FSMA 204 Food Traceability Cold Storage M&A

Cold storage facilities occupy a critical position in the food supply chain. They are the infrastructure through which temperature-sensitive foods move from producer to retailer, and the quality of their traceability records determines whether a contamination event becomes a contained recall or a supply chain catastrophe. FDA's FSMA 204 Food Traceability Rule, which reached full compliance status in January 2026, imposes a detailed recordkeeping framework on cold storage operators that handle food on the Food Traceability List. For buyers acquiring cold storage businesses, FSMA 204 compliance is now a standalone due diligence category with direct implications for purchase price, deal structure, representations and warranties, and post-close integration planning.

The rule's requirements are specific and operational. Every time a covered cold storage facility receives an FTL food, it must record a defined set of Key Data Elements associated with that receiving event. Every time it ships an FTL food, it must record the corresponding outbound KDEs and, critically, link them to the inbound records so that the lot can be traced forward and backward through the chain of custody. The traceability plan, the lot code system, the electronic infrastructure, and the supplier reconciliation protocols are all reviewable during FDA inspection. A facility with gaps in any of these areas is exposed to Form 483 observations and potential Warning Letters, both of which become material inherited liabilities in an acquisition.

This article is part of the Warehousing and Cold Storage M&A Legal Guide. It covers the FSMA 204 framework in detail, with a focused analysis of how each compliance element creates M&A due diligence obligations and how buyers should structure purchase agreement protections around them.

FSMA 204 Framework and the January 2026 Compliance Date

Section 204 of the FDA Food Safety Modernization Act directed FDA to establish enhanced traceability recordkeeping requirements for high-risk foods. FDA finalized the implementing rule, formally titled the Requirements for Additional Traceability Records for Certain Foods, at 21 C.F.R. Part 1, Subpart S, in November 2022. The rule's compliance date was January 20, 2026, giving covered businesses approximately three years to implement the required systems and processes. As of that date, full FDA inspection authority for FSMA 204 compliance is active.

The rule's stated purpose is to enable FDA to identify and remove contaminated food from commerce more rapidly during a foodborne illness outbreak. The prior one-step-forward, one-step-back recordkeeping standard under Section 414 of the Federal Food, Drug, and Cosmetic Act was adequate for identifying immediate suppliers and customers, but was insufficient to support the rapid lot-level traceback that modern outbreak investigations require. FSMA 204 replaces that baseline for covered foods with a continuous lot-level chain of custody record from growing or first receiving all the way through to final distribution.

The rule applies to persons who manufacture, process, pack, or hold foods on the Food Traceability List, with limited exemptions for farms, retail food establishments below a certain size threshold, and certain fishing vessels. Cold storage operators who receive, store, and ship FTL-covered foods are expressly covered as holders of those foods, regardless of whether they also manufacture or process them. The compliance framework applies at the lot level: every FTL lot that enters or leaves a covered facility must be tracked through the defined Critical Tracking Event and Key Data Element structure.

FSMA 204 Compliance Timeline for M&A Context

November 2022: Final rule published at 21 C.F.R. Part 1, Subpart S. Three-year implementation period begins.

January 20, 2026: Full compliance required for all covered entities. FDA inspection authority for FSMA 204 records fully active. Cold storage facilities operating without complete CTE and KDE records are subject to enforcement action.

Two-year lookback: Required record retention period runs from the date the record is created. Records from January 2026 forward must be retained for two years, creating a growing archive of traceability history that buyers must account for in any acquisition completed through at least January 2028.

M&A diligence implication: Targets that were not compliant by January 2026 have an FDA compliance gap for every FTL shipment received or sent since that date. Those gaps are inherited at closing and reviewable during FDA inspection of the buyer's operations.

Food Traceability List Scope: Fresh Produce, Cheese, Seafood, and Leafy Greens

The Food Traceability List (FTL) identifies the food categories subject to FSMA 204's enhanced recordkeeping requirements. FDA developed the FTL based on historical outbreak data, the severity of illness associated with contamination events, and the likelihood that enhanced traceability would produce meaningful improvements in outbreak response speed. The list is published as a separate document incorporated by reference into the rule, and FDA retains authority to update it over time.

