A cocoa or cocoa powder specification sheet covers four categories: microbiological limits (Salmonella, Enterobacteriaceae, total plate count, yeast, mould), mycotoxins (ochratoxin A, aflatoxin), PAH4/benzo(a)pyrene, and physical parameters (moisture, free fatty acid, foreign matter).
Cocoa’s low water activity limits pathogen growth, but contamination enters at fermentation, drying, storage, shipping, or post-roast handling without changing how the product looks or smells.
A 2011 peer-reviewed survey of 25 commercial cocoa powder samples, published in the journal Food Microbiology, found one Salmonella-positive result, five Enterobacteriaceae-positive results, and two mould-limit exceedances.
Two major European chocolate manufacturers, Ferrero and Barry Callebaut, issued Salmonella-linked recalls in 2022, both traced to post-processing contamination in the finished-goods environment rather than the raw bean.
The specification sheet below is what a procurement team uses to prevent that outcome.
Full Cocoa Powder Specification Table
| Category | Parameter | Specification | Basis |
| Physical | Moisture | 5% max (powder); 7 to 7.5% typical for beans | Commercial standard |
| Fat content | 10 to 12% (standard) or 20 to 22% (high-fat) | Commercial grade selection | |
| pH (alkalized powder) | 6.8 to 8.1 | Process specification | |
| pH (natural powder) | 5.2 to 5.8 | Process specification | |
| Particle size | 99% through 200 mesh | Commercial standard | |
| Foreign matter | 0.75% max (beans) | ISO 2451:2017 | |
| Chemical | Free fatty acid (FFA) | 1.75% max (oleic acid equivalent, cocoa butter) | EEC Directive 73/241/EEC |
| Contaminants | Cadmium | 0.60 mg/kg max | EU Regulation 2023/915 |
| Ochratoxin A (OTA) | 3 µg/kg max (cocoa powder only; no bean limit) | EU Regulation 2023/915 | |
| Aflatoxin | No EU limit set | Not regulated in the EU | |
| Benzo(a)pyrene (PAH) | 5.0 µg/kg fat max | EU Regulation 2023/915 | |
| Sum of PAH4 | 30.0 µg/kg fat max | EU Regulation 2023/915 | |
| Microbiological | Total Plate Count (TPC) | 5,000 CFU/g max | Industry standard (CAOBISCO/ECA/FCC) |
| Yeast | 50 CFU/g max | Industry standard | |
| Mould | 50 CFU/g max | Industry standard | |
| Enterobacteriaceae | Negative/g | Industry standard | |
| Coliforms | Negative/g | Industry standard | |
| E. coli | Negative/g | Industry standard | |
| Salmonella | Negative/375 g (or /25 g minimum) | Industry standard |
Every shipment from Radad International is tested against this exact panel before it leaves Nigeria or Dubai. Detailed sourcing and regulatory basis for each parameter follows below.
The Regulatory Overview: What’s Legally Binding (and What Isn’t)
Microbiological limits for cocoa are industry standards, not law. Regulation (EC) No 2073/2005, the EU’s binding microbiological criteria regulation, does not list cocoa or cocoa powder among its regulated food categories.
The limits every serious supplier tests against, Salmonella, Enterobacteriaceae, total plate count, yeast, and mould, come from the joint working group of CAOBISCO (the European chocolate and confectionery association), the European Cocoa Association (ECA), and the Federation of Cocoa Commerce (FCC), maintained at cocoaquality.eu. Every serious buyer in Europe, the Gulf, and North America specifies against these industry limits regardless of their non-statutory status.
A supplier cannot cite an EU regulation number for microbiological compliance the way they can for cadmium or PAHs. A supplier who claims one exists is misinformed or misrepresenting their compliance position.
Contaminant limits, by contrast, are law. EU Regulation 2023/915 sets binding maximum levels for heavy metals, mycotoxins, and PAHs, and replaced the earlier Regulation (EC) 1881/2006 in 2023.
