Authorised Economic Operator, security and safety

HMRC will ask how visitors get into your premises, and then come and look

The AEO questionnaire asks you to describe how access is regulated for visitors and how they are told your security procedures. The handbook then says those procedures will always be checked on site. So the first thing the officer does is walk through your reception as a visitor, and the second is ask to see the record of somebody else doing the same.

Book a 15 minute call What the guidance says

From £150 a month plus VAT, iPad and stand included. We are not customs advisers, and every quotation on this page is linked to GOV.UK.

What HMRC’s guidance says

Five places the word “visitors” appears, and what each one wants

Two documents: the AEO chapter of the customs technical handbook, and the guidance notes to section 6 of the self-assessment questionnaire. The quotations are verbatim.

Handbook 11.6 and 11.9

Access is regulated, for visitors by name

“The process of access to business premises (buildings, production areas, warehouses, and so on) should be regulated for staff, visitors, other persons, vehicles and goods.”

The sentence that puts your reception inside an AEO audit. It goes on to say the procedures should document who has access to which areas and how that is controlled, and gives keypads and swipe cards as examples, not as requirements.

C118-6, section 6.1

Visitors are told the procedures, and you can show when

“Customs will look for evidence of how and when you tell both staff and visitors about your procedures.”

Evidence, how and when: three words a laminated notice on the reception wall answers poorly. A named acknowledgement with a time on it answers all three.

C118-6, section 6.2

Somebody checks the rules are followed

“how you check staff and visitors are following your security rules”

One of the things HMRC asks you to describe about your boundary and building security. For visitors it usually comes down to two things: whether they are escorted, and whether anyone on the floor can tell that they were signed in.

C118-6, section 6.2

Visitors’ vehicles are controlled or recorded

“how you control or record visitors with private vehicles coming to your premises”

Asked under parking. A registration taken at sign in, against the visitor and their host, is a record. A car park nobody can account for next to a loading bay is the thing the question is looking for.

Handbook 11.4

After an incident, visitors hear about the change

“Evidence will also be required of how these changes were subsequently communicated to staff and visitors.”

If a security incident leads you to change a procedure, HMRC expects evidence that visitors were told. Wording that changes once and is then shown to every arrival, with each acknowledgement stored, is that evidence.

None of this tells you to buy anything. What it tells you is that the visitor procedure has to be written down, has to reach the visitor, and has to leave evidence behind it.

At the door

What an iPad at reception records towards each of them

The same kiosk your auditors and your fire marshal use, with the wording HMRC’s guidance is asking about on the screen.

Every arrival on the record, with a host

Anyone coming on to the site signs in and out on the iPad as a visitor, a contractor or a driver as much as a guest. Each one is tied to the member of staff they came to see, with the time on both ends, which is what “regulated” looks like when somebody asks to see it. A courier who only drops off is logged separately, with the time and the carrier.

Your security procedures, acknowledged by name

The wording you need visitors to see is put on screen and accepted before they are let through, and each acceptance is stored against the person with a timestamp. That is the “how and when” in one record.

Vehicles recorded at sign in

The sign in form takes a registration if they have driven in, stored with the visit. Who was parked on your site on a given day stops being a question for the gatehouse’s memory.

A record HMRC can be shown on site

Filter by date, by company or by host and export it to a file that opens without our software. The handbook says procedures will always be checked on site, and this is the part of the check that happens at your front desk.

Watch it work The kiosk in full The same door, for ISO 27001 More than one site

On the day of the visit

Six questions at reception, and where the answers come from

Each of these is the guidance turned into the question an officer asks. None is difficult if the record exists.

