Chain of Custody

info

Please note that this content is under development and is not ready for implementation. This status message will be updated as content development progresses.

Overview

Chain of custody refers to the documented, end-to-end record of how a product or material moves and is transformed from origin to final use, identifying each handler, location, and process along the way. Its purpose is to provide traceability and integrity, proving where something came from, what happened to it, and who was responsible at each step—enabling organisations to support compliance, sustainability claims, quality control, and anti-fraud assurance.

The transparency graphs section describes how data in UNTP credentials can be assembled to construct a verifiable digital twin of a supply chain. It explains how product passports link to the facilities that made the products and, via traceability events, to the upstream products used in manufacturing. However, it does not describe the material accounting framework that enables verifications such as:

• Farm-level emissions are accurately allocated to individual shipments of cattle or grain from farm to processor
• A weaving factory that buys 50% certified organic cotton supply can only claim organic cotton fabric for 50% of its output
• A copper smelter has sourced sufficient copper concentrate from certified mines to confidently claim that its shipments of refined copper are made from 100% certified ore

There are many similar scenarios where trust is derived from accurate accounting of outputs against inputs for production processes. Well-understood chain of custody accounting methods include segregated, mass-balanced, and book & claim.

This page describes how UNTP supports material accounting for chain of custody purposes in a standardised way that works for any commodity (e.g., critical minerals, agriculture, textiles), any topic (emissions, water usage, labour rights, deforestation), and any accounting method. This distinguishes the UNTP approach from many others that tend to be commodity-specific, topic-specific, or platform-specific.

Key Design Principles

The following principles underpin the scalable and verifiable UNTP approach to chain of custody accounting.

Support All Industrial Production Models

Industrial processes fall into three broad categories, each producing a different but conceptually equivalent type of production record:

• Discrete Manufacturing produces individually serialised items such as vehicles, machinery, and electronics. The canonical record is the as-built record that documents actual components, configuration, and processes used to manufacture a specific serialized product. Represented by a transformation event with serialised item outputs.
• Batch Manufacturing processes a quantity of identified inputs and produces a corresponding quantity of identified outputs via discrete production batches. Typically found in food processing, chemicals, and refining. The canonical record is the batch record, also represented as a transformation event with quantity inputs and outputs over a defined and uniquely identified batch boundary.
• Continuous Production produces a stream of output materials from a continuous stream of input materials. Typically used in mining, oil production, bulk chemicals, and pulp & paper. The boundary is typically a time period (hour, day, etc.), and the canonical record is the production run record, also represented as a transformation event with input/output material quantities and a defined time boundary.

All three record types are specializations of a Production Record—a record documenting the execution of a production process, including inputs consumed and outputs produced. They differ only in how production boundaries are defined (serial number, batch ID, or time window).

Anchor Trust in Facility-Level Material Accounting

UNTP material accounting follows the same fundamental logic as financial accounting:

Financial Accounting	UNTP Material Accounting
Chart of accounts	Digital Product Passports (DPPs) describe key characteristics and intensity metrics (not quantities) of identified input and output materials using assessmentCriteria and declaredValue
Balance sheet	Digital Traceability Events (DTEs) with bizStep "stocktake" record material stocks at a point in time
Ledger transactions	Digital Traceability Events (DTEs) with bizStep "shipping" or "transformation" account for input/output flows and production runs
Audited accounts	Digital Conformity Credentials (DCCs) carry independently audited conformance and verified intensity metrics
Facility conformity	Digital Facility Records (DFRs) carry facility-level conformity claims, certifications, and quality metrics using assessmentCriteria and declaredValue

The core principle is conservation:

Opening stock
  + inbound flows
  - outbound flows
  ± production transformations
= closing stock

This applies to mass, volume, or count and forms the foundation for all higher-level sustainability claims.

Just as double-entry accounting makes financial fraud difficult by requiring transactions to balance, material accounting makes greenwashing difficult by requiring physical quantities to reconcile. Mass balance fraud happens when actors buy small quantities of high-integrity inputs but claim much larger volumes of sustainable outputs. A properly implemented material accounting system makes this detectable.

It is worth noting that the accounting analogy, whilst valuable, may imply an accuracy that exists in financial accounting but does not in material accounting, and even less in impact accounting.

