CBP Will Start Voiding Importer Numbers on September 18. Here Is Exactly What It Is Checking, and Why the Fixes Are Not as Simple as They Look

On August 19, 2026, CBP published a general notice in the Federal Register titled "Accuracy of Importer of Record Data Submitted to CBP." Starting September 18, 2026, CBP will immediately void any importer of record number where the information on CBP Form 5106 is inaccurate or incomplete. A voided number is invalid for every purpose, including making entry. Cargo tied to a voided number stops at the port without advance warning.

This post explains what CBP is actually verifying, why several standard industry practices now qualify as defects, what happens after a number gets voided, and the specific steps to take before the enforcement date.

Where this comes from

On June 3, 2026, President Trump signed Executive Order 14411, "Strengthening Customs Enforcement." Section 2(e) of that order directs the Secretary of Homeland Security to confirm that active importers of record are compliant with applicable regulations and disclosures. The August 19 notice is CBP's first concrete implementation step under that directive, and it moves faster and further than many in the trade expected.

CBP states it is comprehensively reviewing Form 5106 data for all importers of record, not sampling or reviewing on request. That matches the pattern CBP has already shown this year. Earlier in 2026, the agency deactivated roughly 4.8 million importer of record accounts that had not filed an entry within the preceding year. The Form 5106 accuracy review applies the same systematic, registry-wide approach to a different question: not whether an account is active, but whether the data behind it is real.

What CBP Form 5106 is

Form 5106, formally the Create/Update Importer Identity Form, is the document that establishes an importer's identity and registration information with CBP: legal name, tax identification number, physical address, mailing address, and contact information. It is the record CBP relies on to know who an importer actually is.

The three data elements under review

CBP identified three fields specifically that must be complete and accurate, and each carries a definition tighter than common industry practice has treated it.

The physical address must be the actual physical location of the business or individual. CBP expressly excludes a registered agent's address, a customs broker's address, a freight forwarder's address, a P.O. box, a business service center, or the address of any other party. Form 5106 instructions do allow a principal's home address to serve as the business address, which gives small and home-based importers a legitimate path, but a third party's commercial address does not qualify regardless of how long that practice has gone unquestioned.

The email address must be valid and must belong to the importer of record. A broker or other third party substituting its own address, even for administrative convenience, does not satisfy the requirement.

The phone number carries the identical standard. It must be valid and must belong to the IOR, not a number associated with a broker, forwarder, or other party managing the account.

Who this actually captures

Several categories of importers are structurally likely to have a defective record under this standard, often without realizing it.

Non-resident importers who listed a U.S. broker's address because they have no physical premises in the United States. Delivered duty paid arrangements where the foreign seller is technically the importer of record but the forwarder's contact information populated the record for practical convenience. E-commerce sellers using a third-party fulfillment center's address as their own. And any importer whose accountant, registered agent, or broker completed the original Form 5106 years ago using their own contact information, a common shortcut that was never revisited as the business grew.

None of these arrangements were necessarily improper at the time they were set up. They are, under this notice, now defects that trigger an immediate voiding.

The notification problem

This is the detail that makes the rule more consequential than a routine compliance update. CBP will send written notice of a voiding to the most recent email address the IOR submitted to CBP. Where applicable, CBP will copy the customs broker that last filed an entry on the importer's behalf.

Read that against the requirement that the email address belong to the importer, and a circular problem emerges. The importers most likely to have a defective email address on file, because a broker or forwarder's address has been sitting in that field for years, are precisely the importers least likely to actually receive the notice telling them their number has been voided. They may not learn of the problem until a broker attempts to file an entry and the transaction is rejected.

The notice does not describe a pre-deprivation process. CBP is not proposing to issue a request for information, offer a cure period, or hold a hearing before voiding a number. The voiding happens first. Reestablishment happens afterward, on a timeline CBP has not published, through an email inbox at IORProgram@cbp.dhs.gov using the subject line "Enforcing IOR Accuracy."

The liability extends past the voided number itself

CBP's framing of this issue carries legal weight beyond the immediate operational disruption. The notice states that inaccurate or misleading Form 5106 information is material to an obligation to pay money to CBP, language that connects directly to False Claims Act exposure under 31 U.S.C. 3729, a statute that carries treble damages and allows qui tam whistleblower suits.

The certifying party on a Form 5106 may also face fines or imprisonment under 18 U.S.C. 1001 for an intentional false statement. For customs brokers, the exposure runs through separate channels: due diligence obligations under 19 CFR 111.29(a), the prohibition on transmitting false or misleading information under 19 CFR 111.32, and monetary penalties under 19 U.S.C. 1641. Brokers must also hold a power of attorney executed directly with the importer under 19 CFR 111.36(c)(3); a POA obtained through a freight forwarder rather than the importer itself does not satisfy the regulation.

For a brokerage, the scale of exposure compounds quickly. A brokerage that populated its own address, email, or phone number across hundreds of client records now has hundreds of individually defective certifications, each one a separate instance of unverified information transmitted to CBP.

What to do before September 18

The corrective sequence has a specific order that matters.

Start by pulling the actual data CBP has on file, through your broker or directly through the ACE Secure Data Portal, rather than assuming your records match what you believe was submitted.

Test each field against the disqualifying criteria described above. For the physical address, the honest test is whether a CBP officer visiting that address would find the business actually operating there. If the address involves a mail service, a registered agent, an accountant, a lawyer, a broker, or a forwarder, it needs to change.

Assign an email address the importer actually owns and monitors. This is the single highest-value fix available, because it is also the channel through which CBP delivers the voiding notice if something goes wrong later. Use a domain the importer controls and route it to a mailbox a compliance-responsible employee actually reads, not a single individual who may leave the company.

Brokers should audit their full portfolio of powers of attorney to confirm each was executed directly with the importer, with a signer who had actual authority to bind the entity. POAs obtained through a forwarder should be re-executed proactively rather than discovered as a gap after CBP raises the question.

Non-resident importers and businesses operating under DDP structures should treat this as more than a data correction. A foreign entity acting as IOR without any U.S. physical presence is a structural issue, and that analysis connects to the broader eligibility framework Executive Order 14411 is setting in motion, including bonding, tangible domestic asset, and good standing requirements still to be defined through future rulemaking.

Corrections should go through the proper channel and be documented: filed via ABI or by email to the assigned Center of Excellence and Expertise, with the submission, date, and CBP's confirmation retained for the record.

One point deserves particular care. If a prior certification was knowingly inaccurate, correcting it now may itself function as an admission, and that correction should be sequenced with legal counsel rather than filed in isolation, particularly given the False Claims Act exposure described above.

Finally, treat Form 5106 accuracy as an ongoing compliance control rather than a one-time fix. Address changes, entity restructurings, and personnel departures all have the potential to break a record that is accurate today.

What is actually at stake

Importers who complete this review before September 18 keep their number active and their entries moving while others discover the problem after cargo is already held at the port, accruing demurrage and general order exposure with no published resolution timeline. An accurate Form 5106 record also removes a straightforward point of attack in any future penalty proceeding, since CBP or the Department of Justice would otherwise be able to point to a defective certification as evidence relevant to reasonable care.

For brokers, completing a full portfolio audit of POAs and contact data converts a latent exposure under 19 U.S.C. 1641 into a documented record of due diligence, which is precisely what distinguishes a brokerage that transmitted unverified information from one that exercised the diligence the regulations require.

We are reviewing client Form 5106 records and broker POA files ahead of the September 18 date. If you want your records checked before the enforcement date arrives, reach out to your ShipTech account manager.