Bulgaria has been a fully-fledged Member State of the European Union (EU) since 1 January 2007 and exerts controls over one of the external maritime borders of the EU with the Black Sea, in accordance with EU Customs policies. The number of inbound and outbound container units going through its largest maritime port, the Port of Varna, has grown steadily over the past 10 years (see Figure 1) but represents a minor part of the flows of goods entering or leaving the European Union through its maritime borders. Most goods entering Bulgaria by sea are released for internal circulation or are in transit to neighbouring EU countries. Transboundary movements to non-EU countries and transshipment operations are an exception.

To be secure and resilient, international supply chains must rely on ports regulated by and enforcing stringent legislative policies, whatever the size of their traffic volume. In this article, I will explain the risk analysis model applied by the Customs office in charge of the port, the various digital platforms employed by the administration, and finally some of the challenges frontline Customs officers must deal with.

In all EU countries, the Customs administration has the legal obligation to carry out the security and safety risk analysis on all the cargo, regardless of the EU country of destination. To do so, Customs risk analysis systems must apply common security and safety risk criteria and standards and common priority control areas set in the EU Common Risk Management Framework. The Framework provides for common risk criteria and standards to target high-risk consignments before their arrival or departure from Bulgaria’s jurisdiction, enabling expeditious releases when the goods are effectively presented. It also provides for financial risk criteria on Customs clearance formalities.

The risk management approach adopted by Bulgarian Customs is a double-layered, double-securing, process. The goal is to identify, in real-time, cargo and operators presenting a risk across a wide range of known fraud practices, as well as shifting patterns and emerging vulnerabilities.

For goods arriving or leaving through maritime ports, shipping lines or their local representatives have the obligation to submit entry summary declarations and exit summary declarations related to a shipment within specified time limits via the Bulgarian Import Control System (called ICS) or the Bulgarian Customs Information System for Exports (called MISI) – Import Control Systems and Export Control Systems are the IT systems which are used by Customs administrations across the EU. The time limit for reporting an inbound shipment is 24 hours before the goods are loaded onto the vessel for containerized cargo, and 4 hours before the arrival of a vessel for bulk cargo. Data transmitted to the national interfaces of ICS and MISI is analysed through a risk engine and the results from the risk analysis are transmitted to the Common EU IT system.

Customs declarations are lodged through the Bulgarian Customs Import System (called MISV) and a risk assessment is performed through the algorithms of the Risk Analysis Module (MAR). MAR targets common financial risks, such as undervaluation, misclassification, or origin fraud. Additionally, MAR addresses product safety standard requirements, as well as restrictive or prohibitive measures enforced by the relevant control authorities. MAR algorithms are built using recognized risk profiles and scenarios. They are developed, updated, and adjusted on a continuous basis with  information gatheredon fraud cases, infringements, or offences exchanged Customs-to-Customs via the Customs Risk Management System managed at EU level. MAR allows new risk profiles to be created quickly, for example, following a tip. Customs officers processing declarations are alerted when a risk profile is activated and are provided with a description of the actions to be undertaken.

In a second phase, a supplementary risk analysis is conducted to target specific threats and adverse practices. This risk evaluation is conducted on the advance cargo information (ACI) which is submitted to the Customs risk analysts by shipping companies in the form of manifests or, as an exemption, of Bills of Lading prior to ship arrivals or departures and before Customs clearance procedures are conducted. ACI is scrutinized to identify unmatched data elements, vague descriptions, inconsistencies, or missing data. Every single piece of data is weighed and assessed against the whole supply chain logic, from the source of the goods to the end user. Analysts must be agile to respond to changing trends and identify criminal intentions. They must justify their decisions to select a cargo for non-intrusive or intrusive inspections. Abusive practices which are discovered and the criteria used by the analysts are then shared to update the risk profiles and thus narrow and fortify the first layer of automated risk analysis.

Other regulatory agencies (border control police, tax and revenue administration, food safety control agency, and internal police service) also conduct their own risk analysis during the cargo clearance process, strengthening the whole targeting process. They receive entry summary declarations and ACI directly from the shipping companies. The data transmission is processed according to the respective competences of the authority to supervise and control the supply chain, as regards the sharing of personal and commercially sensitive data.

