COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE on Customs Risk Management and Security of the Supply Chain
Date: 2013-01-08
Institutions: European Commission
Subjects: customs inspection, data collection, delivery, disclosure of information, illicit trade, international trade

EUROPEAN 
COMMISSION 

Brussels, 8.1.2013  
COM(2012) 793 final 

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL 
COMMITTEE 

on Customs Risk Management and Security of the Supply Chain 

EN 

   EN 

 
 
 
 
  
 
TABLE OF CONTENTS 

1. 

2. 

2.1. 

2.2. 

2.3. 

2.4. 

INTRODUCTION ............................................................................................................ 3 

EU CUSTOMS RISK MANAGEMENT AND THE SECURITY OF THE SUPPLY CHAIN ......... 3 

Customs' security role .................................................................................................. 3 

The EU customs risk framework.................................................................................. 4 

The risk management process ...................................................................................... 4 

Gaps in the current approach........................................................................................ 5 

2.4.1.  Data quality and the role of the economic operators .................................................. 5 

2.4.2. 

Secure supply chains and economic operators ............................................................ 5 

2.4.3.  Operational methodologies.......................................................................................... 6 

3. 

3.1. 

3.2. 

3.3. 

4. 

RISK MANAGEMENT OF THE SUPPLY CHAIN — THE BROAD VIEW ............................. 7 

Scale of the challenge: trade growth and complexity of the supply chain................... 7 

Range of risks and customs interconnection with other authorities............................. 8 

The challenge for customs risk management: a multi-layered approach..................... 8 

EU CUSTOMS RISK MANAGEMENT: THE WAY FORWARD.......................................... 10 

4.1. 

Ensuring quality, availability and fusion of trade data .............................................. 10 

4.1.1.  Quality of data (‘who is moving what to whom’)....................................................... 10 

4.1.2.  Data availability to all customs authorities concerned ............................................. 10 

4.2. 

Engaging with economic operators............................................................................ 11 

4.2.1.  The EU Authorised Economic Operator (AEO) programme..................................... 11 

4.2.2.  Cooperation with legitimate business to target illicit traffic ..................................... 11 

4.3. 

Addressing risk management capacity differentials .................................................. 11 

4.3.1.  Member States level ................................................................................................... 11 

4.3.2.  EU level...................................................................................................................... 11 

4.4. 

4.5. 

5. 

Coordinating with other authorities and agencies...................................................... 12 

Cooperating internationally........................................................................................ 12 

CONCLUSION.............................................................................................................. 13 

EN 

2 

   EN 

 
COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL 
COMMITTEE 

on Customs Risk Management and Security of the Supply Chain 

1. 

INTRODUCTION 

The EU relies heavily on international trade for its economic development and is exposed to 
security and safety threats that come with this trade. Illicit international trade also undermines 
economic and social welfare in the EU. Effective risk management of the movement of goods 
through  the  international  supply  chain  is  critical  for  security  and  safety  and  essential  to 
facilitating legitimate trade and protecting the financial and economic interest of the EU and 
its Member States. 

Since  ‘9/11’  and  other  terrorist  attacks  in  Europe  and  elsewhere,  security  has  become  a  top 
priority for European customs. The security of the EU, of the Member States and of citizens 
depends on each and every single point of entry of goods into the EU. If customs failed to act 
to  tackle  risks  consistently  along  the  EU’s  external  borders,  the  customs  union  and  the  EU 
single market would become unsustainable. 

Customs  policy  is  an  EU  competence:  the  Member  States  follow  a  common  approach.  The 
EU  has  the  responsibility  of  supervising  the  Union’s  international  trade  and  upholding 
minimum standards of customs risk management and controls. Like many other jurisdictions 
and in line with international standards, the EU has a common policy framework intended to 
address risks and accelerate legitimate trade. In addition to adopting the relevant legislation, 
the  customs  administrations  throughout  the  EU  have  taken  action  to  overhaul  control 
procedures, techniques and resources. 

The October 2010 (Yemen) incident demonstrated weaknesses in the security standards and 
procedures applying to air cargo in the EU and worldwide. The debate ensued underlined the 
need  to  review  security  procedures  and  requirements  more  broadly  for  all  transport  modes. 
There are critical challenges to be tackled and these cannot be fully resolved at Member State 
level but require EU action to complement and reinforce the efforts made at national level. 

