For a U.S. importer, supply chain due diligence comes down to one test. When U.S. Customs and Border Protection (CBP) detains a shipment, can you produce records that trace the goods and every input back to raw material before CBP's deadline? This guide is current as of September 28, 2026. It covers what CBP asks for, which evidence standard you may face, which lists to screen against, and how to build the supplier file before you need it.
What CBP Asks For When It Detains a Shipment
Under 19 CFR 151.16, CBP has five business days from presentation to decide whether to release or detain goods. If it detains them, the notice must give the reason and the expected length of the detention. It must also describe "the nature of any information which, if supplied to CBP, may accelerate the disposition." CBP then has 30 days from presentation to decide whether the goods can enter. If it misses that deadline, the goods are treated as excluded, and you can protest the exclusion.
For detentions under the Uyghur Forced Labor Prevention Act (UFLPA), CBP's enforcement FAQ says each notice includes "an attachment that specifies the information CBP is requesting from the importer." The FAQ refers to an "initial 30-day detention period." An importer that needs more time "may request an extension from the Port Director or applicable Center Director." You have to ask for an extension, and CBP decides whether to grant it. Plan around the 30 days.
CBP's UFLPA FAQ, in its guidance for applicability reviews, says importers should provide "documentation produced in the ordinary course of business (and translated into English if necessary)." It then lists the records it expects, which we summarize here: transaction and supply-chain documents showing the origin of the goods and their components, the parties involved in making, handling, and exporting them, where the raw materials came from, and proof that the transactions happened financially and physically. Work from the FAQ itself for the exact wording.
Use that sentence as your spec. It asks for four things: where the good and its components came from, every party that handled it, where the raw materials came from, and proof that the goods and the money actually moved. Everything below is about being able to meet it.
Two Arguments, Two Evidence Bars
Section 3(a) of the UFLPA sets a presumption. Goods "mined, produced, or manufactured wholly or in part" in China's Xinjiang Uyghur Autonomous Region (XUAR), or made by an entity on the UFLPA Entity List, are presumed prohibited under 19 U.S.C. 1307 and "not entitled to entry." You can respond in one of two ways.
Applicability review: the presumption does not apply. CBP's FAQ says that if merchandise "was not produced in whole or in part in the XUAR or by an entity on the UFLPA Entity List, the rebuttable presumption established by the UFLPA does not apply." This is an argument about tracing. You need records that follow the material from origin forward and show no XUAR input and no listed party anywhere in the chain. CBP's February 2024 best-practices guidance (Publication 3083-0223) covers how to structure the executive summary and table of contents for this kind of submission.
Exception: the link exists, but there was no forced labor. Under section 3(b), CBP can grant an exception only if the importer meets three conditions:
- It fully complied with the statute's importer guidance.
- It "completely and substantively responded to all inquiries for information."
- It showed "by clear and convincing evidence" that the goods were not made with forced labor.
That standard is well above the more-likely-than-not threshold most commercial disputes use. Exceptions are also public: section 3(c) requires CBP to report each one to Congress and make it public within 30 days.
How deep you trace matters. CBP's FAQ asks whether a tier-three or tier-four supplier in the XUAR brings goods under the presumption. It answers: "Yes. Any goods made with any inputs from XUAR are presumed to be made with forced labor under UFLPA." A clean tier-one factory tells you nothing about the cotton or polysilicon further up the chain.
Two more FAQ points affect how you build the file. First, CBP "will consider laboratory test results as part of the total package," such as isotopic testing of cotton. Test results add to your documents but do not replace them. Second, if CBP has already found a supply chain admissible, say in your package that the supply chain is "identical to a previously reviewed supply chain." That only works if you file past submissions by supply chain rather than by shipment.
The Supplier File, Section by Section
The six sections below are our own structure, not a CBP form. What goes in each one comes from the FAQ language quoted above.
