Your IOR Data Has 30 Days: CBP Starts Voiding Importer Numbers September 18

Executive Summary

CBP published a general notice on August 19, 2026 (91 FR 53627) implementing Executive Order 14411. Starting September 18, inaccurate or incomplete information on CBP Form 5106 can get your Importer of Record (IOR) number voided, and a voided number won’t clear merchandise. CBP has confirmed it’s reviewing records already on file, so long-established importers are covered too. Your physical address, email, and phone all have to belong to you. Check your IOR data in the ACE Portal now.

Intro

The phone number CBP has for your company probably rings a desk that was cleared out years ago, and until last week that was nobody’s problem. But now it’s yours. 

CBP published a notice on August 19 saying it’s reviewing the IOR data it holds on file tied to Form 5106. And starting September 18, the agency will void importer numbers whose information doesn’t hold up. 

For the record, voided means your entries stop, and they stay stopped until you can prove to CBP that you’re the company your record says you are.

The part worth sitting with is who’s covered. This reaches back through records that have been in the system for decades, so a long run of clean entries doesn’t earn you a pass. 

The good news, though, is you can see exactly what CBP sees, and you’ve got a month to sort out anything that doesn’t line up.

What CBP Announced, and What Changes Next Month

First and foremost, let’s look a little closer at the two dates running this whole thing.

August 18, 2026: CBP Files the Notice

The notice hit Public Inspection on August 18 and landed in the Federal Register the next morning as 91 FR 53627. 

What it says is that CBP intends to verify the Form 5106 information behind every importer in its system, whether the account opened last month or in 1998. The authority comes from Section 2(e) of Executive Order 14411, which put DHS on the hook for confirming that active IORs are compliant with the regulations and disclosures that apply to them. 

When we covered that order in June, it was a page of deadlines with nothing behind them yet. But now it has teeth.  

September 18, 2026: CBP Starts Voiding Numbers

Thirty days later, enforcement begins. If CBP decides an importer or a broker acting on its behalf failed to give complete and accurate information, the agency voids the IOR number on the spot. A voided number is invalid for every purpose, including entry of merchandise into the United States.

What IOR Data Is CBP Checking?

CBP Form 5106 carries six required fields, and all six are in scope:

• Importer name
• EIN, SSN, or CBP-assigned number
• Mailing address
• Physical location address, where it differs from the mailing address
• Phone number
• Email address

The form also collects optional detail on business structure, beneficial ownership, and company officers.

One word in the notice deserves your attention: comprehensively. CBP says it’s comprehensively reviewing the Form 5106 information already on file. That sweeps in accounts opened in 2009 by an employee who has since retired, plus every company that has relocated, merged, rebranded, or been acquired since. The rule in 19 CFR 24.5 has said the same thing for years.  

Why Your Broker’s Address Can’t Be Your Physical Address

All six fields are in scope, but CBP didn’t treat them equally. Three of them got their own paragraphs in the notice, spelled out in more detail than the rest, and that’s a fair signal of where the agency expects to find problems.

The Three Fields CBP Called Out

• Physical address: Has to be where your business actually sits.
• Email address: Has to be valid and belong to you.
• Phone number: Same rule, and it has to reach you.

What links them is that all three are contact points. CBP is asking a simple question of every importer record it holds: if we needed to reach this company tomorrow, could we?

What Won’t Count as a Physical Address

The physical address drew the most attention, and CBP listed what it won’t accept:

• A registered agent
• A customs broker
• A freight forwarder
• A P.O. box
• A business service center
• Any other person or entity’s address

Email and phone come at it from the opposite direction. Rather than listing what’s out, the notice says a broker or third party can’t substitute its own contact information for the importer’s. Different wording, same idea.

Who This Hits Most

Read the two rules together, and the target comes into focus. If a forwarder set up your importer record as a favor back when you were starting out, it probably carries their office address and their phone. Because those were the details they had in front of them. DDP arrangements and nonresident importer structures tend to look the same way for the same reason.

