The Uyghur Forced Labor Prevention Act (UFLPA) took effect June 21, 2022. For apparel buyers sourcing cotton, it's the single largest compliance obligation to land on the industry in the last decade.
This is a non-lawyer's walkthrough. It is not legal advice; work with a customs attorney on edge cases. It is the operational playbook that every brand importing cotton apparel into the US should have internalized.
What UFLPA actually does
UFLPA creates a rebuttable presumption that any goods:
- Mined, produced, or manufactured wholly or in part in Xinjiang (the Xinjiang Uyghur Autonomous Region of China), OR
- Produced by entities on the UFLPA Entity List (maintained by DHS; updated periodically)
...are made with forced labor and are therefore prohibited from entering the United States under 19 U.S.C. § 1307.
"Rebuttable presumption" means: the default assumption is your shipment is forced-labor product. To release it, you (the importer) must affirmatively prove it isn't.
Why apparel is the tip of the spear
Xinjiang produces roughly 85% of China's cotton and 20% of the world's cotton. Chinese cotton is a significant portion of the global supply, and Xinjiang cotton specifically has been documented throughout the supply chains of most major apparel brands as recently as 2020–2022.
Since UFLPA took effect, CBP has issued thousands of detention notices for apparel shipments. The agency has published repeated enforcement priorities explicitly including cotton, polysilicon, and tomatoes — the first of which is the apparel industry's exposure.
A brand importing cotton apparel without a traceability dossier is not asking "will we get flagged?" — they're rolling the dice on timing.
What CBP looks for when a shipment gets flagged
When a shipment is detained, CBP issues a detention notice. You have 30 days (extendable) to submit documentary evidence. The dossier they expect includes:
1. Supply-chain map. A visual / tabular document listing every facility from raw material to finished goods — named farms or cotton-growing regions, ginning mills, spinning mills, knitters/weavers, dye houses, cut-and-sew factories, finishing facilities, packers, and shippers. Each with full legal name, physical address, and role in the chain.
2. Transaction records. For each step in the chain, the commercial documents proving the transfer:
- Purchase orders
- Commercial invoices
- Bills of lading
- Packing lists
- Payment records (wire transfers, checks)
- Certificates of origin
The goal: CBP can trace a specific bale of cotton from a named farm, through every processor, to the specific garments in this shipment.
3. Third-party verification. Where possible:
- Audits (SA8000, SMETA, BSCI, GOTS social audits)
- Certifications (GOTS for organic, BCI for Better Cotton, Organic Content Standard for traceability)
- Isotopic testing or DNA testing for the cotton, which can confirm or rule out regional origin scientifically. Labs like Oritain and Applied DNA Sciences offer this; cost is ~$400–$1,200 per test.
4. Affirmative attestations from each tier, ideally with legal weight — signed affidavits from the factory, spinner, and ginner attesting that no Xinjiang cotton was used, with specific cotton-origin declarations.
A brand that can produce all four tiers on 30 days' notice will generally see CBP release the shipment. A brand that can produce only an attestation will see exclusion.
Building a traceability dossier before you get flagged
The work can't start when a detention notice lands. 30 days is not enough time to assemble retroactively what should already exist. Start now if you haven't.
The checklist:
- Know your cotton origin. For every SKU, get a named origin country (ideally named region) from your factory. Not "various" — named. If the factory can't name it, keep pressing.
- Get a supply-chain map from your factory. Most audited factories in India already have this on file; ask for it. For factories that don't, build your own: ask the factory who their spinner is, ask the spinner who the ginner is, ask the ginner where the cotton came from. This takes weeks; do it outside of a detention window.
- Collect certifications at each tier. A spinner with GOTS, a ginner with Organic Content Standard certification, and cotton from a BCI-certified farm creates a paper trail.
- Store the documents in one place. A shared folder per SKU, organized by tier. When CBP asks, you hand them the folder.
- Consider isotopic testing for high-risk SKUs. If your product is cotton-heavy and your volume is meaningful, budgeting $500–$1,000 per SKU per season for third-party origin verification is a reasonable insurance policy.
Working with your factory
Your Indian, Bangladeshi, or Vietnamese factory is not the enemy here — they're a partner. Most ethical factories already have traceability data they can share; others don't have it on file and will need to ask their suppliers upstream.
The conversation to have:
- "We need a named-origin declaration on every cotton-containing SKU, signed by you on factory letterhead."
- "We need to understand your cotton supply chain: who's your spinner, who's their ginner, where is the cotton grown."
- "We need a commitment that if CBP detains a shipment of this product, you'll provide supporting documents within 7 days."
A factory that can't or won't provide this is a factory that isn't ready to sell to the US market today. The ones that can will often have the data already compiled because their larger buyers have demanded it since 2022.
The bottom line
UFLPA is not an abstract future risk. It's operational law, enforced daily, and the cost of a detained shipment — delivery delay, legal fees, potential cargo loss — is much larger than the cost of building a traceability dossier proactively.
Every brand importing cotton apparel into the US should, by the end of the next quarter, have (a) named cotton origin on every SKU, (b) supply-chain maps for each SKU on file, (c) a standing request with each factory to provide supporting documents within 7 days of a CBP notice. Everything else is detail.
Frequently asked questions about UFLPA
Does UFLPA apply if my factory is in India?
The factory location doesn't matter — the raw material origin does. An Indian cut-and-sew factory using cotton grown in Xinjiang makes a finished garment that falls under UFLPA. The "rebuttable presumption" is that any product with Xinjiang inputs is forced-labor product unless you can prove otherwise. You need traceability back to the cotton farm, wherever your cut-and-sew happens.
What documents does CBP want to see?
Primary: a supply-chain map showing every facility from raw material to finished goods, with names, addresses, and roles. Secondary: commercial documents (invoices, bills of lading, packing lists) for each transaction between facilities. Supporting: third-party audits, certifications (GOTS, Organic Content Standard, BCI, etc.), and isotopic or DNA testing reports for the cotton if available. CBP published detailed guidance in the UFLPA Operational Guidance; every importer's compliance team should have it on file.
What happens when a shipment is detained?
CBP issues a detention notice giving you 30 days to submit documentary evidence rebutting the presumption. If your documents are complete and persuasive, CBP releases the shipment. If incomplete, they extend detention or exclude/seize the goods. The practical cost: 30–90 day delivery delay, legal fees to respond, potential forfeiture of the shipment value. Detention is not a fine — it's cargo held at the port while you prove your case.
Is a supplier attestation enough?
No. A one-page letter from your supplier saying "no Xinjiang cotton" is worth roughly zero to CBP. They've seen hundreds of them. What they need is a traceability dossier: named farms or regions, named ginning mills, named spinners, transaction records, audit reports. The attestation is the summary sheet on top of the actual documentation.
Related reading
- California SB-657 + NY Fashion Act: What You Legally Have to Disclose — other regulatory disclosures on US apparel brands.
- How to Vet a Manufacturer: A 12-Point Checklist — building traceability starts with the initial vendor-onboarding process.
- SA8000 vs Fair Trade vs BSCI: Which Social Audit Matters — audits that support a UFLPA defense package.
Found this useful?
Share it with your network
