CARM has been live for importers since October 2024. If you're still treating it like something on the horizon, you're already behind. CBSA has moved the entire import accounting and duty payment system onto this platform — and the penalties for non-compliance aren't theoretical anymore. They're showing up on real accounts.
This guide covers everything you need to actually be compliant: registration, financial security, payment, delegating authority to your broker, and what happens if you get any of it wrong. I'll tell you what most importers miss, what the common mistakes look like, and what to do about them.
Updated June 2026: There are a few developments worth flagging since we first published this — particularly around CBSA's updated trade compliance verification priorities and the surtax remission extension. I've added a new section below covering both.
What CARM Actually Is (And Why It Matters)
CARM stands for CBSA Assessment and Revenue Management. It's CBSA's system for managing import accounting — duty and tax statements, payments, corrections, and financial security. Before CARM, your customs broker handled most of this behind the scenes. You probably never thought much about it.
That's changed.
Under CARM, you as the importer of record are directly responsible for your account. You need your own portal login. You need your own financial security posted with CBSA. You need to know when your statements are due and make sure they get paid. Your broker can still do most of the day-to-day work — but only if you've formally delegated that authority through the portal.
A furniture importer we worked with assumed their broker was handling everything automatically, the way it worked pre-CARM. They weren't wrong to assume that — it's how things worked for decades. But under CARM, the broker couldn't act on their account because the delegation of authority had never been set up. Statements went unpaid. CBSA assessed interest. It took three weeks to sort out, and it cost them more than just the interest — it cost them a shipment delay right before their busy season.
That's the kind of problem CARM creates when you don't take ownership of your account.
The CARM Timeline: Where We Are Now
CARM launched in phases. Here's the short version of how we got here:
- May 2021: CARM Client Portal (CCP) opened for registration. Importers could create accounts but weren't required to use them yet.
- October 2022 (Release 1): Importers could view their account statements and make payments through the portal. Still optional for most functions.
- October 2024 (Release 2): The big one. CARM became mandatory. Financial security requirements kicked in. The old surety bond arrangement through brokers ended. Importers had to post their own security or use a licensed customs broker who had posted security on their behalf under a specific transitional arrangement.
- Now (mid-2026): Full compliance is expected. The transitional period for security is over. If you don't have your own financial security posted and your account set up properly, you're exposed.
CBSA has published several notices and D-memoranda covering the rollout. The key reference document is D17-1-22, which covers CARM requirements for importers. If you haven't read it, your broker has — or should have.
Registering on the CARM Client Portal
You can't do anything in CARM without a portal account. The registration process is straightforward, but there are a few places where importers get stuck.
Step 1: Create Your Business Account
Go to the CARM Client Portal at ccp.cbsa-asfc.cloud-nuage.canada.ca. You'll need a GCKey or a Sign-In Partner credential (like your bank login). Most businesses use GCKey.
You'll register your business using your Business Number (BN). CBSA ties your import account to your BN9 — the first nine digits of your CRA business number. Make sure you're using the right one. If you have multiple legal entities, each one needs its own CARM account.
Step 2: Enrol Your Import Account
Once you're in the portal, you need to enrol your RM account — that's your import/export program account (the BN followed by RM0001, or whatever suffix CBSA assigned you). If you don't know your RM account number, it's on your previous B3s or you can ask your broker.
Step 3: Set Up Your Business Account Administrator
The first person who registers becomes the Business Account Administrator (BAA). This is important. The BAA has full control over the account — they can add users, grant access to brokers, and manage security. Pick someone who's actually going to be responsible for this. Don't make it the owner's assistant who's leaving in three months.
If your BAA leaves or changes, you need to update this immediately. CBSA has a process for it, but it takes time. I've seen accounts get locked up for weeks because the BAA was a former employee and nobody had set up a successor.
Step 4: Delegate Authority to Your Customs Broker
This is the step most importers miss. Your broker cannot act on your CARM account unless you've given them access through the portal. It's not automatic. It's not assumed. You have to go into the portal, find your broker's portal business account, and grant them the appropriate level of access.
