Malaysia Is Standard Risk. No Shortcuts, No Simplified Declarations — Here Is What That Means for Your Timber Business.

Last updated: April 2026. This article reflects Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650. The European Commission is required to publish an additional simplification package by 30 April 2026, which may include revised product scope guidance and updated FAQ. This guide reflects confirmed law only. Regulatory positions may evolve — verify current obligations with qualified legal or compliance counsel.

Key takeaways

• Wood products entering the EU must be proven deforestation-free from land not cleared after 31 December 2020. Your buyer cannot accept them without that proof from 30 December 2026.
• Malaysia is classified as standard risk under Commission Implementing Regulation (EU) 2025/1093. Full due diligence obligations apply to your business regardless of company size.
• The simplified postal-address declaration available to micro and small operators in low-risk countries does not apply to Malaysian exporters. Precise GPS coordinates are required for every timber harvest plot.
• Medium, large, and any other operator placing wood products on the EU market for the first time faces a compliance deadline of 30 December 2026.
• Micro and small enterprises have until 30 June 2027 — but European buyers will request your documentation before that date. Orders are already at risk.
• FSC Chain of Custody certification alone is not accepted as sufficient evidence of deforestation-free status. Plot-level geolocation data is still required.

---

A buyer has emailed you. The subject line reads: "EUDR compliance — please confirm your documentation."

European importers are now requesting GPS coordinates, deforestation-free declarations, and due diligence reference numbers from their Malaysian suppliers. Many are doing so well ahead of the enforcement deadline because they need time to build their own compliance systems. If you cannot provide what they are asking for, they will find a supplier who can.

Regulation (EU) 2023/1115 — the EU Deforestation Regulation — is confirmed law. From 30 December 2026, any company placing wood products on the EU market must prove those products are deforestation-free and were produced in compliance with the laws of the country of origin. The regulation covers timber, plywood, wood panels, furniture, paper, and a wide range of other wood-derived products. If your products reach European buyers, this regulation applies to you.

This guide explains what the EUDR requires, how it applies specifically to Malaysian wood businesses, what your obligations are under confirmed law, and what you need to do before your deadline.

Table of contents

• What the EUDR requires and which products are in scope
• Whether EUDR applies to your Malaysian business
• What Malaysia's standard-risk classification means for your obligations
• What you are required to collect and submit
• Your compliance deadline and where you stand now
• Five steps to build your due diligence system
• Common mistakes Malaysian exporters make
• FAQ

---

What the EUDR requires and which products are in scope

Regulation (EU) 2023/1115 came into force in June 2023. It replaced the EU Timber Regulation, which since 2013 had addressed only illegally harvested timber. The new regulation goes considerably further: it applies to all deforestation linked to seven commodities, whether that deforestation was legal or illegal under the originating country's laws.

The seven regulated commodities are wood, cattle, soy, palm oil, cocoa, coffee, and rubber. Each commodity comes with a defined list of derived products that are also in scope. For the wood sector, Annex I of Regulation (EU) 2023/1115 covers sawn timber, veneer, plywood, particle board, oriented strand board, medium-density fibreboard, pulp, paper, paperboard, printed products, and furniture, among other product categories. If your business manufactures or exports any of these, you are in scope.

The regulation has one non-negotiable requirement at its centre: products can only be placed on the EU market if the land from which they originated was not deforested or forest-degraded after 31 December 2020. This cut-off date is fixed. It does not change based on company size, certification status, or country of origin, and it was not altered by the 2025 amendments under Regulation (EU) 2025/2650.

Definition: Under Article 2(4) of Regulation (EU) 2023/1115, forest degradation means changes that reduce the structure, function, or species composition of a forest without the land being fully cleared. A concession where significant canopy loss occurred through selective logging after 31 December 2020 may be classified as degraded even if it was not converted to another land use. This distinction is directly relevant to Malaysian timber concessions where partial harvesting has taken place since 2020.

