How FSC Certification Closes the EUDR Compliance Gap for PEFC-Certified SMEs
Last updated: June 2025. This article reflects Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, and the FSC Regulatory Module (FSC-STD-01-004 V1-0) as published. Regulatory positions and FSC programme specifications may evolve — verify current obligations with qualified legal or compliance counsel.
Key takeaways
- PEFC certification alone does not satisfy EUDR due diligence obligations — Regulation (EU) 2023/1115, Article 8 requires operators to conduct and document a full due diligence system regardless of existing certification.
- FSC's new Regulatory Module (FSC-STD-01-004) translates EUDR obligations directly into FSC certification requirements, giving certificate holders a structured path to compliance.
- Malaysia and Indonesia are classified as standard-risk countries under Commission Implementing Regulation (EU) 2025/1093 — geolocation data at plot level is mandatory; simplified due diligence declarations are not available.
- Large operators face a compliance deadline of 30 December 2026; micro and small operators established by 31 December 2024 have until 30 June 2027.
- Achieving FSC certification with the Regulatory Module in scope produces audited, third-party-verified evidence of EUDR compliance — the kind of documentation EU buyers are now requesting.
- FSC certification also opens access to a growing segment of EU buyers who specify FSC in procurement policies, creating a commercial return on the compliance investment.
Your EU buyer's latest purchase order has arrived with a new clause attached: evidence of EUDR compliance required before shipment. You hold PEFC certification. You assumed that would be enough. It is not — and your buyer's legal team knows it.
This situation is playing out across plywood mills, timber processors, and rubber goods manufacturers in Malaysia and Indonesia right now. PEFC is a respected certification, and it signals genuine commitment to sustainable forest management. But Regulation (EU) 2023/1115 does not operate on recognition of voluntary certification schemes. It requires operators to demonstrate a documented due diligence system — specific geolocation data, a deforestation risk assessment, and risk mitigation measures — every time a regulated product enters the EU market. PEFC certification does not generate those outputs automatically.
The practical question is not whether your PEFC certificate has any value — it does — but how to build the additional layer of compliance infrastructure your buyers are requiring. For many SMEs, the most efficient path is FSC certification, specifically because FSC has built a direct bridge to EUDR through its Regulatory Module. Upgrading from PEFC to FSC, or running both in parallel, closes the compliance gap, produces buyer-ready documentation, and positions your business for a category of EU customers that PEFC alone cannot reach.
Why PEFC certification does not satisfy EUDR on its own
PEFC and EUDR are built around different mechanisms, and conflating them is one of the most common and costly assumptions Malaysian and Indonesian exporters make.
PEFC certifies that forest management practices meet a defined standard and that chain of custody procedures are in place. It answers the question: does this company manage or source wood responsibly? EUDR asks a different and more specific question: can this operator prove, with documented geolocation evidence, that the land producing this product was not deforested after 31 December 2020?
Regulation (EU) 2023/1115, Article 8 requires every operator placing regulated products on the EU market to maintain a due diligence system. That system must include: information collection (including geographic coordinates of plots), a risk assessment against EUDR deforestation and legality criteria, and — where risk is not negligible — risk mitigation measures. Article 9(1)(d) specifically requires the GPS coordinates or polygon data for each plot where the commodity was harvested.
PEFC chain-of-custody certification does not mandate collection of harvest-plot geolocation data. It does not require a deforestation risk assessment framed against the 31 December 2020 cut-off date. And it does not produce the due diligence statements that Regulation (EU) 2023/1115, Article 4(2) requires operators to file before placing products on the EU market.
This is not a criticism of PEFC — it was designed for a different purpose. But for exporters to the EU market in 2025 and beyond, PEFC is a foundation, not a finish line.
Important: Under Commission Implementing Regulation (EU) 2025/1093, Malaysia and Indonesia are classified as standard-risk countries. This means the simplified due diligence procedure under Regulation (EU) 2023/1115, Article 13 — which reduces documentation requirements for low-risk countries — is not available to you. Full due diligence is mandatory for every shipment, every time.
What the FSC Regulatory Module actually does
In direct response to market confusion about the relationship between FSC certification and EUDR, FSC launched the FSC Aligned Certification for EUDR framework. The operational core of this framework — the part most relevant to wood and rubber exporters — is the FSC Regulatory Module, published as FSC-STD-01-004 V1-0.
The Regulatory Module is a voluntary add-on standard that translates EUDR's due diligence obligations into FSC certification language. Rather than running a separate compliance process alongside your FSC audit, the Module embeds EUDR requirements into your existing FSC scope. Your certification body audits both FSC conformance and EUDR alignment in a single assessment.