The purpose of this Communication is to: 

- review the implementation of customs risk management policy; 

- put forward a strategic approach for the years ahead; 

- make recommendations for action with a focus on efficient deployment of resources. 

EN 

3 

   EN 

 
2. 

EU CUSTOMS RISK MANAGEMENT AND THE SECURITY OF THE SUPPLY CHAIN 

2.1. 

Customs’ security role 

The role of customs in the supply chain has been constantly evolving. From revenue collector 
to guardian of the internal market and of other policy areas such as public health, consumer 
protection, environment, agriculture, it has naturally expanded, following the terrorist attacks 
on 11 September 2001, to become a major player in the field of supply chain security. 

This role is recognised in the mission statement of EU customs authorities1: 

‘Customs  authorities  shall  be  primarily  responsible  for  the  supervision  of  the  Community’s 
international trade, thereby contributing to fair and open trade, to the implementation of the 
external aspects of the internal market, of the common trade policy and of the other common 
Community policies having a bearing on trade, and to overall supply chain security.’2 

The  increasing  security  role  of  EU  customs  in  the  last  decade  is  in  line  with  worldwide 
developments and international standards, notably the World Customs Organisation’s (WCO) 
‘SAFE’ framework of standards. 

2.2. 

The EU customs risk framework 

The 2005 amendment to the EU Customs Code3 provided the legal basis for the development 
of  a  common  framework  for  risk  management  of  the  supply  chain.  This  amendment  and 
subsequent implementing provisions introduced far-reaching changes affecting both customs 
and the trade community. 

This common framework comprises: identification and control of high-risk goods movements 
using  common  risk  criteria;  the  contribution  of Authorised Economic Operators (AEO) in a 
customs-trade  partnership  to  securing  and  facilitating  legitimate  trade;  and  pre-arrival/pre-
departure security risk analysis based on cargo information submitted electronically by traders 
prior to arrival or departure of goods in/from the EU. 

Operationally,  the  framework  is  underpinned  by  the  electronic  EU  Customs  Risk 
Management System (CRMS). This is the channel for wide-ranging communication between 
Member States and systematic risk information exchange. It is available to Member State risk 
analysis centres, to all external border control points in the EU and to the Commission. 

Because of its scope and impact, this legal amendment required development over a number 
of years with full implementation of all measures scheduled in 2011. 

1

2 

3

Council  Regulation  (EC)  No  450/2008  of  23  April  2008  laying  down  the  Community  Customs  Code  (Modernised  Customs 
Code), Article 2. 
Accordingly, the strategy for the evolution of the Customs Union adopted by the Council in 2008 calls on EU customs to fulfil the 
objective  of  protecting  society  and  the  financial  interests  of  the  EU  by  ‘applying  effective  measures  against  the  movement  of 
illicit,  restricted  and  prohibited  goods’  —  Communication  from  the  Commission  to  the  Council,  the  European  Parliament,  the 
Economic  and  Social  Committee  and  the  Committee  of  the  Regions  of  1  April  2008  entitled  Strategy  for  the  evolution  of  the 
Customs Union [COM(2008) 169 final, p.5. 
Council Regulation (EC) No 648/2005 of 13 April 2005. 

EN 

4 

   EN 

 
                                                 
 
 
2.3. 

The risk management process 

The  risk  posed  by  cargo  entering  and  leaving  the  EU  is  analysed  on  the  basis  of  cargo 
information submitted electronically in a single declaration4 by operators prior to departure or 
arrival.  For  exports  (Export  Control  System)  this  is  carried  out  by  customs  at  the  office  of 
export. For imports (Import Control System) risk analysis is performed by customs at the first 
point of entry on all goods entering the EU regardless of destination. 

Risks are assessed by means of electronic application of common risk criteria and standards 
for  security  and  safety  risk  analysis.  The  electronic  output  is  then  assessed  by  customs  risk 
analysts  using  multiple  sources  of  information,  including  information  from  other  Member 
States. Customs authorities at the first point of entry decide, based on the seriousness of the 
risk  posed,  whether  checks  are  needed  and,  if  so,  whether  at  the  border  or  at  the  place  of 
unloading.  If  the  risk  analysis  is  positive  (checks  are  requested),  the  results  are  sent  to 
customs authorities in Member States of unloading. 

2.4. 

