The CF-28 Landed. Now What? A Response Playbook for CBP Requests for Information

A CBP Form 28, or Request for Information, means Customs has reviewed one or more of your entries and wants additional information to verify a classification, value, origin, or other compliance issue before liquidation. You usually have 30 days to respond.

How you respond matters. A complete, well-supported submission can resolve the issue at the information-request stage; an incomplete or missed response can push the matter toward a CF-29 Notice of Action, additional duties, or further enforcement.

A CF-28 is rarely a fishing expedition. Gaia analyzed nearly 30,000 US import entries and almost 270,000 line items and found that roughly one third contained discrepancies, with more than $64 million in combined overpayment and underpayment exposure.

What a CF-28 Is Really Testing

Under 19 U.S.C. 1500, CBP fixes final classification, appraises value, and sets the duty owed on every entry. When the entry summary and its supporting documents do not give CBP enough to make that call, it issues a written request for more information on CBP Form 28 or its electronic equivalent in the ACE CBP Forms application. The regulation at 19 CFR 151.11 authorizes the request even after merchandise has been released, and lets CBP demand redelivery of the goods under the import bond if the request is not promptly met.

A CF-28 almost always maps to one of four questions:

• Classification: Whether the HTS code on the entry matches what the merchandise actually is.

• Valuation: Whether the declared customs value is complete, including assists, royalties, and related-party pricing.

• Origin and preference: Whether a claimed country of origin or trade-agreement preference holds up against the production record.

• Other compliance: Antidumping and countervailing duty scope, partner-government-agency requirements such as FDA or EPA, and marking.

CBP tends to send a CF-28 when invoice descriptions and HTS codes do not line up, when declared values look unusually low or sit inside a related-party relationship, when the line touches a high-risk code such as an AD/CVD case, or when preference claims look inconsistent with the origin rules. Random and risk-based audit sampling accounts for the rest. All of it flows from the reasonable-care standard in CBP's Reasonable Care publication: the importer, not the broker, is legally responsible for accurate classification, value, and origin, and for the records that support each call.

The critical distinction is between the CF-28 and its successor, the CF-29. A CF-28 gathers information; it does not raise your duties or open a penalty case. If your response shows the entry was correct, CBP can let liquidation proceed as filed. If CBP concludes it was wrong, it issues a CF-29 Notice of Action proposing a rate advance, a value increase, or another change, giving the importer 20 days to respond. CF-28 sits early on the enforcement ladder, ahead of Notices of Action, focused assessments, and pre-penalty notices under 19 U.S.C. 1592. It is the last comfortable opportunity to fix errors while the options are still open.

The 30-Day Clock, and How to Extend It

CF-28 forms direct the importer to respond within a set number of days from the date of the request, and CBP training materials, ACE guidance, and trade practice consistently describe that window as 30 days. Worth flagging: no single response period is codified in 19 CFR 151.11, which speaks instead of "prompt compliance." Treat the 30 days as firm practice printed on your specific form rather than a bright-line statutory rule, and read the actual due date off the form you received.

If compiling the response will clearly run past the deadline, request more time before the date passes. CBP's ACE Forms guidance and long-standing practice let importers ask the officer named on the form for an extension, usually in writing, with a short explanation and a proposed new due date. Reasonable requests are often granted, especially where the delay is legitimate, such as pulling detailed production-cost data from a foreign supplier or assembling complex origin documentation. No regulation guarantees an extension, so frame the request as a credible need, not an entitlement, and make it early.

Missing the deadline without asking is the expensive path. If you do not respond, CBP can issue a CF-29 proposing duty increases, demand redelivery of merchandise under the bond where the CF-28 concerned samples, and treat the silence as evidence of inadequate reasonable care in any later penalty assessment. A CF-29 then carries its own 20-day window, and letting that lapse means the proposed action takes effect and the higher duties are assessed automatically. The CF-28 deadline is the first decision point that keeps the matter at the information-request stage instead of pushing it into formal notice.

Building the Response: A Five-Step Sequence

A strong CF-28 response does two things at once: it answers every question CBP asked, and it shows the reasoning and controls behind the declared data. Work through these five steps in order.