The current FTL includes: fresh fruits and vegetables, including leafy greens such as romaine lettuce, spinach, and other salad greens; shell eggs; nut butters; certain soft ripened cheeses, including fresh soft cheese, soft ripened cheese, and surface ripened cheese; finfish, including tuna, salmon, cod, bass, flounder, grouper, snapper, and Pacific ocean perch; crustaceans, including shrimp, crab, and lobster; mollusks, including clams, oysters, mussels, and scallops; smoked finfish; tropical tree fruits, including papayas, mangoes, guavas, and breadfruits; and ready-to-eat deli salads.

For cold storage M&A purposes, the FTL scope determination is the threshold question: does the target handle any FTL-covered food categories? Most refrigerated and frozen food distribution facilities handle at least some FTL items because fresh produce, seafood, and cheese are core cold storage commodities. A facility that handles only ambient products entirely outside the FTL scope may not be subject to the rule, but the scope determination requires a complete review of every food category the facility receives, stores, and ships, including items that may be handled occasionally rather than routinely.

Common FTL Foods in Cold Storage Facilities

✓Fresh leafy greens: romaine, spinach, arugula, spring mix, kale, chard, and herbs
✓Fresh tomatoes, cucumbers, peppers, and other fresh-cut produce
✓Shell eggs and egg products from covered facilities
✓Soft ripened cheeses: brie, camembert, fresh mozzarella, ricotta, and similar varieties
✓Fresh and frozen finfish: salmon, tuna, cod, halibut, and other species on the FTL
✓Shrimp, crab, lobster, and other covered crustaceans
✓Oysters, clams, mussels, and scallops
✓Ready-to-eat deli salads with meat, seafood, or egg components
✓Tropical fruits: papayas, mangoes, and guavas when handled fresh

Critical Tracking Events (CTEs) in Cold Storage Operations

A Critical Tracking Event (CTE) is a point in the food supply chain where a covered food changes hands or undergoes a transformation that requires the creation of a new traceability record. FSMA 204 defines five CTEs: growing (for produce), receiving, transforming, creating, and shipping. For cold storage operators who do not grow or process food, the operative CTEs are receiving and shipping. These are the moments at which the facility's traceability obligations are triggered and at which KDE records must be created and linked.

The receiving CTE occurs when a cold storage facility takes possession of an FTL food from a supplier. At that moment, the facility must capture and record the Key Data Elements associated with that receiving event: the traceability lot code assigned by the supplier, the quantity received, the product description, the date and location of receiving, and the business name and location of the immediate previous source. These records must link to the lot-level records the supplier was required to generate at the prior CTE in the supply chain.

The shipping CTE occurs when the cold storage facility sends FTL food to a customer. The facility must record the corresponding outbound KDEs and, critically, must link the outbound shipment records to the inbound receiving records for the same lot. This linkage is the core mechanism of FSMA 204's traceback capability: FDA investigators can request the shipping records for a lot identified in an outbreak, follow that lot back to the cold storage facility's receiving records, and then continue the traceback upstream to the supplier who shipped to the cold storage operator. Without accurate linkage between inbound and outbound records, the chain of custody is broken and the traceback fails.

Transformation CTEs in cold storage: Some cold storage facilities also perform light processing, repacking, or portioning that triggers the transformation CTE. A cold storage operator that repackages bulk fresh produce into retail-ready bags, portions whole fish into fillets, or assembles deli salads from components is performing a transformation and must create new traceability lot codes for the transformed product, along with records linking the new lots to the input lots. Buyers acquiring cold storage businesses with any processing or repacking operations must assess transformation CTE compliance separately from standard receiving and shipping CTE records.

