Regulation (EU) 2025/2650: What Changes for Cocoa Under the EU Deforestation Regulation

The 2025 amendment to the EU Deforestation Regulation (EUDR) does not change the fact that cocoa remains a fully covered "relevant commodity", but it reshapes who has to do what along the cocoa chain, with special consequences for smallholders and grinders/traders handling already‑processed cocoa.

1. Cocoa stays fully in scope – but the actors' roles shift

Cocoa is one of the "relevant commodities" at the heart of the original EUDR, alongside cattle, coffee, palm oil, rubber, soy and timber. All cocoa beans and cocoa‑derived products placed on or exported from the EU market must still be:

• Deforestation‑free;
• Produced in compliance with the relevant laws of the country of production;
• Covered by a due diligence statement or, for certain small primary producers in low‑risk countries, by a simplified declaration.

The 2025 reform does not soften those core conditions. Instead, it redistributes obligations along the supply chain, which matters a lot for how cocoa traders, processors and chocolate manufacturers organise their compliance.

2. Primary cocoa operators vs downstream cocoa operators

2.1. Who is an "operator" in cocoa?

In cocoa, an operator is now any entity that, as part of a commercial activity, places cocoa or cocoa‑based products on the EU market or exports them, except where they qualify as "downstream operators".

Typical cocoa operators include, for example:

• EU importers buying cocoa beans or semi‑processed products (liquor, butter, cake, powder) directly from producing countries;
• EU‑based processors who export cocoa products out of the EU.

Operators must still carry out full EUDR due diligence for cocoa and submit due diligence statements before placing or exporting, unless they fall under the new micro/small primary operator regime in a low‑risk country (see below).

2.2. Who counts as a "downstream operator" in cocoa?

A downstream operator is any actor that places on the market or exports cocoa products which have been manufactured using relevant products that are already covered by a due diligence statement or a simplified declaration.

In cocoa supply chains, this typically captures:

• EU chocolate manufacturers sourcing cocoa liquor, butter or powder from EU or non‑EU processors that have already carried out EUDR due diligence;
• EU food companies exporting chocolate or cocoa‑containing products made from EUDR‑compliant cocoa inputs.

Downstream operators do not have to perform their own due diligence or submit new due diligence statements for those cocoa products. Instead, they must:

• Obtain and keep the reference numbers of the upstream due diligence statements or simplified declarations;
• Maintain supplier and customer records for traceability;
• Act on new risk information and cooperate with authorities.

This change is designed to avoid multiple layers of duplicative due diligence for the same cocoa volume as it moves from beans to semi‑finished products to chocolate.

3. Micro or small primary cocoa operators in low‑risk countries

3.1. Who can use the simplified regime?

The new category of micro or small primary operators is particularly relevant for smallholder cocoa producers and farmer‑based exporters in low‑risk countries.

A cocoa actor can qualify if:

• It is a natural person, micro‑enterprise or small enterprise under Directive 2013/34/EU, irrespective of its legal form.
• It is established in a country classed as low risk under the EUDR country benchmarking (Article 29).
• It places on the market or exports cocoa (beans or derived products) that it has itself grown, harvested or obtained on identified plots of land in that low‑risk country.

Larger cocoa entities may still qualify if they can show that the part of their balance sheet, turnover and workforce linked to EUDR commodities (including cocoa) stays within micro/small thresholds, even if the group as a whole is bigger.

3.2. What changes for these small cocoa operators?

For cocoa micro/small primary operators in low‑risk countries, the obligations move from transaction‑level due diligence to a one‑off simplified declaration:

• They are exempt from filing a due diligence statement for every cocoa consignment and from keeping five‑year records of those statements.
• Instead, they submit a single simplified declaration in the EUDR information system before placing or exporting cocoa products, and receive an identifier of the declaration.
• That identifier must then follow all cocoa volumes covered by the declaration along the chain.

The simplified declaration must include:

• Identity and (where relevant) EORI of the cocoa operator;
• HS code, free‑text description and estimated annual single volume of cocoa or cocoa products to be placed/exported, expressed in net mass and, where applicable, supplementary units;
• Country of production and geolocation of all cocoa plots or the postal address of those plots or of the establishment where the cocoa is produced;
• A formal statement that the operator will conduct due diligence and only place/export cocoa where there is no or only negligible risk of non‑compliance with the EUDR's deforestation‑free and legality criteria.

