Palm oil body’s ‘no harm’ guarantee still given to companies operating illegally

Certification by the Roundtable on Sustainable Palm Oil (RSPO) cannot provide assurance that palm oil has been produced in full compliance with Indonesian law.

For more 20 years, the RSPO – the world’s best-known certification scheme for palm oil, intended to assure consumers that palm oil production does not cause environmental or social harms – has presented certification as a guarantee that palm oil meets environmental, social and legal standards.

It has been more than a decade since EIA has first exposed the repeated failures of the RSPO in 2015’s Who Watches the Watchmen? report and today we release our latest analysis Illegally Operated, Officially Certified.

Despite the RSPO trying to keep up with the times and align with the EU Deforestation Regulation (EUDR), a fundamental problem remains for the organisation’s credibility – the companies operating illegally can remain certified.

Legal compliance is essential for sustainability. It is essential for good governance, the rule of law, upholding the rights of Indigenous Peoples and local communities and for preventing deforestation and environmental crime. Companies face increasing regulatory, financial and reputational risks for non-compliance. Despite its importance, RSPO certification was not designed to ensure legality, nor can it.

EIA analyses shows that more than 20 per cent of palm oil areas operating illegally in the Indonesian Forest Area are RSPO-certified. New laws such the EUDR and upcoming UK regulations require palm oil to be legally produced before it can be placed on the market. RSPO certification does not guarantee legal compliance and cannot be relied upon as a proxy for due diligence obligations.

In 2025, the Indonesian Government published Decree No. 36, identifying 436 company areas covering more than 1.1 million hectares inside the country’s Forest Area without required “forest release”. EIA’s analysis found that 178 of those areas – 41 per cent – belonged to RSPO member companies and 95 areas, or 22 per cent, were operated by RSPO-certified companies.

Together, those 95 areas cover 274,201 hectares – roughly 1.7 times the size of Greater London – and are linked to 20 palm oil groups, including some of the industry’s biggest names such as Wilmar, Musim Mas and Golden Agri-Resources.

RSPO certification has not demonstrated what regulators and buyers need to know, namely whether every relevant operation and supplier has completed the legal steps required.

Certification must improve – and regulations must remain robust

Voluntary schemes may support due diligence in the EUDR, but responsibility for ensuring legality remains with the companies placing products on the market. A market-based sustainability label should never become a short-cut to legal compliance.

Companies’ deforestation pledges also differ widely in their coverage and deadlines. With no binding requirements behind them, implementation and progress remain uneven.

Eviction activity at Muara Tae using heavy equipment (c) Kaoem Telapak

In July 2026, EIA and our long-term partner Kaoem Telapak revealed how an RSPO member company remained linked to unresolved allegations of Indigenous land rights violations to the Dayak Benuaq community of Muara Tae, in East Kalimantan – more than a decade after complaints were first filed by EIA and local communities. This underscores broader concerns about the RSPO’s ability to identify and address non-compliance with it own standards.

As the UK develops its own regulation on forest risk commodities, it should make clear from the outset that certification must not confer automatic low-risk status, lighter scrutiny nor any exemption from due diligence. At most, certification can provide input into a company’s risk assessment, but it cannot replace independent checks and it must not shift responsibility away from the company.

The RSPO should require audits to test the full certified mill supply base against authoritative Forest Area maps, suspend certification where forest release and applicable penalties have not been completed and close the loophole allowing affected land within a company’s concession to be excluded while the rest remains certified.

Meanwhile, Indonesian authorities should publish up-to-date information on company status, outstanding fines and confiscated or relinquished land.

EIA contacted the RSPO and all 20 palm oil groups identified in the report. The predominant response was that areas listed in Decree No. 36 of 2025 reflect unresolved regulatory and land tenure issues rather than confirmed illegality and that compliance should be assessed through ongoing Government and RSPO processes.