Regulatory risk in shipping: a guide for forwarders

Regulatory risk in shipping is the chance that a shipment breaks a rule on customs, sanctions, dangerous goods, cargo security or emissions, and that the break costs you through holds, fines, seized cargo or lost customers. For a freight forwarder it rarely starts as a legal problem. It starts as a wrong code, a party nobody screened or a seal number that doesn’t match the paperwork, and it shows up as delay and rework long before anyone calls it compliance.

What does compliance risk mean in cross-border freight?

Compliance risk in cross-border freight is the risk that the data, documents or parties on a shipment don’t meet the rules of the countries it moves through. A truck breakdown is an operational problem. A currency swing is a financial one. A container held because the declaration doesn’t match the goods, or because a consignee on a sanctions list wasn’t screened, is a regulatory one.

You can reroute around congestion, but you can’t negotiate with a customs hold. And the shipper’s word doesn’t protect you. US export rules (15 CFR 758.3) say every party to an export, forwarding agents included, must comply.

Why it costs more than the fine

One bad data point can block a whole chain of work. A weak tariff classification triggers a customs query. Missing origin support delays entry. An incomplete dangerous goods declaration gets the box refused at the terminal. The fine gets management’s attention, but the repeat costs do more damage over a year:

• Labour. Skilled staff spend the day fixing paperwork.
• File profit. Storage, demurrage, rebooking and exam charges land on your margin when you can’t pass them on.
• Trust. Customers stop believing your quoted transit and clearance times.
• Growth. Larger shippers won’t give you regulated products or high-risk lanes if your controls look loose.

Practical rule: if the first serious compliance check happens after booking, the shipment is already carrying avoidable risk.

Who sets the rules in shipping

Shipping is regulated at two levels. The International Maritime Organization (IMO) writes the global rules for ships: safety under SOLAS (the Safety of Life at Sea convention), pollution under MARPOL, security under the ISPS Code, and dangerous goods under the IMDG Code. National authorities then decide what may enter or leave their country, who may arrange the freight and who may not be dealt with at all.

For a US forwarder that means, among others, CBP for customs and cargo security, OFAC and BIS for sanctions and export controls, and the Federal Maritime Commission, which requires US ocean freight forwarders and NVOCCs (non-vessel-operating common carriers) to hold an ocean transportation intermediary (OTI) licence and show proof of financial responsibility before they offer services (46 CFR 515.3). The examples in this guide are US rules; other countries have their own.

The top regulatory risks for freight forwarders

The costly failures come from a short list, and almost all of them start as an ordinary workflow error rather than bad intent.

Risk area	Who sets the rule	Typical failure point	What it costs
Customs and trade compliance	Customs authority of each country (in the US, CBP)	Wrong classification, value or origin; invoice, packing list and filing don’t match	Hold, exam, rework, penalties, lost preference
Sanctions and export controls	OFAC, BIS, EU, UK and UN lists	A party, bank or vessel not screened, or screened only at onboarding	Frozen shipment, blocked payment, loss of export privileges
Dangerous goods	IMDG Code, mandatory under SOLAS chapter VII since 2004	Shipper’s declaration accepted without checking the safety data sheet	Carrier rejection, repacking, rolled cargo, fines
Cargo security	ISPS Code for ships and ports; trusted trader programmes such as CTPAT and AEO	Seal number not checked, no inspection record, weak chain of custody	Exams, audit findings, lost trusted trader benefits
Emissions and environment	IMO (MARPOL); EU ETS for shipping	Carrier surcharges not explained or not passed through	Margin loss, invoice disputes

Customs and trade compliance

Most forwarders have their worst days here: classification, valuation, country of origin, permits and declarations that have to agree with each other. The problems come from copied codes, vague product descriptions and trusting the customer’s description too much. If your team needs a refresher on codes, see what an HTS code is.

Most holds start with documents that don’t agree. Check these against each other before filing:

• commercial invoice: description, value, currency, origin;
• packing list: quantities and weights that match the invoice;
• bill of lading: parties, container and seal numbers;
• certificate of origin, if you claim a trade agreement rate;
• dangerous goods declaration and safety data sheet, if the goods are hazardous.