• Material stocks and flows must allow for waste and losses.
• Emissions intensity calculations must allow for inaccuracies in reported intensities.

The UNTP allows for claims and assessments to report metrics together with an estimate of accuracy.

Separate Facts from Policy Claims

This guidance separates:

• Underlying material accounting (facts about what physically happened) from
• Policy-driven claims and certifications (assertions about sustainability attributes)

This separation allows a consistent material accounting approach to assess a variety of policy-driven claims and certifications. For example, when a facility records input material identity and quantity for every production run, the same records support:

• Segregated chain of custody if all inputs for a given run meet the policy criteria claimed for the output
• Mass-balance chain of custody if the average of all inputs to multiple production runs matches the average of all outputs over a given period

The same separation facilitates multiple impact assessments from the same underlying material accounting facts. For example:

• Given a shipment of 100 tonnes of copper ore (fact in the shipping manifest) and a DPP stating an emissions intensity of 2 tCO₂e/tonne ore and copper concentration of 25%, the emissions intensity per tonne of contained copper is 2 ÷ 0.25 = 8 tCO₂e/tonne Cu
• Production run DTEs provide raw facts (tonnes ore consumed, tonnes copper produced), which combined with process energy data, allow auditors to calculate the aggregate output emissions intensity of refined copper and issue verified intensity metrics in a DCC

Align with Natural Industrial Processes

UNTP should not require facilities to change their manufacturing processes or record-keeping systems. No UNTP credential should carry information not reasonably available in production management systems at the time of issue. Specifically:

• Material flows between facilities are recorded using shipping manifests, which are logistics-level flow records representing physical movement, not commercial sale. Logistics systems already create and consume shipping manifests.
• Production runs represent consumption of inputs and creation of outputs. Whether discrete, batch, or continuous, all production management systems maintain this data.
• Facility stocks represent point-in-time inventory of both input and output materials. All production management systems maintain running balances updated after each shipment or production run and verified via periodic physical stock-takes.
• Product records are master data that define specific characteristics of uniquely identified material types used as inputs or outputs. Product records define metrics like emissions intensity and chemical composition used to calculate impacts (like carbon footprint per tonne of copper) from material facts (like tonnes of copper concentrate).

UNTP credentials map naturally to these business records: Digital traceability events carry flow information via shipping events, transformation events (production runs), and object events with bizStep "stocktaking" (inventory snapshots). Digital product passports carry material characteristics that can be used to calculate impacts from raw facts. Digital facility records carry facility-level conformity claims and certifications.

Preserve Privacy While Enabling Verification

Most facilities will not want to provide public transparency into their internal production stocks and flows. Yet all facilities should operate on a level playing field where everyone can be confident that genuine commercial confidentiality concerns are not being used to hide non-compliant behaviour. The answer is that facilities that want to provide their customers with chain-of-custody assurance should share their material accounting information with at least one trusted independent party, but not necessarily with everyone.

A key advantage of a digital standard like UNTP is reduced auditing cost: digital and verifiable source data enables increasingly automated algorithmic auditing. This permits every actor to choose an appropriate level of transparency vs confidentiality simply by choosing who they share their UNTP DTEs with:

• Random sample-based audits. A facility maintains internal records using UNTP transformation events, shipping events, and stocktake events. All relevant material accounting data for any given production period are grouped and signed by the facility as an evidence bundle, and only the hash of the bundle is shared to support self-assessed chain of custody claims. External auditors can request random bundles, verify (using the hash) that underlying evidence has not changed, and confirm the facility's claims via a public assessment DCC.
• Outsourced continuous audit. A facility streams all their internal material accounting data (DTEs) to a trusted external auditor who issues trustworthy verifiable assessments (DCCs) to back claims in DPPs and DFRs issued by the facility.
• One-up-one-down verification. Facilities share their material accounting data only with direct customers. Those customers typically do not share supplier data further downstream for commercial sensitivity reasons. In this model, the facility essentially outsources the audit to their customers.
• Full public transparency. Some businesses may decide that full transparency is a competitive advantage and may choose to make their material accounting data discoverable by anyone.

In all these models, there is no change to the actual material accounting data or how it is embedded into credentials and shared. The only difference is who it is shared with. The models are also not mutually exclusive—for example, a facility may share its material accounting data (as UNTP DTEs) with a customer and also provide that same customer with an independent audit report (as UNTP DCCs).

