ACE Portal SMS authentication gives customs brokers, importers of record, and account administrators another way to receive security tokens during login. The optional feature can improve operational flexibility, but firms should pair adoption with clear device policies, documented access controls, reliable fallback procedures, and disciplined user offboarding.
How ACE Portal SMS Authentication Works
CBP introduced optional SMS token delivery for ACE Portal users on September 12, 2026. The feature does not replace email authentication or impose a new authentication mandate. Instead, it allows an eligible user to register a mobile telephone number after completing a successful email-authenticated login and then select SMS for future token delivery.
Registration and Login Process
A user begins by signing in through the normal ACE Portal login process and receiving an authentication token by email. After that successful login, the user can register a mobile number, select the appropriate country code, and complete the verification process. Future login attempts generally allow the user to choose whether the security token should arrive by email or SMS.
Users can edit or remove the registered number through Manage Preferences. Depending on the available setup prompts, they may also be able to register immediately, defer the decision, or indicate that they are not interested. Message and data charges may apply based on the user’s carrier and mobile plan.
Repeated entry of an incorrect token can temporarily prevent another attempt. Users should therefore avoid guessing when a message is delayed and verify that they are using the most recently issued passcode.
A Token Delivery Option, Not a Filing Change
The change affects how an authenticated ACE Portal user receives a login token. It does not generally modify ABI transmissions, ACE report permissions, account-level entitlements, ACH enrollment, or other operational workflows within the portal.
Brokerages and importers should treat the feature as an access-channel enhancement rather than a substantive change to customs filing requirements. Existing user roles, authorization structures, and internal compliance responsibilities remain in place.
Operational and Security Considerations for ACE Users
SMS authentication can be convenient for users who do not have immediate access to corporate email, particularly during after-hours operations, travel, or an email service disruption. However, convenience should not be confused with a complete identity and access management strategy. Each organization should determine how SMS token delivery fits within its broader security controls.
Personal Mobile Devices Versus Monitored Operations Phones
A central policy decision is whether users may register personal mobile numbers or whether the organization will provide managed devices. Personal phones can support individual accountability and reduce the risk of multiple employees sharing a token. They may also create privacy, reimbursement, availability, and offboarding concerns.
A monitored operations phone can help a night shift or centralized filing team maintain access, but shared devices generally weaken attribution. If several employees can view the same token, internal records may not clearly identify who completed a login. Shared phones also require documented custody, secure storage, screen-lock controls, and escalation procedures when the device is lost or unavailable.
In most environments, named ACE users should retain distinct credentials and should not share passwords. Registering one operations phone for multiple users does not eliminate the need for individual accountability.
SMS Should Remain One Part of a Resilient Process
SMS delivery may be affected by carrier delays, mobile coverage, international roaming, device settings, or telephone-number changes. Brokerages and importers should keep email authentication available as a fallback rather than assuming that every SMS message will arrive immediately.
Cybersecurity teams should also recognize the established risks associated with mobile numbers, including SIM-swap fraud, forwarded messages, compromised devices, and exposed lock-screen notifications. Appropriate safeguards typically include device passcodes, carrier account protections, prompt reporting of lost phones, and restrictions on automatic message forwarding.
The objective is not simply to activate SMS. It is to provide a controlled alternative that supports continuity without introducing unmanaged access paths.
Implementation Checklist for Brokers and Importers
A structured rollout will help prevent avoidable login problems while giving operations teams the flexibility intended by the new option. The implementation plan should bring together brokerage operations, trade compliance, information security, and ACE account administration.
Establish and Document the Firm’s Policy
The organization should first identify which ACE Portal users are eligible to register for SMS delivery. The policy should address whether personal numbers are permitted, whether company-managed phones are required, and whether shared operations devices are allowed in limited circumstances.
The access inventory should record that SMS is enabled, the type of device registered, the responsible user, and the date of the latest review. Full telephone numbers should only be stored where operationally necessary and protected in accordance with the organization’s privacy and security requirements.
Account administrators should verify the current registration and removal steps in the ACE training materials before issuing internal instructions. Screenshots and menu paths can change over time, so standard operating procedures should be reviewed periodically.
Prepare Support, Training, and Offboarding Procedures
Day, night, and weekend personnel should know how to select either email or SMS during login. They should also understand what to do when a token is delayed, when an old token no longer works, or when repeated failed attempts cause a temporary lockout. ACE login issues that cannot be resolved internally can be directed to ACE.Support@cbp.dhs.gov.
