ACE Portal SMS Login and New FTZ e214 Error Code 238: Sept 2026

Key Points

• As of September 12, 2026, CBP added SMS as a multifactor authentication (MFA) option for ACE Portal login, alongside the existing email-based authentication.
• On September 17, 2026, CBP will deploy new error code 238 (FIRMS CODE NOT AP) for e214 Foreign Trade Zone admissions in the ACE Production environment.
• Error code 238 is already live in the ACE Certification environment, giving filers a window to test submissions before the Production rollout.
• The ACE Appendix P document (e214 FTZ Admission Error Codes) and the FTZ CATAIR have both been updated to reflect the new error code.

On this page

1. What changed in ACE Portal login security
2. New FTZ e214 error code 238 and CATAIR updates
3. Dates and applicability
4. What importers, brokers, and FTZ operators should do
5. Key references

CBP has released two ACE operational updates in September 2026: an SMS-based login option for the ACE Portal and a new error code for FTZ e214 admission filings. Both changes are in effect now or take effect September 17, 2026, and require attention from anyone who files through ACE or operates a Foreign Trade Zone.

The links in this article go to the primary documents: the CBP CSMS notices themselves. Read the source.

What changed in ACE Portal login security

On September 12, 2026, CBP added SMS (Short Message Service) as a multifactor authentication option for the ACE Portal, per CSMS #69896141. Previously, MFA was limited to email-based token delivery. The new flow works as follows:

• Users complete an initial login via email authentication as before.
• After a successful login, users may register a mobile phone number in their ACE Portal account settings.
• Once registered, users can choose to receive their login security token by SMS rather than by email on future logins.

SMS registration is optional, not mandatory. Users who do not register a mobile number continue to authenticate by email. Organizations with multiple ACE Portal users should decide whether to standardize on one method or allow per-user choice, and update any internal access-management documentation accordingly.

New FTZ e214 error code 238 and CATAIR updates

On September 17, 2026, CBP will push error code 238, described as "FIRMS CODE NOT AP," into the ACE Production environment for e214 FTZ admission filings, per CSMS #69902241. The code is already active in the ACE Certification environment, so filers can replicate the condition and test their systems before the Production deployment date.

Two CBP technical documents have been updated to include error code 238:

• ACE Appendix P, e214 FTZ Admission Error Codes
• FTZ CATAIR (Customs Automated Trade Interface Requirements)

The "FIRMS CODE NOT AP" message indicates that the FIRMS (Facilities Information and Resources Management System) code submitted on an e214 does not correspond to an approved FTZ admission permit. FTZ operators and their software vendors should confirm that their FIRMS codes are current and accurately mapped before the September 17 Production cutover.

Dates and applicability

• September 12, 2026: SMS MFA option live in ACE Portal Production.
• Now through September 16, 2026: Error code 238 available for testing in ACE Certification environment.
• September 17, 2026: Error code 238 deploys to ACE Production; e214 submissions with an invalid FIRMS code will receive this rejection.

What importers, brokers, and FTZ operators should do

• Log in to the ACE Portal and, if desired, register a mobile phone number to enable SMS-based MFA; notify staff who hold ACE accounts about the new option.
• Pull the updated ACE Appendix P and FTZ CATAIR documents from CBP.gov and share them with any software vendors or in-house development teams that process e214 submissions.
• Test e214 filings against the ACE Certification environment before September 17 to verify that FIRMS codes resolve correctly and do not trigger error code 238.
• Update internal FTZ admission procedures and error-resolution workflows to document the meaning and remediation path for error code 238.

Key references

• CSMS #69896141 -- CBP notice announcing SMS MFA for ACE Portal login (September 12, 2026)
• CSMS #69902241 -- CBP notice announcing e214 FTZ error code 238 and CATAIR updates (September 14, 2026, deploying September 17, 2026)
• CBP ACE CATAIR landing page -- official repository for Appendix P and FTZ CATAIR documents