Our customs desk still fields the same surprised question from US and overseas companies shipping into Canada: "my broker always handled the bond, why is the border asking me for security now." The short answer is that the rules changed under CARM, the obligation moved onto the importer, and the next moment it bites is the annual review on 20 October 2026. GetTransport.com books freight on lanes into Canadian ports and land crossings, so this is the operational read on what an importer has to post, how the number is calculated, and what to have ready before that review, not legal or surety advice.
CARM, the CBSA Assessment and Revenue Management system, went live as the Canada Border Services Agency's official system of record for commercial imports on 21 October 2024. CBSA reports the scale it now runs at: around 47.5 billion dollars in duties and taxes collected in 2025 across more than 41 million accounting declarations, with an electronic release rate above 99%. For an importer the headline is not the technology, it is one structural change buried inside it, and that change is about who guarantees the money.
Why your broker's bond no longer covers you
Before CARM, most importers got their goods released before paying duty by riding on their customs broker's security. The broker posted a bond, and their clients cleared under it. Under CARM that is gone. As Roanoke Group and CBSA both spell out, each importer must now post its own financial security, cash or a surety bond, directly to CBSA to keep the Release Prior to Payment privilege. A broker can no longer cover a client's RPP obligation with the broker's own bond.
Release Prior to Payment is worth understanding plainly, because losing it hurts cash flow. RPP lets you get goods released from CBSA before you pay the duties and taxes, defer the accounting, and defer the payment to a monthly settlement. Without RPP you pay duties and taxes at the port before CBSA will release the shipment, on every entry. The transition to the new model is already behind us: CBSA set a 180-day window that ran to 19 April 2025, then granted a 30-day extension to a hard deadline of 20 May 2025 for importers to post security. Those dates have passed, so if you are importing into Canada today you are either already secured or you are paying at the border, and the live question now is keeping the security correctly sized through the annual review cycle.
How much security you actually have to post
The required amount is driven by your own import history, not a flat figure. CBSA looks at your statement of account over the trailing 12 months, finds the single highest month of duties and taxes owed, and sets the security from that peak. According to Cole International, a surety bond has to cover at least 50% of that highest month, while a cash deposit has to cover 100% of the same figure. Bondrail gives the clean worked example: a peak month of 200,000 dollars means a surety bond of at least 100,000 dollars, or a cash deposit of the full 200,000.
Two boundaries matter. The security is posted per RM import program account, so a company running several program accounts has to cover each one, and the amount runs between a floor and a ceiling. Cole and Bondrail both put the CBSA minimum at 5,000 dollars per RM account and the maximum at 10 million. One caution for anyone shopping for a bond: some surety providers advertise a product minimum around 25,000 dollars, which is the smallest bond they will write rather than the CBSA regulatory floor. Do not confuse the two, and if you see a 25,000 figure quoted, check whether it is the agency's requirement or the provider's. The authority on the underlying framework is CBSA Memorandum D17-1-8, which governs the RPP privilege, the security calculation, and suspension.
Surety bond or cash deposit
For most importers with any real volume this is not a close call. A cash deposit ties up 100% of your peak-month duty figure with CBSA, money that sits idle and out of your working capital. A surety bond covers the requirement at the 50% level and costs only an annual premium, a fraction of the sum guaranteed, so it preserves cash you would otherwise lock away. The trade-off is that a bond is a credit product: the surety underwrites you, so a new or thinly-capitalized importer may face underwriting questions a cash deposit sidesteps. The practical pattern we see is cash deposits used only by very small or occasional importers, and surety bonds used by everyone moving steady volume. This is the same logic that governs a continuous bond in the United States, which we cover in our US customs bonds guide.
Setting up the CARM Client Portal
The mechanics run through the CARM Client Portal, and the importer has to do the registration itself. A broker cannot register your business for you. As GHY International lays out the sequence, it goes like this:
- Create an individual user account through GCKey or a Sign-In Partner, done by the person who will manage the business account.
- Register the business using its 9-digit business number and its 6-digit RM import program account, plus the legal name and address on file with the CRA and answers to verification questions on past CBSA transactions.
- Take the Business Account Manager role, which the first registrant is assigned automatically, and add a second manager as a backup so a single departure does not lock you out.
- Delegate authority to your customs broker inside the portal so they can file accounting declarations and manage payments on your behalf.
- Post your financial security, cash or surety bond, to activate and keep RPP.
The delegation step is where importers misread the split. You can hand your broker authority to transact, and most do, but the financial-security obligation stays with you as the importer. Delegating the filing does not delegate the bond.
