If you're still running your import program on your broker's security bond, that arrangement ended. CBSA made financial security a direct importer responsibility under CARM, and 2025 was the year the training wheels came off. A lot of importers found out the hard way.
Here's what actually changed, what it costs you if you ignored it, and what you need to do now — including a few things that have shifted heading into mid-2026.
The Short Version of Why This Matters
Before CARM, most importers never thought about financial security. Your customs broker posted a bond, you imported goods, duties got paid, everyone went home happy. CBSA's exposure was covered by the broker's surety bond.
CARM changed that structure. Under the new model, importers are required to post their own financial security directly with CBSA — either a cash deposit or a surety bond in your own name. Your broker's bond no longer covers your transactions unless you're still in a very specific transitional arrangement, and those arrangements have a hard end date.
The legal basis for this is the Customs Act, specifically the amendments that came into force when CARM Release 2 went live. CBSA's CARM Client Portal (CCP) is now the mechanism for managing your account, your security, and your release-prior-to-payment privileges.
What the 2025 Changes Actually Were
The Transitional Period Ended
CBSA gave importers a transitional grace period after CARM Release 2 launched in October 2024. During that window, brokers could continue to use their own bond to cover importer transactions. That window closed on May 20, 2025, per CBSA's published CARM transition timeline.
After that date, if you didn't have your own security posted, you lost release-prior-to-payment (RPP) privileges. That means your goods sit at the border until you pay duties and taxes in full before CBSA releases them. For a high-volume importer, that's a cash flow problem that gets ugly fast.
Security Thresholds Are Based on Your Import Volume
CBSA calculates your required security amount based on your projected annual duties, taxes, and fees. The formula uses 50% of your highest monthly duty and tax liability over a 12-month period, multiplied by a factor that reflects your payment history and risk profile.
In practice, here's roughly what that looks like:
- A small importer with $200,000/year in duties might need $25,000–$50,000 in security
- A mid-size importer at $1M/year in duties is often looking at $100,000–$200,000
- High-volume importers have posted bonds in the $500,000+ range
These aren't CBSA's published numbers — they're real ranges we've seen across clients. Your actual number depends on your specific transaction history. Pull your CARM account and look at your calculated security requirement directly. Don't guess.
One thing worth flagging in 2026: if you import goods that have been hit by Canada's retaliatory tariffs — steel, aluminum, and a growing list of U.S.-origin products — your duty liability has likely gone up. CBSA's compliance verification priorities have shifted to specifically target goods subject to those surtaxes. Higher duties mean higher security requirements. If your product mix has changed since you last checked your CCP, check again.
Two Ways to Post Security
You have two options, and they're not equal for every importer.
Cash deposit: You wire money directly to the Receiver General. It sits there, earns nothing, and ties up working capital. The upside is there's no annual premium and no surety company involved. For very small importers with low security requirements, this can actually make sense.
Surety bond: You pay an annual premium — typically 1–3% of the bond face value — to a licensed surety company. The bond is posted on your behalf. Most active importers go this route because tying up $150,000 in cash to cover a bond requirement is a hard conversation with your CFO.
A furniture importer we worked with in early 2025 had a $175,000 security requirement. Their annual surety premium came in at $2,100. The alternative was a $175,000 cash deposit sitting idle. The math wasn't complicated.
What Happens If You Don't Have Security Posted
You lose RPP. That's the immediate, practical consequence.
Without RPP, you're on a cash-against-documents model — you pay before CBSA releases your shipment. For a company importing weekly, that means you're fronting duty and GST on every single shipment before it clears. Your payment terms with suppliers don't change. Your cash cycle gets compressed from both ends.
Beyond the cash flow hit, there are compliance consequences. Operating without proper security when you're required to have it is a contravention under the Customs Act. CBSA has discretion on penalties, and while they were more focused on education than enforcement in the early CARM period, that patience has largely run out heading into 2026. Administrative Monetary Penalties (AMPs) under the AMPS program can run to $25,000 per contravention for serious violations. Don't test it.
