How to become a TSA Indirect Air Carrier

General information, not legal advice. Rules, fees and forms change. Confirm with the agency named in the sources, or a licensed professional, before you file or ship.

Who needs this

Any business in the United States that accepts cargo and arranges its air transport without holding its own FAA air carrier certificate, including sole proprietors, partnerships, corporations and freight forwarders. Each proprietor, general partner, officer, director and owner must also pass a TSA Security Threat Assessment.

Cost

The Security Threat Assessment fee for IAC personnel was set at $41 by a 2012 Federal Register notice; TSA sets these fees by notice, so confirm the current amount in the Federal Register before you pay. No separate TSA application fee was found in the sources reviewed.

Time

TSA's Cargo Programs page says that once a complete application is received, final approval may take about 90 to 120 days. The regulation also requires you to apply at least 90 calendar days before you intend to begin operations, so file early.

Applies to

US

An Indirect Air Carrier (IAC) is a freight forwarder or similar business that moves property by air using an airline's services, and that is regulated by the Transportation Security Administration (TSA) of the United States. You need IAC approval before you offer air cargo to certain aircraft operators, so this step comes before you sell air freight space or tender cargo to airlines. The approval rests on a TSA-approved security program, not on a general business license.

Step by step

1. 1

   Confirm you qualify as an IAC

   Check that your business is in the United States, does not hold an FAA air carrier operating certificate, and moves property by air using an air carrier's services. If you plan to offer cargo to a full-program aircraft operator or a foreign air carrier under TSA rules, you must hold an approved IAC security program before you do so.

2. 2

   Plan the 90-day lead time

   Apply for the security program in the form and manner TSA prescribes at least 90 calendar days before the date you intend to begin operations. Build the approval wait into any contract or sailing schedule that depends on it.

3. 3

   Gather the required corporate and personal information

   Assemble your business name, any other names you use, state of incorporation if applicable, and tax identification number. Also prepare the names, addresses and dates of birth of each proprietor, general partner, officer, director and owner, and signed statements about any prior IAC security program withdrawal.

4. 4

   Submit the application through the Indirect Air Carrier Management System

   Apply online through TSA's Indirect Air Carrier Management System (IACMS). TSA's Principal Security Inspectors are the primary contacts for the application process. You receive a response from TSA through that system and from your assigned inspector.

5. 5

   Complete Security Threat Assessments

   Make sure each proprietor, general partner, officer, director and owner completes a TSA Security Threat Assessment under part 1540, subpart C. Each employee or agent who will have unescorted access to cargo must also complete one before that access is granted.

6. 6

   Designate the IAC Security Coordinator

   Appoint an Indirect Air Carrier Security Coordinator (IACSC) at the corporate level, with an alternate. The IACSC is your primary contact with TSA for security matters and must be reachable on a 24-hour basis.

7. 7

   Train staff and receive your approved program

   Make sure employees and agents with security duties complete the training in your security program before they perform those duties. TSA approves the program by giving you the Indirect Air Carrier Standard Security Program and any Security Directives. You may begin operating once you meet all requirements, including training and the required Security Threat Assessments.

8. 8

   Calendar your renewal

   Your approved program is renewed on a longer cycle than before. Under the TSA rule, renewal is required once every three years, and the renewal application must be filed on time before the program expires. Keep your IACMS information current, because TSA lists failure to keep it up to date as a violation.

Documents you will need

• Business name, any doing-business-as names, state of incorporation if applicable, and federal tax identification number
• Business addresses and locations, and contact information for the company
• Names, addresses and dates of birth of each proprietor, general partner, officer, director and owner
• Signed statements from each of those persons on whether they were tied to an IAC whose security program was withdrawn by TSA
• A statement on whether the business is a small business under the Small Business Act
• Designated IAC Security Coordinator and alternate, with 24-hour contact details
• Evidence that each Security Threat Assessment and employee training requirement is planned or completed
• Payment method for the Security Threat Assessment fee, as TSA's current notice requires

Common mistakes

• Filing the application less than 90 calendar days before you plan to start, which can delay the start date beyond your commercial plans. File early and treat the 90-day period as a minimum.
• Starting cargo operations before written TSA approval, because the program may only be used once you meet all requirements. Wait for the approval letter and the program before you accept cargo.
• Forgetting that owners and officers need Security Threat Assessments too, not just warehouse or driver staff. Include every proprietor, officer, director and owner in your planning.
• Letting the IACMS record go stale after you change addresses, owners or corporate structure. TSA's rule requires notice of changes, and TSA lists IACMS upkeep as an enforcement area.
• Assuming the fee amount and renewal cycle from older guidance still apply. Check the current Federal Register notice for the fee and the current eCFR text for renewal.

