The UK AEO Application Checklist: What HMRC Actually Wants to See

Most AEO applications that stall don't stall because the business is uncompliant; they stall because the evidence pack doesn't answer the question HMRC actually asked. Here's what to check before you submit.

The five stages, briefly

HMRC's AEO team manages applications through the Customs Authorisation and Decision (CAD) portal, in five stages: pre-application self-assessment, evidence pack preparation, formal submission, audit and assessment, and certificate issue. Average time from submission to certificate runs 90–180 days; up to 12 months for complex, multi-site applications. Almost all of the delay that's within your control sits in the first two stages.

The pre-application checklist

Work through each of these before you submit, not after HMRC asks:

• Compliance record. Any customs or tax infringements in the last three years, including at any related entity, not just the applicant. HMRC checks associated companies and directors' other businesses, so a clean record for the applicant alone isn't enough.
• Systems. Can you produce a full audit trail from purchase order through to customs declaration? Review your ERP/customs management system configuration before applying, not during the audit.
• Solvency. Three years of accounts available, and solvent. A new company (under three years old) can substitute a business plan, director guarantee, or parent-company guarantee.
• Competence. A qualified or experienced customs professional in-house; an external consultant alone is a frequent reason for delay. HMRC wants competence embedded in the organisation.
• Security (AEO(S) only). Have you run a formal supply chain security risk assessment? ISO 28001 or the NCSC Principles for Supply Chains both give you a usable framework if you haven't.
• IT security. Are customs-relevant IT systems access-controlled and backed up? ISO 27001 alignment is advantageous but not mandatory.
• Procedures manual. A documented customs procedures manual is a prerequisite for applying, not something to produce after the fact.

Two mistakes that come up constantly

Treating the applicant as an island. HMRC's compliance check extends to directors' and beneficial owners' other companies. A pre-application review across every related entity, not just the one applying, catches problems before a caseworker does.

Outsourcing competence entirely. The single most common reason for delay on the competence criterion is that the nominated "competent person" is an external consultant rather than an employee. HMRC wants that knowledge inside the business, so if you're relying on a consultant today, the fix is training an employee before you apply; not after HMRC flags it.

What proportionality actually means

HMRC doesn't expect a large balance sheet or a big compliance department. A small business with modest but consistent profitability, no debt issues, and no infringement history typically satisfies the financial and compliance criteria without either. The real question behind every criterion is simple: could this business absorb a post-clearance customs debt demand, and does it actually run the controls it says it does? Evidence that answers that directly will always outperform a longer, vaguer submission.