You buy from an EU importer. You’re still not exempt.

Last updated: 23 August 2026

First, make sure you’re actually downstream

The obligations in this guide are for buyers who purchase from an EU-established supplier who has already placed the goods on the market. If instead you import directly from a non-EU origin (even through an agent, and even if a European business handles the logistics) then you are the operator placing the goods on the market, and the full due-diligence and filing duty is yours. That distinction is the most consequential one in the whole regulation, and it is easy to get wrong; our three-question operator check settles it, and the pillar guide explains the operator-versus-downstream split in full.

If a non-EU supplier ships to you, the filing duty is almost certainly yours, regardless of your size. Confirm which side of the line you are on before you rely on anything below.

What a downstream buyer actually owes

Assuming you buy from an EU supplier who has done the filing, your duties are about information and record-keeping rather than about geolocation and screening:

• Collect the reference numbers. For the relevant goods you buy, you are entitled to (and must obtain) the reference number of the Due Diligence Statement your supplier filed.
• Satisfy yourself due diligence was done. You cannot simply assume it; you should be able to show you ascertained that the upstream statement exists and covers what you bought.
• Keep the records for five years. The reference numbers and the supporting information have to be retained and available for the standard five-year period.
• Pass them on. When you sell to the next business down the chain, you hand the reference numbers along, so the thread runs unbroken.

What you are generally not required to do, in this position, is re-collect plot geolocation or run your own deforestation screen: that work sits with the operator upstream. The larger and more complex your business, the more the regulation expects of you here; a very small buyer’s duty centres on holding and passing the references. Where exactly your business falls is worth confirming, because the line between a light and a fuller obligation depends on your size and role.

The reference number, and why it’s the whole game

When an operator files a DDS in TRACES, the system issues a reference number (paired with a verification number). That short string is the pointer to a specific, lodged due-diligence statement. For a downstream buyer it is the single most important artifact in the whole chain: it is your evidence that the goods you bought are covered, and it is what you pass to your own customers. Lose it, and you cannot demonstrate compliance even if everything upstream was done perfectly. We describe how these numbers are issued in the TRACES filing guide.

What an audit-ready record looks like

A Competent Authority carrying out a check does not want a promise; it wants to see the references, matched to the goods, retrievable on the spot. Audit-ready, in practice, means:

• Every relevant purchase mapped to the DDS reference (and verification) number that covers it.
• The numbers held in one place, not scattered across invoices, emails and PDFs.
• Each one checked: that it is well-formed, that it corresponds to the supplier and the goods, that it hasn’t been transposed or truncated in a spreadsheet.
• The whole set retained for five years and producible without a scramble.

Where small buyers get caught

The gap is rarely bad faith; it is bookkeeping. The reference numbers arrive buried in a supplier’s email or on a contract, get filed nowhere in particular, and are assumed to be “on record.” Two years later, in a check, they cannot be produced quickly or matched to the right lots, and an obligation that was genuinely light becomes a genuine problem.

This is the narrow, unglamorous job we handle for downstream buyers as an audit-readiness catalogue: we take in the reference numbers your EU suppliers give you, check each one is well-formed and matches the goods, and organise them into a single record that satisfies the five-year retention and is instantly producible if anyone asks. It is not the full Authorised-Representative service (you don’t need that if you’re truly downstream), but it closes the one gap that trips small buyers up. If you’re not certain which side of the operator line you’re on, start with the operator check; if you know you’re downstream, we can make your records audit-ready.