CTPAT Certification and AEO Readiness: Minimum Security Criteria, Validation, and Trusted-Trader Status
CTPAT certification is granted by U.S. Customs and Border Protection, and AEO status by national customs authorities. Accredify Global prepares you for both. We assess your sites, supply chain, and records against the CTPAT Minimum Security Criteria and the AEO criteria. Then we help you build the evidence customs officers ask to see. You get a tailored proposal after a free scoping review.
What Is CTPAT Certification?
CTPAT certification means U.S. Customs and Border Protection (CBP) has accepted your company into the Customs Trade Partnership Against Terrorism. C-TPAT, now written CTPAT, is a voluntary program for importers, carriers, brokers, and other supply chain businesses that meet CBP's Minimum Security Criteria. Certified partners are treated as lower risk at the border.
AEO, or Authorised Economic Operator, is the international equivalent. It is granted by national customs authorities under the World Customs Organization SAFE Framework. In the EU, AEO status is set out in the Union Customs Code, and other countries run their own AEO programs.
Accredify Global does not grant CTPAT or AEO status. We run a readiness assessment against the criteria, so your security profile, application, and validation visit go smoothly.
Who Grants CTPAT and AEO Status, and How They Recognize Each Other
CTPAT is run by CBP. It is voluntary and free to join. You apply through the CTPAT Portal and submit a security profile, which CBP aims to review within about 90 days. A CBP Supply Chain Security Specialist then validates your practices, and CBP revalidates members periodically.
AEO is granted by customs authorities. In the EU, applicants must meet the criteria in Article 39 of the Union Customs Code, and the customs authority audits the business before deciding.
Mutual recognition links the programs. The EU has AEO mutual recognition with 8 countries, including the United States, the United Kingdom, China, Japan, and Canada. The EU and U.S. treat each other's trusted traders as comparable.
Sources: EU AEO programme (European Commission) · EU AEO mutual recognition · CTPAT application guide (ReformHQ)
CTPAT vs AEO: The Differences That Matter
Many companies trading with the U.S. and the EU need both. This is how they compare.
| Topic | CTPAT | EU AEO |
|---|---|---|
| Granted by | U.S. Customs and Border Protection | The customs authority of an EU Member State |
| Legal basis | Voluntary partnership, with security criteria by business type | Union Customs Code, Article 39 |
| Who can apply | Importers, carriers, brokers, consolidators, 3PLs, and some others, including Mexican manufacturers | Any supply chain business established in the EU |
| Types | Security, plus a Trade Compliance program for importers | AEOC, AEOS, or both |
| Cost to apply | Free | No application fee in most Member States |
| How it is checked | Security profile review, then CBP validation | Customs audit of the business before the decision |
| Mutual recognition | Recognized by the EU and other partners | Recognized by 8 partner countries |
CTPAT Requirements: The Minimum Security Criteria, and What We Assess
The criteria have 3 focus areas and 12 categories. Each criterion is a "must" or a "should", and the detail varies by business type.
| Focus area | Categories | What we assess |
|---|---|---|
| Corporate security | Security vision and responsibility, risk assessment, business partners, cybersecurity | Leadership ownership, a documented risk assessment, partner screening, and IT controls |
| Transportation security | Conveyance and instruments of international traffic, seal security, procedural security, agricultural security | Container inspections, seal controls, cargo documentation, and pest contamination checks |
| People and physical security | Physical security, physical access controls, personnel security, education and training | Fencing, lighting, CCTV, access logs, background checks, and awareness training |
For a certifiable security management system that supports these criteria, see ISO 28000 certification.
AEO Certification Criteria Under the Union Customs Code
All applicants meet the first three criteria. AEOC adds competence, and AEOS adds security and safety.
| Criterion | Applies to | What we check |
|---|---|---|
| Customs compliance record | AEOC and AEOS | Past errors, how they were corrected, and controls to prevent repeats |
| Records and logistics system | AEOC and AEOS | Traceable trade and transport records, and access controls on them |
| Financial solvency | AEOC and AEOS | The evidence customs typically asks for, organized and current |
| Practical competence | AEOC | Customs experience or qualifications of the people responsible |
| Security and safety standards | AEOS | Site security, cargo integrity, partner security, and staff screening |
Who Needs CTPAT or AEO Readiness?
Anyone whose customers, or customs authorities, expect proof of a secure supply chain.
Companies applying for CTPAT, or moving up the tiers.
Manufacturers in India, Asia, and Latin America asked by U.S. importers to meet the criteria.
Who can join CTPAT directly.
Businesses handling cargo for certified partners. See ISO certification for logistics.
Companies applying for AEOC, AEOS, or both.
High-value or controlled goods. See our WHO GDP readiness service.
CTPAT Tiers for Importers, and Why They Matter
Importers move up the tiers as CBP confirms their security goes deeper.
The three importer tiers
| Tier 1 | Certified: CBP has accepted your security profile |
|---|---|
| Tier 2 | Validated: CBP has verified your practices in person |
| Tier 3 | Validated, with security beyond the minimum criteria |
Benefits CBP describes
- Fewer examinations, and front-of-line inspection when examined
- An assigned Supply Chain Security Specialist
- Priority treatment when trade resumes after a disruption
- Recognition under mutual recognition arrangements
- A stronger case with customers who require it
CTPAT Compliance Checklist: Ten Things Validators Ask For
If you cannot show one of these with records, it belongs on your readiness plan.