Maritime port authorities must abide by multiple regulations, supervisory policies, and administrative procedures, and this necessarily entails the need for smooth interactions and cooperation between a diversity of stakeholders involved in moving and managing seaborne trade.

The Bulgarian National Maritime Single Window (NMSWe) was launched in 2013, transforming the entire mechanism of reporting obligations for the shipping companies, as laid down in the Facilitation of International Maritime Traffic Convention (FAL Convention). It enables them to submit electronic data required for the arrival, stay and departure of a ship, persons and cargo in a port (FAL Forms) at least 24 hours before port calls. The NMSWe collects and distributes relevant information to border control agencies, which then transmit through the system their approvals or requests for additional actions that the shipping companies need to complete prior to receiving approvals for entering the port facilities. It allows for fast exchange of information and messages between shipping lines, providers of port services and all border control institutions. The NMSWe integrates the digital interface of a Vessel Traffic Management Information System (VTMIS), which enables the monitoring of ships’ calls in ports, harbours, and coastal areas.

The NMSWe is to be transformed following the establishment of a European Maritime Single Window Environment (EMSWe) by 15 August 2025. The EMSWe aims to lower the administrative burden on ship operators by harmonizing rules for the provision of the information that is required for port calls, in particular by ensuring that the same data sets can be reported to each NMSWe in the same way. The front-end interfaces of those NMSWe on the side of the declarants should be harmonized at Union level by the use of common interface software for system-to-system exchanges of information, developed at Union level. The Bulgarian Port Authorities and the Customs administration should bear the responsibility for integrating and managing the interface module and for updating the software regularly and in a timely manner when the obligatory reporting data sets are amended by the Commission. Common databases are to be built, such as a ship database, a Common Location Database and a Common Hazmat Database incorporating a list of dangerous and polluting goods that are to be notified. Complete information on vessels (including particulars of the ship, history, visited ports and registered port calls) could be exchanged between the EU Member States in real-time[1].

Another system launched by the Bulgarian Executive Agency Maritime Administration in February 2023 is worth mentioning: the Integrated Bulgarian Maritime Surveillance (InBulMarS), developed as part of the EU Common Information Sharing Environment (CISE) which aims at enabling the sharing of maritime surveillance data between different ICT systems to obtain a comprehensive maritime picture. CISE works via a network of nodes in EU Member States, which takes information from the various existing maritime surveillance systems. In other words, its infrastructure is decentralized. CISE stakeholders define an information sharing plan based on their operational needs – in other words, each decides what information he can share with others and needs from others. When looking for information about a vessel, a stakeholder would include it on a Vessel of Interest (VOI) list and share it with the list of subscribers. If a second stakeholder detects the vessel, he would share the information through CISE. If he detects a vessel not transmitting its position with its radar system, he would also report it and, if a third stakeholder happens to come across the detected vessel, he could take pictures with the visible name and call sign, check that it is included in the VOI list and send the information through the system. InBulMarS brings together seven agencies to receive and communicate information on vessels within EU jurisdictional waters or in the EU maritime domain. The Bulgarian Customs Administration participated in the project from its inception in 2017 to its deployment in February 2023. However, since then, it has withdrawn its participation and denied access to the IT system due to internal cybersecurity rulings.

Finally, the much awaited Port Community System (PCS) is due to be launched by the Bulgarian Port Infrastructure Company in January 2024. It should allow logistics and transport information related to inbound and outbound cargo to be swiftly exchanged between port authorities, control institutions and involved stakeholders. An interoperable digital interface between the Port Infrastructure Company and the Customs administration should integrate their IT systems together with the Customs IT systems (such as ICS, MISI, MISV and Transit), and thus allow extracted data sets to be transmitted and messages to be communicated during the handling of the cargo at the port facilities and during the Customs formalities.

Given the complexity of their task, Customs analysts encounter many issues. Some are sketched out and briefly explained below.