The annual October 20 review is the recurring trap
CARM security is not set-and-forget. CBSA re-runs the calculation every year on 20 October, looking back over the preceding 12 months to recalculate each importer's required minimum for the year ahead. The first of these annual reviews ran on 20 October 2025, and accounts whose required security had increased had to top up by 15 January 2026. That January deadline is the recurring pattern rather than a one-off: each 20 October review carries a top-up deadline of 15 January the following year. The detail that catches people, flagged by Cole International, is that CBSA only notifies accounts where the number went up, so importers whose requirement is unchanged or lower get no message at all. If your required security rose and you missed the notice in the portal, you find out when your RPP is at risk.
That makes the next review, on 20 October 2026, the live item on the calendar, with any resulting top-up due by 15 January 2027. If your Canadian import volume grew over the past year, your peak month grew with it, and so will your required security. The move is to check the portal proactively ahead of the review rather than waiting for a notification that only arrives on increases, and to build in lead time on the bond side. CBSA has cited roughly 25 business days to process paper endorsements, so a last-minute top-up is a real risk of an RPP gap.
What happens if your security lapses
The consequence is concrete and immediate. An importer who does not post, or whose security falls short after the annual review and is not topped up by the deadline, has RPP suspended. In practice that means paying all duties and taxes upfront at the port of entry before CBSA releases the goods, on every shipment, with no deferral. For a business importing regularly, that is a working-capital shock and a clearance delay at the same time. Continued insufficient or lapsed security can escalate to revocation of the privilege under the D17-1-8 framework. Keeping the bond current and correctly sized is cheaper than any of that.
How this compares to a US customs bond
Importers who already hold a US bond expect Canada to work the same way, and the structure rhymes but the math does not. In the United States, a continuous bond covers all of an importer's entries nationwide for a year and is sized as the greater of 50,000 US dollars or 10% of the duties, taxes, and fees paid to CBP over the trailing 12 months. Canada sizes its surety at 50% of the single highest month of duties and taxes, with a 5,000 dollar floor per RM account. Both systems now put the security obligation squarely on the importer, both offer a continuous or self-renewing option against a single-transaction one, and both let a surety bond stand in for tied-up cash. The difference to plan around is the calculation basis: a US continuous bond is built on 10% of an annual figure, while a Canadian surety is built on 50% of a peak month, which can produce a materially different guarantee relative to your volume. Whoever is named as importer of record carries the obligation in both countries, which is why your Incoterms matter here as much as your bond, a point we unpack in our DDP versus DAP breakdown.
What to do before the next review
If you import into Canada, the checklist for the run-up to the 20 October 2026 review is short and specific:
- Confirm you are registered in the CARM Client Portal with your business number and every RM account, and that you have a second Business Account Manager set up for continuity.
- Pull your statement of account, find your highest single month of duties and taxes over the last 12 months, and recompute the security you need at 50% for a surety or 100% for cash, per RM account.
- Compare that to your posted amount now, because a year of import growth may have pushed your required minimum above what you posted last cycle.
- Choose or renew a surety bond over a cash deposit if you carry any real volume, and engage the surety or broker early given the roughly 25-business-day processing lead time.
- Log into the portal proactively around the review rather than relying on a notification, since CBSA only flags accounts whose requirement increased.
- Keep the security continuously in force, because a lapse drops you out of RPP and forces payment at the border on every entry.
Frequently asked questions
Can my customs broker still post the bond for me under CARM?
No. Since CARM went live, each importer must post its own financial security directly to CBSA to keep Release Prior to Payment. A broker can be delegated authority in the CARM Client Portal to file declarations and manage payments on your behalf, but the security obligation stays with you as the importer. This is the single biggest change from the pre-CARM model, where clients cleared under the broker's bond.
How is my required security amount calculated?
CBSA takes your highest single month of duties and taxes over the trailing 12 months. A surety bond must cover at least 50% of that peak month; a cash deposit must cover 100%. The minimum is 5,000 dollars per RM import program account and the maximum is 10 million. Note that some surety providers set their own higher product minimum, often around 25,000 dollars, which is separate from the CBSA floor.
What is the next deadline I need to worry about?
The annual CBSA financial-security review on 20 October 2026, with any required top-up due by 15 January 2027. CBSA recalculates each importer's required minimum over the preceding 12 months and only notifies accounts whose requirement increased, so an unchanged or lower account gets no message. If your import volume grew, check the CARM Client Portal proactively and top up before the 15 January deadline, allowing lead time for bond processing, or you risk losing RPP.
What happens if I lose Release Prior to Payment?
You have to pay all duties and taxes upfront at the port of entry before CBSA releases your goods, on every shipment, with no deferral. That is both a cash-flow hit and a clearance delay, and continued lapses can lead to revocation of the privilege. Keeping a correctly sized bond in force is far cheaper than operating without RPP.