Key Data Elements (KDEs): Lot Code, Location, Temperature, and Date

Key Data Elements (KDEs) are the specific data fields that must be captured and recorded at each Critical Tracking Event. The KDE requirements vary by CTE and food category, but all revolve around four core data types: lot identification, location, quantity, and time. For cold storage facilities, the receiving and shipping KDEs must include, at minimum: the traceability lot code for the food, the quantity and unit of measure, the product description, the date of the CTE, the location description of the immediate source or recipient, and the reference document identifier (typically the bill of lading, purchase order, or receiving record number).

The traceability lot code is the linchpin of the FSMA 204 framework. It is a unique identifier assigned to a food lot that must be passed forward through the supply chain and recorded at every subsequent CTE. For foods a cold storage facility receives from a covered supplier, the supplier's traceability lot code must be captured and recorded at the cold storage receiving CTE. If the cold storage facility ships that lot intact to a customer, the same lot code must appear in the shipping KDE records. If the facility breaks down a larger lot into smaller shipments, it must track which portions of the original lot went to which customers and record that in its shipping records.

Temperature is a KDE component for certain FTL foods where temperature exceedances constitute a food safety event. While FSMA 204's core KDE framework does not require temperature data for every FTL transaction, the rule's interaction with preventive controls requirements and the practical reality of cold storage operations means that temperature monitoring data is frequently relevant to traceability investigations. Cold storage facilities that operate integrated temperature monitoring systems, where sensor data is linked to the lot-level traceability records for foods stored in a given zone, have a materially stronger compliance posture than facilities where temperature logs exist but are not connected to the KDE record system.

Lot code format requirements: FSMA 204 does not mandate a specific lot code format, but the code must be assigned at the first land-based receiving point for imported foods, or at the point of harvesting or first packing for domestic produce. The code must be sufficient to uniquely identify the lot across the supply chain. Cold storage facilities receiving product with supplier-assigned lot codes must capture those codes exactly as provided; facilities that reassign their own internal codes must maintain a linkage between the internal code and the supplier's original lot code.

Reference document identifiers: Each KDE record must include a reference document number and type, such as a bill of lading number, purchase order number, or invoice number, that enables the record to be linked to the underlying transaction documents. In cold storage operations, the warehouse management system typically generates these identifiers automatically. In manual or hybrid systems, ensuring that every receiving and shipping event is tied to a specific document reference is a recurring compliance challenge.

Location data standards: FSMA 204 requires that location descriptions be sufficient to identify the specific facility or field location involved in the CTE. FDA encourages use of Food Traceability Number (FTN) identifiers and GS1 Global Location Numbers (GLNs) as standardized location identifiers that support electronic data exchange. Cold storage facilities using GLNs for their own location and for supplier and customer locations have a meaningful operational advantage in data linkage and partner reconciliation.

Recordkeeping Format Requirements and the 24-Hour Production Rule

FSMA 204 requires covered entities to maintain traceability records in a manner that allows them to be produced to FDA within 24 hours of a written request during an active outbreak investigation. This is the 24-hour production rule, codified at 21 C.F.R. 1.1405. The rule does not require real-time electronic access, but it does require that records be retrievable and transmittable to FDA within a tight window that presupposes efficient record storage and retrieval infrastructure.

The recordkeeping format is not mandated to be electronic, but paper-based systems face a practical ceiling. A cold storage facility receiving hundreds of FTL shipments daily from dozens of suppliers, operating multiple temperature zones, and shipping to retail and food service customers across multiple states cannot realistically retrieve, compile, and transmit lot-level KDE records within 24 hours from a paper-based system at any meaningful scale. The 24-hour production rule functions as a practical electronic systems requirement for larger cold storage operations, even though it is technically format-neutral.

In M&A diligence, the 24-hour production capability is evaluated through a mock records production exercise: the buyer's team submits a hypothetical lot code from a receiving or shipping event and asks the seller's team to assemble the complete KDE record set and the associated linkages within the 24-hour window. This exercise reveals both the completeness of the underlying records and the facility's operational capacity to respond to an FDA information request. Failures in mock production exercises, whether from record gaps, system limitations, or staff unfamiliarity with retrieval procedures, are material findings that must be addressed before closing or reflected in the purchase agreement's representations and indemnities.