How is access to the premises regulated for visitors?The kiosk at the door, the sign in and sign out record behind it, and the member of staff each visitor was tied to.
How and when are visitors told about your security procedures?The wording shown at sign in, and the stored acknowledgement against each named visitor with its time.
How do you control or record visitors who arrive by car?The registration captured at sign in, filterable by date.
How do you check visitors are following the rules?Your escort procedure, which is yours. With the badge module, a printed badge issued only after a member of staff approves the visit, so the floor can see who was signed in.
You changed a procedure after an incident. How were visitors told?The date the wording changed, and every acknowledgement of the new wording since.
Is it the same at every site?One company account with a kiosk at each site. The guidance says that where a process is used only at some sites you must make that clear; here it is the same process, and each site’s record says so.

Before you ask

The questions exporters ask on the first call

Does AEO status require a visitor management system?

No. HMRC’s guidance says access to the premises should be regulated for staff, visitors, other persons, vehicles and goods, and that procedures should document who has access to which areas and how that is controlled. Its examples are keypads and swipe cards. It does not name a technology for visitors, and a documented paper procedure can meet it. What the guidance repeatedly asks for is evidence, including evidence of how and when visitors were told your procedures, and that is the part a book on a counter answers least well.

Which type of AEO do the visitor requirements apply to?

The security and safety criteria, which is where access to premises sits. HMRC’s customs technical handbook heads that chapter “Security and Safety - AEOS Only”. If you are applying for the customs simplifications status alone, read the criteria for that status instead; they are different.

What does HMRC actually check at reception?

The handbook says all procedures should be documented and made available for HMRC during the audit, and that they will always be checked on site. In practice that means the officer experiences your visitor procedure as a visitor, and then asks to see the record of somebody else going through it.

Do delivery drivers count?

The guidance does not leave a gap for them to fall into: access is to be regulated for staff, visitors, other persons, vehicles and goods. Whether you call a driver a visitor or an other person, they and their vehicle are inside the sentence, and the loading bay is the part of the site the rest of the security criteria care most about.

How long should visitor records be kept for AEO?

The security and safety guidance we read does not give a period for visitor records. Choose one that covers the interval between HMRC’s reviews of your authorisation and anything your customers ask for, write it into your documented procedure, and keep to it. UK GDPR still applies to the names in the record, so “for ever” is the wrong answer in both directions.

We have more than one site. Does each need the same procedure?

HMRC’s guidance notes say that if you have more than one site and any of your processes are only used at some of them, you must make this clear. It is easier to write one procedure than three. A kiosk at each site under one company account gives you the same process everywhere, with each site’s own name on the screen and its own record.

Being straight with you

What this does not do

We are not customs consultants, freight forwarders or AEO advisers, and nothing here is advice on an application. This is general information about published HMRC guidance.
The security and safety criteria cover far more than the front door: boundary fences, cargo units, seals, storage, production areas, staff vetting and business partners. A kiosk touches one paragraph of that, and an application built around it would be refused.
Nothing in the guidance requires an electronic system. HMRC’s own examples are keypads and swipe cards, and a well run paper procedure can be documented and evidenced. What the guidance asks for is evidence, and that is where paper tends to struggle.
The kiosk records that a visitor was shown your procedures and accepted them. Whether they then followed them is an escorting and supervision question.
Badges and staff approval are an add-on module, not part of the platform price.

Sources

Check any of this yourself

HMRC customs technical handbook: AEO criteria, security and safety (AEOS only)Paragraphs 11.1, 11.4, 11.6, 11.8, 11.9 and 11.11 are the ones quoted or relied on here.
HMRC, C118-6: guidance notes to section 6 of the AEO questionnaireSections 6.1 and 6.2. Updated 22 January 2024. The questions are not numbered in the guidance notes, so none are numbered here.
GOV.UK, Authorised Economic Operator status: what you can apply forThe types of status, and which criteria each one has to meet.

General information about published guidance, not customs advice. Contains public sector information licensed under the Open Government Licence v3.0. Guidance changes; read the current pages before you rely on a quotation here.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Next step

Tell us what your AEO questionnaire says about visitors

Fifteen minutes on the phone. How many sites, how many gates, and what you wrote, or are about to write, under access to premises. We will tell you straight whether a kiosk makes that paragraph easier to evidence.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case