Practically, this means the Module addresses what PEFC does not: it requires certificate holders to collect and maintain harvest-plot geolocation data, conduct a deforestation risk assessment referenced against the 31 December 2020 cut-off date, and document risk mitigation where needed. When your audit passes, you hold third-party-verified evidence that your products meet EUDR requirements — not a self-declaration, but an accredited certification body's finding.
What the Module covers
The FSC Regulatory Module applies to wood, wood-based products, and rubber. For Chain of Custody (CoC) certificate holders — the category most Malaysian and Indonesian SME processors fall into — the Module can be scoped to specific product groups. This means you can start with your highest-volume EU export products and expand scope incrementally, which has practical implications for cost and audit preparation time.
One important operational note: once you elect to include the Regulatory Module in your certification scope, its requirements become mandatory for the product groups in scope. It is not a light-touch add-on — it carries real audit requirements. What it removes is the need to build and certify a parallel EUDR compliance system from scratch.
The FSC Risk Hub as infrastructure
The Regulatory Module is supported by the FSC Risk Hub, which provides risk assessments by country, jurisdiction, and commodity. For standard-risk countries — including Malaysia and Indonesia — the Hub does not offer simplified pathway options, but it does provide structured risk frameworks that certificate holders can use as the starting point for their plot-level assessments. This is meaningful for SMEs that lack in-house geospatial teams: the risk framework gives you a methodology, not just a requirement.
How FSC certification compares to PEFC for EUDR compliance
The table below maps the key EUDR due diligence requirements against what PEFC CoC, FSC CoC (without the Regulatory Module), and FSC CoC with the Regulatory Module each provide.
| EUDR Requirement | PEFC CoC | FSC CoC (standard) | FSC CoC + Regulatory Module |
|---|---|---|---|
| Chain of custody documentation | Yes | Yes | Yes |
| Harvest-plot GPS / polygon data | Not required | Not required | Required |
| Deforestation risk assessment (post-Dec 2020) | Not required | Not required | Required |
| Risk mitigation documentation | Not required | Not required | Required |
| Third-party audit of EUDR alignment | No | No | Yes |
| EUDR due diligence statement support | No | No | Yes |
FSC CoC with the Regulatory Module is the only path in this comparison that produces third-party-audited EUDR compliance evidence. That is the document your EU buyer's legal team is asking for.
The compliance timeline: what PEFC-certified SMEs should plan for
Deadlines under Regulation (EU) 2025/2650 are firm, and certification processes take time. Understanding the realistic timeline from a standing start is essential for planning.
Large operators — those not qualifying as micro or small enterprises under Directive 2013/34/EU — must be compliant by 30 December 2026.
Micro and small operators established by 31 December 2024 have until 30 June 2027.
FSC Chain of Custody certification typically takes three to six months from initial gap assessment to certificate issuance, depending on the complexity of your operations and your readiness. Adding the Regulatory Module scope extends preparation time because of the geolocation data collection requirement — gathering precise GPS coordinates for all harvest plots, particularly for complex supply chains involving multiple suppliers, is often the longest single task.
A realistic planning sequence for a PEFC-certified SME moving to FSC + Regulatory Module:
- Months 1–2: Gap assessment against FSC CoC requirements and FSC-STD-01-004. Identify which product groups to include in Regulatory Module scope. Begin supplier engagement on geolocation data.
- Months 2–4: Implement system changes. Collect and verify GPS coordinates for all in-scope harvest plots. Document deforestation risk assessments.
- Month 4–5: Pre-audit internal review. Resolve non-conformities.
- Month 5–6: Certification body audit and certificate issuance.
For large operators targeting the December 2026 deadline, beginning this process by mid-2025 is advisable. For small operators with the June 2027 deadline, a Q1 2026 start leaves adequate buffer — but not unlimited time, given that supplier data collection routinely takes longer than expected.
Example: Sabah-based plywood processor Kijang Timber Products holds PEFC CoC certification and exports laminated panels to three German buyers. In early 2025, two buyers sent contract amendments requiring EUDR due diligence documentation by Q1 2026. Kijang's compliance team calculated that collecting GPS polygon data from their 12 timber suppliers — spread across Sabah and Sarawak — would take approximately three months. They initiated FSC CoC certification with Regulatory Module scope in March 2025, targeting certificate issuance by September 2025. This gives them a four-month buffer before the buyer deadline and positions them to issue EUDR-aligned documentation for the December 2026 regulatory deadline well in advance.
How FSC certification opens new EU customers that PEFC cannot reach
Compliance is the floor, not the ceiling. The commercial case for FSC certification extends beyond satisfying EUDR — it opens procurement channels that PEFC certification does not.
