Vantario

Insight

Your supplier's annual letter probably does not meet the standard

July 27, 2026

Almost every company subject to CTPAT or OEA collects an annual letter from its suppliers. Almost nobody checks that letter against what the standard actually requires.

Here is a letter of the kind that sits in compliance files across North America, lightly paraphrased:

This letter certifies that [Supplier], located in [Industrial Park], does not employ child labor in its production processes and complies with applicable local labor law. Issued for whatever purposes may be appropriate. Sincerely, [Name], Plant Manager.

It is signed, it is on letterhead, it is filed. It also fails on most of what the business partner standard expects, and it would not survive a serious documentation request.

The ten elements

A supplier attestation that holds up should address all ten:

1. All forms of prohibited labor — not only child labor. Forced, indentured, prison, bonded, and trafficked.
2. Sub-tier scope — the supplier's own suppliers, not only its direct operations.
3. Signed by a legal representative with authority to bind the company.
4. A binding truthfulness declaration — in Mexico, bajo protesta de decir verdad.
5. An explicit validity period, with a defined start and end.
6. A duty to notify of any change in status during that period.
7. Reference to the applicable frameworks — UFLPA, Section 307, CTPAT, OEA.
8. Acknowledgement of your right to audit or request supporting evidence.
9. Defined consequences for breach.
10. Identification of the specific sites covered.

The letter quoted above addresses part of one.

The four that are almost always missing

Signature authority

A plant manager does not bind the company. The standard expects someone with demonstrable legal authority — in Mexico, a representative with a notarial power of attorney. A letter signed by operations staff is a statement of belief, not a corporate commitment.

Sub-tier scope

Most letters describe only the supplier's own facility. The standard's "wholly or in part" language reaches further, and so does the risk. A supplier can be entirely clean and still deliver goods containing upstream material that is not.

Validity and notification

A letter dated January with no stated validity period and no duty to notify proves one thing: that on one day in January, someone said yes. It says nothing about March.

Scope of prohibited labor

Child labor is the category everyone names because it is the most legible. It is also, in supply chains that touch high-risk sectors, frequently not the relevant one. Forced and bonded labor in extraction and processing is what drives enforcement action, and a letter that omits those categories omits the exposure.

Why the language matters more than the intent

A supplier may be entirely compliant and still hand you a letter that does not help you. The document is not evidence of their conduct — it is evidence of your due diligence, and it can only evidence what it actually says.

Which means the fix is usually not a supplier problem. It is a template problem. Companies collect the letter they asked for, and most asked for very little.