Talk to your broker about what level of delegation they need. Most brokers need at minimum the ability to view statements and submit corrections. Some need payment authority too, depending on your arrangement.
Do this before your first statement is due. Not after.
Financial Security Requirements
This is where CARM gets expensive if you get it wrong.
Under the old system, your customs broker posted a bond with CBSA that covered your transactions. That arrangement ended with CARM Release 2. Now you need your own financial security posted directly with CBSA.
Who Needs to Post Security?
Any importer who wants to use the Release Prior to Payment (RPP) program — meaning you want your goods released before you've paid the duties and taxes — needs to post security. If you don't post security, you have to pay duties and taxes before CBSA will release your shipment. For most commercial importers, that's not workable.
How Much Security Do You Need?
CBSA calculates your required security based on your import volume. Specifically, it's based on your highest monthly duty and tax liability over the previous 12 months. The minimum is $25,000. There's no published maximum, but large importers can be looking at hundreds of thousands of dollars.
CBSA will calculate a recommended amount and show it in your portal. You're not required to post exactly that amount, but if you post less and your liability exceeds your security, CBSA can put conditions on your account — including requiring payment before release.
One thing worth flagging right now: if your import mix includes goods subject to Canada's retaliatory tariffs — steel, aluminum, and a range of U.S.-origin goods — your monthly duty liability may be significantly higher than it was a year ago. That means your security requirement may have gone up too. Check your portal. Don't assume the number you posted in late 2024 is still adequate.
What Forms of Security Are Accepted?
- Cash deposit: You send money directly to CBSA. It's tied up until you close your account or reduce your security. Not ideal for cash flow.
- Surety bond: You get a bond from an approved surety company. You pay a premium (typically 1-3% of the bond amount annually) instead of tying up cash. This is what most importers use.
- Other approved instruments: CBSA also accepts certain bank instruments, but surety bonds and cash are the most common.
A mid-sized electronics importer we worked with had about $180,000 in monthly duty liability at peak. Their required security was $180,000. They went with a surety bond — annual premium around $3,600. That's the cost of staying in the RPP program. Worth every dollar compared to the alternative of pre-paying duties on every shipment.
How to Post Security
For a surety bond, your surety company files directly with CBSA. Once it's posted, it shows up in your CARM account. You should verify it's there before your next shipment. Don't assume it's been processed — check.
For cash, you make the payment through the CARM portal or by certified cheque to the Receiver General.
Understanding Your Statement of Account
CARM generates two types of statements:
Daily Notice
This is a running record of transactions posted to your account — B3 entries, corrections, adjustments. It's not a payment demand. Think of it like a transaction log. You should review it regularly to catch errors early.
Monthly Statement of Account (SOA)
This is the one that matters for payment. CBSA issues your SOA on the 25th of each month, covering all transactions from the previous month. Payment is due by the last business day of the following month.
So transactions from January appear on the SOA issued February 25th. Payment is due by the last business day of March.
Miss that deadline and CBSA charges interest at the prescribed rate — currently around 6% annually, compounded daily. It adds up faster than you'd think on a large statement.
Pull up your CARM portal and find your most recent SOA right now. Confirm the balance, confirm the due date, and confirm your payment method is set up. This takes five minutes and it's the most important five minutes you'll spend on compliance this month.
Making Payments Through CARM
You have a few options for paying your statement:
- Online banking: Add CBSA as a payee through your bank. Use your BN15 (your full business number including the RM suffix) as the account number. This is the most common method.
- Wire transfer: For large payments. CBSA has specific wire instructions in the portal.
- Credit card: Available through the portal for smaller amounts. There's a transaction limit.
- Debit card: Same as above.
One thing that trips people up: the payment has to be received by CBSA by the due date, not just initiated. If you're paying by online banking, give it at least two business days. Don't initiate payment on the due date and assume it'll land in time.
Also — and I cannot stress this enough — make sure you're paying to the right account. CBSA has separate accounts for different programs. Your CARM statement payment goes to your RM account. Sending it to your corporate tax account doesn't count.
