Skip to content

Independent R&D project · Cologne

Back to the blog

Custody is not who held it. Custody is who can prove it.

Chain of custody as practised today is a chain of declarations reconciled by periodic sampling. European rules are starting to ask questions that only a chain of evidence can answer.

Published August 22, 2026 9 min read

A horizontal chain across a deep navy field. The links on the left are solid white, one link in the middle is green, and the links continuing to the right are drawn only as faint outlines.

One consignment, five sets of hands

A lot of green coffee leaves a smallholding, is delivered to a cooperative and is pooled with everything else that came in that week. It moves to a warehouse, then to a dry mill, where the graded output is recomposed into export lots that no longer correspond one to one to the bags that arrived. An exporter consolidates, books a container and issues the paperwork. Weeks later a buyer's team in Europe opens the file.

Their question is not whether a chain of custody exists. It plainly does: every handover left a document behind. The question is narrower and harder. Which of those links can you prove right now, from what is in the file, without phoning somebody. For most, the honest answer is that the document records that a handover happened and asserts what was handed over, and both facts rest on the word of the party who wrote them down.

What the phrase means today

Three models were inherited from the schemes that formalised the term. Identity preservation keeps one source's material physically separate from first step to last, so the unit that arrives is the unit that left. Segregation keeps material carrying a given claim apart from material that does not while allowing mixing within the claim, so what arrives carries the claim but no individual origin. Mass balance allows the mixing and reconciles the quantities administratively instead.

Mass balance was designed to reconcile volumes that carry a given claim with volumes that do not, across a defined system boundary and accounting period, so that no more is sold under the claim than entered under it. It was not designed to preserve the physical identity of every unit through every transformation. Inside its own scope it is coherent, and run in good faith by people who know exactly what it does. The difficulty begins when a question arrives that it was never built to answer.

Evidence handling settled the underlying point long ago. In forensics, chain of custody is not a record of who held the item. It is the ability to demonstrate each handover to somebody who was not present and has no reason to trust the party handing over. Every transfer is fixed as it happens, by identified people, in a form a later reader can test without the original participants. The custody is not the point. The demonstrability is. Custody is not who held it. Custody is who can prove it.

Supply chain practice inherited the vocabulary and left much of that discipline behind. A statement signed by the party with the strongest interest in its content is not evidence of a handover but a claim about one, tested afterwards, if at all, by sampling that reaches a fraction of such claims at yearly intervals.

The regulation asks where, not whether

Regulation (EU) 2023/1115, the EU Deforestation Regulation, does not ask whether a company has a chain of custody policy. Article 9(1)(d) requires the geolocation of all plots of land where the relevant commodities the product contains, or was made using, were produced, with the date or time range of production, and where several plots contributed, the geolocation of all of them. It asks where the commodity inside the product was actually produced, and each contributing plot must be identified.

For larger plots, that location takes a particular form. Article 2, point (28) defines geolocation as latitude and longitude to at least six decimal places, and for plots of more than four hectares used to produce relevant commodities other than cattle it requires polygons describing the perimeter. A boundary, rather than a declaration of origin. The rule is not universal, and became less so in December 2025: Article 4a(5), inserted by Regulation (EU) 2025/2650, lets micro or small primary operators give the postal address of the plots or of the holding instead. That regime turns on who the operator is, not on what is convenient, but it is real: the polygon rule must not be written as though it covered everyone.

What does not change is the shape of the question. Mass balance can reconcile quantities; it cannot turn several physical origins into one geographic origin, because a geographic origin is not a quantity and does not average. Four plots do not resolve into a fifth. There is no average polygon. Where the answer has to be a place, a method built to answer in volumes has nothing to hand over.

The same problem, in a chain that looks nothing like it

Coffee and batteries appear to have little in common, and their evidence problem is almost identical. A coffee lot begins on a plot of land; battery minerals begin at an extraction site. Both enter long chains in which identity gets harder to prove at every step, and in which the paper trail lengthens while its connection to the original place thins.

Regulation (EU) 2023/1542, the EU Battery Regulation, will require certain operators to close part of that distance. Article 49(1)(d) obliges an operator within scope to run a system of controls and transparency over the supply chain, including a chain of custody or traceability system, identifying upstream actors. Article 49(2) sets out the documentation underneath it: the raw material, the supplier, the country of origin and the market transactions from extraction to the immediate supplier, the quantities present, and third party verification reports. Where those reports are unavailable and the material comes from a conflict affected or high risk area, Article 49(2), point (f) reaches to the mine of origin and the locations where the material is consolidated, traded and processed.

Two limits belong with that. The obligations are not in force yet: Article 48(1) originally set 18 August 2025, and Regulation (EU) 2025/1561 replaced that date with 18 August 2027. Article 47 also exempts operators below EUR 40 million net turnover that are outside a larger group. The raw materials are listed in Annex X: cobalt, natural graphite, lithium and nickel, with the chemical compounds based on them. These are critical raw materials of mineral origin, extracted at determinable sites, and not rare earth elements, which are a different list entirely.