Coverage is uneven by design: some limits apply to raw beans, some apply only to finished cocoa powder, and aflatoxin is not regulated in cocoa at all under EU law. Each section below states precisely which category a given limit falls into.
-
Microbiological Specifications
Salmonella
Salmonella is the pathogen every cocoa buyer cares about most, and for good reason: it’s the one organism that can survive cocoa’s low water activity in a dormant state and cause a genuine public health incident if it re-activates downstream.
The industry-standard specification is absence in a defined sample weight, most commonly 25 g, though many premium buyer contracts specify 375 g (pooling several 25 g subsamples) for a statistically stronger guarantee on large lots.
A published commercial cocoa powder product data sheet from a UK ingredients supplier, for example, specifies Salmonella negative per 375 g as its stated commercial standard.
Salmonella in cocoa is not typically a contamination of the bean itself; the roasting step (commonly above 120°C) is lethal to it.
The risk window is almost always post-roast: powder or nibs re-contaminated by dirty equipment, poor hygiene in a milling or packing facility, or exposure to rodents or birds in storage.
This is why Salmonella testing has to happen on the finished product, not just the incoming bean, and why a supplier’s factory hygiene audit matters as much as their raw material sourcing.
Enterobacteriaceae and Coliforms
Enterobacteriaceae (a broader family that includes E. coli and coliforms) are used as indicator organisms. Their presence doesn’t necessarily mean the product is unsafe, but it flags a hygiene failure somewhere in processing that warrants investigation. The 2011 cocoa powder survey referenced above found Enterobacteriaceae in 5 of 25 samples even though only one was Salmonella-positive, which is exactly the pattern you’d expect: Enterobacteriaceae is the more sensitive early-warning signal.
Total Plate Count, Yeast, and Mould
These three tests together describe the general microbiological “load” of a batch: how clean the processing environment and drying process were, in aggregate. A representative commercial specification for alkalized cocoa powder, drawn from a published industry product data sheet, sets the following limits:
| Microbiological parameter | Typical industry limit | What it indicates |
| Total Plate Count (TPC) | 5,000 CFU/g max | Overall hygiene of processing and handling |
| Yeast | 50 CFU/g max | Moisture ingress, inadequate drying, or storage humidity |
| Mould | 50 CFU/g max | Same as above; often correlates with moisture content above spec |
| Enterobacteriaceae | Negative/g | Faecal or post-process hygiene failure |
| Coliforms | Negative/g | Same as above |
| E. coli | Negative/g | Direct faecal contamination indicator |
| Salmonella | Negative/375 g | The critical pathogen test, must always be negative |
Source: representative commercial cocoa powder product specification, industry-standard limits consistent with CAOBISCO/ECA/FCC guidance.
A yeast or mould count creeping toward the limit is frequently the first sign of a moisture problem, which is why these tests and the moisture reading (Section 4, below) should always be read together, not in isolation.
-
Mycotoxins: Ochratoxin A and Aflatoxin
Mycotoxins are toxic metabolites produced by moulds, principally Aspergillus species, and they are the contaminant class most directly caused by poor post-harvest handling: beans that are dried too slowly, stored too damp, or held too long before shipment.
Ochratoxin A (OTA)
OTA is the mycotoxin the EU actually regulates in cocoa, but the regulation is narrower than most buyers assume.
Under Commission Regulation (EU) 2022/1370, since folded into the consolidated Regulation (EU) 2023/915, the EU set a maximum OTA level of 3 µg/kg specifically for cocoa powder, effective 1 January 2023. Critically, there is no EU maximum level for raw cocoa beans, cocoa mass, or cocoa butter.
This is a genuine gap that catches buyers off guard: a supplier can legally sell beans with OTA levels that would fail the powder standard once processed, because the bean itself sits outside the regulation.
For context on typical levels: field research on Ivorian cocoa beans found average OTA concentrations of roughly 0.6 to 1.9 µg/kg depending on grade and whether beans were shelled, with unshelled beans running higher because OTA concentrates disproportionately in the shell and outer layers.
