40 CFR 68: Chemical Accident Prevention and RMP Rule

Under 40 CFR Part 68, the chemical accident prevention requirements apply to any stationary source that holds a listed hazardous substance at or above its threshold quantity, and a covered facility must classify each process into one of three program levels, complete the required hazard and prevention work, coordinate with emergency responders, and file a Risk Management Plan with the EPA. The rule flows from Section 112(r) of the Clean Air Act, and civil penalties for noncompliance now reach $121,275 per day per violation, so knowing what the regulation demands is a live operational question rather than a paperwork exercise.

Is Your Facility Covered

Coverage turns on three defined terms: stationary source, process, and threshold quantity. A stationary source is any set of buildings, structures, equipment, or substance-emitting activities that belong to the same industrial group, sit on contiguous property, and operate under common control. Transportation and storage in transit are excluded, but transportation containers used for on-site storage or connected to loading equipment count. Naturally occurring hydrocarbon reservoirs are also excluded.¹

A process is any activity involving a regulated substance, including use, storage, manufacturing, handling, or on-site movement. Interconnected vessels count as one process, and so do separate vessels close enough that a release from one could involve the other.¹ If the maximum quantity of a regulated substance in a single process at any moment meets or exceeds its threshold, the facility is covered and the full framework applies.

Regulated Substances and Thresholds

The list of regulated substances lives in 40 CFR 68.130 and splits chemicals into toxic and flammable categories. Each has a threshold quantity in pounds, and the thresholds vary widely with the acute hazard of the substance.² Some highly toxic chemicals trigger coverage at 500 pounds, while less acutely toxic substances have limits of 10,000 or 20,000 pounds.³

A few common examples show the range:

Chlorine: 2,500 pounds
Anhydrous ammonia: 10,000 pounds
Propane: 10,000 pounds
Phosgene (carbonic dichloride): 500 pounds
Acrylonitrile: 20,000 pounds

The calculation counts all of the substance present across interconnected or closely situated vessels within a single process, not just what’s in one tank. If your inventory sits near a threshold, review the full EPA list carefully before assuming you’re below it.

Program Levels for Each Covered Process

Every covered process is assigned to Program 1, 2, or 3. The level drives how much analysis, documentation, and oversight the facility owes.

Program 1

Program 1 is the lightest tier. A process qualifies only if it has had no accidental release with off-site consequences in the five years before the most recent Risk Management Plan submission, and no public receptors such as homes, schools, or hospitals fall within the distance a worst-case release could travel.⁴ If either condition fails, the process does not qualify, and the five-year clock restarts from any disqualifying accident.⁵

Program 3

Program 3 is the most demanding tier. A process lands here if it doesn’t qualify for Program 1 and either falls under specific high-risk NAICS codes or is already covered by OSHA’s Process Safety Management standard. The triggering codes include pulp mills (32211), petroleum refineries (32411), petrochemical manufacturing (32511), and certain basic chemical manufacturing operations (325181 and 325188).⁶

Program 2

Everything else defaults to Program 2. It requires a hazard review, operating procedures, training, maintenance, compliance audits, and incident investigation, but the analytical depth sits below Program 3’s full process hazard analysis.

Hazard Assessment

Every covered process needs a hazard assessment, with scope varying by program level. It has three parts: a worst-case release scenario, alternative release scenarios, and a five-year accident history.

Worst-Case Release Scenario

The worst-case analysis assumes complete release of the largest quantity held in a single vessel or pipe within the process. For toxic gases, the model assumes the entire quantity escapes as a gas over ten minutes. For toxic liquids, the full volume spills instantly and forms a pool, with the volatilization rate calculated at the highest daily maximum temperature recorded in the past three years.⁷ Flammables are modeled as a vapor cloud explosion. Passive mitigation like containment dikes counts; active systems like sprinklers do not. Results feed the Risk Management Plan and reach local emergency planning committees.

