Controls and sanctions
Country benchmarking system (standard/high/low risk), competent authority controls, corrective measures and sanctions.
Country benchmarking system (Article 29)
One of the most distinctive features of the EUDR is the country benchmarking system established by Article 29. The Commission classifies countries (or parts thereof) into three risk categories, which directly determine the intensity of controls applied to products originating from those countries.
Risk categories and control rates
| Risk category | Minimum control rate (operators) | Minimum control rate (traders) | Simplified due diligence |
|---|---|---|---|
| Low risk | 1% of operators | 1% of traders | Available (Art. 13) |
| Standard risk | 9% of operators | 9% of traders | Not available |
| High risk | 18% of operators | 18% of traders | Not available |
These percentages refer to the proportion of operators and traders whose due diligence statements are subject to detailed checks by competent authorities during any given year. The percentages also apply as a minimum share of the quantity of relevant commodities placed on the market.
Benchmarking criteria
Article 29(3) specifies the criteria for country classification:
Environmental criteria:
- Rate of deforestation and forest degradation (national and sub-national)
- Rate of expansion of agricultural land for relevant commodities
- Production trends for relevant commodities and derived products
Governance criteria:
- National and sub-national policies on deforestation, forest conservation, and sustainable forest management
- Enforcement capacity and effectiveness of relevant legislation
- Level of corruption (Transparency International Corruption Perceptions Index)
- Ratification and implementation of international agreements (Paris Agreement, CBD, CITES)
Supply chain criteria:
- Availability of traceability data and supply chain transparency
- Engagement with the EU on EUDR implementation
- Existence of national-level deforestation monitoring systems
Current status (April 2026)
The Commission has not yet published the definitive country benchmarking. A preliminary assessment was shared with Member States in late 2025, but the final classifications have been delayed. Until publication:
- All countries are treated as standard risk by default
- The 9% minimum control rate applies universally
- Simplified due diligence (Article 13) is not yet available in practice
The delay has been criticised by both industry (which needs clarity for planning) and producing countries (which have invested in reforms to qualify as low risk). The Commission has indicated that the first benchmarking will be published "in the first half of 2026."
Sub-national differentiation
Article 29(2) allows the Commission to classify parts of countries at different risk levels. This is particularly relevant for large, diverse countries:
- Brazil: the Amazon biome may be classified differently from the Cerrado or southern agricultural regions
- Indonesia: Kalimantan and Sumatra (high deforestation) vs. Java (low deforestation)
- Democratic Republic of Congo: eastern provinces (conflict areas) vs. western provinces
Sub-national benchmarking provides a more targeted approach but adds complexity for operators who must verify the specific region of production, not just the country.
Competent authorities (Articles 14-19)
Designation and responsibilities
Each Member State must designate one or more competent authorities responsible for the application and enforcement of the EUDR (Article 14).
Key competent authorities by Member State:
| Member State | Designated authority | Notes |
|---|---|---|
| France | DGCCRF + DGDDI | DGCCRF (market surveillance), DGDDI (customs controls) |
| Germany | BMEL (coordination) + Laender | Federal + state enforcement |
| Netherlands | NVWA | Food and Consumer Product Safety Authority |
| Belgium | FPS Health + Customs | Federal Public Service |
| Italy | MASAF | Ministry of Agriculture |
| Spain | MITECO + AEAT | Environment ministry + customs |
Powers of competent authorities
Article 18 grants competent authorities broad powers:
- Access to documents: request and obtain any document or record related to due diligence, including supplier contracts, geolocation data, satellite imagery analyses, and risk assessments
- Inspections: conduct on-site inspections of operators' and traders' premises, warehouses, and supply chain infrastructure
- Sampling and testing: take samples of products for laboratory analysis (e.g., isotope testing for origin verification, DNA analysis for species identification)
- Satellite verification: access satellite imagery to independently verify the deforestation-free status of plots identified in due diligence statements
- Information system access: query the EUDR information system for due diligence statements, cross-reference with customs data, and coordinate with other Member States' authorities
Risk-based control plans
Article 16 requires competent authorities to establish annual control plans specifying:
- The total number and percentage of operators and traders to be checked
- The methodology for selecting operators and traders for checks (risk-based criteria)
- The types of checks to be performed (documentary, on-site, satellite-based)
- The resources allocated to EUDR enforcement
- Coordination mechanisms with customs authorities and other Member States
Control plans must be submitted to the Commission and are subject to review. The Commission may issue recommendations if it considers that a Member State's enforcement is insufficient.