Corrections and Amendments
B3 corrections — called re-determinations or amendments — are filed through CARM now. Your broker typically handles these, but you need to understand the basics.
Voluntary vs. CBSA-Initiated Corrections
If you find an error on your own and correct it before CBSA does, that's a voluntary amendment. CBSA generally treats these more favourably. If CBSA finds the error first — through a trade compliance verification or audit — you're looking at potential penalties on top of the corrected duty.
The lesson: review your entries. Don't wait for CBSA to find mistakes. A food importer we worked with caught a tariff classification error on their own — they'd been using the wrong HS code for two years. They filed voluntary amendments, paid the additional duty, and avoided penalties. If CBSA had found it first, they were looking at potential Administrative Monetary Penalties (AMPs) starting at $1,200 per occurrence under Schedule 2 of the Customs Act.
The Four-Year Rule
You have four years from the date of accounting to request a correction that results in a refund. CBSA has four years from the same date to reassess and collect additional duties. This is the window you're working in for any historical corrections.
Administrative Monetary Penalties (AMPs)
CBSA will fine you for CARM-related non-compliance. These aren't hypothetical — they're being assessed.
The AMP system is laid out in the Customs Act and the Administrative Monetary Penalties Regulations. Penalties are tiered based on severity and history:
- Minor violations: $150 to $1,200 depending on whether it's a first, second, or third occurrence
- Serious violations: $1,200 to $12,000
- Very serious violations: $2,400 to $25,000
Common CARM-related violations that trigger AMPs include failing to account for goods correctly, failing to pay duties by the due date, and providing false or inaccurate information on a B3.
I've seen brokers eat $40,000 in penalties because they misread a D-memo and classified a product incorrectly across hundreds of entries. The per-entry penalties were small, but they multiplied fast. That's the math CBSA is doing when they run a trade compliance verification on your account.
What to Do If You Get an AMP Notice
You have 90 days to request a review by the President of CBSA. If that doesn't go your way, you can appeal to the CBSA Appeal Division and then to the Canadian International Trade Tribunal (CITT). Don't ignore AMP notices. The deadline is real and missing it waives your appeal rights.
What's Changed in 2026: Retaliatory Tariffs and Updated Verification Priorities
This section didn't exist in the original version of this post. It needs to.
The trade environment in 2026 is messier than it was when CARM first launched. Canada's retaliatory tariffs on U.S.-origin goods — introduced in response to U.S. steel and aluminum tariffs — are still in play. CBSA extended the surtax remission for an additional two months earlier this year, which gave some importers temporary breathing room. But remission isn't the same as exemption, and the guidance CBSA published to narrow the scope of that relief caught a lot of importers off guard.
If you're importing goods that might qualify for remission, read the CBSA guidance carefully. The eligibility criteria are specific. Assuming you qualify without checking is how you end up with an unexpected duty bill six months later.
More immediately relevant for CARM compliance: CBSA has updated its trade compliance verification priorities to specifically target goods subject to retaliatory tariffs. That's a significant shift. It means if you're importing U.S.-origin steel, aluminum, or other goods caught by the surtax, you're higher on CBSA's radar than you were a year ago.
The updated priority list also includes:
- Origin claims on goods where U.S. tariff exposure creates an incentive to misrepresent country of origin
- Tariff classification of goods where the surtax applies to some classifications but not others in the same product family
- Valuation of goods from related parties, particularly where transfer pricing might affect the duty base
Honestly, if your supply chain touches the U.S. at all right now, a self-audit is worth doing before CBSA does it for you. The cost of finding a problem yourself is a voluntary amendment and some back-duty. The cost of CBSA finding it is that plus AMPs plus the distraction of a formal verification process.
Your broker should be flagging this to you. If they haven't, ask them directly: are any of my products on the current verification priority list?
Trade Compliance Verifications
CBSA runs trade compliance verifications — what used to be called audits — on a risk-based basis. They publish their verification priorities each year, and as noted above, the June 2026 update specifically added goods subject to retaliatory tariffs to that list.