Crucially, for cocoa smallholders:

• Geolocation can be replaced by a postal address of all plots or of the establishment, provided it clearly matches the actual location, which can be easier to manage for dispersed cocoa farms.

If, in future, a Member State or partner country builds an official cocoa traceability database that contains all Annex III information, those cocoa micro/small primary operators could be exempted from submitting the simplified declaration at all, with authorities uploading the data directly into the EUDR system and still assigning an identifier.

4. Downstream cocoa processors and chocolate makers: compliance via information, not duplicate due diligence

For large cocoa grinders, processors and chocolate manufacturers in the EU, the reform changes how they demonstrate compliance when they are not acting as the first placer of cocoa on the EU market.

If they operate as downstream operators (using cocoa inputs already covered by due diligence or a simplified declaration), their obligations focus on:

• Collecting and keeping:
  • Supplier identity details (operators/downstream operators/traders) for the cocoa products they buy;
  • The reference numbers of due diligence statements or simplified declarations where the supplier is an operator;
  • Customer identity details for the cocoa products they sell.
• Retaining this information for at least five years and supplying it to competent authorities on request.
• Immediately flagging to authorities and trading partners any new relevant information or substantiated concerns suggesting that cocoa products they placed/made available are not EUDR‑compliant.

Non‑SME cocoa grinders, processors and brand‑owners face a stronger gatekeeper role. If they receive credible information, before placing/making available/exporting cocoa or cocoa‑containing products, that these may not meet EUDR requirements, they must:

• Inform competent authorities in the Member States where they intend to place/make available/export the cocoa or chocolate.
• Verify that due diligence has indeed been performed upstream and that it shows no more than negligible risk.
• Refrain from placing, making available or exporting until that is proven.

For cocoa companies further down the chain, this is a shift from doing their own full due diligence on every batch to managing traceability and risk information using upstream EUDR identifiers and documentation.

5. Controls, sanctions and timelines: implications for cocoa countries and EU buyers

5.1. Controls by risk level – and what this means for cocoa origins

The risk‑based control system explicitly distinguishes between low‑, standard‑ and high‑risk countries or regions. For cocoa, this will directly affect how often EU authorities must inspect operators and volumes depending on how a producing country is benchmarked.

Minimum annual control rates for operators, non‑SME downstream operators and non‑SME traders handling cocoa are:

• At least 1 % for cocoa from low‑risk countries;
• At least 3 % for cocoa from standard‑risk countries;
• At least 9 % of actors and 9 % of volumes for cocoa from high‑risk countries.

This creates a strong incentive for cocoa‑producing countries to move towards a low‑risk classification, as that unlocks the micro/small primary operator regime and lowers control intensity on cocoa flows.

5.2. Sanctions and corrective measures

If cocoa consignments are found non‑compliant, operators, downstream operators or traders face:

• Mandatory corrective measures such as blocking market access, withdrawal/recall, donation or disposal, plus mandatory fixes to their due diligence systems.
• Penalties that include fines proportional to environmental harm and cocoa value, with legal‑person fines capped at no less than 4 % of EU‑wide annual turnover in the previous year (and possibly higher), as well as confiscation of cocoa products and associated revenues.

For cocoa companies, this reinforces the financial and reputational stakes of EUDR compliance across beans, semi‑finished products and chocolate.

5.3. Timelines for cocoa operators

The reform delays the start of EUDR obligations but does not exempt cocoa:

• The core obligations (including due diligence for cocoa operators and obligations for downstream operators and traders) now apply from 30 December 2026.
• For operators that are natural persons, micro‑enterprises or small enterprises (including cocoa farmers/exporters fitting that definition) established as such by 31 December 2024, application is postponed to 30 June 2027, except for products covered by the Timber Regulation.

This gives cocoa supply chains additional time to:

• Map plots and supply chains;
• Integrate EUDR data requirements into existing cocoa traceability systems;
• Decide where in the chain to concentrate full due diligence (typically at first placement) and where to rely on the downstream operator model.