The CARM Client Portal Is Where You Manage All of This
If you haven't spent real time in the CCP, you need to. This is not optional anymore.
Your CCP account is where CBSA posts your security requirement, where you can see your account balance, where your RPP status lives, and where your payment history is tracked. If your security is insufficient, you'll see a flag in the portal. If your bond is expiring, you need to catch that before it lapses — CBSA won't call you.
A few things to check right now:
- Log into your CCP account and confirm your security is posted and active
- Check the expiry date on your surety bond — annual bonds need renewal and the lead time matters
- Confirm your RPP status shows as active
- Make sure your business account is linked to your broker's account correctly
Sounds basic. You'd be surprised how many importers have never actually logged in. Their broker handles everything and they assume it's fine. That assumption cost some of them RPP privileges in 2025.
If You're Using Multiple Brokers, Read This Carefully
Under the old system, each broker posted their own bond and your transactions were siloed. Under CARM, your financial security is tied to your importer account — not to a specific broker.
This means if you use two or three brokers (which is common for importers with different ports of entry or commodity types), all of their transactions against your account draw against the same security pool. Your single bond or cash deposit needs to be large enough to cover your total RPP exposure across all brokers.
We've seen importers who correctly calculated their security based on one broker's volume, then added a second broker mid-year and suddenly found themselves underposted. CBSA doesn't care which broker filed which entry. They look at your total account exposure.
If you use multiple brokers, add up your total duty and tax volume across all of them before you calculate your security requirement.
Surety Bond Renewals: Don't Let This Slip
Most surety bonds issued for CARM are annual. They have an expiry date. When the bond expires, your security lapses. When your security lapses, you lose RPP.
Your surety company should send renewal notices, but don't rely on that. Put the expiry date in your calendar with a 60-day reminder. Getting a new bond issued, approved, and posted in the CCP takes time — especially if your surety company needs updated financials or if there's any underwriting review involved.
We had a client in Q3 2025 whose bond lapsed over a long weekend. Three shipments sat at the border for two days while we sorted it out. The demurrage and storage charges were over $4,000. The bond renewal itself would have cost them $1,800. Do the math.
How CBSA Calculates Your Security Requirement (And How to Challenge It)
CBSA's system calculates your required security automatically based on your transaction history in their system. If you're a new importer with no history, they apply a default formula.
The calculation isn't always right. We've seen cases where:
- A one-time large shipment skewed the 12-month average significantly upward
- An importer's business changed substantially (seasonal product, discontinued line) and the historical data no longer reflected reality
- Administrative errors in past B3s inflated the duty figures CBSA was working from
You can request a review of your security requirement. This isn't a formal appeal — it's a business case you make to your CBSA trade office. Bring your actual transaction data, explain the anomaly, and ask for an adjusted requirement. It works. Not always, but often enough that it's worth doing if your required security seems out of line with your actual risk profile.
Before you do this, make sure your B3 history is clean. If there are classification errors or valuation issues in your past entries, CBSA will find them when they review your account. Fix your compliance first, then ask for a security reduction.
The Retaliatory Tariff Wrinkle in 2026
This is new since the original version of this post.
CBSA updated its trade compliance verification priorities in 2026 to specifically target goods subject to Canada's retaliatory surtaxes — the measures applied in response to U.S. tariffs on Canadian goods. If you're importing anything that falls under those surtax categories, you're now in a higher-scrutiny pool.
What does that mean for financial security? A few things.
First, if your surtax exposure has increased your total duty liability, your security requirement may have gone up since you last checked. CBSA recalculates periodically, but they don't always notify you proactively. Log into your CCP and look.
Second, if CBSA finds a compliance issue during a verification — wrong tariff classification, incorrect origin declaration, anything that affects whether the surtax applies — they can reassess duties going back. A reassessment can spike your account balance fast. If your posted security doesn't cover the reassessed amount, you're in a shortfall position.
Third, CBSA has been issuing guidance to narrow the scope of remission relief from retaliatory tariffs. If you've been relying on a remission order to reduce your duty exposure — and therefore your security requirement — make sure that remission still applies to your goods. The rules have tightened.
