NCAs play a central role in implementing CBAM at the national level. NCAs’ responsibilities include authorising importers as CBAM declarants and registering accredited verifiers who are essential to the CBAM compliance process (Section 3.1). NCAs must also handle the revocation of authorisations (Section 3.2). They are responsible for reviewing CBAM declarations submitted by authorised CBAM declarants (Section 3.3), managing CBAM certificate requirements (Section 3.4), acting upon faulty CBAM certificate surrender and requesting correction and ultimately for imposing penalties when CBAM declarants fail to comply with their obligations (Section 3.5). Finally, effective data exchange and communication are crucial to the NCA’s operations (Section 3.6).
Advancing the Implementation of the EU Carbon Border Adjustment Mechanism
From 1 January 2026, only authorised CBAM declarants are allowed to import CBAM goods above the 50-tonne de minimis threshold into the EU. Importers of less than 50 tonnes of CBAM goods per year (except hydrogen and electricity) are exempted from the authorisation requirement. Authorisation is necessary to ensure that importers can fulfil key obligations under the CBAM framework, such as reporting embedded emissions, purchasing and surrendering CBAM certificates, and submitting annual CBAM declarations. To allow for the processing of applications, importers without the status of CBAM declarant can continue importing from 1 January 2026 when an application for CBAM declarant has been submitted by 31 March 2026 until the NCA grants authorisation (Article 17(7a) of the CBAM Regulation 2023/956).
Authorisation is the formal recognition by an NCA that an importer or its indirect customs representative is eligible to import CBAM goods under EU rules. This status is granted upon successful application for the status of CBAM declarant via the CBAM Registry. The process requires submission of detailed information about the applicant, the goods to be imported. Once authorised, the applicant gains the status of authorised CBAM declarant and has access to the CBAM Registry for the submission of CBAM declarations and to the Central Common Platform (CCP) for acquisition and surrender of CBAM certificates. NCAs shall also register and deregister accredited verifiers in and from the CBAM Registry.
3.1.1. Authorisation processes and tasks of NCAs
NCAs in each EU Member State play a central role in the CBAM authorisation process. Relevant provisions include Article 5 and 17 of the CBAM Regulation 2023/956, as well as Chapters I, II, and III of the Implementing Regulation 2025/486 laying down rules as regards the conditions and procedures related to the status of authorised CBAM declarant (European Commission, 2025[1]). NCAs are responsible for receiving and processing applications for the status of authorised CBAM declarant. All procedures related to the authorisation take place in the CBAM Registry. Once an application is submitted via the CBAM Registry, NCAs verify the identity of the applicant, assesses their eligibility, and ensures that the application is complete and accurate. This includes the evaluation if the criteria for granting the status of authorised CBAM declarants are met.
Upon evaluation, the NCA decides to approve or reject the application: if approved, the applicant is granted access to the CBAM Registry as an authorised CBAM declarant. The NCA must communicate its decision within 120 days for those submitted after 15 June 2025 and within 180 days for applications submitted before that date or if additional information is requested from the applicant. In addition, the NCA must manage and update the list of authorised CBAM declarants. Detailed NCA tasks and authorisation processes are depicted in Figure 3.1.
Source: Authors.
As part of the assessment, the NCA may request additional information from applicants if necessary to verify compliance. The specific conditions are set out in Article 17(2) of the CBAM Regulation 2023/956. In such cases, the overall assessment period may be extended by up to 30 days but shall not exceed 180 days in total from the date of the original application.
If the NCA intends to refuse the application, it must notify the applicant of this intention and the reasons for it. The applicant is then granted up to 30 calendar days to submit observations. After reviewing any submitted observations, the NCA may proceed with a final decision. If the status is ultimately denied and the applicant appeals the decision, the NCA must record the existence and outcome of the appeal in the CBAM Registry. If the authorisation is refused the NCA must register the reasons for refusal as well as information on the applicant whose authorisation has been refused.
If the NCA grants authorisation to a CBAM declarant, it shall register the authorisation as ‘active’ in the CBAM Registry along with the information specified in the Annex of the Implementing Regulation 2025/486. The decision on the application takes effect on the date where the decision is registered in the CBAM Registry, and the applicant is notified of that decision in the CBAM Registry.
The NCA is responsible for conducting periodic reassessments of the status. The NCA must inform other NCAs where a CBAM declarant has been involved in serious or repeated infringements of customs legislation, taxation rules or market abuse rules. If the reassessment warrants a change to the status of an authorised CBAM declarant, the NCA shall inform the CBAM declarant without delay. The declarant has 30 days to respond and the NCA may initiate the revocation procedure (Section 3.2).
The process for the authorisation of electricity importers is described in Box 3.1. Authorising electricity importers require close coordination with Customs Authorities and energy regulatory authorities (Recommendation 2).
The authorisation process for electricity importers may differ from the processes for importers of other CBAM goods according to Article 5(4) of the CBAM Regulation 2023/956 and Article 8 of the Implementing Regulation 2025/486. The person to whom explicit capacity has been allocated for import and who nominates that capacity for import will by default be regarded as the authorised CBAM declarant in the Member State where the person has declared the importation of electricity in the customs declaration. No separate application for the status of authorised CBAM declarant is required in that case. For importers not falling under Article 5(4), the normal application procedure applies.
To identify the relevant persons importing electricity falling under Article 5(4), within one month after the customs declaration was lodged that person shall provide to the NCA the following:
The respective customs declaration covering the electricity imports
Information on the following:
Name, address and contact information;
Economic Operators Registration and Identification (EORI) number1;
Main economic activity carried out in the Union;
Indication that the capacity for the import of electricity has been allocated to that person and that the capacity was nominated for import through explicit capacity allocation and the imports measures per border for time periods no longer than one hour and no deduction of export or transit in the same hour;
Documents supporting the indication.
When the above information is available to the NCA, the person can be registered as CBAM declarant in the CBAM Registry.
To identify the relevant persons importing electricity falling under Article 5(4), within one month after the customs declaration was lodged that person shall provide to the NCA the following:
The respective customs declaration covering the electricity imports
Information on the following:
Name, address and contact information;
Economic Operators Registration and Identification (EORI) number2;
Main economic activity carried out in the Union;
Indication that the capacity for the import of electricity has been allocated to that person and that the capacity was nominated for import through explicit capacity allocation and the imports measures per border for time periods no longer than one hour and no deduction of export or transit in the same hour;
Documents supporting the indication.