Electronic Traceability Systems: GS1, EPCIS, and WMS Integration

GS1 standards and the Electronic Product Code Information Services (EPCIS) specification have become the dominant industry frameworks for implementing FSMA 204 traceability requirements in cold storage and food distribution. GS1 provides standardized identifiers for companies (GS1 Company Prefix), individual products (Global Trade Item Number, or GTIN), locations (Global Location Number, or GLN), and lots (Serial Shipping Container Code, or SSCC). EPCIS is an event-based data model that captures what, when, where, and why for each supply chain event, mapping directly onto the FSMA 204 CTE and KDE framework.

Cold storage facilities using GS1-compliant lot codes and GLN-based location identifiers can exchange traceability data electronically with suppliers and customers using EPCIS messaging, reducing manual data entry errors and enabling automated KDE capture at receiving and shipping. Integration between a GS1/EPCIS traceability layer and the facility's warehouse management system (WMS) is the operational foundation for FSMA 204 compliance at scale. The WMS captures the transaction data; the traceability layer structures it into KDE records; and the EPCIS interface provides the exchange format for supplier reconciliation and FDA records production.

In M&A diligence, the electronic system assessment covers four dimensions. First, whether the target has implemented a WMS or ERP system capable of capturing FSMA 204 KDEs. Second, whether the system is configured to capture all required KDE fields for every FTL CTE, or only for select food categories or operations. Third, whether the system integrates with supplier and customer data exchange protocols sufficient to support KDE reconciliation. Fourth, whether the system's export and production capabilities can deliver a complete lot-level record set to FDA within 24 hours.

Acquiring a Cold Storage Business with FSMA 204 Exposure?

Alex Lubyansky handles M&A transactions involving regulated food distribution businesses, including FSMA 204 diligence, purchase agreement representations, and compliance transfer mechanics. Submit your transaction details to begin the assessment process.

Request Engagement Assessment

Supplier and Customer KDE Reconciliation Obligations

FSMA 204 imposes KDE reconciliation obligations that run in both directions through the supply chain. A cold storage facility receiving FTL food from a covered supplier must ensure that the KDE records it maintains for the receiving CTE are consistent with the records the supplier maintained for the corresponding shipping CTE. The records must reference the same traceability lot code, the same quantity (or an explainable variance), and the same reference document identifiers. Discrepancies between the cold storage facility's inbound records and the supplier's outbound records create traceback gaps that undermine the rule's entire purpose.

Suppliers are required under FSMA 204 to provide their immediate customers with the Key Data Elements for FTL foods at the time of shipping. In practice, this means that a cold storage facility's receiving records should match data that the supplier transmitted at ship time, typically through an advance shipping notice (ASN), an electronic EPCIS message, or a paper bill of lading with lot code and quantity information. Cold storage facilities that rely entirely on their own lot code scanning at receiving, without reconciling against supplier-provided KDE data, create a compliance gap: the supplier's record and the facility's record may diverge without detection until an FDA inspection or a traceback request forces a comparison.

On the outbound side, cold storage facilities must transmit KDE data to their immediate customers at the time of shipping. The customer's receiving record must match the cold storage facility's shipping record. Cold storage operators serving retail customers with their own traceability systems, such as major grocery chains operating GS1-compliant EPCIS environments, face KDE transmission requirements that must be met in the format and timing the customer's system expects. Cold storage operators who have not established electronic KDE exchange with their major retail customers face both compliance risk and customer relationship risk as those customers integrate FSMA 204 compliance into their vendor qualification requirements.

Records Transfer Obligations in M&A and Successor Liability

FSMA 204 does not include an explicit provision governing records transfer in M&A transactions, but the two-year retention requirement and the 24-hour production obligation together create a practical records transfer obligation that must be addressed in every cold storage acquisition. The buyer who operates the facility after closing is responsible for producing any FTL traceability records for the two-year lookback period if FDA requests them. Records that exist only on seller-operated systems that are decommissioned or transferred post-close may be inaccessible to the buyer when needed, creating a production failure that FDA treats as a compliance violation.

