Security Vision and Responsibility
One named person owns this and has the authority to hold a shipment. Validations go badly when the answer to who decides is a committee.
Trade Tools · Supply chain security
CTPAT, and why it is harder to put off than it used to be.
The Customs Trade Partnership Against Terrorism is a voluntary program: you meet a published set of security criteria, and CBP treats your cargo as lower risk. This page covers what the criteria actually require, what a validation looks for, and what has changed to make the calculation different from the one most importers last ran. We are a member, and we file for importers who are and importers who are not.
There is now a date on this
The Strengthening Customs Enforcement executive order, signed 3 June 2026, gives CBP 180 days to rewrite the importer eligibility rules — the end of November 2026. Within that window a foreign importer of record is to be barred from filing informal entries, and required either to be validated in CTPAT or to file through a CTPAT validated licensed customs broker. If you import into the United States from abroad in your own name, this is the paragraph to read twice.
The program
What CTPAT actually is
CTPAT began in 2001 and was written into law by the SAFE Port Act of 2006. The bargain is straightforward. You document how you secure your supply chain against the published Minimum Security Criteria for your entity type. CBP reviews it, certifies you, and then sends a Supply Chain Security Specialist to check that the document describes the company. In return your cargo is scored as lower risk, so it is selected for examination less often, and when it is selected it goes to the front of the queue.
Two things about it are commonly misunderstood. It is not a certificate you buy — there is no fee, and no consultant can issue it. And it is not a one-off: the criteria are written as musts and shoulds against risk, membership is revalidated on a cycle, and the evidence has to keep existing in between.
There is a second layer above it rather than beside it. CTPAT Trade Compliance looks at how you comply with the customs regulations themselves rather than at how you secure the cargo, and it is open to U.S. and non-resident Canadian importers who are already Tier 2 or Tier 3 members of the security program in good standing. You reach it through CTPAT; you do not reach it instead.
Why now
Five things changed underneath the decision
The program has been there for two decades and the case for joining used to be a narrow one about examination rates. Four of these five have nothing to do with examination rates.
- Executive order
Strengthening Customs Enforcement put CTPAT in the eligibility rules
The executive order signed on 3 June 2026 directs DHS and CBP to tighten who may act as an importer of record, what they must post, and how hard their broker must look at them. It gives CBP 180 days to revise the importer eligibility regulations, which puts the operative date at the end of November 2026.
The weight of it falls on foreign importers of record, and it falls in two places. The informal entry route closes to them altogether. And what replaces the old eligibility test is a choice: hold CTPAT validation in your own name, where CBP determines you eligible for it, or file through a broker that holds it. There is no third option in the text. For a foreign IOR the program stops being a way to be examined less and becomes a condition of being allowed to file.
It reaches every other importer through bonds and vetting, which the questions below set out. What it does not yet do is define its own terms: the order says validated, and CBP has not published the regulations that would say whether an existing certification satisfies that. The requirement is real. Its precise shape is not settled, and November is not far away.
- Forced labor
Section 3.9 stopped being optional
In January 2023 the forced labor criterion in the Minimum Security Criteria moved from a should to a must for importers, exporters and foreign manufacturers. You are expected to hold a documented social compliance program showing how you satisfy yourself that your goods were not mined, produced or manufactured, wholly or in part, with prohibited forms of labor.
Set that beside the Uyghur Forced Labor Prevention Act, where goods with a Xinjiang nexus are presumed inadmissible unless you rebut it, and the two ask for the same underlying thing: a supply chain you can map and evidence. CTPAT is where most importers already keep that map.
- Validation
A binder is no longer the answer
Validations have become evidence-driven. The officer does not simply read what your self-assessment says you do — they pull the entry record and reconcile it against the claim. If the assessment says ISF is filed 24 hours before loading, the question is what the filings actually show.
The gap that matters is not between your policy and the criteria. It is between your policy and your own practice.
- Volume
De minimis is gone, and entry counts rise with it
Duty-free de minimis treatment was suspended for all countries, international mail included, on 29 August 2025 by executive order 14324. CBP then suspended the exemption in the regulations indefinitely, and the postal informal entry process that replaced the old paper mail entry took effect on 24 July 2026, with a compliance date of 22 October 2026 for shipments carrying partner government agency data, Chapter 98 or 99 duties, or a free trade agreement claim.
So mail now moves on an informal entry, or a formal entry where the value or the commodity requires one. Entry type 13 is a voluntary electronic alternative CBP is testing, opening at the end of that compliance window — worth watching, not yet something to plan around.
The consequence for this page is arithmetic. Exposure scales with entries, and a program that felt like overhead at a few hundred entries a year reads differently at several thousand, because every one of them is a line CBP can select and every one of them carries your name.
