By Ernesto Mendoza Guerra | Opinion

On October 2, CBP temporarily removed the public CTPAT-validated customs broker list while evaluating feedback from trade stakeholders.

Seventeen days later, the October 19 email arrived.

The evaluation was complete. CBP said the list would soon be available through ACE’s public-facing site, in furtherance of Executive Order 14411. Partners were asked to keep their account information current, with another notification to follow when the list was live.

The email announced the list’s planned return. It did not say the updated list was already online.

I put my 𝗔𝗜 𝗮𝗻𝗱 𝗚𝗼𝗼𝗴𝗹𝗲-𝗳𝘂 to work and read the announcements together. What surprises me, especially in conversations outside the trade community, is how easily the discussion stops at the disappearing webpage.

𝗧𝗵𝗲 𝗯𝗶𝗴𝗴𝗲𝗿 𝘀𝘁𝗼𝗿𝘆 𝗶𝘀 𝘄𝗵𝘆 𝗽𝘂𝗯𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗯𝗲𝗰𝗮𝗺𝗲 𝘀𝗲𝗻𝘀𝗶𝘁𝗶𝘃𝗲, what the industry understood would remain private, and why an importer might now need information that used to circulate through controlled channels.

Before the list, CTPAT verification worked differently

For much of CTPAT’s history, participants expected their status to be checked through controlled arrangements rather than a public government directory. The Status Verification Interface, or SVI, allowed partners to share and verify status within the program.

That expectation helps explain the reaction. A company choosing who receives confirmation of its status is in a different position from a company appearing in a roster anyone can download.

Earlier CBP privacy documentation also described public disclosures based on partner approval. The concern therefore has a documented history. The question is how the current publication approach fits or changes that framework.

A public list changes more than visibility.

𝙏𝙝𝙚 𝙡𝙞𝙘𝙚𝙣𝙨𝙚𝙙 𝙗𝙧𝙤𝙠𝙚𝙧 𝙧𝙤𝙨𝙩𝙚𝙧 𝙞𝙨 𝙖𝙡𝙧𝙚𝙖𝙙𝙮 𝙥𝙪𝙗𝙡𝙞𝙘. Comparing that roster with the validated list makes the names missing from the second list easier to identify, including businesses that never joined CTPAT.

Publication creates a message about who appears. Customers can also draw conclusions about who does not.

Is CTPAT voluntary under Executive Order 14411?

CTPAT is voluntary. 🫥

Apparently, the Washington kind of voluntary.

Federal law establishes the Customs Trade Partnership Against Terrorism as a voluntary government–business partnership.

Executive Order 14411 directs Department of Homeland Security to require foreign Importers of Record making formal entries to obtain CTPAT validation, if CBP determines they are eligible, or use a CTPAT-validated licensed customs broker. Applicable procedures and timing depend on CBP’s implementation.

𝗧𝗿𝗮𝗻𝘀𝗹𝗮𝘁𝗶𝗼𝗻: 𝗬𝗼𝘂 𝗱𝗼𝗻’𝘁 𝗵𝗮𝘃𝗲 𝘁𝗼 𝗷𝗼𝗶𝗻. 𝗬𝗼𝘂 𝗷𝘂𝘀𝘁 𝗵𝗮𝘃𝗲 𝘁𝗼 𝘂𝘀𝗲 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝘄𝗵𝗼 𝗱𝗶𝗱.

Eligibility makes that distinction more important.

Being a foreign importer does not automatically make a company eligible to obtain its own CTPAT importer validation. The importer categories currently identified by CBP include U.S. importers and qualifying non-resident Canadian importers.

A foreign company outside those categories cannot simply assume that applying under its own name is an available alternative.

For companies unable to qualify themselves, the broker pathway becomes particularly important under the framework the order directs.

Why foreign importers need a way to verify validated brokers

Now consider the customer outside CTPAT.

It may need to select a validated broker, but it cannot simply log into the partners’ SVI environment to check that credential itself.

A broker can provide confirmation through available channels. An official public source would let the customer check independently.

If a credential affects which provider you can use, you need a workable way to verify it.

