EUDR reference number and verification number: obligations in the supply chain clearly explained

Executive Summary

The EUDR has three numbers: The reference number is created after a declaration of due diligence (DDS) is submitted, the declaration identifier is created after a simplified declaration (SD) is submitted by MSPOs, and the verification number is an additional layer of security for the deposited data. Only the first two must be actively passed on.

Operators submit DDS or SD and proactively pass the number on to the first downstream actor and to customs. Downstream operators and traders collect and store the numbers for five years, without any due diligence or duty of inquiry. Only non-SME downstream operators must perform additional verification if there are justified concerns. This is where the verification number comes into play.

Customs will not release any goods without a valid reference number or identifier. Violations can be penalized with at least 4% of the Union-wide annual turnover. Application deadlines: December 30, 2026 for large and medium-sized companies, June 30, 2027 for micro and small companies.

Three stakeholder roles - three different duty profiles

Reference number, declaration identifier, verification number - three terms that are regularly confused in practice. Who has to pass on which number, who only collects it and when it is used at all determines whether a product is released at customs or not.

The requirements for the numbers depend on the role a company plays in the supply chain:

• Operator (market participant): Brings a relevant product onto the EU market for the first time or exports it. Carries the full due diligence obligation and submits a due diligence declaration (DDS).
• Micro or Small Primary Operator (MSPO): Sub-category of operators. Micro or small enterprises from a country classified as low-risk that place their own products directly on the EU market. Submit a single simplified declaration (SD) instead of a DDS. More on this in our specific blog post on MSPO.
• Downstream operators and traders: process or resell relevant products that are already covered by a DDS or SD. Do not have to perform their own due diligence or submit a DDS, but must collect and retain information.

A detailed overview of group structures and SME thresholds can be found in the article EUDR and group structures: applying SME thresholds correctly.

The declaration of due diligence (DDS) and the reference number

Before an operator places relevant products on the market or exports them, he must submit a Due Diligence Statement (DDS) in the EUDR information system. The DDS contains:

• Product type and HS/KN code
• Quantity (usually net weight)
• Country of production and origin
• Direct suppliers and customers
• Geocoordinates of all production areas (GeoJSON format, WGS-84/EPSG-4326)
• Proof of deforestation-free and legal production

After successful submission, the system generates a unique reference number. This must be entered by the operator:

1. proactively to the first downstream actor (downstream operator or trader), if there is one - Art. 4(7) EUDR;
2. to customs for import and export.

The simplified declaration (SD) and the declaration identifier

MSPOs benefit from a much more streamlined procedure. Instead of a DDS, they submit a one-off Simplified Declaration (SD) and receive a Declaration Identifier in return. This has the same functional role as the reference number: it must be passed on to the first downstream actors and must be provided to customs.

Two special features:

• Instead of geocoordinates, MSPOs may specify the postal address of the production area or establishment, provided this clearly describes the geographical location.
• If a Member State provides the required data from national databases, the SD submission can be omitted.

The verification number: additional security layer, no obligation to pass it on

In addition to the reference number and declaration identifier, there is also the verification number. It serves as an additional security layer for the data stored in DDS and SD and allows their authenticity to be checked in the information system.

The decisive difference: There is no legal obligation to pass on the verification number along the supply chain (see FAQ No. 3.6.1 on EUDR). It only comes into play in a special case:

The actual lever of the verification number is access to the raw data: With a valid verification number and provided the submitter has authorized this in the system, downstream actors can view the stored geocoordinates or postal addresses of the production areas. This is precisely what makes it the decisive tool for substantiated concerns: it enables independent verification of whether the declared areas are plausible and deforestation-free.

This is therefore a reactive step, not a routine requirement in every delivery.

Who has to pass on or collect which number?

The duties can be summarized by role as follows:

Operator (including MSPO):

• Proactively forwards the reference number or declaration identifier to the first downstream operator or trader.
• Transmits the number to customs for import and export.
• No obligation to pass on the verification number.
• Keeps all due diligence documents, risk assessments and mitigation measures for 5 years after placing on the market.

First downstream operator or trader:

• Collects and retains the reference number or identifier received, passive obligation.
• Does not have to actively ask the supplier. If he does not receive a number, he may assume in good faith that his supplier is not an operator (FAQ No. 3.4).
• Requires an inbound process to assign incoming numbers to the correct products.
• In the case of non-SME status: registration in the information system; additional verification obligation in the event of substantiated concerns.
• Retention period: 5 years for supplier data, reference numbers and, if applicable, identifiers. A specific storage system is not prescribed. The decisive factor is that the data can be compiled at the request of the authorities within a reasonable period of time.

Subsequent downstream operators and traders:

• Collect supplier and customer data.
• No obligation to actively obtain reference numbers.
• Duty to inform in the event of breaches, duty to check in the event of substantiated concerns (non-SMEs only).
• Retention period 5 years for all supplier and customer data.

The complete due diligence obligations for all roles are described in detail in the article EUDR due diligence obligations for market participants and traders.

Examples from practice

Example 1 - Coffee roastery and wholesaler:

An EU micro-company imports green coffee beans (HS 0901) from a third country and does not qualify as an MSPO because it is not a primary producer. It is therefore an operator and must submit a DDS. He can appoint an authorized representative to submit the DDS, but the responsibility remains with him. He sells the roasted beans on to a large wholesaler and actively provides him with the DDS reference number. The wholesaler is the first downstream actor and collects the number, nothing more.