Prefer Continuous Algorithmic Assurance Over Episodic Inspection

Manual audits of small samples of onsite material accounting records are costly and may face increased fraud risk due to selective sample sharing.

However, if source data is digitalized and verifiable according to the UNTP standard, continuous algorithmic auditing becomes feasible. Provided that the protocol offers reasonable mitigation of fraud vectors, continuous algorithmic auditing of facility-level material accounting should be both lower cost and higher integrity.

UNTP Credentials in Chain of Custody

This section provides more detail on how UNTP credentials support verifiable chain of custody claims.

Overview

The diagram shows an overview of credential flows for a refiner facility seeking to provide chain of custody compliance assurance to its customers without revealing commercial sensitivities. No new UNTP credentials are required—only conventions on credential use to achieve privacy-preserving and auditable material mass-balance compliance.

Actors:

• Copper Mine (did:web:coppermine.example.com) - Produces copper ore concentrate
• Refiner (did:web:refiner.example.com) - Refines to 99.99% pure copper cathodes
• Fabricator (did:web:fabricator.example.com) - Manufactures copper wire and components

Process flow:

1. A supplier facility (e.g., a mine-site) ships material with a shipping manifest (DTE) listing material identifiers and quantities. The mine has also issued a DPP for each material and may include conformity assessments (DCCs) about the mined materials. Following the UNTP identity resolver (IDR) standard, the DPPs and DCCs are discoverable from material identifiers in the shipping manifest.
2. The refiner receives the inbound shipment. If reporting chain of custody using mass-balance policies, the inbound shipment may be mixed with other ore supplies with different qualities. The facility performs production runs (batch or continuous) and records quantities of input materials consumed and output materials produced as transformation event DTEs. The facility also performs periodic stock-takes and records current inventory levels as stocktake event DTEs (object events with bizStep "stocktaking").
3. The external auditor (which, if all source data is digital, could be an algorithmic service) receives all stock and flow data (DTEs including shipping, transformation, and stocktake events), pulls the DPPs (qualities) for each identified material, verifies material accounting (balancing material mass), calculates impacts (e.g., emissions intensity), and issues DCCs at product and facility level that provide trusted attestation of correct allocation of impacts such as emissions intensity to output products.
4. The facility issues DPPs with declared product characteristics and intensity metrics (via assessmentCriteria and declaredValue) and DFRs with facility-level conformity claims and quality metrics (e.g., certifications, capacity, energy performance). The facility adds the DCCs received from the independent auditor as verifiable support for product-level intensity metrics and mass-balance conformance. A shipment of refined product is prepared for a customer and includes a shipping manifest listing identifiers and quantities of refined product in the shipment.
5. The customer facility receives the shipment and manifest and can pull DPPs (product characteristics and intensity metrics), DCCs (verified intensities and conformance), and DFRs (facility certifications and capabilities) that provide verifiable confidence in the qualities claimed for refined products. The receiving facility (e.g., a fabricator) is now in the same position as the refining facility was in step 1, and the material accounting process can repeat at the fabricator facility.

How These Credentials Work Together

1. DPPs define product characteristics and intensity metrics using assessmentCriteria and declaredValue (reusable reference data)
2. DTEs record material flows (shipping), transformations (production), and stocks (stocktake events)
3. DCCs provide independent verification of conformance and verified intensity metrics using assessmentCriteria that reference corresponding criterion.id from DPPs and DFRs
4. DFRs provide facility-level conformity claims, certifications, and quality metrics using assessmentCriteria and declaredValue

Criterion Alignment: Each assessment criterion in DPPs and DFRs has a unique criterion.id (e.g., https://coppermine.example.com/criteria/carbon-intensity). When an auditor issues a DCC, the DCC's assessmentCriteria reference these same IDs, creating a verifiable link between facility claims and auditor verification.

The copper fabricator can verify the entire chain by:

• Reading the refiner's DCC to confirm mass balance integrity and obtain verified intensity metrics
• Following criterion IDs to trace which DPP/DFR claims the auditor verified
• Tracing back through DTEs to see material flows, transformations, and stock positions
• Checking DPPs to understand material characteristics and base intensities (via assessmentCriteria/declaredValue)
• Reading DFRs to understand facility-level certifications, conformance claims, and operational capabilities
• Calculating embedded impacts using quantities from DTEs × verified intensities from DCCs

This preserves commercial confidentiality (prices, supplier identities) while enabling verification of physical reality and sustainability claims.