Different instruments, one infrastructure problem

Deforestation due diligence under Regulation (EU) 2023/1115, battery due diligence under Regulation (EU) 2023/1542 and the digital product passport under Regulation (EU) 2024/1781 are different instruments, with different scopes, obligated parties and timetables. A due diligence statement is not a battery due diligence policy, and neither is a product passport, which under Articles 8 and 9 of the ESPR carries whatever a delegated act sets for its product group. Nothing in the three texts says that satisfying one produces the others.

These rules do not create one common database, one common passport or even one common compliance process, but they expose the same infrastructure problem, that a claim about a product is only useful if its evidence survives the journey with it. Each asks, in its own vocabulary, that a downstream party be able to check an upstream event they did not witness. That is a question about how evidence travels before it is a question about any single regulation.

Declared, located, verified

Three things usually spoken of as one are worth separating. Declared origin: this came from Farm A. Located origin: Farm A corresponds to these coordinates. Verified origin: the location claim itself has been checked against evidence independent of the assertion. These are not degrees of precision on one scale. They are three different objects, and only the third holds up in front of a reader with no particular reason to trust the writer.

Traceability tells you where a claim points. Verifiability tells you whether there is reason to trust it. Many traceability systems can identify an origin without independently testing the evidence behind that origin, which is not a defect but the scope they were built to. But a complete traceability record and a defensible evidence record are not the same artefact, and holding the first says nothing about the second.

The ways chains break in ordinary operation are undramatic and have nothing to do with fraud. A link that exists only inside an email thread between two people, one of whom has left. A handover written up afterwards, from memory, once the truck had gone. Paperwork correct in every particular except which consignment it refers to. And an audit that arrives once a year, careful and competent, in November, to look at a shipment that left in March. The information existed. It was never fixed in a form that could travel with the goods.

Before the goods move

The problem is not that the chain lacks information, the problem is that information and evidence often stop travelling together. The figures arrive; the ability to demonstrate them stays behind. And the moment of discovery matters. Asked at the border, the question arrives when the container is already sealed and every remaining option is expensive. Asked before the goods move, it is still a question about paperwork.

Custody is not who held it. Custody is who can prove it. Link by link, each handover is either independently verifiable or it is one more declaration, and the time to find out which is before the goods move.

Inspect one lot yourself. No account. No sales call. Follow the evidence and decide where the chain holds.

Key dates

  • 26 July 2026. Deadline for the Commission to publish guidelines on the battery due diligence requirements of Articles 49 and 50 (Regulation (EU) 2023/1542, Article 48(5), as amended by Regulation (EU) 2025/1561).
  • 30 December 2026. The main obligations of the EU Deforestation Regulation apply, including the Article 9(1)(d) geolocation duty (Regulation (EU) 2023/1115, Article 38(2)).
  • 30 June 2027. The same obligations apply to operators who are natural persons or micro and small undertakings established as such by 31 December 2024, except as regards products covered by the Annex to Regulation (EU) No 995/2010 (Regulation (EU) 2023/1115, Article 38(3)).
  • 18 August 2027. Battery due diligence obligations, including the chain of custody or traceability system, apply to operators within scope (Regulation (EU) 2023/1542, Article 48(1), as amended by Regulation (EU) 2025/1561).

Sources

  • Regulation (EU) 2023/1115 (the EU Deforestation Regulation), Article 2, point (28), Article 4a, Article 9(1)(d) and Article 38. The definition of geolocation including the four hectare polygon rule, the simplified regime for micro or small primary operators and its postal address option, the plot level geolocation duty, and the application dates. Read in the consolidated version in force since 26 December 2025.
  • Regulation (EU) 2025/2650. Of 19 December 2025, amending Regulation (EU) 2023/1115; published in the Official Journal on 23 December 2025. Inserted Article 4a, the simplified regime for micro or small primary operators.
  • Regulation (EU) 2023/1542 (the EU Battery Regulation), Article 47, Article 48(1), Article 49 and Annex X, point 1. The turnover threshold that bounds the due diligence chapter, the application date, the obligation to operate a chain of custody or traceability system identifying upstream actors and the documentation underneath it, and the list of raw materials: cobalt, natural graphite, lithium and nickel.
  • Regulation (EU) 2025/1561. Of 18 July 2025, amending Regulation (EU) 2023/1542; replaced 18 August 2025 with 18 August 2027 in Article 48(1), and 18 February 2025 with 26 July 2026 in Article 48(5).
  • Regulation (EU) 2024/1781 (the ESPR), Articles 8 and 9. The digital product passport as an instrument whose content and format are set product group by product group in delegated acts, and the accurate, complete and up to date standard for the data it carries.

Every article number and every date above is taken from the cited instrument's own text as published in the Official Journal, in the version in force at the date of this article, not from secondary reporting.

This article is informational and is not legal advice. What a given company owes depends on its products and its own facts, and the authoritative EU legal texts prevail over any summary of them.

Written by Luiz Hogrefe.

Share this article

Public feedback

Have a correction, implementation note or different architectural view?

Discuss this articleView the public discussion