The Importer Number Is Now Perishable: CBP Starts Voiding IOR Records September 18th

Today, September 1st, 2026, is the date we flagged in Show Your Work: the day Executive Order 14411’s penalty mitigation floors take effect, and the discretion to negotiate a customs penalty down mostly disappears. As it turns out, the first concrete implementation of the order did not wait for today, and it did not arrive where most people were watching.

On August 19th, 2026, CBP published a Federal Register notice titled “Accuracy of Importer of Record Data Submitted to CBP” (91 FR 53627). It is short, it concerns a form most importers filled out once and forgot, and it carries a date: September 18th, 2026. From that day, if CBP determines that an importer of record - or a customs broker acting on the importer’s behalf - has failed to provide complete and accurate information on CBP Form 5106, CBP “will void the IOR number, rendering it invalid for any purpose.”

Invalid for any purpose includes making entry. An importer whose number is voided cannot clear goods, and the freight already on the water does not know that yet.

The form everyone filled out once

Form 5106 is the record that creates an importer of record number in the first place. It ties the number to an identity: the legal name, the IRS EIN (or SSN, or CBP-assigned number for non-residents), a physical address, a mailing address, an email address, a phone number. Every entry filed under that number rests on this record, which is precisely why it is so easy to forget. It is not shipment paperwork. It was set up once - often years ago, often by a broker as part of onboarding - and it has been quietly load-bearing ever since.

The notice turns three of its fields into enforcement surface:

• The physical address “must be the actual physical location of the business or individual.” The notice enumerates what does not qualify: a registered agent, a customs broker, a freight forwarder, a P.O. box, a business service center, or the address of any other person or entity.
• The email address must be valid and belong to the IOR. A broker or third party may not substitute its own.
• The phone number must be valid and belong to the IOR.

Read that list against how importer records actually get created, and the problem comes into focus. A broker onboarding a new client, or a forwarder setting up a non-resident importer for DDP shipments, has often used its own contact details as a convenience - the broker’s office as the address, the broker’s inbox as the email, so that nothing from CBP gets missed. Under the notice, every one of those conveniences is now a defect, and a defect is now grounds for voiding.

How a record drifts

Even records that were correct on the day of filing decay. Businesses move and the 5106 keeps the old address. Entities rename, merge, or restructure and the record keeps the old name against the old EIN. The person whose email went on the form leaves the company. Nothing in the entry process forces the record to be refreshed, so the gap between the registered identity and the operating one widens a little every year - invisibly, because until now nothing checked.

Two things changed this summer. In July, ACE began automatically deactivating importer numbers that had not filed an entry in at least a year - a dormancy sweep that has reportedly caught roughly 4.8 million accounts. And now the September 18th notice adds an accuracy sweep on top of it. Taken together, the direction is unmistakable: CBP is working through the IOR registry systematically, and it is treating the register as something to be actively policed rather than passively maintained. The authority it cites is Section 2(e) of EO 14411, which directs the Secretary to confirm that active importers of record “are compliant with all applicable regulations and disclosures.”

The notification trap

Here is the detail that should make operations teams sit up. When CBP voids a number, it “will issue a written notice of this action to an IOR to the email address the IOR most recently submitted to CBP,” with a copy to the broker that last filed entries, where applicable.

Notice the circularity. If the email on file is stale - the very defect that can trigger the voiding - the notice of voiding goes to an inbox nobody reads. The first observable symptom is not a letter. It is a rejected entry and cargo standing at the port, accruing storage, while someone works out why a number that cleared goods last week no longer exists. The notice does specify a correction channel - the voided IOR receives instructions on what documentation will corroborate its identity, and general inquiries go to IORProgram@cbp.dhs.gov with the subject line “Enforcing IOR Accuracy” - but reactivation is not instant. Brokers report that even routine dormancy reactivations are taking up to several weeks given current ACE backlogs.

What it means for brokers

The notice is addressed to importers, but a large share of its citations point at brokers. Submitting inaccurate 5106 data exposes the certifying party to 18 U.S.C. 1001, and the notice invokes the False Claims Act alongside it. For brokers specifically it cites the due diligence obligation of 19 CFR 111.29(a), the prohibition on transmitting false information in 19 CFR 111.32, penalties under 19 U.S.C. 1641 - and 19 CFR 111.36(c)(3), the requirement that the power of attorney be executed directly with the importer of record, not passed through a freight forwarder or another intermediary.

That last one deserves attention. POA chains that route through forwarders are common in DDP and non-resident importer arrangements, and they are exactly the structures where the 5106 contact fields are most likely to hold someone else’s details. This is the “fail to conduct due diligence” language of EO 14411’s broker section acquiring its first specific, checkable meaning - a pattern worth expecting more of as the implementing rules arrive.

Seventeen days: a working checklist

What a desk can actually do before September 18th:

1. Pull the current 5106 record for every active importer you file for - through the ACE Secure Data Portal, or through your broker.
2. Test the three fields against the exclusion list. Is the physical address the importer’s own operating location? Does the email belong to the importer? Does the phone? Any broker, forwarder, agent, or service-center detail in those fields is a defect by definition, however it got there.
3. Fix email ownership first. It is both a voiding trigger and the only channel CBP will use to tell you about a voiding. An owned, monitored inbox is the difference between a correction letter and a stopped container.
4. Audit the POAs. Any power of attorney executed through a forwarder rather than directly with the IOR should be re-papered.
5. Check what your documents say against what the register says. The party blocks on commercial invoices and bills of lading are where identity drift shows up first: a new operating address on the paperwork while the 5106 still holds the old one, a renamed entity invoicing under a name the register has never heard of. We catalogued these as the top errors in The 15 Most Common Commercial Invoice Errors, and the same cross-reading that customs applies to a document bundle applies here - the file contradicting the register is the file volunteering the discrepancy.
6. Make verification recurring. EO 14411’s vetting provisions are explicitly recurrent, and a record that was clean this month can drift again. A once-a-quarter check of the register against current master data is cheap; a voided number is not.

The register and the paperwork

There is a broader shift worth naming. Customs enforcement has historically read the shipment paperwork; the identity register behind it was near-static plumbing. What EO 14411’s implementation is doing - the dormancy sweep, the accuracy notice, the recurrent vetting deadline of November 30th, 2026 still ahead - is making the register itself a living record that has to keep agreeing with the operating reality of the business, and with every document filed under it.

That agreement is checkable, and most of the checking is mechanical. CargoLint reads the party blocks on commercial invoices, packing lists, and bills of lading, extracts each party’s name and address with per-field confidence, and flags disagreements across the documents of a shipment - the renamed consignee, the address that changed on the invoice but nowhere else. Those findings are advisory: a flagged mismatch shows that two records disagree, not which one is right, and updating a 5106 is a decision for the importer and their broker. What the flags do is surface the drift while it is still a correction, before an officer - or an automated registry sweep - surfaces it as a defect.

The fastest way to see what your own party data looks like across a bundle: run a recent shipment through the free trial, or send us a bundle for a free accuracy audit.

CargoLint provides document automation software, not customs brokerage or legal advice. CargoLint checks documents against each other, not against CBP’s importer registry; verify your Form 5106 record and any corrections with your broker or counsel.