When the above information is available to the NCA, the person can be registered as CBAM declarant in the CBAM Registry.
The respective customs declaration covering the electricity imports
Information on the following:
Name, address and contact information;
Economic Operators Registration and Identification (EORI) number3;
Main economic activity carried out in the Union;
Indication that the capacity for the import of electricity has been allocated to that person and that the capacity was nominated for import through explicit capacity allocation and the imports measures per border for time periods no longer than one hour and no deduction of export or transit in the same hour;
Documents supporting the indication.
When the above information is available to the NCA, the person can be registered as CBAM declarant in the CBAM Registry.
Source: CBAM Regulation 2023/956 and Implementing Regulation 2025/486.
Indicative timeline: Short term
Description: Close coordination between NCAs and Customs Authorities, energy regulatory authorities and transmission system operators (TSOs) is needed to identify CBAM declarants importing electricity, and the following steps are recommended:
Exchange with above stakeholders on electricity import procedures and relevant electricity importers covered by CBAM;
Identify relevant electricity importers in coordination with above stakeholders;
Communicate with identified electricity importers on CBAM requirements proactively.
Examples from EU-wide implementation: Some NCAs have initiated internal discussion with the respective energy regulatory authorities and TSOs. A working group from European Commission and NCAs addresses the topic of electricity importers as CBAM declarants and aims to provide further guidance to NCAs.
3.1.2. Assessment criteria of applications
Any applicant for the status of authorised CBAM declarant provides information via the application form in the CBAM Registry. Based on the information provided, the NCA evaluates if the applicant meets the criteria in Article 17(2) of the CBAM Regulation 2023/956 and documents the evaluation and its results:
The applicant has not been involved in a serious infringement or in repeated infringements of customs legislation, taxation rules, market abuse rules or the CBAM Regulation and its delegated and implementing acts, and in particular the applicant has no record of serious criminal offences relating to its economic activity during the five years preceding the application;
The applicant demonstrates its financial and operational capacity to fulfil its obligations under the CBAM Regulation 2023/956;
The applicant is established in the Member State where the application is submitted;
The applicant has been assigned an EORI number in accordance with Article 9 of the Union Customs Code (UCC) Regulation 952/2013.
Evaluation of the formal requirements on EORI number and establishment in the Member State where application is submitted can be achieved by comparing information submitted by the applicant with existing company registration information.
To assess financial and operational capacity to fulfil the obligations under CBAM, and to ensure that the applicant has not been involved in serious or repeated infringements of customs legislation, taxation rules, market abuse rules, or the CBAM Regulation 2023/956, the NCA can analyse information provided in the application and regarding the compliance of the applicant during the CBAM transitional period (Table 3.1). The NCA can also consider expert or third-party conclusions, as well as audits provided by the applicant during the evaluation.
Source: Authors, based on the CBAM Regulation 2023/956.
NCAs can require additional information and documents from applicants to assess their eligibility for the status of authorised CBAM declarant. This can include a various set of documents according to the specific national context (Recommendation 3). Some NCAs published detailed list of documents required from applicants during the authorisation process, including
Company identification number;
Tax clearance certificate and company tax criminal record;
Certificate of status issued by the Company Register, listing company administrators;
Statement from the Company Register identifying beneficial owners;
Criminal records of administrators and beneficial owners, or a self‑declaration by the legal representative attesting compliance with Article 9 of Implementing Regulation 2025/486.
Indicative timeline: Short, medium and long terms
Description: The list of documents required from applicants should be reviewed periodically to ensure that it remains adequate for assessing applications and identifying risk factors during the authorisation process, taking into account regulatory changes and operational experience (e.g., identifying recurring gaps or missing information in applications). Risk-assessment dashboards, supported by clear decision procedures and standardised templates, could further reduce manual handling and enable NCAs to focus their resources on higher-risk applicants.
Automating parts of the authorisation process is possible in-house through e.g., automatic cross-checks of data from applications with other databases or analysis of information application.
Delegating parts of the authorisation process to another public or private entity than the NCA is also possible, in particular the processing and evaluation of applications. This can help streamline the process and free up resources at the NCA.
Examples from EU-wide implementation: The application reviews are partially automated within some NCAs, while other NCAs have opted to delegate parts of the authorisation process to another entity (private or public), which was enabled via the transposition of the CBAM Regulation to national law.
3.1.3. Processes for guarantee required from applicants
The NCA shall require the provision of a guarantee from the applicants that have not been established throughout the two financial years preceding the year of application for the status of authorised CBAM declarant (Figure 3.2). The guarantee should amount to the aggregate value of number of CBAM certificates that the CBAM declarant would have to surrender based on the information in its application. The purpose is to demonstrate the financial and operational capacity of the applicant. For applications received in 2025, a guarantee would be required from applicants that have not been established by 1 January 2023 in the respective Member State, although NCAs may have some flexibility.
The guarantee can take the form of a bank guarantee payable at first demand by a financial institution operating within the Union or any other guarantee providing equivalent assurance. When the guarantee is provided by the applicant and registered in the CBAM Registry by the NCA, the positive decision on the application takes effect on the day of the registration of the guarantee.
Note: EC stands for the European Commission.
Source: Authors, based on the CBAM Regulation 2023/956 and the Implementing Regulation 2025/486.
The NCA is also responsible for monitoring, reassessing, potentially requiring adjustments to the guarantee, and releasing the guarantee. Detailed guidelines and tools can help manage the guarantees (Recommendation 4). The amount of each guarantee shall be determined as the aggregate value of the number of CBAM certificates that the authorised CBAM declarant would have to surrender based on the information provided on volume of imported CBAM goods in the application.