The practical consequence is that purchase agreements for cold storage acquisitions must include detailed records transfer provisions that address: the format in which traceability records will be transferred, the timeframe for transfer (before or at closing, not months post-close), the completeness standard (all FTL KDE records for the two-year lookback period, not just records from the prior quarter), which party is responsible for data migration costs if records are being moved from a seller-operated WMS to a buyer-operated system, and what happens if transferred records are found to be incomplete after closing.

Successor liability for FSMA 204 record gaps operates through practical enforcement rather than formal legal assignment. FDA enforcement runs against the entity operating the facility at the time of inspection. If the buyer is operating the facility when FDA arrives with a records request, the buyer must produce the records or face an observation. If the records that should exist for the pre-close period are missing because the seller's system was improperly decommissioned, the buyer faces the observation and the associated regulatory burden, with a right of indemnification from the seller under the purchase agreement if that protection was properly negotiated.

FDA Inspection History, Form 483 Observations, and Warning Letters for Traceability

FDA inspection history is a core diligence category for cold storage acquisitions post-FSMA 204 compliance date. Before January 2026, FDA inspections of cold storage facilities focused primarily on preventive controls compliance, sanitation, and pest control. Post-compliance, FDA inspectors can now request and review FSMA 204 traceability records as a standard inspection activity. Form 483 observations for traceability deficiencies have become a new category of finding that buyers must review during acquisition diligence.

A Form 483 is a list of inspectional observations issued to a facility at the conclusion of an FDA inspection, documenting conditions the inspector believes may constitute violations of FDA regulations. Form 483 observations are not formal enforcement actions and do not, by themselves, establish regulatory violations. However, they signal that the facility's practices in the cited areas are under FDA scrutiny and must be addressed. A facility that receives repeated Form 483 observations in the same compliance category without implementing corrective actions is on a trajectory toward Warning Letter issuance, which is a more serious enforcement action.

Warning Letters are publicly available on FDA's website and are permanent records. A cold storage target with an open Warning Letter, or with a Warning Letter issued within the past several years that required a formal response and corrective action plan, is a materially different compliance profile than a facility with no Warning Letter history. Buyers should request the complete FDA inspection history for the target, including all Form 483s, establishment inspection reports, and any Warning Letters or voluntary action indicated determinations, as part of the standard regulatory compliance diligence package.

FSMA 204 Form 483 Observation Categories to Review in Diligence

✓Failure to establish or maintain a written traceability plan as required by 21 C.F.R. 1.1315
✓Incomplete Key Data Elements for receiving CTEs: missing lot codes, reference document numbers, or source location data
✓Incomplete KDE records for shipping CTEs: failure to link outbound shipment records to inbound receiving records for the same lot
✓Lot code assignment practices that do not meet the traceability lot code definition: codes that are not unique, not traceable to a specific lot, or not consistently applied
✓Failure to produce records within the 24-hour window during FDA mock production exercises or actual records requests
✓Records for transformation CTEs that fail to link input lot codes to output lot codes
✓Absence of records for certain FTL food categories that the facility handles but has not included in its traceability program

Recall Readiness and Mock Recall Diligence

Recall readiness is the practical test of FSMA 204 compliance: can the facility identify all customers who received a specific FTL lot within hours of a contamination notification? Can it trace the lot back to its upstream source at the supplier level? Can it identify all other lots stored in the same zone that may have been co-mingled or co-exposed with the recalled lot? The answers to these questions depend entirely on the completeness and accessibility of the KDE record system.

A mock recall exercise conducted as part of M&A due diligence is the most reliable method of evaluating FSMA 204 practical compliance. The exercise selects a historical FTL lot from the target's receiving records, typically from 30 to 90 days prior to the exercise date, and asks the target's operations and compliance team to: identify the supplier and lot code for the selected lot, retrieve all KDE records associated with that lot's receiving CTE, identify all customers to whom that lot or portions of that lot were shipped, retrieve the corresponding shipping KDE records, and complete the forward and backward traceback within a defined timeframe, typically four to eight hours.

