R2v3 Certification FAQ

R2 is the electronics reuse and recycling standard owned by SERI, and being R2 Certified means an accredited certification body has audited your facility against it. The R2 Standard sets common criteria for responsible reuse and recycling across the used portion of the electronics lifecycle. R2 Certification is the program for evaluating and monitoring businesses against those criteria, protecting the environment, worker health and safety, data and communities, and supporting a circular economy. R2v3 is the current and only active version.

It means an R2 certificate covers one facility address, so it doesn't move with you. The R2 facility must be a commercial place of business, and all R2 requirements apply at that address. If you move, notify your certification body (CB); it performs a transfer audit at the new location to confirm your processes haven't changed, and a new certificate is issued with the new address. For example, a phone refurbisher that outgrows its unit and moves to a larger building must tell its CB, pass the transfer audit, and then receive a certificate showing the new address.

R2v3 requires a certified environmental, health and safety (EH&S) management system. Paradygm recommends ISO 14001 together with ISO 45001, because those certificates are recognized worldwide and across industries. A certified quality management system (ISO 9001) is required only if your scope includes test and repair (Appendix C) or brokering (Appendix F).

The REC (R2 Equipment Categorization) is SERI's companion document for grading every asset an R2 facility receives. Each asset is evaluated on cosmetic and functional criteria after testing, and that evaluation sets its final grade. For example, a phone that tests fully functional but has a cracked screen grades lower until the screen is replaced; after a successful repair it can be regraded higher.

Generally no. The one exception is an external vendor that is itself R2v3 certified for those processes; then testing and refurbishment can be outsourced to it.

Only if the vendor you bought them from is an R2v3 certified facility. If the vendor is not R2v3 certified, failed or "DOA" assets cannot be returned to it.

There are three outcomes: repair, harvest parts, or recycle. You can repair or refurbish the asset for resale using new or existing parts; harvest the good working parts into a parts inventory and recycle the rest (plastics, metal, circuit boards) through qualified downstream vendors; or recycle the asset when repair would cost more than it is worth.

Logical data sanitization means using software to overwrite or otherwise make data unrecoverable on a device that will be reused. R2v3 requires all data-bearing assets to be sanitized. For reuse, Appendix B expects software that controls the process and records the result. A manufacturer's factory reset on its own is not always enough: it can count only when it is controlled and recorded by an application and verified, as explained in the answers below.

Physical data sanitization means destroying the storage media, for example by shredding, crushing or disintegrating it, so the data can't be recovered. Choose destruction equipment and particle sizes that meet a recognized specification, such as the NSA evaluated products lists for media destruction devices, and record each destruction. Degaussing is treated as a purge technique for legacy magnetic media, not a destroy method, under NIST SP 800-88 Rev. 2.

In Appendix B, "software" means an application that automates logical sanitization and creates a record of it. It should control and direct the whole process, overwrite all user-addressable storage with non-sensitive data, and record the date and time, the device's unique identifier, the method used and the verification result.

Not always. A reset can erase data but may not make it unrecoverable by commercial software, so it can't be the primary logical method on its own. Where no dedicated sanitization software exists for a device, the reset can count as software if an application documents and controls it, records the results in detail, and can be shown to meet Appendix B's software and records requirements.

Manual sanitization following the manufacturer's instructions is still acceptable, if it is controlled. You need a documented process, a tool that verifies the sanitization worked, and a detailed record of the date and time, device identifier, method and verification result.

Because software makes sanitization consistent, recorded and provable. It gives rigor (the same complete process every time), transparency (detailed records for every device) and confidence (evidence that data was overwritten), which commercial reuse needs.

Yes. Individuals can wipe their own devices at their own risk, but that approach lacks the rigor and records required when a facility commercially reuses devices.

On an unencrypted device, a reset doesn't actually erase the data; it stays hidden and can be recovered with commercial software. That exposes the previous user to a real privacy risk.