Documents and governance
- A written supply chain security risk assessment, reviewed at least yearly
- Business partner screening and security questionnaires
- Written seal, container inspection, and cargo procedures
- Cybersecurity policies covering systems used for trade
- Training records for security and threat awareness
Site evidence
- Seven-point or seventeen-point container inspections recorded
- Seal numbers verified at loading and arrival
- Access logs for employees, visitors, and drivers
- Working CCTV, lighting, and perimeter controls
- Background checks for staff in sensitive roles, where law allows
How Our CTPAT and AEO Readiness Program Works
Six stages from scoping to a validation-ready business. Most readiness journeys run 6 to 12 months before the customs visit.
Asked by a U.S. importer to meet CTPAT criteria? A free scoping review shows how much work there is.
Book a free scoping reviewWhat You Receive From CTPAT and AEO Readiness
Every CTPAT criterion or AEO requirement rated, with evidence.
Actions in priority order, with owners and dates.
Access, perimeter, cargo areas, and seals checked on site.
Supplier and carrier security, with a monitoring approach.
Records organized for the security profile or AEO application.
A readiness view your management can sign off.
CTPAT Certification Cost and Timeline
CBP charges nothing to join CTPAT. The real cost is preparation. Our readiness work is priced in a tailored proposal after a free scoping review.
What drives the cost
- Program: CTPAT, AEOC, AEOS, or a mix
- Sites: facilities, warehouses, and ports in scope
- Partners: how many suppliers and carriers to review
- Starting point: existing security or ISO 28000 controls
- Countries: overseas sites that need a visit
How long it takes
| Readiness | Usually 6–12 months |
|---|---|
| CBP review | About 90 days |
| Validation | Scheduled by CBP |
| Upkeep | Yearly profile update |
Frequently Asked Questions About CTPAT and AEO
Straight answers on CTPAT certification, AEO status, criteria, cost, and timeline.
What is CTPAT certification?
CTPAT certification means U.S. Customs and Border Protection (CBP) has accepted your company into the Customs Trade Partnership Against Terrorism. It is a voluntary program for companies that meet CBP's Minimum Security Criteria for their role in the supply chain.
What does C-TPAT stand for?
C-TPAT stands for Customs Trade Partnership Against Terrorism. CBP now writes it as CTPAT, without the hyphen, but both spellings refer to the same program.
Who grants CTPAT certification?
Only CBP grants it. Accredify Global does not issue CTPAT or AEO status. We prepare your company for CBP's review and validation, or for your customs authority's AEO audit.
Is CTPAT certification free?
Yes. CBP does not charge to join CTPAT. The real cost is the internal work and any security improvements needed to meet the Minimum Security Criteria and keep evidence current.
What are the CTPAT requirements?
CBP's Minimum Security Criteria cover three focus areas: corporate security, transportation security, and people and physical security. Within them are 12 categories, from risk assessment and cybersecurity to seal security and personnel security.
What are the CTPAT tiers for importers?
Tier 1 means CBP has certified your security profile. Tier 2 means CBP has validated your practices in person. Tier 3 recognizes validated importers whose security goes beyond the minimum criteria.
How long does CTPAT certification take?
Preparing a security profile can take weeks or months, depending on your operations. CBP aims to review a submitted profile within about 90 days. Validation follows after certification, and CBP revalidates members periodically.
What is AEO certification?
AEO stands for Authorised Economic Operator. It is trusted-trader status granted by a national customs authority to companies that meet criteria based on the World Customs Organization SAFE Framework.
What is the difference between AEOC and AEOS?
In the EU, AEOC covers customs simplifications and AEOS covers security and safety. A company can hold both. AEOS is the type recognized under mutual recognition agreements with other countries.
What are the EU AEO criteria?
Applicants must show a good record of customs compliance, a satisfactory system of trade and transport records, and financial solvency. AEOC also needs practical competence or professional qualifications, and AEOS needs appropriate security and safety standards.
Is CTPAT recognized by the EU?
Yes, through mutual recognition. The EU and the United States recognize each other's trusted-trader programs, so CTPAT and EU AEO security status are treated as comparable. The EU has similar agreements with seven other countries.
Can a foreign manufacturer get CTPAT certification?
Most foreign manufacturers cannot join CTPAT directly, although Mexican manufacturers are eligible. Overseas suppliers are still affected, because CTPAT importers must check that their business partners meet CBP's security criteria.
Does CTPAT include cybersecurity requirements?
Yes. Cybersecurity is one of the 12 Minimum Security Criteria categories. It covers topics such as policies, access control, passwords, and protection of systems used in the supply chain.
Does Accredify Global audit our overseas suppliers?
We can review supplier security against CTPAT business partner requirements as part of a readiness program. The scope and locations are agreed in your tailored proposal.
How much does CTPAT or AEO readiness cost?
The cost depends on your role, the number of sites, trade lanes, and business partners, and how mature your security controls are. Accredify Global reviews your scope for free and sends a tailored proposal.
How long does AEO or CTPAT readiness take?
A typical readiness journey runs 6 to 12 months before the official customs validation. It depends on the gaps found and how quickly your sites close them.
Be Ready Before CBP or Customs Visits
Tell us about your business type, sites, and partners. We'll confirm which program fits, recommend a timeline, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.