Mock recall results must be evaluated against the FSMA 204 standard, not against the facility's own internal expectations. A facility that can complete a forward traceback but cannot complete a backward traceback to the supplier's harvest or first packing location has a compliance gap. A facility that can identify the receiving KDE records but cannot link them to the specific outbound shipments that consumed each lot has a linking gap. These gaps require remediation before the facility is compliant, and the cost and timeline of that remediation must be factored into the acquisition economics.

Integration with HACCP, FSVP, and the Preventive Controls Rule

FSMA 204 does not operate in isolation. Cold storage facilities are subject to multiple overlapping FSMA requirements, and the traceability framework's practical effectiveness depends on its integration with the broader food safety management system. The three most relevant intersecting frameworks in cold storage M&A contexts are Hazard Analysis and Critical Control Points (HACCP), the Foreign Supplier Verification Program (FSVP), and the Preventive Controls for Human Food rule (21 C.F.R. Part 117).

HACCP plans in cold storage operations identify temperature control as the primary critical control point for temperature-sensitive foods. A cold storage facility that documents a temperature exceedance in its HACCP monitoring records but does not link that event to the FSMA 204 KDE records for the affected lots has an integration gap: the HACCP record identifies a food safety event, but the traceability system cannot identify which specific lots were affected or where they went after the exceedance. Integrated systems that cross-reference HACCP monitoring data with the lot-level KDE records for foods in the affected zone provide meaningfully better recall capability.

The FSVP adds a parallel dimension for imported FTL foods. A cold storage operator who imports seafood, tropical fruits, or other FTL items from foreign suppliers must maintain FSVP records verifying those suppliers' food safety controls as a condition of importation. In M&A diligence, buyers should review both the FSVP records for foreign-sourced FTL items and the corresponding FSMA 204 KDE records for those same items to confirm consistency. An import that lacks adequate FSVP documentation also typically lacks a complete upstream KDE record, because the lot code chain starts at the foreign source and the US importer's first land-based receiving record.

Purchase Agreement Representations: FSMA 204 Compliance, FTL Accuracy, and Record Retention

Purchase agreement representations and warranties for cold storage acquisitions must be updated to reflect the FSMA 204 compliance framework. General food safety compliance representations are not sufficient: buyers need specific representations that address the rule's individual components, because each component creates distinct liability exposure if the representation is inaccurate.

The FTL accuracy representation covers the seller's identification of all food categories handled at the facility that fall within the Food Traceability List. This representation protects against the discovery post-close that the target was handling FTL-covered foods that were not included in the traceability program, meaning the KDE records for those items were never created and the facility has been out of compliance since January 2026 for categories the seller did not identify during diligence. The representation should require the seller to certify that its FTL scope determination is complete and accurate.

The KDE record completeness representation covers the existence and completeness of lot-level records for every receiving and shipping CTE involving FTL foods during the two-year retention period. The seller should represent that KDE records have been maintained for all FTL CTEs, that the records contain all required data fields, and that the records can be produced to FDA within 24 hours of a written request. This representation should specifically survive the closing date, with a survival period that runs at least through the expiration of the two-year retention window for records that exist at closing.

Traceability plan representation: The seller should represent that a written traceability plan exists as required by 21 C.F.R. 1.1315, that the plan identifies the FTL foods handled at the facility, assigns responsibility for traceability activities to specific personnel, and is accessible to employees and FDA upon request. The plan document itself should be provided as a diligence exhibit and reviewed for completeness against the regulatory requirements.

No open FDA actions representation: The seller should represent that there are no open FDA Warning Letters, consent decrees, or Section 305 notices relating to FSMA 204 compliance, and that there are no pending or threatened FDA enforcement actions that have not been disclosed. Form 483 observations that remain unresolved and for which the seller has not submitted a complete corrective action response should be specifically disclosed.