Other active priority areas include:
- Tariff classification of certain textile and apparel products
- Valuation of goods imported from related parties
- Origin claims under CUSMA (the Canada-US-Mexico Agreement)
- Certain food and beverage categories
Check the CBSA website for the current verification priorities list. If your products are on it, you should be doing a self-audit before CBSA comes knocking.
A verification isn't necessarily bad news if your records are clean. CBSA will request your import documentation, your B3s, your supplier invoices, and your tariff classification rationale. If everything lines up, you're fine. If it doesn't, you're looking at reassessments plus interest plus potential AMPs.
Keep your records for at least six years. That's the CBSA requirement. Some importers keep seven just to be safe.
Working With Your Customs Broker Under CARM
Your broker relationship hasn't gone away — it's just changed. Here's what's different:
Before CARM, your broker was the primary interface with CBSA. They posted security, they received statements, they managed corrections. You were somewhat insulated from the mechanics of it.
Now, you're directly in the system. Your broker works within your account, not around it. This is actually better for visibility — you can see exactly what's been filed, what's been paid, what's outstanding. But it requires you to be engaged.
What Your Broker Should Be Doing
- Filing B3s accurately and on time
- Reviewing your daily notices for errors
- Flagging classification or valuation issues before they become problems
- Advising you on your security requirements as your import volume changes
- Helping you prepare for verifications if your product categories are on CBSA's priority list
- Keeping you informed about retaliatory tariff developments that affect your goods
What You Need to Do Yourself
- Maintain your portal account and keep your BAA information current
- Review your monthly SOA and confirm payment is made on time
- Ensure your security is adequate as your business grows — and as your duty liability changes with tariff shifts
- Keep your business information in the portal up to date (address, contact info, authorized representatives)
Honestly, most importers can handle the CARM side of things in about 30 minutes a month if they've set it up properly. The problem is the setup. Get that right once and it runs smoothly.
Common CARM Mistakes and How to Avoid Them
After helping dozens of importers through the CARM transition, here are the mistakes I see most often:
Not Setting Up Broker Delegation
Already covered this, but it bears repeating. Your broker cannot act on your account without it. Set it up before your first shipment under CARM, not after your first problem.
Posting Insufficient Security
Your import volume changes. Your security requirement changes with it. If you had a big year and your monthly duty liability went up significantly, your required security went up too. This is especially true right now if retaliatory tariffs have increased your effective duty rate on U.S.-origin goods. CBSA will notify you if you're under-secured, but don't wait for that notice. Review your security annually at minimum.
Missing Payment Deadlines
The SOA is issued the 25th. Payment is due the last business day of the following month. Write it in your calendar. Set a reminder. Assign someone specific to make this payment. Don't let it fall through the cracks because "someone else was supposed to handle it."
Ignoring the Daily Notice
The daily notice is your early warning system. If a B3 was filed with the wrong tariff treatment, it shows up there. If you catch it early, you can correct it with minimal fuss. If you ignore it until CBSA finds it, you're dealing with a reassessment plus interest plus potential penalties.
Using the Wrong BN
If you have multiple legal entities or multiple import accounts, make sure every B3 is filed under the right BN. Mixing them up creates accounting headaches that take months to untangle. CARM is less forgiving of these errors than the old system was.
Not Updating Your BAA When Personnel Changes
If the person who set up your CARM account leaves the company, update the BAA immediately. Don't wait. A locked account at the wrong time can hold up your shipments.
Assuming Surtax Remission Applies to You Without Checking
This one is new and it's catching people. CBSA's guidance on remission eligibility for retaliatory tariffs is narrow. If you haven't read the actual guidance document and confirmed your goods qualify, don't assume they do. The wrong assumption here means owing duties you thought were remitted — plus interest from the original due date.
CARM for Brokers: What You Need to Know About Your Clients' Accounts
If you're a licensed customs broker reading this, you already know most of the above. But a few things worth flagging:
Your clients' CARM accounts are their responsibility, but they're going to call you when something goes wrong. Make sure every client has completed their portal registration, set up their BAA, and delegated authority to you. Don't assume they've done it just because you asked them to.
