CBP Form 5106 Enforcement: How to Prevent IOR Number Voiding

CBP Form 5106 accuracy is now an immediate cargo-clearance issue, not a back-office housekeeping task. Since September 18, 2026, CBP has been able to void an Importer of Record number as soon as incomplete or inaccurate identity data is found, leaving importers and brokers to resolve the record before affected merchandise can be entered.

Why IOR Number Voiding Changes Entry Risk

Immediate Operational Consequences

CBP’s enhanced review applies to Form 5106 information for both new and existing Importers of Record. The agency is evaluating whether the identity data associated with each IOR number is complete, accurate, and attributable to the importer rather than to an intermediary.

When CBP identifies noncompliant data, it may immediately void the IOR number. A voided number is invalid for any purpose, including entering merchandise into the United States. This makes importer identity management a direct dependency for customs clearance, cargo availability, production continuity, and customer delivery.

The risk is particularly significant because an organization should not assume that it will receive a warning or correction window before voiding occurs. Notification generally goes to the IOR email address most recently on file. CBP may also copy the customs broker that filed the importer’s most recent entry, but brokers should not depend on receiving that copy.

If the email address belongs to a former employee, customs broker, freight forwarder, or unmonitored mailbox, the importer may not learn of the action until an entry fails. Cargo can then remain stranded while the parties investigate the rejection, obtain corrected information, secure supporting documentation, and seek reestablishment of the IOR number.

This enforcement model changes the control objective. Importers and brokers must do more than submit technically complete records. They need processes that establish the authenticity of the IOR, preserve accurate ownership information, and detect changes before those changes interfere with entry processing.

What Valid CBP Form 5106 Data Requires

Identity, Address, and Contact Standards

A compliant CBP Form 5106 record generally includes the importer’s legal name; IRS Employer Identification Number, Social Security number, or CBP-assigned number; mailing address; physical location address when different; telephone number; and email address. Each field should accurately identify the party acting as the Importer of Record.

The physical address requirement deserves particular attention. The address must represent the actual physical location of the business or individual. A registered agent’s office, customs broker, freight forwarder, P.O. box, business service center, or unrelated person’s address is not an acceptable substitute for the IOR’s physical location.

This can create additional validation work for nonresident importers, e-commerce sellers, and companies using third-party administrative services. A foreign address is not inherently problematic, but it should be a genuine operating or residential location attributable to the importer. Compliance teams should retain reasonable evidence supporting the address rather than relying exclusively on data supplied in an onboarding form.

The email address and telephone number must also belong directly to the IOR. Brokers and other service providers should not insert their own contact details as placeholders, even when doing so might make communications easier. Shared broker addresses can prevent CBP from contacting the importer and may make the record appear inaccurate.

Identification numbers require equally careful review. The name, tax identifier, address, and entity type should align across onboarding documents, powers of attorney, entry records, and internal master data. Differences involving legal suffixes, reorganizations, ownership changes, or reused identifiers should be investigated rather than automatically overwritten.

For brokers, the submission itself must be properly authorized. A broker creating or updating Form 5106 data generally needs a valid power of attorney executed directly with the IOR under 19 CFR 111.36(c)(3), not an authorization routed through a freight forwarder. Broker due diligence obligations under 19 CFR 111.29(a) and the prohibition against transmitting known false or misleading information under 19 CFR 111.32 remain central to the process.

A Practical Control Plan for Importers and Brokers

Audit Active IOR Records and Supporting Documents

The first priority is a risk-based audit of active importer records in ACE and connected brokerage systems. Organizations should begin with IORs supporting imminent shipments, high entry volumes, duty-sensitive merchandise, or time-critical supply chains. Nonresident importers, delivered-duty-paid sellers, infrequent importers, and entities with older records may warrant additional scrutiny.

For each IOR, the review should confirm:

• The legal name matches the applicable tax or CBP-assigned identifier.
• The mailing address is current and complete.
• The physical address is the importer’s actual location.
• The telephone number and email address belong to the IOR.
• The email account is monitored by personnel able to respond to CBP.
• The broker holds a direct, valid power of attorney.
• Supporting identity and address documents are available when needed.

Build Controls Into Onboarding and Entry Operations

A one-time cleanup will not provide lasting protection. Importers and brokers should establish structured workflows for creating, approving, updating, and periodically recertifying Form 5106 data. High-risk fields should not be changed through informal email instructions without appropriate verification.

Master-data controls can prevent common errors by flagging P.O. boxes in physical-address fields, identifying broker-owned email domains, detecting missing telephone numbers, and comparing tax identifiers against existing records. Role-based approvals and audit trails can document who reviewed each change and what evidence supported it.

Prepare for Sudden Voiding Notices

An incident-response procedure should define how teams will handle a voided IOR number. The plan should identify who monitors the IOR email account, who contacts CBP, who supplies corroborating documents, and who communicates with carriers, forwarders, warehouses, customers, and internal stakeholders.

Questions regarding reestablishment can be directed to IORProgram@cbp.dhs.gov using the subject line “Enforcing IOR Accuracy.” Escalation procedures should account for the possibility that the issue will arise outside normal compliance working hours. After remediation, the organization should verify the importer’s status before assuming that entries can resume.

Frequently Asked Questions

What Happens When CBP Voids an IOR Number?

The number becomes invalid for any purpose, including entering merchandise into the United States. Entries using that IOR may be blocked until the identity record is corrected, CBP completes its review, and the number is reestablished.

Can a Broker’s Address, Email, or Phone Number Be Used for the Importer?

Generally, no. The physical location, email address, and telephone number must belong to the IOR. A broker, freight forwarder, registered agent, business service center, P.O. box, or unrelated party should not be used as a substitute for the importer’s actual information.

How Will an Importer Learn That Its Number Was Voided?

CBP generally sends written notice to the IOR email address most recently on file. The broker that filed the importer’s most recent entry may also be copied, but the IOR should maintain its own monitored email account rather than relying on broker notification.

How Can a Voided IOR Number Be Reestablished?

The importer or authorized representative should contact IORProgram@cbp.dhs.gov with the subject “Enforcing IOR Accuracy.” CBP may require corrected Form 5106 information and evidence corroborating the importer’s identity, address, and contact details. Questions may also be directed to Anita Rivera, Revenue Enforcement Branch, at (771) 233-2939.

Does an Existing Power of Attorney Automatically Authorize a Form 5106 Update?

Only if the broker holds a valid power of attorney executed directly with the IOR and the authorization remains effective. A power of attorney obtained indirectly through a freight forwarder generally does not satisfy the direct authorization requirement for submitting importer identity data.

How Stable Software Can Help

Strengthen Importer Data Governance

Form 5106 compliance requires consistent data across importer onboarding, powers of attorney, entry workflows, and operational communications. Manual spreadsheets and disconnected inboxes make it difficult to validate ownership, identify stale records, and document approvals before cargo is at risk.

Stable Software helps customs brokers and importers centralize trade data, automate compliance workflows, and maintain clearer audit trails. Structured validation, exception management, document controls, and operational visibility can help teams identify missing or conflicting IOR information before it interrupts entry processing. By embedding importer identity checks into routine operations, organizations can reduce preventable clearance delays while supporting scalable, defensible compliance programs.