---

Whether EUDR applies to your Malaysian business

The regulation applies to any party that places regulated products on the EU market for the first time, or that exports them from the EU. This includes non-EU companies such as Malaysian manufacturers and exporters. You do not need a registered entity in Europe for the EUDR to affect your commercial operations.

The regulation is likely to apply to your business if any of the following describe your situation:

• You export wood products directly to buyers in the EU.
• You sell to a trading company in Malaysia, Singapore, or elsewhere that supplies the EU market.
• Your products are components incorporated into goods assembled and sold in Europe, such as furniture parts, panel products, or flooring.
• You supply a brand or retailer whose finished products are sold to European consumers.

The point many Malaysian suppliers have not fully absorbed is this: your European buyers cannot complete their own compliance without your data. The EU importer is legally responsible under Regulation (EU) 2023/1115, Article 4(1) for filing a due diligence statement before placing goods on the market. To do that, they need GPS coordinates, harvest dates, and legality documentation from every supplier in the upstream chain. If you cannot provide that information, you are creating a compliance gap for your buyer — and that gap immediately becomes a commercial risk for you.

---

What Malaysia's standard-risk classification means for your obligations

How the risk classification system works

Under Commission Implementing Regulation (EU) 2025/1093, effective 30 June 2025, every country where regulated commodities are produced is assigned a risk classification: low, standard, or high risk. The classification directly determines the level of due diligence an operator must carry out and whether any simplified pathways are available.

Operators sourcing from low-risk countries benefit from meaningfully reduced obligations. Micro and small primary operators established in low-risk countries may file a simplified one-time declaration using a verifiable postal address rather than precise GPS coordinates for each harvest plot.

Malaysia is classified as standard risk. So is Indonesia. Neither country qualifies for any simplified pathway based on country classification.

What standard risk means in practice

Standard-risk classification means full due diligence applies to every shipment. There is no simplified declaration option available to Malaysian exporters or their EU buyers, regardless of company size. The postal-address exemption does not apply. Every harvest plot from which timber originates must be documented with precise GPS coordinates — either as a polygon or as a set of coordinate points — sufficient to identify the plot as required under Regulation (EU) 2023/1115, Article 9(1)(d).

This is the obligation that catches most Malaysian exporters off guard. A concession licence number, a Forest Management Unit identifier, or an FSC certificate number does not substitute for plot-level geolocation data. These documents may support your legality evidence package, but they do not satisfy the geolocation requirement.

For Malaysian exporters, the key implication of this table is unambiguous: there is no administrative shortcut available based on where you are located. Full geolocation and due diligence documentation is required for every consignment.

---

What you are required to collect and submit

Geolocation data

Regulation (EU) 2023/1115, Article 9(1)(d) requires that due diligence statements include the geolocation of all plots of land where the relevant commodities were produced. For timber originating in Malaysia, this means GPS coordinates — either polygon boundaries or point coordinates — for each harvest area from which your timber was extracted. The coordinates must be precise enough to identify the actual plot.

A single polygon covering an entire Forest Management Unit or concession area does not satisfy this requirement. The obligation is at the harvest-plot level. If your timber comes from multiple compartments within a concession, each compartment that was harvested must be individually documented.

Legality documentation

Under Article 9(1)(c) of the EUDR, operators must collect evidence that the product was produced in compliance with the relevant legislation of the country of origin. For Malaysian timber, this typically includes:

• A valid felling licence or annual coupe allocation
• Transport and movement documents (Form Q or equivalent under the relevant state forestry authority)
• Chain of custody documentation linking harvested logs to your processing facility

Your FSC or MTCC certificate supports the legality case, but it does not replace the underlying statutory documents. Buyers and auditors will want to see the originating licences, not just the certification status.

Deforestation-free assessment

You must be able to demonstrate that the land from which your timber originated had not been deforested or forest-degraded after 31 December 2020. In practice, this means comparing the GPS coordinates of your harvest plots against satellite-derived deforestation monitoring data for that date range. Your EU buyer's compliance platform will typically perform this check — but only if you have provided the correct coordinates.

