EUDR for palm oil traders and refiners: tracing crude and refined oil to source

Yes — crude and refined palm oil and palm kernel oil are Annex I commodities in their own right, under CN codes 1511 and 1513, and the due diligence obligation follows the oil through refining and fractionation into olein, stearin and specialty fractions. What makes palm oil traders and refiners harder to get right than most sectors is not the legal test but the supply chain underneath it: crude oil from hundreds of smallholders is pooled at the mill before a trader or refiner ever touches it, and the regulation still expects plot-level geolocation at the other end of that pooling.

Which palm oil products are in scope

Annex I lists palm oil and its fractions under CN 1511, covering crude palm oil and refined palm oil alike — refining does not remove a product from scope, it only changes which CN subheading applies. Palm kernel oil sits under CN 1513, split between crude (1513 21) and refined (1513 29) fractions, alongside palm nuts and kernels under CN 1207 10, the raw input mills crush before any oil is extracted.

This is the commodity-level entry: crude palm oil (CPO), RBD (refined, bleached, deodorised) palm oil, and the fractions a refinery produces by cooling and separating CPO into palm olein (the liquid fraction, used widely in food) and palm stearin (the solid fraction, used in confectionery fats and oleochemical feedstock). All of them carry the same obligation, because fractionation is a physical separation of the same oil, not a change of commodity. Palm oil derivatives used in cosmetics and personal care — fatty acids, fatty alcohols, glycerol and soap made by further processing palm oil chemically — sit under separate Annex I entries with their own CN codes; this page covers the oil itself and its physical fractions, which is where most tonnage sits for a trading or refining business.

Refining does not take the obligation off your hands

The most common misreading in this sector is that due diligence belongs to the plantation and the mill, and that a refiner further down the chain is simply buying an already-cleared input. It is the other way round. The obligation attaches to whoever first places the product on the EU market — typically the importer bringing crude or refined palm oil into the EU, whether that import happens before or after refining. A refinery established in the EU that imports crude palm oil and refines it domestically is the primary operator on that import; the refining step itself changes nothing about who owes the statement, because the import already triggered the obligation before the oil reached the refinery.

Where this gets genuinely harder than, say, a coffee importer, is that a refiner typically blends crude oil from multiple mills, each supplied by its own catchment of plantations and smallholders, into a single refined batch. The due diligence statement still has to be traceable back to the actual production plots behind that batch — refining mixes the oil physically, but it cannot mix away the geolocation requirement.

The traceability problem that is specific to palm

An estimated third to two-fifths of global palm oil comes from independent smallholders, typically farming a few hectares each, selling fresh fruit bunches to a local mill rather than directly to an exporter. Most of those plots were never digitally mapped before the EUDR made it a filing requirement: records, where they exist, sit in a cooperative's notebook or an agent's phone, not a GIS system. A mill commonly draws fruit from dozens to hundreds of such suppliers in a single week, and a trader or refiner buying crude oil from that mill is several steps removed from any single plantation boundary.

This is the specific reason palm oil compliance projects run longer and cost more than a comparable coffee or cocoa programme: the geolocation obligation is identical in law — polygons above four hectares, points below — but the number of individually mapped origin points behind a single shipment of crude palm oil is an order of magnitude higher than behind a shipment of green coffee from a handful of estates.

Supply chain step	What typically happens	What EUDR needs from it
Smallholder or estate	Harvests fresh fruit bunches	Plot geolocation, deforestation-free status after 31 Dec 2020
Mill	Buys from many growers, presses crude oil	Traceable record of which plots supplied which batches
Trader or refiner	Buys crude oil, blends, refines, fractionates	A due diligence statement that still resolves to the originating plots
EU importer	Places refined oil or fractions on the EU market	Files the statement, or holds the reference number if someone upstream already filed

Mass balance, segregated and identity-preserved supply chains

Palm oil sustainability schemes — RSPO, Malaysia's MSPO, Indonesia's ISPO and ISCC — each support a handful of chain-of-custody models, and which one your supplier uses decides how usable the certificate is for EUDR purposes. Identity-preserved and segregated models keep certified oil physically separate from conventional oil back to specific mills, which is compatible with producing plot-level geolocation for a given batch. Mass balance models pool certified and non-certified oil administratively — a certified tonne in, a certified tonne out, not necessarily the same molecules — and on their own do not give you origin data for the physical batch you bought.

