CARM has been live long enough now that CBSA is done being patient. The grace period thinking — "we're still figuring out the system, they won't really penalize us" — that window closed. Importers who haven't sorted out their registration, their security, or their release-prior-to-payment setup are getting hit. Real penalties, real delays, real problems at the border.
Here's what those penalties look like, where most importers are tripping up, and what you can do before a CBSA audit lands in your inbox.
What CARM Actually Changed About Compliance
Before CARM, your customs broker was your buffer. They held the security bond, they managed your account, and if something went wrong on a B3, you had some insulation. That model is gone.
Under CARM, you — the importer — are directly responsible for your account in the CARM Client Portal (CCP). Your own financial security. Your own payment of duties and taxes. Your broker still files on your behalf, but the liability sits with you now. CBSA made that very clear in their CARM transition documentation and it hasn't changed.
A furniture importer we worked with learned this the hard way. They assumed their broker was handling everything CARM-related. The broker was handling the filings — but nobody had set up the importer's own Release Prior to Payment (RPP) security. When their broker's RPP coverage was restructured, the importer's goods got held. Three days of storage fees and a delayed production run. All because of an assumption.
Don't assume. Know what's in your account.
The Penalty Framework You Need to Understand
CBSA administers penalties under the Administrative Monetary Penalty System (AMPS). CARM didn't create AMPS — it's been around since 2002 — but CARM created new ways to trigger it.
AMPS penalties are tiered. First infraction, second, third, and subsequent. The amounts depend on the contravention code. Some are flat amounts. Some are calculated as a percentage of the value of the goods or the duties owing. Here's what that looks like in practice:
- C073 — Failure to pay duties and taxes by the due date: 2% of the amount owing for the first infraction. Doesn't sound like much until you're importing $800,000 worth of goods a month.
- C074 — Failure to pay interest: Flat penalties that compound if ignored.
- C354 — Failure to report to CBSA: Up to $25,000 per infraction depending on the contravention level.
- C016 — Failure to keep adequate records: $150 to $1,500 per infraction, but CBSA can issue multiple counts.
The ones that really hurt are the percentage-based penalties on large shipments, combined with interest on late duty payments. We've seen importers eat $40,000+ in combined penalties and interest from a single audit because their payment processes weren't aligned with CARM's billing cycle.
CBSA publishes the full AMPS penalty schedule. Look up D-Memorandum D22-1-1 — it's dense, but it's the actual rulebook. If you haven't read it, your compliance team should.
One More Layer Right Now: Retaliatory Tariffs
If you're importing goods with any U.S. connection in mid-2026, your compliance exposure just got bigger. Canada's retaliatory tariffs — the surtaxes on American goods introduced in response to U.S. steel and aluminum tariffs — are still in play. CBSA extended the surtax remission program by two additional months, but that extension has a hard end date. If you've been relying on remission relief, confirm whether it still applies to your goods right now.
More importantly: CBSA updated its Trade Compliance Verification priorities in June 2026 to specifically target goods subject to retaliatory tariffs. That's not a rumour — McMillan LLP flagged it publicly. If you're importing goods that fall under those surtax codes and your classification or origin documentation isn't airtight, you're a higher audit target than you were six months ago.
CBSA also issued guidance narrowing the scope of remission relief — meaning some importers who thought they qualified may not. If you haven't had your broker review your surtax exposure against the current guidance, do it this week. The cost of getting it wrong is the surtax amount plus AMPS penalties on top.
The Most Common CARM Compliance Failures
1. Not Registering — Or Registering Wrong
You'd think this one would be solved by now. It's not. There are still importers operating with incomplete CCP registrations — missing business relationships, wrong signing authority, or a portal account that nobody actually manages.
If your Business Relationship with your customs broker isn't properly set up in the CCP, your broker can't file on your behalf under your account. That means your entries may be filed incorrectly, or your broker is carrying liability they shouldn't be.
What to do: Log into your CCP account today. Confirm your business relationships are active. Confirm the right people have the right roles — Account Owner, Account Manager, and so on. If you haven't touched the portal in six months, something has probably changed that needs attention.
2. Missing or Insufficient Financial Security
To use Release Prior to Payment — which lets your goods get released before you've actually paid the duties — you need to post security. Either a surety bond or cash deposited with CBSA.