The most important implication of this table is that no single document covers all four evidence categories — you will need to gather and organise documentation from multiple sources across your supply chain.

---

Your compliance deadline and where you stand now

Regulation (EU) 2025/2650, which entered into force on 26 December 2025, confirmed the following deadlines:

• 30 December 2026 — the compliance date for large operators and for any operator placing regulated products on the EU market for the first time, regardless of size.
• 30 June 2027 — the compliance date for micro and small operators as defined by Directive 2013/34/EU, established on or before 31 December 2024.

The micro and small operator definition under Directive 2013/34/EU refers to balance sheet total, net turnover, and average number of employees. Many Malaysian SME exporters will meet this threshold — but the later deadline should not be treated as breathing room.

Important: European importers are building their own compliance systems now, ahead of their 30 December 2026 deadline. Their internal supplier data collection windows typically close six to twelve months before the regulatory deadline. If you are a micro or small exporter and your buyer is a large EU importer, your buyer's deadline — not yours — governs when they need your documentation. Waiting until mid-2027 to act risks losing orders in 2025 and 2026.

The most critical implication here is that if you supply a large EU importer, your effective deadline is defined by their compliance programme — which may already have passed.

---

Five steps to build your due diligence system

The following steps apply to a Malaysian wood product exporter building a due diligence system from scratch. If you already have elements in place, use these steps to identify the gaps.

1. Map your timber supply chain back to harvest plot level. Identify every concession, licence area, and compartment from which your timber originates. Obtain the GPS coordinates or polygon boundaries for each harvest plot, not just the concession boundary. If you source from multiple suppliers, require this data from each of them as a condition of purchase. If a supplier cannot provide plot-level coordinates, that supply source creates a compliance gap you cannot paper over.

2. Collect the statutory legality documents for each source. Obtain copies of the felling licences, annual coupe approvals, transport permits, and any other documents issued by the relevant state forestry authority. These documents must correspond to the specific harvests that produced your export batches. Generic or outdated documents will not satisfy an audit.

3. Match your product descriptions to Annex I of Regulation (EU) 2023/1115. Confirm that each product you export to the EU is listed in Annex I. Map your internal product descriptions and HS codes to the Annex I categories. If you are uncertain whether a specific product is in scope — for example, engineered wood components or composite panels — obtain a formal legal opinion rather than assuming you are out of scope.

4. Establish a record-keeping system that meets the five-year retention requirement. Under Regulation (EU) 2023/1115, Article 10(2), due diligence records must be retained for a minimum of five years. This includes all geolocation data, legality documents, risk assessments, and due diligence statements. The system does not need to be digital, but it must be structured so that any consignment can be traced and documented on request.

5. Respond to buyer questionnaires with a structured data package. When your buyer requests EUDR documentation, provide a consistent, structured package rather than ad hoc responses. Include: the GPS coordinates for each harvest plot linked to the relevant consignment; the corresponding felling licences and transport documents; your HS codes; and a statement of the applicable Malaysian forestry laws your timber was produced under. A consistent format reduces back-and-forth and positions you as a reliable supply chain partner.

---

Common mistakes Malaysian exporters make

Treating FSC certification as a substitute for geolocation data. FSC Chain of Custody certification demonstrates that your internal chain of custody meets FSC standards — it does not provide the EU importer with the GPS coordinates they are required to record under Article 9(1)(d) of Regulation (EU) 2023/1115. Your FSC certificate belongs in the legality evidence package, not in place of geolocation data.

Submitting a concession boundary polygon instead of harvest-plot coordinates. The EUDR requires plot-level geolocation data. A single polygon representing an entire Forest Management Unit or timber licence area may cover tens of thousands of hectares. Submitting that boundary does not tell your buyer which specific areas within the concession were harvested, or whether those specific areas were deforestation-free after 31 December 2020.