Gaps in the current approach 

Following  a  preliminary  assessment  of  initial  implementation  of  the  new  legislation  made 
with the Member States’ customs authorities, the Commission commissioned a more in-depth 
study of EU risk analysis and targeting capabilities5. The study concluded that several issues 
require urgent action, including data quality, supply chain modelling and certain aspects of the 
methodology applied. 

2.4.1.  Data quality and the role of the economic operators 

The main goal of risk management is to ensure the correct implementation of all legislation 
and  avoid  unwarranted  controls  while  focusing  on  areas  that  pose  the  most  serious  risks. 
Economic  operators  are  crucial  to  risk  management  because  of  the  information  available  to 
them and the measures they take to secure their supply chain. 

To  make  full  use  of  risk  assessment  methods,  one  needs  to  know  ‘who  is  moving  what,  to 
whom,  from  where’.  Data  on  the  real  parties  behind  the  transaction  and  the  movement  of 
goods  (buyer  and  seller  or  owner),  and  on  the  precise  goods  involved,  is  essential  as  is 
information on the routing of the goods throughout the supply chain 

The foundation for this approach is the advance cargo information submitted electronically by 
economic operators in relation to goods movements entering and exiting the European Union. 
It is critically important that this data be available as early as possible, be relevant and be of 
high quality. Conversely, significant weaknesses in the standard or relevance of the data will 
undermine later, electronically based risk identification and evaluation. 

Relevant, high-quality data is fundamental to electronic data-based risk management, but the 
study suggests that current input does not meet minimum requirements. Moreover, there is a 
systemic gap in the provision of information on the parties behind the transaction and some 
other data elements provided are  of low quality. In many cases the information available in 
the entry summary declaration (ENS) is not precise enough to conduct effective risk analysis. 

4 
5

ENS: Entry Summary Declaration. 
Study  on  possible  ways  to  enhance  EU-level  capabilities  for  customs  risk  analysis  and  targeting,  PricewaterhouseCoopers, 
31 May 2012. 

EN 

5 

   EN 

 
                                                 
 
Furthermore,  valuable  data  available  to  operators  should  be  more  fully  exploited  by  the 
authorities for risk analysis purposes. 

2.4.2. 

Secure supply chains and economic operators 

Securing  and  safeguarding  the  integrity  of  the  supply  chain  is  a  shared  interest  among 
citizens, business and government. It requires high levels of partnership between customs and 
the trading community. 

Identifying  legitimate  and  low-risk  trade  makes it easier for customs authorities to focus on 
higher risks and to accelerate the movement of legitimate trade through the supply chain. 

A robust Authorised Economic Operator (AEO) programme is now firmly established in the 
EU (with more than 11 000 certificates in use in July 2012) and formally recognised by some 
major trading partners. The programme is closely monitored at EU level. 

Authorised Economic Operators take significant measures to secure their supply chain and are 
formally  validated  by  customs  authorities.  These  measures  relate  to  investment  in  physical 
security and internal control systems, financial solvency, risk assessment of the business and 
the reliability of business partners. In the EU, these measures should be recognised by non-
customs  authorities  and  regulators  concerned  with  supply  chain  risk  evaluation  and 
mitigation. 

Currently, however, similar initiatives in other public policy areas are not linked to the AEO 
programme.  This  may  lead  to  situations  where  an  operator  is  assessed  twice  for  the  same 
criteria by two different public administrations. 

There  is  a  need  for  a  more  concerted  effort  to  broaden  formal  recognition  of  the  AEO 
programme across policy areas for risk management purposes and to ensure that the benefits 
accruing to compliant businesses are maximised. Aligning the customs authorised economic 
operator programme with the secure trader programme in aviation security is one example. 

2.4.3.  Operational methodologies 

Putting  the  EU  common  risk  management  framework  into  operation  poses  significant 
challenges. Significant variance in the levels of risk analysis performed by Member States and 
associated countermeasures has real and undesirable consequences. 

Implementation is uneven and not as effective as expected for several reasons: 

• 

Variance in capacity 

A common minimum standard of automated risk analysis for security and safety has not yet 
been  achieved  due  to  variance  in  the  development,  capacity  and  technical  capability  of 
national electronic risk analysis systems. 

This means that the common risk criteria are not fully implemented in all Member States and 
cannot be properly monitored and evaluated for effectiveness at EU level. The absence of 24 
hour/7  days  a  week  (24/7)  capacity  and  support  in  some  Member  States  also  inhibits  the 
achievement of common EU standards. 

