Authorised Economic Operator (AEO) status in the EU and UK and CTPAT (Customs Trade Partnership Against Terrorism) in the United States are voluntary "trusted trader" programmes. A business opens its customs controls and supply chain security to an audit, and in return customs treats it as lower risk: fewer physical and documentary checks, priority when it is checked, and access to simplified procedures. The key takeaway is what they are not: neither programme lowers a single rate of duty, and neither replaces your filing obligations. Both descend from the same international template, the World Customs Organization's SAFE Framework, which is why an AEO in one country can be recognised by another through a mutual recognition arrangement (MRA). This guide covers the EU and UK AEO types, the CTPAT tiers, the MRA lists as published in October 2026, and how to decide whether the effort pays for your business.
Where AEO and CTPAT come from: the WCO SAFE Framework
CTPAT came first: US Customs launched it after the 2001 attacks, and Congress put it on a statutory footing in the SAFE Port Act of 2006 (6 U.S.C. 961 onward). The World Customs Organization adopted the SAFE Framework of Standards in June 2005 to give every customs administration a common model. It rests on three pillars: customs-to-customs cooperation, customs-to-business partnership, and customs cooperation with other government agencies. The AEO concept sits under the customs-to-business pillar, and mutual recognition is one of its standards.
The WCO published a new edition in September 2025, adding, among other things, a code of conduct requirement for AEOs and a push to make AEO programmes accessible to small businesses. National programmes adopt such changes on their own timetables, so the framework shows the direction of travel, not today's rules in any one country.
EU AEO: AEOC vs AEOS
In the EU, AEO status is set out in Articles 38 and 39 of the Union Customs Code (Regulation (EU) No 952/2013). The European Commission says the programme has been fully operational since 1 January 2008. There are two authorisations, which can be held separately or together:
- AEOC (customs simplifications): makes it easier to obtain simplified procedures, with fewer controls related to customs legislation. Some simplifications are reserved for AEOC holders by law: under the UCC, centralised clearance (Article 179) and self-assessment (Article 185) can only be authorised for an AEOC, and an AEOC can apply for a comprehensive guarantee at a reduced amount (Article 95).
- AEOS (security and safety): fewer security and safety controls, prior notification of a physical control, and the status that foreign customs administrations recognise under mutual recognition.
- Both: the Commission's statistics call the combined status "AEOF". At December 2024 there were 18,437 valid EU authorisations: 8,868 AEOC, 753 AEOS and 8,816 combined.
Every AEO is entitled to fewer physical and document-based controls than other operators (Article 38(6) UCC), priority treatment if selected for control, and the option to ask for the control to take place at a specific location. One status is recognised in all Member States, and a trader can hold only one.
The criteria in Article 39 are the same five for everyone, with the last two depending on the type:
- No serious or repeated infringements of customs and tax rules, and no record of serious criminal offences relating to the business.
- A high level of control of operations and the flow of goods, through commercial and transport records that allow customs audits.
- Financial solvency.
- For AEOC: practical standards of competence or professional qualifications directly related to the activity.
- For AEOS: appropriate security and safety standards, covering physical integrity and access controls, logistical processes, handling of specific goods, personnel, and identification of business partners.
Any business established in the EU customs territory that holds an EORI number and is involved in customs-related activity can apply, and the Commission names importers, exporters, manufacturers and freight forwarders among the eligible supply chain actors. Applications go to the customs authority of the Member State where the main customs accounts are held or accessible, mostly through the EU Trader Portal.
UK AEO after Brexit
The UK runs its own AEO programme through HMRC, with the same two types. HMRC's guidance (last updated 4 August 2026) lists the benefits as follows. For AEOC in Great Britain: a faster application process for other customs simplifications, a lower risk score and a guarantee waiver up to your deferment account level, with extra benefits for Northern Ireland traders, including a 70% reduction in the deferment guarantee. For AEOS: a lower risk score, priority treatment for customs controls, reduced data for entry and exit summary declarations, and mutual recognition.
HMRC checks compliance, record keeping, financial solvency and practical competence over the last three years, and expects positive net assets except in special circumstances. The person responsible for customs matters should be based in the UK, and each legal entity in a group applies separately: status cannot be granted to a single site or branch. Applying confirms you are ready for an on-site HMRC audit visit, and HMRC says the status "can take up to 120 days to approve". You need a GB EORI number (or one beginning XI for Northern Ireland). For the declaration side of UK imports, see our guide to UK customs declarations, CDS, EORI and postponed VAT.