6. Key Points Not to Miss: The Devil in the Details

6.1. The 2026 simplification review: an early warning system

The regulation embeds a “simplification review” checkpoint by 30 April 2026, just four months after most implementation begins. This is not a formality. The Commission must:

• Assess whether the administrative burden actually decreased;
• Identify problems specific to micro and small operators;
• Propose technical guidance, IT system improvements or even new delegated/implementing acts;
• If warranted, table a fresh legislative proposal.

This accelerated review is crucial because the 2025 reform itself is a response to implementation feedback. If the simplified regime for micro/small primary operators or the downstream operator model creates new bottlenecks in practice, Brussels will have data and political cover to adjust course within months, not years. For stakeholders, this means the legal framework is not locked in stone; evidence of dysfunction can drive mid‑course corrections.

6.2. First‑in‑chain traceability responsibility falls on any first downstream actor, not just SMEs

A critical but often overlooked rule: when micro or small primary operators supply cocoa or other commodities to a larger buyer, that first buyer, regardless of size, becomes the “first downstream operator or trader” and must collect and keep the reference numbers and identifiers of the micro or small operator’s simplified declaration.

This obligation applies to all first downstream actors, not only non‑SMEs. However, only non‑SME downstream operators and traders face the extra gatekeeper obligation to pre‑check risk information before market placement. This distinction is important: smaller chocolate makers and processors must still participate in the traceability chain but have less stringent verification duties than large ones.

6.3. The role of Member States in exempting micro/small operators via existing databases

The regulation opens a door for practical relief: if a Member State or partner country has built a traceability database (especially for cattle under the Animal Health Regulation, Regulation 2016/429, but also potentially for cocoa, coffee or other commodities under national or EU law), micro or small primary operators can be fully exempted from filing the simplified declaration.

Instead, the Member State loads their data directly into the EUDR system and assigns an identifier. This is not optional, it applies whenever “all” information in Annex III is already held in such a system and the Member State facilitates access. The implication is that countries serious about simplifying for their smallholders should invest in integrating existing databases with the EU’s EUDR IT infrastructure by late 2026.

6.4. Proportionality exception: low‑intensity grazing and small‑scale agriculture

The regulation explicitly codifies a proportionality clause that may protect some land uses from being classified as deforestation:

Extensive or occasional small scale grazing in forests is not to be treated as predominantly agricultural use, so long as production and related activities do not harm forest habitats. This matters for pastoral systems, agroforestry and other low intensity practices that might otherwise trigger severe deforestation concerns. The principle is that insignificant activities, when viewed in context, deserve proportionate treatment.

6.5. Information system contingency and operator communication

The EUDR information system must now have contingency measures in place for when key functionalities become unavailable. The Commission will publish implementing acts detailing how the system handles outages and which functions are prioritised for recovery. This reflects lessons learned from the system's launch in December 2024, when unexpected traffic surges highlighted the need for robustness planning.

Moreover, the system is explicitly tasked with supporting communication between competent authorities and operators, including via digital supply‑chain management tools. This suggests future integration with blockchain, track‑and‑trace platforms and enterprise software that cocoa traders and chocolate makers already use.

6.6. Financial fines scaled to EU turnover, not just infringement value

A powerful enforcement lever: for legal person operators, downstream operators or traders, fines can be as high as 4 percent of their total EU wide annual turnover in the preceding financial year, with explicit provision to increase fines beyond that threshold if needed to exceed any economic gain.

This moves EUDR penalties into the realm of competition law and data protection, which also use turnover based caps, signalling that Brussels treats EUDR violations as systemic business misconduct, not isolated regulatory slip ups. A major chocolate company with €500 million in EU sales could face a fine floor of €20 million, a jaw dropping figure that concentrates the mind.

6.7. Confiscation of products and revenues: not just fines

Beyond monetary penalties, the regulation mandates that Member States can confiscate both:

• The non‑compliant products themselves;
• All revenues obtained from selling those products.

This dual mechanism means that if cocoa or chocolate derived from non‑compliant cocoa is seized, the operator loses not just the fine but the entire commercial value of affected sales. Combined with corrective measures (withdrawal, recall or donation), this makes EUDR violations financially catastrophic.

