What counts as a declared supplier under UFLPA and forced labor import bans

A compliance manager gets asked this question more than any other: if CBP detains a shipment under the Uyghur Forced Labor Prevention Act, does a tier-1 supplier's name on file protect you? Usually not. CBP's question runs past the tier-1 contract to whoever actually touched the raw material further back, and whether that entity is on a list somewhere.

"Declared" has a narrow, specific meaning

Under UFLPA, "declared" means something narrower than "known to your company." It means named, in writing, inside documentation that ties a specific site to a specific shipment. A supplier your tier-1 mentioned on a sourcing call isn't declared. A mill whose name turns up in a factory list your team compiled three years ago isn't declared either, unless you can connect that mill's output to this shipment's bill of materials.

CBP's own guidance asks importers for a traceability package: purchase orders, invoices, packing lists, proof of payment, transportation records running from raw material to finished good. If a tier-2 smelter or tier-3 tannery doesn't show up in that paper trail with a name and an address attached, it isn't declared, no matter how many people in your supply chain know it exists.

The entity list, the WRO list, and what neither one tells you

The UFLPA Entity List, maintained by DHS under the Forced Labor Enforcement Task Force, names specific companies CBP has determined use forced labor or source from the Xinjiang region. A Withhold Release Order names a company or product category separately, through CBP's older authority. These are two different lists, built through two different processes, and a site can be absent from both without being clean.

A name's absence from either list mainly reflects where CBP's enforcement attention has landed so far. It says nothing about whether that site belongs in your own declared supplier file.

This is the gap that catches most compliance teams. A tier-1 supplier hands over a disclosure that satisfies the paperwork requirement: a signed attestation, a code-of-conduct acknowledgment, maybe a list of their own direct vendors. None of that confirms whether the smelter feeding that vendor's furnace is a declared entity, an undeclared one, or a site nobody in the chain has ever named out loud. A tier-1 disclosure only goes as deep as what the tier-1 was willing, or able, to find out about its own suppliers.

Why the undisclosed tier-2/3 site is the real exposure

CBP's standard kicks in the moment a shipment gets detained: produce documentation proving the material never passed through a banned source, at whichever tier that source sits. If your declared supplier list stops at tier-1, and the smelter or refinery involved sits two tiers back with no paperwork trail leading to it, you can't produce that proof. The detention holds. The burden of proof under UFLPA sits with the importer, and a blank space in the supplier file counts against you.

A producing region can run dozens of smelters, mills, or tanneries that never appear in any tier-1 disclosure, simply because no direct contract names them and nobody downstream has reason to ask. Finding those sites before CBP does, rather than waiting on what a tier-1 chooses to disclose, is what separates a file that holds up from one that triggers a detention letter. Supply Chain Mapping builds an annual candidate-site list from high-resolution satellite imagery of a producing region, aimed specifically at the tier-2 and tier-3 sites that no paperwork names.

A short answer for the memo

A site counts as declared when it's named, with an address, inside documentation that traces a specific shipment back to that site. Showing up on a factory list, a sourcing map, or a supplier's internal records doesn't make it declared unless that record is part of the traceability package CBP can review. Everything short of that is a site you know about, not one you've declared.

If your declared list only goes as deep as your tier-1 is willing to name, it's worth seeing what's operating behind them.