Controls and verification (Articles 19-22)
Types of controls
Competent authorities employ three types of controls:
1. Documentary checks:
- Verification of the due diligence statement's completeness and coherence
- Cross-referencing geolocation data with satellite imagery
- Checking the consistency of quantity, CN code, and country of production data
- Verification that the risk assessment methodology is adequate
2. Physical controls:
- On-site inspection of operator/trader premises
- Verification of product traceability systems and record-keeping
- Sample collection for laboratory analysis
- Verification of supply chain documentation (invoices, shipping documents, contracts)
3. Advanced verification:
- Independent satellite imagery analysis of declared geolocation coordinates
- Isotope ratio testing to verify geographical origin
- DNA testing for species identification (e.g., wood species, rubber origin)
- Supply chain auditing through third-country cooperation mechanisms
Enhanced scrutiny triggers
Competent authorities must apply enhanced scrutiny when:
- A due diligence statement concerns products from a high-risk country or region
- A substantiated concern has been raised (see below)
- Previous checks revealed non-compliance by the same operator or trader
- There are inconsistencies between the due diligence statement and customs declaration data
- The operator is newly registered and has limited compliance history
- Whistleblower information suggests potential non-compliance
Provisional measures and corrective actions (Articles 23-24)
Provisional measures (Article 23)
When a competent authority has reasonable grounds to suspect non-compliance, it may impose provisional measures:
- Seizure of the relevant commodities or products
- Prohibition of placing on the market or making available on the market
- Suspension of customs clearance
- Immediate withdrawal of products already on the market
Provisional measures are temporary and must be confirmed, modified, or lifted following a full investigation. The operator has the right to be heard before permanent measures are imposed.
Corrective actions (Article 24)
When non-compliance is confirmed, competent authorities must order corrective actions:
- Withdrawal of non-compliant products from the market
- Recall of products already distributed to end consumers
- Donation of seized products to charitable or public interest purposes (where safe and appropriate)
- Destruction of products that cannot be otherwise disposed of
- Prohibition of placing further products on the market until compliance is demonstrated
The operator bears the costs of corrective actions (withdrawal, recall, storage, destruction).