Example 1: DPP for Input Ore

Purpose: Identity and characteristics Accounting analogy: GL account number

A DPP:

• Identifies a product, material, or product class
• Declares intrinsic properties and intensity metrics (e.g., kg CO₂e / tonne material, m³ water / tonne material)
• Does not assert quantity or location

DPPs are reusable references across facilities, shipments, and production records. They answer "what is this material?" not "how much" or "where."

The DPP describes the characteristics and impact intensities of copper concentrate. Note it declares intensities, not absolute quantities.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dpp/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalProductPassport"],
  "issuer": {...},
  "credentialSubject": {
    "type": ["ProductPassport"],
    "granularityLevel": "batch",
    "product": {
      "type": ["Product"],
      "id": "https://coppermine.example.com/products/copper-concentrate",
      "name": "Copper Ore Concentrate",
      "batchNumber": "BATCH-2024-Q1-027",
      "producedByParty": {...},
      "producedAtFacility": {...}
    },
    "conformityClaim": [
      {
        "type": ["Claim", "Declaration"],
        "id": "https://coppermine.example.com/claim/ore-composition",
        "description": "Copper ore grade and material composition",
        "conformityTopic": "product.quality",
        "assessmentCriteria":[
          {
            "type": ["Criterion"],
            "id": "https://scheme.example.com/criteria/ore-composition",
            "name": "Copper ore grade and material composition",
          }
        ],
        "declaredValue": [
          {
            "metricName": "Copper (Cu) content",
            "metricValue": {
              "value": 0.285,
              "unit": "fraction"
            }
          }
        ]
      },
      {
        "type": ["Claim", "Declaration"],
        "id": "https://coppermine.example.com/criteria/carbon-intensity",
        "description": "Carbon emissions intensity",
        "conformityTopic": "environment.emissions",
        "assessmentCriteria":[
          {
            "type": ["Criterion"],
            "id": "https://scheme.example.com/criteria/carbon-intensity",
            "name": "Carbon emissions intensity",
          }
        ],
        "declaredValue": [
          {
            "metricName": "Carbon Intensity (per tonne concentrate)",
            "metricValue": {
              "value": 450,
              "unit": "KGM-CO2e"
            }
          }
        ]
      }
    ]
  }
}

Key observations:

• Uses assessmentCriteria array to group related quality metrics
• Each assessment criterion has unique id (e.g., https://coppermine.example.com/criteria/carbon-intensity) enabling alignment with auditor verification in DCCs
• Each assessment criterion has declaredValue array containing specific metrics
• Material composition (ore grade) declared using assessmentCriteria
• Multiple intensity bases provided (per tonne concentrate AND per tonne contained copper)
• Appropriate conformityTopic for each category (emissions, water, energy)
• No quantities declared—this is a product class definition with intensity metrics

Example 2: DTE for Stocktake Event

Purpose: Material stocks at a point in time Accounting analogy: Balance sheet

A stocktake DTE:

• Uses bizStep "stocktake" to indicate inventory observation
• Records quantities of materials on hand at a specific facility
• References DPPs for product identity
• Provides verifiable "balance sheet" snapshot at a point in time

This example shows a stocktake event at the smelter facility recording current inventory levels.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dte/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalTraceabilityEvent"],
  "id": "https://smelter.example.com/dte/stocktake-2024-03-31",
  "issuer": {
    "type": ["CredentialIssuer"],
    "id": "did:web:smelter.example.com",
    "name": "Example Smelter Operations"
  },
  "validFrom": "2024-03-31T23:59:59Z",
  "credentialSubject": {
    "type": ["ObjectEvent", "Event"],
    "eventTime": "2024-03-31T23:59:59Z",
    "action": "observe",
    "bizStep": "stocktaking",
    "bizLocation": "did:web:smelter.example.com:facility:main",
    "quantityList": [
      {
        "productId": "https://coppermine.example.com/dpp/concentrate-batch-2024-Q1",
        "quantity": 5420,
        "uom": "TNE",
        "comment": "containedMetal extension for chain of custody",
        "containedMetal": {
          "element": "Cu",
          "quantity": 1544.7,
          "unit": "TNE"
        }
      },
      {
        "productId": "https://smelter.example.com/dpp/blister-copper",
        "quantity": 1240,
        "uom": "TNE",
        "comment": "containedMetal extension for chain of custody",
        "containedMetal": {
          "element": "Cu",
          "quantity": 1215.2,
          "unit": "TNE"
        }
      }
    ]
  }
}