Keep the records. US customs rules (19 CFR 163.4) require most entry records to be kept for five years from the date of entry.

Sanctions and embargo exposure

A restricted party can sit anywhere on the file: customer, consignee, notify party, bank or vessel owner. Screening breaks when it is split up. One branch screens at onboarding, an overseas agent assumes origin did it, and nobody re-checks when the consignee changes mid-shipment. OFAC’s sanctions guidance for the maritime shipping industry (October 2024) lists the patterns to watch: falsified certificates of origin, ships that switch off their tracking signal, and vessel ownership hidden behind shell companies. Our guide to denied party screening covers who to screen and when.

Cargo security and chain of custody under a trusted trader programme

Chain of custody is mostly paperwork that proves nobody got into the box. Under CBP’s CTPAT programme, which ocean transportation intermediaries can join, the minimum security criteria ask for:

• a seven-point inspection of every empty container before stuffing, recorded on a checklist with container number, date, time, inspector and areas checked;
• a high-security seal meeting ISO 17712, applied right after loading and checked with the “view, verify, tug, twist” method;
• a seal log covering receipt, issue and use of every seal;
• a record of any seal broken in transit, with the replacement number sent to shipper, broker and importer.

That inspection sheet should travel with the shipping documents. Members are treated as lower risk and are less likely to be examined at a US port, which is why shippers ask about it in tenders.

Emissions rules that end up on your invoice

Some rules land on carriers but reach you as surcharges. Since January 2024 the EU Emissions Trading System covers CO2 from large ships calling at EU ports. Carriers surrender allowances for 40% of their 2024 emissions, 70% of their 2025 emissions and all of their emissions from 2026 on. Expect customers to ask why the surcharge keeps rising.

Building a regulatory risk management framework

Most forwarders don’t lack effort. Their compliance work is reactive. One team checks documents, another fixes exceptions, and a manager steps in when customs escalates. A framework that fits freight has four steps.

1. Identify the rules tied to each step of the shipment: onboarding, quote, booking, documents, screening, filing, handoff to agents and brokers, delivery and post-entry corrections. For each step, write down which data fields matter, who owns the check and what proves it happened.
2. Assess the risk before controls (a new shipper moving regulated goods through several partners) and what is left after them (you screen and review documents, but still rely on the shipper’s product description).
3. Control what can stop cargo first: classification-sensitive goods, sanctions-sensitive lanes, dangerous goods and outsourced customs work. A good control is the shortest repeatable step that prevents a known failure, not a longer checklist.
4. Monitor with thresholds that force action, not a monthly surprise. Repeated document mismatches from one shipper, a spike in customs queries on a lane, or a run of manual overrides should alert a named person.

A risk register you can copy

One row per risk, kept short enough that people update it. Here is the structure with a worked row for a Mexico to US ocean shipment claiming USMCA preference:

Field	Example
Risk	USMCA preference claimed without a valid certification of origin
Rule	USMCA: any format is accepted if it has the nine minimum data elements in Annex 5-A
Trigger	Booking where the customer asks for duty-free entry under USMCA
Owner	Customs desk lead
Control	Check all nine elements are on the certification before the entry is filed; no certification, no preference claim
Evidence	Certification copy stored with the entry, kept for five years
Signal to watch	Preference claims later denied, by shipper

The lane isn’t small. In the 12 months to August 2026, 2,000+ Mexican companies exported to the US by sea (Coreties Mexico data, as published in October 2026). Every one of those shippers needs this check from someone, and a forwarder that does it well has something concrete to say in a sales meeting.

Freight forwarding regulatory compliance at every handoff

A forwarder doesn’t move cargo alone. Brokers, overseas agents, truckers, warehouses and carriers all touch the shipment, and the weak point is almost always the handoff: sales to operations, origin to destination, forwarder to broker. That’s where people assume instead of check.

