EU and UK: Due Diligence Obligations for Deforestation Risk Products

Companies dealing with commodities and products that are linked to deforestation, including palm oil, soya, cocoa and rubber, are likely to be impacted by a new law that has been passed in the UK and/or a proposed law in the EU, designed to curb deforestation driven by UK/EU companies and consumers (the “Deforestation Due Diligence Laws”).

The Deforestation Due Diligence Laws vary in scope, but fundamentally they require companies importing or using affected commodities to conduct due diligence on their supply chains to ensure that the commodities have been produced in accordance with local laws and—in the case of the EU proposal—that products are more widely “deforestation free”. Failure to comply with the laws could result in significant fines, among other enforcement action.

In this article, we provide an overview of the Deforestation Due Diligence Laws and the critical considerations for in-scope companies, as they take steps to implement compliant supply chain due diligence programs.

During its hosting of the COP26 summit, on 9 November 2021, the UK passed its long-awaited Environment Act 2021 into law. Amongst a host of other key environment and product stewardship legislative measures, the new law includes provisions on the import and use of certain forest risk commodities (“FRCs”) or products derived from FRCs, in commercial activities in the UK (these provisions will be referred to as the “FRC Law”).[1] 

Scope

The exact FRCs will be set out in secondary legislation, but based on the results of government consultations—about which see our earlier alert here—they are likely to include palm oil, soya, cocoa, rubber, beef, and leather. These are the UK Government’s initial priority commodities, but the list could be extended, including to go beyond forests and land conversion risks to, for example, mining and extractive commodities.[2]

Importantly, the FRC Law as currently drafted is limited in that it focuses on FRCs linked to illegal deforestation. However, it applies not just to the raw or whole FRCs but also to FRC derived products. It also applies to corporate entities “using” FRCs/derived products in their commercial activities which is defined widely as producing, manufacturing, processing, distributing, selling, supplying, or purchasing (but does not extend to financing activities).

The qualification criteria to determine which corporate entities or groups—i.e., “Regulated Persons”—have to comply with the FRC Law will also be set out in secondary legislation. It is expected that the applicability threshold will be based on annual turnover.

Obligations for Regulated Persons

Broadly, Regulated Persons will be:

• prohibited from using FRCs or products derived from FRCs in UK commercial activities unless relevant local laws in producer countries have been complied with;
• required to establish a due diligence system for FRCs, including measures for: (i) obtaining information about FRCs; (ii) assessing the risk that local laws were not complied with in relation to FRCs; and (iii) taking steps to mitigate identified risks; and
• required to report annually on the measures taken to establish and implement an FRC due diligence system.

A “relevant local law”, means local law which relates to the ownership of the land on which the source organism was grown, raised, or cultivated, the use of that land, or which otherwise relates to that land as specified in secondary legislation.

Enforcement and Sanctions

The FRC Law’s enforcement mechanisms could include investigatory powers enabling the enforcement authority to search and enter facilities, and seize products. Non-compliance may be met with a range of sanctions including civil sanctions (such as monetary fines, stop notices and/or enforcement undertakings) and criminal sanctions in certain circumstances.

Timing

The timing for when the obligations of the FRC Law will actually apply to corporates is to be set out in secondary legislation. However, given the acceleration and political support behind the deforestation agenda - see commentary below - the UK legislators will be under some pressure to introduce detailed secondary legislation; NGOs have called for a phased target of 2023-2025 for UK supply chains to be deforestation free and the UK Government also indicated its support for FRCs to be phased out in an order or priority.[3] 

European Commission’s Proposal for a Deforestation-Free Products Regulation

The European Commission’s new legislative proposal, published on 17 November 2021 (the “DFP Regulation”) would introduce a range of measures for EU operators and traders aimed to ensure that certain commodities bought, used, and consumed on the EU market no longer contribute to global biodiversity and forest loss and are “deforestation-free”.

Scope

The DFP Regulation targets soy, beef, palm oil, wood, cocoa and coffee, and some of their derived products, including leather, chocolate, paper and pulp, as well as furniture (the “Deforestation-Risk Commodities”).[4] As drafted, the Commission will be empowered to review and potentially update the list of Deforestation-Risk Commodities and to extend the Regulation’s scope to other ecosystems such as grasslands.