EN 

6 

   EN 

 
This limits EU capacity to adapt and respond to common risks and hinders innovation in risk 
management. 

• 

Differential burden 

Differences  in  the  volume  of  trade  to  be  risk-assessed  means  the  burden  of  the  work  also 
varies between Member States. This is mainly due to geographical location and to the nature 
of supply chain logistics. In addition, threats may vary according to time and place. 

Analysis  of  the  Import  Control  System  data  and  risk  assessment  resources  available  in 
Member  States  indicates  wide  variations  in  the  workload  of  customs  risk  analysis  and 
targeting officers. In some instances this ranges from 9 times the EU average for air cargo to 
over 50 times greater than the EU average for maritime traffic. 

• 

Operational coordination and exchange of information 

As the advanced cargo information is sent to the first point of entry in the EU, the challenge in 
risk assessing ‘who is moving what, to whom, from where’ is further complicated because the 
proportion of trade entering the EU that is bound for a Member State other than that of first 
entry or is transiting the EU is significant6. Traffic arriving at first points of entry frequently 
includes cargo bound for other Member States as well as cargo transiting the EU en route to a 
final destination in third countries. 

This  means  that  the  knowledge  and  information  available  at  national  and  local  level  in  the 
Member State of destination is critical for effective risk analysis and risk mitigation at points 
of  first  entry.  In  addition,  information  on  parties  and  their  characteristics,  including 
vulnerabilities  relating  to  parts  of  the  supply  chain  outside  the  EU,  is  clearly  of  common 
relevance and significance for risk analysis all along the external border. 

Systematic, real-time sharing or pooling of information, knowledge and expertise is essential 
to ensure that common equivalent minimum standards apply and that important information 
affecting  supply  chain  risk  is  available  to  those  who  need  it.  Conversely,  any  significant 
weaknesses  in  information-sharing  undermine  the  effectiveness  of  risk  management  at 
different entry points and for the EU as a whole. 

The  available  data  on  information-sharing  over  a 12-month period  suggests that not enough 
risk-related  information  is  made  available  under  current  operational  methodologies  and 
structures7.  Since  the  exchange  of  information  between  customs  at  first  point  of  entry  and 
other relevant Member States is not working properly, information relevant to risk assessment 
at EU level is being overlooked. 

In  the  aftermath  of  the  Yemen  incident,  the  High  Level  Working  Group  Report  on 
strengthening air cargo security also addressed EU coordination and exchange of information: 

‘An  adequate  response  to  the  terrorist  threats  must  involve  streamlined  coordination  and 
cooperation at EU level between the transport and the Justice and Home Affairs sector and 
different  government  agencies  as  well  as  a  rapid  exchange  of  information  between  the 
authorities  of  the  EU  Member  States.  This  principle  goes  beyond  the  specific  threat  giving 

6 
7 

E.g. more than 50 % of goods entering via Rotterdam — a major sea hub —are bound for another Member State. 
Over 36 million ENS were lodged but the number of requests from EU first points of entry for information from other Member 
States was 382. This is not consistent with proactive risk assessment and credible risk analysis and mitigation for goods crossing 
the external border. 

EN 

7 

   EN 

 
                                                 
rise  to  this  Report,  and  is  part  of  the  broader  reflection  on  how  the  EU  should  be  able  to 
respond to incidents which could also occur in other areas.’ 

However, exchanges of information between customs and other authorities vary significantly 
at  national  level  and  are  sometimes  lacking  at  EU  level  (e.g.  during  the  Fukushima  crisis). 
The current situation is unsatisfactory and requires remedial action8. 

3. 

RISK MANAGEMENT OF THE SUPPLY CHAIN — THE BROAD VIEW 

Risk management is a continuous process that involves identifying threats and risk, evaluating 
and  analysing  them  and  devising  appropriate  counter-measures.  It  is  time-constrained  and 
characterised by the need for knowledge of logistics and supply chains and the management 
and  integration  of  multiple  information  and  intelligence  flows.  It  requires  assessment  of  the 
quality and reliability of information, including an appreciation of the risk that data may be 
compromised  by  misinformation,  manipulation  or  falsification.  Its  effectiveness  lies  in  its 
flexibility, adaptability and responsiveness to the potential occurrence not only of events with 
knowable  consequences  but  of  those  with  less  calculable  effects.  Dealing  with  the 
consequences and aftermath of risks that materialise is also of vital importance. 