Offboarding deserves particular attention. When an employee leaves, changes roles, replaces a device, or changes a telephone number, the organization should remove or update the SMS registration through Manage Preferences. This step should appear alongside credential deactivation, entitlement review, corporate email closure, and recovery of company-owned equipment.
Periodic access reviews should confirm that registered users still require ACE Portal access and that their delivery methods remain current. These controls turn an optional convenience feature into a dependable component of the organization’s access governance program.
- CBP deployed optional SMS multifactor authentication for ACE Portal logins on September 12, 2026 (CSMS #69896141 issued September 14).* After a successful email-authenticated login, users can register a mobile number to receive future security tokens via SMS (as an alternative to email); the feature is optional, email remains available, users can manage/remove it under “Manage Preferences,” and message/data rates may apply. Instructions are on CBP’s ACE Training webpage; contact ACE.Support@cbp.dhs.gov for assistance.
- Industry recaps appeared immediately after the CSMS.* Expeditors Newsflash (September 15) and International Trade Today (September 14) summarized the change for brokers and importers, noting it as a convenience/resiliency option rather than a mandate; CustomsGenius (September 15) also covered the login update alongside a separate FTZ e214 error-code deployment.
- CBP updated official documentation in advance.* The ACE Portal Account Types User Guide (Publication 5685-0926, dated September 9, 2026) added a “What’s New” section on SMS text authentication, including registration options (Yes / Ask Me Later / Not Interested), country-code selection, passcode verification, and a note that three failed token attempts lock the user out for 15 minutes.
- A September 8 International Trade Today article previewed the September 12 go-live* as part of CBP’s notional ACE development/deployment schedule (previously listed for September). No subsequent regulatory mandates, outages, or widespread issues were reported in the following weeks.
- No notable practitioner discussions* on the SMS option appeared in recent X/Twitter searches among trade, broker, or compliance accounts.
Frequently Asked Questions
Is SMS Authentication Mandatory for ACE Portal Users?
No. SMS token delivery is optional, and email authentication remains available. Organizations can decide whether to permit or encourage SMS registration based on their operational needs, security policies, device-management practices, and user population. A user who does not register a mobile number can generally continue receiving login tokens through email.
Does SMS Authentication Change ABI Filing or ACE Permissions?
No. The feature changes the delivery method for an ACE Portal login token. It does not generally alter ABI filing procedures, report permissions, user entitlements, ACH enrollment, or account-type responsibilities. Existing authorization and compliance controls continue to apply after SMS registration.
Can a User Change or Remove a Registered Mobile Number?
Yes. A user can manage the registered telephone number and related notification preferences through Manage Preferences. Organizations should include this process in device-replacement and offboarding procedures so that obsolete or former employee numbers do not remain associated with ACE access.
Should a Brokerage Use Personal or Shared Mobile Phones?
The appropriate choice depends on the firm’s security model. Personal or individually managed devices generally provide clearer user attribution. Shared operations phones may support round-the-clock coverage but require stronger custody controls, documented access, and procedures for identifying which employee performed each login.
What Should Users Do if an SMS Token Does Not Arrive?
Users should confirm mobile coverage, verify that the registered number remains current, and allow for possible carrier delays. They should avoid repeatedly requesting or guessing tokens because newer codes may invalidate older ones. Email authentication should remain available as a fallback, with unresolved login problems escalated to ACE support.
How Stable Software Can Help
Strengthen Access Governance Across Trade Operations
ACE authentication is only one component of a brokerage or importer’s wider compliance technology environment. Firms also need reliable user administration, standardized workflows, accessible audit records, and controls that remain effective across shifts, locations, and personnel changes.
Stable Software helps customs brokers and importers streamline trade operations while reducing the administrative friction surrounding complex compliance processes. By centralizing critical workflows and improving operational visibility, Stable can help teams build more resilient procedures around account access, filing activity, exception management, and internal accountability. Organizations evaluating their ACE Portal controls can use the SMS rollout as an opportunity to modernize access inventories and strengthen broader trade compliance governance.
Resources
| Type | Resource |
|---|---|
| Primary CSMS | CSMS #69896141 — SMS Option Now Available for ACE Portal Login Authentication |
