ACC3, RA3 & KC3 · EU AIR CARGO SECURITY · Aero Support Group FZCO · Updated 22 October 2026
The legal framework
- Regulation (EC) No 300/2008 sets the common rules for civil aviation security in the EU. Article 10 requires each Member State to have a national civil aviation security programme, and Article 13 requires air carriers to have a security programme.
- Implementing Regulation (EU) 2015/1998 contains the detailed measures. Point 6.8 of its Annex covers cargo and mail carried into the EU from third countries: ACC3 designation (6.8.1), EU validation of the ACC3 (6.8.2), security controls on inbound cargo (6.8.3), RA3 and KC3 designation and validation (6.8.4 and 6.8.5), non-compliance (6.8.6) and pre-loading advance cargo information, PLACI (6.8.7).
- Implementing Regulation (EU) 2019/1583 is often cited in this context but deals with cybersecurity: protection of critical information and communication technology systems and data (point 1.7), background checks and cyber training. It applies to ACC3 operations only through those general requirements.
The regulation has been amended many times. Recent changes include the PLACI rules from 2021 and 2023 and, from 1 January 2026, the option for ACC3s and RA3s to screen with explosive detection dogs once a validator has assessed the screening against Attachment 6-M (Regulation (EU) 2025/920).
ACC3 designation and validation
Who designates. Under 6.8.1.1 the ACC3 is designated by the Member State that issued the carrier’s AOC; failing that, by the Member State listed for the carrier in the Annex to Regulation (EC) No 748/2009; failing that, by the Member State where the carrier has its major base of operations in the EU. The designation is entered in the Union database on supply chain security, and an ACC3 listed there is recognised in all Member States.
What the carrier provides. The carrier nominates a person with overall responsibility for cargo and mail security at the airport and submits an EU aviation security validation report.
Validation. An EU aviation security validator examines the carrier’s security programme against the content list in Attachment 6-G and checks implementation on site using the checklist in Attachment 6-C3. The validation report consists of the carrier’s declaration of commitments (Attachment 6-H1), the completed checklist and the validator’s declaration.
Validity. ACC3 designation is valid for up to five years from entry in the Union database, after which a new validation is required. Carriers with many third-country airports can use a network approach under 6.8.2.2, with validation of a representative sample of airports each year under an authority-approved quality assurance programme.
RA3 and KC3
A regulated agent (RA3) or known consignor (KC3) is an entity in a third country that applies security controls to cargo or mail destined for the EU. Under 6.8.4 they are designated by the Member State authority responsible for the ACC3 designation at that airport.
There are two validation routes (6.8.5.1):
- the entity is covered by the ACC3’s own security programme and validation, in which case its status applies only to cargo delivered to that ACC3;
- the entity undergoes a standalone EU validation, using the checklist in Attachment 6-C2 for an RA3 or 6-C4 for a KC3.
RA3 and KC3 designations are valid for up to three years from entry in the Union database, with revalidation at intervals not exceeding three years. Cargo that has not been secured by an RA3 or KC3 must be screened before loading, by the ACC3 or on its behalf.
Validators and training
EU aviation security validators are approved by the appropriate authority of a Member State under point 11.6 of the Annex to Regulation (EU) 2015/1998 and listed in the Union database. Their approval is recognised by all Member States. The standard they validate against is the EU checklist in the relevant attachment, not an ECAC document. ECAC Doc 30 Part I deals with facilitation, and its security part is restricted ECAC policy rather than EU law.
Training. Staff with unescorted access to secured cargo must receive initial and recurrent security training and pass a pre-employment check covering at least their identity and the previous five years. The regulation does not set training hours for third-country staff. The validator records what the training covers, how long it lasts and how often it is repeated, and assesses whether it is adequate.
PLACI and ICS2
Under 6.8.7, when EU customs refer a consignment through the pre-loading advance cargo information process, the carrier treats it as high-risk cargo or mail and applies the corresponding screening. If customs issue a “do not load” notice, the consignment is not loaded or is off-loaded. Since 1 April 2023 the carrier may not load a referred consignment for carriage into the EU until the required measures have been met.