Under CARM, you're no longer the primary security holder for your clients. Your own broker bond covers your operations, not your clients' import liabilities. If a client hasn't posted security and you file a B3 for them, they're importing without RPP coverage. That's their problem legally, but it's your headache practically.
With CBSA's updated verification priorities targeting retaliatory tariff goods, now is a good time to review your client list and flag anyone importing U.S.-origin goods that might be caught by the surtax. A proactive call to those clients is a lot better than a reactive one after CBSA sends a verification letter.
Keep a checklist for every client account. Registration complete? BAA assigned? Security posted and verified? Delegation set up? Payment method configured? Run through it for every new client and every existing client who hasn't confirmed their setup.
Frequently Asked Questions
Do I need to register on CARM if I only import occasionally?
Yes. If you have a CBSA import account (a BN with an RM suffix), you need to be registered on the CARM portal. Even if you only import a few times a year, CBSA will issue statements and expect payment through the portal. The only exception is if you're importing as an individual for personal use — commercial importers need to be registered.
My broker used to handle all my duty payments. Can they still do that?
Your broker can manage payments on your behalf if you've delegated that authority to them in the CARM portal. But the account is yours. The statement is issued to you. If something goes wrong — missed payment, insufficient security — CBSA is coming to you, not your broker. Make sure you understand what your broker is doing on your account and confirm payments are being made on time.
What happens if I can't pay my statement on time?
CBSA will charge interest from the due date. The current prescribed interest rate is set quarterly — check the CBSA website for the current rate. If non-payment continues, CBSA can put conditions on your account, including requiring payment before release of goods. In serious cases, they can suspend your import privileges. Call CBSA or your broker immediately if you're going to miss a payment — don't just let it slide.
How do I know if my financial security amount is correct?
Log into your CARM portal and check your account profile. CBSA calculates a recommended security amount based on your import history. If your actual posted security is lower than the recommended amount, you should either post additional security or be prepared for CBSA to require payment before release on shipments that would exceed your security. Review this at least once a year, and any time your import volume or effective duty rate increases significantly — which, given current tariff conditions, may mean reviewing it now even if you just checked it a few months ago.
I got a notice of assessment from CBSA saying I owe additional duties. What do I do?
Don't ignore it. You have 90 days from the date of the notice to file a request for re-determination if you disagree with the assessment. If you agree with it, pay it promptly to stop interest from accruing. Either way, talk to your customs broker or a trade lawyer before the 90-day window closes. Missing that deadline is very hard to recover from.
Can I use CARM if I'm a non-resident importer?
Yes. Non-resident importers (NRIs) who have a CBSA import account need to be registered on CARM just like Canadian importers. The registration process is the same. The financial security requirements are the same. If you're a foreign company importing into Canada and you're the importer of record, CARM applies to you.
Do Canada's retaliatory tariffs affect my CARM account directly?
They affect your duty liability, which affects your security requirements and your monthly statement balance. They don't change how CARM works mechanically. But if the surtax has increased your monthly duty payments, your posted security may no longer be adequate. And as noted above, CBSA has specifically added retaliatory tariff goods to its trade compliance verification priorities — so the stakes for getting your classifications and origin claims right are higher than they were a year ago.
The Bottom Line
CARM isn't going away and it isn't getting simpler. CBSA has committed to this platform and they're actively enforcing compliance. The importers who are having problems right now are mostly the ones who set up their accounts in a hurry, didn't verify their security was posted correctly, and assumed their broker was handling everything the way they used to.
The current tariff environment adds another layer. If your goods touch U.S. origin, you need to be paying attention to the retaliatory surtax, the remission guidance, and CBSA's updated verification priorities — not just your CARM portal setup.
Get your account set up properly. Post adequate security. Know when your statements are due and make sure they get paid. Review your daily notices. Keep your records.
That's it. It's not complicated — it just requires attention. And in this business, attention is the difference between a clean audit and a very expensive lesson.
If you have questions about your specific situation, talk to your customs broker. If you don't have one or you're not confident in the advice you're getting, get a second opinion. The cost of a consultation is a lot less than the cost of getting this wrong.