What Your Broker Owes You Here

Your broker won’t be caught off guard by any of this. Due diligence has been part of the job under 19 CFR 111.29 for years. The direct relationship with you came later. 

CBP modified 19 CFR 111.36 in 2022, requiring the IOR and customs house broker (CHB) to communicate directly and handle the power of attorney between themselves. Before that change took effect, a properly authorized freight forwarder could sit in the middle and provide the POA to the broker on the IOR’s behalf.

What’s changing now is how closely that relationship gets verified. Expect your customs broker to come back this fall asking for fresh paperwork on accounts they’ve handled for a decade, and treat that as the system working rather than a hassle.

Our CTPAT alert on EO 14411 breaks down what that scrutiny costs importers in time and money.

What Happens if CBP Voids Your IOR Number

Your entries stop. Cargo on the water, at an airport, or rolling toward a land border waits until the number gets reestablished. Here’s the sequence CBP describes:

1. CBP voids the number and issues a written notice explaining the basis for it.
2. That notice goes to the email address most recently submitted for the IOR.
3. The broker who last filed an entry gets copied.
4. Reestablishment requires corroborating the importer’s identity, with questions going to IORProgram@cbp.dhs.gov under the subject line "Enforcing IOR Accuracy."

Step two is worth a second look. If the address on file went stale in 2021, the message explaining why your number died lands in a mailbox no longer being read, and your first clue arrives as a phone call from your carrier.

Free time keeps burning while you sort it out. Demurrage and per diem accrue on an ocean container or an air shipment held over a phone number that changed three offices ago. 

CBP’s Strengthening Customs Enforcement page tracks the rest of the rollout, and Holland & Knight mapped the November milestones for eligibility rules and risk tiering.

How to Verify Your IOR Data Before September 18

Everything above is fixable, and none of it requires a compliance project. What it requires is seeing your own record, which most importers have never done. Five steps get you there.

‍

1. Get Into the ACE Secure Data Portal: The ACE Portal is the only place you can see your importer record yourself instead of asking someone to look it up for you. CBP automated the application in CSMS # 66674007 for companies that already have a 5106 on file.
2. Ask Your Broker for a Bond Query in the Meantime: Most importers still don’t have portal access. Of the 330,000-plus importers who paid duties, roughly 21,423 had completed electronic refund setup in ACE as of March, a figure we flagged in our advisory on ACE access. If you’re in that group, your broker can run an Importer/Bond Query that confirms your IOR name and physical address while your application works through the queue.
3. Walk the Six Data Points: Once you can see the record, check the legal IOR name, physical address, mailing address, EIN or SSN or CBP-assigned number, phone number, email address, and whether your broker holds a POA signed directly with you. Read each one against what’s true today rather than what you remember approving.
4. Fix the Email Before Anything Else: If CBP voids your number, the notice explaining why goes to the address on file, so a dead mailbox costs you the warning along with the number. Point it at a monitored internal group inbox that survives turnover instead of one person’s account. CBP requires the address to belong to the importer of record, so a broker’s or forwarder’s mailbox won’t satisfy it.
5. File the Corrections Through the Right Channel: Updates go through a licensed broker via ABI, or on a revised Form 5106 emailed to your assigned Center of Excellence and Expertise. Neither route is instant, which is the argument for starting now instead of in mid-September.

Verify Your IOR Data Before CBP Does

At Mallory Alexander International LLC, we received our CBP license in 1999, so we know a thing or two about maintaining records and powers of attorney. Our licensed customs brokerage team can pull a bond query on your IOR this week, walk your ACE Portal application through, compare what CBP holds against what’s true today, and file the corrections via ABI ahead of September 18. Our trade management and compliance group takes it from there.

Keeping brokerage, warehousing, and managed logistics with one provider gives you one set of records to reconcile when CBP asks a question. myMALLORY keeps the documents where you can reach them, and our case studies show how it plays out on live freight.

Contact us to review your IOR record before the deadline, or subscribe for the next EO 14411 update.