- Cost
An exam costs more than it used to
The delay has not changed much. What has changed is the invoice sitting behind it. With Section 301 and Section 232 duty stacked on top of the general rate, the cargo held for examination is worth more, the demurrage and per-diem run against a larger number, and the working capital tied up is larger too.
Fewer exams and front-of-line treatment when one does happen are worth what your cargo is worth — which is more than it was.
The criteria
Where companies actually lose points
CBP publishes the Minimum Security Criteria in full, and you should read the set for your own entity type rather than a summary of it. What follows is the shape of it — twelve categories across three focus areas — with a note on each saying what the criterion is not going to tell you.
Corporate Security
Who owns security, what you assessed, who you let near the cargo, and how your systems are protected.
Risk Assessment
The five-step assessment run against your actual top lanes. It is the first document CBP asks for and the one most often copied from a sample.
Business Partners
You have to show how you screened everyone who touches the cargo — supplier, co-loader, drayman, broker. A list of names is not screening.
Cybersecurity
A written policy, access control that is actually enforced, and evidence the equipment checks happened on the dates the policy claims.
Transportation Security
The physical chain of custody, from the container being stuffed to the entry being filed.
Conveyance and Instruments of International Traffic Security
Inspections at each point the cargo changes hands, recorded at the time. Reconstructed records read as reconstructed records.
Seal Security
ISO 17712 high-security seals, a written SOP, and a seal log that reconciles to the bill. Seal numbers that do not match the paperwork are the quickest route to a finding.
Procedural Security
Where the paperwork stops agreeing with itself: master and house bill naming different parties, a weight nobody reconciled, a description written for the seller rather than the tariff.
Agricultural Security
Wood packaging to ISPM 15 and a pest contamination procedure someone has been trained on. This one is cheap to fix and expensive to fail.
People and Physical Security
The site, the staff, and whether anyone can show what they were taught.
Physical Access Controls
The joiners are usually handled. It is the leavers that fail: badges not returned, accounts not closed, a visitor log with no time out beside the time in.
Physical Security
Fencing, lighting, alarms and cameras — with recording retention long enough to still be useful once you know what you are looking for.
Personnel Security
Background screening proportionate to the role, and revisited rather than done once. A file that was clean in 2019 is evidence about 2019.
Education, Training and Awareness
Training with a roster and dates against it. Untracked training is, for validation purposes, no training.
Each criterion is designated a must or a should according to risk. A should is not a suggestion you can leave blank — it is one you have to be able to justify not doing.
What JFS does
Where a broker fits into this
Where we stand, in the word the order uses
JFS CHB, Inc. is a licensed U.S. customs broker, CBP filer code 82G, and CTPAT validated. Validated is the word the executive order uses, and inside CTPAT it is a defined status rather than a synonym for membership — a member reaches it by completing a validation, not by applying. So for a foreign importer of record weighing the second route, this is the specific answer to the specific question: we hold the status the order names, and we will put it in writing for your business partner file. Ask the next broker the same question and see whether the answer is as specific.
We screen you the way CBP expects us to
Before we file on your behalf we run identity verification, denied-party and sanctions screening, and an assessment against the minimum security criteria. That is not friction we invented — it is the business partner criterion applied to you. It is built into our client intake, and it is why onboarding takes 24 to 48 hours rather than an afternoon. The June 2026 executive order put penalties behind it, directing the maximum at brokers who fail to conduct due diligence on their clients. A broker who waves you through is not doing you a favor.
We keep the binder you will be asked for
Consolidated risk assessment, business partner packet, seals SOP, wood packaging and agriculture handling procedures, IT security and equipment check procedures, hiring policy, employee handbook and a signed-handbook tracker. We maintain ours on an annual review cycle. That is the list, and it is the same list you will be asked for.
And what we do not do
We are a customs broker, not a guard service or a security integrator. We will not sell you fencing, cameras or a background-check subscription. Where a criterion needs physical work at your site, we will tell you what CBP is looking for and leave the procurement to you.
Questions
Common questions about CTPAT
I am a foreign importer of record. Does the executive order mean I have to join CTPAT?
It gives you two routes rather than one obligation, and the order is set out above. Joining is one of them. The other is to file through a broker that is CTPAT validated and licensed — which for most foreign importers is the faster route, because it does not turn on your own operation passing a validation before the end of November.
Read the second route carefully, because the order says validated, and inside CTPAT that is a defined status rather than a synonym for membership. Whether a broker holding certification alone satisfies it is one of the questions CBP has not yet answered, which makes it the question to put to any broker you are considering. Expect a specific answer rather than a logo. Ours: JFS CHB is CTPAT validated.
Plan on the requirement. Do not plan on a reading of it.
What else does the executive order change for importers?