Alternative Release Scenarios

Alternative scenarios model releases that are more likely than the worst case, typically pipe ruptures, valve malfunctions, or gasket leaks rather than total vessel loss. Operators have more flexibility in the assumptions, and the resulting planning distances are more realistic for day-to-day preparedness.

Five-Year Accident History

Each covered process must document accidental releases for the five years before the plan submission: date, time, substance, estimated quantity, and consequences including injuries, fatalities, property damage, environmental harm, and off-site impacts. This record determines Program 1 eligibility and surfaces recurring patterns.

Prevention Program

For Program 2 and Program 3 processes, prevention program requirements overlap heavily with OSHA’s Process Safety Management standard. Operating procedures must be written, current, and accessible to every employee involved in the process. Mechanical integrity programs cover pressure vessels, piping, relief and vent systems, emergency shutdowns, and controls, with documented inspection schedules and deficiencies corrected before equipment returns to service. Training must ensure every worker understands the hazards, follows correct procedures, and can respond to equipment failures. Training and maintenance records anchor any audit.

Compliance Audits

Owners must evaluate compliance with the prevention program at least every three years, document findings, and correct deficiencies promptly.⁸ Under the 2024 SCCAP amendments, a facility that has had a reportable accident since its last audit must make the next scheduled audit a third-party audit conducted by an independent evaluator.⁹

Employee Participation for Program 3

Program 3 processes carry explicit employee participation rules. The facility must maintain a written plan for involving employees and distribute an annual notice explaining how workers and their representatives can access it. Employees knowledgeable in the process must have the authority to recommend a partial or complete unit shutdown when they believe a catastrophic release is possible, and a qualified operator in charge must be able to act on that recommendation. Facilities must also give employees a way to anonymously report unaddressed hazards, unreported accidents, or other noncompliance to the operator or directly to the EPA, with reports retained for at least three years.¹⁰

Emergency Response

The regulation divides facilities into responding and non-responding stationary sources. Responding facilities keep their own trained personnel and equipment. Non-responding facilities rely on local fire departments and hazmat teams. Both types owe coordination and exercise obligations.

Non-Responding Facilities

These facilities must coordinate with local emergency planning and response agencies at least annually, providing the emergency action plan, updated contacts, and other relevant materials. If local agencies decline to participate, the facility documents the attempts and keeps trying.¹¹ Annual notification drills verify that alert mechanisms work.

Exercises for Responding Facilities

Responding facilities follow a tiered exercise schedule:

Notification exercises at least once per calendar year to test emergency notification mechanisms.
Tabletop exercises at least once every three years, coordinated with local emergency response officials. The first was due by December 21, 2026.
Field exercises at least once every ten years, with the first due by March 15, 2027, unless local agencies agree in writing that this frequency is impractical.

These frequencies are minimums; the facility and local officials may agree on more frequent exercises.¹²

The Risk Management Plan

The Risk Management Plan pulls the required work into one document. Submission is electronic only, through the EPA’s RMP*eSubmit software.¹³ Access runs through the EPA’s Central Data Exchange, which requires a registered account and a completed Electronic Signature Agreement before upload.¹⁴

The plan contains:

An executive summary of safety policies, primary chemicals, and release-reduction steps.
Registration information: facility name, location, owner contacts, and the person implementing the program.
Off-site consequence analysis: worst-case and alternative scenario modeling, estimated affected population, and impact distances.
The five-year accident history.
Prevention program details for Program 2 and Program 3 processes, including the dates of the most recent safety audit and hazard review.
The emergency response program: responding or non-responding status and coordination with local agencies.

Accurate facility coordinates matter. Regulators map them against surrounding population, and errors delay certification.