Example 2 - Timber supply chain with MSPO:

A small forest owner in a low-risk country in the EU cuts his own timber and sells raw wood (HS 4403) to a sawmill. He is an MSPO and submits a unique SD with a postal address instead of geocoordinates. He passes on the declaration identifier to the sawmill. The sawmill processes the logs into chipboard (HS 4410). As these are made from wood that is already SD-covered, the sawmill is the downstream operator: no DDS of its own, but collection of the identifier and - as a non-SME - registration in the information system. A downstream furniture manufacturer that installs the chipboard is also a downstream operator.

Example 3 - Cocoa via a non-EU operator:

A cocoa supplier not based in the EU places cocoa beans (HS 1801) on the EU market and is therefore the operator. A small EU buyer takes delivery of the goods. According to Art. 7 EUDR, this EU buyer is also considered an operator because it is the first actor in the chain based in the EU. There are therefore two operators with full due diligence obligations - one outside the EU and one inside the EU.

The article Raw materials and processing under the EUDR explains how the transitions between raw materials and processing work in detail.

Special case: Operator and downstream operator in one legal entity

In practice, it often happens that a company has both roles at the same time. A classic example: An EU manufacturing company imports raw wood from a third country (= operator for the import process) and processes it in-house into chipboard, which it supplies to a furniture manufacturer (= downstream operator for the processed product).

This results in a reduced duty of care: the full duty of care including DDS applies before import. When the chipboard is resold, only the reduced downstream obligations apply and the reference number of the company's own DDS is passed on to the furniture manufacturer.

The customs process

The numbers in the customs process

Customs decides whether compliance on paper also works operationally. The following information is required in every customs declaration for relevant goods:

• Customs tariff number incl. TARIC (10 digits for import, up to 8 digits for export)
• Quantity in kilograms Net weight
• TARIC document code, typically C716 ("Due diligence declaration available")
• Document number = reference number of the DDS or identifier of the SD (several numbers can be combined)
• Y-codes for exceptions (SME constellations, transitional periods, "ex" codes, recycled material), if applicable

Two important special cases:

• Export by a downstream operator: No DDS reference number needs to be specified here. Instead, a dedicated TARIC certificate code is used (see Art. 26(4) EUDR).
• Re-importation of previously exported EU goods: Anyone who can prove that a product has already been carefully checked on the EU market is considered a downstream operator and can use the conventional reference number 99EU999999999999 in the customs declaration. Customs declarations, contracts, delivery bills, CMRs, bills of lading or invoices can be used as proof. Without proof, the full operator obligation applies.

The information system (TRACES)

The central platform for DDS, SD and all associated numbers is the EUDR information system (TRACES).

Important to know:

• The system has been live since December 4, 2024, but was temporarily taken offline for revision and is expected to go live again in the second half of 2026.
• DDS and SD can be changed or withdrawn up to 72 hours after the reference number has been assigned, provided they have not yet been used in a customs declaration.
• A DDS file may be a maximum of 25 MB in size (more than 1 million geopoints).
• Registration takes place via EORI number, VAT ID, tax number or GLN.
• Only competent authorities and supply chain members who have reference and (if approved by the submitter) verification numbers have access to geodata.

Why clean handling of these numbers is crucial

Without a valid reference number or valid declaration identifier, a product will not be released at customs, except in the special constellations mentioned above. Anyone who is unable to obtain the required information (in particular geocoordinates) may not place the product on the market or export it. Failure to do so constitutes a breach of the EUDR.

The correct handling of the numbers is therefore not just a compliance exercise, but an operational prerequisite for any market access. It enables complete traceability back to the production area, which is the actual aim of the regulation.

The article EUDR requirements for sustainability managers provides practical tips for concrete implementation in the company.

The EUDR does not turn supply chain transparency into a recommendation, but rather a hard market access condition. Operators create a DDS or SD, receive a reference number or identifier and actively pass it on to the first downstream actor and to customs. If you are a downstream operator or trader, you collect these numbers, keep them and report any justified concerns - but do not actively request or carry out your own due diligence. The verification number remains an option for emergencies, not part of day-to-day business.

If you assign the roles, numbers and their routes correctly, you not only comply with the regulation, but also relieve your own supply chain of avoidable effort. The next step for every affected company is to check their own processes to ensure that inbound, storage and customs declarations fit together properly.

What happens in the event of violations

The EUDR does not rely on soft recommendations. Infringements, such as missing, incorrect or non-disclosed reference numbers, can be punished with the following sanctions in accordance with Art. 25 EUDR:

• Fines for legal entities: statutory maximum of at least 4% of the EU-wide annual turnover of the previous year
• Confiscation of the products concerned and/or the proceeds generated
• Temporary exclusion from public contracts and EU funding (up to 12 months)
• In the event of serious infringements: temporary ban on placing on the market
• Publication of final judgments against legal entities on a Commission list - naming and shaming with corresponding reputational consequences for customer and investor relationships

The specific amount and structure are determined by the member states at national level. In Germany, this is implemented via the Deforestation-Free Supply Chains Act (EUDR-DG).

Conclusion

The EUDR turns supply chain transparency into a hard market access condition. Operators create DDS or SD, receive a reference number or identifier and actively pass it on to the first downstream actor and to customs. Downstream operators and traders collect, store and report any reasonable concerns - they neither actively enquire nor carry out their own due diligence. The verification number remains a tool for emergencies, not for day-to-day business.

Those who check now whether inbound processes, storage and customs declarations fit together properly will create leeway until the application deadlines of December 30, 2026 and June 30, 2027. Those who wait not only risk fines, but also blocked shipments, which usually cost more than the preparation.