Key observations:

• Uses EPCIS bizStep "stocktaking" to indicate inventory observation
• Time-bounded snapshot (end of Q1 2024)
• References DPPs for product identity
• Records material quantities (facts) without impact calculations
• Provides verifiable "balance sheet" at a point in time

Example 3: DFR for Facility Conformity Claims

Purpose: Facility-level certifications, conformity, and quality metrics Accounting analogy: Corporate certifications/registrations

A DFR:

• Identifies a facility
• Declares facility-level certifications and conformity claims (using conformityClaim)
• Declares facility quality metrics and operational capabilities (using assessmentCriteria and declaredValue)
• Does not carry material accounting data (stocks, flows, shipment quantities)
• Provides verifiable evidence of facility-level compliance, certifications, and capabilities

This example shows a DFR for the smelter facility communicating its certifications, conformity to standards, and operational quality metrics.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dfr/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalFacilityRecord"],
  "id": "https://smelter.example.com/dfr/2024",
  "issuer": {
    "type": ["CredentialIssuer"],
    "id": "did:web:smelter.example.com",
    "name": "Example Smelter Operations"
  },
  "validFrom": "2024-01-01T00:00:00Z",
  "validUntil": "2025-12-31T23:59:59Z",
  "credentialSubject": {
    "type": ["FacilityRecord"],
    "id": "https://smelter.example.com/facility-record/2024",
    "facility": {
      "type": ["Facility"],
      "id": "did:web:smelter.example.com:facility:main",
      "name": "Example Smelter - Main Facility",
      "countryOfOperation": "AU",
      "processCategory": [...],
      "operatedByParty": {...}
    },
    "conformityClaim": [
      {
        "type": ["Claim", "Declaration"],
        "description": "Environmental Management System certification",
        "conformityTopic": "environment.management",
        "referenceStandard": {
          "type": ["Standard"],
          "name": "Sample Environmental Management Standard",
          "issuingParty": {...}
        },
        "conformance": true,
        "conformityEvidence": {...}
      },
      {
        "type": ["Claim", "Declaration"],
        "description": "Supply chain due diligence compliance",
        "conformityTopic": "governance.ethics",
        "referenceRegulation": {
          "type": ["Regulation"],
          "name": "Sample Due Diligence Guidance"
        },
        "conformance": true
      },
      {
        "type": ["Claim", "Declaration"],
        "id": "https://smelter.example.com/criteria/operational-capacity",
        "description": "Facility operational capabilities and capacity",
        "conformityTopic": "environment.energy",
        "declaredValue": [
          {
            "metricName": "Annual smelting capacity",
            "metricValue": {
              "value": 250000,
              "unit": "TNE"
            }
          },
          {
            "metricName": "Typical copper recovery rate",
            "metricValue": {
              "value": 0.96,
              "unit": "fraction"
            }
          }
        ]
      }
    ]
  }
}

Key observations:

• Carries facility-level conformity claims (certifications) using conformityClaim array
• Uses assessmentCriteria with declaredValue for facility quality metrics (capacity, recovery rates, energy performance)
• Each assessment criterion has unique id (e.g., https://smelter.example.com/criteria/operational-capacity) enabling alignment with auditor verification in DCCs
• References external standards and regulations
• Includes certification body details and validity periods
• Does NOT carry material accounting data (stocks, flows, shipment quantities)
• Provides verifiable facility credentials and operational capabilities to support trust

Example 4: DTE for Shipping Event

Purpose: Material flows between facilities Accounting analogy: Ledger transactions

Shipping DTEs:

• Record material movement between facilities
• Use bizStep "shipping" to indicate the business context
• Are digitally signed by the responsible facility
• Form part of an append-only material ledger
• Reference DPPs to identify what materials are involved