3.1. 

The scale of the challenge: trade growth and the complexity of the supply chain 

The  scale  of  the  challenge  can  be  gauged  by  considering  the  volume  and  rate  of  trade 
movements  and  the  profile  of  modern-day  logistics.  This  needs  to  be  balanced  with  the 
constraints  on  the  control  environment  both  in  terms  of  resource  capability  and  the  need  to 
avoid unwarranted disruption of the legitimate supply chain. 

Between 2004 and 2010, despite the impact of the financial crisis, the value of EU external 
trade grew by almost 50 %9. The EU is at the centre of global trade and supply chain logistics. 
It is the number one trading partner for the United States, China and Russia. More than 90 % 
of global trade (8.4 billion tons of merchandise) is carried annually by sea along more than 
25 800 global trade lanes. More than 20 % of this seaborne trade is unloaded in Europe. There 
are 25 400 transport  nodes  world-wide for cargo and passengers  moved by  air,  a  substantial 
proportion  of  which  are  linked  to  more  than  250  international  airports  in  the  EU.  The 
numerous parties involved in the management of these trade lanes add to the complexity of 
supply chain logistics. The eastern land border runs to 9 890 km, with 133 commercial road 
and rail entry points. Along the entire EU external border there are more than 1 000 customs 
offices of entry. 

In  2011,  EU  customs  processed  36  million  pre-arrival  cargo  declarations  (entry  summary 
declarations),  140  million  import  declarations,  96  million  export  declarations  and  9  million 
transit declarations. These figures represent an average of 8.9 declarations per second handled 
by the Member States’ customs administrations. 

Although the bulk of trade is lawful, a recent study by the World Economic Forum estimates 
illicit trade at between 7 % and 10 % of the global economy10. 

8

9 
10

On this subject the PWC study concluded ‘…there is room for improvement in the exchange of intelligence and information at all 
levels (between organisations at the national level, between the national and the EU level and between organisations at the EU 
level).’  
External and intra-EU trade: A statistical yearbook — Data 1958-2010, p16. 
World  Economic  Forum,  New  Models  for  Addressing  Supply  Chain  and  Transport  Risk,  An  initiative  of  the  Risk  Response 
Network, 2012. P9. 

EN 

8 

   EN 

 
                                                 
 
 
3.2. 

Range of risks and customs interconnection with other authorities 

The policies and role of agencies and authorities other than customs are also a core concern. 
The  need  to  align  and  ensure  complementarity  between  measures  taken  by  different 
authorities with due regard for their respective powers is a constant and vital feature of supply 
chain security management. Measures to enhance transport security, for instance, are clearly 
relevant to risk assessment of goods movements, most obviously in relation to cargo moved 
by air, a mode of transport now considered to be at high risk of terrorist acts. Equally, security 
measures  required  to  safeguard  transport  of  dangerous  goods  are  significant  factors  to  be 
taken account of. 

More  generally,  when  customs  acts  in  conjunction  with,  or  on  behalf  of,  other  authorities 
systematic communication and exchange of risk-related information is required11. In matters 
posing  serious  risks  to  public  health  and  the  environment  or  to  the  security  and  safety  of 
citizens such communication is vital to ensure timely intervention by the appropriate authority 
to mitigate and control risk. This is especially important where there are likely to be attempts 
to  conceal  or  misrepresent  such  goods  when  they  enter  the  EU.  The  objective  should  be  to 
ensure  that  key  information  residing  with  different  agencies  at  national  and  EU  level  is 
incorporated in risk assessment to improve its efficiency. 

3.3. 

The challenge for customs risk management: a multi-layered approach 

The current risk management framework is not sufficient to address security and safety risks 
uniformly  at  the  external  border.  Action  to  fill  in  the  existing  gaps  is  required  and  a  new 
approach to EU risk management is needed. 

The  assessment  of  the  nature  of  the  risk  and  the  likely  impact  should  the  risk  materialise 
should  drive  decisions  on  whether  action  is  considered  appropriate  and,  if  so,  the  location, 
type and timing of the checks or countermeasures to be taken. 

Different  risks  require  different  responses:  trade  between  identifiably  secure  traders  is 
considered  to  pose  a  lesser  risk  than  other  trade;  certain  goods  movements  are  readily 
identifiable as high risk. For this reason the EU does not support 100 % scanning or control 
but considers control measures should be commensurate with the risk assessment. 

