There is a common assumption in how importers discuss EUDR compliance: that the responsibility for geo-data accuracy sits with the supplier. The supplier collected the data. The supplier provided it. If something is wrong, it is the supplier's problem.
The regulation does not agree.
EUDR is explicit on this point — explicit enough that Version 5 of the FAQ addresses it in two separate questions. The operator, meaning the entity placing the product on the EU market, bears full legal responsibility for the accuracy of every piece of geo-data in every Due Diligence Statement they submit. Not the producer who grew the coffee. Not the exporter who shipped it. The importer who placed it on the EU market.
What the regulation actually says
FAQ 1.11 addresses the question directly: can an operator use the producer's geolocation data? The answer is yes — but with a condition that changes everything.
"It is the operator who is ultimately responsible for its accuracy and not the producer who provides it."
FAQ 1.12 goes further, addressing whether operators must verify the geo-data they receive:
"Ensuring the truthfulness and precision of geolocation information is a crucial aspect of the responsibilities that operators must fulfil. Providing incorrect information would constitute a breach of the obligations of operators under the Regulation."
Two sentences. Both unambiguous. The operator must verify. Incorrect information is a breach — regardless of where it came from.
What this means across the supply chain
EUDR defines the "operator" as the entity that places a relevant commodity or product on the EU market for the first time, or exports it. In a standard green coffee supply chain, that is the European importer.
The regulation does not distribute responsibility proportionally across the chain. It concentrates it at the point of market entry. Everyone upstream of the importer has obligations toward their own trading partners, but none of them bear the compliance burden that the importer carries under EUDR.
What "verification" means in practice
The FAQ does not define a specific verification methodology. It says the operator must verify and be able to prove that geolocation is correct. What constitutes sufficient verification is a matter of due diligence — and due diligence, by design, requires judgment proportional to risk.
What is clear is what verification is not. Receiving a geo-data file from a supplier and uploading it to a compliance tool is not verification. It is forwarding. The act of submission does not transfer responsibility — it confirms it.
An importer who submits a DDS containing incorrect geo-data has breached their obligations under the Regulation — whether or not they knew the data was incorrect, and whether or not the supplier provided it in good faith.
This is the structural logic behind why geo-data validation cannot be an afterthought. The importer is not a passive conduit for supplier data. They are the party who certifies, by submission, that the data is accurate. That certification carries legal weight.
The penalty attached to that responsibility
EUDR Article 25 requires EU Member States to establish penalties for non-compliance. The FAQ specifies a floor, not a ceiling:
"For legal persons the maximum level of the penalty cannot be lower than 4% of the operator's total annual Union-wide turnover in the financial year preceding the fining decision."
4% of EU-wide annual turnover. That is the minimum maximum — Member States may set higher penalties. The FAQ also specifies that fine levels should increase for repeated infringements, and that penalties must effectively deprive operators of economic benefits derived from non-compliance.
Beyond fines, the regulation provides for confiscation of non-compliant products and revenues derived from them, temporary exclusion from public procurement, and temporary prohibition from placing relevant products on the EU market.
For a mid-sized green coffee importer with €20 million in EU turnover, the minimum maximum fine exposure is €800,000 — per infringement, before any upward adjustment for repeat violations.
The geo-data gap this creates
Most green coffee importers currently receive geo-data from suppliers in one of two ways: as an attachment to shipping documentation at the point of export, or as a separate file submitted shortly before a DDS needs to be filed.
Neither of these workflows includes a verification step. The data arrives. It is formatted — or not. It is complete — or not. It is accurate — or not. In most cases, the importer has no way of knowing which, because no one has checked.
The regulation's answer to "can I use the supplier's data?" is yes. Its answer to "do I still need to verify it?" is also yes — emphatically, and with legal consequences attached.
FAQ 1.20 makes the enforcement mechanism explicit: competent authorities will cross-check geolocation coordinates against satellite images and forest cover maps. The DDS is not a declaration of intent. It is a verifiable claim. Authorities will verify it.
What responsible verification looks like
There is no single prescribed verification method under EUDR. The regulation operates on a risk-based due diligence model — more scrutiny for higher-risk supply chains, streamlined process for lower-risk ones. But certain baseline checks are implied by the obligation to ensure "truthfulness and precision."
- Format validation. Does the geo-data arrive in a format that the Information System can accept? GeoJSON is the only accepted upload format. A CSV file with coordinates has not been verified — it has not even been converted.
- Geometry type validation. Are farm polygons actually polygons, or are they point coordinates? A point submitted for a farm above 4 hectares is not a compliant record. The importer who submits it has certified that it is.
- Coordinate accuracy. Do the coordinates place the farm where the farm is supposed to be? Swapped latitude and longitude, comma decimal separators, coordinate transposition errors — these are common, detectable, and the importer's problem to catch.
- Completeness. Is geo-data available for every farm that contributed to the shipment? FAQ 1.20 is direct: if the operator cannot collect geolocation for all contributing plots, they should not place the product on the EU market.
- Deforestation overlay. Does the geo-data, once validated, pass a cross-check against the relevant forest cover maps? This is the final check — but it only produces meaningful results if the geo-data going into it is accurate.
None of these checks happen automatically when a file arrives from a supplier. Each one requires a process — and the importer is responsible for having that process.
The practical shift this requires
Understanding that responsibility sits with the importer, not the supplier, changes the relationship between the two. The importer is not a recipient of geo-data. They are its verifier — and ultimately, its guarantor.
This does not mean the importer must collect the data themselves. The FAQ explicitly acknowledges that operators can use producer-provided geo-data and can support suppliers through capacity building. What it means is that the importer must have a process for validating what they receive before they submit it.
The question is no longer "did we get the geo-data from the supplier?" It is "have we verified that the geo-data we received is accurate, complete, and submittable?"
Those are different questions. The first is answered by an email attachment. The second requires a validation process.
TraceBean is the validation step between supplier delivery and compliance tool submission. Every file processed receives a farm-level report identifying which records are compliant, which have been automatically corrected, and which require supplier follow-up — with a precise description of what is wrong and what the supplier needs to provide. The importer gets confirmation that what they submit has been checked. That confirmation is the foundation of a defensible due diligence process.
Source: European Commission, Frequently Asked Questions — Implementation of the EU Deforestation Regulation, Version 5, April 2026. FAQ 1.11, 1.12, 1.20, 3.11, 10.2.
← Back to Blog