This example shows a shipping event from the mine to the smelter.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dte/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalTraceabilityEvent"],
  "issuer": {...},
  "credentialSubject": {
    "type": ["TransactionEvent", "Event"],
    "eventTime": "2024-02-15T14:30:00Z",
    "action": "observe",
    "bizStep": "shipping",
    "bizLocation": "did:web:coppermine.example.com:facility:main",
    "sourceParty": {
      "type": ["Party"],
      "id": "did:web:coppermine.example.com"
    },
    "destinationParty": {
      "type": ["Party"],
      "id": "did:web:smelter.example.com"
    },
    "quantityList": [
      {
        "productId": "https://coppermine.example.com/dpp/concentrate-batch-2024-Q1",
        "quantity": 850,
        "uom": "TNE",
        "comment": "containedMetal extension for chain of custody",
        "containedMetal": {
          "element": "Cu",
          "quantity": 242.25,
          "unit": "TNE"
        }
      }
    ]
  }
}

Key observations:

• Uses TransactionEvent type per UNTP v0.6.0 schema
• References the DPP for product identity via productId
• Records both total mass and contained metal (copper content) as extension
• Uses sourceParty and destinationParty (Party type objects)
• Counterparty (smelter) would issue corresponding receiving event

Example 5: DTE for Refining Production Run at Smelter

Purpose: Material transformation Accounting analogy: Ledger transactions

Transformation DTEs:

• Record production processes that transform inputs to outputs
• Use bizStep "commissioning" or similar to indicate production
• Include yield and loss data (facts)
• Form part of an append-only material ledger

This transformation event records the smelting process converting concentrate to blister copper.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dte/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalTraceabilityEvent"],
  "issuer": {...},
  "credentialSubject": {
    "type": ["TransformationEvent", "Event"],
    "eventTime": "2024-02-28T23:59:59Z",
    "action": "observe",
    "bizStep": "commissioning",
    "bizLocation": "did:web:smelter.example.com:facility:main",
    "processType": "Copper smelting",
    "inputQuantityList": [
      {
        "productId": "https://coppermine.example.com/dpp/concentrate-batch-2024-Q1",
        "quantity": 3200,
        "uom": "TNE",
        "comment": "containedMetal extension for chain of custody",
        "containedMetal": {
          "element": "Cu",
          "quantity": 912,
          "unit": "TNE"
        }
      }
    ],
    "outputQuantityList": [
      {
        "productId": "https://smelter.example.com/dpp/blister-copper",
        "quantity": 890,
        "uom": "TNE",
        "comment": "containedMetal extension for chain of custody",
        "containedMetal": {
          "element": "Cu",
          "quantity": 872,
          "unit": "TNE"
        }
      }
    ],
    "comment": "yield extension for chain of custody",
    "yield": {
      "metalRecoveryRate": 0.956
    }
  }
}

Key observations:

• Uses TransformationEvent type per UNTP v0.6.0 schema
• Run record for continuous process (one month campaign)
• Records inputs consumed (inputQuantityList) and outputs produced (outputQuantityList)
• Includes yield and loss data as extensions
• containedMetal property added as chain-of-custody extension for material accounting

Example 6: DCC for Independent Chain of Custody Assurance

Purpose: Verified conformance and intensity metrics Accounting analogy: Audited accounts

DCCs:

• Issued by independent auditors (not facilities)
• Communicate chain of custody conformance (e.g., mass balance verified)
• Provide verified intensity metrics for output products
• Hide commercially sensitive data (absolute quantities, supplier identities)
• Enable trust without revealing operational details