Indicative timeline: Short term
Description: Setting up operational capacity to document and communicate guarantee information alongside the guarantee can include:
Developing guidelines consisting of tasks, processes, timelines and consequences regarding the (non-)provision of guarantees;
Determining if another form of guarantee with equivalent assurance to a bank guarantee, payable at first demand by a financial institution operating in the Union is acceptable and notifying the European Commission thereof;
Establishing templates for communication of required and adjusted guarantees, and for the latter:
Information on time limit for provision (not exceeding two months);
The possibility for the authorised CBAM declarant of fulfilling the guarantee requirement either via an additional guarantee, or the replacement of the initial guarantee with a new guarantee;
Documentation of receipt of guarantees and their amounts per CBAM declarant, required amount of guarantee after reassessment, receipt of adjusted guarantee, release of guarantee;
Developing an automatic tool to aid quick, methodologically sound and impartial calculation and regular (e.g., quarterly) reassessment of the guarantee considering e.g., customs data vs. information provided in the application for the status of CBAM declarant, actual CBAM benchmarks, country-specific default values for embedded emissions, including mark-up, EU ETS price developments.
Examples from EU-wide implementation: Some NCAs have developed internal and external guidelines and envision the utilisation of an internal tool for tracking and assessing guarantees.
3.1.4. Registration of accredited verifiers
The NCA must register the information on accredited verifiers in the CBAM Registry upon request of the accredited verifier. The NCA must notify the verifier of the registration in the CBAM Registry and the NCA must update any changes to the information when notified by the accredited verifier thereof. The NCA shall deregister a verifier from the CBAM Registry where the verifier is no longer accredited or where the verifier has not notified the NCA on updates to the information above. The NCA shall notify the European Commission and other NCAs of the deregistration and delete the information on the accredited verifier from the CBAM Registry provided that it is not necessary for the review of CBAM declarations.
The core purpose of revocation of authorisations is to address situations where a declarant either no longer wishes to hold the status of authorised CBAM declarant, no longer meets the fundamental authorisation criteria or has committed serious or repeated infringements of its CBAM obligations. In that case, the legal person holding the status loses it.
The NCA has the authority to suspend or revoke the status if the declarant fails to comply with CBAM requirements. The rules governing the revocation of the status are laid out in Article 17 of the CBAM Regulation 2023/956 and Chapter IV of the Implementing Regulation 2025/486. Three revocation scenarios exist:
Revocation requested by the authorised CBAM declarant;
Revocation initiated by NCAs;
Immediate revocation initiated by NCAs.
These procedures ensure that the revocation of the status of authorised CBAM declarant, whether initiated by the declarant or the NCA, is conducted in a structured manner, with clear obligations and timelines to maintain compliance with the CBAM framework (Recommendation 5).
3.2.1. Revocation processes and tasks of NCAs
The NCA is responsible for managing the revocation procedure and registers all decisions and significant steps during the revocation process in the CBAM Registry (Figure 3.3). If an authorised CBAM declarant voluntarily requests the revocation of their status, the request must include the reason for revocation and the desired effective date. The NCA must register the reasons provided.
The NCA periodically reassesses the status of authorised CBAM declarants to establish if they still fulfil the authorisation criteria or have been involved in serious or repeated infringements of the obligation to surrender CBAM certificates or hold them at the end of each quarter. In case the reassessment warrants a change to the status of CBAM declarant, the NCA initiates a revocation procedure after informing the CBAM declarant. The NCA may initiate a consultation procedure with the European Commission and other NCAs via the CBAM Registry after revocation procedure started. Before revoking the status, the NCA shall give the authorised CBAM declarant the possibility to be heard and to submit observations. After the NCA takes the revocation decision, it registers it without delay in the CBAM Registry. The revocation takes effect the following day. Persons holding a revoked authorisation may appeal the decision. If the right to appeal is exercised after the NCA's final decision, the NCA shall register the existence and the conclusions of the appeal proceedings in the CBAM Registry. An appeal generally does not suspend the revocation decision unless national law, or a court order dictates otherwise.
The person whose status has been revoked still has to submit a CBAM declaration and surrender the total outstanding number of CBAM certificates for imports prior to the revocation's effective date within one month from the notification of revocation. In case the person holding a revoked authorisation is not able to submit the CBAM declaration, the NCA shall establish a CBAM declaration by itself based on available data and default values. The surrender of CBAM certificates must then occur within 15 calendar days for which the NCA reopens the closed CBAM account temporarily.
Note: EC stands for the European Commission.
Source: Authors, based on the CBAM Regulation 2023/956 and the Implementing Regulation 2025/486.
3.2.2. Revocation upon request of CBAM declarant
An authorised CBAM declarant may, at any time, request the revocation of its own status. The authorised CBAM declarant must submit a request to the NCA via the CBAM Registry, indicating the reason for the revocation (e.g., cessation of business or import activity below the threshold) and the desired date from which the revocation should take effect. This revocation date cannot predate the submission of the request. The NCA is responsible for registering the reasons provided by the declarant in the CBAM Registry and must notify the declarant, the European Commission, and other competent authorities of the revocation. A declarant may withdraw their revocation request at any time before the NCA has made a final decision on it.
3.2.3. Reassessment of status of CBAM declarant
The NCA is responsible for ensuring that authorised CBAM declarants continue to meet the conditions of their status. It must reassess the status periodically, at least in the following specific cases:
When information provided by the authorised CBAM declarant under their duty to report changes as per Article 5(7) of the CBAM Regulation 2023/956 (e.g., EORI number, economic activity, etc.) has changed;
When the NCA has information indicating that the criteria for granting the status of authorised CBAM declarant in Article 17(2) of the CBAM Regulation 2023/956 might no longer be met (Subsection 3.1.2);
When the NCA has information indicating that the conditions for maintaining a sufficient guarantee might no longer be fulfilled;
When the CBAM declarant is involved in a serious or repeated infringements of surrendering or holding a sufficient number of CBAM certificates during the year (Article 22 of the CBAM Regulation 2023/956);
If the declarant's EORI number has been invalidated e.g., due to company closure or legal entity changes, voluntary deregistration by the economic operator, duplicate or inconsistent data, fraud or breach of customs regulations. The Custom Authority is responsible for managing EORI numbers.
Furthermore, NCAs in other Member States or the European Commission, must inform the authorising NCA if they become aware of serious or repeated infringements by an authorised CBAM declarant. This information exchange is an important part of the reassessment mechanism which in turn serves as a crucial proactive tool for NCAs to maintain the integrity of the CBAM.