6.8. Inter‑authority intelligence sharing and technical error reporting

Member States must now formally report to the Commission any significant documented technical errors or serious disruptions affecting the EUDR information system. They also exchange control results and operator data freely among themselves and with Brussels, building a centralised picture of compliance patterns and circumvention risks. This information‑pooling apparatus, if managed well, could become a powerful tool for detecting coordinated non‑compliance or supply‑chain manipulation across borders.

6.9. Risk profiling and automated selection for controls

The information system must support automated risk profiling of operators, downstream operators, traders and commodities or products, using electronic data processing. This allows competent authorities to move away from manual, subjective operator selection towards algorithmic targeting of high risk patterns, including mixing, sudden volume spikes, changing suppliers and geographic red flags. For compliant operators, predictability and reduced audit frequency should follow, while for non compliant ones, increased scrutiny applies.

6.10. Commission guidance on best practices and multi‑stakeholder dialogue

The Commission is mandated to issue harmonised guidance in ongoing dialogue with experts, stakeholders and all relevant operators, including micro or small primary operators, downstream operators and traders. It must also leverage its existing Multi stakeholder Expert Group on Forest Protection and Restoration. This governance structure, open and iterative, is the EU’s signal that EUDR is not a “set it and forget it” rule but a living regulatory ecosystem requiring continual calibration.

7. The broader stakes: what this reform signals for future EU commodity law

Regulation 2025/2650 is a template for how Brussels manages escalating regulatory intensity. The EUDR was already one of the most complex supply‑chain laws ever adopted. Rather than roll it back when implementation proved harder than expected, the EU chose to:

• Differentiate obligations by actor size and risk profile;
• Reduce direct interactions with central IT infrastructure;
• Leverage existing national/sectoral traceability systems;
• Build in early review checkpoints to catch problems before they metastasize.

This pattern, tiered responsibility, risk based controls, database reuse and agile governance, will likely influence future EU commodity and due diligence laws, including carbon, biodiversity and human rights. Cocoa companies watching the EUDR now should expect similar architectures in the next generation of EU trade law.

The bigger picture on competitiveness

The 2025 reform is also the EU’s answer to the “competitiveness paradox”, how to maintain environmental and social standards without driving business away. By simplifying compliance for small producers and downstream actors in low risk geographies, and by focusing enforcement intensity on large, non SME actors and high risk origins, the regulation tries to distribute the burden proportionally. Whether this works, whether it really does reduce compliance costs without opening loopholes for circumvention, will be the subject of the April 2026 review and the full evaluation in 2030.

8. Bottom line for cocoa stakeholders

For cocoa producers, traders, processors and chocolate makers, Regulation 2025/2650 delivers a mixed but ultimately workable settlement:

For smallholder cocoa farmers in low‑risk countries:
The one‑off simplified declaration replaces transaction‑level due diligence. Combined with postal addresses instead of geolocation and potential database exemptions, this dramatically reduces compliance friction. However, they still need to track and identify their plots and declare annual volumes reliably.

For cocoa importers and first‑placement operators:
Full due diligence remains mandatory, but they become the choke point for traceability. They must capture upstream simplified declaration identifiers from small producers and pass them downstream, concentrating the IT interaction at a single point rather than dispersing it across the entire chain.

For cocoa grinders, processors and chocolate makers (downstream operators):
No need for re‑checking or new due diligence statements. Instead, they manage traceability information and, if they are non‑SME, assume a gatekeeper role for risk flagging. This is a massive simplification compared to the original EUDR design.

For enforcement authorities:
Risk‑based controls, automated profiling and minimum check rates provide a structured, data‑driven approach. Early review in April 2026 allows for real‑time adjustments.

For cocoa‑producing countries:
Low‑risk classification becomes a competitive advantage, unlocking the simplified regime and lowering inspection burdens. The incentive to improve governance and close deforestation loopholes is sharpened.

The bottom line: cocoa supply chains can now operate under EUDR without grinding to a halt, provided stakeholders invest in mapping, data integration and first‑placement governance. Compliance is non‑negotiable; the path to it is now more realistic.

Note: This analysis is based on Regulation (EU) 2025/2650, adopted 19 December 2025 and published in the Official Journal on 23 December 2025, amending Regulation (EU) 2023/1115. Key application date: 30 December 2026 for most operators; 30 June 2027 for micro/small primary operators established as such by 31 December 2024.