1. Confirm the entries and issues in scope. 

Read the CF-28 boxes for entry numbers, dates, HTS codes, and the specific concern flagged, then cross-check against your entry records, broker data, and ERP or compliance system. Determine whether the request is limited to one entry or references a pattern, such as "similar entries" or a date range, that signals broader exposure. The output is a clean list of covered entries and lines, each with its HTS code, declared value, and origin or preference claim.

2. Gather the substantiating records. 

Assemble everything that supports the data declared at entry, organized by the topic CBP raised. Classification questions call for product specifications, technical drawings, catalogs, and any binding rulings relied on. Valuation questions call for commercial invoices, purchase orders, contracts, proof of payment, and documentation for assists, royalties, and commissions, plus transfer-pricing support for related-party transactions. Origin and preference questions call for certificates of origin, bills of materials, production records, and supplier declarations. Map each document to the question it answers, and note any gaps.

3. Reconcile the declared data to the records. 

Compare the product descriptions on invoices and specs against the HTS headings used on the entry, confirm that declared values match invoice prices with correct treatment of assists and related-party pricing under 19 U.S.C. 1401a, and verify that origin declarations match the production record. Build a reconciliation matrix that marks each line as fully supported, debatable, or clearly erroneous. That reconciliation is where problems surface, and it feeds the prior-disclosure decision below, so document every discrepancy.

4. Draft the narrative response. 

Write a response that restates each CBP question, describes the merchandise in clear technical terms, and walks through the classification, valuation, and origin reasoning with citations to the relevant HTS headings, General Rules of Interpretation, and any rulings on substantially similar goods. Attach a document index keyed to each exhibit and the question it answers. Keep the tone professional and neutral, and resist over-disclosing unrelated material that could open new lines of inquiry.

5. Submit and confirm receipt. 

File the response through the ACE CBP Forms application or the channel the form specifies, in a format CBP can review easily, such as clearly labeled PDFs. Confirm receipt through the ACE status update or an email acknowledgment, and keep an internal copy and response log for any future audit or CF-29 action.

The evidence has a standard to meet. CBP expects documents detailed enough to verify the declared data: physical characteristics, materials, and principal use for classification; price, terms, and payment proof for value; component origins and manufacturing processes for origin. Reconciled records that let a reviewer follow your logic are the point. That kind of ongoing reconciliation, run across a full duty history rather than one entry at a time, is exactly what a tariff audit workflow is built to surface before CBP ever asks.

When a Discrepancy Becomes a Prior-Disclosure Decision

Reconciliation sometimes turns up a real error: a misclassified line, an omitted assist, an origin assumption that does not hold. At that point the CF-28 stops being a documentation exercise and becomes a strategic decision, because how you handle the error drives your penalty exposure under 19 U.S.C. 1592.

The mechanism that matters is prior disclosure. Under 19 CFR 162.74, a person who discloses the circumstances of a violation to CBP before, or without knowledge of, the commencement of a formal investigation, and who tenders the actual loss of duties, is entitled to sharply reduced penalties. For a negligent violation, the penalty is limited to interest on the lost revenue; for a fraudulent one, it is capped at one times the loss. A valid disclosure must identify the class of merchandise and the affected entries, specify the false statements or omissions and how they occurred, and set out the correct information, with any missing data supplied within 30 days.

Timing is everything, and this is where the CF-28 creates ambiguity. A formal investigation is treated as commenced when CBP records in writing the date it discovered facts suggesting a possible violation. CBP internal guidance says a CF-28 should not, by itself, serve as notice that a formal 1592 investigation has begun; that role is reserved for correspondence or the CF-29. Even so, specific acts, such as a Special Agent inquiry, a request for records tied to the violation, or a pre-penalty notice, can close the disclosure window. When a CF-28 response reveals an error, the first question is whether CBP has already taken any step that meets the regulatory definition of a commenced investigation.

That analysis shapes which of four paths fits:

1. Correct inside the CF-28 response: Explain the error, provide corrected data, and offer to tender additional duties for the cited entries. This addresses CBP's immediate concern but does not, on its own, qualify as a prior disclosure unless it meets every element of 19 CFR 162.74.