If the reassessment leads the NCA to conclude that adjustments to the status are required, it must communicate its conclusions to the authorised CBAM declarant. The authorised CBAM declarant then has 30 calendar days to respond. When a NCA, as a result of the reassessment and taking into account the observations of the authorised CBAM declarant, has grounds to believe a declarant no longer meets authorisation criteria, it initiates a revocation procedure.
3.2.4. Revocation initiated by NCAs
Revocation procedures initiated by the NCA are governed by Articles 22, 23, 26, and 27 of the Implementing Regulation 2025/486 and involve the following steps:
1. Additional information request (optional): Before making the decision on revocation or initiating a consultation procedure, the NCA may request from the CBAM declarant additional information or observations on the information on which the NCA intends to base its revocation decision. The deadline for this request shall not exceed 10 working days.
2. Consultation procedure (optional): The NCA may initiate a consultation procedure with other NCAs and the European Commission via the CBAM Registry if it intends to revoke the status of an authorised CBAM declarant.
3. Right to be heard and decision (mandatory): Before taking the decision, the NCA must provide documents and reasons for the intended revocation and give the declarant the possibility to be heard within 15 working days. After considering its observations, the NCA may take a decision and must notify it without delay in the CBAM Registry, where it takes effect the following day.
4. Appeal (optional): The person holding a revoked authorisation has the right to appeal the revocation decision under national law. The appeal's existence and outcome are registered by the NCA though an appeal by itself does not suspend the revocation.
3.2.5. Immediate revocation initiated by NCAs
The NCA may decide on an immediate revocation of the authorised CBAM declarant status in exceptional and severe circumstance, specifically if:
The conclusions of a reassessment of the status of authorised CBAM declarant justify it;
The authorised CBAM declarant has ceased its economic activity;
The decision granting the authorisation was taken on the basis of incorrect or incomplete information, and the declarant knew or ought reasonably to have known this.
Even for immediate revocations, the declarant must be given the possibility to be heard. The NCA's communication regarding the intended immediate revocation must include the reference to the documents and information on which it intends to base its decision. However, the time limit for the declarant to submit observations on the intended immediate revocation is shortened to not exceed 5 working. After considering its observations, the NCA may notify the declarant of the immediate revocation and the reasons without further delay via the CBAM Registry, changing the authorisation status to ‘revoked’.
3.2.6. Post-revocation obligations
The person whose status has been revoked must submit a final CBAM declaration and surrender the total number of CBAM certificates for imports prior to the revocation (Table 3.2). These obligations have to be fulfilled within one month from the revocation’s effective date.
Source: Authors, based on the Implementing Regulation 2025/486.
A crucial backstop measure for ensuring compliance after revocation is the NCA's authority to establish a CBAM declaration itself if the person whose status has been revoked fails or is unable to do so. If the person whose status has been revoked is unable to submit the CBAM declaration, they must inform the NCA within one month of being notified of the revocation decision and provide any necessary data and information.
The NCA then establishes such CBAM declaration, including the number of outstanding CBAM certificates within one month of receiving notification of the person’s inability to submit the declaration or the missed deadline. This CBAM declaration can be based on:
Information provided by the person whose status has been revoked e.g., quantity of goods, verified embedded emission data;
Information on imports communicated by the European Commission or Customs Authorities;
Any other information held by the NCA e.g., data from reviews of CBAM declarations or from other NCAs;
Embedded emissions determined by reference to the default values as set out in Annex IV of the CBAM Regulation 2023/956.
Once the NCA has made this CBAM declaration, the person with revoked status is notified and must surrender the corresponding number of CBAM certificates within 15 calendar days. During this time, the NCA will temporarily reopen the closed CBAM account. This process ensures that any outstanding liabilities are settled, even if the former authorised CBAM declarant is uncooperative or incapacitated after their status has been revoked.
Indicative timeline: Short term
Description: To uphold the integrity of CBAM, it is essential to ensure that only entities that have demonstrated their capacity to submit a CBAM declaration and surrender the correct number of CBAM certificates are importing CBAM goods. The development and implementation of internal guidelines, capacity and responsibilities regarding the revocation procedure and the potential establishment of a CBAM declaration by the NCA is recommended, including:
Periodic (e.g., quarterly) and automatic IT-supported reassessment of:
Conditions for sufficient guarantee for entities not established throughout the two financial years preceding the year of application;
Criteria for granting status of authorised CBAM declarant;
Definition of relevant trigger points that warrant the revocation procedure, e.g.:
Threshold of sufficient guarantee;
The number and/or seriousness of infringements of customs legislation, tax rules, market abuse rules;
The observation of the quarterly holding obligation of CBAM certificates in the CBAM account of the authorised CBAM declarants considering the factors laid down in Article 22(2) of the Implementing Regulation 2025/486;
Operational and financial capacity of the authorised CBAM declarant versus the obligation to surrender CBAM certificates;
Procedures regarding timelines and communication templates during the revocation procedure;
Data requirements and sources for the establishment of CBAM declarations by the NCA;
Development of tools for the automatic establishment of CBAM declarations by NCA and the calculation of the number of outstanding CBAM certificates.
Examples from EU-wide implementation: Some NCAs treat the revocation procedure as similar to other customs procedures and are thus able to model and execute it according to existing procedures.
The submission of an annual CBAM declaration by 30 September of the year after the year of import is a critical compliance milestone of authorised CBAM declarants but not the endpoint. NCAs could issue automated, targeted reminders ahead of the deadline to reduce late or missing declarations. To ensure the effectiveness of CBAM in preventing carbon leakage and upholding the integrity of the EU’s carbon pricing policy, the European Commission and NCAs have significant review and verification responsibilities.
Clear guidance can reduce reporting and compliance errors, while effective review can identify remaining inaccuracies and errors, deter non-compliance, and help ensure that CBAM declarants surrender a correct number of CBAM certificates, making the review mechanisms crucial for NCAs’ enforcement duties. The primary legal basis for these reviews is Articles 15 and 19 of the CBAM Regulation 2023/956, which establish a dual oversight system. The European Commission undertakes EU-level coordination and risk analysis, while NCAs hold responsibility for detailed reviews and definitive actions concerning CBAM declarants in their Member State. The CBAM Registry is the central tool facilitating these processes.
