Executive Summary
September 2026 marks a pivotal month for the Automated Commercial Environment (ACE). U.S. Customs and Border Protection is rolling out two significant changes: mandatory two-factor authentication for ACE portal logins and a new Entry Type 13 test program for international mail shipments. The two-factor authentication requirement, driven by concerns over fraud and account security, will add an extra layer of verification for all portal users. Meanwhile, Entry Type 13 represents a major step toward automating the processing of low-value international mail shipments—replacing the manual Excel spreadsheet submission process that took effect in July. This analysis examines both changes, their operational implications, and what logistics providers and importers must do to prepare.

ACE Two-Factor Authentication and Entry Type 13: What Logistics Providers Must Know

(ACE双重验证与13类清关：物流企业须知)

1 · Two-Factor Authentication: A New Security Mandate for ACE Portal Users

Why CBP Is Implementing Two-Factor Authentication

Amid growing concerns over bad actors stealing importers’ refunds of International Emergency Economic Powers Act (IEEPA) tariffs, CBP is set to deploy multi-factor authentication (MFA) to the ACE portal. The move to two-factor authentication ensures there is even more security for the system that handles billions of dollars in customs transactions.

CBP’s John Everett explained on a webinar that as the agency continues “to move on this path and get towards a full and comprehensive set of capabilities that cover everything in IEEPA, we need to make sure our security stays in place as well.” The ACE portal already has regular security testing, including cybersecurity monitoring—but the move to two-factor authentication adds an essential layer of protection.

How It Will Work

Per CBP’s most recent ACE functionality schedule, the new requirement will incorporate two-factor authentication for ACE portal login via email or SMS notification. This follows the same general approach used elsewhere in the modernized ACE Portal, where a security token code is required in addition to username and password—a standard multi-factor authentication method that requires two or more verification factors to access an account. CBP is also looking at incorporating AI to identify suspicious trends and behaviors, as well as real-time alerts for changes to banking information.

When It Takes Effect

According to the ACE functionality schedule updated by CBP on August 14, 2026, two-factor authentication for ACE portal login is newly planned for deployment this September. The specific implementation date within September has not been announced, but logistics providers should expect the change to take effect in the coming weeks.

What This Means for Logistics Providers

Operational Impact:

• Users will need to register for multi-factor authentication before they can access the portal
• Each login will require an additional verification step—potentially slowing down access for users who are not prepared
• Training is essential: Scott Davis, management and program analyst at CBP, recommended training staff on fraud, specifically on what links to click on and what to expect. He said CBP sends out phishing training quarterly, and importers should as well, if they have the resources

Security Best Practices:

• Verify that banking information on file with CBP is accurate. Everett said importers should check their bank account information to ensure accuracy, ensure they are following the attestation on the claim, and remain cautious
• Be wary of third-party offers: “There’s a lot of entities out there who are saying, ’let me do this all for you.’ Just, you know, ‘I’ll buy your refund from you.’ If it’s too good to be true, it’s probably not true,” Everett warned
• Only the importer of record or filer of the entry can file a CAPE claim, or the claims will reject out of the CAPE process
• Refunds are only for importers of record or the 4811 party, as a security layer to ensure the money ends up in the right account

A Broader Security Context

The two-factor authentication requirement is part of a broader CBP effort to enhance security across its systems. The agency already has data encryption for both data at rest and in transit, and automated account setup. CBP is “really trying to move away from any kind of PDF form that we have and automate those processes,” Everett said. CBP also validates banking information in ACH with routing numbers with the Treasury Department.

2 · Entry Type 13: A New Era for International Mail Processing

The Background: From De Minimis Suspension to Manual Spreadsheets

In June and July 2026, CBP issued two interim final rules indefinitely suspending the de minimis exemption for low-value shipments across all modes of entry. For international mail shipments valued at $2,500 or less, CBP established a new interim process requiring filers to email an Excel spreadsheet containing specified information. This process is limited to parties with the right to make entry (owners, purchasers, or licensed customs brokers), who must have a basic importation and entry bond.

