What did CBP(Customs and Border Protection) actually publish on 2 September?
An advance notice of proposed rulemaking, which is the earliest formal stage of American rulemaking. It is not a rule and not even a proposed rule. It is an agency saying it is considering amending its regulations, listing the questions it wants answered first, and opening a comment period. Comments on this one are due on or before 1 December 2026.
What CBP says it is after is detecting goods that move through third countries to evade duties and trade law, alongside revenue collection and national security. The instrument under consideration is visibility: more named parties per entry, tied to identifiers that resolve to the same legal entity across borders.
The document is a list of questions rather than a set of requirements. That distinction runs through everything below, and it is the reason the right time to read it is now rather than when it hardens.
What is an MID, and why is CBP looking past it?
The manufacturer identification code, or MID, is the field on a US entry that identifies who made the goods. It is not a registry number issued to a company. It is a code constructed from the manufacturer or shipper name and address as they appear on the commercial invoice, assembled according to a formula CBP publishes.
That construction is the weakness. A code derived from a name and an address on an invoice is only as good as the invoice, changes when an address changes, and cannot be reliably matched against the same company appearing elsewhere in trade data. It identifies a string, not an entity.
The notice asks about replacing or supplementing that with global business identifiers, naming D-U-N-S, GLN, LEI and Altana ID as candidates, and asks about foreign tax identification numbers as well. These are persistent identifiers that resolve to one legal entity and can be joined across datasets. The shift is from a field that describes a shipment to a key that describes a company.
Which parties would have to be named?
The notice works from party roles rather than contracts. In the identifier definitions it uses, the roles are manufacturer, shipper, seller, exporter, distributor and packager. It also asks whether importers should have to obtain and file the export paperwork their supplier lodged with its own customs authority, including export declarations, commercial invoices, packing lists and certificates of origin. Separate questions ask whether an online marketplace that brokered the sale should be identified, and whether traceability technology should be used to verify where production happened.
Defining parties by role rather than by contract is the structural move. An importer knows the party it buys from because it has an agreement with that party. It does not necessarily know who packed the goods, or who the seller of record was two steps upstream, because it has no agreement with them and no reason to have asked.
None of that is unique to any industry. Every importer of everything faces the same question set. The asymmetry appears only when you ask which supply chains keep those roles in separate companies by design.
Why does this land differently on Korean cosmetics?
Korea's Cosmetics Act registers two separate businesses. A cosmetics manufacturer makes the product. A responsible distributor manages the quality and safety of what it sells and puts it on the market, including product made under contract by someone else. A brand registers as the second and never as the first. That split is the legal foundation of the asset-light Korean beauty company and the reason a brand with a dozen staff can ship into forty countries.
It also means the roles the notice asks about sit in different companies as a matter of course. The manufacturer is a contract manufacturer. The packager is frequently a third firm. The exporter and the seller of record are often a trading company. A vertically integrated Western brand answers most of these questions by naming itself. A Korean indie brand answers them by naming its suppliers.
Volume makes this concrete rather than theoretical. Korea Customs Service figures for the first ten days of September 2026 put cosmetics exports up 46.1% year on year, at an average of 33.9 dollars per kilogram, with shipments to the United States at 28.2 dollars. Those are ten-day preliminary numbers rather than a settled monthly total, and the direction is not in doubt. The structure now under examination is carrying record volume through the border it is being examined at.
Does the FDA not already know who made it?
For cosmetics, partly. Under the Modernization of Cosmetics Regulation Act, manufacturers and processors of cosmetic products register their facilities with the FDA, and the responsible person, defined as the manufacturer, packer or distributor whose name appears on the label, lists each marketed product. A Korean factory making product for an American shelf is therefore already known to one American agency, and the brand on the label is already on record as answerable for it.
The two regimes differ in three ways that matter. They sit at different agencies, so the data does not automatically meet. Facility registration happens once and is maintained; an entry disclosure happens every time goods cross. And registration records who a factory is, while the customs question is which specific parties handled this specific shipment.
So the argument that the information already exists is half right and operationally beside the point. What would be new is not the fact of the relationship. It is the relationship arriving at the border, per shipment, keyed to an identifier that can be joined to every other shipment that identifier appears on.
What does the notice not say?
A great deal, and the gaps are as important as the contents. It does not set requirements. It does not name a final list of data elements. Whether any of this applies to all imported goods is posed as a question rather than stated, and the notice separately asks whether categories flagged as higher national-security risk should be treated differently. Cosmetics appear nowhere in it.
So this is not an American regulator turning towards Korean beauty. It is a general customs instrument whose burden falls unevenly depending on how an industry is organised, and the Korean beauty industry is organised in the way that makes the burden heaviest.
Which also means the outcome is unsettled in a way that is still open to argument. The comment period is the mechanism through which affected parties tell an agency what a proposal costs them, and it runs until 1 December 2026.
What would compliance actually require of a brand?
Three things that most Korean beauty exporters do not currently hold as structured data.
First, a map of parties by role rather than by invoice. Knowing which firm packed a batch and which entity was the seller of record is a different question from knowing who sent the bill, and answering it means going back through contract manufacturers to their own subcontractors.
Second, persistent identifiers for those parties. A D-U-N-S number or an LEI is not something a brand can assert about a supplier; the supplier has to hold one, and someone has to keep it current.
Third, contractual authority to obtain and pass on documents that belong to a supplier, including export paperwork filed with Korean customs. Supply agreements written on the assumption that manufacturing identity stays private will not contain that permission, and the time to add it is at renewal rather than at the border.
Who carries the cost inside the Korean structure?
Not evenly. Large contract manufacturers already operate under international audit regimes and hold the identifiers that global clients require; supplying them is administrative work. Their smaller subcontractors, the second tier that handles filling, packing and secondary processing, are where the data thins.
Brands carry the exposure without controlling the information. A responsible distributor under Korean law does not own the plant and cannot compel disclosure from its supplier's supplier by right, yet it is the importer's counterparty and the name on the label. The party who answers to the American border is the party furthest from the facts.
There is also a commercial cost with no compliance label on it. Manufacturing identity has functioned as a competitive secret; which factory produces a breakout product is information rivals pay attention to. Disclosure regimes convert that secret into a data field. That is a real cost, and it belongs in a comment letter rather than in a complaint made later.
Where does this leave the model?
For contract manufacturers, identifier readiness turns into a sales argument. A supplier that holds current global identifiers, can produce export documentation on request, and can account for its own subcontractors is easier to import from than one that cannot. That is a durable advantage for the large Korean manufacturers and a genuine problem for the tier beneath them.
For brands and buyers, diligence questions change shape. A buyer sourcing from a Korean brand has been asking who formulates and who owns the brand. The question that follows a rule of this kind is who else touches the goods, and can they be named. Supply agreements signed now will be read against whatever emerges from this docket.
For regulators and investors, the asymmetry is the point worth holding. A rule that names no industry can still reshape one, because burden follows structure. An industry that separated brand from factory as a matter of efficiency built an information gap into itself, and information gaps are what customs regimes are designed to close.
The notice asks a question rather than issuing an instruction. The question is who actually made it. Korean beauty has spent two decades making that question hard to answer, and has until 1 December to explain what answering it costs.