• Client onboarding. Confirm commodity profile, usual origins and destinations, special handling, screening scope, and who supplies regulatory data.
• Partner onboarding. Ask what your agent or broker checks, what evidence they keep, and how they escalate.
• Booking acceptance. Don’t accept “general cargo” when the goods are regulated or hard to classify.
• Document submission. Make sure the filed data matches the latest commercial documents, not the first version the customer sent.

Outsourcing the work doesn’t outsource the blame. If your nominated broker misfiles, your customer still sees your name first.

Third party	What to verify	Red flag
Customs broker	Review process, escalation path, evidence retention	They “usually catch issues” but can’t show a workflow
Overseas agent	Screening steps, commodity handling, local rules	They rely on the origin office’s assumptions
Trucker or warehouse	Seal checks, access control, incident logging	Informal habits with no records

Make exceptions travel upward. A branch that fixes the same error from one shipper every week is hiding a pattern that sales and management need to see.

Use your own shipment data to catch repeat risk

The records you already have show where risk keeps coming back:

• customs holds that keep coming from the same shipper and the same document problem;
• repeated classification arguments over one product family;
• lanes with more exceptions than the rest;
• partners whose handoffs keep needing corrections;

Turn them into simple rules. Escalate incomplete descriptions for regulated goods, flag accounts with repeated amendments, require a second review when a shipper, lane and commodity combination caused trouble before. Each rule needs a named owner, or the alerts turn into noise.

The worst sign isn’t one violation. It’s a workaround your team has started to treat as normal.

Metrics and a quarterly freight provider review

Track numbers that change behaviour:

• Documentation error rate by shipper. Shows where onboarding or account rules need tightening.
• Customs hold resolution time. Long cycles point to unclear ownership or weak document collection.
• Manual override count. Many overrides mean the control is wrong or ignored.
• Partner exception frequency. Separates one-off mistakes from a structural problem with a broker or agent.

Once a quarter, the owner should be able to answer five questions. Which customers create the most compliance rework? Which lanes keep causing regulatory friction? Which partners add avoidable risk? Which exceptions get fixed again and again instead of removed? And can sales explain your compliance work as a benefit to the customer?

Turn compliance into a sales argument

Shippers care about compliance because a held container stops their inventory and their cash. Say it plainly in a pitch: “We check your documents before submission, not after customs rejects them.” “We screen every party on every booking.” “We can show you how we escalate an exception.”

Finding those shippers is the other half. Coreties finds the importers and exporters on a lane from customs declarations and bills of lading, and shows what changed, such as companies new on the lane or buying from new suppliers. Shipper search builds the list, Supply Chain Analysis gives a sourced reason to reach out to each company, and outreach finds a named contact with a verified email and drafts a message for you to approve. Because the list is real, named companies, you can screen it before anyone reaches out. See how it works, or read the guide to finding shippers.

Frequently asked questions

What is regulatory risk in shipping?

The risk that a shipment breaks a customs, sanctions, dangerous goods, security or environmental rule, and that you pay for it through holds, fines, seizure or lost customers. For ship operators it is mostly IMO rules. For forwarders it is mostly customs, sanctions and documents.

What documents prove chain of custody under a trusted trader programme?

Under CTPAT, the main records are the empty-container inspection checklist, the seal log, the seal number on the shipping documents, and a record of any seal changed in transit. A first-time shipper should agree with its forwarder who keeps each record before the first booking.

Do freight forwarders need a licence?

In the US, yes for ocean: ocean freight forwarders and NVOCCs need a licence from the Federal Maritime Commission. Customs brokerage needs a separate CBP licence. Other countries have their own rules.

Who is responsible if the customs broker makes a mistake?

The importer of record carries the legal liability for the entry, and the broker answers for its own licence. Your customer will still hold you responsible if you appointed the broker. See who the importer of record is.

How long should we keep shipping records?

US customs entry records for five years. OFAC sanctions records for ten years since March 2025. Keeping everything ten years is the simple rule.

Want to see the shippers on your own lanes? Get a free market study for one of your lanes, or book a demo.