The DCC is issued by an independent auditor after verifying the smelter's material accounting. It communicates verified conformance claims and intensity metrics WITHOUT revealing commercially sensitive stock and flow data.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dcc/0.6.0/"
  ],
  "type": ["VerifiableCredential", "DigitalConformityCredential"],
  "issuer": {
    "type": ["CredentialIssuer"],
    "id": "did:web:auditor.example.com",
    "name": "Independent Materials Auditing Service"
  },
  "validFrom": "2024-04-15T00:00:00Z",
  "validUntil": "2025-04-15T00:00:00Z",
  "credentialSubject": {
    "type": ["Attestation"],
    "assessorLevel": "3rdParty",
    "attestationType": "certification",
    "issuedToParty": {
      "type": ["Party"],
      "id": "did:web:smelter.example.com"
    },
    "assessment": [
      {
        "type": ["ConformityAssessment", "Declaration"],
        "name": "Mass Balance Conformance",
        "assessmentDate": "2024-04-10T00:00:00Z",
        "referenceStandard": {
          "type": ["Standard"],
          "name": "Sample Mass Balance Standard v1.0"
        },
        "conformityTopic": "environment.energy",
        "conformance": true,
        "assessedFacility": {
          "facility": {
            "type": ["Facility"],
            "id": "did:web:smelter.example.com:facility:main"
          }
        },
        "assessmentCriteria": [
          {
            "type": ["Claim", "Declaration"],
            "id": "https://smelter.example.com/criteria/operational-capacity",
            "description": "Verified operational capacity and recovery rates",
            "conformityTopic": "environment.energy",
            "declaredValue": [
              {
                "metricName": "Verified copper recovery rate",
                "metricValue": {
                  "value": 0.956,
                  "unit": "fraction"
                },
                "accuracy": 0.98
              }
            ]
          }
        ],
        "comment": "auditSummary extension for chain of custody",
        "auditSummary": {
          "auditPeriod": {
            "startDate": "2024-01-01",
            "endDate": "2024-03-31"
          },
          "inboundShipmentsVerified": 47,
          "outboundShipmentsVerified": 38,
          "productionRecordsVerified": 3,
          "counterpartyReconciliations": {
            "matched": 45,
            "unmatched": 0
          },
          "materialVariance": {
            "averagePercentage": 1.1,
            "withinTolerance": true
          }
        }
      },
      {
        "type": ["ConformityAssessment", "Declaration"],
        "name": "Carbon Intensity Verification",
        "conformityTopic": "environment.emissions",
        "conformance": true,
        "assessedProduct": {
          "product": {
            "type": ["Product"],
            "id": "https://smelter.example.com/dpp/blister-copper"
          }
        },
        "assessmentCriteria": [
          {
            "type": ["Claim", "Declaration"],
            "id": "https://coppermine.example.com/criteria/carbon-intensity",
            "description": "Verified carbon emissions intensity for input materials",
            "conformityTopic": "environment.emissions",
            "declaredValue": [
              {
                "metricName": "Carbon Intensity (per tonne contained Cu)",
                "metricValue": {
                  "value": 2908,
                  "unit": "KGM"
                },
                "accuracy": 0.95
              }
            ]
          },
          {
            "type": ["Claim", "Declaration"],
            "id": "https://smelter.example.com/criteria/energy-performance",
            "description": "Verified facility energy and emissions performance",
            "conformityTopic": "environment.emissions",
            "declaredValue": [
              {
                "metricName": "Verified process energy consumption per tonne",
                "metricValue": {
                  "value": 3.15,
                  "unit": "MWH"
                },
                "accuracy": 0.97
              }
            ]
          }
        ]
      }
    ]
  }
}

Key observations:

• Uses Attestation type per UNTP v0.6.0 schema with assessment array
• Issued by independent auditor (not the facility)
• Each assessment includes assessmentCriteria array with declaredValue for verified metrics
• Criterion alignment: Uses criterion.id to reference corresponding claims in DPP and DFR
  • Mass Balance assessment references DFR criterion: https://smelter.example.com/criteria/operational-capacity
  • Carbon Intensity assessment references DPP criterion: https://coppermine.example.com/criteria/carbon-intensity AND DFR criterion: https://smelter.example.com/criteria/energy-performance
  • Water Intensity assessment references DPP criterion: https://coppermine.example.com/criteria/water-intensity
• Provides verified intensity metrics with accuracy scores (not absolute quantities)
• Includes high-level audit statistics (counts, percentages) via auditSummary extension without revealing sensitive data
• Hides all commercially sensitive information (actual stock levels, flow quantities, supplier identities)
• Time-bounded validity (annual audit cycle)
• Enables downstream buyers to trust facility operations and use verified intensities for their own impact calculations

Fraud Resistance and Assurance

Fraud in chain of custody claims will disadvantage legitimate actors and lead to a collapse in trust (and hence value) of material sustainability claims. When there is material value (i.e., higher prices or reduced taxes) attached to performance claims, there will be incentives to make fraudulent claims. This section defines fraud prevention measures and how they counter plausible fraud vectors.

