Who Must Comply: Operators, Downstream Operators, Traders, and MSPOs
Key takeaway
Four actor categories, four levels of obligation
When the EUDR was first published, the regulation talked about two kinds of obligated parties: operators and traders. Following the December 2025 amendment and the Commission's V5 FAQ (April 2026), there are now four recognised actor categories, each with a different level of obligation: operators, downstream operators, traders, and micro or small primary operators (MSPOs). Working out which category your organisation falls into is the first thing you have to do, because every other compliance step depends on it.
A Quick Map of the Four Categories
| Category | Who they are | Core obligation |
|---|---|---|
| Operator | The first person to place a relevant product on the EU market or to export it (importer, EU producer, EU manufacturer who first places the product) | Full due diligence + submit a Due Diligence Statement (DDS) before each placement on the market |
| Downstream operator | An operator further down the supply chain who transforms a product that has already been the subject of due diligence into another Annex I product (e.g. a chocolate maker buying EU-cleared cocoa butter) | Collect supplier information and DDS reference numbers; no new DDS required for the parts already covered |
| Trader | Anyone in the chain who makes a relevant product available on the EU market without transforming it (e.g. supermarkets, distributors). Non-SME traders carry operator-equivalent duties; SME traders carry only record-keeping duties. | Non-SME: full DDS. SME: keep DDS reference numbers from suppliers. |
| Micro or Small Primary Operator (MSPO) | A small farmer, forester, or rancher in a low-risk country who directly places onto the EU market the products they themselves produced | Submit a one-time Simplified Declaration (SD) instead of a full DDS; may use a postal address instead of geolocation coordinates |
The next sections explain each category and walk through how the same supply chain can contain several of them at once.
Operators: The Gatekeepers
An operator is any natural or legal person who, in the course of a commercial activity, places relevant products on the EU market or exports them. Operators are the primary obligated parties under the EUDR and carry the full due diligence burden:
- Establish and maintain a due diligence system covering information collection, risk assessment, and risk mitigation.
- Submit a Due Diligence Statement (DDS) through the EUDR Information System before each placement on the market or export.
- Keep all due diligence records and documentation for at least five years.
- If they are non-SMEs, publish annual reports on their due diligence systems.
The category is deliberately broad. It includes importers, manufacturers, producers, and processors. A Belgian chocolate manufacturer using Ghanaian cocoa is an operator. An Indonesian palm oil company exporting to Germany is an operator. A French furniture maker using French timber is also an operator, because EU domestic production is within scope.
Analogy
The operator is the gatekeeper
Think of the operator as the last checkpoint before a product enters the EU market or leaves it as an export. Just as a customs officer checks what comes through a border, the operator is legally responsible for ensuring that only deforestation-free, legally produced, and duly declared goods cross the threshold. The operator cannot simply pass this responsibility upstream to suppliers without also maintaining their own due diligence system.
Downstream Operators: The New Middle Layer
The downstream operator category, formally clarified in the V5 FAQ (April 2026), recognises that many companies further down the supply chain do not import or first-place products themselves; they buy goods that have already been EUDR-cleared by an upstream operator and transform them into another Annex I product. A French chocolate manufacturer buying EU-cleared Ghanaian cocoa butter to make chocolate bars is a downstream operator: the cocoa butter has already been covered by a DDS, and what the chocolate maker has to do is much lighter:
- Collect and keep the DDS reference numbers received from upstream suppliers, plus supplier identification information (name, address, registered trade name, web address if available). Records must be kept for five years.
- Pass on the reference numbers to their own downstream customers when those customers are themselves downstream operators or traders.
- Register in the EUDR Information System (only required for non-SME downstream operators).
- React to substantiated concerns: if a non-SME downstream operator becomes aware of a credible signal of non-compliance in the products they buy, they must verify that due diligence was properly exercised and stop placing the product if not.
Downstream operators do not have to submit a new DDS for the parts of the product that were already covered upstream. This is a deliberate simplification: the regulation does not want every link in a long manufacturing chain to repeat the same risk assessment on the same farm.