On an encrypted device, a reset destroys the encryption key, so the remaining data is permanently unreadable even with specialized software. That gives much stronger protection than resetting an unencrypted device.

No. Encryption isn't mandatory on every device and users can sometimes turn it off. Any data stored after encryption is disabled is not protected by a later reset.

Use a process that is software-based, verified and recorded. In practice: use devices with full-disk encryption on by default and don't disable it; use sanitization software that meets the R2v3 Standard's software and verification requirements; use a professional, R2 certified sanitization service for sensitive data or many device models; and wipe devices before any physical disposal.

R2v3 sets logical sanitization between NIST's Clear and Purge levels: data must not be recoverable with commercially available software. Clear applies where all addressable storage can be overwritten; visual inspection alone isn't enough to verify it. Purge makes recovery infeasible even with laboratory techniques, which R2v3 doesn't require for logical sanitization. These levels come from NIST SP 800-88 Rev. 1; NIST replaced it with Rev. 2 in September 2025, which keeps clear, purge and destroy as the three methods. For the maintained Rev. 2 deep guide, see the NIST SP 800-88 Rev. 2 guide.

Appendix B(13) goes further than checking that a record exists: it requires actually trying to recover data from sanitized devices with commercially available software, to confirm the sanitization worked.

Then data recovery with commercial software is impossible by design. If a device has no working I/O ports or remote access, retrieving data would need specialized forensic analysis, which goes beyond what Appendix B(13) requires.

No. Formatting a drive or resetting an unencrypted device can look clean but often leaves pictures, contacts and messages that commercial recovery software can find.

Mainly because they don't reach all the data. Some methods overwrite only part of the storage; remnants can remain on the media; hidden partitions may be untouched by formatting or resets; and encryption may be off or user-configurable, leaving data exposed.

Yes, but the activities and certification boundary matter. Activities unrelated to processing used electronics can share the site without being part of the R2 scope. All certifiable electronics activities at the site must be included; walls or cages alone do not put them outside scope.

If another business at the site also processes used electronics, it generally must be R2 certified too. An exception requires the certification body to verify that the businesses are separate legal entities, completely physically separated, independently operated, share no ownership, workers or services, and have traceable, documented interactions that conform to R2. Shared docks, equipment and access arrangements should therefore be reviewed with the certification body before committing to a layout.

Review the new equipment against your existing capabilities and controls. Update the device types and sanitization methods in your data sanitization plan, train the relevant workers, and ensure you can identify and secure its data storage devices.

If you test or repair the equipment, your test plans, worker competence and applicable quality-management-system scope must cover it. Review any new Focus Materials, such as batteries and circuit boards, and confirm that your downstream vendors are qualified for the streams they will receive. Your certificate scope must accurately reflect the equipment and activities covered; discuss the proposed addition with your certification body.

Yes. An R2 operation can receive, store and transfer material without performing all processing itself. It must still evaluate and categorize what it receives, secure data-bearing devices, track the material and send it to appropriately qualified downstream vendors for the required processing. Appendix A applies when R2 Controlled Streams go to downstream vendors, even if those vendors are R2 certified.

Brokering is different: it covers transactions in which equipment or material moves directly from the supplier to the downstream vendor without passing through your facility. A business can do both. A broker that never receives or processes equipment is identified as “Broker Only” on its certificate. Have your certification body confirm the scope against your actual activities.

Confirm that the address is zoned for commercial or industrial activity, as required for R2 certification eligibility, and that the intended use, materials and storage volumes comply with local zoning, building, fire and environmental rules.

R2 requires suitable secure, labelled storage protected from foreseeable weather, an enclosed environment for equipment destined for reuse, risk-based insurance and a closure plan with applicable financial assurance. Processing normally takes place indoors; outdoor processing requires a risk assessment and controls against uncontrolled environmental releases. Check these needs against the proposed layout before signing. R2 does not specify a universal minimum warehouse area or sprinkler design; the fire authority, applicable law and insurer may impose additional requirements.

