Auditing The Auditors

In Two Regulations, One Direction, we described the coordinated package China's State Council issued on April 7, 2026—Decree No. 834 on industrial and supply chain security and Decree No. 835 on countering "improper extraterritorial jurisdiction"—and observed that its significance would turn on how, and against whom, the new machinery was used. On August 5, Beijing answered part of that question. MOFCOM Order No. 2 of 2026 added six US entities to the countermeasure list maintained under the Anti-Foreign Sanctions Law (AFSL)¹ for "assisting and supporting" US Xinjiang-related sanctions, prohibiting organizations and individuals within China from any transactions or cooperation with them, effective immediately. Among the six is the Responsible Business Alliance (RBA)—the multi-stakeholder coalition whose Code of Conduct, Validated Assessment Program (VAP) audits, and Responsible Minerals Initiative (RMI) sit beneath a remarkable share of global supply chain due diligence. The designation does more than limit the operations of the specific entities. For companies sourcing from or investing in China, the designations shape how they share supply chain information with data and verification providers, and how they sustain the certification-based audit trail that RBA programs have long supplied—and on which EU due diligence regulations increasingly rely.

Targeting the Enforcement Supply Chain

The six designees—Applied DNA Sciences, Stratum Reservoir, Altana Technologies, RBA, Verité Group, and Human Rights in China²—are not random. They are a cross-section of the evidentiary apparatus on which US forced labor enforcement runs: forensic origin testing (DNA tagging and stable isotope analysis used to prove provenance to CBP), supply chain data mapping (Altana's platform, selected by CBP in 2025 for its "product passport" pilot), labor-rights research (Verité), advocacy (Human Rights in China), and the audit and certification layer (RBA) that multinationals cite when they tell a regulator their supply chain is clean. Beijing has not sanctioned the companies that terminate Chinese suppliers; it has sanctioned the infrastructure that tells them which suppliers to terminate. Regimes like the Uyghur Forced Labor Prevention Act (UFLPA) are only as strong as their evidence, and the evidence is produced by a small number of identifiable organizations, which is now even smaller.

Order No. 2 treats its designees identically, but they divide into two categories the instrument reaches very differently. RBA and Verité are cooperation-dependent: their product requires willing counterparties inside China—factories hosting auditors, smelters paying fees—so a territorial transaction ban excludes them directly. Altana is observation-based: its maps are built from third-country customs records, bills of lading, shipping data, and corporate registries, inputs that require no Chinese entity's cooperation. Beijing can prohibit persons in China from feeding the platform or buying its services, degrading data completeness at the margin, but it cannot prohibit the platform from observing China. A territorial ban can switch off the auditors; it cannot switch off the cartographers.

That asymmetry suggests that the next steps are likely to be data-governance measures rather than list additions alone. Article 13 of Decree No. 834 already ties supply chain information collection in China to the Data Security Law, PIPL, Cybersecurity Law, and Counter-Espionage Law, and the Data Security Law claims jurisdiction over offshore data activities that harm PRC national security.³ Where the countermeasure list runs out of jurisdiction, data sovereignty picks up: restricting the export of customs, logistics, and registry data at the source—as China has already done with Automatic Identification System (AIS) vessel-tracking data and corporate-registry databases⁴—would degrade every foreign mapping platform simultaneously, listed or not, alongside personnel and travel risk for anyone whose observation can be characterized as unlawful data activity.

For multinationals relying on these sources as part of their supply chain due diligence, a risk to track is what information they share with those entities, and how that information is shared. Most enterprise customers enrich the vendor's public-data baseline with their own information—supplier lists, purchase-order and shipment data, bill-of-materials detail, diligence findings on their upstream supply chains. Where any part of that feed originates with, passes through, or is administered by a PRC subsidiary, the designation creates a two-front problem. First, a China-incorporated subsidiary that contracts with, pays, or submits data to a listed entity is squarely within the Order No. 2 prohibition; and it is no defense that the master agreement sits with the offshore parent, given the reading Chinese industry bodies have adopted for RBA. ⁵ Second, and independent of the listing, moving supplier and logistics data collected in China onto an offshore platform is a regulated cross-border transfer: outbound transfers of "important data" require a security assessment under the framework anchored in Article 31 of the Data Security Law and Article 39 of the Cybersecurity Law and operationalized by the CAC's outbound data transfer security assessment measures, transfers of personal information must proceed through one of the PIPL's prescribed mechanisms, and Decree No. 834 has now expressly tied supply chain information to that framework—meaning transfers that once passed as routine are more likely to be scrutinized as national-security-sensitive.⁶