Worked example
When the same company is both an operator and a downstream operator
Company A imports raw timber from Brazil (HS 4403) and uses it to make sawn wood (HS 4407) which it sells to a furniture manufacturer in Italy. Both timber and sawn wood are Annex I products. Here, A wears two hats simultaneously: it is an operator when it imports the raw timber (it must submit a DDS at import), and it is a downstream operator when it sells the sawn wood made from that already-cleared timber to the Italian furniture maker (it does not need to submit a new DDS for the sawn wood, only keep the import DDS reference). It does not have to pass the import DDS reference number on to the Italian buyer for the sawn wood, because the upstream and downstream roles cancel out within the same legal entity. (FAQ 3.8, V5)
Traders: A Lighter Touch for SMEs
A trader is any person in the supply chain, other than the operator or downstream operator, who makes relevant products available on the EU market without transforming them into another Annex I product. Traders are typically distributors and retailers. The EUDR applies materially different obligations to traders depending on their size:
| Category | Obligation Level | Key Requirements |
|---|---|---|
| Non-SME traders | Operator-equivalent | Register in the EUDR IS; collect supplier information and DDS reference numbers; verify due diligence in case of substantiated concerns; publish annual reports |
| SME traders | Simplified | Collect and keep DDS reference numbers from suppliers; maintain five-year records |
A large supermarket chain selling chocolate is a non-SME trader. A small independent corner shop selling the same chocolate is an SME trader. Both ultimately rely on the operator's DDS, but the supermarket has to register in the EUDR IS, react to substantiated concerns, and publish an annual report; the corner shop simply keeps the reference numbers in its files.
MSPOs: The Smallholder Simplification
The micro or small primary operator (MSPO) is a new category formally introduced into the regulation by the December 2025 amendment. It exists to keep the regulation workable for very small primary producers, the typical example being a small farmer, forester, or rancher who places their own harvest directly on the EU market or exports it. To qualify as an MSPO, all four of the following must be true (FAQ 3.21, V5):
- The person is a natural person or a micro or small undertaking within the meaning of the EU Accounting Directive (2013/34/EU). Roughly: under 50 employees and under EUR 10 million net turnover.
- Their primary place of business or registered office is in a low-risk country under the EUDR benchmarking system.
- They directly place the product on the EU market or export it (no intermediaries upstream).
- The products are ones they produced themselves (grew, harvested, raised, or obtained on their own plots of land or establishments).
If all four conditions are met, the MSPO benefits from a substantially lighter regime:
- They submit a one-time Simplified Declaration (SD) instead of a full DDS for every shipment.
- They may use a postal address (street, zip code, city, country) instead of GPS geolocation coordinates of the plot of land.
- They can declare multiple relevant products and multiple plots in one SD.
The MSPO category recognises that asking a small Austrian forest owner who harvests every 30 years to submit a polygon-mapped DDS for every batch of logs would be disproportionate. A one-time SD with a postal address keeps such producers in the EU market without crushing them under paperwork. Lesson 1.5 walks through the MSPO regime in detail.
SME Status: The Exact Thresholds
SME status is defined by reference to the EU Accounting Directive (2013/34/EU). For EUDR purposes, the thresholds applied are:
| Category | Employees | Annual Turnover | Balance Sheet Total |
|---|---|---|---|
| Micro | Fewer than 10 | Not exceeding EUR 900,000 | Not exceeding EUR 450,000 |
| Small | Fewer than 50 | Not exceeding EUR 10 million | Not exceeding EUR 5 million |
| Medium | Fewer than 250 | Not exceeding EUR 50 million | Not exceeding EUR 25 million |
| Large | 250 or more | Exceeding EUR 50 million | Exceeding EUR 25 million |
A company qualifies as a non-SME if it exceeds at least two of the three thresholds for two consecutive financial years. The same two-year rule applies in reverse: a company only ceases to be a non-SME (or stops being an MSPO) once it has fallen below the thresholds for two consecutive years (FAQ 3.24, V5). This consecutive-year rule prevents companies from flipping in and out of categories due to a single unusual year.
Importantly, for company groups, each subsidiary is assessed individually under the EUDR, not as part of the group as a whole (FAQ 3.13, V5). This is different from many other EU sustainability laws that look at consolidated group figures. A small subsidiary of a large multinational can therefore qualify as an SME under the EUDR even if its parent does not.
Important: SME Operators Get No Discount on the Operator Side
A common misconception is that being an SME automatically reduces obligations for everyone. It does not. The simplified regime for traders applies to SME traders, not to SME operators. An SME that is an operator (placing products on the market for the first time, or exporting) must carry out full due diligence regardless of its size. The only exception is the MSPO category for primary producers in low-risk countries described above.
So a small cocoa importer with 30 employees buying cocoa beans directly from Cote d'Ivoire is an operator and must conduct full due diligence. Only when it sells those beans onward does the buyer become a downstream operator or trader. If that next buyer is also an SME and it transforms the cocoa into chocolate, it is a downstream operator with the lighter record-keeping obligation. If it is a large company, it is a non-SME downstream operator with the additional duties to register in the EUDR IS, react to substantiated concerns, and publish an annual report.