Most batteries from electronics are R2 Focus Materials; the exception is alkaline batteries that do not contain mercury. Your Focus Materials Management Plan must cover their handling and downstream processing. Inspect incoming equipment for damage, assess the risks, and use appropriate containment, segregation and storage for items needing special handling.

R2 prioritizes reuse and materials recovery. Energy recovery, incineration and land disposal are not ordinary management routes for Focus Materials. Core 2 permits narrow exceptions where applicable law requires a particular technology, or during documented extreme and rare disruptions beyond the facility's control, only as legally allowed and until normal management is possible. These are not routine disposal permissions.

Storage and transport controls must fit the battery chemistry, condition and quantity, applicable law and the facility's risk assessment. Confirm fire-protection requirements with the local authority and insurer; R2 does not prescribe one universal container or sprinkler system. Accepting lithium primary batteries also rules out the small-facility exemption from a closure financial instrument.

Not automatically. The purpose of the work matters. SERI says Appendix E is not required for repair or parts harvesting carried out to preserve components for reuse. This can include removing a non-reusable battery to reach a reusable component. The reusable parts must be tested internally or sent to an external vendor that is R2v3 certified for the testing and refurbishment processes being outsourced. Testing and refurbishment generally cannot otherwise be outsourced. Remaining material must be managed through the appropriate R2 route.

If equipment or components are dismantled for materials recovery instead, Appendix E applies—even if the dismantling is careful and manual. Cutting or heating alone does not decide the scope; the intended outcome and evidence of reuse do. Confirm your actual process with the certification body rather than assuming all battery removal is materials recovery.

It must accurately describe the equipment, components, materials and activities your facility actually manages and can demonstrate through audit evidence. Broad wording such as “used electronics” is not appropriate for a facility that only processes mobile phones; it is reserved for facilities qualified to sort and process numerous electronics types.

Materials must be tied to electronics—for example, “lithium-ion batteries from used electronics” rather than simply “batteries”. The certification body uses SERI's prescribed process terms and distinguishes testing, repairing and the different types of data sanitization. Outsourced downstream activities and planned operations that are not yet implemented do not belong in your facility's scope. Ask the certification body to agree wording that is accurate, not merely broad.

R2 requires security and access controls for equipment containing data. Written contractual requests not to sanitize must be addressed in the data sanitization plan, and binding restrictions on resale or donation must be respected.

For a legal-hold workflow, recommended controls include recording each device's identity and hold status, using secured non-pickable storage locations, and requiring documented authorization before release. These are practical ways to prevent held devices from entering normal inventory; they do not replace the legal instructions or contractual terms governing the hold.

R2 requires security controls for data in the facility's control, identification of network services that could restore data to devices, access controls and an incident-response process. Applicable privacy and data-breach requirements must also be addressed. Under Appendix B, connections to remote services must be removed from sanitized devices.

A useful assessment starts with the systems that touch customer devices or their data, including imaging and configuration labs, sanitization systems and connected services. Reviewing those systems and documenting the assessment boundary is recommended practice; this is not a claim that R2 prescribes an assessment of every corporate network.

No. R2 certification does not establish PCI compliance. R2 requires applicable supplier, legal and other data-security requirements to be identified and addressed in written procedures. Where payment terminals are subject to PCI requirements, those obligations must be assessed separately against the applicable payment-industry requirements and customer contracts.

Yes. R2 certification does not replace separate customer contracts or program approvals. R2 itself requires applicable supplier, legal and other data-security requirements to be addressed. Where customer, legal or information-sensitivity requirements demand more stringent physical destruction methods, Appendix B requires those more stringent methods to be used.

Check any additional program requirements separately rather than treating them as requirements of the R2 Standard.

No. R2 certification covers the operations described on the R2 certificate; it does not itself grant approval to participate in another organization's purchasing or remarketing program. Confirm that program's eligibility requirements and application process directly with its operator.