Records transfer covenant: The purchase agreement should include a specific post-closing covenant requiring the seller to cooperate with the transfer of all FSMA 204 traceability records to the buyer in a format accessible on the buyer's systems, to maintain access to seller-operated systems containing pre-close records until the records transfer is confirmed complete, and to assist the buyer in responding to any FDA records requests relating to pre-close operations for the duration of the two-year retention period.

Indemnification scope for FSMA 204 claims: The indemnification provisions should expressly cover losses arising from inaccuracies in the FSMA 204 representations, including the cost of reconstructing missing records, responding to FDA enforcement actions based on pre-close compliance gaps, and implementing corrective actions required by FDA in connection with pre-close traceability deficiencies. The FSMA 204 indemnity should have a survival period aligned with the two-year records retention window rather than a standard general representation survival period.

FSMA 204 Due Diligence for Your Cold Storage Acquisition

Acquisition Stars handles purchase agreement drafting, regulatory compliance review, and traceability records transfer mechanics for cold storage M&A transactions. Alex Lubyansky works directly on each engagement. Contact the firm at 248-266-2790 or consult@acquisitionstars.com.

Request Engagement Assessment

Frequently Asked Questions

Does FSMA 204 apply to ambient warehouses or only cold storage?

FSMA 204 applies to any entity that manufactures, processes, packs, or holds foods on the Food Traceability List (FTL), regardless of whether those foods are stored under refrigeration or at ambient temperature. A dry grocery warehouse that receives and ships FTL-designated produce or cheese is subject to the rule even without refrigerated infrastructure. Cold storage facilities handle a disproportionate share of FTL-covered commodities because fresh produce, shell eggs, seafood, and soft ripened cheeses require temperature-controlled environments. The compliance obligation follows the food category, not the facility type. Buyers acquiring ambient warehouses should not assume immunity: the FTL scope review is a necessary first step in FSMA 204 diligence for any food storage or distribution facility.

How does successor liability work for FSMA 204 record gaps?

FDA does not automatically transfer regulatory exposure from seller to buyer at closing, but a buyer who acquires a cold storage business and continues operations at the same facility inherits the operational record gaps that existed before closing. FDA enforcement authority runs against the entity operating the facility at the time of inspection. If the buyer is operating the facility when inspectors arrive and the traceability records for the covered two-year lookback period are incomplete, the buyer faces Form 483 observations and potential Warning Letter exposure even if the gaps predate the acquisition. Successor liability for FSMA 204 purposes is therefore practical rather than purely legal: incomplete records from the seller's operations become the buyer's compliance problem the moment FDA walks through the door. Comprehensive records transfer provisions in the purchase agreement and a gap-fill protocol at close are essential risk management tools.

What is the 24-hour production rule?

The 24-hour production rule under 21 C.F.R. Part 1, Subpart S permits food businesses covered by FSMA 204 to provide required Key Data Element records to FDA within 24 hours of a written request, rather than having all records immediately accessible at all times. The rule was designed to give smaller operations flexibility in how they store and retrieve traceability records while preserving FDA's ability to conduct rapid traceback investigations. In practice, the 24-hour window means that electronic systems need not display all KDE data on a single dashboard in real time, but the underlying records must be retrievable and transmittable within that window. During M&A diligence, buyers should verify that the seller's recordkeeping infrastructure can reliably meet the 24-hour production standard, including during system transitions, integration periods, and the first months of post-close operations when IT systems may be in flux.

Are electronic KDE records required or paper permitted?

FSMA 204 does not mandate electronic recordkeeping. Paper records are legally permissible provided they contain all required Key Data Elements and can be produced to FDA within 24 hours of a written request. However, FDA strongly encourages electronic systems because the traceback use case, linking a contaminated product from retail back to the farm-level growing location within hours, is practically impossible with paper records at any meaningful scale. For cold storage operations handling high volumes of FTL foods from multiple supplier sources, paper-based KDE records create significant risk of incompleteness, illegibility, and retrieval failure under the 24-hour production standard. In M&A contexts, a target operating on paper records is a material diligence finding: the acquirer will almost certainly need to invest in electronic system implementation post-close, and the paper records themselves will need to be converted or preserved in accessible formats for the two-year retention period.

