CBP has strengthened ACE Portal ACH refund verification at a critical point in the refund process. Importers and customs brokers must now use an email or SMS security token when adding or changing refund bank information, making accurate contact records, controlled access, and timely preparation essential.
What Changed for ACH Refund Information in ACE
A Security Token Is Now Required
Since October 10, 2026, an authorized user attempting to add or modify ACH refund information in an ACE Portal importer sub-account must complete a token verification step. The security token is sent by email by default. A user may also configure SMS delivery through the portal's notification preferences.
The bank information change cannot be completed without entering the token. This creates an additional control between an authenticated ACE user and the submission of new or revised refund instructions. It also means that an outdated email address, inaccessible mailbox, or incorrect mobile number can prevent a legitimate banking update from being finalized.
The verification requirement applies when bank details are added for the first time and when existing information is changed. It is therefore relevant to importers establishing electronic refund instructions, companies changing financial institutions, and organizations updating accounts after a merger, acquisition, treasury restructuring, or fraud event.
Electronic Refunds Increase the Importance of Readiness
CBP refunds are generally issued through ACH electronic funds transfer rather than paper checks. This makes the accuracy and security of refund banking instructions operationally significant for importers expecting duty refunds, duty drawback payments, reconciliation refunds, liquidation-related refunds, or potential IEEPA-related refunds.
ACH information is entered through the ACH Refund Authorization tab within the Importer Account view. Although users manage the submission through ACE, the banking information itself is maintained in CBP's financial system rather than stored in the ACE Portal.
Companies should not wait until a refund is imminent to confirm their setup. A banking change attempted shortly before liquidation may be delayed if the authorized user cannot receive the required token or does not have sufficient portal access.
Access Rights and Fraud Controls for Importers and Brokers
Review Full Access and Read-Only Permissions
Trade Account Owners can grant either Read-Only or Full Access to the ACH Refund Authorization tab for Proxy Trade Account Owners and Trade Account Users. These permissions should be treated as sensitive financial access, not routine portal administration.
Full Access allows an authorized user to enter or change ACH refund information, subject to token verification. Read-Only access can support oversight without permitting banking changes. Importers should generally limit Full Access to personnel with a defined treasury, compliance, or account administration responsibility.
A periodic access review should identify inactive employees, former service providers, duplicate accounts, and users whose responsibilities no longer require banking authority. Organizations should also document who approves a change internally, who submits it in ACE, and who independently confirms completion. Token verification strengthens the submission process, but it does not replace sound segregation of duties.
Enable Alerts for Independent Oversight
Other authorized users associated with the importer sub-account may opt in to receive email or SMS alerts after ACH refund information changes. These notifications can serve as an important detective control because they inform additional personnel that refund instructions were modified.
For stronger governance, an importer can direct alerts to someone outside the individual user's reporting chain, such as a treasury manager, controller, trade compliance director, or security administrator. That person should know how to escalate an unexpected change immediately.
The control is most effective when responsibilities are explicit. Organizations should define who monitors alerts, how quickly the recipient must respond, and how banking details will be validated through a trusted channel. Sensitive information should not be confirmed solely through an email reply or an unsolicited telephone request.
Customs brokers also need to distinguish between authority to file transactions and authority to manage importer refund banking information. A broker named on CBP Form 4811 to receive refunds must generally request access to the importer record view before entering ACH information. That access should be established well before an expected refund becomes payable.
Preparing Refund Operations for the Verification Process
Update ACE Contact Information Before It Is Needed
Every user with Full Access to the ACH Refund Authorization tab should confirm that the email address in the ACE Portal profile is accurate and accessible. Users who want SMS delivery should also verify their mobile number and notification preferences. Shared inboxes and company-issued mobile devices require special attention because personnel changes can interrupt access without immediately affecting the underlying ACE user account.
Compliance teams should test their internal process without making unnecessary bank changes. A practical readiness review can confirm the authorized users, current contact methods, alert recipients, internal approval requirements, and escalation contacts for both treasury and customs matters.
If a user cannot access the registered email address or phone number, the issue should be resolved before banking information must be updated. ACE Portal technical assistance is available through ACE.Support@cbp.dhs.gov, but support requests may not align with a company's refund timetable.
Coordinate Refund and Drawback Timelines
Duty drawback claimants should give ACH readiness particular attention because drawback refunds are paid electronically. The claimant, broker, and treasury function should confirm the intended refund account before claims liquidate. Accelerated payment can make early validation even more important because a refund may be issued before the normal liquidation cycle is complete.
