CBP Starts Voiding Importer Numbers With No Warning, and the Exposure Lands on Brokers

U.S. Customs and Border Protection began voiding importer-of-record (IOR) numbers on Sept. 18, 2026, under an enforcement regime it published a month earlier in the Federal Register on Aug. 19. The notice, issued under Executive Order 14411, targets the accuracy of contact data importers submit on CBP Form 5106 — the form that establishes or updates an importer's identity in CBP's system before goods can clear a U.S. port.

The mechanics are what make this a brokerage-side story rather than an importer-side one. CBP's notice requires that the physical address, phone number and email on file belong to the importer of record itself — not a customs broker, a registered agent or a freight forwarder standing in for a client that has no U.S. address. The IRS employer ID number or Social Security number and mailing address must also be current. Once CBP determines a Form 5106 record is inaccurate or incomplete, it voids the IOR number outright, which the agency's notice states renders it "invalid for any purpose, including entering imported merchandise." CBP notifies the importer by email after the fact; the notice does not provide for a correction window before the number is disabled.

That absence of a cure period is the detail brokers are reacting to. Forvis Mazars' compliance guidance, published after the Sept. 18 effective date, tells both importers and brokers to audit Form 5106 data now rather than wait for a CBP notice, warning that a voided number can trigger broker penalties for submitting false data and, in CBP's own language, potential False Claims Act liability for "inaccurate or misleading information." FreightWaves reporting on the rollout cites Diaz Trade Law's assessment that brokers who have, for convenience, listed their own office address or phone number on a client's Form 5106 now carry that exposure across every file where they did it — a broker managing hundreds of importer records can be looking at hundreds of individually defective filings, not one.

Four importer categories show up repeatedly in compliance write-ups of the rule: nonresident importers whose only U.S. contact point has historically been their broker's address; foreign sellers moving goods under delivered-duty-paid terms, where the seller rather than the U.S. buyer is IOR; e-commerce sellers routing through third-party fulfillment centers that never touch the seller's own contact information; and smaller, longer-tenured importers whose Form 5106 has not been refreshed since a past address or contact change. None of these are unusual or high-risk importer profiles — they are common, ordinary structures in cross-border retail and delivered-duty-paid freight, which is why the enforcement action reaches further than a typical customs crackdown aimed at fraud.

A parallel action in Mexico gives a sense of scale when a government moves on importer-identity data at once rather than case by case. Mexican authorities have suspended import activity and moved toward permit cancellation for 350 steel importers under the IMMEX maquiladora program this year, with roughly 400 more companies still under review, according to FreightWaves' reporting. CBP's Form 5106 sweep is a data-accuracy action rather than a fraud sweep, but it shares the same operational risk: goods already in transit or awaiting entry can be stranded the moment the underlying importer number stops working, with demurrage and storage costs accruing while the importer works to reestablish it.

What changes for forwarders and brokers this week

Four things worth acting on rather than watching:

Audit your own address out of client files. Any Form 5106 where a broker's office, phone or email stands in for the importer's own contact information is now a live liability, not a convenience. Brokers with large importer books should treat this as a data cleanup project with a deadline that already passed, not one still ahead.

Power of attorney has to trace to the actual importer. CBP and the compliance guidance both flag POAs executed with an intermediary rather than the importer of record itself as a defect that compounds the contact-information problem — fix one without the other and the exposure remains.

Nonresident and DDP shippers are the highest-risk lane. Any program built around a foreign seller acting as IOR with no independent U.S. address should get checked first; that structure is named specifically in the compliance guidance as most likely to fail the new standard.

There is no notice-and-cure window to plan around. Because CBP voids first and emails after, the only defense is getting the Form 5106 correct before an entry is filed against it — a shipment already moving on a defective IOR number has no procedural off-ramp once the number goes dark.