CTPAT: tiers, minimum security criteria and Trade Compliance
CTPAT is run by US Customs and Border Protection (CBP). As of CBP's programme page (last modified 24 September 2026), it has more than 11,400 certified partners, which CBP says account for over 52% by value of cargo imported into the US. CBP states there are no costs to join, and you do not need an intermediary to apply.
The SAFE Port Act creates three tiers, which CBP still uses:
| Tier | How you get there | Benefits in the statute |
|---|---|---|
| Tier I (certified) | CBP reviews your application and security profile. The Act says CBP should, to the extent practicable, certify within 90 days. | Limited: a reduction in your Automated Targeting System risk score of no more than 20% of the high-risk threshold. |
| Tier II (validated) | A Supply Chain Security Specialist validates your practices, including on-site visits, to the extent practicable within one year of certification. | Reduced risk scores, reduced examinations and priority searches of cargo. CBP describes Tier II as the level with full programme benefits. |
| Tier III (exceeding) | Granted case by case to members whose validation shows security practices that exceed the minimum criteria. | Further reductions in examinations and risk score, priority for examinations and expedited release at all threat levels. |
CBP's FAQ says CTPAT operates on a four-year validation cycle. Its benefit list also includes front-of-the-line inspections, FAST lane access at land borders and business resumption priority after a disruption.
The Minimum Security Criteria (MSC) are written per business type. The importer edition posted on CBP's site (October 2021) groups 12 categories into three focus areas: corporate security (security vision and responsibility, risk assessment, business partners, cybersecurity), transportation security (conveyance and instruments of international traffic security, seal security, procedural security, agricultural security) and people and physical security (physical security, physical access controls, personnel security, and education, training and awareness). The business partner section is where forced labour due diligence sits, which links CTPAT to UFLPA detention risk.
CTPAT Trade Compliance is the customs compliance layer, open only to importers. It replaced the Importer Self-Assessment programme. CBP's February 2023 handbook requires Tier II or Tier III security status in good standing, at least two years of import history for every importer of record number joining, no unpaid final debt to CBP, a memorandum of understanding and an Application Review Meeting. Benefits include an assigned National Account Manager, priority handling of ruling requests, 30 days to self-assess and disclose before CBP acts on errors that may breach 19 U.S.C. 1592, and exemption from Focused Assessment audits (single-issue audits can still happen). Keeping that status depends on records that would survive an audit anyway, so our customs audit readiness guide is a useful starting point.
EU, UK and US programmes side by side
| EU AEO | UK AEO | US CTPAT | |
|---|---|---|---|
| Legal basis | UCC Articles 38 and 39 | HMRC programme (UK customs law) | SAFE Port Act 2006, 6 U.S.C. 961 onward |
| Types or levels | AEOC, AEOS or both | AEOC, AEOS or both | Tier I, II, III, plus Trade Compliance for importers |
| Who can apply | EU-established operators with an EORI | GB or NI-established legal entities with an EORI | Listed entity types, mostly US-based, plus Mexican and Canadian manufacturers and some carriers |
| Published decision time | 120 days from acceptance, extendable | "Up to 120 days" | Certification within 90 days where practicable |
| Fee | No fee named on the Commission page; the main cost is internal preparation | No fee named by HMRC; the main cost is internal preparation | CBP: no costs to join |
| MRA partners (October 2026) | 8 | 12 | 19 |
Mutual recognition: which countries recognise which
An MRA means two customs administrations accept each other's trusted trader audits. The benefit normally runs to the goods: a shipment from a recognised foreign AEO is scored as lower risk at import. CBP's own description is that it counts a partner programme membership as a risk factor and avoids duplicate validations. As published in October 2026:
- EU (Commission page): Canada, China, Japan, Moldova, Norway, Switzerland, the United States and the United Kingdom.
- UK (HMRC, updated 4 August 2026 when Australia was added): Australia, Canada, China, the European Union, Japan, New Zealand, Singapore, South Africa, South Korea, Switzerland, Turkey and the United States.