- Party map. List every entity that mined, grew, processed, manufactured, handled, or exported the good. Give each one's legal name, aliases, address, owners, and role, tier by tier. This is also the list you screen.
- Bill of materials tied to lots. A general bill of materials tells CBP what a product is made of. A lot-level record tells CBP what this shipment was made of. Link each input to the purchase and production run that supplied it.
- Raw-material origin. For inputs in a DHS high-priority sector (listed below), keep the record from where the material started: where the fiber was ginned, where the metal was smelted, where the polysilicon was made. This is the tier most files are missing.
- Financial and physical proof. Purchase orders, invoices, and payment records show that money moved between the parties on your map. Packing lists, production records, and transport documents show that the goods moved.
- Translations. Translate records into English when you onboard the supplier, not during the 30-day window.
- Your diligence log. Record when you screened each party, against which list version, what you found, and what you did about it. Section 2(d)(6) says the importer guidance covers "due diligence, effective supply chain tracing, and supply chain management measures." A dated log shows those measures were in place before the detention.
On June 12, 2026, CBP combined its forced-labor guidance into one document, the Forced Labor Enforcement Operational Guidance for Importers (Publication 5359-0126). It covers 19 U.S.C. 1307, the UFLPA, and the Countering America's Adversaries Through Sanctions Act. Its appendices include recommended supply chain documentation for the UFLPA high-priority sectors. If you import in one of those sectors, build your file against CBP's current version of that appendix.
Screening: Which Lists, and How Often
Different agencies maintain the lists that matter to an importer, and no single search covers them all.
UFLPA Entity List (DHS). An interagency task force chaired by the Department of Homeland Security (DHS) maintains this list. A Federal Register notice effective August 3, 2026 added 43 entities, bringing the total to 187. Forty-one of the additions fall in the category for entities that source material from the XUAR or from state labor-transfer programs. That category is based on what a company buys, not where it is located. As of September 28, 2026, the newest additions on DHS's list page still carry the August 3 effective date. Our analysis of the August 2026 expansion covers the details.
Entries on the list include aliases. For example, Hoshine Silicon Industry (Shanshan) Co., Ltd is listed with the alias Hesheng Silicon Industry (Shanshan) Co. Match against aliases, not just one spelling.
High-priority sectors (DHS). DHS's 2025 strategy update names these sectors:
- aluminum
- apparel
- cotton and cotton products
- polyvinyl chloride (PVC)
- seafood
- silica-based products, including polysilicon
- tomatoes and downstream products
- caustic soda, copper, lithium, red dates, and steel (added in 2025)
DHS tells importers to "focus due diligence on supply chains that intersect with these sectors." As of September 28, 2026, the August 19, 2025 update is the most recent one listed on DHS's strategy page.
Sanctions and export-control lists. The Treasury Department's Office of Foreign Assets Control (OFAC) maintains the Specially Designated Nationals (SDN) list. Its 50 Percent Rule "applies to entities owned 50 percent or more in the aggregate by one or more blocked persons." A supplier that appears on no list can still be blocked because of who owns it. That is why owners belong on your party map. The Commerce Department's Consolidated Screening List (CSL) combines lists from Commerce, State, and Treasury into one search. When we checked the CSL page on September 28, 2026, the UFLPA Entity List was not among the lists it names. A CSL search does not cover UFLPA.
How often to screen. Screen at onboarding, whenever a list is revised, and whenever a supplier changes its name, owners, or sub-suppliers. After a revision, re-run open purchase orders and cargo already in transit as well as new orders.
Onboarding and Monitoring
The 30-day window is why this work belongs at onboarding. If you first ask a tier-three supplier for records during a detention, they may not arrive in time. A supplier also has the least reason to help once it has already been paid.
For a new supplier in a high-priority sector, or with any input sourced from China, we recommend four steps:
- Map it down to raw material, including owners.
- Screen every party on the map and log the date and list version.