None of this means you need to panic. It means you need to know your numbers.
What Brokers Can and Can't Do For You Now
Your broker can still file entries on your behalf. They can still manage your day-to-day clearances. They can still advise you on classification, valuation, and origin. None of that changed.
What they can't do is post security on your behalf anymore. That's your responsibility. Some brokers were slow to communicate this clearly in 2025 — either because they didn't want to lose clients who found the new requirements burdensome, or because they were hoping the transition rules would get extended again.
They didn't get extended. May 20, 2025 was the date, and it held.
Your broker should be helping you manage your CCP account, advising you on your security requirement, and connecting you with a surety provider if you need one. If your broker is still vague about whether you have your own security posted, that's a problem worth addressing directly.
Practical Checklist: Financial Security Under CARM
- Log into your CARM Client Portal and confirm your account is active and properly set up
- Check your calculated security requirement in the portal — especially if your duty profile has changed due to retaliatory tariffs
- Confirm you have security posted — either a cash deposit receipt or an active surety bond
- Verify your RPP status is active
- Note your bond expiry date and set a 60-day renewal reminder
- If you use multiple brokers, confirm your security covers your total combined duty exposure
- If your security requirement looks wrong, gather your transaction history and request a review
- Make sure your broker has the correct level of access to your CCP account to file on your behalf
- If you import goods subject to surtaxes, confirm your tariff classifications are correct — CBSA is actively verifying these
Frequently Asked Questions
My broker told me they're covering my security. Is that still okay?
No. The transitional period that allowed broker bonds to cover importer transactions ended May 20, 2025. If your broker is still telling you they're covering your security, ask them to show you the documentation. Chances are either they're mistaken about your current arrangement, or you've been operating without proper coverage and just haven't had a shipment flagged yet. Either way, fix it now.
How long does it take to get a surety bond posted in the CCP?
Realistically, plan for 2–3 weeks if everything goes smoothly. The surety company needs to underwrite the bond, issue the document, and then it needs to be submitted and processed in the CCP. Some brokers and surety providers can move faster, but don't assume you can get this done in 48 hours if you're starting from scratch. If you're already in RPP suspension, talk to your CBSA trade office directly — there may be options for provisional arrangements while your bond is being processed.
What's the difference between a customs bond and a surety bond for CARM?
For CARM purposes, they're the same thing. "Surety bond" is the general term. A customs bond is a surety bond specifically written to satisfy CBSA's financial security requirements. Your surety provider will know what to issue — just tell them it's for CARM financial security and give them your Business Number and your required security amount from the CCP.
I'm a small importer — do I really need to go through all this?
If you import goods commercially and want release-prior-to-payment privileges, yes. There's no size exemption. That said, if your duty and tax liability is very low, your security requirement might be low enough that a cash deposit makes more sense than paying annual surety premiums. Run the numbers. If your calculated security requirement is under $10,000, a cash deposit might actually be the simpler path.
Can I reduce my security requirement over time?
Yes, if your import volume decreases or if you can demonstrate a strong compliance history. CBSA does review security requirements periodically. You can also proactively request a review if your business circumstances change significantly. Good compliance history — clean classifications, accurate valuations, no AMP history — works in your favour when CBSA is assessing your risk profile.
What happens to my security deposit if I stop importing?
If you posted a cash deposit, you can request a refund once you've closed your importer account and all outstanding duties, taxes, and penalties are settled. The process goes through CBSA and the Receiver General. It's not instant — budget a few months. If you had a surety bond, it simply expires at the end of its term and you don't renew it. You won't get the premiums back, but there's nothing to reclaim.
My duty costs went up because of the retaliatory surtaxes. Does that automatically increase my security requirement?
It can, yes. CBSA's system recalculates your security requirement based on your actual duty and tax history. If your surtax exposure has materially increased your monthly duty liability, that will eventually flow through to a higher security requirement. Don't wait for CBSA to flag it — check your CCP now and see where you stand. Being underposted when CBSA catches up is a worse situation than proactively adjusting your bond.