However, CBP acknowledged that this spreadsheet-based approach was a manual stopgap rather than a long-term solution. On June 24, 2026, the agency announced its intention to begin a test of a new electronic informal entry type 13 for international mail shipments valued at $2,500 or less, starting September 22, 2026. The test has already been running in CBP’s certification (CERT) environment since July 24, 2026, ahead of its production rollout in September.

The Entry Type 13 Test Program

What It Is: Entry Type 13—“Informal Mail Entry”—is a new electronic informal entry type for merchandise entering the United States through the international mail process. The test will provide an alternative to the interim spreadsheet-based process and will allow informal entry in ACE for qualified international mail shipments.

Key Features:

• Electronic filing in ACE: Unlike the spreadsheet process, Entry Type 13 allows filers to transmit informal mail entries electronically
• Voluntary participation: The test is voluntary—filers are not required to use the new entry type and may continue relying on the interim spreadsheet process
• Indefinite duration: The test will run for an indefinite period until concluded by an announcement published in the Federal Register
• Expanded coverage: The test will temporarily create an informal entry pathway for low-value international mail shipments subject to PGA data requirements or duties other than those set forth in HTSUS Chapters 1-97

What Remains Excluded: Shipments subject to AD/CVD duties or quotas will remain ineligible for this test and must be entered under formal entry procedures.

How to Participate:

• Comments will be accepted throughout the duration of the test, submitted by email with “Comments on the Entry Type 13 Test” in the subject line
• For further information, contact Christopher Mabelitini, Director, Intellectual Property Rights & E-Commerce Division, Office of Trade, U.S. Customs and Border Protection, at 202-325-6915 or ecommerce@cbp.dhs.gov

ACE Functionality Schedule Updates

According to CBP’s ACE functionality schedule as updated August 14, 2026, still on the schedule for September 22 is the creation of new entry type 13 for U.S. mail shipments, enabling filers to provide CBP with mail shipment information via an ACE cargo release filing.

Other recent and updated ACE items include:

• IOR numbers: CBP deployed on July 16 a new “Inactive for Entry Purposes” status for importer of record numbers, automatically deactivating IOR accounts that have not filed an entry in 366 days, in accordance with 19 CFR 24.5(e). Accounts in this status cannot transmit ACE Cargo Release or Entry Summary transactions until reactivated.
• Maritime fees: CBP has moved back to September the addition of ACH debit through pay.gov as an option for vessel agents to complete maritime fee payments—a delay from its previously reported timing, not an acceleration.
• Manifests: CBP has moved up to September an enhancement modernizing ACE rail manifest electronic data interchange services. Similar enhancements to ocean manifest EDI services, the air manifest user interface, and the in-bond external interfaces and APIs remain planned for October.
• Business identifiers: Still on hold is functionality expanding the global business identifier (GBI) proof-of-concept enrollment process, including support for submitting one, two, or all three global identifiers per party, an additional free-text description field, a new GBI identifier qualifier, and an expansion of the GBI identifier field from 20 to 35 characters.
• Sanctions targeting: Also still on hold is functionality to collect new data elements enabling CBP to target merchandise subject to sanctions on Russian diamonds and seafood.
• Exports: CBP has indefinitely delayed adding the X12 and EDIFACT standardized message formats—currently used for import truck manifest submissions—as options for electronic export truck manifest submissions.

What Was Removed from the Schedule

Several enhancements previously reported do not appear on the most recent ACE functionality schedule:

• Cargo Descriptions: Automated rejection of insufficient manifest cargo descriptions
• De Minimis Shipments: Addition of bond validations for low-value shipments
• Detentions: Integration of detention record data in ACE with other CBP applications for streamlined detention process management
• In-Bonds: Modernization of ACE in-bond processing, including the QP and WP message transactions, and improvements to CBP’s ability to collect penalty payments assessed to parties that fail to meet in-bond shipment requirements

3 · What This Means for Logistics Providers

Two-Factor Authentication: Immediate Actions

1. Prepare for registration: Users will need to register for multi-factor authentication before accessing the portal. Ensure that all employees who need ACE portal access are aware of the upcoming requirement.