This is also why careful deshelling before further processing measurably reduces OTA carryover into the final powder.
OTA forms primarily during slow or interrupted drying and damp storage, not during fermentation itself. The FAO/WHO Codex Alimentarius Code of Practice for the prevention and reduction of OTA contamination in cocoa (CAC/CXC 72-2013) is the reference document most serious origin-side quality programmes work from.
Aflatoxin
This is the single most important gap in cocoa regulation to understand: the EU has not set a maximum level for aflatoxins in cocoa beans or cocoa products, despite aflatoxins being classified as carcinogenic by international health bodies and being a recognised risk in cocoa grown and stored in humid tropical conditions.
This isn’t an oversight so much as a reflection of historically lower aflatoxin prevalence in cocoa compared to products like groundnuts or maize. But “not legally required” and “not a real risk” are different things, and more cautious buyers specify their own aflatoxin limits contractually even where no regulation compels it.
Where national limits do exist, they’re informative benchmarks:
| Jurisdiction | Aflatoxin limit | Product |
| European Union | No limit currently set | Cocoa beans or cocoa products |
| Brazil (ANVISA) | 10 µg/kg | Cocoa beans |
| Brazil (ANVISA) | 5 µg/kg | Cocoa products and chocolate |
| Japan | 10 µg/kg (AFB1) | Import enforcement threshold, applied case by case |
Aflatoxin risk correlates strongly with the same root causes as OTA: beans held too long in humid conditions before drying, or drying that doesn’t bring moisture down fast enough. The moisture and mycotoxin sections of a spec sheet are really describing the same underlying failure mode from two different angles.
-
Polycyclic Aromatic Hydrocarbons (PAH4)
PAHs are combustion byproducts, and in cocoa they come from one specific practice: drying beans over open wood fires or with smoke-producing artificial dryers instead of clean, indirect-heat drying or sun-drying. This is a practically avoidable contaminant; it’s a processing choice, not an inherent property of the bean.
The EU regulates PAHs in cocoa under Regulation (EU) 2023/915, Annex I, point 6.1.2, with two parameters:
| Contaminant | EU maximum level | Basis |
| Benzo(a)pyrene (BaP) | 5.0 µg/kg fat | Cocoa beans and derived products |
| Sum of PAH4 (BaP + benz(a)anthracene + benzo(b)fluoranthene + chrysene) | 30.0 µg/kg fat | Cocoa beans and derived products |
Note: both limits are expressed per kilogram of fat, not per kilogram of whole product. This is an important distinction when comparing a bean result to a cocoa butter result, since fat content differs enormously between product forms.
The practical takeaway for buyers is straightforward: ask how the beans were dried. Sun-drying on raised beds, or artificial drying with indirect (non-smoke-contact) heating, essentially eliminates this risk category.
Direct-flame or wood-fired drying is the pattern the Codex Code of Practice for the Reduction of Contamination of Food with PAH from Smoking and Direct Drying Processes (CXC 68-2009) specifically exists to address.
-
Moisture Content
Moisture is the single parameter that most directly governs almost every other risk on this page: mould growth, yeast counts, and mycotoxin formation are all downstream of moisture control.
ISO 2451:2017, the international specification for cocoa beans, sets a maximum moisture content of 8%. In commercial practice, most serious buyers specify tighter than the ISO ceiling: 7% to 7.5% is the commonly quoted commercial buying range, because mould risk rises sharply as moisture approaches and exceeds 8%, and because a small safety margin protects against moisture pickup during ocean transit (see our guide on sourcing bulk cocoa beans for more on container condensation risk).
| Moisture reading | Practical implication |
| Below 6% | Beans are over-dried; can become brittle, and some flavour precursor loss may occur |
| 6% to 7.5% | Commercial sweet spot most buyers specify |
| 7.5% to 8% | Within ISO 2451 limit but approaching risk zone; increased mould monitoring warranted |
| Above 8% | Non-compliant with ISO 2451; high mould and mycotoxin risk; typically rejected |
Moisture should always be tested at origin before loading and ideally re-tested on arrival, because a batch that leaves West Africa at 7% moisture can pick up 1 to 2 percentage points during a poorly ventilated or condensation-prone container voyage. That is a separate risk entirely from how the beans were dried.
