GuideMetals & Mining

Mineral supply chain due diligence: frameworks, chain of custody and traceability records

Customers, auditors and regulators increasingly want evidence that metal was sourced responsibly, not just a policy saying so. Most regimes build on the OECD five-step due diligence framework, then differ on which minerals, which companies and what proof. This guide maps the main regimes, what each chain-of-custody model can prove, the records each node should keep, and where digital traceability helps.

Reviewed 8 min read

On this page
  1. Who is asking for sourcing evidence, and why
  2. Applying the OECD five-step framework in a mining or refining business
  3. Regimes that buyers and regulators point to
  4. Chain-of-custody models and the claims each can support
  5. Where traceability records are created along a battery-metal chain
  6. Records each supply chain node should keep
  7. What a ledger can and cannot prove about origin
  8. First moves for a smaller producer
  9. Tracing a hypothetical cobalt hydroxide shipment to a refinery
  10. Questions and answers
  11. Sources

Who is asking for sourcing evidence, and why

Pressure arrives from several directions at once. Battery and vehicle makers need supplier evidence to meet their own legal duties; electronics brands rely on smelter and refiner assessments for conflict-minerals reporting; lenders and offtakers write due diligence into financing and supply terms; and EU importers of tin, tantalum, tungsten and gold carry direct obligations under Regulation (EU) 2017/8212.

Each asks a slightly different question: did this material come from a conflict-affected or high-risk area, were human rights and environmental risks addressed, and can the chain of custody be shown? Answering once, from records that serve every audience, costs far less than answering each questionnaire from scratch.

Applying the OECD five-step framework in a mining or refining business

The OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas sets out the framework most regimes refer to1.

  1. Establish strong company management systems

    Adopt a supply chain policy consistent with the guidance, give a senior manager responsibility for it, set up a chain-of-custody or traceability system, and create supplier engagement and grievance mechanisms.

    Owner
    Senior management and compliance

  2. Identify and assess supply chain risks

    Map the chain, look for red flags such as origin in or transit through conflict-affected and high-risk areas, and assess what you find against the policy.

    Owner
    Compliance and procurement

  3. Design and implement a risk response

    Report findings to senior management and decide whether to keep trading during measurable mitigation, suspend temporarily or disengage from a supplier.

    Owner
    Senior management

  4. Support independent third-party audits

    Audits take place at identified points in the chain, usually smelters and refiners. Upstream companies feed them with the information auditors need.

  5. Report on supply chain due diligence

    Publish policies, risk findings and responses each year, at a level of detail that respects legitimate commercial confidentiality.

Regimes that buyers and regulators point to

OECD Due Diligence Guidance for minerals[^1]

OECD members and adhering countries (recommendation)

Applies whenReferenced by most regimes below and by many customer codes of conduct.

  • Five-step, risk-based due diligence, with supplements for tin, tantalum, tungsten and gold.

Conflict Minerals Regulation (Regulation (EU) 2017/821)[^2]

European Union

Applies whenA Union importer brings in tin, tantalum, tungsten or gold ores, concentrates or metals above the regulation's volume thresholds.

  • Management systems, risk management, independent third-party audits and disclosure aligned with the OECD guidance.

Batteries Regulation (Regulation (EU) 2023/1542), battery due diligence[^3]

European Union

Applies whenAn economic operator above the turnover threshold places batteries on the EU market; the due diligence obligations were postponed to 18 August 2027 by Regulation (EU) 2025/15614.

  • Due diligence policies covering cobalt, lithium, nickel and natural graphite and their social and environmental risks.
  • Verification of those policies by a notified body, with periodic audits3.

LBMA Responsible Gold Guidance[^5]

Global, London bullion market

Applies whenA gold refiner is on, or seeks to join, the LBMA Good Delivery List.

  • Annual independent third-party audit against guidance that follows the OECD five-step framework5.

Responsible Minerals Assurance Process (RMI)[^6]

Global industry programme

Applies whenA smelter, refiner or recycler wants conformant status that downstream customers recognise.

  • Independent assessment of management systems and sourcing practices; RMI states it is not a material validation assessment6.

Critical Raw Materials Act (Regulation (EU) 2024/1252)[^7]

European Union

Applies whenA large company uses strategic raw materials to make batteries or other strategic technologies listed in the Act.

  • Periodic risk assessment of the company's strategic raw material supply chain, including where the materials come from7.

Chain-of-custody models and the claims each can support

ISO 22095:2020 sets out common chain-of-custody models. Which one applies decides what you can truthfully claim about a shipment.