A significant and growing segment of EU buyers — particularly in construction, furniture retail, and public sector procurement — specify FSC certification explicitly in their purchasing policies. FSC's brand recognition with end consumers in Germany, the Netherlands, and Scandinavia is substantially higher than PEFC's. For SME exporters, holding FSC CoC certification with Regulatory Module scope creates a differentiated market position: you can offer EU buyers third-party-audited EUDR compliance bundled with the certification mark their retail customers recognise.
This matters for pricing as well as access. Buyers managing their own EUDR compliance risk will pay a premium to source from suppliers whose documentation reduces their operator-level due diligence burden. A supplier with FSC + Regulatory Module certification shortens the buyer's own due diligence process — that has measurable value in a buyer's procurement cost model.
For Malaysian and Indonesian SMEs operating in competitive commodity segments where price differentiation is difficult, the combination of FSC certification and verified EUDR compliance creates a genuine basis for premium positioning that cannot be replicated by price alone.
Common mistakes PEFC-certified SMEs make when approaching EUDR
Assuming PEFC mutual recognition will be formalised. There is no mutual recognition agreement between PEFC and EUDR. Regulation (EU) 2023/1115 does not defer to any voluntary certification scheme for compliance purposes. Waiting for a policy change that may not come is a compliance risk.
Treating geolocation as a supplier problem. Operators are responsible for collecting and holding geolocation data for products they place on the EU market. If your upstream timber suppliers cannot provide GPS coordinates for harvest plots, the compliance failure is yours under Article 9(1)(d), not theirs. Supplier engagement on data collection must begin early.
Scoping the Regulatory Module too narrowly to save cost, then expanding under pressure. Choosing a narrow product group scope initially is legitimate, but exporters sometimes underestimate how quickly buyers will ask about products outside the initial scope. Build your scope around your actual EU export product portfolio, not your lowest-effort starting point.
Underestimating audit preparation time for the geolocation requirement. Certification body audits for the Regulatory Module will verify that GPS data is accurate, current, and traceable to specific harvest plots. Submitting a concession boundary polygon rather than harvest-plot level coordinates does not satisfy FSC-STD-01-004 requirements — the same way it does not satisfy Article 9(1)(d) of the EUDR directly.
Delaying because the deadline feels distant. The June 2027 deadline for small operators is 24 months away as of mid-2025. FSC certification plus Regulatory Module scope, including supplier data collection, realistically requires six to nine months. Buyers will begin requesting documentation well before the regulatory deadline — many already are.
Frequently asked questions
If I already hold PEFC certification, do I have to start from scratch to get FSC CoC?
Not entirely. Your PEFC certification demonstrates that you have chain of custody management procedures in place, which overlaps with FSC CoC requirements in several areas — supplier approval, product group management, and record-keeping. A gap assessment will identify exactly what needs to change. The main additions for FSC are the FSC-specific trademark and claims requirements, and — if you include the Regulatory Module — the geolocation and deforestation risk assessment requirements. Many PEFC-certified companies find the transition audit-ready within three to four months.
Can I apply the FSC Regulatory Module to only some of my products?
Yes. For Chain of Custody certificate holders, the Regulatory Module can be applied to specific product groups. Products outside the scope of the Module remain outside its requirements and cannot be promoted as FSC Aligned for EUDR. This means you can phase your compliance investment across product lines, starting with your highest-volume or most at-risk EU export products. Note that once a product group is in scope, the Module's requirements are mandatory for it — there is no partial application within a product group.
Does holding FSC CoC with the Regulatory Module mean I can skip filing EUDR due diligence statements?
No. Regulation (EU) 2023/1115, Article 4(2) requires operators to file due diligence statements through the EU Information System before placing products on the market. FSC certification with the Regulatory Module generates the evidence base for those statements — the geolocation data, risk assessments, and mitigation records — but it does not file statements on your behalf. What it gives you is a verified, auditable foundation so that filing those statements is straightforward and defensible.
My buyers are asking for EUDR compliance documentation now, before the 2026 deadline. What should I provide in the interim?
You have two practical options. First, you can begin implementing the EUDR due diligence process independently — collecting geolocation data, conducting risk assessments, and documenting mitigation — and provide that documentation directly to buyers. Second, and more efficiently, you can initiate FSC certification with Regulatory Module scope and provide buyers with your certification timeline and interim documentation. Many buyers will accept a credible, time-bound compliance roadmap alongside interim self-assessments, particularly from suppliers with an existing PEFC certification history.
Next step
If you hold PEFC certification and your EU buyers are asking questions you cannot yet answer, the most productive next step is a gap assessment against FSC CoC and the FSC Regulatory Module requirements. GreenThread works with Malaysian and Indonesian SMEs through the full FSC certification process — from supplier data collection through to certificate issuance — with a specific focus on closing the EUDR compliance gap as efficiently as possible. [Book a consultation with GreenThread] to identify exactly what needs to change and how long it will take.