• Obtaining advance cargo information remains pivotal for efficient risk assessment. However, the quality of this information relates to the contract between the carrier and parties involved in a shipment. They can be rather distant from the manufacturers of the goods and their final end-users and consumers. Indeed, there are often many intermediaries involved in the international supply chain and this can lead to a lack of visibility which translates into incomplete and ambiguous data provision.
• The EU Customs risk management strategy stipulates the principle “assess in advance, control where required[2]” – in other words, tackling risks efficiently before they materialize, but enabling the uninhibited clearance of freight handled via “trusted trade lanes” (trade lanes which offer visibility to Customs, from the origin of the goods to the final consumers) and moving to and from compliant and trusted businesses. Concise risk analysis and decision-making correlates with the structure and quality of the data provided by the users and historically stored in IT systems. Rational, consistent, and unbiased solutions are expected to identify compromised shipments. Such solutions rely not only on quality data supply, but also on the results from controls. The approach towards every inspected cargo should be to anticipate and be prepared to react to unexpected threats or corrupt practices since the true intentions of an importer may remain disguised until the control ends.
• Effective Customs control practices and methods play a key role. Substantiated risk analysis depends on the reported results, where objectives meet outcomes from interventions. Jeopardized controls or subtle interferences can alter the data reported and thus preempt the wider strategy of risk management. This highlights the need at all levels for skilful, competent and reliable human resources.
• Customs officers operate through multiple decentralized electronic systems, each employed for a specific Customs procedure – entering goods, taking goods out, or transiting the goods. These IT systems are not integrated and data is not inter-connected through a common database. The risk analysis is hampered and has to take into account this multiplicity of Customs procedures and systems when matching the data. In many cases, it is impossible to properly track a consignment from origin to end as the quality of the data is poor. This situation can be exploited by malevolent traders to compromise the international supply chain, thus causing financial losses or endangering human and wildlife, as well as the environment.

The gradual integration of interoperable IT systems could curb attempts to circumvent control decisions or to compromise the outcome of controls. It is therefore something to look forward to.

It would also make a huge impact to have the largest possible participation of operators in the Authorized Economic Operator programme and the deployment of trusted trade lanes which could be based on Customs-to-Customs information sharing and mutual recognition of controls, or on Authorized Economic Operators (or other trusted traders) involved throughout the supply chain (trusted trade lanes). Such an ambition is laid out in the WCO Integrated Supply Chain Management Guidelines[3].

Another thing to consider is leveraging technologies deployed by the port operators, and a future alignment between the International Ship and Port Facility Security Code (ISPS Code[4]) and AEO security status (see figure 2). The first would permit optimal utilization of IT resources and the establishment of an interchangeable electronic environment. The second, mutual recognition of both security programmes in terms of requirements and validation/revalidation methodology, would enhance mutual trust and would avoid duplicative administrative work, benefiting border regulating authorities and port operators.

Finally, digital transition has been highly beneficial to risk analysis, but more could be done, for example by deploying disruptive technologies such as big data and machine learning.

If a thorough and streamlined risk management model is in place and control measures are efficiently performed, digitalization can result in creating “Smart Borders”. Whatever the maturity of the port environment and traffic volumes, we need all maritime points of entry to become smart if we want to facilitate trade while enforcing regulations.

More information
Dilyana.Alexandrova@customs.bg
www.customs.bg

[1] Regulation (EU) 2019/1239 of the European Parliament and of the Council of 20 June 2019 establishing a European Maritime Single Window environment (https://eur-lex.europa.eu/eli/reg/2019/1239/oj)

[2] See Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee on the EU Strategy and Action Plan for customs risk management: Tackling risks, strengthening supply chain security and facilitating trade https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52014DC0527

[3] https://www.wcoomd.org/-/media/wco/public/global/pdf/topics/facilitation/instruments-and-tools/tools/safe-package/guidelines-on-iscm.pdf?la=en&la=en

[4] Developed in response to the perceived threats to ships and port facilities in the wake of the 9/11 attacks in the United States, the ISPS code is a comprehensive set of measures to enhance the security of ships and port facilities.