None of this is a shortcut around due diligence in any case. A certificate, on any model, is evidence that can support a risk assessment; it is not a substitute for the due diligence statement itself, and a competent authority asking for the plot behind a specific consignment will not accept a mass balance certificate as the answer. Where a supplier mixes certified and conventional material under mass balance, EUDR-relevant information — origin and negligible-risk evidence — has to be collected for the non-certified share too, not just the certified one, if the blend is going into a statement you are filing.

Who owes the statement: importer, refiner or trader

Three roles turn up repeatedly in palm oil chains, and they are not interchangeable:

• The EU-based importer or refiner bringing crude or refined palm oil into the EU for the first time is the primary operator. The due diligence statement, the geolocation, the risk assessment (unless the origin qualifies for the low-risk simplification) and the filing in TRACES are all theirs.
• A trader buying already-imported, already-compliant palm oil within the EU — a distributor selling refined oil on to a food manufacturer, for instance — is downstream. Downstream operators and traders no longer file their own statement under Regulation (EU) 2025/2650; they collect and retain the reference number the primary operator was given, and keep records of who supplied them and who they sold to.
• A non-EU trading house selling CPO to an EU refiner is not itself bound by the regulation — it is not established in the EU — but commercially it cannot avoid the obligation, because its EU customer cannot file without the geolocation and legality data only the trading house's mill relationships can provide. Refusing to supply that data is, in practice, refusing to sell into the EU market at all.

Getting the role wrong in either direction causes real failures. A refiner that assumes its crude oil supplier already filed a statement, when in fact the supplier is a non-EU trading house with no EU establishment, has simply not complied on its own import. A downstream distributor that tries to re-file for oil a refiner upstream already covered is duplicating work the 2025 amendment specifically removed.

Origin and risk tier

Indonesia and Malaysia together supply most of the palm oil entering the EU, and neither is on the Commission's low-risk list under Implementing Regulation (EU) 2025/1093. Both sit in the default standard-risk tier, which means a 3% competent authority check rate and full due diligence — the risk assessment and mitigation steps in Articles 10 and 11 apply in full, with no route to the simplified declaration or postal-code concession that low-risk sourcing would unlock. Country benchmarking explained covers how the tiers work across all seven commodities; for palm oil specifically, the practical consequence is that there is no shortcut available through origin alone — the full risk assessment has to be done and documented, whatever the certification status of the supply.

Deadlines for a palm oil trading or refining business

Your business	Deadline
Large or medium operator, trader or refiner	30 December 2026
Micro or small operator, product previously under the EU Timber Regulation	30 December 2026
Micro or small operator, otherwise	30 June 2027
Further palm oleochemicals added by Delegated Regulation (EU) 2026/2102	30 December 2027

Crude and refined palm oil and palm kernel oil under CN 1511 and 1513 were always Annex I commodities, so they run on the main schedule — the later 30 December 2027 date applies only to the further oleochemical derivatives the 2026 delegated act added, not to the oil itself. The full deadline breakdown covers how size and product history interact with the two main dates in detail.

What to ask your mills and trading partners now

• Which mills supplied the crude oil in this specific batch, and can you provide plot-level geolocation for the plantations and smallholder farms behind each one?
• If you certify under mass balance, can you supply origin and negligible-risk evidence for the non-certified share of the blend, not only the certified share?
• Are you the business placing this oil on the EU market for the first time, or has an earlier link in the chain already filed a due diligence statement whose reference number I should be holding instead?
• Where fresh fruit bunches are bought from independent smallholders rather than an estate you control, what is your actual mechanism for mapping and updating their plots, rather than a one-off survey that will not catch new clearing?

A mill or trading house that cannot answer the first two questions is not a due diligence problem you can paper over with a certificate — it is a supplier you cannot currently source from legally once your application date passes.

Check what the EUDR requires of your specific role in the palm oil chain, including whether you are the one who owes the statement or the one who only needs to hold a reference number.