Article 25 of Regulation (EU) 2023/1115 requires Member States to set maximum fines of at least 4% of an operator's or trader's total annual Union-wide turnover for breaches of the EU Deforestation Regulation (EUDR), alongside confiscation of the products concerned and the revenues derived from them. That ceiling is the floor of the EUDR penalty regime, not the cap.

With the application date now pushed to 30 December 2026 under Regulation (EU) 2025/2650, sustainability and compliance teams have one more financial year to prepare. That preparation looks different once you read Article 25 next to the revised Environmental Crime Directive, which adds imprisonment for natural persons who commit the offence, and fines of up to 5% of worldwide turnover to the same conduct. EUDR exposure in 2026 and 2027 is a stacked enforcement regime, and it lands on the balance sheet rather than in the sustainability report.

The four penalty tiers Member States must transpose under Article 25

Article 25 EUDR sets out four categories of sanction that competent authorities can impose on operators and traders, and Member States must transpose each of them into national law. The categories include fines, confiscation, temporary exclusion from public procurement and a temporary trading ban.

On fines specifically, the regulation requires Member States to calibrate them to the environmental damage caused and the value of the commodities or products concerned - and to increase them progressively for repeated infringements. The penalties must be effective, proportionate and dissuasive.

For legal persons, the maximum fine must be set at no less than 4% of the operator's or trader's total annual Union-wide turnover in the year preceding the fining decision. That 4% is therefore a floor on what Member States must allow - national law can go higher, but not lower. There is also a hard override where the economic benefit an operator derived from the infringement would exceed that ceiling. In this instance, the fine must be increased beyond it regardless. An operator that saved or gained more than 4% of its EU turnover through non-compliance has no cap protection at all.

Confiscation of the non-compliant products and of the revenues gained from the transaction sits alongside the fine. A single shipment of cocoa, soy or palm oil that fails the due diligence test can therefore trigger both a monetary penalty calculated on group turnover and seizure of the underlying goods. For perishable commodities, the goods lose their value before they are returned, and confiscated revenue is calculated on gross sales rather than on margin.

The third tier is temporary exclusion from public procurement processes and from access to public funding, for a maximum of 12 months. For operators that sell to government buyers in any of the 27 Member States, this sanction can foreclose more revenue than the fine itself. The fourth tier is a temporary prohibition from placing or making available relevant products on the EU market, which is the most operationally damaging of the four because it halts the revenue stream rather than taxing it.

Article 24 of the regulation runs parallel to the penalty regime. Under Article 24(2), competent authorities can require operators to withdraw or recall a product, donate it to charitable or public interest purposes, or dispose of it under EU waste management law. These corrective actions sit on top of the penalty rather than replacing it, meaning a non-compliant shipment can attract a fine, a confiscation order and a recall obligation in the same enforcement action.

Supply chain due diligence is therefore not just a documentation exercise. It is the primary defence against a four-part sanction stack that operates simultaneously.

{{product-tour-injectable}}

How the 4% turnover fine is actually calculated

The 4% maximum applies to total annual Union-wide turnover, which is the figure that matters for any operator with a presence in more than one Member State. The Regulation (EU) 2023/1115 describes the threshold as a maximum of at least 4% of the operator's or trader's annual Union-wide turnover, meaning Member States are free to set higher national ceilings but cannot go lower. The base is total EU turnover, not turnover from the non-compliant commodity line.

That distinction matters most for multinational operators. A trader with a single non-compliant cocoa import faces a fining base that includes its packaging, retail and logistics turnover across every Member State where it operates. Penalty severity is calibrated to the environmental damage caused and the value of the commodities, which means weak or absent due diligence files raise the multiplier before the percentage is even applied.

The European Commission's official Guidance, developed with Member State representatives, covers penalties alongside geolocation, traceability and the EUDR Information System. That guidance is the reference point national competent authorities will use to set their calibration of fines, and it confirms that proportionality applies to environmental damage and product value, not to a company's ability to pay.