The security amount needs to cover your peak duty and tax liability for a billing cycle. If your business has grown since you set this up, your security might be too low. CBSA will flag this. And if your security lapses or gets cancelled, your RPP privilege goes with it. Your goods stop at the border until payment is confirmed.
We had a client in the automotive parts space who grew their import volume significantly in 2024. Their bond was sized for their 2022 volume. By mid-2025 they were regularly hitting their security ceiling, causing holds. Nobody had reviewed the bond amount in three years.
If you're importing goods subject to retaliatory surtaxes, this matters even more. Those surtax amounts count toward your duty liability. A bond sized for your pre-surtax import costs may not be adequate anymore.
What to do: Talk to your surety provider or your broker about whether your current security level still matches your import volume. Do this annually, not just when something breaks.
3. Missing the Statement of Account Payment Deadline
Under CARM, CBSA issues a monthly Statement of Account. Payment is due by the last business day of the month following the billing period. Miss that date and you're looking at the C073 penalty plus interest under the Customs Act.
The problem is that some importers set this up as an afterthought and then forget about it. Pre-authorized debit is available and honestly, you should be using it. Manual payment processes introduce human error. One missed email notification, one person on vacation, and you've got a late payment.
What to do: Set up pre-authorized debit through your CCP account if you haven't already. If you're managing this manually, build a hard calendar reminder — not just for the payment date, but for a week before so you can verify the amount and flag any discrepancies.
4. Not Reviewing Your Statement of Account
This is the one that surprises people. You can make your payment on time and still end up with a compliance problem if the entries on your statement are wrong and you don't catch them.
Errors happen. Wrong tariff classification, wrong valuation, wrong country of origin. If those errors are on your statement and you pay without flagging them, you've essentially accepted them. Correcting them after the fact means filing a request for re-determination or an amendment — more work, more time, sometimes more cost.
Worse, if CBSA audits you and finds systematic classification errors that you've been paying on without question, they'll wonder how long it's been going on. That's not a conversation you want to have.
What to do: Pull up your last three statements of account. Spot-check 10 entries against your commercial invoices and your broker's classification. If you find discrepancies, talk to your broker immediately. Make this a monthly habit, not a once-a-year thing.
5. Delegation and Access Problems
The CCP has a specific permission structure. The Account Owner has full control. Account Managers and other roles have limited access. If the person who set up your account has left the company, or if your Account Owner is someone who doesn't actually manage imports day-to-day, you've got a governance problem.
We've seen situations where a company's CCP Account Owner was a former CFO who left in 2024. Nobody updated the account. The new finance team couldn't access key functions. Filings were getting delayed because the business relationship approvals were stuck waiting on someone who no longer worked there.
What to do: Review your CCP user list quarterly. Make sure the Account Owner is someone currently employed and actively involved. Have a backup. Don't let portal access become a single point of failure.
What a CBSA Audit Actually Looks Like Under CARM
CBSA's Trade Compliance Verification (TCV) program existed before CARM, but CARM gives them better data to work with. They can see your payment history, your filing patterns, your security levels — all in one place. That makes it easier to identify importers worth looking at.
As of June 2026, CBSA has explicitly updated its TCV priorities to focus on goods subject to retaliatory tariffs. If you're importing American-origin goods or goods with U.S. content, expect more scrutiny on your country of origin declarations and your tariff classification. This isn't speculation — it's published guidance.
A TCV audit typically covers a specific commodity or tariff area over a defined period — usually two to four years of entries. They'll ask for your commercial invoices, contracts, purchase orders, proof of origin, and records supporting your declared value. Under D-Memorandum D17-1-21, you're required to keep these records for six years.
If they find errors, they'll issue a detailed report. You'll have an opportunity to respond. If the errors are significant or systemic, penalties follow. If they find evidence of intentional misrepresentation, you're in a different category entirely — that's potential fraud territory under the Customs Act, and the penalties are severe.
The best audit outcome is one where your records are clean, your classifications are defensible, and your valuation methodology is documented. That doesn't happen by accident. It happens because someone is paying attention to compliance before the auditors show up.
