coordinating the building permit and health department plan review processes simultaneously, rather than sequentially, reduces the timeline and minimizes the risk of conflict between agency requirements.

For acquisitions where the buyer intends significant post-close modifications, the plan review timeline should be a factor in the closing timeline and in the purchase agreement's conditions. If the buyer's operational plan depends on completing kitchen renovations before reopening, and the health department's plan review timeline is 60 days, the buyer must factor that 60-day period into the operational schedule and must confirm that the facility can operate in its current configuration during the renovation planning period. The purchase agreement should include representations that the current facility configuration, including all equipment, layout, and preparation processes, has been approved by the applicable health department and that no outstanding health department orders require modifications to the facility before the new permit can be issued.

Employee Food Handler Cards and CFPM Credentials: ANSI-Accredited Certification Requirements and Post-Close Continuity

Food handler training and certification requirements for food service employees operate at two distinct levels in most jurisdictions. The first level is the individual food handler card or food worker card, which is a basic food safety training credential required of all employees who handle food or food-contact surfaces in a food service establishment. The second level is the Certified Food Protection Manager credential, which requires more advanced training and a proctored examination from an ANSI-accredited certification organization, and which the FDA Food Code 2022 requires at least one person in charge at each food service establishment to hold.

Food handler card requirements vary significantly by state and locality. Some states require all food service employees to obtain a food handler card before beginning work or within a defined period after starting employment, typically 30 to 60 days. Others require food handler training but leave the specific training program and documentation requirements to the employer. California, Washington, and Oregon are among the states with mandatory statewide food handler card requirements. Texas requires food handler certification through an accredited program for all food service employees in most jurisdictions. New York City and other large municipalities have adopted their own food handler training requirements that supplement or differ from state requirements. In a multi-state restaurant acquisition, the buyer must map the food handler card requirements of every jurisdiction of operation and confirm that the target's employees are in compliance.

The CFPM requirement under FDA Food Code 2022 Section 2-102.12 requires that at least one person in charge of a food service establishment hold a current CFPM credential from an ANSI-accredited certification organization. The recognized ANSI-accredited CFPM certification programs include ServSafe (administered by the National Restaurant Association Educational Foundation), the National Registry of Food Safety Professionals' Certified Professional Food Manager certification, Prometric's Food Protection Manager certification, and several other accredited programs. Each of these credentials requires completion of a training course and passage of a proctored written examination. The credentials are valid for five years from the date of issuance and must be renewed through examination before expiration.

Post-close CFPM continuity is a key-person issue in any restaurant acquisition where the seller's CFPM is the owner-operator who is departing at closing. If no other employee at the location holds a current CFPM credential, the buyer will be out of compliance with the CFPM requirement from the moment the prior CFPM departs. Health department inspections are the primary mechanism for detecting CFPM deficiencies, and an inspection that occurs shortly after closing is a foreseeable scenario in jurisdictions where a change of ownership triggers a change-of-ownership inspection. A buyer cited for failing to have a CFPM during a change-of-ownership inspection is in a legally and commercially uncomfortable position that is entirely avoidable with pre-close planning.

Buyers should address CFPM continuity in the purchase agreement by including a representation that at least one person in charge at each location holds a current ANSI-accredited CFPM credential, by identifying the CFPM designee at each location in the disclosure schedules, by confirming whether each CFPM designee will remain employed post-close, and if not, by beginning the process of enrolling a replacement in an ANSI-accredited CFPM training program before closing. If the CFPM examination cannot be completed before closing, the buyer should require as a closing condition that the departing CFPM designee remain available to the business in an advisory capacity until a replacement CFPM has been certified and designated, and should structure any retention agreement accordingly.

Inspection History Diligence: Violation Scores, Critical vs. Non-Critical Violations, and Closure History

Inspection history is the most publicly accessible indicator of a food service establishment's compliance culture and operational food safety standards. Most local health departments maintain publicly searchable inspection databases that disclose inspection dates, scores or letter grades, violation descriptions by category, and closure or corrective action history. These databases are a standard starting point for food service M&A diligence and are valuable precisely because they provide an unmediated record of the establishment's compliance history that does not depend on the seller's disclosure.

Health department inspections categorize violations as critical or non-critical, sometimes also called priority or non-priority violations in the FDA Food Code terminology. Critical violations are those that directly create a risk of foodborne illness and include improper temperature control for potentially hazardous foods, inadequate cooking temperatures for raw animal products, contamination of ready-to-eat food by raw animal products, presence of pest activity or evidence of pest intrusion, lack of proper handwashing facilities or employee hygiene, and unapproved food sources. Non-critical violations address facility maintenance, equipment condition, documentation, and other issues that do not directly create an immediate foodborne illness risk but that indicate operational deficiencies requiring correction.

