R2v3 Certification Requirements Explained

The current version is R2 Version 3.1, effective 31 January 2024, which added photovoltaic modules to the standard as Appendix G and brought solar cells into the Focus Materials list.

That structure is the single most important thing to understand, because it decides what you will be audited on, how long preparation takes, and what it costs.

This guide walks through all ten Core Requirements, explains what an auditor actually asks for against each one, sets out how the appendices attach, and covers what an Indian recycler specifically needs to have in place first.

Why R2v3 is structured this way#

The previous version of the standard applied broadly similar requirements to every recycler regardless of what they did. A facility that only dismantled equipment was assessed in much the same way as one wiping hard drives and reselling laptops. That made certification unnecessarily heavy for simple operations and insufficiently rigorous for complex ones.

R2v3 restructured this. The Core Requirements set a foundation everyone must meet. The appendices then attach based on your actual operations. A facility that does not sanitise data is not audited against the sanitisation appendix. A facility that does gets examined closely.

The practical effect is that two R2 certified recyclers can hold genuinely different certificates. This matters when you are buying services as much as when you are seeking certification, which is why certificate scope should always be checked rather than assumed.

The ten Core Requirements, and what auditors look for#

Every certified facility meets all ten. For each one below, the second paragraph is the part that decides whether you pass.

1. Scope#

You must declare every R2 related activity the facility performs, so that everything is audited and reflected accurately on the certificate. This includes activities you may think of as incidental, such as occasional brokering or holding material on behalf of a client.

What the auditor asks for: a documented description of your operations, material streams and processes, reconciled against what they observe walking the floor. Understating scope is one of the fastest routes to a finding, because the auditor will see activity that your documentation does not describe.

2. Hierarchy of Responsible Management Strategies#

Reuse comes before materials recovery, which comes before disposal. You need a documented policy reflecting this order, and evidence that you actually apply it rather than shredding equipment that could have been returned to use.

What the auditor asks for: your policy, and then evidence of decisions. Expect them to pick equipment that was shredded and ask why reuse was not viable. A defensible answer is a documented test result or a client instruction, not a general statement about market conditions.

3. EH&S Management System#

An environmental, health and safety management system. In practice this means a certified environmental management system, either ISO 14001 or RIOS, with occupational health and safety managed alongside.

What the auditor asks for: a valid certificate from an accredited body, plus the usual management system evidence: policy, objectives, internal audits, management review, corrective actions, competence records. This is the requirement recyclers most often underestimate, because it is effectively a separate certification project that has to be completed first.

4. Legal and Other Requirements#

Compliance with all applicable laws, including import and export controls.

What the auditor asks for: your register of applicable legal requirements, your permits and authorisations, and evidence you monitor changes. For an Indian facility this is where the E-Waste (Management) Rules, 2022 and your CPCB authorisations enter the audit directly. Expect the auditor to check that your downstream vendors hold valid registrations, not just that you hold yours.

5. Tracking Throughput#

Records that account for everything coming in and everything going out, by weight and category.

What the auditor asks for: a reconciliation. Material in should equal material out plus material held in inventory, within a reasonable tolerance you can explain. Auditors routinely pick a month and ask you to prove the balance. Facilities that track inbound carefully but handle outbound loosely fail here.

6. Sorting, Categorisation and Processing#

Documented processes for how equipment is assessed and routed, so that reuse, repair, recovery and disposal decisions are consistent and recorded.

What the auditor asks for: your procedures, your staff's understanding of them, and records showing the route each category takes. They may ask two operators the same question to see whether the answer matches the documented process.

7. Data Security#

This applies to every R2 facility that receives data bearing devices, whatever else it does. It is covered in detail in its own section below, because it is the most misunderstood requirement in the standard.

8. Focus Materials#

Focus Materials are those requiring special handling because of their environmental or health risk. Under version 3.1 they are polychlorinated biphenyls, mercury, CRT glass, batteries of all chemistries except non mercury alkaline, circuit boards whether whole, partial or shredded, and solar cells. You must identify them, including where they sit inside equipment, and manage them properly through to final disposition.

What the auditor asks for: your Focus Materials inventory, how you identify them during sorting, how you store and label them, and where they ultimately go. The final disposition question is the hard one, because it reaches into your downstream chain.

9. Facility Requirements#

Physical site controls: security, storage, containment, emergency preparedness and a closure plan with financial provision, so the site cannot simply be abandoned with material on it.

What the auditor asks for: a site walk. Expect them to look at access control, segregation of material, containment under stored batteries and CRTs, fire provisions, spill response, and then ask to see your closure plan and the financial instrument backing it. The closure plan is frequently missing entirely in first audits.

10. Transport#

Controls over how material moves, including the carriers you use and the documentation that travels with it.

What the auditor asks for: carrier approval records, shipping documentation, and evidence that material arriving at its destination matches what left. For cross-border movement they will look closely at legality and permits.

The process appendices#

These attach to your certificate only if you perform the activity.