The Yemen incident illustrated very clearly several key points to be considered in formulating 
EU  customs  supply  chain  security  policy.  These  include  the  time-sensitive  nature  of  risk 
mitigation  measures,  the  simultaneous  involvement  of  several  Member  States  in  a  single 
transaction  and  their  interdependence,  the  multi-agency  and  international  dimension  to  the 
issue and the core interest of industry and stakeholders in the international trading and supply 
chain  system.  These  interlinked  elements  underline  the  need  for  a  proactive,  interconnected 
approach to risk management involving multiple actors. 

Addressing the risk of an explosive device being loaded with air cargo requires action prior to 
loading  in  a  third  country,  whereas  other  risks,  including  those  with  security  and  financial 
implications such as illicit trade used to fund criminal or terrorist purposes, may be subject to 
control further on in the supply chain. Yet other risks may well be dealt with more efficiently 
and with the least disruption at traders’ premises. Many financial and commercial policy risks 

11

‘The  term  security  is  used  in  the  widest  sense  here.  It  covers  not  only  threats  to  public  security  in  the  movement  of  goods 
(criminal,  terrorist  or  other  trafficking  or  illegal  trade  in  firearms,  biological  products  or  explosives,  for  example),  but  also  the 
threats to society’s security from trade in goods which pose a risk to public health, the environment and consumers.’ The role of 
customs in the integrated management of external borders, COM(2003) 452. . 

EN 

9 

   EN 

 
                                                 
 
will continue to be controlled more effectively at the time of customs clearance and by means 
of  post-clearance  audits  when  more  detailed  data  and  documentation  is  available.  Effective 
risk analysis is essential for targeting such controls. 

Conducting early risk assessment is key to identifying the type and level of risk and the range 
of possible responses. Assessing the risks in advance of the arrival (and even the loading) of 
the  goods  enables  customs  and  other  enforcement  authorities  to  implement  a  multi-layered 
response to risks, allowing them to decide where best in the logistics chain to deal with the 
risk without jeopardising the security of EU Member States and citizens. This optimal vision 
of risk management is illustrated below. 

EN 

10 

   EN 

 
Figure 2: Optimal risk management process: 

Assess in advance — intervene where required 

1- Pre-loading: Immediate threat e.g. explosive device 
concealed in cargo, spread of disease, 

2- First EU entry point: Immediate threats not covered 
by 1 

3- Place of unloading: risks requiring control at border 
e.g. prohibited or dangerous goods and illicit trade 

4- Final destination: Early control not required e.g. 
conformance with product safety rules, financial audits 

Loading of the 
Goods 

Arrival of the goods at 
EU first point of entry 

Risk Assessment 

Intervention (control) 
where required

This  pro-active  risk  management  requires  24/7  surveillance  of  the  supply  chain  in  real  time 
365 days of the year. It requires all actors with a shared interest in safeguarding the integrity 
of  the  supply  chain  to  play  their  part  and  a  framework  for  the  process.  Legitimate  business 
interests must provide relevant supply chain information for risk analysis. A structure may be 
envisaged to cater for the multi-agency coordination and information sharing required in the 
EU. Ways of taking information from third countries into account must also be considered. 

Such  an  approach  underlines  the  need  for  much  greater  convergence  in  the  use  of  the 
information,  data  sources,  tools  and  methods  used  by  customs  to  pinpoint  risks  and  analyse 
commercial supply chain movements. Distinctions, e.g. between risk management to protect 
citizens from security and safety risks and more general anti-fraud concerns including goods 
smuggling, seem counterproductive and inefficient. 

The lack of a uniform approach hampers planning and targeted use of limited resources and 
represents an EU-level vulnerability. 

EN 

11 

   EN 

 
 
4. 

EU CUSTOMS RISK MANAGEMENT: THE WAY FORWARD 

The  effectiveness  and  efficiency  of  risk  management  of  the  movement  of  goods  across  EU 
borders are of critical importance for the security, health and well-being of citizens as well as 
for  the  trade,  economic  and  financial  interests  of  the  EU  and  its  Member  States.  Multiple 
challenges  require  multiple  and  integrated  solutions  to  the  gaps  identified  in  the  current 
approach.  

4.1. 

