ACE Portal ACH Refund Changes Require MFA Starting Oct 10, 2026

Key Points

• Effective October 10, 2026, CBP requires a security token sent by email (with optional SMS) before any ACH refund information can be added or modified in the ACE Portal.
• The requirement applies to all authorized ACE Portal users who manage ACH refund account details for duty drawback, protest payments, or other refund instruments.
• CBP also posted an updated ACE Development and Deployment Schedule on October 9, 2026; the schedule is notional and subject to change.

On this page

1. What changed in the ACE Portal
2. How the new verification step works
3. The updated ACE deployment schedule
4. What importers, brokers, and compliance teams should do
5. Key references

Starting October 10, 2026, CBP is adding a mandatory verification step to the ACE Secure Data Portal: any user who attempts to add or change ACH refund banking information must first confirm their identity using a one-time security token delivered by email, with an optional SMS backup. This is a procedural security change, not a policy change to refund eligibility or rates, but it directly affects anyone who manages ACH refund accounts in ACE.

The links in this article go directly to the primary documents: the official CBP CSMS bulletins themselves. Read the source.

What changed in the ACE Portal

According to CSMS #70162211, CBP is introducing an additional verification layer for ACH refund information changes in the ACE Portal. Before this update, authorized users could add or modify ACH refund details without a separate identity-confirmation step. After October 10, 2026, every such change will trigger a security token sent to the user's registered email address. Users also have the option to receive the token via SMS.

This change is consistent with broader federal efforts to harden financial account management against unauthorized modification, particularly for accounts that receive government disbursements such as duty refunds, drawback payments, and protest refunds routed through ACH.

How the new verification step works

The workflow, as described in CSMS #70162211, is straightforward:

• An authorized ACE Portal user navigates to the ACH refund section and attempts to add a new bank account or modify existing account details.
• The ACE Portal sends a one-time security token to the user's registered email address.
• The user may also opt to receive the token via SMS.
• The user enters the token to complete the change.

Compliance teams should confirm that every ACE Portal user who manages ACH refund information has a current, accessible email address registered in their ACE Portal profile before October 10. A stale or shared email address on the account could block the verification step and delay refund setup or modification.

The updated ACE deployment schedule

On the same date, CBP issued CSMS #70165283 announcing that an updated ACE Development and Deployment Schedule is now available at CBP.gov/ACE. CBP explicitly notes the schedule is notional and subject to change. Brokers and IT teams integrating with ACE should monitor that page regularly rather than treating any published date as final.

What importers, brokers, and compliance teams should do

• Before October 10, 2026, audit every ACE Portal account that has permission to add or modify ACH refund information and verify that each account has a current, individually accessible email address registered.
• Brief any staff responsible for duty refund, drawback, or protest ACH setup on the new token-based verification workflow so they are not caught off guard when the prompt appears.
• Review the updated ACE Development and Deployment Schedule at CBP.gov/ACE and flag any upcoming deployments relevant to your filing systems.

Key references

• CSMS #70162211 - CBP notice announcing mandatory email/SMS verification for ACH refund changes in the ACE Portal, effective October 10, 2026.
• CSMS #70165283 - CBP notice announcing an updated ACE Development and Deployment Schedule posted to CBP.gov/ACE.
• CBP.gov/ACE - The official CBP ACE portal page where the current deployment schedule is published.