• Appendix A, Downstream Recycling Chain. Due diligence on every vendor your material passes to, through to final disposition.
• Appendix B, Data Sanitisation. For facilities performing physical or logical sanitisation of data bearing devices.
• Appendix C, Test and Repair. For facilities testing and repairing equipment for reuse. Also requires certification to an approved quality management system.
• Appendix D, Specialty Electronics Reuse. For specialty equipment such as medical or laboratory devices. Requires Appendix C as well.
• Appendix E, Materials Recovery. For shredding, separation and recovery of commodity materials.
• Appendix F, Brokering. For facilities that arrange movement of equipment they do not physically handle. Also requires an approved quality management system.
• Appendix G, Photovoltaic (PV) Modules. Added by R2 version 3.1, effective 31 January 2024, covering solar panels.

The quality management system requirement under Appendices C and F catches facilities out regularly. If you test and repair for reuse, or you broker, you need a certified QMS in addition to your environmental, health and safety certification. That is a second parallel certification project.

Appendix G, the newest addition#

Version 3.1 brought photovoltaic modules formally into the standard, which matters as solar installations in India begin reaching end of life. A PV module is a standalone device converting solar radiation into electrical energy, including attached components, but excluding modules built into other products such as calculators or lights where power generation is not the primary purpose.

PV modules are managed as an R2 Controlled Stream under all applicable R2 requirements. Appendix G adds periodic hazard identification including electrical safety risks, inclusion of PV modules in your Focus Materials Management Plan, a documented process preventing modules conducting electricity during transport, handling, storage and processing, and a prohibition on storing or processing damaged modules outdoors unless the risks are assessed and controlled.

For modules going to reuse, you test and repair under Appendix C and must disclose to the purchaser the total power output in watts normalised to standard test conditions, the ratio of that output to the originally designed level as a percentage, any repairs made, and the applicable REC category. Alternatively you transfer them to a downstream vendor qualified under Appendix A who meets the relevant Appendix G requirements.

Solar cells also became a Focus Material in version 3.1, with defined thresholds at which tracking obligations end.

SERI publishes an Appendix Applicability Guidance document and a determination tool. Use them at the start. Scoping appendices correctly saves considerable money, and scoping them wrongly is discovered at the worst possible moment.

Appendix A and the downstream chain, where most facilities are weakest#

Appendix A deserves separate attention because it is where auditors find the most problems, and where buyers increasingly focus.

The principle is simple. You remain accountable for material after it leaves your site, all the way to final disposition. That means knowing who your downstream vendors are, verifying they are legally authorised and capable, and being able to trace material through the chain.

In practice this requires a documented vendor approval process, evidence of due diligence on each vendor, contracts or agreements setting out obligations, records tracking what you sent where, and an understanding of what happens at each subsequent tier, not just the first one.

For Indian facilities there is a direct overlap with domestic rules. Your downstream vendors need valid CPCB registration, and transactions need appropriate documentation including tax registration and invoicing. An auditor will check those registrations rather than taking your word for it.

The common failure is a facility that can account for material leaving its gate but cannot say with evidence what happened to it afterwards. That is a finding, and it is also the exact question a serious corporate customer will ask during vendor assessment.

Core 7 versus Appendix B, the distinction that catches people out#

This is the most common scoping mistake, so it is worth being precise.

Core Requirement 7 applies to every R2 facility that receives data bearing devices. If a laptop, phone, server or drive enters your facility, you are responsible for securing it from the moment it arrives, planning how its data will be dealt with, and directing it accordingly. You cannot opt out of this by saying you do not handle data.

Appendix B applies if you perform logical sanitisation yourself, meaning software based wiping of drives rather than physical destruction.

So a facility that receives data bearing devices and physically destroys the drives under Core 7 can operate without Appendix B. A facility that wipes drives and returns them to use must hold it. Many recyclers assume Appendix B is optional in all cases, discover otherwise during the audit, and lose months.

Appendix B also brings materially heavier controls. Expect traceability records tied to unique device identifiers, so each device can be followed individually rather than by batch, and video surveillance with a minimum retention period, commonly sixty days, covering the areas where data bearing devices are handled and sanitised. These are infrastructure decisions with lead times and cost, which is why they need to be planned before the audit rather than retrofitted afterwards.

Data sanitisation and NIST SP 800-88#

R2v3 requires a documented data sanitisation plan aligned with recognised methods, with NIST SP 800-88 as the usual reference. That guidance defines three levels.

Clear uses logical techniques to overwrite user addressable storage, protecting against simple recovery attempts. Purge applies more thorough techniques such as cryptographic erase or firmware based commands, protecting against laboratory recovery. Destroy renders the media physically unusable through shredding, disintegration or similar.

Your plan needs to state which method applies to which media type, who is authorised to perform it, how each action is recorded against the individual device, how failures are handled, and how verification is carried out. Failed drives, solid state media where sanitisation cannot be verified, and high sensitivity data usually route to physical destruction rather than wiping.