Ensuring quality, availability and fusion of trade data 

Provision  by  traders  of  quality  data  and  its  availability  to  the  authorities  involved  in  risk 
management at the appropriate level is a major priority. 

4.1.1.  Quality of data (‘who is moving what to whom’) 

Based on work carried out by a high level working group on strengthening air cargo security, 
EU  legislation  and  advance  cargo  information  systems  should  be  adapted  to  ensure  that  the 
data required for effective risk analysis is made available. 

This  includes  details  of  the  real  parties  behind  transactions  and  goods  movements  and  an 
adequate  description  of  the  goods  for  the  purposes  of  identification  and  electronic  risk 
analysis;  the  introduction  of  a  mandatory  HS  code  is  needed  at  least  for  commercial 
consignments. 

The filing arrangements required to obtain this range of data from carriers and other parties 
must be put in place as a matter of urgency. Some degree of differentiation to take account of 
different  trade  business  models  is  called  for  (e.g.  maritime  container  shipping;  air  express 
cargo; post). Rule-making by the EU should consider the administrative burden on economic 
operators and small and medium enterprises. It also must take account of the need to develop 
and promote international standards. 

4.1.2.  Data availability to all customs authorities concerned 

The sooner risk assessment of supply chain goods movements can be undertaken, the better 
control  requirements  can  be  tailored  to  the  type  of  risk  identified  and  adapted  to  fit  the 
logistics  process.  Trade  data  must  be  recorded  as  soon  as  possible  in  a  way  that  facilitates 
effective risk analysis and management. 

Data need to be accessible at the same time to multiple Member States to support flexible use, 
management  and  exploitation.  The  change  in  filing  arrangements  can  allow  data  from 
different parties obtained in more than one Member State to be fused. Cost-effective methods 
of achieving this should be explored. 

4.2. 

Engaging with economic operators 

Securing  and  safeguarding  the  integrity  of  the  supply  chain  is  a  shared  interest  among 
business interests and government authorities. 

EN 

12 

   EN 

 
4.2.1.  The EU Authorised Economic Operator (AEO) programme 

Successful implementation of the Authorised Economic Operators (AEO) programme in the 
EU  is  vital  to  recognise  the  investment  made  by  these  operators  and  ensure  that  significant 
benefits accrue. 

Recognition  of  AEO  status  within  the  EU  by  other  non-customs  authorities  and  regulators 
concerned with supply chain risk evaluation and mitigation could be an important source of 
economies  and  benefits  for  operators.  Likewise,  customs  recognition  (full  or  partial)  of 
similar EU status in other spheres (e.g. regulated agent in the air transport legislation) could 
improve the effectiveness of risk targeting. 

Broadening  the  benefits  accruing  to  EU  AEOs  internationally  and  mutual  recognition  of 
similar programmes established by third countries should also be a priority. 

4.2.2.  Cooperation with legitimate business to target illicit traffic 

Full engagement with economic operators offers the prospect of further significant benefits to 
risk management through raising trade awareness of the importance of the quality of data to 
be  supplied  and  increasing  knowledge  of  the  supply  chain  in  order  to  better  identify 
vulnerabilities and threats. 

Valuable  data  available  to  operators  should  be  exploited  by  authorities  for  risk  analysis 
purposes. 

4.3. 

Addressing risk management capacity differentials 

There is a need to overcome not only differences in capacity to analyse information but also 
the  varying  levels  of  information  in  different  Member  States.  A  combination  of  action  at 
Member State and EU level must be considered. 

4.3.1.  Member State level 

It is necessary to build up capacity to address the gaps existing in each Member State. This 
involves adjusting national electronic risk engines to common technical specifications in order 
to  ensure  implementation  of  the  required  standards.  It  also  involves  committing  adequate 
resources for 24/7 risk management and ensuring high-quality expertise in targeting and risk 
mitigation (e.g. through training). 

4.3.2.  EU level 

Member  State  action  can  help  overcome  gaps  in  risk  analysis  capacity  at  national  level. 
However, this alone is insufficient to deal with collective, EU-wide risk management issues 
associated with fragmentation in information flows due to geographic location and the nature 
of international logistics chains. 

