FDA Warns Food Facilities to Protect Their Registration Information
The FDA issued an advisory in July 2026 warning food businesses against registering unnecessarily and cautioning them not to share Food Facility Registration credentials with third parties. Third-party registrars and platforms such as TikTok Shop have been requesting sensitive registration information, creating security vulnerabilities and regulatory confusion.
Sharing FFR numbers, PINs, or FIS-FURLS login credentials can allow unauthorized parties to alter or cancel a facility’s registration. Not all food businesses are required to register, and those that are should verify their status only through official FDA channels and report any suspected misuse of their registration information.
On July 20, 2026, the FDA issued a constituent update reminding human and animal food businesses of two things: register your facility with the FDA only when you are actually required to, and protect your Food Facility Registration (FFR) information from misuse. The advisory comes as the agency reports a rise in unnecessary registrations and a growing number of third parties asking companies to hand over sensitive registration credentials.
What prompted the FDA warning?
The FDA says it has become aware of several problems, including:
- An uptick in businesses registering their facilities with the FDA when they are not required to.
- Third-party “registrars” requesting a company’s FFR number, PIN, and FIS-FURLS (FDA Industry Systems) username and password to “verify” registration status.
- TikTok Shop and other third-party seller platforms asking food companies to provide a copy of their FDA Food Facility Registration, or a registration certificate, as part of the product-listing process.
Why is sharing your FFR information risky?
According to the FDA, these practices create real problems:
- Security risks. When you share your FFR number and PIN (or your FIS-FURLS username and password), a third party can link your registration to their own FIS-FURLS account. Once linked, they can view, change, or even cancel your registration. Bad actors can also misuse the information for fraudulent purposes.
- Regulatory confusion. Registering when you are exempt or otherwise not required to may subject your facility to unnecessary inspections and create confusion about your compliance obligations.
- Strained FDA resources. Unnecessary registrations divert FDA attention away from facilities that are actually required to register, including those that pose higher food safety risks.
Am I even required to register with the FDA?
Not every food business is. Facilities that manufacture, process, pack, or hold food for consumption in the United States must register unless an exemption applies (21 CFR 1.225; 21 CFR 1.226). Private residences and restaurants are not considered facilities (21 CFR 1.227). Determining whether you must register — and whether an exemption applies — is the first step in getting compliance right. The FDA’s Questions and Answers Regarding Food Facility Registration (Seventh Edition) guidance (Section II.B) can help you evaluate the exemptions.
Does the FDA require me to give my FFR number to third parties?
No. Your FFR information is not public, and the FDA does not require you to share your FFR number with third-party platforms or registrars. There is one common exception for importers: a facility may need to provide its FFR number to the downstream commercial entity that submits prior notice to the FDA for imported food (see 21 CFR part 1, subpart I).
Keep in mind that the FEI (FDA Establishment Identification) number is a separate, public identifier and is not the same as your FFR number. If a platform needs to confirm your facility, the FEI number — not your FFR credentials — is the appropriate public reference.
How do I protect my registration information?
The FDA recommends the following:
- Never share your FIS-FURLS username and password. Each FIS-FURLS account is tied to the individual who created it. If you need others to help manage your registrations, create subaccounts for them instead of sharing your login.
- Do not hand your FFR number to third parties who do not need it. Remember that this information is not public and is not required for most product-listing processes.
- Check your registration status only through the official FDA site. Use access.fda.gov rather than any third-party “verification” service.
- If you have already shared your FFR number or PIN in error, consider cancelling your registration and re-registering your facility to protect it.
- Report suspected misuse. If you believe your registration number has been used fraudulently, report it to the FDA.
How can US Food Imports help?
We handle FDA Food Facility Registration for foreign and domestic facilities every day, and we can help you determine whether you are required to register in the first place, register correctly, and keep your FIS-FURLS credentials and FFR information secure. If you are unsure whether you need to register — or you think your registration information may have been compromised — we can help you sort it out and correct it. Learn more about our FDA compliance solutions.