3.3.1. Oversight by the European Commission
The European Commission oversees all relevant CBAM data, including information held in the CBAM Registry, data communicated by Customs Authorities, and findings from relevant customs controls and checks. The European Commission may constantly review this information and conduct reviews within the period ending in the fourth year after the year in which the CBAM declarations should have been submitted (e.g., the end of 2031 for CBAM declarations to be submitted in 2027).
If, through its risk-based controls on CBAM Registry data and transactions, the European Commission identifies irregularities relating to, for instance, data submitted to the CBAM Registry via CBAM declarations or the purchase, holding, surrender, repurchase, or cancellation of CBAM certificates, it informs the relevant NCA. This notification enables the NCA to initiate further investigations and correct any irregularities. Communication is to be made via the CBAM Registry, and this mechanism acts as an early warning system for NCAs. To support consistent decisions and possible appeals, NCAs could establish documented investigation procedures, including standardised case files, evidentiary requirements and decision templates while recording the information assessed and the grounds for each decision.
To support NCA reviews, the European Commission periodically identifies specific risk factors and points for attention. These are based on a comprehensive risk analysis conducted at the Union level. This proactive, intelligence-led guidance is designed to help NCAs target their own review efforts more effectively and efficiently by focusing on CBAM declarations or declarants that present a higher risk profile. Furthermore, the European Commission shall also facilitate the exchange of information with NCAs regarding fraudulent activities and penalties imposed. This shared intelligence enables a coordinated and consistent response to non-compliance across Member States and prevents CBAM declarants from exploiting potential enforcement gaps.
A critical support function for NCAs when dealing with non-compliant authorised CBAM declarants is the preliminary calculations for missing or incorrect CBAM certificate surrendering. Where an authorised CBAM declarant fails to submit a CBAM declaration, or where the European Commission, based on its review, considers that the declared number of CBAM certificates is incorrect, the European Commission conducts a preliminary calculation of the total number of CBAM certificates that should have been surrendered. This calculation must be made by 31 December of the year after the year in which the CBAM declaration should have been submitted (in case of a missing declaration), or by 31 December of the fourth year after the year in which an incorrect CBAM declaration was submitted, as applicable.
The European Commission provides this preliminary calculation to the relevant NCA for indicative purposes. The NCA is not bound by this preliminary calculation and may use it as an input for its own definitive calculation of due CBAM certificates. Although the European Commission provides analytical support, the NCA retains the final decision-making power regarding the declarant's obligations.
3.3.2. Review processes and tasks of NCAs
While the European Commission supports the review of CBAM declarations through general oversight and may inform NCAs of any irregularities, the NCAs have primary and independent authority to review CBAM declarations submitted by authorised CBAM declarants established in their respective Member State. Figure 3.4 details the review processes.
Note: EC stands for the European Commission.
Source: Authors, based on the CBAM Regulation 2023/956 and Implementing Regulation 2025/486.
The NCA can also review CBAM declarations up to four years after the year in which they should have been submitted. The NCA's decision to initiate such a review can be informed by various factors:
Information received from the European Commission;
The NCA’s own risk assessment methodologies and national priorities: NCAs may develop and apply their own risk profiles based on national data sources, specific sectoral concerns within their Member State, intelligence from national customs or other domestic agencies, the declarant's past compliance history (CBAM or related obligations), or outcomes from random or targeted national control campaigns;
Credible information from other substantiated sources such as verified information from third parties or data exchanged with other NCAs.
Once the NCA decides to initiate a review, it shall communicate both the initiation and the subsequent results of its review to the Commission via the CBAM Registry. This ensures EU-wide transparency and coordination of enforcement activities.
3.3.3. Review outcomes and corrective actions
The scope of the review can range from a comprehensive examination of all aspects of a specific CBAM declaration to a targeted audit of particular elements. These elements include the declared quantity of goods, the calculation of embedded emissions, the validity of verification reports or claims for reduction due to the effective carbon price paid abroad. The NCA may use all available tools and information sources including data from the European Commission or Customs Authorities, information requested directly from the CBAM declarant, or from conducted audits (Recommendation 6). The potential outcomes and consequences of the review are summarised in Table 3.3.
Source: Authors, based on the CBAM Regulation 2023/956 and the Implementing Regulation 2025/486.
If the NCA's review concludes that an authorised CBAM declarant has either failed to submit a CBAM declaration by the deadline or has submitted an incorrect declaration leading to an insufficient number of surrendered CBAM certificates, corrective actions are required. The NCA shall determine the number of CBAM certificates that the declarant should have surrendered (for a missing declaration) or the additional number of certificates due (for an incorrect declaration). This definitive calculation can take into account the preliminary calculation provided by the European Commission and must be based on information and corrected data resulting from the NCA's review. Key elements to consider and apply in the calculation include:
Accurately established quantities of imported goods and their verified embedded emissions;
The correct validation and application of any deduction claimed by the declarant for a carbon price effectively paid in a country of origin, ensuring conditions under Article 9 of the CBAM Regulation 2023/956 are met, and evidence for any rebates or other forms of compensation that would reduce the effective carbon price paid;
The correct application of the prevailing adjustment factor reflecting the extent to which EU ETS allowances are allocated for free for the production of those goods within the Union, as per Article 31 of the CBAM Regulation 2023/956;
If, even after the review, actual verified emissions are not available for some or all goods, the NCA will use the applicable default values established by the European Commission for those portions in its calculation.
The NCA's conclusion regarding the non-compliance shall be notified to the CBAM declarant via the CBAM Registry. The failure of the CBAM declarant to surrender the required number of CBAM certificates on 30 September along with the submission of the CBAM declaration (or the lack thereof), might also lead to penalties (Section 3.5).
Indicative timeline: Medium and long terms
Description: Reviewing CBAM declarations is a core task of the NCA to spot errors or non-compliance and is the first step to rectifying an incorrect amount of surrendered CBAM certificates. Developing guidelines and capacity for reviewing CBAM declarations will be crucial, including:
Determining priority sectors and CBAM declarants for which review is warranted e.g., due to amount of imported CBAM goods, legal infringements, industrial relevance and capacity;
Building-up the capacity of relevant staff on CBAM emission accounting;
Understanding verification and review processes through exchange with the national NCA responsible for the implementation of the EU ETS;
Developing review plans, risk profiles, and data requirements and sources;
Preparation of automated analysis of data received from the European Commission, the CBAM Registry, Custom Authority and potential other sources;
Establishing a calculation tool for the determination of the correct number of CBAM certificates e.g., via verified emission data or default values as per Annex IV of the CBAM Regulation 2023/956;
Preparation of notification templates to communicate all relevant information pertaining to Article 19(5) of the CBAM Regulation 2023/956 to authorised CBAM declarants.
