Tier 2 and Tier 3 supplier due diligence: how to get evidence beyond your direct suppliers 

What are Tier 2 and Tier 3 suppliers, and why do buyers ask about them now?

Your Tier 1 suppliers are the ones you buy from and pay. Tier 2 suppliers sell to them: the mill that makes the fabric, the foundry that casts the part, the smelter behind the wire. Tier 3 sits one step further back, often at the raw material. You rarely have a contract with either, and many buyers do not know their names.

That gap matters more now because several rules look at how a good was made, not who sold it to you. US Customs can detain goods made wholly or in part with forced labor, including through their inputs, and the EU Forced Labour Regulation will apply the same logic to products sold in or exported from the EU. Customers pass the question down in their own requirements. The supplier regulation library lists each rule, its status and what it asks procurement to collect.

Why sub-tier visibility is hard

• No relationship: a Tier 2 supplier has no reason to answer you, and will not log in to your portal.
• Confidentiality: your direct supplier may see its sources as a commercial secret.
• Volume: one finished product can pull in dozens of sub-suppliers, most of them low risk.
• Change: sources move with price and capacity, so a declaration ages quickly.
• Format: evidence arrives as PDFs, spreadsheets and emails in several languages.

Where do you actually need evidence beyond Tier 1?

Not everywhere. A risk-based scope starts from where the exposure is and stops there. These are the usual triggers:

The material list above is a set of commonly cited examples, not an official list. Your compliance team decides which materials and origins your policy covers.

How to get sub-tier evidence through your direct supplier

1. Decide the scope in your policy

   Which products, materials, countries and spend levels need sub-tier evidence, and to which tier. Everything else stays at Tier 1. Writing this down is what keeps the work proportionate.

2. Ask your direct supplier, in the same thread you already use

   An email to the supplier listing, for the products in scope, what you need to know about its own suppliers: who they are, where they produce, and the documents that support it.

3. Read and match what comes back

   Declarations, certificates of origin, mill or smelter lists, audit reports. The agent checks that names, sites and materials agree across documents and with what the supplier declared before.

4. Screen the names that appear

   Each sub-supplier named is screened against sanctions and restricted-party lists your policy uses. A potential match always goes to a person.

5. Record what is known and what is not

   The supplier file shows, per product, the sub-suppliers declared, the evidence for each, and what the supplier could not or would not provide.

6. A person decides on gaps

   Approve, approve with a remediation plan, change the source, or stop. The agent prepares the decision; it does not make it.

This is the same exchange as onboarding a supplier without a portal, with a different question. The supplier answers by email with the files attached, and your team sees the result and the gaps in Microsoft Teams or Slack. The guide to supplier management without a new portal explains the full flow.

What evidence to ask for

• A written declaration of sub-suppliers for the products in scope, with legal name, site and country.
• Origin documents for high-risk materials: certificates of origin, mill or smelter declarations, chain-of-custody certificates where they exist.
• Recent social or environmental audits of the sub-supplier sites, with date, scope and corrective action plan.
• The direct supplier's own supplier code of conduct and how it passes your requirements down its chain.
• For forced-labor risk: recruitment policy, use of labor agencies and who pays recruitment fees.
• A dated statement of what the supplier cannot disclose, and why.

Ask for what your policy needs for that product, not the whole list. A supplier asked for everything tends to send nothing.

What the request looks like

The supplier answered one email. The approver sees what is known, what is not, and the rule that applies, and makes the call.

What to do when a supplier cannot or will not disclose

A refusal is information, and it should be recorded as such. Common responses, set by your policy and decided by a person: accept the gap with a dated request to close it, ask for a third-party audit or certificate instead of the name, add a contract clause at the next renewal, shift volume to a supplier that discloses, or stop buying the product where the risk is high. Under US import rules the burden of proof sits with the importer, so for goods in a high-risk category an undisclosed source can be a reason not to ship.

What this is not

• Not a full supply-chain map. It covers the products and tiers your policy puts in scope.
• Not an audit. The agent reads the evidence suppliers provide; it does not visit sites or certify compliance.
• Not a legal determination. Whether goods can be imported or sold is decided by the authorities, and your counsel advises on it.
• Not a replacement for traceability services where you need lab testing or isotopic analysis of materials.

To see how Nora handles requests and approvals, read her profile. To scope a pilot on the categories where sub-tier risk sits, book a call.

Frequently asked questions

This article is for information and is not legal advice. It reflects US and EU rules as checked on October 22, 2026. Whether a rule applies to you depends on what you import or sell, where, and your company's size; check with counsel.