Prevention Measure: Algorithmic Mass-Balance Audit

If all stocks and flows are:

• Digitally signed by responsible parties
• Time-ordered and immutable
• Counterparty-anchored (suppliers sign outbound, receivers sign inbound)

Then mass-balance assurance becomes an algorithmic audit problem rather than requiring constant physical site inspections.

An independent audit service (which may be a trusted third-party auditor or an algorithmic service) can:

1. Collect opening stock positions from Digital Facility Records
2. Gather all inbound flows (signed by suppliers)
3. Gather all outbound flows (signed by facility)
4. Collect production records (signed by facility)
5. Apply conservation rules and declared yield/loss tolerances
6. Check for:
   • Temporal consistency
   • Counterparty consistency (outbound from A matches inbound to B)
   • Impossible negative balances
   • Output quantities exceeding possible inputs
7. Issue a UNTP Digital Conformity Credential (DCC) as the audit opinion

The DCC serves as the verifiable audit opinion for facility-level mass balance. This is directly analogous to audited financial accounts in the accounting world.

The DCC attests:

"Given the signed stocks and flows available, the facility's material balances reconcile within declared tolerances for the period [start] to [end]."

Key properties of mass-balance DCCs:

• Issued by: An independent auditor (human auditor or algorithmic audit service)
• Subject: A specific facility for a specific time period
• Evidence base: References to DFRs (stocks), DTEs (flows), and production records
• Claim: Material conservation holds within tolerances
• Credential type: org.untp.dcc.massBalance or similar conformity assessment type
• Enables: Downstream actors to trust upstream facility operations without accessing commercial details

The DCC allows buyers to verify that a facility's claimed outputs are credible given their inputs, without requiring visibility into commercial relationships, pricing, or specific supplier identities. This preserves commercial confidentiality while enabling verification.

Advantages:

• Continuous assurance instead of periodic site visits
• Scales globally without linear increase in audit costs
• Works across borders and supply tiers
• Preserves commercial confidentiality (auditors see hashes and summaries, not full commercial terms)
• Detects inconsistencies in near real-time

Limitations:

• Does not prevent measurement errors or sensor tampering
• Assumes digital signatures represent legitimate parties
• Requires baseline physical audits to establish trust anchors

Countering Facility Collusion

Collusion between facilities is the hardest residual risk. If Facility A and Facility B collude, they could fabricate matching inbound/outbound records. However, several practical, achievable controls dramatically raise the cost of collusion:

1. Multi-Party Reconciliation (Network Effects)

Collusion is easiest pairwise but becomes fragile when third parties are involved. An audit service checks:

• Inbound claims from Facility B
• Outbound claims from Facility A
• Downstream consumption at Facility C
• Stock snapshots across multiple connected facilities

If A and B collude, they must ensure downstream buyers' production records also reconcile. This scales collusion from 2 actors to many actors, which is rarely stable.

2. Time-Based Plausibility Constraints

Material moves and transforms at finite rates. Examples:

• Production rate limits (equipment capacity)
• Transport time constraints (distance and mode)
• Yield envelopes based on declared process parameters

If two facilities invent flows, they often violate rate-of-change constraints, creating statistical anomalies.

3. Statistical Anomaly Detection

Analysis of:

• Yield variance compared to peer facilities
• Loss rates that are suspiciously consistent
• Perfect reconciliation over long periods (real operations have noise)
• Sudden step changes aligned across facilities

These don't prove fraud but trigger targeted audits and focus human attention where needed.

4. Independent Anchoring Points

Collusion collapses if one party cannot lie freely. Practical anchors include:

• Transport operators signing manifests
• Weighbridge operators issuing signed weights
• Port/terminal intake records
• Utility-based production constraints (energy consumed vs output possible)

Even partial anchoring breaks closed-loop fabrication.

5. Randomized Physical Audits

• Algorithmic audit runs continuously
• Facilities randomly selected for spot checks
• Selection weighted by anomaly scores
• Creates uncertainty for would-be colluders

This is exactly how tax audits work—most returns are processed algorithmically, but random physical audits maintain deterrence.

6. Liability and Counterparty Risk Linkage

• Audit failures propagate risk flags to connected parties
• Downstream buyers inherit risk exposure
• Certifications or market access can be suspended

This makes collusion commercially dangerous, not just dishonest.

Objective: Economically Irrational Collusion

The goal is not to make collusion impossible (which is impractical), but to make it:

• Expensive (requires many parties)
• