A cocoa powder inquiry often arrives with a short line at the end: "Please confirm halal, kosher, ISO, EUDR and Rainforest Alliance." For a buyer, that list looks like paperwork. For a supplier, each item points to a different part of the chain — the ingredient, the line, the factory, the farm, or the trading relationship. Knowing which is which tells you what to verify before you sign, and what you can reasonably ask to see.
This checklist separates the certificates that change how cocoa powder is produced from the ones that only document how the factory is managed, and gives you the questions to ask at each step.
Request | What it actually covers | Who issues it | What to verify |
|---|---|---|---|
Halal | The product and the production line contain no prohibited substances and no cross-contact | Recognised halal certification bodies (different bodies are accepted in different markets) | Certificate holder name, product scope, line coverage, expiry date |
Kosher | Ingredient, equipment and sanitation comply with kosher rules; dairy and non-kosher contact excluded | Kosher certifying agencies | Pareve or dairy status, whether the certificate covers the specific plant |
ISO 22000 / FSSC 22000 | Food safety management system across the whole site | Accredited certification bodies | Scope wording (product families), site address, validity, last audit result |
EUDR | Cocoa was not produced on land deforested after the cut-off date, and is legally produced | No certificate — a due diligence statement backed by plot geolocation | Whether the supplier can supply plot-level coordinates and legally valid due diligence data |
Rainforest Alliance | Farm-level social and environmental standard plus chain-of-custody at the processing stage | Rainforest Alliance, through licensed certification bodies | Chain-of-custody model (segregated or mass balance) and the certificate code |
Two more appear regularly and are usually easier: HACCP (a plan, not a certificate, though many factories hold HACCP certification) and BRCGS, which is a GFSI-recognised factory standard often requested by European retailers.
Cocoa powder itself is plant-based, so buyers sometimes assume halal and kosher compliance is automatic. It is not. Both schemes care about what else runs on the same equipment, how the line is cleaned between runs, and whether carriers or processing aids are acceptable. Alkalisation, for example, uses alkaline solutions and sometimes emulsifiers or anti-caking agents; these must be acceptable to the certifier, and the sanitisers used between batches must be too.
When a supplier says "halal available", ask three things:
Is the certificate issued to the factory that actually processes the cocoa, or to a trading company?
Does the scope list cocoa powder and the specific product grades, or only a generic product category?
Is there a separate halal-dedicated line, or is compliance maintained through cleaning validation between conventional runs?
The third question matters most in practice. A shared line is workable, but it depends on documented cleaning and changeover control — and that is exactly what an auditor, or your own second-party audit, will look for.
ISO 22000 is the international food safety management standard: it describes how a site identifies hazards and controls them. FSSC 22000 builds on ISO 22000 with additional sector requirements and is recognised by GFSI, which is why European and North American buyers ask for it by name. BRCGS is a retail-driven standard with a strong emphasis on factory hygiene, supplier approval and traceability.
In practice, the certificate type tells you less than its scope. A certificate with a narrow product scope, an old site address, or a suspended status is not the reassurance it appears to be. Ask for the certificate PDF, check the legal entity and site address against the quotation, and confirm the audit cycle is current.
The EU Deforestation Regulation requires operators placing cocoa and cocoa products on the EU market to prove the material was not produced on land deforested after the cut-off date and was produced legally. The evidence is geolocation of the plots plus a due diligence statement, not a logo on a brochure.
This is the request most likely to stall a deal, because a processing factory can only pass on what its upstream supply chain provides. The application timeline has been revised more than once, so confirm the current deadline with your EU importer rather than relying on a fixed date in a supplier presentation.
Practical questions to ask before contracting:
Can you provide plot-level coordinates (polygons where required) for the lots you will ship?
Which upstream entities hold the legality evidence, and will you share the due diligence statement reference?
If part of the volume cannot be covered, can you supply a segregated EUDR-ready lot instead of blending?
Rainforest Alliance certification is issued at farm level and then carried through the supply chain by a chain-of-custody certificate held by the processor or trader. Two models are common: segregated, where certified beans are kept physically separate, and mass balance, where certified and conventional volumes are mixed but accounted for administratively.
If your brand claims "certified cocoa", you need to know which model your supplier uses, because the claim you can legally make depends on it. For most consumer-facing on-pack claims, mass balance is not enough — check with your certification body before you print anything.
Certificate of Analysis (COA) per lot: fat content, moisture, pH, colour specification, sieve or particle size, heavy metals and microbiology results against the limits of your destination market
Technical Data Sheet (TDS): grade, alkalisation level, fat range, intended applications, packaging
Safety Data Sheet (MSDS): many buyers' internal systems still require one even for a food ingredient
Allergen and non-GMO statements, and a gluten-free statement if relevant to your formulation
Certificate copies (halal, kosher, ISO/FSSC, organic) with scope and expiry visible
Traceability record: lot number linking the delivered bags back to the production batch
Heavy metals deserve specific attention in cocoa. Cadmium and lead limits differ by product form and market, so a generic "within limits" statement is not useful — ask for the actual measured values against the regulation that applies to your sale.
Certificate holder legal name and site address — does it match the quotation and the invoice?
Product scope — does it name cocoa powder and the grade you are buying?
Expiry date and last audit result
Halal and kosher: line status and changeover control if shared
EUDR: plot geolocation availability and due diligence statement reference
Rainforest Alliance: chain-of-custody model and certificate code
COA from the last three lots, with heavy metals values, not just pass/fail
Traceability: can a bag in your warehouse be traced to a production date and a supplier lot?
Only partly. Factory standards such as ISO 22000, FSSC 22000 and BRCGS are issued to a specific site, so a trader's own certificate says nothing about the factory that made your powder. Halal, kosher and chain-of-custody certificates can be held by a trader, but they must state which products and which upstream sites they cover.
No. In the EU it is a market requirement, not a legal one. It becomes effectively mandatory when your customer sells into Indonesia, Malaysia or much of the Middle East, or when your customer's own product carries a halal claim.
It depends almost entirely on whether the upstream supply chain has plot mapping. Suppliers who already collect coordinates can usually answer within days; suppliers who buy through several intermediaries may need weeks or may not be able to answer at all for a given lot. Ask before you agree a delivery date, not after.
If you are sourcing cocoa powder for a formulation that needs a specific certification set, tell us the grade (natural, alkalised or black), the fat range and the destination market, and we will confirm which documentation is available for that grade and what the current lead time looks like.