FSC, RSPO and Rainforest Alliance: Do They Cover EUDR?

If your buyer has emailed asking for EUDR compliance documents, and you have replied by sending your FSC or RSPO certificate, you may be about to face a follow-up question you are not prepared for. Certification helps. It does not, by itself, satisfy the EU Deforestation Regulation.

This is not a technicality. The regulation is explicit about it, and the European Commission has confirmed it repeatedly. Understanding exactly what your certification covers, and where it stops, is what will determine whether your shipments clear customs and whether your buyer relationship holds.

---

What the EUDR Actually Says About Certifications

The regulation addresses certifications directly in Article 10(2) of Regulation (EU) 2023/1115. It says certifications or third-party verified schemes "may be taken into account" during the risk assessment phase of due diligence.

"May be taken into account" is not the same as "accepted as proof". Three conditions apply before a certification can even be used as supporting evidence:

1. The scheme must be verified by an independent third party.
2. Its scope must adequately cover the requirements being assessed.
3. It must address both the deforestation-free status and the legality of production.

Even when all three conditions are met, the legal responsibility for placing a compliant product on the EU market stays with you, the operator. Your certification body audits against its own standard. It does not audit against the EUDR's specific requirements around geolocation data, cut-off dates, or the full scope of local-law compliance the regulation demands.

The European Commission has made this clear in its published guidance. No certification scheme is recognised as a substitute for EUDR due diligence.

---

The Four Gaps That Apply to Every Scheme

1. No Plot-Level Geolocation

Every scheme studied fails to collect the geolocation data the EUDR requires. The regulation mandates GPS coordinates or polygon mapping for every product, traced back to the specific harvesting plot. FSC records forest management unit boundaries, but not at plot level. RSPO's traceability systems, even under Identity Preserved and Segregated models, do not produce the coordinate data the EUDR needs.

For Malaysian and Indonesian operators, this gap is non-negotiable. Under Commission Implementing Regulation (EU) 2025/1093, both countries are classified as standard risk. There is no simplified declaration available to you regardless of your business size. Precise geolocation data for every relevant harvesting plot is required.

2. Misaligned Cut-Off Dates

The EUDR's deforestation cut-off date is 31 December 2020. Products must be shown to come from land that was not subject to deforestation or forest degradation after that date. FSC's own deforestation-related provisions use different reference dates. RSPO's 2018 Principles and Criteria use a different baseline. No scheme has been designed to verify specifically against 31 December 2020.

3. Incomplete Legality Scope

The EUDR requires evidence of compliance with a broad range of local laws: land rights, labour law, environmental law, and third-party rights. Certification schemes audit against their own standards, which do not map directly onto the full list of legal requirements the regulation specifies. What FSC or RSPO auditors check for legality is not the same as what an EUDR due diligence statement must cover.

4. No Transfer of Operator Liability

When your supplier holds an FSC or RSPO certificate, that does not transfer any legal responsibility to the certification body. You placed the product on the EU market. You carry the liability. This is unchanged regardless of what certifications exist in your supply chain.

---

What Each Scheme Covers, and Where It Stops

The table below summarises the practical position for the certifications most relevant to Malaysian and Indonesian timber and palm oil exporters.

RSPO's Mass Balance and Book and Claim models are worth flagging separately. Under EUDR, every unit of product must be independently traceable to its origin. Mass Balance and Book and Claim permit mixing and crediting that the regulation's traceability requirements cannot accommodate. If your palm oil supply chain uses either of these models, your RSPO certificate will not support your due diligence statement.

---

Click to expand

What You Need to Do Alongside Your Certification

Your FSC or RSPO certificate is not wasted. Article 10(2) explicitly allows you to use it as supporting evidence during risk assessment. A certified supply chain is easier to document and easier to defend than an uncertified one. Use it as part of your due diligence, not instead of it.

Here is what you need to add:

1. Collect plot-level geolocation data from your suppliers for every harvesting area. This means GPS coordinates or polygon files, not general forest unit references. Start with your highest-volume suppliers first.
2. Verify the 31 December 2020 cut-off for each plot. Cross-reference supplier-provided information against satellite land-cover data for that date. Your certification does not do this for you.
3. Map your local-law compliance against the full scope the EUDR requires, including land rights, labour law, and environmental law, not just what your certification scheme audits.
4. Collect and retain due diligence reference numbers from upstream suppliers. As a downstream operator or trader, you must hold these for at least five years. You are not required to submit your own due diligence statement if products are already covered by an upstream statement, but you must be able to show the chain.
5. Document your risk assessment and mitigation steps in writing, including how your certification evidence was used and what independent steps you took to address the gaps.

The deadline for large and medium operators is 30 December 2026, under Regulation (EU) 2025/2650. Micro and small operators face a later deadline of 30 June 2027, but the same geolocation requirements apply to Malaysian and Indonesian businesses regardless of size, because neither country qualifies for the low-risk simplified declaration.

---

Common Questions

My buyer says my FSC certificate is enough for EUDR. Is that right? No. Your buyer may not yet understand the regulation fully. Article 10(2) allows FSC to be used as supporting evidence in your risk assessment, but it does not replace the requirement to collect geolocation data, verify the 31 December 2020 cut-off, and carry out a full due diligence process. If your buyer places your product on the EU market, they carry the liability. They will need your geolocation data and due diligence documentation regardless of your FSC status.

We have RSPO Identity Preserved certification. Does that cover the EUDR traceability requirement? Partly. IP and Segregated models provide better traceability than Mass Balance or Book and Claim, and this supports your risk assessment. However, RSPO's systems do not produce the plot-level GPS coordinates the regulation requires, and they do not verify against the 31 December 2020 cut-off date. You still need to collect that data separately.

Does the 2025 regulation change anything about how certifications are treated? No. Regulation (EU) 2025/2650 adjusted deadlines and simplified certain obligations for micro and small operators in low-risk countries. It did not change Article 10(2) or the Commission's position that no certification scheme substitutes for due diligence. The European Commission's simplification review, due by 30 April 2026, may update guidance on Annex I product definitions, but is not expected to grant formal recognition to certification schemes.

We are a small factory, not a large operator. Do we still need geolocation data? Yes, if you are in Malaysia or Indonesia. The simplified one-time declaration available to micro and small operators applies only to operators in formally low-risk countries. Neither Malaysia nor Indonesia has that classification under Commission Implementing Regulation (EU) 2025/1093. Your size affects your deadline, not your data requirements.

Can we use our certification to reduce the risk level we assign to a supplier? Yes, within limits. A supplier with FSC certification has more documented evidence of legal compliance and supply chain traceability than an uncertified supplier. You can take this into account when assessing risk level. However, you cannot treat certification alone as proof of deforestation-free status or use it to skip geolocation verification. The risk assessment must still be carried out, and the outcome must be documented.

---

GreenThread can help you identify exactly which EUDR gaps your current certifications leave open and build the documentation process to close them. Contact us to book a compliance gap review before your next buyer audit.

Next in this series: You now know what your certification covers and where it stops. The next step is understanding your actual role in the EUDR supply chain — and it is probably not what you think. Malaysian and Indonesian exporters do not file EU declarations. Your job is to build the Digital Data Passport that makes your EU buyer's filing possible. Read: You Are Not Filing the EU Declaration. Your Job Is to Build the Data Passport That Makes Your Buyer's Filing Possible