The DFP Regulation would impose different obligations on “operators” and “traders”, and impose a lighter regulatory burden on SMEs.

• The law’s key obligations will apply to “operators”, defined as natural or legal persons acting in the course of a commercial activity who place Deforestation-Risk Commodities on the EU market, or export them from the EU.
• "Traders" are entities that are not operators but who in the course of their commercial activity make available Deforestation-Risk Commodities on the EU market.

Only EU-established entities can be operators for the purposes of the DFP Regulation. Where a non-EU entity is conducting an activity that would otherwise meet the definition of placing on the market, the first EU established person who buys or takes possession of the Deforestation-Risk Commodities (including distributors) becomes the operator and carries the DFP Regulation’s substantive obligations. The Regulation could therefore have significant ramifications for e-commerce companies.

Obligations for Operators

(i) Due Diligence

Operators would have to conduct due diligence to ensure that any Deforestation-Risk Commodities placed on or exported from the EU market, are both:

1. “deforestation-free”;[5] and

2. produced in accordance with local production country laws concerning the legal status of the area of production in terms of land use rights, environmental protection, third parties’ rights and relevant trade and customs regulations.

To meet the due diligence requirements, operators must:

• Collect extensive information on Deforestation-Risk Commodities, including not only the country of production but geo-localisation coordinates of all plots of land on which the Commodities were produced, supplier details, and adequate and verifiable information that the commodities are deforestation free and have been produced in accordance with local law;
• Carry out risk assessments to determine whether there is a risk that relevant commodities are non-compliant, taking into account a range of prescribed risk assessment criteria;[6]
• Implement risk mitigation and management measures (for example additional information gathering and independent surveys) to ensure that there is no risk or only negligible risk that the Deforestation-Risk Commodities are not compliant. (If risk assessments have identified risks, companies are prohibited from placing relevant products on the EU market before implementing risk mitigation measures to allow them to achieve this requisite level of certainty.)

The DFP Regulation would require the Commission to categorize countries into low, standard, and high risk of producing commodities linked to deforestation and forest degradation, or to breaches of local law. Deforestation-Risk Commodities placed on the EU market will be subject to tighter checks based on this benchmarking system (see enforcement section below).

Where operators know that all relevant products have been produced in countries (or parts thereof) that the Commission considers low risk, a simplified due diligence obligation applies—generally, no risk assessment or mitigation measures are required except where an operator is made aware of specific risks of non-compliance.

(ii) Certification

Prior to marketing or exporting in-scope products, operators must submit a signed due diligence statement via a new, dedicated EU information system to confirm that due diligence was carried out and that no or only a negligible risk of non-compliance was found as part of their due diligence process.[7] If this assessment subsequently changes, they must notify the relevant competent authorities.

(iii) Reporting

Non-SME operators must on an annual basis publicly report ‘as widely as possible’ (including on the internet) on their due diligence system and the steps taken to implement their diligence obligations. Record keeping requirements also apply.

Obligations for Traders

Traders have different obligations depending on whether they are an SME or not:

• Non-SME traders will be considered operators for material purposes of complying with the DFP Regulation and will have the due diligence obligations and information requirements discussed in this alert.
• SME traders will have to: (i) collect and keep information about their suppliers and customers; and (ii) inform competent authorities if they receive information about non-compliant products they have made available on the market.

Enforcement Mechanisms

Failure to comply with obligations under the DFP Regulation could result in fines of at least up to 4% of an entity’s turnover in an EU country, confiscation and/or destruction of the relevant products, confiscation of revenues linked to transactions, and exclusion from procurement processes. The Regulation would establish three connected enforcement mechanisms which, collectively, could introduce significant enforcement risk for companies:

• Checks by competent authorities: EU Member States’ competent authorities would be given powers to carry out checks to establish whether operators and traders comply with their obligations, generally without prior warning to companies.[8]
• Controls from customs authorities: In effect, this new enforcement tool will work like an import/export ban in some cases.
• Complaints mechanism: Natural or legal persons, including NGOs, will be entitled to submit “substantiated concerns” about operators or traders failing to comply with the Regulation to competent authorities. On receipt of a complaint, authorities would be required to assess the concerns and take necessary steps to detect potential breaches.

Timing

The Commission anticipates the DFP Regulation will come into force by 2023, with large companies thereafter given a 12-month grace period to comply and SMEs a 24-month grace period.