The pattern of violations across multiple inspection cycles is more informative than any single inspection result. An establishment that consistently receives critical violations in temperature control across three or four consecutive inspections has a systemic problem with food temperature management that is not being corrected between inspections. An establishment that has received the same critical violation multiple times without correction is a higher risk acquisition than one that receives isolated violations and corrects them promptly. Health departments escalate persistent critical violations through re-inspection, warning letters, conditional permits, and ultimately permit suspension or revocation proceedings, so a pattern of uncorrected critical violations is a predictive indicator of future enforcement action.

Closure history is among the most significant data points in inspection history diligence. A closure ordered by the health department indicates that the health department found conditions during an inspection severe enough to require immediate cessation of operations. Common grounds for closure include active pest infestation, no running hot or cold water, sewage backup or plumbing failure, no refrigeration capability for potentially hazardous foods, or imminent health hazard conditions. Each of these conditions represents a significant food safety failure, and a prior closure indicates that the establishment has, at some point, been operated in a condition that the health department considered unsafe for food service operations.

Buyers should conduct a comprehensive inspection history review covering a minimum of three years of inspection reports for every location in the acquisition. The review should categorize all violations by type, identify any repeated violations, note any closure events and the grounds for each closure, confirm that all closures were followed by re-inspection and reinstatement, and assess whether the overall inspection history reflects a pattern of improving compliance or a persistent pattern of deficiency. The results of this review should inform both the purchase price negotiation and the representations and warranties framework. A location with a problematic inspection history should be addressed through specific representations about the remediation of identified violations, closing conditions requiring confirmation of current compliance, and indemnification protection for any enforcement action initiated post-close based on pre-close conditions.

Ghost Kitchen Commissary-Specific Issues: Pre-Cooked vs. Fresh-Prep Operations and Co-Packing Compliance

Ghost kitchen operations that function as commissary kitchens present compliance issues that are distinct from those applicable to retail food service establishments serving direct-to-consumer meals. The commissary ghost kitchen model involves producing food in a central facility for distribution to other locations, for storage and reheating at remote preparation sites, or for direct delivery to consumers through third-party delivery platforms. Each of these distribution models has different regulatory implications, and the applicable regulatory framework depends on whether the food is produced and sold as a finished consumer product, as an intermediate product for further preparation, or as a meal prepared for immediate consumption.

Pre-cooked food production at a ghost kitchen facility, where food is fully cooked at the commissary and then reheated at remote locations or delivered for consumer reheating, is subject to the temperature control for safety requirements of the applicable food code as well as the transport and storage requirements governing potentially hazardous foods in transit. Pre-cooked food that is transported between facilities must be maintained at safe temperatures throughout the transportation chain, and the temperature log requirements for transport of potentially hazardous foods must be satisfied. A ghost kitchen operation that produces pre-cooked items for distribution to multiple remote locations must have a documented cold chain management system covering production, packaging, storage, loading, transport, and delivery, and that system must be included in the commissary's HACCP plan or food safety management system.

Fresh-prep operations at a ghost kitchen, where food is prepared from raw ingredients and delivered for immediate consumption by the end consumer through a delivery platform, are most analogous to traditional restaurant food service for regulatory purposes. The fresh-prep ghost kitchen is subject to the same temperature control, cooking temperature, allergen management, and food worker certification requirements as a conventional restaurant, and the food service establishment permit issued to the ghost kitchen facility must reflect the scope of fresh-prep operations conducted there. A ghost kitchen that has expanded from basic fresh-prep meal assembly into more complex preparation involving raw animal foods, multi-step cooking processes, or reduced oxygen packaging without seeking permit modifications or HACCP plan approval for those processes is operating outside its permitted scope.

Co-packing, where a ghost kitchen facility produces food products under a third-party brand's label for retail sale or wholesale distribution, introduces FDA manufacturing compliance requirements in addition to the local health department's food service permitting framework. A ghost kitchen that engages in co-packing of packaged food products for retail sale is likely subject to the FDA's Preventive Controls for Human Food rule under 21 CFR Part 117, which requires facility registration with the FDA, a written Food Safety Plan prepared by a PCQI, implementation of preventive controls including allergen controls, monitoring and corrective action procedures, and supply chain program requirements. Co-packing operations that are conducted at a ghost kitchen facility without FDA registration and a compliant Food Safety Plan represent a significant regulatory compliance failure that must be identified and addressed in diligence.

In an M&A transaction involving a ghost kitchen that conducts commissary, fresh-prep, and co-packing operations under a single facility permit, the buyer must assess the compliance status of each distinct operational category separately. The commissary operations must be covered by an adequate commissary permit and a documented food safety management system for the commissary function. The fresh-prep operations must be within the approved scope of the food service establishment permit and must satisfy all applicable food code requirements. The co-packing operations must comply with FDA facility registration, Preventive Controls, and Food Safety Plan requirements. A ghost kitchen that has grown organically into multi-modal operations without maintaining regulatory alignment across all three operational categories is a common finding in ghost kitchen M&A diligence, and the cost of bringing all three categories into compliance is a material factor in the transaction economics.