How to Build a Basic CARM Compliance Checklist
You don't need a 40-page compliance manual. You need a short list of things someone actually checks on a regular schedule.
- Monthly: Review your Statement of Account before the payment date. Flag anything that looks off. Confirm payment went through.
- Monthly: Check your CCP inbox for any CBSA notices or messages. They communicate through the portal now — if nobody's checking it, you're missing things.
- Quarterly: Review your CCP user list. Confirm business relationships with your broker are active. Update any access that's changed.
- Quarterly: If you're importing goods subject to retaliatory surtaxes, confirm your classification and origin documentation is current. CBSA's verification priorities have shifted — this is not a once-a-year task right now.
- Annually: Review your financial security level against your current import volume. Adjust if needed.
- Annually: Do a sample audit of your own entries — pick 20 entries across different suppliers and check classification, valuation, and origin against your source documents.
- Ongoing: Keep your commercial records organized and accessible. Six-year retention requirement. If you're storing these in someone's email inbox, that's a problem.
Honestly, most importers skip the self-audit step. That's the one that would catch the most problems before CBSA does.
When You Find an Error — Voluntary Disclosure
If you find a classification or valuation error in your past entries, you have options. CBSA's Voluntary Self-Assessment (VSA) program lets you come forward, correct the record, and pay any duties owing — without triggering the full AMPS penalty structure.
The key word is "voluntary." If CBSA finds the error first, you lose that option. The VSA process is governed by D-Memorandum D11-6-6. It's not a free pass — you'll still owe the duties and interest — but it's significantly better than having penalties layered on top.
If you find something material during your own records review, talk to your broker or a trade lawyer before you do anything. The disclosure process matters. Doing it wrong can create more problems than it solves.
Frequently Asked Questions
What happens if I miss my CARM payment deadline?
CBSA will apply the C073 penalty — 2% of the amount owing for a first infraction — plus interest under section 33.4 of the Customs Act. If it happens again, the penalty rate goes up. Repeated late payments can also trigger a compliance review. Set up pre-authorized debit and this becomes a non-issue.
My broker handles everything. Do I still need to worry about my CCP account?
Yes. Your broker files on your behalf, but the account is yours. The liability is yours. If your CCP registration is incomplete or your business relationship with your broker isn't set up correctly, your broker's filings may not be properly linked to your account. Log in and verify. Don't assume.
How much financial security do I actually need?
Your security needs to cover your peak duty and tax liability for a single billing cycle. If you're unsure what that number is, look at your highest monthly statement from the past 12 months and use that as a baseline. If you're paying retaliatory surtaxes on U.S.-origin goods, make sure those amounts are factored in — they've pushed a lot of importers over their bond limits without anyone noticing. Talk to your broker or surety provider about whether your current bond amount is adequate. When in doubt, size up — the cost of a slightly larger bond is nothing compared to the cost of goods held at the border.
I found a classification error in entries from two years ago. What do I do?
Don't ignore it and don't just fix it quietly without proper process. Talk to your customs broker first to understand the scope — is it one entry or a pattern? Then look at CBSA's Voluntary Self-Assessment program under D11-6-6. If the amount of duties owing is significant, get a trade lawyer involved before you file anything. Coming forward proactively is almost always better than waiting for CBSA to find it.
Can CBSA penalize me for errors my broker made?
This is a painful one. Generally, yes — the importer is the party of record and carries the liability for the accuracy of the entry. Your broker is your agent. If they made an error, you may have recourse against them depending on your service agreement, but CBSA's claim is against you. This is exactly why reviewing your own entries matters, even if you trust your broker completely.
How far back can CBSA audit my imports?
CBSA can generally go back four years for a re-determination of duties. You're required to keep records for six years under the Customs Act, and they can request those records during that window. If there's evidence of fraud or misrepresentation, there's no time limit. Keep your records. All of them.
Do the retaliatory tariffs affect my CARM compliance exposure?
Directly, yes. The surtaxes increase your duty liability, which affects your financial security requirements and your statement of account amounts. They also put you on CBSA's radar — the agency updated its TCV priorities in 2026 specifically to target goods subject to those surtaxes. If your origin documentation or classification is weak on any U.S.-connected goods, fix it now rather than waiting for a verification letter.