The RBA Implications

The RBA sanction is particularly noteworthy because of how integrated the organization and standards are in electronics and minerals supply chains. Chinese industry bodies moved quickly to give the prohibition content. On August 6, the China Chamber of Commerce of Metals, Minerals & Chemicals Importers & Exporters instructed Chinese mineral companies to immediately halt RBA- and RMI-related audits, training, fee payments, and data submissions, to handle existing audit results and logos cautiously, and to seek alternative compliance mechanisms, warning members that the designation could disrupt "supplier qualifications, new orders and existing contracts."⁷

The Chamber treated RMI as within scope of the RBA designation—a reading that extends the prohibition from electronics-sector factory audits down into the smelter- and refiner-level assurance work anchoring tin, tantalum, tungsten, and gold (3TG) and battery-minerals due diligence globally. Because RBA's members cascade Code requirements upstream to their Chinese suppliers, and because RMI's Responsible Minerals Assurance Process (RMAP) is the dominant assurance scheme for smelters and refiners, the consequence cascades downstream: new certifications cannot issue, and existing ones will lapse as they come up for renewal. Whether audits performed in China under contracts signed offshore by multinational headquarters count as prohibited "cooperation" by persons within China is untested, but the conservative reading—the one the Chamber has adopted—is yes.

Two formal relief valves exist on paper. The 2025 AFSL implementing provisions introduced an exemption mechanism absent from the AFSL itself: where organizations and individuals in special circumstances genuinely need to conduct otherwise-prohibited activities with a listed entity, they may apply to the State Council department that made the designation, with supporting facts and reasons, and proceed upon consent; ⁸ and Decree No. 835 provides a parallel exemption pathway for parties caught between conflicting legal demands.⁹ But neither route has demonstrated practice for a designation of this kind, and processing timelines are unknown. Companies should treat exemption applications as worth pursuing where the commercial stakes justify the effort—and where the application itself will not create an unhelpful record—not as near-term relief to plan around.

The Brussels Challenge

The most interesting consequence may be felt not in Washington but in Brussels, because the EU has given RBA-affiliated assurance formal legal status. In October 2025, the Commission recognized RMI's RMAP—its 3TG standards—as the first due diligence scheme deemed equivalent under Article 8(3) of the Conflict Minerals Regulation, allowing EU importers to rely on sourcing from RMAP-conformant smelters and refiners in discharging their own obligations.¹⁰ The Batteries Regulation replicates this architecture for cobalt, natural graphite, lithium, and nickel: OECD-aligned due diligence policies, third-party verification by notified bodies, and a Commission-recognition mechanism for schemes modeled on the Conflict Minerals Regulation's.¹¹ When the Commission proposed in May 2025 to postpone the battery due diligence obligations to August 2027, it cited the immaturity of recognized schemes as a core reason—the delay was, in effect, a bet that infrastructure like RMAP would be ready by 2027.¹²

Order No. 2 undercuts the premise of that bet: the leading candidate scheme can no longer operate in the jurisdiction that hosts much of the capacity it is meant to certify. China holds a commanding share of global midstream processing for the minerals both regulations govern—a large fraction of RMAP-audited tin, tungsten, and gold smelters are Chinese, and Chinese dominance in graphite anode material, refined cobalt, and lithium chemicals is the central sourcing fact of the battery supply chain. If Chinese smelters and refiners cannot lawfully pay RMI, host its auditors, or submit data, their conformant status will decay facility by facility as reassessments come due. EU importers will find the recognized scheme progressively ceasing to cover the portion of the supply chain where the processing capacity and risk actually sit, delivering the promised simplification only for supply chains that avoid China. Beijing's countermeasure is aimed at US enforcement and says nothing about the EU; but because both regulations chose to deputize the same private assurance infrastructure the US enforcement apparatus uses, a strike on that infrastructure is a strike on both. Companies in scope should raise this squarely in their engagement with the Commission on Batteries Regulation implementation.