Penalties (Article 25)
Article 25 requires Member States to establish effective, proportionate, and dissuasive penalties for violations. The regulation sets minimum standards:
Mandatory penalty types
| Violation | Minimum penalty framework |
|---|---|
| Placing non-compliant products on the market | Fines proportionate to environmental damage and economic benefit obtained |
| Failure to submit due diligence statement | Fines + product seizure |
| Providing false information in a due diligence statement | Fines + potential criminal proceedings |
| Failure to cooperate with competent authorities | Fines + enhanced scrutiny |
| Repeated non-compliance | Increased fines + temporary exclusion from public procurement + ban on placing products on the market |
Financial penalties
Article 25(2) establishes that fines must be:
- At least 4% of the operator's annual turnover in the EU for the most serious violations
- Calculated based on the environmental damage, the economic benefit obtained from the violation, and the gravity and duration of the infringement
- Adjusted for mitigating factors (cooperation, self-reporting, corrective actions taken) and aggravating factors (deliberate non-compliance, repeated violations, obstruction)
Additional penalties
Member States may also impose:
- Temporary exclusion from public procurement procedures
- Prohibition on placing products on the market for a specified period
- Confiscation of revenues derived from non-compliant transactions
- Criminal penalties for deliberate fraud or systematic non-compliance (at Member State discretion)
Comparison with other EU penalty frameworks
| Regulation | Maximum fine | Benchmark |
|---|---|---|
| EUDR (1115/2023) | 4%+ of EU turnover | Most serious violations |
| GDPR | 4% of global turnover | Most serious violations |
| CBAM (956/2023) | 3-5x certificate value | Non-surrender of certificates |
| CSDDD | 5% of worldwide net turnover | Failure of due diligence |
Substantiated concerns (Article 31)
Article 31 establishes a mechanism for any natural or legal person to submit substantiated concerns to competent authorities:
Who can submit
- NGOs and civil society organisations
- Indigenous peoples and local communities
- Journalists and media
- Competitors (industry whistleblowing)
- Employees and former employees of operators
- Any member of the public with relevant evidence
Requirements for a substantiated concern
The concern must be:
- Substantiated: supported by objective, verifiable evidence (not mere suspicion)
- Specific: identifying the operator, product, or supply chain in question
- Relevant: relating to non-compliance with the EUDR (deforestation, legality, due diligence failures)
Authority obligations
When a substantiated concern is received, the competent authority must:
- Acknowledge receipt within a reasonable time
- Assess the concern and determine whether an investigation is warranted
- Inform the person who submitted the concern of the outcome
- Take appropriate action if the concern is justified (checks, provisional measures, penalties)
Protection against retaliation
Article 31(4) requires Member States to ensure that persons submitting substantiated concerns are not subject to retaliation. This aligns with the EU Whistleblower Protection Directive (2019/1937).
Access to justice (Article 32)
Article 32 ensures that persons affected by EUDR enforcement decisions have access to effective judicial review. This includes:
- Operators and traders subject to penalties or corrective actions
- Persons who submitted substantiated concerns that were not adequately addressed
- Third parties whose rights are affected by enforcement measures
Controls and sanctions preparedness checklist
Frequently Asked Questions
- What control rate applies to my imports right now?
- Until the Commission publishes the definitive country benchmarking, all countries are treated as standard risk. This means the competent authority in your Member State must check at least 9% of operators and 9% of the quantity of relevant commodities placed on the market. Your individual probability of being checked depends on risk factors such as the country of origin, your compliance history, and any substantiated concerns.
- Can I be fined even if the deforestation occurred without my knowledge?
- Yes. The EUDR imposes strict liability on operators. The obligation is to exercise due diligence and ensure that products are deforestation-free. If a product turns out to originate from deforested land, the operator is liable regardless of intent. However, the penalty amount may be reduced if the operator demonstrates that it exercised adequate due diligence and the failure was not attributable to negligence or deliberate conduct. The key defence is a robust, documented due diligence system.
- What is the maximum fine for EUDR non-compliance?
- Article 25(2) sets a minimum floor of 4% of the operator's annual EU turnover for the most serious violations. Member States may set higher penalties in their national transposition. The actual fine depends on the environmental damage caused, the economic benefit obtained, the gravity and duration of the infringement, and any mitigating or aggravating factors.
- Can NGOs force an investigation by submitting a substantiated concern?
- Article 31 requires competent authorities to assess all substantiated concerns and take appropriate action if warranted. The authority is not obligated to launch a full investigation based on every submission, but it must respond and explain its decision. If the person who submitted the concern considers the response inadequate, they have access to judicial review under Article 32.
- Will a low-risk country classification mean no checks at all?
- No. Even for low-risk countries, the minimum control rate is 1% of operators and 1% of the quantity of relevant commodities. Simplified due diligence (Article 13) reduces the procedural burden for operators but does not eliminate it. Operators must still collect Article 9 information (including geolocation data) and submit a due diligence statement. The simplified regime exempts them from the full risk assessment and mitigation steps, not from the information collection and declaration requirements.