- Contract for records. Get a written commitment that the supplier will produce its ordinary-course records, with English translations, for any lot within a set number of days.
- Test one lot now. Build the full trace while nothing is detained. If the trace breaks, you have a sourcing problem you can still fix.
After onboarding, re-screen whenever a list is revised. Re-trace whenever a bill of materials or a sub-supplier changes. Run at least one sample trace per supplier each year.
Keep the file as long as the entries it supports. Under 19 U.S.C. 1508, importers must make, keep, and produce records for CBP. Under 19 CFR 163.4(a), the general retention period is five years from the date of entry. We keep the supplier file on the same five-year schedule.
Document Standards: What Makes a Record Usable
A file can hold the right documents and still fail if CBP can't follow it. We apply six standards:
- Created in the ordinary course of business. Records made during normal operations carry more weight than documents written after a detention to explain it.
- Names that match. The name on the invoice should match the name on the party map and in the screening log. If they differ, note why.
- Quantities that reconcile. Quantities should add up from raw material to the finished goods on the entry.
- Translated. Keep each original next to its English translation.
- Clearly structured. Open with an executive summary, then a table of contents, then the party map.
- Retrievable within days. Keep one folder per supply chain, indexed by lot.
A supplier attestation is a claim, not a record. It can go in the file, but it does not show where the cotton was ginned.
What Changed in 2026
As of September 28, 2026, four dated developments shape this file:
- June 12: CBP combined its forced-labor guidance for importers into one document (above).
- July 31: DHS announced the Entity List expansion. It stated that "since enactment of the UFLPA, CBP has denied entry to more than 24,300 shipments pursuant to this expanded authority, valued at nearly $1 billion." For current figures, check CBP's UFLPA statistics dashboard.
- August 3: The Entity List reached 187 entities.
- September 2: CBP published an advance notice of proposed rulemaking (ANPRM), "Heightened Import Disclosures for Supply Chain Visibility," at 91 FR 56408, docket USCBP-2026-1058. Comments must be received on or before December 1, 2026.
The ANPRM asks whether importers should provide six categories of their supplier's foreign export documents: the export declaration, the commercial invoice declared to foreign customs, the packing list, the certificate of origin, any export license, and the transport documents. An ANPRM creates no obligations; it is CBP asking questions before drafting a rule. Our ANPRM explainer covers the questions and how to comment.
Not on its own. CBP asks for ordinary-course records showing origin, every party involved, where the raw materials came from, and that the transactions happened "financially and physically." A signed statement shows none of that. Keep it in the file, but build the file on records.
None of my suppliers is on the Entity List. Am I covered?
No. The presumption also covers goods made wholly or in part in the XUAR, whether or not a listed entity is involved, and that includes inputs from tier three or four. A clean list screen is necessary but not sufficient.
How long do I have once a shipment is detained?
Under 19 CFR 151.16, CBP must decide whether the goods can enter within 30 days of presentation. If it doesn't decide in that time, the goods are treated as excluded. CBP's UFLPA FAQ says you can ask the Port Director for an extension, but CBP decides whether to grant it. In practice, the file has to exist before the detention.
How long should I keep supplier due diligence records?
19 CFR 163.4(a) sets a general five-year retention period from the date of entry. Keep the supplier trace for as long as you keep the entries it supports.
How Strix Helps
We work with importers on supply chain due diligence in four ways:
- Clear: Our licensed brokers file your entries at all U.S. ports and handle the entry side when a shipment is held.
- Consult: Our compliance team reviews your party maps, screening, and traces against what CBP asks for, before a detention tests them.
- Comply: We handle screening, origin documentation, and record organization as ongoing work.
- Automate: Our ABI-certified self-filing software costs $30 per entry. ABI is the Automated Broker Interface, CBP's system for electronic filing.
To document your process, start with the Supply Chain Due Diligence Template on our downloads page or see our compliance consulting services. If you aren't sure your file would hold up against a detention notice, talk to our team.