The record keeping is where audits are won or lost. An auditor will pick a serial number and expect you to show what arrived, what was done to it, by whom, when, what the verification result was, and where it went afterwards. If the chain breaks at any point, that is a finding. Facilities that record sanitisation by batch rather than by device struggle badly here.

What you need in place before you start#

Recyclers consistently underestimate this list, so treat it as the real project rather than a checklist.

• A certified environmental management system, ISO 14001 or RIOS, from an accredited body
• Occupational health and safety management, with competence and training records
• All applicable legal authorisations, which in India means CPCB registration and compliance with the E-Waste (Management) Rules, 2022
• A documented downstream vendor due diligence process, with evidence gathered for every vendor
• Data security controls covering receipt, secured storage, sanitisation and device level records
• Facility controls including security, segregation, containment, emergency response and a funded closure plan
• Throughput tracking that reconciles inbound, outbound and inventory
• Written procedures covering each process you perform, with trained staff who follow them
• An internal audit and management review cycle that has actually run at least once

If most of these are missing, certification is the final step of a longer programme rather than the starting point. Facilities that try to compress this into a few weeks before an audit generally do not pass.

A scope warning specific to India#

One point worth checking before you spend anything. The categories covered by India's e-waste rules are broader than the equipment R2v3 recognises as electronics. A facility that only processes large white goods such as washing machines, air conditioners or refrigerators would fall squarely under the Indian rules but would not qualify for R2 certification at all.

Confirm that your actual material streams fit the standard first. We have seen facilities begin preparation before establishing this, which is an expensive way to learn it.

SERI has also published guidance specifically on how the E-Waste (Management) Rules integrate with R2 certification, which tells you something useful about how audits run in India. Your legal compliance under Indian rules becomes part of your certification evidence rather than a separate exercise, so the two programmes should be built together rather than sequentially.

The audit, step by step#

Knowing the shape of the process helps you plan it.

Choose a certification body. It must be accredited for R2, and it must be independent of whoever helped you prepare. A body that consulted on your implementation cannot audit it.

Scope confirmation. You and the certification body agree which Core Requirements and appendices apply, based on your declared operations.

Readiness. Most facilities run a gap assessment first, close the gaps, then operate the system long enough to generate real records. You need evidence that processes have been running, not just that they have been written.

The certification audit. Conducted on site. Expect document review, process observation, staff interviews, a floor walk and records sampling. Auditors trace material and devices through your system rather than reading policies in isolation.

Findings and closure. Nonconformities are raised, you respond with root cause and corrective action, and the body verifies closure before certifying.

Certification and surveillance. Certificates run on a three year cycle with annual surveillance audits in between. Surveillance is not a formality, and certificates can be suspended or withdrawn.

Certification is facility level. A company with three sites certifies each one separately, and a certificate issued for one location says nothing about another. Certificates are published in SERI's public directory with their scope stated, which is how customers verify what you are actually certified for.

That public scope matters commercially. A buyer who needs data sanitisation will check whether your certificate includes Appendix B. Claiming capability you are not certified for is visible and damaging.

The findings facilities get most often#

From what we see in practice, the recurring ones are:

• Downstream evidence gaps. Vendors identified but not properly vetted, or no visibility past the first tier.
• Throughput that does not reconcile. Inbound recorded carefully, outbound recorded loosely.
• Batch level data records. Sanitisation logged by lot rather than by device, so individual devices cannot be traced.
• Missing closure plan. Either absent or without the financial provision behind it.
• Focus Materials handling. Identified in policy but stored or routed inconsistently on the floor.
• Procedures that do not match practice. Written process says one thing, operators do another.
• Expired or incomplete legal authorisations, including those of downstream vendors.

Most of these are evidence problems rather than capability problems. The facility is doing the right thing but cannot prove it, which under an audit amounts to the same outcome.

How we help#

We prepare facilities for certification rather than issuing it, because the certification body must remain independent of the implementation work.

The sequence usually runs: confirm which appendices genuinely apply to your operations, assess your current position against the Core Requirements and those appendices, put the underlying environmental, health and safety systems in place, build the data security and downstream due diligence processes, get records and evidence in order, run the internal audit and management review the system needs, then support you through the certification audit and close any findings.

The detail is on our electronics recycling and R2v3 service page, and the environmental and safety systems that sit underneath are covered on our QEHS consulting page. If you are still deciding between standards, our comparison of R2v3 and e-Stewards sets out which fits an Indian recycler.

Frequently asked questions#

Conformite Assist is an independent compliance advisory, helping organisations across 13 regions and four continents get audit-ready since 2011. We prepare you for certification. The certification body issues the certificate.

This article is for general information only and does not constitute legal or regulatory advice. Requirements are summarised from the R2 Standard Version 3.1, effective 31 January 2024, and SERI guidance evolves, so confirm the current requirements for your facility and scope before acting. Details are accurate to the best of our knowledge at the time of writing, November 2026.

Hero photograph: Nathan Cima, Unsplash.