Does ISPO or MSPO satisfy EUDR due diligence for palm oil?

No. Indonesia's ISPO and Malaysia's MSPO are national palm oil sustainability certification schemes, and neither satisfies EUDR due diligence by itself. Both can feed evidence into the risk assessment Article 10 requires, and MSPO has picked up real but limited recognition from the EU and one member state since September 2025 — but no scheme, from either country, replaces the due diligence statement, the plot-level geolocation, or the operator's own legal liability.

Why ISPO and MSPO come up so often

Indonesia and Malaysia between them produce roughly 85% of the world's palm oil, and both built mandatory national certification schemes — ISPO (Indonesian Sustainable Palm Oil) and MSPO (Malaysian Sustainable Palm Oil) — years before the EUDR existed. MSPO certification covers around 90% of Malaysia's plantation area and 85% of its independent smallholders. Every EU buyer sourcing crude or refined palm oil, or any of the downstream products that carry palm oil as an ingredient, runs into one or both schemes somewhere in its supply chain, and suppliers often present the certificate as proof the shipment is "EUDR-ready." It generally is not, for the same structural reason that FSC, RSPO and other verified schemes fall short — see do FSC, RSPO or Rainforest Alliance certification satisfy EUDR due diligence for the general rule. ISPO and MSPO raise two further wrinkles, because unlike the voluntary international schemes, both have had direct, if partial, engagement from EU and national authorities.

What Article 10 actually allows a certification scheme to do

Article 10(2) of Regulation (EU) 2023/1115 lists the criteria an operator's risk assessment must weigh, and point (n) lets certification or other third-party verified evidence feed in as "complementary information on compliance with this Regulation." That is the full legal role either scheme can play: supporting evidence for one input among several, not a substitute for the risk assessment itself, and never a substitute for the due diligence statement. The regulation says explicitly that certification schemes "should not substitute the operator's responsibility as regards due diligence," and that rule applies to ISPO and MSPO exactly as it applies to FSC or RSPO.

What actually changed for MSPO in 2025 and 2026

MSPO is the scheme with genuine, documented EU-side movement, and it is worth being precise about what happened, because Malaysian industry and government statements have described it in stronger terms than the underlying documents support.

• September 2025 — EU–Malaysia joint statement. Following a visit by EU Environment Commissioner Jessika Roswall, the EU and Malaysia issued a joint statement acknowledging MSPO as a relevant national sustainability standard with a credible digital traceability system, with further alignment work between MSPO and the EUDR's requirements continuing. This is a diplomatic acknowledgement of MSPO's quality as a scheme, not a legal finding that MSPO-certified palm oil meets EUDR due diligence. No Commission implementing or delegated act gives MSPO any formal status under the regulation.
• July 2026 — Dutch NVWA recognition. The Netherlands Food and Consumer Product Safety Authority (NVWA) recognised MSPO as a "private control system" under the EUDR. In practice this means the NVWA can take MSPO-certified shipments into account within its own supervisory and enforcement procedures when it checks Dutch imports — it is one competent authority's own risk-based approach to deciding where to focus checks, not an EU-wide rule. It does not exempt MSPO-certified palm oil from Article 9 information requirements, from filing a due diligence statement, or from the risk assessment under Article 10 unless Article 13's simplified due diligence already applies for an unrelated reason (see below). Other member states' competent authorities are not bound by the NVWA's approach, and an importer into Germany, France or elsewhere cannot assume the same treatment.

Taken together, these are the most concrete steps any single-country scheme has achieved towards EU recognition so far — and they still fall well short of a safe harbour. Malaysia itself remains a standard-risk country under the EU's own country benchmarking, which matters more than either announcement for how much due diligence a Malaysian shipment actually needs.

What the EFI–ISPO gap assessment found

Indonesia has not had an equivalent government-to-government statement, but the European Forest Institute (EFI) carried out a joint gap assessment with the ISPO Secretariat comparing what ISPO certification collects against what EUDR due diligence requires. It found real overlap: ISPO data already aligns with several Article 9 criteria, including product description, quantity, supplier information and the legal status of the production area. It also identified gaps against key EUDR requirements and areas where ISPO's own standard could be extended — among them, consultation with customary ("traditional law") communities and information on supply-chain mixing risk relevant to Article 10. A follow-up EU–Indonesia Joint Task Force on the EUDR has agreed to keep working on closing the remaining gaps, but, as with MSPO, none of this amounts to formal recognition that ISPO certification satisfies EUDR due diligence on its own, and no Commission act gives it that status.