That gives CBP a practical reason to publish a broker list.

My reading is that publication could be part of administering the Executive Order’s framework: the government makes a credential relevant to a transaction, then provides a way to identify the providers holding it.

The October 19 email’s connection to the order supports that explanation. It does not, by itself, settle every question about disclosure authority or implementation.

Does the CTPAT partner agreement promise permanent secrecy?

This is where I think the discussion needs more care.

The partner agreement addresses protection of proprietary business information under U.S. law. It also commits CBP to providing status verification through the SVI. Those provisions do not expressly describe the SVI as the exclusive verification channel forever.

Before saying CBP broke a promise, I would want to identify the actual promise and consider the other privacy rules and policies governing the information.

The company provides its security information. 𝗖𝗕𝗣 𝗺𝗮𝗸𝗲𝘀 𝘁𝗵𝗲 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻 𝗱𝗲𝘁𝗲𝗿𝗺𝗶𝗻𝗮𝘁𝗶𝗼𝗻.

Whether confirmation of that determination receives the same protection as the underlying security file is a question that deserves an explanation.

A company advertising its credential on its own website also complicates an argument that the bare status is always kept confidential. That does not automatically authorize every government disclosure; it does show why the information and the legal protection need to be identified precisely.

The agreement also permits termination by written notice. It should not be assumed to provide an automatic claim or remedy for every change in publication practice.

What the SAFE Port Act and FOIA add to the debate

𝗧𝗵𝗲 𝗦𝗔𝗙𝗘 𝗣𝗼𝗿𝘁 𝗔𝗰𝘁 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝘀𝗮𝗳𝗲𝗴𝘂𝗮𝗿𝗱𝘀 𝗳𝗼𝗿 𝗰𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗖𝗧𝗣𝗔𝗧 𝗱𝗮𝘁𝗮. It also expressly permits publication, after the prescribed process, of participants suspended or expelled for knowingly providing false or misleading information during validation.

That specific provision raises a fair question about what Congress contemplated for other publication. It does not, standing alone, answer whether a routine roster is permitted or prohibited.

The central question remains what information is legally protected and what authority supports publishing it.

FOIA—𝘁𝗵𝗲 𝗙𝗿𝗲𝗲𝗱𝗼𝗺 𝗼𝗳 𝗜𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗔𝗰𝘁—adds another distinction. An exemption from mandatory disclosure is not, by itself, a universal ban on release. Other laws, including the Trade Secrets Act, can restrict disclosure.

We therefore need to examine protection of the security records separately from publication of a company’s status.

The Executive Order explains a verification need; it does not automatically erase confidentiality obligations.

Why the CTPAT broker list affects customer decisions

Imagine two licensed customs brokers competing for the same account.

One appears on the validated list. The other does not.

The customer asks the second broker:

“Why aren’t you on the list?”

• The answer might be that it is certified and awaiting validation.
• It might not participate.
• A record could also need correction.

The list alone can not establish which explanation applies.

Certification follows acceptance of the application and Security Profile. Validation is the later verification of the applicable security practices. Those stages should not be used interchangeably.

𝗠𝗶𝘀𝘀𝗶𝗻𝗴 𝗳𝗿𝗼𝗺 𝗮 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗲𝗱 𝗹𝗶𝘀𝘁 𝗱𝗼𝗲𝘀 𝗻𝗼𝘁 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 𝗺𝗲𝗮𝗻 𝘂𝗻𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝗱, 𝘂𝗻𝘀𝗮𝗳𝗲 𝗼𝗿 𝗱𝗼𝗶𝗻𝗴 𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘄𝗿𝗼𝗻𝗴.

But a customer may make that assumption and take the business elsewhere. That possibility matters even to a broker that never joined the program.

For a validated broker, public verification can help demonstrate its credential. For another broker, the same list can create a sales conversation it did not previously need to have.

My reading of the feedback on the broker list

My interpretation is that publication exposed several concerns at once: a change in expected disclosure, the need for reliable verification, and the effect on customer decisions.

