CBP just made a free 20-hour form compulsory for 2,028 brokers by May.

Start with what the rule actually does, because the trade press has read it as a crackdown on fraud and it is also a licensing event. The prohibition is flat: “foreign IORs are prohibited from making informal entry of merchandise for consumption” unless CTPAT validated or using a validated broker, and formal entry carries the same condition. United States importers are not exempt from the paperwork either — from 5 January 2027 they must declare their qualification on CBP Forms 3461 and 7501. Brokers must verify each client’s qualification and keep the record for five years under 19 CFR §§ 111.21, 111.23 and 111.29, a power of attorney under § 141.46 is required even where the broker is itself the importer of record, and the penalty appendix for brokers at Appendix B to Part 171 is rewritten. Requests for delayed compliance are due by 5 January 2027, which is also the day comments close.

Now the thing that is free. CTPAT is a voluntary partnership; 6 U.S.C. § 962 makes “importers, customs brokers, forwarders, air, sea, land carriers, contract logistics providers, and other entities in the international supply chain” eligible to apply, and 6 U.S.C. § 964(c) asks the Commissioner to finish Tier 1 certification within 90 days of receiving an application, but only “to the extent practicable.” CBP charges nothing for it. What the application costs is time, and CBP has published the figure twice: 20 hours a response, signed both times by Seth D. Renkema, Branch Chief of the Economic Impact Analysis Branch. The programme has run at 750 to 770 applications a year for four years without moving.

Against that steady state, measure the stock the rule has just created. 2,028 permitted brokers are not validated. Only 0.4% of foreign IORs are CTPAT validated, and while 68% of foreign IORs already use CTPAT validated brokers, the remaining 32% must switch brokers or get validated themselves. The brokers are not a side population: “About two-thirds of brokers have submitted an entry summary for a foreign IOR,” so roughly 1,733 of the 2,600 have a book that touches this rule. At 770 applications a year the whole broker stock takes 2.6338 years, and the compliance date is in 181 days.

CBP’s reason for doing it is priced in the rule and it is worth reading, because it is the same number from the other side. Non-CTPAT foreign importers of record owed $1.01 billion in uncollected bills as of 6 February 2026. Lost revenue from foreign IORs between January 2020 and 27 August 2026 was $1.16 billion, of which $35.7 million was recovered — a 3.1% collection rate against 15.2% for United States importers. Per entry summary the uncollected bill is $34.08 for a non-CTPAT foreign importer and $1.21 for a validated one. Seizures run 6.38 per million entry summaries against 1.14. And the register CBP is cleaning holds roughly 55,000 accounts with fake telephone numbers, 45,000 with fake email addresses, and over 870 unique CBP Form 5106 accounts sharing a single physical address.

Here is the non-consensus reading, and the evidence for it is CBP’s own table. Everyone is reporting a crackdown on anonymous foreign importers. What the rule measurably does is put a price on a membership that has always been free: $32.87 per entry summary, the gap between $34.08 and $1.21, a ratio of 28.1653 to one. A credential worth nothing on Thursday is the condition of trading on 5 January 2027, and the agency that issues it processes about 64 a month. That is not a compliance story. That is a queue, and queues are where small operators get paid.

The work inside the queue is the 20 hours CBP itself named, and the question that decides whether a non-broker may sell those hours is answered, on its face, by the regulation. 19 CFR § 111.1 defines “customs business” as “those activities involving transactions with CBP concerning the entry and admissibility of merchandise, its classification and valuation, the payment of duties, taxes, or other charges” and the refund of them, extended to the preparation of “documents … intended to be filed with CBP in furtherance of any other customs business activity.” A supply-chain security profile is none of those things. But the same section’s express carve-out, “corporate compliance activity,” reaches only entities related by “more than a 50 percent ownership interest,” so it does not cover an outside consultant, and CBP’s broker modernisation rule at 87 FR 63267 states plainly that “decisions as to what constitutes customs business are made in a case-by-case analysis” with a ruling available under 19 CFR § 177.1. No ruling on CTPAT application preparation for an unrelated client was located on this run. That gap is the whole legal risk of this edition, and it is closable for nothing.

The door, by contrast, is the cheapest this series has priced. A Delaware limited liability company costs “a fee in the amount of $70” to form under Del. Code tit. 6 § 18-1105(a)(3) and “$400” a year in franchise tax under § 18-1107(b) — $470, or 94% of the budget, with $30 left. The regulator charges nothing: no CTPAT fee, no ruling fee. Compare the licensed route in the same trade: 19 CFR § 111.96 sets a $390 examination fee, $300 for an individual licence application or $500 for a corporate one, $100 for a national permit and $100 every three years for the status report — $790 before an FBI fingerprint fee, against an April 2026 examination the brokers’ own association reported at a 22% pass rate.

And the target arithmetic is small, which is the point of a queue this size. $5,000 a month kept after 2026 federal tax, single filer, sole proprietor, needs $75,643.15 of profit — $10,688.04 of self-employment tax and $4,955.12 of income tax, an effective 20.6802%. With the $400 Delaware line that is $76,043.15 of fees, or 25.3477 engagements a year at $3,000 each — 2.1123 a month, 506.95 hours a year at CBP’s own twenty, 42.2462 hours a month. That is 1.2499% of the 2,028 brokers and 1.5398% of the 1,646.1644 the queue will not reach by 6 May 2027. No published price for CTPAT security-profile preparation was found anywhere on this run, so the $3,000 is an assumption and the sensitivity in the playbook is where it is tested.