Reps and Warranties: Health Permit Validity, Inspection History, HACCP Compliance, Closure History, and Special Indemnification

The representations and warranties framework for a restaurant or food service M&A transaction must be calibrated to the specific regulatory structure of the food service industry with the same precision that healthcare M&A requires for Medicare billing compliance or financial services M&A requires for securities licensing. Standard commercial M&A representations covering governmental permits and compliance with applicable laws provide a necessary baseline, but they do not capture the specific compliance dimensions of health department permitting, HACCP plan requirements, allergen management, inspection history, closure events, and the CFPM credential requirement. Counsel who rely on generic representations in food service acquisitions routinely encounter post-close compliance issues that targeted representations would have surfaced during diligence.

The health permit validity representation should confirm that all food service establishment permits required for the target's operations are current, valid, and in good standing; that no permit has been suspended, revoked, or subjected to conditions or restrictions other than standard permit conditions; that no permit is within 60 days of its renewal date without the renewal application having been submitted; and that the permitted establishment type and scope accurately reflects the food preparation and service activities currently conducted at each location. The health permit validity representation should be accompanied by a schedule disclosing every food service establishment permit held by the target, with permit numbers, issuing jurisdictions, expiration dates, and any conditions or restrictions.

The inspection history representation should disclose all inspection reports, violation notices, warning letters, corrective action orders, and consent agreements received by the target from any health department during a defined lookback period of at least three years. The representation should also require the seller to disclose any pending or scheduled health department inspections that the seller is aware of, any outstanding corrective action requirements that have not been fully satisfied, and any conditions of the current permit that require ongoing compliance. A blanket representation that the target is in compliance with all applicable health regulations is insufficient without this level of specificity, because it does not give the buyer any information about the actual inspection record that would allow post-close enforcement exposure to be assessed.

The HACCP compliance representation should confirm that all food processes that require a written HACCP plan under the applicable food code or FDA regulations have a current, approved HACCP plan in place; that the plan is being actively implemented with the monitoring, corrective action, and recordkeeping required by the plan; and that no HACCP critical limit has been exceeded without documented corrective action having been taken. The representation should also confirm that all employees responsible for HACCP monitoring functions have received training appropriate to their responsibilities and that the business has a PCQI if required by applicable FDA regulations.

Special indemnification for health and food safety regulatory matters should cover three primary categories of post-close liability. First, costs of remediation and penalties arising from any health department enforcement action initiated post-close based on conditions or violations that existed during the seller's ownership, including violations identified in connection with a change-of-ownership inspection. Second, third-party claims for foodborne illness, allergen reaction, or food contamination arising from food prepared or served during the seller's ownership period. Third, the cost of any HACCP plan deficiencies or food safety management system failures that are identified post-close and that require remediation to bring the business into compliance with applicable health code requirements. The special indemnification should be fully funded through an escrow holdback at closing and should not be subject to the general indemnification basket or cap. Acquisition Stars advises buyers and sellers in restaurant, QSR, and ghost kitchen M&A, including health permit diligence, HACCP compliance review, and purchase agreement negotiation. Contact us at 248-266-2790 or through the form below to discuss your transaction.

Frequently Asked Questions

Related Resources

Health permit compliance is not a peripheral administrative matter in restaurant and food service M&A. It is the legal foundation of the acquired business's right to prepare and serve food, and any disruption to that foundation, whether from a permitting gap at close, an unapproved facility modification, a CFPM vacancy, a failed change-of-ownership inspection, or a post-close enforcement action based on pre-close conditions, directly affects the business's ability to operate and generate revenue. The buyer who treats health permit diligence as a box to check at the end of the due diligence period will encounter compliance issues that a front-loaded analysis would have identified and addressed before they became operational problems.

A buyer who conducts comprehensive health permit diligence, maps every jurisdiction's transfer requirements, reviews three years of inspection history, confirms HACCP plan status and CFPM credentials, assesses allergen management procedures, and builds a pre-close and post-close permitting plan is positioned to close a restaurant or food service acquisition without a regulatory-driven operational disruption. That outcome requires early engagement, legal counsel with food service regulatory experience, and a purchase agreement that addresses the specific compliance dimensions of health department permitting and food safety law. Acquisition Stars advises on restaurant, QSR, and ghost kitchen M&A transactions, including health permit diligence, HACCP compliance assessment, and purchase agreement structuring. Contact us at 248-266-2790 or through the form below.