CBAM Registry modules: AMM, DRMC, O3CI and evidence handoffs

Use a boundary record, not a three-step filing recipe

AMM, DRMC and O3CI describe different official functions, not three compulsory stages through which every file passes. The Commission Registry page describes the Authorisation Management Module (AMM), data reconciliation for monitoring and control (DRMC), and Operators of Third-Country Installations (O3CI). An application, a monitoring query and a disclosure have different actors and different results.

The matrix below is an editorial operating model, not an official Registry schema or a claim about CBAM Pulse functionality. Its purpose is to make a handoff inspectable. Record an internal package reference, official reference where available, source/manual version, actor, input version, returned status, unresolved gap and next owner. Keep the official response separate from your interpretation of it.

One package can meet three different module boundaries

Read the module column as documented purpose; read the evidence columns as recommended controls. A package may support several activities without being transferred automatically between them.

Separate access, authorisation and permission to act

The June 2026 Declarants Portal manual §3 says access requires registration in UUM&DS, with allowed roles assigned by the national competent authority. A successful login therefore answers an access question, not whether an authorisation application has been approved. For eligibility and national procedure, use the authorised declarant process rather than treating this handoff map as application advice.

Keep three separate evidence fields: the user/role access confirmation, the applicant or declarant identity, and the authorisation decision/reference. If a central team acts for another entity, also retain the basis for that action. Article 5(7a) of Regulation 2023/956 permits delegated declaration submission while leaving responsibility with the authorised declarant; possession of a login does not itself establish that delegation.

An internal state such as access-confirmed must not overwrite application-pending. When either record changes, ask whether the person reviewing the package is still acting for the intended declarant. Escalate an identity mismatch before sharing another version.

Use DRMC to investigate differences, not to certify a prepared file

The Commission describes DRMC as account monitoring across imported goods, emissions, certificates and penalties. The Release 3.2 manual §3.3 describes goods queries with associated estimated emissions. Estimated values are not evidence that installation actual emissions have been verified. Compare like periods and populations before deciding that a difference is an error.

Preserve the extract or observation, retrieval time, filters, comparison population and source version. Route a quantity difference to the customs population owner and an emissions-basis difference to the technical reviewer. If the underlying rows span countries, the multi-Member-State movement reconciliation should settle their identity before the team adjusts its totals.

The manual §§4.2.4.3–5 explicitly describes coverage, certificate and declaration-monitoring screens without data in that release. This is a documentary limit, not an authenticated test of your account today. A menu item does not establish that a service is operational; declaration monitoring is not proof of declaration submission. Recheck current official instructions before taking an official action.

Close the disclosure-to-retrieval gap

For the O3CI retrieval flow described on the Commission Registry page, the declarant shares its EORI with the supplier outside the Registry. Validate that recipient reference through an agreed channel and connect the commercial contact to the actual operator. The exporter-to-importer evidence handoff covers the broader commercial-chain and confidentiality questions; here the control is whether the intended recipient obtained the intended version.

Record disclosure-attempted, disclosed, retrieved and reviewed as separate internal states, each with an event reference. These are proposed tracking labels, not claimed official portal status names. A forwarded email saying sent is not retrieval evidence. A retrieved package can still refer to the wrong installation or reporting period.

Articles 8 and 10 of Regulation 2023/956 distinguish verification and disclosure. Keep the verification-report reference as a separate dependency; uploading or retrieving a package does not create verification. If the operator replaces the package, retain the earlier disclosure record and identify recipients whose review depended on it.

Resolve exceptions without inventing a successful transition

Suppose the invented package PKG-A/v2 concerns installation INST-A and recipient ENTITY-B. The operator records a disclosure attempt. ENTITY-B cannot retrieve it because the recipient reference belongs to an old group entity. The controller does not relabel the attempt as completed: the operator confirms the intended recipient, corrects the disclosure and returns a new event reference.

ENTITY-B then retrieves v2, but its internal worksheet still points to v1. Receipt is now confirmed; review remains stale. Use versioned evidence dependencies to identify the affected worksheet and retain both versions. Only the reviewer can close the mismatch after checking the replacement evidence. Nothing in this synthetic journey constitutes a filing or a verification opinion.

• Wrong recipient: preserve the attempted reference, stop further disclosure and assign the operator/recipient identity owner.
• Missing access: preserve the error context without circulating credentials; refer the user to the national access process.
• Returned discrepancy: attach the official reference to the comparison version and assign a named resolver.
• Superseded package: mark dependent reviews stale; do not delete the version used for the earlier decision.

Define the external handoff acceptance record

Close a handoff only when the next owner acknowledges the exact package version and the unresolved work. The record should say what was received, what was checked, what remains blocked and which official/manual version governed the action. A review date without a package reference cannot establish which evidence was reviewed.

This map supports preparation and coordination only. CBAM Pulse does not provide a Registry integration, access management, verification or declaration filing. Official portal actions and any unresolved national-procedure questions remain with the responsible actors and authorities.