CBAM certificates, each representing one tonne of embedded CO2e emissions, are the central compliance currency of CBAM. In the definitive period, authorised CBAM declarants must surrender CBAM certificates in the amount of embedded emissions of their imported goods. For NCAs, understanding the functioning of CBAM certificates is crucial for overseeing CBAM declarant’s compliance and ensuring the smooth functioning of the system within their respective Member State. Chapter IV of the CBAM Regulation 2023/956 contains the rules pertaining to CBAM certificates. Developing a tool that can track CBAM certificate requirements of CBAM declarants may support a swifter and more effective implementation of CBAM (Recommendation 7).
3.4.1. Mechanisms, rules and processes
A common central platform (CCP), managed by the European Commission in conjunction with Member States will serve as the exclusive platform for the transactions of CBAM certificates. The CCP will be established during 2026 following a joint procurement procedure. Through this CCP, Member States will sell CBAM certificates to authorised CBAM declarants established in their respective territories, and repurchase surplus CBAM certificates under certain conditions. To ensure seamless operation and data integrity, the CCP must be fully interconnected with the CBAM Registry, with information on these transactions transferred daily. A forthcoming delegated act will further specify the CCP's administration and operational rulebook, including aspects relevant to oversight and processes. The specifications will aim to align with the EU ETS Auctioning Delegated Regulation 2023/2830 (European Commission, 2023[124]) which covers elements like timing, format, access, and administration of the EU ETS auction platform and sets out procedural details for auction calendars, auctioneer and platform appointments.
Authorised CBAM declarants will be able to acquire CBAM certificates via the CCP from 1 February 2027 at a price calculated every week by the European Commission and valid for the next week, based on the average of the closing prices of EU ETS allowances (EUAs) on the auction platform. In weeks where no auctions of EUAs are scheduled, the price of CBAM certificates is based on the average closing prices from the last week during which auctions of EUAs occurred. This price is published and applies for the subsequent week. By derogation from the above rule, the price of CBAM certificates for 2026 imports purchased in 2027 is calculated based on the quarterly average EUAs closing prices of the specific quarter of importation in 2026. Implementing Regulation 2025/2548 details practical arrangements for the CBAM certificate price calculation and its publication (European Commission, 2025[2]).
Upon creation and sale, each CBAM certificate is assigned a unique identification number by the European Commission and registered in the CBAM Registry account of the respective authorised CBAM declarant. Only authorised CBAM declarants shall be able to make purchases. The core compliance obligation for an authorised CBAM declarant is the annual surrender of CBAM certificates. By 30 September and for the first time in 2027, CBAM declarants must surrender via the CBAM Registry a number of CBAM certificates equivalent to the total embedded emissions declared in their annual CBAM declaration covering imports of CBAM goods during the preceding calendar year. The European Commission then removes the surrendered CBAM certificates from the CBAM Registry. Should an NCA review determine that a higher number of CBAM certificates is due, the declarant must surrender the outstanding amount within one month of the NCA's formal notification.
To ensure ongoing financial coverage for imported embedded emissions throughout the year and to prevent a significant accumulation of liability at the annual surrender date only, CBAM declarants must observe a quarterly holding requirement. At the end of each quarter, the number of CBAM certificates held in the CBAM Registry account must correspond to at least 50% of the embedded emissions determined by (i) reference to the default values set out in Annex IV of the CBAM Regulation 2023/956 for all goods that a CBAM declarant has imported since the beginning of the calendar year (without the mark-up on default values) or (ii) based on the number of CBAM certificated surrendered for the calendar year preceding the calendar year of the surrender for same goods by CN code and countries as of that CBAM declaration submitted in the calendar year preceding the current year. If the European Commission finds that this holding obligation is not met, it informs the relevant NCA via the CBAM Registry. The NCA then notifies the CBAM declarant, who must ensure that there is a sufficient number of CBAM certificates on their account within one month of receiving the notification. The notification and the CBAM declarant's response are both registered by the NCA in the CBAM Registry. For CBAM goods imported during 2026, the quarterly holding requirement is waived and only applied for imports starting 2027.
The system also includes limited repurchase of excess CBAM certificates. A CBAM declarant who holds more CBAM certificates on their account than required for annual surrender The number of CBAM certificates subject to repurchase would be limited to the total number of CBAM certificates the declarant was required to hold on its account by the end of each quarter of the year of purchase to meet the 50% quarterly holding obligation. The repurchase is handled by the Commission via the CCP on behalf of the relevant Member State. The deadline for a repurchase request would be 31 October of each year during which CBAM certificates were surrendered, and CBAM certificates purchased in 2027 due to imports during 2026 would be subject to repurchase only in 2027 but without quantity limit.
CBAM certificates have a limited validity. On 1 November of each year, the European Commission shall cancel, without compensation, any CBAM certificates that were purchased during the year before the previous calendar year and remained on declarants’ accounts in the CBAM Registry. This effectively gives CBAM certificates a validity period covering surrender for the year of purchase and the following year, i.e. until 1 November two years after issuance. If the number of CBAM certificates to be surrendered is disputed, the European Commission will suspend the cancellation of these certificates to the extent of the disputed amount, upon notification by the relevant NCA.
For the NCA, monitoring compliance with the quarterly obligation, upon notification from the European Commission, and managing the ensuing communication and potential revocation procedures with CBAM declarants is an important ongoing task during the definitive period (exception for 2026). The NCA should also be prepared to guide CBAM declarants on the processes, conditions and timelines of CBAM certificate purchase and repurchase and must inform the European Commission about national disputes to prevent premature cancellation of contested CBAM certificates. Table 3.4 provides an overview on processes and timelines regarding CBAM certificate management.
Source: Authors, based on the CBAM Regulation 2023/956 and amending Regulation 2025/2083.
