For decades, a customs penalty had a soft landing. A new executive order is taking most of that away. Here's what changed, where you're still protected, and what your team needs in place now.
For years, the worst case on a customs penalty wasn't the number on the notice. It was the starting point for a negotiation you usually won.
Under CBP's long-standing mitigation guidelines, a company with a clean history and good-faith effort could bring an assessed penalty down hard. A mitigation petition could cut a first-time negligence penalty to a fraction of the original assessment. The system was built to reward good actors who made honest mistakes, and most compliance officers have spent their whole careers inside that cushion.
Most of that cushion is going away.
On June 3, 2026, the president signed Executive Order 14411, "Strengthening Customs Enforcement". It directs the Department of Homeland Security and CBP to rewrite the trade enforcement playbook, and one instruction lands directly on your risk.
The order tells CBP to revise all of its mitigation guidelines and set a minimum penalty floor of not less than 50% of the assessed penalty. The only stated exception is "exceptional circumstances that materially impact national security." There's no carve-out for a written compliance program, for training or for internal controls. Repeat offenders get no mitigation at all.
Trade lawyers read it the same way. Holland & Knight looked at the long run of nominal mitigation and concluded, "That era appears to be over." Akin Gump flagged the same 50% floor and the repeat-offender rule.
Be precise about timing, because it drives your planning. The order set a 90-day deadline for the mitigation changes, which fell in early September 2026. A second, bigger set of importer of record changes carries a 180-day deadline, around the end of November. Morrison Foerster notes that the order doesn't change legal standards by itself. It directs agencies to act, and some of that action still runs through guidance and rulemaking. So watch for CBP's published revisions. The direction is set either way, and the clock is short.
If you want the full rundown of who the order touches, from importers of record to brokers and forwarders, we covered that in who the customs enforcement executive order affects. This post stays on the money.
Here's the part that gets lost in the headlines.
Prior disclosure is written into the penalty statute, not the mitigation guidelines. If you tell CBP about a violation before it opens a formal investigation, and you pay the lost duties, the penalty for a negligent or grossly negligent violation is capped at interest on those duties. That cap comes from Congress. An executive order directing CBP to revise its guidelines doesn't rewrite it.
So the new math pushes in one direction. The old back door, taking the penalty and petitioning it down later, is worth a lot less once a 50% floor is in place. The front door, finding the problem yourself and disclosing it first, is worth more than it's ever been.
There's a catch, and it's the whole point of this post. You can only disclose what you find. Prior disclosure has to come before CBP starts asking questions. Once a request for information or a notice of action lands, that window is closing. A team that reviews its own entries, partners and procedures on a schedule finds problems in time to disclose them. A team that finds out from CBP doesn't get the choice.
(Your trade counsel should make the call on any specific disclosure. The mechanics matter, and so does the timing.)
Reasonable care has always been your legal duty as the importer of record. It's written into 19 U.S.C. § 1484. The duty hasn't moved. What moved is the safety net underneath it.
Negligence, in customs terms, is a failure to exercise reasonable care. If you can show you exercised it, there's no negligence penalty to mitigate in the first place. That was always your strongest defense. It used to be backed by a generous fallback: even if the argument didn't fully land, a clean record and a good-faith story usually knocked the penalty way down in mitigation.
That fallback now bottoms out at half. At today's duty rates, half of a large penalty is real money.
So the question for your team shifts. Everyone believes they're careful. What matters now is whether you can prove it, quickly, with dated records, on the day CBP asks.
This is where most importers are quietly exposed. The evidence of their care lives in spreadsheets, email threads and a shared drive only three people know their way around. When a penalty notice arrives, the response turns into a scavenger hunt. You're reconstructing decisions from memory. You're hunting for the backup on an entry from eighteen months ago. You're doing it against a deadline, with interest accruing, and the person who made the original call may not even work there anymore.
That pile isn't a compliance program. It's the absence of one, dressed up.
Reasonable care shows up in two layers, and most companies only think about one.
The first is the entry itself: classification with the reasoning attached, origin you can trace back to the source, valuation support tied to each entry. That usually lives with your broker and trade compliance team.
The second is the program around it, and it's where a penalty defense is often won or lost. Who you do business with and how you vetted them. Whether your suppliers' certifications and documents are current or a year stale. The written procedures your people follow, the training they've completed, the internal reviews you ran and what you fixed afterward. This is what shows CBP that an error was an exception inside a working system and not a symptom of no system at all.
The companies that hold their ground share one trait. They can produce both layers on demand. All of it in one place, dated and owned. Filed, and ready to hand over.
That second layer is what Veroot was built for. We replace the spreadsheet-and-email sprawl behind CTPAT and supply chain security programs with a defensible system of record, from continuous business partner monitoring to audit-ready evidence, backed by compliance experts who know what CBP asks for.
If you're weighing whether to formalize that program with CBP, our breakdown of CTPAT Security vs. CTPAT Trade Compliance covers which fits your company.
Enforcement isn't slowing down. The joint DOJ and DHS Trade Fraud Task Force reported passing $1 billion in civil and criminal recoveries, penalties, forfeitures and publicly charged losses in less than a year. In May 2026, Perfectus Aluminum and related companies agreed to pay $549.5 million to settle False Claims Act allegations that they evaded antidumping and countervailing duties on aluminum extrusions from China.
That's a fraud case, not a negligence penalty. It still tells you where the government's appetite is, and appetite sets the tone for everything below it.
Put the math in front of your CFO in one line. When a penalty lands, mitigation can now take it down by half at most, and a repeat violation gets nothing. The cheapest outcomes left are proving reasonable care so there's no violation, or finding the problem first and disclosing it. Both depend on records you have to build before you need them. A documented compliance program costs far less than a penalty you can't defend. That's insurance you can actually collect on.
Everyone thinks they're a good actor. The question is whether you could prove it in a week if you had to. If you're not sure, find out now, not during a penalty response.
See where your program stands. The CTPAT maturity assessment scores your controls across seven security domains in about ten minutes. Want a second set of eyes on what you could produce today? Talk to a Veroot compliance specialist.
Executive Order 14411, signed June 3, 2026, directed CBP to revise its mitigation guidelines so that a mitigated penalty can't fall below 50% of the assessed penalty, except in exceptional circumstances that materially affect national security. Repeat offenders get no mitigation. The order gave CBP 90 days to make the mitigation changes.
The prior disclosure penalty cap comes from the statute, 19 U.S.C. § 1592(c)(4), not from CBP's mitigation guidelines. For negligent or grossly negligent violations, a valid prior disclosure limits the penalty to interest on the unpaid duties, provided the duties are paid. The executive order doesn't amend the statute. Confirm how CBP applies its revised guidelines to your facts with trade counsel.
It's the legal standard the importer of record must meet when entering goods under 19 U.S.C. § 1484. In practice it means you took the steps a careful importer would take on classification, value, origin and the partners in your supply chain, and you can show it with records. Customs negligence is defined as a failure to exercise reasonable care, so proving it is your main defense against a negligence penalty.
Keep dated, retrievable evidence of your controls. Review your own entries, partners and procedures on a set schedule so you find errors early enough to disclose them. Fix what you find and document the fix, because a repeat violation now loses mitigation entirely.