Criminal liability under the revised Environmental Crime Directive

EUDR exposure no longer ends with administrative fines. Directive (EU) 2024/1203 on the protection of the environment through criminal law was published in the Official Journal on 30 April 2024 and replaces Directive 2008/99/EC. The recitals state plainly that existing penalty rules under the previous directive and Union environmental sectoral law have not been sufficient to achieve compliance, which is the policy justification for adding criminal sanctions.

The European Parliament's Legislative Train file sets out the penalty levels in detail. Natural persons - meaning individual human beings, such as a company director, compliance officer, or sole trader - responsible for environmental offences causing death may be sentenced to up to 10 years in prison, qualified offences are punishable by up to 8 years, and most other offences by up to 5 years. Legal persons - meaning incorporated entities such as limited companies, subsidiaries, and corporate groups - face fines with a minimum maximum of 3% or 5% of annual worldwide turnover, or fixed amounts of at least EUR 24 million or EUR 40 million, depending on offence severity, with the choice of method left to Member States.

The legislative summary of Directive (EU) 2024/1203 clarifies what counts as a qualified criminal offence: unlawful acts that cause irreversible or long-lasting damage to an ecosystem of considerable size, or that substantially harm air, soil or water quality. Serious negligence is enough in some cases, not just intent. For an operator placing soy or palm oil from a deforested plot on the EU market, that threshold is closer than it looks.

The directive also reaches into corporate governance. The full text allows accessory penalties on legal persons that include obligations to install due diligence schemes and to promote compliance and transparency. Member States must transpose the directive within 24 months of its entry into force, which puts national criminal provisions in place during the same window that EUDR enforcement begins. EUDR breaches that satisfy the qualified offence threshold can move from administrative file to criminal docket in the same Member State.

Where enforcement will hit first in 2026 and 2027

The application date for large and medium operators is now 30 December 2026, with micro and small enterprises following on 30 June 2027. Both dates come from Regulation (EU) 2025/2650, which moved through its final legislative steps in quick succession: the European Parliament voted on 17 December 2025, the Council formally adopted it on 18 December, and the final act was signed on 19 December 2025 - the date the regulation officially bears. It was published in the Official Journal on 23 December 2025 and entered into force on 26 December 2025.

The Council's formal adoption note explains that the postponement is intended to streamline due diligence requirements and to allow improvements to the IT system used for electronic due diligence statements.

Two practical consequences follow. First, the categorisation of an entity as operator, trader or downstream operator now determines which obligations apply and which DDS reference is owed, and the revised definitions sit in the amending regulation rather than the original text. Second, the Commission was required to deliver a simplification review by 30 April 2026 - that review was published on 4 May 2026, slightly past its deadline. The package is more refinement than reform: it clarifies obligations but does not delay enforcement. The December 2026 deadline remains unchanged. For a full breakdown of what the package contained, see the EUDR simplification 2026 article.

The hidden costs beyond statutory fines

The 4% turnover figure is the line item the board will see, but it is rarely the largest exposure. A temporary market ban under Article 25 halts shipments mid-contract, which exposes operators to breach-of-contract claims from downstream buyers who cannot accept non-compliant goods. Those claims are calculated on the customer's loss, not on the operator's margin, and they sit outside the EUDR penalty cap.

Procurement exclusion is the second hidden cost. Penalties include temporary exclusion from public procurement processes and from access to public funding. For commodities like timber, paper, cocoa, coffee and soy that move through public-sector kitchens, hospitals and offices, losing access to tender lists across the EU compounds the financial damage well beyond the original fine.

Reputational exposure with banks, insurers and CSRD-reporting customers is the third. Large customers downstream are required to disclose value chain risks under their own reporting obligations, which makes the supplier list a live data set that updates as enforcement actions are published. An EUDR sanction can prompt buyer reviews in commercial relationships that have nothing to do with the original product flow.

The fourth cost is the criminal accessory penalty. Under Directive (EU) 2024/1203, courts can impose obligations on legal persons to install due diligence schemes and to promote compliance and transparency. In practice, that means a court-ordered compliance programme on top of any administrative remediation already imposed by the EUDR competent authority. The directive aims to strengthen prevention through compliance schemes, compliance officers, and cross-border cooperation, which writes the existence of a compliance function into the sentence itself.