Indicative timeline: Medium term
Description: Keeping track of CBAM certificate obligations of CBAM declarants is vital to the integrity and functioning of the CBAM. The implementation of an automated and digital tool to surveil relevant data in real-time for all CBAM declarants enables the NCA to:
Codify and make available to all staff complex CBAM certificates management rules and timelines;
Conduct backward- and forward-looking analyses e.g., CBAM revenues, outstanding CBAM certificate purchase, repurchase;
Oversee CBAM declarants’ obligations at all times;
Define trigger dates and points for NCA-related actions.
Along with a CBAM certificates management surveillance tool, the early preparation on how to manage sales and repurchase of CBAM certificates operationally (e.g., bank accounts linked to CCP) will ease the transition into the definitive period.
Coordination and exchange with the NCA responsible for the implementation of EU ETS can yield valuable insights for the implementation of CBAM.
The enforcement of CBAM provisions is crucial for the mechanism's environmental integrity. The enforcement is underpinned by a system of penalties designed to be effective, proportionate, and dissuasive with the NCA imposing and securing penalties as detailed in Article 26 of the CBAM Regulation 2023/956, following the changes introduced by the amending Regulation 2025/2083.
3.5.1. General processes on penalties
While specific procedures are rooted in national administrative law, they must respect EU principles, including the right to appeal. General steps for imposing penalties under CBAM are outlined in Figure 3.5.
Only the NCA of the Member State where the CBAM declarant is established or where a person imported CBAM goods without complying to the CBAM Regulation 2023/956 has the authority to impose penalties (Recommendation 8). The formal notification of the decision to impose a penalty to the non-compliant party (authorised CBAM declarant or any other person introducing CBAM goods within the customs territory of the Union without being authorised to do so) must detail:
The conclusion of the NCA on the fact that the authorised CBAM declarant or any other person failed to comply with the obligations under the CBAM;
The specific reasons for this conclusion;
The amount of the penalty imposed on the authorised CBAM declarant or any other person;
The date from which the penalty is due;
The action that the authorised CBAM declarant or any other person is to take to pay the penalty;
The right of the authorised CBAM declarant or any other person to appeal.
Note: EC stands for the European Commission.
Source: Authors, based on the CBAM Regulation 2023/956.
All penalty decisions and records of final payment must be communicated to the European Commission and registered in the CBAM Registry.
3.5.2. Penalty system under CBAM
There are distinct approaches for applying penalties for non-compliance of authorised CBAM declarants and other persons introducing CBAM goods illicitly. Non-compliance can result from not having obtained the CBAM declarant status or in any other way breaching the obligations set out in the CBAM Regulation 2023/956 (Table 3.5).
The penalty for an authorised CBAM declarant not surrendering CBAM certificates is directly connected to the EU ETS penalty. The NCA must apply the identical rate that is applied for excess emissions under EU ETS as set out in Article 16 of the EU ETS Directive 2003/87/EC. These provisions determine a financial penalty for each tonne of CO2e for which an operator has not surrendered an EUA. The penalty was initially set at EUR 100 for the year 2013 and is to be increased in line with the European harmonised index of consumer prices published by Eurostat (2025[125]), for the respective reporting year (for instance, EUR 132.06 in 2024).4
For each CBAM certificate that was not surrendered, the penalty corresponds to the inflation-adjusted rate for the specific year the goods were imported. NCAs may consider specific circumstances, such as intentional or negligent behavior, when determining final penalty amounts imposed on authorised CBAM declarants, potentially allowing for adjustments of the amount of the penalty in cases of minor or unintentional errors.
The payment of this penalty does not release the CBAM declarant from the underlying obligation to surrender the outstanding number of CBAM certificates as determined in the review process by the NCA.
For each CBAM certificate that was not surrendered, the penalty corresponds to the inflation-adjusted rate for the specific year the goods were imported. NCAs may consider specific circumstances, such as intentional or negligent behavior, when determining final penalty amounts imposed on authorised CBAM declarants, potentially allowing for adjustments of the amount of the penalty in cases of minor or unintentional errors.
The payment of this penalty does not release the CBAM declarant from the underlying obligation to surrender the outstanding number of CBAM certificates as determined in the review process by the NCA.
Source: Authors, based on the CBAM Regulation 2023/956 and Implementing Regulation 2024/3210
A more punitive penalty regime applies if a person other than an authorised CBAM declarant introduces CBAM goods into the customs territory of the Union, in contravention of the requirement that only authorised CBAM declarants may undertake such importation. This is, for instance, the case when entities bring CBAM goods above the de minimis threshold into the customs territory of the Union without being authorised to do so or when entities use artificial arrangements to circumvent the threshold, such as artificially splitting imports, reclassifying products or using other arrangements without valid business or commercial justification. For such unauthorised importation, the penalty shall be effective, proportionate, and dissuasive. The amount is calculated as three to five times the EU ETS excess emissions penalty rate of EUR 100, adjusted for inflation, applicable in the year the CBAM goods were introduced, for each CBAM certificate that the person other than an authorised CBAM declarant failed to surrender.
NCAs are granted discretion to set the precise multiplier within the range between three and five, based on factors such as duration, gravity, scope, intent, and repetition of the non-compliance, and the person's cooperation. The NCAs will need to first determine the embedded emissions of the illegally imported goods, and as determination via verified emission data is not applicable, the NCA establishes the number of CBAM certificated not surrendered by reference to default values. Serious or repeated infringements of the obligation to acquire CBAM certificates may also lead to the revocation of the status of authorised CBAM declarant (Section 3.2).
The payment of the penalty releases the person from the obligation to submit a CBAM declaration or surrender CBAM certificates according to the amending Regulation 2025/2083.
Indicative timeline: Short and medium terms
Description: Exchange with the NCA responsible for the implementation of EU ETS on procedures regarding penalties and use this information to inform the development of own penalty rulebook, including:
Detailed processes for detecting non-compliance e.g., in cooperation with the European Commission and according to guidelines for the review of CBAM declarations;
Establish an automated calculation of the number of CBAM certificates not surrendered (based on verified embedded emissions or default values set out in Annex IV of the CBAM Regulation 2023/956) and the amount of penalty;
Specify reasons and thresholds for:
Deviating from the generic penalty in case of specific circumstances (amending Regulation 2025/2083)
The application of a multiplier for persons other than authorised CBAM declarants;
Provide for a notification template including all information set out in Article 26(4) of the CBAM Regulation 2023/956.