-
Free Fatty Acid (FFA)
FFA is a quality parameter more than a safety one, but it’s a standard line on any serious cocoa spec sheet because it’s a reliable proxy for storage condition and bean integrity. FFA rises when lipase enzymes, often associated with mould activity, break down the fat in poorly stored or damaged beans.
The commonly cited commercial and regulatory reference point, originally set out in EEC Directive 73/241/EEC governing cocoa and chocolate products, is a maximum FFA content of 1.75% (expressed as oleic acid equivalent) in cocoa butter.
Industry research has found that in some origin countries, particularly during end-of-season stock in humid conditions, as much as 15 to 20% of a season’s production can carry elevated FFA. This is exactly why FFA testing on incoming lots, rather than relying solely on the exporter’s declared figure, is worth the marginal cost for high-volume buyers.
-
Foreign Matter and Insect Fragments
This category covers two related but distinct things: foreign matter (non-cocoa material like stones, sticks, or dust mixed into the lot) and filth defects (insect fragments, insect-damaged beans, and rodent contamination), the latter regulated directly by the U.S. FDA as legally enforceable “defect action levels” (DALs).
Foreign Matter (ISO 2451)
ISO 2451:2017 caps foreign matter at 0.75% of the mass of the reference sample, tested by a defined sieving method described in the standard’s own annex.
FDA Defect Action Levels: Raw Beans
The FDA’s Compliance Policy Guide CPG Sec. 515.775 (Cocoa Powder, Press Cake) sets the enforceable thresholds for the raw cocoa beans used to produce cocoa powder and press cake:
| Defect | FDA action level |
| Moldy beans | More than 4% by count |
| Insect-infested or insect-damaged beans | More than 4% by count |
| Combined reject (moldy + insect-damaged) | More than 6% by count |
A related guide, CPG Sec. 515.750, separately sets a mammalian excreta threshold of an average of 10 mg or more per pound of cocoa beans as grounds for enforcement action.
FDA Defect Action Levels: Finished Chocolate
For finished chocolate and chocolate liquor, a separate and frequently cited guide, CPG Sec. 515.700, sets the thresholds most people have actually heard of:
| Defect | FDA action level |
| Insect fragments (average across six 100 g subsamples) | 60 or more per 100 g |
| Insect fragments (any single subsample) | 90 or more, even if the average is under 60 |
| Rodent hair (average across six 100 g subsamples) | More than 1.0 per 100 g |
| Rodent hair (any single subsample) | More than 3, even if the average is below 1.0 |
These are enforcement thresholds for an FDA that already assumes good manufacturing practice, not a target to aim for. A well-run supply chain, with proper drying, clean storage, and pest-controlled warehousing, should produce results far below these ceilings as a matter of course.
-
What to Request From a Supplier
A complete cocoa certificate of analysis covers four categories. Use this as a verification checklist against any COA presented to you:
| Category | Parameters to confirm are present |
| Physical / sensory | Moisture %, bean count per 100 g, cut test result, foreign matter %, colour (Lab* for powder), particle size (D50/D90 for powder) |
| Chemical | Fat content %, pH (for alkalized powder), free fatty acid % |
| Contaminants | Ochratoxin A, cadmium, PAH4/benzo(a)pyrene, heavy metals panel |
| Microbiological | Total plate count, yeast, mould, Enterobacteriaceae, coliforms, E. coli, Salmonella |
Every COA must carry a batch/lot number, production date, testing laboratory name, and issue date. A COA missing the microbiological section, or one that reads as a generic template rather than a batch-specific result, is not a valid basis for shipment release. Request a batch-specific re-test before accepting the goods.
Pre-Shipment vs On-Arrival Testing
A complete buying programme requires both. They answer different questions.
