EUDR Downstream Operators and the inbound process: What FAQ 3.4 really requires

Executive Summary

Downstream operators and traders under the EU Deforestation Regulation (EUDR) have a much leaner obligation than first distributors: no due diligence of their own, no DDS submission. Instead, they must record the master data of their direct suppliers and customers and, if they are first downstream operators, i.e. they are supplied directly by an upstream operator, they must also record the DDS reference numbers and assign them to the incoming delivery. This collection obligation is passive: anyone who does not receive a reference number may assume in good faith that they are not a first downstream operator.

All information must be kept for five years. Non-SMEs must also register in the EUDR information system (TRACES) and, in the event of substantiated concerns, actively verify whether the upstream due diligence obligation has been fulfilled. SMEs are exempt from registration and verification, but are subject to the same reporting and retention obligations.

The obligations will apply to non-SMEs from December 30, 2026 and to micro and small enterprises from June 30, 2027. Violations could result in fines of at least 4% of annual EU-wide turnover, confiscation, distribution bans and public listing. Those who clarify roles, expand master data and establish an escalation process for justified concerns are compliant with manageable effort.

Everything important about the downstream operator

First or second downstream? Almost everything depends on it

With the EUDR simplification of December 2025, a distinction has come to the fore that many downstream companies do not yet have on their radar: Only the first downstream operator in the chain has to record DDS reference numbers. All other operators are exempt. FAQ 3.4 of the European Commission(5th version of the official FAQ) makes this clear and significantly reduces the inbound effort for most companies.

Who is a downstream operator and who is not?

The delimitation of roles is the basis for everything else. It results from Art. 2(15)-(15b) EUDR:

• Operator (Upstream Operator): Brings a relevant product to the EU market for the first time or exports it. the product was not previously covered by a DDS or SD. Full duty of care incl. DDS levy.
• Downstream operator: Provides or exports relevant products that are already covered by a DDS or SD of an upstream operator as part of a commercial activity. Example: An EU chocolate manufacturer that already processes certified cocoa beans.
• Trader: Any other actor who resells a product that has already been placed on the market (e.g. retail or wholesale). The obligations are essentially identical to those of a downstream operator.

First vs. second downstream operator

This distinction is new and has been the key to the inbound process since the December 2025 simplification:

• First downstream operator: who is supplied directly by an (upstream) operator. Mandatory: Record the DDS reference number and assign it to the inbound delivery.
• Second downstream operator (or any other downstream operator in the chain): who is supplied by another downstream operator or trader. Mandatory: only record supplier and customer data, no reference number.

The core obligations of FAQ 3.4 at a glance

FAQ 3.4 structures the obligations into three modules. These apply equally to downstream operators and traders.

Collect information about business partners

The following data must be recorded for each direct supplier and each direct commercial customer:

• Name or registered trade name or trademark
• Postal address
• E-mail address
• Web address (if available)

DDS reference numbers - only for first downstream operators/traders

If the direct supplier is an upstream operator, additional costs are added:

• DDS reference numbers (for operators) or declaration identifiers (for MSPOs with SD)

These must be linked to incoming product flows, not outgoing ones. Storage in a specific system or database is not mandatory. The only decisive factor is that the data can be made available within a reasonable period of time if requested by the authorities.

Why this is a passive duty

This is the central point that FAQ 3.4 (in combination with 3.5) clarifies and which is often misunderstood in practice:

• The downstream operator does not have to proactively ask the supplier whether they are an upstream operator.
• He does not have to actively research his own position in the supply chain.
• The obligation to pass on the reference number lies with the upstream operator (Art. 4(7) EUDR): It proactively passes on the reference number to its direct recipient.
• If the Downstream Operator does not receive a reference number, it may assume in good faith that its supplier is not an Upstream Operator.
• Only if he knows positively that the supplier is an upstream operator and does not comply with his obligation to pass on the product must he withhold the product (Art. 5(1) EUDR).

Registration in the information system - only for non-SMEs

• Non-SME downstream operators and distributors must register in the EUDR information system (TRACES) before placing on the market/exporting for the first time (Art. 5(2) EUDR).
• SMEs are exempt from registration.

The threshold values of the Accounting Directive 2013/34/EU are decisive, not the Commission's SME recommendation from 2003. Medium-sized companies do not exceed at least two of these three values: € 25 million balance sheet total, € 50 million net turnover, 250 employees.

When do the obligations apply?

Following the recent postponements and the publication of the revised version in the Official Journal on December 23, 2025, the following timetable applies:

• Non-SMEs (large and medium-sized enterprises): from December 30, 2026
• Micro and small enterprises: from June 30, 2027
• Special case of EUTR products: Micro/small companies that fell under the old EU Timber Regulation (EUTR) will already start on December 30, 2026, not six months later.

The additional time is not a break: clarifying roles, adapting supplier master data and setting up internal inbound processes usually take longer in practice than the pure legal check.