Every importer of record, foreign or domestic, is to hold a bond or a minimum level of tangible domestic assets, or both, covering formal and informal entries — and CBP is directed to raise the minimum bond amounts through rulemaking. If you are running a minimum continuous bond today, expect that figure to move.
Foreign importers of record get a sharper version of the same provision: they are not to rely on a continuous bond for formal entries except where CBP is satisfied the revenue is fully protected. If you are foreign and running a continuous bond, that is the line to read before the bond one.
The order also establishes recurrent vetting — not vetting once at onboarding, but repeated — of importers, their affiliates, customs brokers, freight forwarders and custodians of bonded merchandise.
Is CTPAT mandatory?
As a program, no. CTPAT is a voluntary public-private partnership, and a U.S. importer that never joins is not out of compliance.
The qualification is new and it is narrow. Under the June 2026 executive order, a foreign importer of record has to be validated in CTPAT or file through a CTPAT validated licensed customs broker once CBP writes the rules. That is not the program becoming mandatory; it is CTPAT being used as a gate on one category of filer.
Beyond that the pressure is commercial rather than legal. Once your customers, your carriers and your customers' customers all ask for it, voluntary starts to mean something closer to expected.
We are small. Is CTPAT worth it for us?
Eligibility is by entity type rather than by size, so being small is not what keeps you out. Whether it is worth it is a different question, and for a lot of small importers the answer is not yet.
The test we would apply: are your shipments actually being selected, is a customer or a carrier asking you for it, and are you a foreign importer of record — because that last one is now close to decisive. If none of those is true, the criteria are still worth reading as a checklist, and the membership can wait.
What does not justify it is a logo for the website. The obligations continue after the certificate arrives, and a lapsed profile is worse than never having applied.
How long does certification take, and then what?
CBP reviews the application and security profile and, if it is accepted, certifies the company. Validation follows — a Supply Chain Security Specialist goes through the profile against what is actually happening, typically within about a year of certification, and revalidation comes around on a cycle of roughly four years after that.
The honest answer on effort is that the application is the small part. The risk assessment, the written procedures and the training records are the work, and they are the work whether or not you join.
Does CTPAT stop my shipments being examined?
No, and any broker who tells you otherwise is selling something. CBP retains the authority to examine any shipment, and members are examined.
It changes frequency and duration, not the authority. It confers no immunity, and it does not reduce a cent of duty.
Does my customs broker need to be CTPAT certified?
Not as a general rule. But your broker is a business partner in your supply chain, so under the business partner criterion you have to screen them and document what you found — and a broker who is already a member gives you a certification to file rather than a questionnaire to chase.
The exception is the one above: if you are a foreign importer of record, the executive order makes your broker's CTPAT status one of your two routes to being able to file at all.
What has CTPAT got to do with forced labor and the UFLPA?
They are separate regimes that have converged on the same evidence. The UFLPA presumes that goods mined, produced or manufactured wholly or in part in Xinjiang, or by an entity on the UFLPA Entity List, were made with forced labor and are therefore prohibited. The presumption is rebuttable, but the standard is high: you must comply fully with the guidance, answer CBP's questions completely, and show by clear and convincing evidence that the supply chain is free of forced labor. Most rebuttals fail on that standard rather than on the tracing.
The CTPAT criteria now require a documented social compliance program addressing prohibited labor, and the CTPAT Trade Compliance program goes further, asking for risk-based mapping of the supply chain in its entirety. That work does not answer a detention on its own — an applicability review asks for production, payroll and transportation records at transaction level, which a program document is not. What it does is mean you know your own supply chain before someone asks you to prove it, which is the part that cannot be assembled after the container is already detained.
Is CTPAT the same as AEO?
Not the same, but related. AEO — Authorized Economic Operator — is the equivalent concept under the World Customs Organization framework, implemented by customs administrations around the world.
CBP has signed mutual recognition arrangements with a number of them, so CTPAT membership can earn your goods lower-risk treatment in a partner country as well. Which arrangements apply depends on where you ship; it is worth checking before you count on it.
Start here
If you are weighing it, or if you already joined.
If you are weighing whether to apply, we can tell you what a validation actually asked us for and where the work sits — which is in the risk assessment and the procedures, not the form. If you are already a member and want your broker on file as one too, the intake collects what your business partner screening needs.
Last reviewed 22 August 2026. The central claim on this page is a rulemaking that has not happened yet. Dates and requirements are stated as CBP and the executive order have them today, and this page is reviewed against current CBP guidance.
JFS CHB, Inc. — licensed U.S. customs broker, CBP filer code 82G, CTPAT member. This page explains a CBP program in general terms and is not legal advice. Read the Minimum Security Criteria for your own entity type on cbp.gov before relying on any summary, this one included.