The gaps that remain whichever scheme you hold

The same four structural shortfalls that apply to FSC and RSPO apply to ISPO and MSPO:

• Cut-off date misalignment. The EUDR requires deforestation-free production after 31 December 2020. Neither scheme's audit cycle checks specifically against that date.
• No plot-level geolocation to EUDR precision. ISPO and MSPO certify at mill, plantation or grower-group level. The EUDR needs a geolocation point or polygon for every plot of production over 4 hectares.
• Incomplete legality scope. Article 2(40) requires checking land use, environmental, forest, third-party rights, labour, human rights, tax, anti-corruption, trade and customs law in the country of production. Neither scheme's legality checks map one-to-one onto that list.
• No transfer of liability. Whatever either scheme has audited, the operator placing the product on the EU market carries the legal obligation and the penalty exposure. See EUDR penalties: what non-compliance costs.

What still has to happen, certified or not

Obligation	Still required with ISPO or MSPO	What the certificate can help with
Collect Article 9 information (product, quantity, supplier, plot geolocation, proof of legal production)	Yes, in full	ISPO/MSPO audit data can shorten supplier questionnaires on product, quantity and supplier identity
File a due diligence statement in TRACES, or the Article 4a simplified declaration if you qualify	Yes, always	No effect — neither scheme files anything on your behalf
Carry out a risk assessment under Article 10	Yes, unless Article 13 simplified due diligence applies	Certificate is one Art. 10(2)(n) input; NVWA-regulated Dutch imports may see it weighed in enforcement targeting
Confirm no substantiated concern on the specific supply chain	Yes	A clean audit history supports this conclusion
Five-year record retention	Yes	No effect
Legal liability for non-compliance	Stays with the operator	Not transferred by either scheme

Article 13's simplified due diligence — skipping the risk assessment and mitigation steps — depends entirely on whether every country of origin is benchmarked low risk under Implementing Regulation (EU) 2025/1093. Indonesia and Malaysia are both benchmarked standard risk, not low risk, so that shortcut is not available on MSPO or ISPO grounds, however the certificate is described. EUDR country benchmarking explained sets out the current tiers in full, and it is worth checking before assuming certification buys you a lighter obligation.

What this means if you trade or process palm oil

Treat an ISPO or MSPO certificate as useful supporting evidence, not as the due diligence itself. Keep the certificate and underlying audit reports on file, map what each one actually checked against Article 9 and Article 10(2), and close the gaps — almost always the 2020 cut-off date and plot-level geolocation — through your own supplier data. Then file the due diligence statement itself; how to submit an EUDR due diligence statement step by step covers the mechanics. If you trade or refine crude or refined palm oil specifically, EUDR for palm oil traders and refiners covers the tracing requirements a certificate does not remove. Run the free checker to see which obligations actually apply to your business, based on your role, size and sourcing countries rather than a general rule about certification.

FAQ

Can I submit an ISPO or MSPO certificate instead of a due diligence statement? No. Every relevant palm oil product placed on the EU market needs its own due diligence statement, or the Article 4a simplified declaration if you specifically qualify. Neither certificate is an accepted substitute.

Does the EU's September 2025 statement mean MSPO is now EUDR-recognised? No, not in a legally binding sense. The joint EU–Malaysia statement acknowledged MSPO as a credible national standard with alignment work ongoing. It is not a Commission implementing or delegated act, and it does not give MSPO-certified palm oil any formal exemption from EUDR due diligence.

What did the Dutch NVWA actually recognise MSPO for? The NVWA recognised MSPO as a "private control system" it can factor into its own supervisory and enforcement procedures for imports into the Netherlands. That affects how the Dutch authority targets checks; it does not change the underlying EUDR obligations, and it has no formal standing with other member states' authorities.

Does ISPO have any equivalent EU recognition? Not yet. A joint gap assessment between the European Forest Institute and the ISPO Secretariat found meaningful overlap with EUDR data requirements and identified gaps still to close, and an EU–Indonesia task force is working on them, but there is no EU or member-state recognition of ISPO comparable to the Dutch NVWA's step on MSPO.

Are Indonesia and Malaysia low-risk countries under the EUDR, given these certification schemes? No. Both are benchmarked standard risk under Implementing Regulation (EU) 2025/1093. Country risk tier and certification are separate mechanisms; being certified does not move a country into the low-risk tier, and only the low-risk tier unlocks Article 13's simplified due diligence.

Will the Commission's planned certification repository change this? No. The Commission's 4 May 2026 simplification report confirmed it will build a transparency repository of certification schemes, expected before the EUDR's December 2026 application date, describing what each scheme covers. It is explicitly not an approval list, and it will not let any certificate, including ISPO or MSPO, substitute for a due diligence statement.

Does this differ for refined palm oil blended from multiple certified and uncertified sources? No, and blending makes the gap more acute rather than less. Mixing risk is itself one of the Article 10(2) risk assessment criteria, and a refiner blending certified and uncertified crude oil has to account for that mixing in its own risk assessment — a certificate on part of the input stream does not cover the blended output.

Am I still liable if my MSPO- or ISPO-certified supplier turns out to be non-compliant? Yes. Liability sits with the operator placing the product on the EU market, not with the certification body, the scheme owner, or the supplier's own certifier. A clean certificate does not change who faces the penalty if a competent authority finds the due diligence statement deficient.