2. Update contact information: Verify that the Point of Contact (POC) email and phone number on your CBP Form 5106 record are current, since verification codes for the new requirement are expected to be delivered by email or SMS.

3. Train staff on security: As CBP’s Scott Davis recommended, train staff on fraud awareness, specifically on what links to click on and what to expect. CBP sends out phishing training quarterly, and importers should as well.

4. Verify banking information: Ensure that banking information on file with CBP is accurate to avoid disruptions in refund processing.

Entry Type 13: Strategic Considerations

1. Evaluate participation: The Entry Type 13 test is voluntary. Logistics providers handling significant volumes of international mail shipments should evaluate whether early participation offers operational advantages—both to gain familiarity ahead of an eventual mandatory transition and to provide CBP with practical feedback while the test program’s parameters remain flexible.

2. Transition planning: CBP has stated that it plans to eventually replace the interim spreadsheet-based process with a fully automated process. Organizations currently building compliance processes around the spreadsheet method should treat that approach as a genuinely temporary solution rather than a long-term operational foundation.

3. Monitor the test closely: The test will allow CBP to evaluate the capabilities of the new entry type and determine if it effectively addresses the risks and complexities present in the international mail environment. Logistics providers should monitor test results and CBP announcements for indications of when the test might become a permanent program or when participation might become mandatory.

4. Understand eligibility: Entry Type 13 is available for international mail shipments valued at $2,500 or less. Shipments subject to AD/CVD duties or quotas remain ineligible. Ensure that your screening processes correctly identify eligible shipments.

5. Check IOR account status: Given CBP’s new automatic deactivation of dormant importer of record numbers, confirm that all IOR numbers your organization relies on—including those tied to subsidiaries, divisions, or infrequently used special-purpose entities—have filed an entry within the past 366 days, or are reactivated before they are needed for an upcoming shipment.

4 · The Bigger Picture: ACE Modernization Continues

The two-factor authentication requirement and Entry Type 13 test are part of a broader ACE modernization effort. As CBP continues to enhance the Automated Commercial Environment, logistics providers should expect ongoing changes to:

• Security protocols: The two-factor authentication requirement is likely just the beginning of enhanced security measures
• Automation: CBP is “really trying to move away from any kind of PDF form that we have and automate those processes”
• Data integration: Enhancements like the Entry Type 13 test aim to integrate more data flows into ACE
• Compliance tools: ACE functionality, including data reports, can help importers and others boost compliance and duty savings efforts

The removal of certain enhancements from the schedule—including automated rejection of insufficient manifest cargo descriptions, bond validations for low-value shipments, detention record integration, and in-bond process modernization—suggests that some capabilities remain in development rather than having been abandoned outright. Logistics providers should monitor future schedule updates for these features, alongside other items still listed as “on hold,” such as expanded global business identifier support and sanctions-related targeting data.

5 · Conclusion: September Is a Critical Month

September 2026 represents a pivotal moment for ACE users. The combination of mandatory two-factor authentication and the Entry Type 13 test program will affect every logistics provider that interacts with CBP systems or handles international mail shipments.

Key Takeaways

The Bottom Line

The window for preparation is closing. Logistics providers must:

1. Prepare for two-factor authentication by registering users and updating contact information
2. Evaluate Entry Type 13 participation to gain early operational familiarity
3. Confirm IOR account activity to avoid unexpected entry rejections
4. Monitor ACE functionality schedule updates for new enhancements and changes
5. Train staff on security protocols and new system capabilities

The message is clear: CBP is modernizing ACE—and logistics providers must modernize their operations to keep pace.

This analysis, current as of August 19, 2026, reflects the ACE functionality schedule update published by CBP on August 14, 2026 (the most recent schedule update at the time of writing), the Entry Type 13 test program announced June 24, 2026 (effective in CBP’s production environment on September 22, 2026), the “Inactive for Entry Purposes” status deployed July 16, 2026, and related CBP announcements. Specific implementation dates and program details are subject to official CBP guidance. Organizations using ACE should consult with customs brokers and trade compliance professionals for guidance tailored to their specific operations.