- US (CBP, 19 MRAs as of June 2025): New Zealand, Canada, Jordan, Japan, Korea, the European Union, Taiwan, Israel, Mexico, Singapore, the Dominican Republic, Peru, the United Kingdom, India, Uruguay, Brazil, Guatemala, Colombia and South Africa.
Two limits are worth knowing. CBP says its MRAs are based on security only and do not cover customs compliance. And mutual recognition generally means an AEOS-type status: under HMRC's guidance the MRA benefit belongs to AEOS holders, and in the EU it is listed as an AEOS benefit, not an AEOC one.
Common misconceptions
- "AEO or CTPAT lowers my duty." It does not. Neither the UCC criteria nor CBP's benefit list includes a lower tariff rate. The financial benefits are indirect: fewer holds and exams, smaller or waived guarantees, faster rulings. Your duty bill still depends on classification, origin and valuation.
- "Members skip the filings." CBP states that mutual recognition does not exempt anyone from other requirements such as ISF 10+2. In the EU, AEOS brings fewer controls, but the entry summary data under ICS2 still has to be filed.
- "A foreign supplier can just join CTPAT." CTPAT's foreign manufacturer category covers Mexico and Canada. An exporter in, say, India or Singapore earns recognition through its own national AEO programme and the MRA.
- "Status is permanent." EU AEO status is monitored and can be suspended or revoked; CTPAT is revalidated on a four-year cycle; HMRC expects you to report business changes.
- "It replaces aviation security approvals." AEO and CTPAT are customs programmes. Air cargo screening rests on separate regimes such as known consignor status, covered in our air cargo security guide.
The EU reform: AEO stays, "Trust and Check" arrives
The EU agreed a reform of the customs code in March 2026, and, according to the Council, gave the reform its final approval in September 2026. The European Parliament's account of the deal says "the current AEO qualification will remain in place" so that smaller operators can still reach trusted status, while a new, more demanding "trust and check" category will offer less frequent inspections and more flexibility on paying duties to operators that share extensive data with customs. Detailed criteria and start dates depend on the published text and implementing rules, so AEO remains the status to plan for today.
Who should bother
The programmes reward volume and repetition. A business with a handful of entries a year will rarely recover the cost of documenting procedures, screening staff and hosting audits. The case is strongest for:
- Regular importers with time-sensitive inventory, where an exam or hold has a real cost.
- Exporters selling into MRA countries, whose AEOS status is recognised at destination.
- Freight forwarders, NVOCCs and consolidators: eligible for EU and UK AEO and for CTPAT as consolidators or ocean transportation intermediaries, and trusted trader status can come up in shipper tenders. Congress also directed CBP in October 2024 to pilot CTPAT participation for third-party logistics providers (Pub. L. 118-98).
- Customs brokers and declarants, whose controls customs relies on for other people's declarations. Licensed US customs brokers are a CTPAT entity type.
- Carriers and terminal operators, especially at land borders, where FAST lane access matters.
If you are choosing a provider rather than applying yourself, treat trusted trader status like the other freight forwarder credentials you can check: ask for the reference number and the exact type (AEOC, AEOS or both; CTPAT tier), because "we are AEO" can mean a simplifications status with no security element at all.
What to do next
- Write down what you would actually use: fewer exams, centralised clearance, guarantee relief, MRA recognition at destination. If the list is short, the audit effort probably is not worth it yet.
- Run a gap check against the criteria that apply to you: Article 39 UCC for the EU, HMRC's criteria for the UK, the Minimum Security Criteria for your CTPAT entity type.
- Get three years of clean records in order (two years of import history for CTPAT Trade Compliance), and name the person responsible for customs.
- Apply through the right channel (EU Trader Portal or national portal, HMRC, or the CTPAT Portal) and plan for an on-site visit within the published timelines.
Whether you hold trusted trader status yourself or want a partner who does, more than 29,300 logistics companies are searchable by country and service in the CargoLinked directory, so you can shortlist forwarders and brokers on the lanes you ship and ask each one about its status directly. If you have a shipment ready, the public requests board lists freight that shippers have posted for forwarders to quote on directly.
This guide is general information, not legal, tax, financial or customs advice. Programme criteria, benefits and mutual recognition lists change: confirm the current position with the European Commission, the relevant EU Member State customs authority, HMRC or CBP, or with a licensed customs professional, before you apply or rely on a benefit.