In pictures

The same facts as this page, as images to save or share. Tap one to open it full size.

Official sources

1. 49 CFR 1548.7 Approval, amendment, annual renewal, and withdrawal of approval of the security programElectronic Code of Federal Regulations (eCFR), National Archives
2. 49 CFR Part 1548 Indirect Air Carrier SecurityElectronic Code of Federal Regulations (eCFR), National Archives
3. Cargo ProgramsTransportation Security Administration (TSA)
4. Frequency of Renewal Cycle for Indirect Air Carrier Security ProgramsFederal Register (TSA rule), published 8 February 2024
5. Air Cargo Screening FeesFederal Register (TSA notice), published 23 May 2012
6. 49 CFR 1540.209 Fees for security threat assessmentElectronic Code of Federal Regulations (eCFR), National Archives
7. Notice on Secured Packing Facility applications for Indirect Air CarriersFederal Register (Department of Homeland Security, Transportation Security Administration)
8. Extension of Agency Information Collection Activity: Air Cargo Security RequirementsFederal Register (TSA), published 26 March 2024
9. Air Cargo Security RequirementsFederal Register (TSA final rule), published 26 May 2006
10. Enforcement Sanction Guidance PolicyTransportation Security Administration (TSA), published 24 January 2025

Claims ledger: 20 facts and where each comes from

• An IAC is a person or entity within the United States that does not hold an FAA air carrier operating certificate and engages indirectly in air transportation of property by using an air carrier's services.⁷
• No indirect air carrier may offer cargo to a full-program aircraft operator or a foreign air carrier under TSA rules unless it has and carries out an approved security program under part 1548.²
• An applicant must apply for a security program in the form and manner TSA prescribes at least 90 calendar days before it intends to begin operations.¹
• The application must be in writing and include the business name, other names including doing business as, state of incorporation if applicable, and tax identification number.¹
• The application must include names, addresses and dates of birth of each proprietor, general partner, officer, director and owner.¹
• The application must include a signed statement from each such person on whether they were an owner or officer of an IAC whose security program TSA withdrew.¹
• Applicants submit IAC applications online through the Indirect Air Carrier Management System, and TSA may take about 90 to 120 days for final approval after receiving a complete application.³
• Applicant information for IAC approval is entered into the Indirect Air Carrier Management System (IACMS).⁸
• Each proprietor, general partner, officer, director and owner of an applicant must successfully complete a Security Threat Assessment under part 1540, subpart C, by a date TSA will specify in a future rule.²
• Each individual must complete a Security Threat Assessment before an indirect air carrier authorizes that individual to perform cargo functions with unescorted access.²
• TSA approves the security program by providing the Indirect Air Carrier Standard Security Program and any Security Directive once the applicant meets the requirements of the part.¹
• An IAC may commence operations under its security program only after written approval from TSA that all security requirements are met, including a successful Security Threat Assessment.⁷
• Each IAC must designate an Indirect Air Carrier Security Coordinator appointed at the corporate level, who is the primary contact with TSA for security matters.⁹
• Either the IACSC or an alternate IACSC must be available on a 24-hour basis.⁹
• Employees and agents performing security-related duties must complete the training in the IAC's security program before performing those duties.¹
• The approved IAC security program remains in effect for three years from the approval month under the current eCFR text, unless surrendered or withdrawn earlier.¹
• TSA changed the IAC renewal cycle from annual to once every three years.⁴
• The Security Threat Assessment fee for IAC personnel with unescorted access to cargo was announced as $41 in a 2012 Federal Register notice.⁵
• TSA publishes Security Threat Assessment fee amounts and any revisions as a notice in the Federal Register.⁶
• TSA lists failure to maintain IACMS information up to date as a violation category in its enforcement guidance.¹⁰

Every figure on this page is tied to a cited source, last checked on 22 October 2026. Pages like this are re-checked every three months. Found something out of date? Tell the desk.