Practical Implications for Companies Investing in and Sourcing from China

The broad implication for companies' use of supply chain data providers is to structure carefully what is shared and how. Map how supply chain data actually flows into these platforms—who administers the account, which entity pays, where uploads originate, whether China-based personnel touch the interface—then ring-fence, holding contract, payments, and administration at the offshore parent, keeping submissions out of PRC entities and systems, and routing genuinely needed China-origin data through formal data-export compliance mechanisms.

For RBA members, and for any company relying on RBA-affiliated certifications in its due diligence file, the implications are more specific.

• First, treat certifications as depreciating assets. VAP audits and RMAP conformance determinations tied to Chinese facilities can no longer be assumed renewable. Companies should inventory which facilities in their upstream supply chain carry active RBA or RMI status, map expiration dates, and identify where a lapse would puncture the documentary record. The practical weight of RBA and RMI certifications lies in customer contractual flow-downs and in the broader due diligence file for regulatory compliance, which will be tested as renewals cease. The same applies to pending investment or restructuring decisions conditioned on RMAP-conformant sourcing, since the underlying verification may go stale before closing.
• Second, diversify the supply chain due diligence toolkit. The same order that reaches RBA also reaches Altana, meaning industry-run social audits and data-driven supply chain mapping—two structurally different tools—were constrained simultaneously. Verification concentrated in US-headquartered organizations with Chinese operations is now a correlated risk. Alternatives worth evaluating include audit schemes headquartered outside the US, internal assessment protocols not branded to a designated entity, chain-of-custody documentation generated by the company's own systems, and configurations that move the verification point outside China entirely.
• Third, companies need to be sensitive to the documentation trail on exits. Article 14 of Decree No. 835 and the AFSL's private right of action create exposure where supplier terminations are attributed to foreign sanctions or human rights compliance, and Decree No. 834's Article 15 investigation mechanism adds administrative exposure. The RBA designation sharpens this: a supplier's loss of certification is now a PRC-caused event, yet a customer that drops the supplier "for losing certification" is implementing a foreign compliance regime in a way Chinese authorities may characterize as discriminatory. Ground termination decisions in neutral commercial criteria, and draft instructions to China-based personnel on the assumption a Chinese regulator will read them.
• Fourth, the logic of targeting the assessors rather than the assessed extends naturally to other social auditors, certification schemes, traceability vendors, and standards bodies active in China. Any compliance program whose evidentiary core depends on a single foreign organization's continued ability to operate there should be stress-tested against that organization's designation.

Conclusion

For two decades, multi-stakeholder initiatives like RBA occupied a carefully cultivated middle ground—private, technical, ostensibly apolitical, and therefore able to operate on all sides of every border their members' supply chains crossed. Order No. 2, in effect, makes the auditor a party to the enforcement it enables. For companies, the operational answer is diversity and redundancy—in certifications, in verification methods, in documentation. For regulators, particularly in Brussels, the harder question is whether due diligence regimes built on private assurance schemes can survive a world in which those schemes are themselves sanctionable, or whether the verification layer of supply chain regulation is about to become as contested as the supply chains themselves.

Footnotes

1 Ministry of Commerce of the People's Republic of China, Order No. 2 of 2026, Decision on Taking Countermeasures Against Six US Entities Including Applied DNA Sciences, Inc. (Aug. 5, 2026), https://www.mofcom.gov.cn/zwgk/zcfb/art/2026/art_bd62c275eb144ba7bc6a50716ab823b6.html hereinafter Order No. 2, issued under AFSL arts. 3, 4, 6, 9, 10, 15 and arts. 3, 5, 8, 10 of the implementing regulations—notably the pre-existing AFSL list, not the new Decree No. 835 Malicious Entity List, confirming that the older instrument remains the workhorse while the decrees supply additional parallel channels.