Understanding the potential impacts of appeals and how to secure payment of penalty by all means available under national law will assist in enforcement.
Examples from EU-wide implementation: Approaches to penalties are currently at a development stage, as penalties are required from 2026 onwards only. However, some NCAs’ approach on penalties is planned to be twofold, comprising of penalties levied by the Customs Authority on importers of CBAM goods not holding the status of CBAM declarant, and penalties levied by the NCA for faulty reporting or missing CBAM certificates.
According to the Implementing Regulation 2024/3210 (European Commission, 2024[126]), the CBAM Registry acts as the primary and central secure communication channel for NCAs with the European Commission as well as with applicants for the status of authorised CBAM declarants, authorised CBAM declarants and persons whose status has been revoked. Many tasks performed by NCAs under CBAM require interaction through the CBAM Registry (Recommendation 9), where information or data is either originating:
From the European Commission regarding information and risk assessments regarding the review of CBAM declarations;
From applicants for the status of authorised CBAM declarants during the authorisation process;
From authorised CBAM declarants or persons whose status has been revoked for the submission of CBAM declarations and the surrendering of CBAM certificates;
From the NCA regarding:
Notifications to the European Commission, applicants, authorised CBAM declarants and persons whose status has been revoked;
Registration of information and data.
Indicative timeline: Short and medium terms
Description: Knowing and correctly using the functionalities of the CBAM Registry is paramount to ensure data security and fulfil several tasks of the NCA. Relevant steps to achieve this include:
Determination of contact points in coordination with NCA internal capacities;
Development of CBAM Registry instructions based on European Commission’s training and communication material;
Building capacity for the NCA staff based on the instructions;
Implementation of organisational measures for system security in line with internal and European Commission’s measures and processes;
Development of contingency and communication plans in coordination with the European Commission in the event of unavailability of the CBAM Registry or critical security incidents.
Communication outside of the CBAM Registry might be required as well e.g., for notifying and securing penalties or for coordination and data exchange with Customs Authorities or verifiers. Therefore, it is recommended to:
Identify communication channels other than the CBAM Registry;
Develop protocols on their use and templates containing relevant information and data.
Further recommendations pertaining to communication include:
Exchange with other NCAs on CBAM implementation and security processes and guidelines;
Development of communication material for relevant CBAM processes such as authorisation and revocation, including notifications, triggers, timelines, actions, responsibilities and results that can be shared with relevant stakeholders e.g., applicants, authorised CBAM declarants.
NCAs must authorise and grant access to the CBAM Registry for its staff, applicants, authorised CBAM declarants and persons whose status has been revoked via the Uniform User Management and Digital Signature (UUM&DS) system. The European Commission and NCAs must designate contact points for each of the different components of the CBAM Registry and relevant customs systems to allow for interoperability (Table 3.6) and communicate and update details of the contact points to each other.
Note: (1) As referred to in Article 36 of the Implementing Regulation 2015/2447 (European Commission, 2015[3]) and Article 70 of the Implementing Regulation 2025/512 (European Commission, 2025[4]).
Source: Authors, based on the CBAM Regulation 2023/956 and the Implementing Regulation 2024/3210.
The NCA will be either sole or joint controller of personal data in the CBAM Registry and when managing access to it, in the meaning of the General Data Protection Regulation (GDPR) 2016/679 (European Parliament and Council of the European Union, 2016[129]) and Regulation 2018/1725 (European Parliament and Council of the European Union, 2018[130]). Due to the personal and confidential nature of information and data in the CBAM Registry, data security is crucial. The European Commission will propose terms of collaboration, service level agreements and a security plan all subject to the agreement with the NCAs. Specific NCA tasks are:
Forwarding data subject requests not falling under own responsibility latest within three working days from receipt to the responsible controller;
Implementing appropriate organisational measures for the system security;
Notifying the European Commission or other NCAs and providing assistance in case of critical security incidents;
Retain personal data only for the time necessary to achieve the purpose and for a maximum of seven years from the registration in the CBAM Registry or until appeal or court proceedings are terminated regarding data stored in the CBAM Registry
The European Commission will develop, test, deploy and manage the CBAM Registry and ensure it fulfils its core functions of communication, notification, registrations, checks and information exchanges. The European Commission aims to define common technical specifications, test and validate the functions in close cooperation with NCAs.
References
[5] DEHSt (2025), EU Emissions Trading System 1 Sanctioning, https://www.dehst.de/EN/Topics/EU-ETS-1/EU-ETS-1-Information/Sanctioning/sanctioning_node.html.
[2] European Commission (2025), Commission Implementing Regulation (EU) 2025/2548 of 10 December 2025 laying down rules for the application of Regulation (EU) 2023/956 as regards the calculation and publication of the price of CBAM certificates, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:L_202502548.
[1] European Commission (2025), Commission Implementing Regulation (EU) 2025/486 of 17 March 2025 laying down rules for the application of Regulation (EU) 2023/956 as regards the conditions and procedures related to the status of authorised CBAM declarant, https://eur-lex.europa.eu/eli/reg_impl/2025/486/oj/eng.
[4] European Commission (2025), Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information, https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32025R0512.
[3] European Commission (2015), Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council laying down the Union Customs Code, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015R2447-20250201.
← 1. The EORI is a unique EU-wide identifier assigned to businesses and individuals involved in customs activities, as required under the CBAM Regulation. It enables consistent identification across Member States for customs and trade purposes. Operators must apply to obtain the EORI number from the Customs Authority of the country where they are established prior to engaging in any customs-related activity.
← 2. The EORI is a unique EU-wide identifier assigned to businesses and individuals involved in customs activities, as required under the CBAM Regulation. It enables consistent identification across Member States for customs and trade purposes. Operators must apply to obtain the EORI number from the Customs Authority of the country where they are established prior to engaging in any customs-related activity.
← 3. The EORI is a unique EU-wide identifier assigned to businesses and individuals involved in customs activities, as required under the CBAM Regulation. It enables consistent identification across Member States for customs and trade purposes. Operators must apply to obtain the EORI number from the Customs Authority of the country where they are established prior to engaging in any customs-related activity.
← 4. For more reporting years, see for instance the values of the EU ETS penalties published by the German Emissions Trading Authority (DEHSt, 2025[5]).