On the customs side, the Import Control System 2 (ICS2) has required advance cargo information from all air carriers, freight forwarders and postal operators since Release 2, which began on 1 March 2023. Security and customs processes need to work together at the departure airport so that referrals are acted on before loading.
Where validations run into difficulty
- The security programme follows a generic template and does not describe what happens at the specific airport.
- Screening methods or equipment do not match those permitted for the cargo type, or screening records cannot show which consignments were screened and how.
- Chain of custody between the RA3, the handling agent and the aircraft cannot be demonstrated, especially where several parties handle the cargo.
- Staff training and background checks are not documented for subcontracted handling staff.
- PLACI referrals are received but there is no tested procedure for applying high-risk cargo measures in time.
- The carrier relies on an RA3 whose designation has expired or does not cover the relevant ACC3.
How ASG supports ACC3, RA3 and KC3
- Applicability review for each third-country airport, including exemptions and the responsible Member State.
- Security programme drafting against Attachment 6-G, written around the actual airport operation.
- Pre-validation gap analysis against Attachments 6-C3, 6-C2 or 6-C4, with corrective actions before the validator’s visit.
- Supply chain mapping to confirm which RA3s and KC3s secure the cargo and whether their designations are valid.
- Training material and records for staff with access to secured cargo.
- Procedures for PLACI referrals and high-risk cargo.
- Ongoing support through SECURITY RADAR: tracking designation expiry dates, amendments to Regulation (EU) 2015/1998 and readiness for revalidation.
ASG prepares organisations for validation. The validation itself is performed by an independent EU aviation security validator.
Conclusion
ACC3 validation tests whether cargo security at a third-country airport works as the carrier’s programme says it does, with traceable screening and a secure supply chain. Getting there takes a programme written for the actual operation and partners whose status is current. ASG helps carriers and their RA3 and KC3 partners prepare for validation and stay compliant afterwards.
Frequently asked questions
ACC3 stands for Air Cargo or Mail Carrier operating into the Union from a Third Country Airport. An airline needs ACC3 designation for each non-EU airport from which it carries cargo or mail to the EU, unless an exemption applies.
RA3 means Regulated Agent validated for the EU from a third country. It is a freight forwarder or handling agent outside the EU that applies security controls, including screening, to cargo or mail bound for the EU. RA3 designation lasts up to three years.
KC3 means Known Consignor validated for the EU from a third country. It is a shipper outside the EU whose cargo security controls have been validated under point 6.8 of Regulation (EU) 2015/1998, so its secured cargo can be carried to the EU by an ACC3 without further screening.
An ACC3 is an air carrier designated to carry cargo or mail into the EU from a specific third-country airport. An RA3 is a regulated agent and a KC3 a known consignor in that country, validated to apply security controls to cargo before it reaches the ACC3.
The Member State that issued the carrier’s AOC; otherwise the one listed for the carrier in the Annex to Regulation (EC) No 748/2009; otherwise the Member State where the carrier has its major EU base (point 6.8.1.1).
ACC3 designation is valid for up to five years. RA3 and KC3 designations are valid for up to three years, with revalidation at intervals not exceeding three years.
An EU aviation security validator approved by a Member State authority and listed in the Union database, using the checklists in the attachments to Regulation (EU) 2015/1998.
No. Staff with access to secured cargo need initial and recurrent security training. The validator records its content, length and frequency and assesses whether it is adequate.
No. It amended Regulation (EU) 2015/1998 to add cybersecurity requirements. ACC3, RA3 and KC3 are covered by point 6.8 of the Annex to Regulation (EU) 2015/1998.
Key takeaways
- ACC3 rules are in point 6.8 of the Annex to Regulation (EU) 2015/1998
- The responsible Member State is set by AOC, Regulation 748/2009 or main EU base
- ACC3 designation lasts up to five years; RA3 and KC3 up to three
- Validators are approved by Member States and use the EU checklists
- PLACI referrals must be acted on before loading
Preparing for an ACC3 or RA3 validation?
Tell us the airports and supply chain partners involved. ASG will confirm what applies and prepare you for the validator’s visit.