ACC3, RA3 & KC3: EU Air Cargo Security Validation Explained

ACC3 is the European Union security designation that an airline must hold to fly air cargo or mail into the EU from an airport in a third (non-EU) country. It sits on top of a chain of validated parties — RA3 regulated agents and KC3 known consignors — and exists so that cargo bound for Europe is secured at its foreign point of origin, not just on arrival.

What is ACC3?

ACC3 stands for Air Cargo or Mail Carrier operating into the Union from a Third Country Airport. It is a designation under EU aviation security law (Regulation (EU) 2015/1998) that an air carrier must obtain for each third-country airport from which it brings cargo or mail into the European Union.

The regime is a direct response to the October 2010 plot in which explosive devices were shipped as air cargo from Yemen toward the United States. The EU's answer was to push cargo security upstream: rather than relying on screening after a shipment lands in Europe, ACC3 makes the carrier responsible for a secured supply chain that starts at the foreign origin airport. It applies to passenger and all-cargo flights alike.

ACC3 moves the EU's cargo security perimeter outward — to the third-country airport where the freight is first accepted, long before the aircraft reaches European airspace.

What is the difference between ACC3, RA3, KC3 and AC3?

These four designations are the building blocks of the EU's third-country cargo chain. They describe who in the chain has been security-validated and for what role:

• ACC3 — the air carrier itself, designated to transport cargo or mail into the EU from a specific third-country airport.
• RA3 — a third-country regulated agent: a freight forwarder or handling agent that applies security controls and maintains chain of custody, validated against EU requirements.
• KC3 — a third-country known consignor: a shipper validated to prepare cargo securely at its own premises so it enters the chain already secured.
• AC3 — a third-country account consignor: a limited category appointed by an ACC3 or RA3, not independently validated, whose cargo faces tighter restrictions on how it may be carried.

The logic mirrors the EU's internal regulated-agent / known-consignor model described in our air cargo security overview — but RA3 and KC3 are the third-country equivalents, validated specifically so their cargo can enter the EU through an ACC3 carrier.

When is ACC3 required?

ACC3 is required whenever cargo or mail is carried into the EU (and the associated EEA states) from a third-country airport. The carrier needs a separate designation for each such airport it serves.

There are defined exceptions. EU aviation security law recognises a small number of third countries whose cargo security regimes are treated as equivalent to the EU's. Cargo originating in those recognised states can follow lighter requirements. Where no equivalence applies — which is the majority of origins — the full ACC3 framework governs the shipment.

How do you get ACC3 designation?

ACC3 designation is granted by an EU member state's appropriate authority, and the central requirement is an on-site EU aviation security validation. In practice this means:

1. An EU aviation security validator — an independent person or body approved under the regulation — visits the third-country station.
2. The validator assesses the carrier's security programme against the EU requirements: how cargo is accepted, screened, protected from tampering, and handled by vetted staff.
3. The validator produces a validation report. On the strength of it, the member state designates the carrier as ACC3 for that airport.
4. The designation is recorded in the Union database on supply chain security, the official register of valid ACC3, RA3 and KC3 entries that carriers and authorities check.

The same independent-validation principle applies down the chain: an RA3 or KC3 must itself be validated by an EU aviation security validator before its cargo can be treated as secure within an ACC3 carrier's supply chain.

How long does an ACC3 designation last?

ACC3 designations and the RA3/KC3 validations beneath them are not permanent. They are granted for a defined period and must be renewed through re-validation on a recurring cycle. A lapsed validation breaks the secure chain: cargo from an RA3 or KC3 whose validation has expired can no longer be accepted as secure without fresh screening. Operators therefore track validation expiry dates across their whole third-country network, because a single expired link can ground a consignment.

How does ACC3 fit the wider cargo security picture?

ACC3 is the EU's regional implementation of a global principle. The international baseline — screen cargo or secure it through an auditable supply chain — comes from ICAO Annex 17. ACC3, RA3 and KC3 are how the EU operationalises that baseline for freight crossing its border, with independent validation as the enforcement mechanism.

For an operator, the practical questions are concrete: does the airline hold ACC3 for each third-country airport it lifts cargo from, and are the RA3/KC3 partners in that chain currently validated? Those compliance facts define the floor. Where to apply scrutiny above the floor — which origins and routes warrant closer attention right now — is a threat-intelligence question, answered by AeroVigil's live, country-level flight risk profiles rather than a static list.

Frequently asked questions

What does ACC3 stand for?

ACC3 stands for Air Cargo or Mail Carrier operating into the Union from a Third Country Airport. It is the EU designation an airline needs to carry cargo or mail into the European Union from a non-EU airport.

What is the difference between RA3 and KC3?

An RA3 is a third-country regulated agent — a forwarder or handler that applies security controls and protects cargo in transit. A KC3 is a third-country known consignor — a shipper validated to prepare cargo securely at its own premises. Both are validated against EU requirements by an EU aviation security validator.

Is ACC3 the same as being a regulated agent?

No. A regulated agent (RA3 in the third-country context) handles and secures cargo within the chain. ACC3 is the carrier's designation to fly that cargo into the EU. A single shipment typically involves both: an ACC3 carrier moving cargo secured by RA3 agents and KC3 consignors.

Does ACC3 require an on-site visit?

Yes. The core of ACC3 designation is an on-site EU aviation security validation, in which an approved EU aviation security validator assesses the carrier's security programme at the third-country airport and issues a validation report.

Continue with air cargo security for how freight is screened and secured worldwide, or ICAO Annex 17 requirements for the international baseline behind ACC3. The aviation security glossary defines the terms used here.