2 Order No. 2, supra note 1, annex. The order's preamble frames the countermeasures as a response to recent US sanctions imposed on Chinese enterprises "under the pretext of so-called 'forced labor,'" and a MOFCOM spokesperson placed them in the context of the July 31 addition of more than forty Chinese entities to the UFLPA Entity List and of the broader set of measures announced the same day, while describing China's response as restrained. See MOFCOM Spokesperson's Remarks (Aug. 5, 2026); China Daily (Aug. 2026) (situating the designations among other countermeasures adopted and planned); China Announces Countermeasures Against Six US Entities, Xinhua (Aug. 5, 2026).

3 Regulations on Industrial and Supply Chain Security (PRC State Council Decree No. 834), art. 13; Data Security Law of the People's Republic of China (2021), art. 2; see Two Regulations, One Direction, Int'l Compliance Blog (Steptoe LLP, Apr. 30, 2026). The 2025 AFSL implementing provisions make the connection explicit within the countermeasure toolkit itself: article 9 includes prohibiting or restricting the provision of data and personal information to a designated party among the "other necessary measures" available under AFSL article 6, and article 13 authorizes barring parties that fail to implement countermeasures from receiving data or personal information from, or providing it to, parties outside China. Provisions on Implementation of the Anti-Foreign Sanctions Law (PRC State Council Decree No. 803, eff. Mar. 23, 2025), arts. 9, 13, official text hereinafter AFSL Implementing Provisions.

4 Following the entry into force of the Data Security Law and PIPL in late 2021, Chinese AIS data providers stopped supplying terrestrial vessel-tracking data to foreign users, with reported declines of 45–90 percent in signal availability in Chinese waters; see Report: New Data Law Cuts Off Access to Chinese AIS Tracking, Maritime Executive (Nov. 18, 2021) (citing Reuters). In 2023, Wind Information, Qichacha, and TianYanCha restricted offshore access to corporate-registry data, including shareholding structures and ultimate controllers, following Cyberspace Administration of China requirements; see China Restricts Overseas Access to Corporate Registry Databases, Bloomberg (May 3, 2023).

5 AFSL arts. 11, 14. Article 11 obligates "organizations and individuals within the territory of China"—which includes China-registered affiliates of multinational companies—to implement countermeasures adopted by State Council departments, on pain of being restricted or prohibited from relevant activities; article 14 attaches legal liability to any failure to implement or cooperate. See also Order No. 2, supra note 1 (prohibiting "relevant transactions, cooperation, and other activities" with the listed entities).

6 Data Security Law arts. 21, 31 (art. 31 governs the cross-border transfer of important data by reference to the Cybersecurity Law for critical information infrastructure operators, and delegates the security-management measures applicable to other data processors to the national cyberspace authority); Cybersecurity Law art. 39 (security assessment for outbound transfers of personal information and important data by critical information infrastructure operators); Cyberspace Administration of China, Measures on Security Assessment of Outbound Data Transfers (eff. Sept. 1, 2022), art. 4 (requiring a security assessment for any data processor's outbound transfer of important data); Personal Information Protection Law arts. 38–40 (CAC security assessment, standard contractual clauses, or certification as preconditions to cross-border transfer); Cyberspace Administration of China, Provisions on Promoting and Regulating Cross-Border Data Flows (Mar. 22, 2024); Decree No. 834, art. 13.

7 China Chamber of Commerce of Metals, Minerals & Chemicals Importers & Exporters, Statement (Aug. 6, 2026), as reported in Chinese Mineral Companies Urged to Halt Responsible Business Alliance Cooperation, MLex (Aug. 6, 2026).

8 AFSL Implementing Provisions, supra note 3, art. 16. Article 14 separately allows the designated party itself to apply for suspension, modification, or cancellation of the countermeasures on a showing of corrective action.

9 Regulations on Countering Improper Extraterritorial Jurisdiction by Foreign States (PRC State Council Decree No. 835), discussed in Two Regulations, One Direction, supra note 3.

10 Commission Implementing Decision (EU) 2025/2071 of 16 October 2025; see European Commission, First Supply Chain Due Diligence Scheme Recognised Under Conflict Minerals Regulation (Oct. 17, 2025). Individual importer obligations under arts. 4–7 remain.

11 Regulation (EU) 2023/1542, arts. 48–53, 2023 O.J. (L 191) 1. RMI's 2022 all-minerals standard was designed to serve both regulations.

12 European Commission, COM(2025) 258 final (May 21, 2025).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.