Reasonable concerns: reporting obligation for all, verification obligation only for non-SMEs

According to Art. 2(31) EUDR, a "substantiated concern" is a duly substantiated allegation based on objective and verifiable information about infringements of this Regulation that may require action by the competent authorities. A general statement that a company is sourcing "from a risk country" is not sufficient. A concrete chain of reasoning backed up with evidence is required. Find out more about this topic in our blog post on Substantiated Concerns.

What downstream operators must do as soon as they become aware of it

All (including SMEs): Immediately inform the competent authority of the Member State in which the product was placed on the market and the downstream actors supplied. In the case of exports, the authority of the country of production must be informed.

Additionally, only non-SMEs (Art. 5(6) EUDR): Actively verify that due diligence has been properly exercised and that there is no or only a negligible risk. As long as this verification has not been completed, a de facto ban on distribution applies. Possible verification steps:

• Checking the validity of the DDS in the information system
• Evaluation of publicly available annual reports of the upstream operator (Art. 12(3) EUDR)
• Access to audit results (Art. 11(2)(b) EUDR)
• Consultation of the country risk classification (Art. 29(2) EUDR)
• Voluntary request for further information from the supplier
• If none of the above applies: Cooperation with the authorities by naming the upstream supplier

The verification obligation is reactive. It is expressly not a systematic routine check, but an event-driven reaction to specific indications.

Practical examples

Example 1: Chocolate manufacturer (non-SME)

An EU importer imports cocoa beans from a third country (upstream operator), submits the DDS and passes on the reference number to its customer. A chocolate manufacturer (non-SME) processes the beans into chocolate and places them on the market in the EU.

• Role: First Downstream Operator (non-SME)
• Obligations: Record reference number + contact details of the importer, keep for 5 years; registration in the information system; reporting obligation in the event of justified concerns; additional verification obligation in the event of justified concerns.

Example 2: Timber trader (SME)

A small sawmill in a low-risk country (MSPO) submits an SD. A medium-sized timber trader (SME) buys the sawn timber and sells it to a furniture manufacturer in the EU.

• Role: Trader (SME)
• Obligations: Record SD declaration ID + contact details of sawmill and keep for 5 years; no registration; reporting obligation in case of justified concerns; no verification obligation.

Example 3: Double role for processing with subsequent export

A tire manufacturer A imports vulcanized rubber into the EU (upstream operator), processes it into tires and exports part of it.

• When importing rubber: Upstream operator → full due diligence, DDS, reference number in the customs declaration.
• For tire export: Downstream Operator → no new reference number required in the customs declaration; instead, the dedicated TARIC certificate code is sufficient (see FAQ 5.6.1).

The internal transfer of reference numbers is no longer necessary because the operator and downstream functions are combined in the same legal entity.

Risk of sanctions: what happens in the event of violations

The sanctions logic of the EUDR is strict because it uses market access as leverage. Downstream operators and traders are also at risk if they breach their obligations. Art. 25 EUDR provides the member states with a minimum framework:

• Fines for legal entities: statutory maximum of at least 4% of the EU-wide annual turnover of the previous year.
• Confiscation of the products and/or the proceeds generated.
• Temporary exclusion from public contracts and EU funding for up to 12 months.
• In the event of serious infringements: temporary ban on placing on the market.
• Publication of final judgments against legal persons on a Commission list ("naming and shaming").

Added to this is the reputational risk vis-à-vis customers, investors and NGOs - which in practice often outweighs the fine itself.

Set up a concrete inbound process: What to do now

FAQ 3.4 describes the what, not the how. Five steps have proven to be a sensible sequence:

1. Clarify my role. Am I an operator, first downstream, second downstream or trader? Do I have dual roles for different product flows? This results in the specific scope of duties.
2. Determine SME status. Check thresholds in accordance with the Accounting Directive 2013/34/EU, taking into account the two-year rule and individual group view. Registration and verification obligations depend on this.
3. Expand supplier master data. Add mandatory fields in the ERP or supplier system: full address, e-mail, web, and - as a technical field - DDS reference number/explanation ID with link to the incoming product flow (batch, goods receipt document, order number).
4. Define the escalation process. Who reacts when a substantiated concern is received? Who informs the competent authority and within what timeframe? Who decides (for non-SMEs) on the temporary halt to distribution during verification?
5. Define responsibilities. EUDR inbound affects purchasing, incoming goods, compliance and IT at the same time. Without a clear assignment, the duty remains between the functions.

Conclusion

The inbound process for downstream operators and retailers is much leaner than an operator's full duty of care - but it is not trivial. Three points are crucial for smooth compliance:

1. Clarity about your own role: first downstream, second downstream or trader? SME or non-SME? Almost everything depends on this.
2. Clean inbound assignment: Incoming reference numbers must be linked to the associated product stream and be traceable for five years.
3. Preparedness for emergencies: In the event of justified concerns, every hour counts - the reporting channels and (for non-SMEs) the verification steps should be defined in advance.

The EU Commission has deliberately minimized the effort for downstream stakeholders with the latest FAQ and guidance clarifications. Anyone who understands the logic of the passive obligation and the first downstream position can set up the process with a manageable use of resources - and at the same time is prepared for a request from the authorities or a substantiated notification.