Update and Resubmission Schedule

Risk Management Plans require a full update and resubmission at least once every five years, running from the initial submission or the most recent triggered update, whichever is later.¹⁵ Several events force an earlier update:

Any change requiring a revised process hazard analysis or hazard review: update within six months.
Operational changes altering worst-case or alternative release modeling: update within six months.
A change that alters the program level of any covered process: update within six months.
A new regulated substance entering an existing process: update no later than the date the substance first exceeds the threshold.
A newly listed substance: update within three years of EPA adding it to the list.
A reportable accident: correct the plan to include the accident and investigation results within six months.

Any six-month or immediate trigger resets the five-year clock, so the next full update runs from that submission rather than the original filing.¹⁶

2024 SCCAP Amendments

The EPA’s 2024 Safer Communities by Chemical Accident Prevention (SCCAP) rule significantly expanded Part 68. Most new provisions carry a compliance deadline of May 10, 2027, three years after the rule’s effective date. As of early 2026, the EPA has published a Federal Register notice revisiting certain provisions, so operators should monitor for changes.

The main additions:

Safer Technology and Alternatives Analysis. All Program 3 processes in NAICS 324 (petroleum and coal products) and 325 (chemical manufacturing) must evaluate inherently safer technologies and designs. Facilities within one mile of another Program 3 NAICS 324 or 325 process, and those with hydrofluoric acid alkylation processes, must go further and assess the practicability of implementing those alternatives.⁹
Root cause analysis. After any reportable accidental release, the incident investigation must include a formal root cause analysis rather than stopping at the immediate cause.
Third-party compliance audits after a reportable accident, as described above.
Natural hazard assessments. Process hazard analyses must consider flooding, seismic activity, and extreme weather that could cause or worsen a release.
Public information disclosure. Facilities must provide chemical hazard information on request, including the names of regulated substances in each process, safety data sheets, the five-year accident history, emergency response program details, and scheduled exercise dates.

The STAA requirement is the biggest operational shift for affected industries. A facility subject to the practicability assessment that declines to adopt a recommended safer technology must include a written justification in its Risk Management Plan explaining why.⁹

Enforcement and Penalties

The Clean Air Act gives the EPA broad enforcement authority over Part 68. The agency can issue compliance orders, pursue administrative penalties, or bring civil actions in federal court, and it inspects facilities to verify that on-site conditions match what the Risk Management Plan reports.¹⁷

Civil penalties are adjusted for inflation and currently reach $121,275 per day per violation. That figure applies to violations occurring after November 2, 2015, with penalties assessed on or after December 27, 2023, and the amount will keep rising with future inflation adjustments. A missed submission or inaccurate filing can accumulate daily penalties quickly, and organized records of submission receipts, electronic signature approvals, and compliance documentation are the most reliable defense.

1
eCFR. 40 CFR 68.3 – Definitions
2
eCFR. 40 CFR 68.130 – List of Substances
3
US EPA. List of Regulated Substances under the Risk Management Program
4
US EPA. Program 1 Five-year Accident History and Hazard Assessment Differences
5
US EPA. Program Level 1 Eligibility and Accident History
6
eCFR. 40 CFR 68.10 – Applicability
7
eCFR. 40 CFR 68.25 – Worst-case Release Scenario Analysis
8
eCFR. 40 CFR Part 68 – Chemical Accident Prevention Provisions
9
U.S. Environmental Protection Agency. Fact Sheet for Regulated Facilities: Safer Communities by Chemical Accident Prevention – Risk Management Program Final Rule
10
eCFR. 40 CFR 68.83 – Employee Participation
11
Environmental Protection Agency. Emergency Response
12
eCFR. 40 CFR 68.96 – Emergency Response Exercises
13
US EPA. How to Submit a Risk Management Plan (RMP) to EPA
14
U.S. Environmental Protection Agency. RMP*eSubmit
15
eCFR. 40 CFR 68.190 – Updates
16
US EPA. When Must RMPs Be Submitted, Updated, and Corrected?
17
Office of the Law Revision Counsel. 42 U.S. Code 7413 – Federal Enforcement