Worked example
A supply chain example: Brazilian soy to European pork
Brazilian soy exporter (operator): Collects geolocation data for all farms in its supply chain, conducts risk assessment, submits a DDS to the EUDR IS before shipping to the EU. Regardless of whether large or small, as the upstream operator it carries full obligations.
Dutch commodity trader (non-SME trader): Buys the soy from the Brazilian exporter and sells it on without transforming it. As a non-SME trader, it must register in the EUDR IS, keep the DDS reference number, react to any substantiated concern, and publish an annual report.
German animal feed manufacturer (downstream operator): Buys soy meal from the Dutch trader and turns it into compound feed (a different Annex I product). As a downstream operator, it does not have to submit a new DDS but must keep the upstream DDS reference numbers and pass them on to its own clients if they are themselves downstream operators or traders.
Small German pig farm (SME trader): Buys the feed and uses it to raise pigs (pork is not in Annex I). The farmer simply keeps the DDS reference number on file for five years and has no further EUDR obligation.
Penalties and the Application Timeline
Large and medium operators, downstream operators, and traders are subject to the regulation from 30 December 2026. Micro and small operators (and SME traders) have until 30 June 2027. Both timelines were extended from earlier dates following the application date amendment of December 2024.
Non-compliance exposes operators to significant penalties. Member States set specific penalty structures, but the EUDR mandates minimum standards including maximum fines of at least 4% of annual EU-wide turnover, confiscation of non-compliant products and associated revenues, temporary exclusion from public procurement processes, and temporary prohibition from placing products on the EU market.
Article 7 EUDR, as updated in V5, recognises that a non-EU company that places a product on the EU market is itself an operator under the regulation. In addition, the first EU-established person who makes the product available on the market is also an operator under Art. 7. So in a typical import chain, there are two operators in the meaning of the regulation: one outside the EU and one inside.
Non-EU operators only get access to the EUDR Information System if they have a valid EORI number issued by an EU Member State (or by the United Kingdom in respect of Northern Ireland). Otherwise they need to mandate an EU-established authorised representative (Art. 6 EUDR) to submit DDS on their behalf. Either way, contractual cascade is unavoidable: the EU-side operator can only comply with its own due diligence obligations if its non-EU supplier provides geolocation data and evidence of deforestation-free production, so EUDR compliance clauses become standard in supplier contracts whether or not the non-EU producer is formally obligated.
Note the consumer carve-out (FAQ 3.19, V5): an EU consumer who buys a relevant product online from outside the EU for purely private use is never an operator under the EUDR, even if they are listed as the importer on the customs declaration. The placing on the market is done by the seller, not the consumer.
Key Takeaways
- The EUDR now recognises four actor categories: operators, downstream operators, traders (SME and non-SME), and micro/small primary operators (MSPOs). Working out which one applies is the first compliance step
- Operators carry the full burden: due diligence system, DDS submission before each placement, and annual reporting if non-SME. Importers, EU producers, and EU first-placers all qualify
- Downstream operators (formally clarified in V5) are companies that transform an already-cleared Annex I product into another Annex I product. They keep DDS reference numbers and pass them on, but do not need to submit a new DDS for the parts already covered upstream
- Traders distribute or retail without transforming. SME traders only need to keep reference numbers; non-SME traders register in the EUDR IS and take on operator-equivalent duties
- MSPOs are small primary producers in low-risk countries who place their own harvest directly on the EU market. They submit a one-time Simplified Declaration with a postal address instead of a full DDS with geolocation. See lesson 1.5
- SME status is per legal entity, not per group: a small subsidiary of a large multinational can still be an SME under the EUDR. Status only changes after two consecutive financial years above or below the thresholds
- Large and medium actors apply from 30 December 2026; small and micro actors (and SME traders) from 30 June 2027
- Non-EU sellers placing products on the EU market are themselves operators under Art. 7 EUDR; they need an EORI number or an EU-established authorised representative to submit DDS
Knowledge Check
Test what you just learned
3 questions · check each one as you go
A company with 35 employees and EUR 8 million annual turnover imports coffee directly from Ethiopia and places it on the EU market for the first time. What are its EUDR obligations?
What is the minimum penalty level that EU Member States must be able to impose on non-compliant operators under the EUDR?
Under the EUDR, a large Dutch retailer sells chocolate bars in its stores. It does not import cocoa; it buys finished chocolate from a Belgian manufacturer. What category does the retailer fall into?