Significance

Corporate entities that are covered by either or both of the Deforestation Due Diligence Laws, may need to make significant enhancements to environmental/ human rights compliance programs. Critical considerations include:

• A requirement to implement formal due diligence regimes: Both laws require implementation of due diligence processes that include information gathering, risk assessment, and risk mitigation measures. The due diligence requirements in the DFP Regulation would be particularly broad in covering due diligence to prevent not only illegal deforestation in the country of production but also to curb deforestation driven by agricultural expansion, whether legal under local law or not. Further, to produce signed due diligence statements for every covered consignment, companies are likely to have to implement effective, cross-functional, internal processes, involving stakeholders in legal/compliance, procurement, and customs functions.
• An emphasis on supply chain traceability: Both laws require entities to obtain information about the origins of covered commodities. The tracing and information gathering requirements placed on entities subject to the DFP Regulation (including geographic coordinates) may be particularly onerous for companies, particularly those who currently have minimal visibility into the lower tiers of their supply chains. These legal requirements will necessitate wider uptake in traceability initiatives and use of technologies.
• Potentially broad product and sector applicability: Both laws envisage that companies importing goods derived from the relevant commodities will be required to implement due diligence regimes. The DFP Regulation places information gathering and (for non-SME traders) due diligence obligations on traders, and the UK FRC Law covers use in commercial activities, potentially creating compliance obligations for a range of companies including those who are not primary commodities companies or first tier operators, and those in the e-commerce sector.
• Potentially significant enforcement risk: Both laws envisage a robust enforcement apparatus. Under the DFP Regulation, these robust sanctions would be coupled with fairly novel multi-stakeholder collaboration on enforcement, involving cooperation with customs authorities. This cooperation and the new information system addresses a widely criticized aspect of the EU Timber Regulation.
• An increase in publicly available supply chain data: Under the DFP Regulation, the EU information system, would contain due diligence statements of entities placing or exporting commodities on the EU market, connect competent authorities and customs authorities, and include a mechanism for risk profiling of operators and commodities. The completely anonymized data will be provided in an open format to the public. This could provide further opportunity for civil society actors to independently investigate potential deforestation risks.
• The human aspects of deforestation: While both laws fall short of expressly requiring human rights due diligence, this expectation is arguably indirectly incorporated to some extent. Both laws prohibit importation of goods containing commodities that have been produced in breach of local laws. Due diligence to ensure that commodity production complies with local land laws—including, for example, any licensing laws incorporating “Free, Prior and Informed Consent” (“FPIC”) principles to protect communities/ indigenous populations from land grabbing—could be critical.
• Part of a broader due diligence trend: Commodity-importing companies caught by broader existing and emerging human rights and environmental due diligence requirements might already be considering deforestation-related human rights impacts as part of their due diligence strategy. These Deforestation Due Diligence Laws are part of a wider trend across Europe and elsewhere necessitating robust corporate environmental and human rights due diligence measures. At an EU level, the DFP Regulation explicitly suggests that the law is intended to be complementary to other human rights/environmental due diligence requirements and anticipates some harmonization in aspects of EU due diligence regimes including reporting requirements. The DFP Regulation must therefore be seen in the context of the upcoming due diligence proposal as well as subject matter specific requirements such as the diligence requirements of the Regulation on Batteries and Waste Batteries.

The Deforestation Due Diligence Laws are emerging at the same time as the historic international Pledge made by 141 States at the COP26 summit to end deforestation by 2030. The Pledge suggests a broad global commitment to this issue, and was supported by a Global Forest Finance Pledge of $12 billion, while the European Commission pledged €1 billion to facilitate protection, restoration and sustainable management of forests globally. There are parallel developments also in the US (where U.S. Senator Schatz presented the Fostering Overseas Rule of Law and Environmentally Sound Trade (FOREST) Act in June 2021).

Deforestation is also increasingly a wider compliance concern and target for authorities. For example, in a Notice issued on November 18, 2021, the US Financial Crimes Enforcement Network (FinCEN) calls attention to an upward trend in environmental crimes and associated illicit financial activity. The Notice provides financial institutions with specific suspicious activity report filing instructions, including for the category of illegal logging and resulting deforestation.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Business and Human Rights, Environmental & Product Stewardship, and Global Public Policy teams.