2. File a formal prior disclosure: Prepare a disclosure that satisfies the regulatory elements, file it with the appropriate Fines, Penalties, and Forfeitures office marked "Prior Disclosure," and coordinate it with the CF-28 response.

3. Assess the full exposure first: Use 19 CFR 162.74(j) self-review to sample similar entries and decide whether the error is isolated or systemic before committing to a disclosure scope.

4. Bring in CBP or counsel: Ask CBP whether any investigative action has started, and consult customs counsel on structuring the disclosure.

The trap to avoid is a premature concession. Admitting misclassification on the cited entries before you have measured how far the same error runs can pre-empt a cleaner prior disclosure that would have covered every affected entry on better terms.

The Mistakes That Turn a CF-28 Into a CF-29

Most CF-28 files that escalate do so for one of a handful of avoidable reasons.

Answering too narrowly

Providing the minimum documents that technically respond, without explaining the reasoning behind the declared data, reads to CBP as an unresolved concern and prompts a follow-up or a CF-29. Interpret each question in light of CBP's reasonable-care expectations and show the controls behind the entry, not just the raw paper.

Sending unreconciled or contradictory records

Invoices that differ from entry values, or specs that contradict the declared classification, invite CBP to infer inadequate reasonable care and widen the review. Reconcile internally first, and explain any correction in the narrative rather than leaving CBP to find the conflict. Classification is where most of these contradictions start, and the downstream cost of a wrong HTS code, from rate advances to misclassification penalties, is exactly what a disciplined response is meant to head off.

Missing the deadline or skipping the extension

Letting the CF-28 window lapse, or failing to ask for more time when the compilation will clearly overrun it, leads straight to CF-29 issuance and undercuts any later claim of cooperation. Put CF-28 due dates on the compliance calendar and request extensions early.

Treating the CF-28 as broker-only business

The importer is legally responsible for entry accuracy, and CBP's reasonable-care standard expects the importer to seek expert advice on complex calls. Route the response through the broker, internal compliance, finance, and, where the exposure warrants, legal counsel, and document how reasonable care was met.

Treating the CF-28 as a Signal, Not a One-Off

A single clean response closes one file. The importers who stop receiving CF-28s read the request as a signal about their whole entry population, not just the entries CBP named. When roughly a third of entries carry a discrepancy, the flagged entry is usually a sample, and the same classification, valuation, or origin error is likely sitting on entries that have not been questioned yet. The move that changes the trajectory is to reconcile the full history proactively, quantify the exposure, and decide on correction or disclosure on your own timeline rather than CBP's. When that review turns up errors worth disclosing, capping the penalty before an audit lands is its own discipline, covered in Gaia's guide to prior disclosure to CBP. Answered that way, a CF-28 becomes the cheapest audit you will ever run.

Gaia's Tariff Audit platform helps importers review historical entries, identify classification, valuation, and origin discrepancies, quantify financial exposure, and prioritize corrective action before CBP raises the question. Book a demo to see how proactive entry reviews can strengthen compliance and reduce audit risk. 

Frequently Asked Questions

Is a CF-28 the same as a penalty notice?

No, a CF-28 is a Request for Information asking you to support the classification, value, or origin declared on an entry. It does not, by itself, raise duties or start a penalty case. A complete response can resolve the matter before it progresses further. 

What happens if I ignore a CF-28?

Missing the response deadline can lead to a CF-29 Notice of Action, proposed duty increases, and, in some cases, redelivery demands or later penalty exposure. A CF-29 also has its own response deadline. 

How long do I have to respond to a CF-28?

Most CF-28s provide a 30-day response period, shown on the form itself. While 19 CFR 151.11 requires "prompt compliance" rather than a fixed deadline, importers should treat the stated due date as firm. 

Can I get more time to respond to a CF-28?

Often, yes. Importers can request an extension from the CBP officer listed on the form before the deadline, explaining why additional time is needed. Extensions are common but not guaranteed. 

Does responding to a CF-28 waive my right to prior disclosure?

No, a CF-28 alone generally does not close the prior-disclosure window. However, certain investigative actions can, so confirm your position before acknowledging any error.