-
Pre-shipment testing (at origin, before the container is sealed) confirms the product met specification at the point of loading. Moisture, FFA, mycotoxins, and the full microbiological panel must be verified here, and the verification should come from an independent third-party inspector (SGS, Bureau Veritas, Cotecna, or equivalent), not solely from the exporter’s in-house laboratory.
-
On-arrival testing (at destination, before cargo is released into the supply chain) catches what pre-shipment testing cannot: moisture pickup from transit condensation, temperature-driven mould growth, and pest ingress during a long or delayed voyage. Moisture, yeast, and mould are the parameters to re-test on arrival even when a clean pre-shipment COA already exists.
Sampling protocol determines whether either test result is meaningful. A single grab sample from one sack does not represent a 20-tonne lot. ISO 2292 specifies the sampling methodology for cocoa beans: how many increments to draw and how to build a representative composite sample from a bulk lot. Confirm that any inspection agency or supplier laboratory samples to this standard before accepting a result as representative of the shipment.
Frequently Asked Questions
What is a cocoa contaminant and microbiological specification sheet?
It is the certificate of analysis (COA) framework covering four categories: microbiological limits (Salmonella, Enterobacteriaceae, total plate count, yeast, mould), mycotoxins (ochratoxin A, aflatoxin), PAH4/benzo(a)pyrene, and physical parameters (moisture, free fatty acid, foreign matter). A complete COA reports a batch-specific result against each of these, not a generic product template.
Is Salmonella commonly found in cocoa beans?
No. Cocoa’s low water activity limits Salmonella survival, and roasting above 120°C is lethal to the organism. Detections trace to post-roasting contamination in a processing or packing facility, not the raw bean itself.
What sample size should a Salmonella test use?
25 g is the baseline industry test weight. 375 g, pooling several 25 g subsamples, is standard in premium buyer contracts because it raises statistical detection confidence on large lots. Either way, the required result is absence.
Is there a legally binding EU limit for Salmonella in cocoa?
No. Regulation (EC) No 2073/2005, the EU’s binding microbiological criteria regulation, does not list cocoa or cocoa powder among its regulated food categories. The absence-in-25g or absence-in-375g standard comes from CAOBISCO/ECA/FCC industry guidance, not statute.
What does an Enterobacteriaceae or coliform positive result mean?
It signals a hygiene control failure somewhere in processing, independent of whether the specific organism detected is itself pathogenic. Enterobacteriaceae is an indicator organism with a lower detection threshold than Salmonella, so it flags risk earlier and more often than a pathogen test alone would.
What do Total Plate Count, yeast, and mould results indicate together?
They quantify the aggregate microbiological load of a batch. The industry limits are 5,000 CFU/g maximum for TPC and 50 CFU/g maximum for both yeast and mould. A yeast or mould count approaching the limit indicates a moisture control failure and should be read against the batch’s moisture result, not in isolation.
What is the EU limit for ochratoxin A in cocoa?
3 µg/kg, applying only to cocoa powder, under EU Regulation 2023/915, in force since 1 January 2023. There is no EU limit for OTA in raw cocoa beans, cocoa mass, or cocoa butter, which means a buyer purchasing beans for in-house processing must set a bean-level OTA limit in the purchase contract, since none is imposed by regulation.
Why does OTA concentrate more in unshelled beans?
OTA accumulates disproportionately in the bean shell and outer layers relative to the nib. Deshelling before further processing measurably reduces OTA carryover into the finished powder, which is why shelling stage and method are relevant questions in a supplier audit.
Is there an EU aflatoxin limit for cocoa?
No. The EU has not established a maximum aflatoxin level for cocoa beans or cocoa products as of 2026, despite aflatoxins being classified as Group 1 carcinogens by the International Agency for Research on Cancer. Buyers requiring a limit must specify one contractually; Brazil (10 µg/kg for beans, 5 µg/kg for finished products) and Japan (10 µg/kg AFB1 import threshold) are the closest national reference points.