A useful control checklist includes:
- Confirming the legal entity and importer account connected to the refund.
- Reviewing users with Full Access and removing unnecessary permissions.
- Verifying email addresses and mobile numbers for token delivery.
- Enabling change alerts for independent personnel.
- Confirming Form 4811 authority and importer record view access where a broker receives refunds.
- Validating bank details through an approved treasury process.
- Retaining internal evidence of approval, submission, and review.
These steps should be integrated into refund procedures rather than handled as a one-time portal project. Importers may have multiple importer numbers, business units, drawback claimants, or broker relationships. A complete review should account for every sub-account through which a material refund could be issued.
- On October 9, 2026, CBP issued CSMS #70162211 requiring email or SMS security token verification starting October 10, 2026, for any addition or modification of ACH refund bank information in an ACE Portal importer sub-account. The change cannot be completed without the token. Other authorized users on the sub-account may opt in for email or SMS alerts after changes. This follows CBP adding SMS as an ACE Portal login method in September 2026.
- CBP published an updated training guide, ACE Portal: ACH Bank Information for Electronic Refunds (October 2026, Publication No. 5686-1026), on or around October 8-9, 2026. It details how Trade Account Owners grant Read-Only or Full Access to the ACH Refund Authorization tab, how users set email/SMS preferences in Notification Preferences, and the two-factor process (email default, SMS optional) when submitting bank details. Banking data is stored in CBP's financial system, not ACE.
- Customs brokers issued client alerts in mid-October 2026, including Allied CHB on October 9, V. Alexander on October 14, and Willson International on October 16, advising importers (especially those expecting IEEPA or other refunds) to confirm ACE contact details and phone numbers are current to receive tokens without delay. The CBP ACE Portal and ACH Refunds FAQs page was last modified October 15, 2026.
- Practitioner discussion on X was limited. One post on October 15, 2026, from a freight forwarder alerted importers to the new email or SMS check before ACH refund details can be changed in ACE. No other significant regulatory updates or CSMS messages on this topic appeared in the following weeks.
Frequently Asked Questions
When Is a Security Token Required for an ACH Refund Change?
A token is required when an authorized user adds or modifies ACH refund bank information in an ACE Portal importer sub-account. The user must receive and enter the token before the change can be completed. Simply logging into ACE does not eliminate this additional verification step.
Is the Token Sent by Email or SMS?
Email verification is enabled automatically for the process. Users may also configure SMS as a delivery preference. Because token receipt depends on the contact information associated with the user, each authorized individual should keep both email and mobile profile details current.
Can Other Users Be Notified After Banking Information Changes?
Yes. Other authorized users on the importer sub-account may opt in to email or SMS alerts following an ACH refund information change. Importers should consider assigning these alerts to personnel responsible for treasury oversight, trade compliance, internal controls, or account security.
Does CBP Store Bank Information in the ACE Portal?
The banking information is managed through the ACE workflow but is maintained in CBP's financial system rather than stored in the ACE Portal. Access to the ACH Refund Authorization tab should still be tightly controlled because authorized users can submit additions or changes through ACE.
What Should Brokers With Form 4811 Authority Do?
A broker designated on CBP Form 4811 to receive refunds should generally request importer record view access before attempting to enter ACH details. Form 4811 authority alone should not be assumed to provide the necessary portal visibility. Access should be verified before any expected refund date.
Why Does This Matter for Duty Drawback Refunds?
Duty drawback refunds are issued electronically, so incomplete or outdated ACH instructions can create operational complications near payment. Claimants and their brokers should confirm banking information, token delivery contacts, and user permissions before drawback claims liquidate or accelerated payment is expected.
How Stable Software Can Help
Support Scalable Broker-Led Drawback Programs
ACH verification protects the payment destination, while an effective drawback program also requires disciplined claim preparation and filing. DrawbackAI is flat-license duty drawback software that U.S. customs brokers can white-label for importer clients and use to file under the broker's own filer code.
Stable Software charges a flat software license and never takes a percentage of the refund. This structure allows brokers to retain control of client relationships, filing operations, and refund economics while building a more scalable drawback service. Brokers evaluating their refund procedures can pair stronger ACE access controls with a structured technology approach to duty drawback claims.
Resources
| Type | Resource |
|---|---|
| Source | Primary source |