Reducing the discussion to brokers being upset about competition misses the confidentiality and administration questions. Assuming the withdrawal proved a legal violation goes beyond what the notices establish.

𝗧𝗵𝗲 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗯𝗲𝗵𝗶𝗻𝗱 𝗖𝗕𝗣’𝘀 𝗽𝗮𝘂𝘀𝗲 𝗵𝗮𝘃𝗲 𝗻𝗼𝘁 𝗯𝗲𝗲𝗻 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝗶𝗲𝗱 𝗶𝗻 𝘁𝗵𝗲 𝗻𝗼𝘁𝗶𝗰𝗲𝘀 𝗱𝗶𝘀𝗰𝘂𝘀𝘀𝗲𝗱 𝗵𝗲𝗿𝗲.

The October 19 email tells us the evaluation is complete and publication is planned. It does not tell us which objection carried the most weight.

What businesses can reasonably ask for is an accurate explanation of the status shown, a date for the record, and a practical way to correct mistakes before customers rely on them.

Could importers, carriers and 3PLs face public lists next?

𝗧𝗵𝗲 𝗯𝗿𝗼𝗸𝗲𝗿 𝗹𝗶𝘀𝘁 𝗿𝗮𝗶𝘀𝗲𝘀 𝘁𝗵𝗮𝘁 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻. 𝗜𝘁 𝗱𝗼𝗲𝘀 𝗻𝗼𝘁 𝗮𝗻𝘀𝘄𝗲𝗿 𝗶𝘁 𝗳𝗼𝗿 𝗲𝘃𝗲𝗿𝘆 𝗼𝘁𝗵𝗲𝗿 𝗰𝗮𝘁𝗲𝗴𝗼𝗿𝘆.

A useful starting point is to ask who outside the program needs to rely on each category’s status. CBP can check importer information within its own systems, and participating business partners have existing verification arrangements.

Sureties may also want authoritative information when assessing bond risk. That creates a question about suitable access, rather than an automatic reason for a public directory.

The Executive Order also directs enhanced vetting of import-related actors.

Vetting an entity and publishing its program status are separate government actions.

The broker list may address a particular verification need. Future rules could create other needs, which is why carriers, manufacturers, forwarders and 3PLs have a reason to follow implementation closely.

A list for one category does not automatically authorize lists for all categories.

What CTPAT partners should do now

• Review the agreement your company signed and the privacy framework that applies. Separate an express commitment from a practice you assumed would continue.
• Keep company names, identifiers and contacts current. Check how the legal entity and its status are represented.
• Describe certification and validation accurately. If validation is pending, prepare a clear explanation for customers and retain supporting confirmation.
• Review public claims about your credential. They should match the company’s actual status without implying that every transaction is guaranteed compliant.
• Raise concrete concerns through the relevant consultation process, industry associations or COAC. Explain the operational problem and the correction needed.

COAC advises and recommends. Its recommendations do not create binding requirements. The government remains responsible for adopting and explaining its measures.

I can see a practical reason for public verification and still question the commercial pressure attached to a program described as voluntary. Both deserve an honest explanation.

The October story began with a list being removed. Its planned return brings us back to the underlying business question: what choices do affected companies actually have, and how can they verify the options available to them?

𝗩𝗼𝗹𝘂𝗻𝘁𝗮𝗿𝘆 𝘄𝗶𝘁𝗵 𝗰𝗼𝗻𝘀𝗲𝗾𝘂𝗲𝗻𝗰𝗲𝘀 𝗶𝗳 𝘆𝗼𝘂 𝗰𝗵𝗼𝗼𝘀𝗲 “𝗻𝗼.”

How to apply for CTPAT and prepare for validation

Curious about becoming CTPAT certified and preparing for validation?

Explore TradeFlex’s step-by-step CTPAT application guide, covering eligibility, the portal, the Security Profile and supporting evidence.

Understand where your company fits before deciding how to proceed.

Explore the TradeFlex CTPAT certification and application guide →

Special thanks to Dan Garcia , Director and Senior Analyst at SIMS World Wide Inc., for his thoughtful commentary on the CTPAT-validated customs broker list, which helped inform this analysis.