Supplier Risk Intelligence Report

Supplier Profiles — Detailed Assessment

In-depth analysis for flagged suppliers and selected high-importance clear suppliers.

Methodology & Audit Trail

Data Sources

Entity Matching Methodology

Suppliers are resolved to a canonical identity using a priority-ordered matching strategy:

Confidence Scoring Formula

CBAM Screening & Carbon Estimation Methodology

The Carbon Border Adjustment Mechanism (CBAM, Regulation (EU) 2023/956) requires EU importers to report embedded carbon for covered products starting 2026. Atesta classifies suppliers by cross-referencing HS/CN codes from available trade records against the CBAM Annex I product scope covering six categories: iron & steel (CN 7201-7229, 7301-7326), aluminium (7601-7616), cement (2507, 2523, 6810), fertilisers (2808, 2814, 2834, 3102-3105), electricity (2716), and hydrogen (2804). Classification is static and based on the current regulation text.

Default carbon intensity factors: When actual production-specific emission data is unavailable, embedded carbon is estimated using EU CBAM Implementing Regulation (EU) 2023/1773 default values, cross-referenced with ECOINVENT v3.10. For electricity-intensive products (aluminium, hydrogen, steel), country-of-origin grid intensity adjustments are applied using IEA Emission Factors 2024. Values represent tCO₂e per tonne of product (direct + indirect emissions).

These are regulatory default values for initial CBAM reporting. Verified supplier-specific data (via ZK proofs or direct measurement) will replace defaults when available.

REACH / SVHC Screening Methodology

REACH (Regulation (EC) No 1907/2006) requires disclosure when products contain Substances of Very High Concern (SVHCs) above 0.1% w/w. Atesta screens suppliers against the ECHA SVHC Candidate List (~240 substances) using sector-level classification based on NACE Rev.2 industry codes.

Important limitation: This is a sector-based screening indicator, not a material composition audit. High sector relevance does not confirm the presence of SVHCs in specific products. Full REACH compliance verification requires supplier-side substance declaration data, which Atesta plans to support via zero-knowledge proofs in a future release.

UFLPA Cross-Reference Methodology

Indirect UFLPA exposure is detected by cross-referencing US Customs trade flow data with the DHS UFLPA Entity List (~27 entities). For each supplier that passes the direct entity list screen, their customs import records are analysed to identify trading partners (shippers) whose names match UFLPA-listed entities using bigram similarity and Levenshtein distance (threshold: 0.85). Indirect exposure indicates the supplier sources from a UFLPA-listed entity at Tier-2, which may subject downstream US imports to withhold/release orders under UFLPA §3.

Country Labour Risk Methodology

Country-level labour risk is assessed using ILO data mapped to LkSG §5(1) requirements. Two data sources are combined into a composite score:

Limitations and Caveats

• Sanctions screening uses fuzzy name matching for entities without LEI/DUNS. Partial matches are flagged but may be false positives.
• LkSG filing analysis is limited to German-registered entities. Non-German suppliers are marked "Insufficient Data" unless equivalent public filings exist.
• Satellite imagery is subject to cloud cover and revisit frequency. Activity scores are derived from parking lot analysis and may not reflect indoor operations.
• Trade flow data covers US-origin routes only. Intra-EU and Asia-origin trade flows are not captured in this assessment.
• Media monitoring relies on GDELT theme classification and tone analysis. Articles may be false positives or false negatives. Results should be verified by human review.
• CBAM screening is based on HS code classification from available trade records. Suppliers without US customs data cannot be assessed. CBAM scope may expand in future regulatory updates. Embedded carbon estimates use EU regulatory default values (Implementing Regulation 2023/1773) and are not verified supplier-specific figures. Country-adjusted values use IEA grid intensity data and should be treated as approximations.
• Country labour risk is a jurisdiction-level indicator, not a supplier-level audit. A supplier in a high-risk country may have exemplary practices, and vice versa. Use as a screening signal alongside supplier-specific due diligence.
• ILO ILOSTAT indicators use latest available year per country (typically 1–3 years lag). Convention ratification data is as of 2026-Q1.
• REACH/SVHC screening is based on sector-level classification using NACE industry codes. It indicates the likelihood of SVHC exposure, not confirmed presence. Suppliers without NACE/SIC codes are classified using HS code inference from trade data or default to low relevance. Full REACH Article 33 compliance requires actual material composition data from suppliers.
• This assessment is based on publicly available data sources. It does not constitute legal advice and should be supplemented with direct supplier engagement.

Cryptographic Proof — EBSI Verifiable Credentials

Each supplier assessment is backed by a W3C Verifiable Credential signed on the European Blockchain Services Infrastructure (EBSI). These credentials are tamper-proof, machine-readable, and independently verifiable without access to Atesta's systems.