How does FSMA 204 interact with FSVP obligations?

The Foreign Supplier Verification Program (FSVP) under 21 C.F.R. Part 1, Subpart L requires US importers to verify that their foreign suppliers produce food in a manner that provides the same level of public health protection as applicable FSMA preventive controls and produce safety standards. FSMA 204 adds a parallel traceability obligation: FTL-covered foods imported from foreign sources must have KDE records that support domestic traceback, even when the origin of the food is outside the United States. A cold storage operation importing FTL-designated seafood or produce must maintain both FSVP documentation verifying the foreign supplier's food safety controls and FSMA 204 KDE records sufficient to link each lot to its foreign source. In M&A diligence, buyers should review the target's importer identification, FSVP qualified individual designations, and the completeness of supplier verification records for all FTL items sourced from outside the United States.

What FDA Form 483 findings commonly occur under FSMA 204?

FDA Form 483 observations under FSMA 204 have concentrated in several recurring categories since the rule's compliance date. The most common findings include: failure to establish or maintain a traceability plan as required by 21 C.F.R. 1.1315; incomplete or missing Key Data Elements for Critical Tracking Events, particularly receiving and shipping events for FTL foods; failure to link KDE records across supply chain handoffs so that inbound supplier lot codes cannot be associated with outbound customer shipments; lot code assignment practices that do not satisfy the traceability lot code definition requirements; and recordkeeping systems that cannot produce required records within the 24-hour window during mock exercises. In cold storage operations, temperature data integration with KDE records, as required for certain FTL categories, is also a recurring gap.

Can FSMA 204 records be transferred to the buyer in standard formats?

FSMA 204 records can be transferred to a buyer in any format that preserves the completeness and accessibility of the required Key Data Elements. FDA has not mandated a specific electronic data format for traceability records, though the agency developed a standardized spreadsheet template (the Traceability Lot Code spreadsheet) to facilitate data sharing. Many cold storage operations use warehouse management systems or ERP platforms that can export traceability records in CSV, XML, or EPCIS-compliant formats compatible with GS1 standards. In M&A transactions, the purchase agreement should address both the format and the method of records transfer, confirm which party is responsible for system migration costs, and specify what happens to records retained on seller-operated platforms that will be decommissioned post-close. Buyers should validate that transferred records are searchable and retrievable in their post-close system environment before the seller's legacy systems go offline.

How does traceability differ for FTL vs non-FTL foods?

Foods on the Food Traceability List are subject to the full FSMA 204 Critical Tracking Event and Key Data Element framework: lot-level tracking at receiving, transformation, and shipping, two-year record retention, 24-hour production capability, and traceability plan documentation. Non-FTL foods are not subject to FSMA 204's enhanced traceability requirements, though they remain subject to the general record-access requirements under Section 414 of the Federal Food, Drug, and Cosmetic Act, which requires food facilities to maintain one step forward and one step backward records for two years. In a cold storage facility handling both FTL and non-FTL foods, the practical challenge is system design: the traceability infrastructure must distinguish FTL from non-FTL lots, apply the enhanced KDE requirements to FTL items, and maintain the one-up one-back baseline for everything else. Mixed-inventory facilities require careful system configuration and staff training to ensure FTL items do not fall through to baseline-only tracking.

Complete the Cold Storage M&A Framework

FSMA 204 traceability is one component of the broader legal framework for cold storage and warehousing acquisitions. Review the related guides for the full picture.

Warehousing and Cold Storage M&A Legal Guide: Complete Overview Ammonia Refrigeration PSM and OSHA Compliance in Warehouse M&A 3PL Customer Contracts and WMS Data in Warehouse Acquisitions M&A Due Diligence Guide Representations and Warranties in M&A Indemnification Provisions in M&A

FDA FSMA 204 Food Traceability Rule in Cold Storage M&A: CTE Data, KDE Records, and Compliance Transfer

Key Takeaways