This is downstream-chain registration under Appendix A(4)(b), not approval of your Focus Materials Management Plan. A facility using this option can track the chain to final disposition or the first R2v3-certified downstream facility rather than demonstrating the entire chain itself.

Use SERI's downstream-registration form with your facility's Account Key and upload a flowchart showing every R2 Controlled output stream, plus the name and location of each downstream vendor up to that endpoint. Keep it updated and register changes before the related shipment. SERI sends a confirmation email; keep that evidence and provide the actual flowchart and supporting vendor-qualification records to the auditor.

The confirmation proves receipt, not SERI verification or approval of your vendors. Registration does not replace downstream due diligence or your FM Management Plan.

Before shipping, check that the new vendor is qualified for the streams and processing involved. For an R2-certified vendor, verify its active certificate and appropriate scope; for a non-R2 vendor, complete the applicable Appendix A due diligence. Update your downstream flowchart and FM Management Plan, the data sanitization plan if the vendor handles data devices, and the legal compliance plan where routes or requirements change.

If you rely on SERI chain registration, submit the updated chain before the shipment. Notify suppliers who have requested notice of downstream changes, and retain shipping and receipt records. Check the legality of international movements through the relevant downstream chain, not just exports made directly by your own facility. Separate customer or recycling-program approvals may also need updating.

There is a narrow transition allowance for Basel-controlled plastics Y48 and A3210: Appendix A(7)–(8) downstream due diligence for those streams is deferred until January 1, 2028. Other R2 requirements, including legal compliance and applicable transparency and tracking controls, still apply. This does not permit otherwise illegal shipments or excuse qualification of unrelated electronics streams.

SERI counts people working partly or fully within the R2 scope, whether part-time or full-time. This includes shift workers, administrative and office staff such as sales and marketing, and contractors. It is not limited to production workers.

The certification body uses SERI's Core and Process Requirement audit-time tables, the relevant headcount, applicable appendices, downstream-vendor profile and certification structure to calculate time. The headcount bands are 1–25, 26–175 and 176 or more. Complex activities, scope changes or other factors can increase time. Ask the certification body for the calculation behind its quote; headcount alone does not determine the total days or the price.

The calculation depends on what is being audited, not just whether the visits share a date. SERI's tables distinguish certification, surveillance and recertification time, and include different entries for relevant processes audited with or without the associated management-system audit. Adding an appendix or changing the activities can therefore change the calculation.

Combining audits does not mean the R2 time can simply be discounted: the Code of Practices requires the calculated R2 time to be maintained except for its expressly stated exceptions. The certification body determines the time needed to verify a scope change and may add time for complexity and corrective actions. A combined facility-move audit must also include additional time rather than replacing surveillance or recertification. Ask the certification body to show the headcount band, appendices, integration assumptions and scope-change time behind the quote; there is no universal 3.5-day minimum for every facility.

Using a consultant does not transfer the facility's R2 responsibilities. The facility must designate qualified people to coordinate environmental, health and safety activities and a competent Data Protection Representative responsible for data security and related legal compliance.

Workers must be trained and verified competent for their authorized data-security duties. The facility must maintain its procedures and records, review its R2 system through annual internal audits, arrange the required annual data-security and sanitization audit, and periodically audit legal compliance. Management and staff therefore need to participate in implementing and maintaining the system, not just preparing documents for certification.

Yes. R2v3 internal auditor training is its own course, delivered on-site at your facility, and every participant who completes it receives a certificate of completion. It covers R2v3's Core and Process Requirements, auditing the legal compliance plan, downstream vendors and data sanitization, and the records auditors need to see. For broader internal auditor training options, see Internal auditor training on paradygm.co.

Yes: Guaranteed Certification within the first attempt. Paradygm has a 100% R2 track record, more than 25 years of experience and over 200 clients, and is a SERI Approved Consultant. Audits are always carried out at your facility; we don't do remote or hybrid audits.