EUDR and financial institutions: are lenders in scope?

No. The EUDR regulates operators and traders who place or make available cattle, cocoa, coffee, oil palm, rubber, soya, wood and their derivatives on the EU market — not the banks that lend to them or the investors who hold their shares. A review clause requires the Commission to assess whether that should change, but as things stand, financing a business is not itself a regulated activity under Regulation (EU) 2023/1115. That does not mean lenders and investors carry no exposure.

Why financing is not a regulated activity

Article 2 of the EUDR defines an operator as whoever places a relevant product on the EU market or exports it, and a trader as anyone in the supply chain, other than the operator, who makes a relevant product available on the market in the course of a commercial activity. Both definitions turn on physical control of the product — who is putting cocoa, timber or rubber into EU commerce. Extending credit to that business, buying its shares or bonds, or underwriting its insurance does not meet either definition, however central the financing is to the deal going ahead.

This is a deliberate omission, not an oversight. During the EUDR's negotiation, the European Parliament pushed to bring banking, investment and insurance activities within scope directly, with a test requiring lenders to find no more than a negligible risk of supporting deforestation before extending finance. That provision did not survive into the final text. What survived instead is a review clause.

The Article 34 review, and where it actually stands

Article 34(2) of the regulation required the Commission to present an impact assessment, no later than 30 June 2025, and Article 34(4) specifies that the assessment must evaluate the role financial institutions play in preventing financial flows that contribute, directly or indirectly, to deforestation and forest degradation, and assess whether it is necessary to introduce specific obligations for financial institutions through Union legal acts.

That deadline has passed. We could not find a published Commission report or decision closing out the Article 34(4) assessment. What is on the public record instead is industry pressure to drop it: German banking associations — the Bundesverband deutscher Banken, Die Deutsche Kreditwirtschaft, the Bundesverband der Deutschen Volksbanken und Raiffeisenbanken and the Verband deutscher Pfandbriefbanken — filed statements with the Bundestag's lobby register in September and October 2025 asking for the financial-institutions impact assessment under Article 34(4) to be removed from the regulation entirely, arguing it would duplicate existing checks without an environmental benefit. Whether the Commission ultimately keeps, narrows or drops the review is unsettled. If you lend against, invest in or insure businesses that handle EUDR commodities, treat this as a live question to check again rather than a settled no.

Where the exposure actually sits

Being outside the EUDR's regulated population does not mean the regulation is irrelevant to a lending or investment decision. The exposure runs through the businesses being financed:

• Credit risk. An operator that cannot produce a valid due diligence statement cannot lawfully place its product on the EU market. For a borrower whose revenue depends on EU sales of cocoa, coffee, timber or palm oil, a failed or delayed filing is a trading disruption with direct cash-flow consequences — exactly the kind of risk a lender underwrites for.
• Penalty exposure that sits on the borrower's balance sheet. Member states must set penalties proportionate to the environmental damage and the value of the goods, with a maximum of at least 4% of the operator's total annual EU-wide turnover — see the EUDR penalties guide for how that is applied. A fine at that scale is a covenant-relevant event for any lender with turnover-based financial covenants in place.
• Reputational and ESG exposure. Campaign groups including Global Witness and Global Canopy have spent several years publishing research tying specific banks' loan books to deforestation-linked commodities. That advocacy pressure does not require a change in the law to affect a lender's reputation or its own sustainability reporting.
• CSDDD, for the minority of financial institutions large enough to be caught. The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) excludes financial undertakings' downstream activities — a bank is not accountable under the CSDDD for the deforestation footprint of the businesses it finances. But their own operations and upstream relationships remain in scope once the size thresholds are met, and insurers in particular tend to be caught because of their size, not because of a financing-specific carve-out. See EUDR vs CSDDD: how the two due diligence laws differ for the thresholds and the downstream exclusion in full.
• Transition and reporting obligations that do reach financial institutions directly. Large banks and insurers already report financed-emissions and portfolio-alignment data under other EU sustainability rules, and the EUDR's cut-off date and commodity list is a natural reference point for that reporting even though the regulation itself does not require it. EUDR and CSRD: how the reporting obligations overlap covers the adjacent reporting regime in more depth.

Who is actually caught, and who only carries exposure

Role	Caught directly by the EUDR	What actually applies
Operator placing cocoa, coffee, timber, etc. on the EU market	Yes	Due diligence statement, geolocation, Article 9 information requirements
Trader making a relevant product available downstream	Yes	Due diligence obligations under Article 5, reduced if a prior statement already covers the product
Bank or lender providing working capital or trade finance to an operator	No	No EUDR duty; credit and covenant exposure to the borrower's compliance
Shareholder or bondholder in an operator or trader	No	No EUDR duty; equity or credit exposure to the issuer's compliance
Insurer underwriting cargo, trade credit or liability for covered goods	No	No EUDR duty directly; may separately be in scope of CSDDD on its own operations
Private equity owner with a controlling stake in a portfolio company that is itself an operator	No, the portfolio company is	No direct EUDR duty for the fund; the portfolio company's size is tested on its own figures, not the fund's

Private equity and portfolio companies

A private equity fund that owns a controlling stake in an operator does not itself become an operator. The EUDR size bands — micro, small, medium and large, based on employees, turnover and balance sheet total — are tested per legal entity, and the Commission's own FAQ guidance confirms that group consolidation does not apply for this purpose. A portfolio company stays in whatever size band its own figures put it in, regardless of the fund's total assets under management. See EUDR group structures: how consolidation affects your size band for how that test works and where it still catches out finance teams used to consolidated SME tests elsewhere in EU law.

What the fund does carry is practical exposure through board control. A fund that sits on a portfolio company's board, signs off its capital allocation and will eventually need a clean exit is in a materially different position from a passive minority shareholder, even though neither has an EUDR obligation of their own. Due diligence on an acquisition target that handles any of the seven commodities should now include its EUDR size band, its application date, and whether its due diligence statements are actually filed — not because the fund answers to a competent authority, but because the target's compliance gap becomes the fund's valuation and exit risk.

What lenders and investors can reasonably do now

None of the following is an EUDR obligation. They are ordinary credit and investment risk management applied to a new fact pattern:

• Identify which borrowers or portfolio companies place or trade any of the seven Annex I commodities, and which EUDR deadline applies to each — see the EUDR deadline guide for which date, 30 December 2026 or 30 June 2027, fits which size band.
• Ask for evidence of due diligence statement filing as part of ordinary covenant reporting, the same way a lender already asks for other regulatory compliance confirmations.
• Price the penalty exposure — a maximum of at least 4% of EU-wide turnover — into covenant headroom for borrowers with concentrated exposure to EU sales of covered commodities.
• Track the Article 34 review and any related Commission publication, since an outcome bringing financial institutions into scope directly would be a different and larger undertaking than monitoring borrower compliance.

What to watch for

The Article 34(4) assessment is the one item on this page genuinely unresolved at the time of writing: the Commission's own deadline for it has passed, and banking associations are actively lobbying to have the requirement dropped rather than acted on. Nothing here should be read as settled Commission policy on whether financial institutions will eventually be brought into EUDR scope. If your business is the one being financed, rather than the one doing the financing, run it through the checker to get your own obligations and deadline, which is the question your lender or investor is actually asking about.