Assuming the 30 June 2027 deadline applies to your situation. The extended deadline is available only to micro and small operators as defined by Directive 2013/34/EU. Even if your business qualifies, your European buyer — who may be a large operator — faces the 30 December 2026 deadline and will require your documentation before their own deadline. The buyer's internal data collection window, not the regulatory deadline, determines when you need to act.

Collecting documentation at the wrong level of the supply chain. If you purchase timber from a domestic trader rather than directly from a concession, you need to look through the trader to the original harvest data. A purchase invoice from a timber merchant does not satisfy the traceability requirement. The documentation chain must reach back to the forest plot itself.

Waiting for formal buyer requests before starting data collection. Tracing GPS coordinates retrospectively — for harvests that took place months or years ago — is significantly more difficult than collecting data in real time. Malaysian timber concessions that harvested between 2021 and 2024 may require you to work backwards through multiple intermediaries and state authority records. Starting this process now, before you receive a formal buyer request, gives you far more control over the outcome.

---

FAQ

Does EUDR apply if I sell to a Singapore trading company, not directly to Europe?

Yes. If the goods ultimately enter the EU market, the regulation applies regardless of how many intermediaries are between you and the final importer. Your Singapore buyer will pass on your documentation obligations to their EU customers. If you cannot provide plot-level GPS data and legality documents, the Singapore trader cannot provide them to their buyer either — and the shipment cannot legally enter the EU market from 30 December 2026. In practice, Singapore-based traders are already requesting this documentation from Malaysian suppliers.

My timber comes from a state forestry concession with a valid licence. Is that enough?

No. A valid felling licence is a necessary part of the legality evidence, but it does not satisfy the full due diligence requirement under Regulation (EU) 2023/1115. You also need plot-level GPS coordinates for the specific harvest areas, a deforestation-free assessment verifying that those plots were not deforested after 31 December 2020, and a properly documented chain of custody linking the harvest to your export consignment. The licence is one component of a four-part evidence package.

Can I use MTCC or MSPO certification instead of collecting GPS data?

No. MTCC and MSPO certification schemes provide evidence relevant to sustainable forest management and legality under Malaysian law, and they may strengthen the legality component of your due diligence. However, neither scheme was designed to generate the plot-level geolocation data required under Article 9(1)(d) of Regulation (EU) 2023/1115. Certification status and geolocation evidence serve different functions in the due diligence system. Both are needed.

What happens if I cannot get GPS coordinates from one of my timber suppliers?

A supply chain where you cannot obtain plot-level coordinates from an upstream supplier is a supply chain you cannot use to supply the EU market — at least until the gap is resolved. Under Regulation (EU) 2023/1115, Article 8(1), operators must not place products on the EU market if the due diligence process identifies a non-negligible risk that the product does not comply with the regulation. Inability to geolocate a source constitutes a compliance gap. Your options are to work with the supplier to collect the required data, source from a supplier who can provide it, or accept that those products cannot be directed at the EU market.

Is there any way to get an exemption if my business is very small?

There is no blanket exemption for small businesses supplying from standard-risk countries like Malaysia. Regulation (EU) 2025/2650 extended the compliance deadline for micro and small operators to 30 June 2027, but it did not reduce the substantive obligations. Full due diligence — including GPS coordinates and legality documentation — is still required. The only simplification available to micro and small operators applies to businesses in low-risk countries, which Malaysia is not.

---

Next step

If you have received a buyer questionnaire and are not sure whether your current documentation meets the requirements, GreenThread can review your supply chain data and identify the gaps before your buyer does. [Book a GreenThread EUDR Advisory consultation] to get a structured assessment of what you have, what you are missing, and what to collect first.

Next in this series: You now know what standard-risk means and what documentation is required. The next question most Malaysian exporters ask is: "Does my FSC or RSPO certification cover any of this?" The answer is more nuanced than a simple yes or no — and understanding the gaps could save you from a costly assumption. Read: Your FSC or RSPO Certificate Will Not Satisfy EUDR. Here Is Exactly What Is Still Missing