CriterionIdentity preservedSegregatedMass balanceBook and claim
What stays separateMaterial from one named source, end to endCompliant material, mixed only with other compliant materialNothing physically; volumes are accounted forNothing; certificates trade apart from the material
Claim it supportsThis material came from this mineThis material came only from compliant sourcesA share of output matches compliant inputThe buyer supported compliant production somewhere
Records neededLot identifiers at every handover and process stepSupplier qualification plus segregation controls at each siteInput and output volumes reconciled per periodA registry of issued, transferred and retired certificates
Fit in metalsHard once smelting or refining merges lotsFeasible for dedicated supply linesCommon where refineries blend feedstocksRare for minerals; more usual for energy attributes
Main weaknessCost and handling disciplineNarrows supply optionsThe physical product may hold no compliant materialNo physical link to the product at all

Where traceability records are created along a battery-metal chain

01Mine or collection point02Processing plant03Export and transport04Trader or warehouse05Smelter or refiner06Cathode or cell maker
  1. Mine or collection point

    Origin, licence, production date and lot identifiers are created at the mine gate.

  2. Processing plant

    Assays, mass in and out, and which lots were merged into each output batch.

  3. Export and transport

    Bills of lading, seals, weights and the route, including transhipment points.

  4. Trader or warehouse

    Ownership transfers, and any splits or blends of lots.

  5. Smelter or refiner

    Receiving assays, feedstock reconciliation and assessment status.

  6. Cathode or cell maker

    Supplier declarations and the data a battery passport will need.

Conceptual chain for a battery metal; each arrow is a custody handover where records must link input lots to output lots.

Records each supply chain node should keep

0 of 7 checked

What a ledger can and cannot prove about origin

First moves for a smaller producer

  • If

    There is no written supply chain policy or named owner.

    Then

    Adopt a policy consistent with the OECD guidance and appoint a senior owner before buying any software.

    Every regime and customer audit starts by testing the management system.

  • If

    Customers send different questionnaires asking for the same facts.

    Then

    Build one evidence pack per product (origin, licences, assessments, risk notes) and answer every request from it.

    Auditors care more about consistent answers than about format.

  • If

    Your output is merged with other producers' material at a refinery.

    Then

    Agree with the refiner which chain-of-custody model applies and which lot data it needs from you.

    Your records carry weight only if they connect to the refiner's reconciliation.

  • If

    A customer asks for blockchain traceability.

    Then

    Ask which claim it must support and which records it needs, then choose the simplest system that produces them.

    A ledger is one way to share tamper-evident records, not a requirement of the main regimes.

Tracing a hypothetical cobalt hydroxide shipment to a refinery

Questions and answers

Does blockchain prove where a mineral came from?

No. A ledger proves that a record existed at a certain time and has not been altered since, and it lets several parties share one custody history. It cannot check whether the first entry was accurate. Origin claims depend on mine-site controls, independent assessments, physical evidence and audits; a ledger makes that evidence easier to share and harder to tamper with afterwards.

How does mineral due diligence relate to the EU battery passport?

From 18 February 2027, the Batteries Regulation requires an electronic battery passport for electric-vehicle batteries, light means of transport batteries and industrial batteries above a capacity threshold3. The passport carries information that includes due diligence data, so upstream records feed it directly. See the digital product passport use case for how passport data is assembled.

Is an RMAP assessment a check of the physical material?

No. The RMI describes the RMAP as an independent assessment of a smelter's or refiner's management systems and sourcing practices, and states that it is not a material validation assessment. It tells customers that a facility runs credible due diligence; it does not certify the origin of any particular lot. Lot-level claims need chain-of-custody records alongside it.

Do EU sourcing rules affect producers outside the EU?

Indirectly, yes. Regulation (EU) 2017/821 places obligations on Union importers, and battery due diligence falls on operators placing batteries on the EU market, but both can only comply with information from their suppliers. Mines, processors and traders elsewhere therefore receive questionnaires, audit requests and contract clauses that pass those duties up the chain.

Sources

  1. OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, Third Edition — OECD · checked 10 October 2026
  2. Regulation (EU) 2017/821 laying down supply chain due diligence obligations for Union importers of tin, tantalum and tungsten, their ores, and gold — EUR-Lex · checked 10 October 2026
  3. Regulation (EU) 2023/1542 concerning batteries and waste batteries — EUR-Lex · checked 10 October 2026
  4. Regulation (EU) 2025/1561 amending Regulation (EU) 2023/1542 as regards obligations concerning battery due diligence policies — EUR-Lex · checked 10 October 2026
  5. Responsible Sourcing Programme and Responsible Gold Guidance — London Bullion Market Association · checked 10 October 2026
  6. Responsible Minerals Assurance Process — Responsible Minerals Initiative · checked 10 October 2026
  7. Regulation (EU) 2024/1252 establishing a framework for ensuring a secure and sustainable supply of critical raw materials — EUR-Lex · checked 10 October 2026
  8. Hedera Consensus Service (HCS): verifiable ordering and timestamping — ColdAI

More in Metals & Mining

Back to Metals & Mining

Next step

Map your sourcing evidence against the regimes your buyers cite

Tell us which customers or regulations are asking, where your material goes and what records you keep today. We will reply with the gaps that matter most and whether a shared, tamper-evident record would add anything beyond better-kept files.

Discuss sourcing due diligence