At  EU  level,  better  pooling  of  the  capacity  and  resources  of  Member  States  is  required  to 
achieve EU risk management objectives more effectively at all point of the external border. 
While  recognising  and  respecting  specific  local,  regional  and  national  risk  management 
characteristics,  additional  EU-level  capacity  would  provide  a  dynamic  cost-effective 
complement to national action. This could comprise deployment in real time of an electronic 
risk  engine  to  supplement  national  technical  capacity  and  the  development  of  a  resource 

EN 

13 

   EN 

 
capability to address threats and risks that are common to Member States. More specifically, a 
capability organised at EU level would: 

• 

• 

• 

• 

• 

• 

enable suitable common risk criteria or EU-level risk profiles to be applied directly 
to EU-level data, rather than via 27 national systems, in crisis and other situations; 

strengthen the capacity to identify common risks and ensure they are treated in the 
same way across the external border. 

increase  the  visibility  of  international  supply  chains  and  ensure  that  important  risk 
information is not overlooked at external border level; 

improve  the  capacity  to  identify  more  rapidly  illegal  trade  networks  that  operate 
beyond  national  boundaries  and  address  the  risks  of  diversion  and  port  shopping 
more systematically. 

permit more effective external border data quality management, risk evaluation and 
review; 

create  a  platform  for  information-sharing  with  other  authorities  and  with  third 
countries. 

The  opportunities  arising  from  the  forthcoming  Customs  2020  programme,  for  example  the 
stationing  of  Member  State  experts  at  a  permanent  location  in  the  form  of  expert  groups, 
should  be  fully  exploited.  Pooling  such  resources  at  EU  level  would  help  to  address  the 
fragmentation of information flows, overcome difficulties associated with differences in risk 
management capacity between Member States and guarantee a uniform standard of electronic 
risk analysis and management. 

4.4. 

Coordinating with other authorities and agencies 

The  need  to  have  more  structured  and  systematic  cooperation  and  coordination  between 
customs and other authorities, especially in situations where the risk can be better handled at 
the EU level, is one of the main conclusions drawn from the Yemen case. In particular: 

• 

• 

There is a need to streamline risk information and intelligence from specific agencies 
on  serious  threats  related  to  cargo  movements,  make  it  available  and  have  it  acted 
upon  immediately  using  the  advance  cargo  information  system.  The  type  of 
information,  and  procedures  for  its  transmission  in  a  way  that  optimises  the  results 
for common risk management, depends on the structure and organisational setting of 
the relevant authorities (including customs) and needs to  be  determined  and agreed 
together with those authorities. 

Customs  should  participate  in  EU-level  supply  chain  security  threat  and  risk 
assessment and ensure its integration in customs risk management. 

The added value of such arrangements would be magnified if such information were applied 
uniformly  and  instantly  at  EU  level  in  real  time,  as  this  would  ensure  the  earliest  possible 
reaction to common threats and risks and overcome the gaps identified above. 

EN 

14 

   EN 

 
4.5. 

Cooperating internationally 

Effective risk management also depends on strong international cooperation, both bilaterally 
and multilaterally. Close cooperation with our main trading partners will expand knowledge 
and information. It will also contribute to spreading knowledge of risk management methods 
and techniques internationally. 

The EU should pursue initiatives to develop information exchange with major trading partners 
and neighbouring countries, promote mutual recognition of trade partnership programmes and 
support  joint  training  of  staff  through  exchanges  of  officials  and  developing  common 
standards; it should complete on-going work on a common framework for risk management 
with  partners  participating  in  the  EU  customs  security  area;  finally,  it  should  continue  to 
support international work on standards (e.g. under ‘SAFE’) in multilateral organisations such 
the WCO, ICAO, IMO and UPU with regard to risk management and supply chain security, 
including pre-departure information for all cargo, exchanges of information, trade partnership 
programmes and detection technologies. 

5. 

CONCLUSION 

Traders,  Member  States  and  citizens  in  the  EU  all  have  an  interest  in  effective  risk 
management.  Closer  engagement  with  economic  operators  is  required  to  attain  the  desired 
standards  of  data  for  risk  analysis,  facilitate  the  efficient  movement  of  legitimate  trade  and 
better combat illicit trade. This, together with more systematic exchange of risk information 
and coordination between customs and other authorities or agencies and closer international 
cooperation, will reinforce the security and integrity of the supply chain. 

Before  taking  concrete  initiatives  for  action  to  reinforce  customs  risk  management  the 
Commission  invites  the  Council,  the  European  Parliament  and  the  Economic  and  Social 
Committee to consider the approach set out in this communication.  

EN 

15 

   EN