{{custom-cta}}

The due diligence evidence that limits penalty exposure

Penalty calibration under Article 25 depends on whether the breach was negligent or intentional and on the documentary record the operator can produce. A defensible due diligence system is therefore not a procedural nicety. It is the primary statutory defence against the highest multipliers in the fining range. The Commission's Guidance on EUDR implementation covers geolocation data, traceability, product scope, definitions, due diligence and the EUDR Information System, and is the document national competent authorities will reference when evaluating whether an operator's system meets the standard.

Five elements carry the most weight in an enforcement file:

• Geolocation evidence linking each commodity batch to the plot of land where it was produced, with timestamps that pre-date placement on the EU market
• A risk assessment that names the source country, the deforestation risk classification and the specific mitigation actions taken
• Supplier verification documentation, including the evidence requested from suppliers and the corrective actions taken when gaps were identified
• A DDS reference number submitted via the EU Information System before the product is placed or made available on the market
• An internal escalation procedure and a named compliance officer with documented authority to halt shipments

The last point connects directly to the Environmental Crime Directive. The directive identifies compliance schemes and compliance officers as preventive mechanisms, which means a documented internal structure is read by both EUDR and criminal-law authorities as evidence of supervision and control. Operators that can produce timestamped DDS submissions, plot-level geolocation and a current risk assessment are positioned to argue down the negligence multiplier rather than absorb it.

For operators relying on third-party verification, the role of certification schemes like FSC, RSPO and Rainforest Alliance is treated as supporting evidence under the Commission Guidance, not as a substitute for the operator's own due diligence file.

What to do before the first 2026 enforcement checks

The work that limits penalty exposure has to happen before the first DDS is submitted, not after the first competent authority letter arrives. Five actions should be on the compliance plan for the next two quarters:

1. Map every EUDR-relevant product flow against the four sanction tiers in Article 25, and identify which legal entity's Union-wide turnover would form the fining base for each flow
2. Confirm the revised operator definitions under Regulation (EU) 2025/2650 and reclassify entities where the new downstream operator category changes which obligations apply
3. Stand up a DDS workflow that produces a reference number before placement on the EU market for large and medium operators from 30 December 2026, and a separate workflow for micro and small operators ahead of 30 June 2027
4. Document supplier verification and risk mitigation in a single audit-ready file per commodity, calibrated to the high, standard and low country risk classifications used by the Commission
5. Name an internal compliance officer with documented authority over EUDR submissions, and connect the role to the directors' supervision and control duties under Directive (EU) 2024/1203

Operators that still have open questions about scope, definitions or system functions should track the Commission's simplification review report and any further guidance updates published through 2026. The EUDR FAQ guide covers the most common operator and trader questions in detail.

Frequently asked questions

What is the maximum EUDR fine in 2026?

The maximum fine under Article 25 of Regulation (EU) 2023/1115 is at least 4% of the operator's or trader's total annual Union-wide turnover, calibrated to the environmental damage caused and the value of the commodities concerned. Member States can set higher national ceilings but cannot go below the 4% floor.

When do EUDR penalties start to apply?

Penalties apply once the substantive obligations of the regulation apply. Under Regulation (EU) 2025/2650, that date is 30 December 2026 for medium-sized and large operators and traders, and 30 June 2027 for natural persons and micro and small enterprises.

Can EUDR breaches result in criminal charges?

Yes. Directive (EU) 2024/1203 on environmental crime sets minimum criminal penalties for serious environmental offences, with imprisonment of up to 10 years for natural persons in the most severe cases, and fines of up to 5% of worldwide turnover or EUR 40 million for legal persons.

Are confiscation and market bans separate from the fine?

Yes. Article 25 EUDR allows competent authorities to impose confiscation of non-compliant products and revenues, temporary exclusion from public procurement and access to public funding, and temporary prohibition from placing or making available relevant products on the EU market. All four sanctions can be combined in a single enforcement action.

Does a certification scheme protect against EUDR penalties?

No. Under the Commission's EUDR Guidance, certification and third-party verification can support an operator's due diligence file but do not replace the statutory obligations under Articles 8 to 11 of Regulation (EU) 2023/1115. The operator remains legally responsible for the DDS and the underlying evidence.