What causes ochratoxin A and aflatoxin contamination in cocoa?
Both mycotoxins form under the same conditions: beans dried too slowly, stored too damp, or held too long in humid conditions before drying begins. Neither forms during fermentation itself. Controlling moisture and drying speed at origin controls both risks simultaneously.
What is PAH4 and where does it come from in cocoa?
PAH4 is the sum of four polycyclic aromatic hydrocarbons: benzo(a)pyrene, benz(a)anthracene, benzo(b)fluoranthene, and chrysene. In cocoa, PAHs form from drying beans over open wood fires or with smoke-producing artificial dryers. It is a processing choice, not an inherent property of the bean, and is fully avoidable through sun-drying or indirect-heat drying.
What is the EU limit for PAH4 and benzo(a)pyrene in cocoa?
Under EU Regulation 2023/915, Annex I, point 6.1.2: 5.0 µg/kg fat maximum for benzo(a)pyrene alone, and 30.0 µg/kg fat maximum for the sum of PAH4. Both figures are expressed per kilogram of fat, not per kilogram of whole product, so results across product forms (beans versus butter, for example) are not directly comparable in absolute terms.
What moisture content should cocoa beans have?
8% maximum under ISO 2451:2017. Radad International specifies 7% to 7.5% on outbound shipments, a full percentage point tighter than the ISO ceiling, both because mould growth accelerates sharply as moisture approaches 8% and because that margin absorbs moisture pickup during ocean transit.
Why does moisture matter more than any single contaminant test?
Mould growth, yeast proliferation, and mycotoxin formation are all downstream consequences of moisture control failure. A single moisture reading is the most direct predictor of risk across nearly every other category in the specification sheet.
What is the free fatty acid (FFA) limit for cocoa butter?
1.75% maximum, expressed as oleic acid equivalent, under EEC Directive 73/241/EEC. FFA rises when lipase enzyme activity, typically driven by mould growth, breaks down bean fat during poor storage. It is a quality indicator of storage condition and bean integrity rather than a direct food-safety parameter.
What is the ISO limit for foreign matter in cocoa beans?
0.75% of sample mass maximum, under ISO 2451:2017, determined by the sieving method specified in the standard’s own annex. Foreign matter covers non-cocoa material such as stones, sticks, or dust mixed into the lot.
How many insect fragments are permitted in chocolate under FDA rules?
An average of 60 or more per 100 g across six subsamples, or 90 or more in any single subsample, constitutes an FDA enforcement action level under CPG Sec. 515.700. This is a legal adulteration threshold under 21 U.S.C. 342(a)(3), assuming otherwise compliant Good Manufacturing Practice; it is not a production target. A properly controlled facility produces results substantially below this ceiling as a routine outcome of correct process control.
What defect levels apply to raw cocoa beans under FDA rules?
Under CPG Sec. 515.775: more than 4% moldy beans by count, more than 4% insect-infested or insect-damaged beans by count, and more than 6% combined reject (moldy plus insect-damaged) each constitute an action level. CPG Sec. 515.750 separately sets a mammalian excreta threshold of 10 mg or more per pound.
What should be tested pre-shipment versus on arrival?
Pre-shipment testing, ideally by an independent third-party inspector such as SGS, Bureau Veritas, or Cotecna, confirms the product met specification at the point of loading: moisture, FFA, mycotoxins, and the full microbiological panel. On-arrival testing catches what pre-shipment testing cannot: moisture pickup from transit condensation, temperature-driven mould growth, and pest ingress during a long or delayed voyage. Moisture, yeast, and mould are the parameters most worth re-testing on arrival even against a clean pre-shipment COA.
Why does a single grab sample from a shipment not represent the whole lot?
Cocoa is not homogenous within a lot; contamination and moisture levels can vary between sacks and even within a single sack. ISO 2292 specifies the sampling methodology for cocoa beans, defining how many increments to draw and how to build a representative composite sample from a bulk lot. A test result is only meaningful if the underlying sample was drawn to this standard.
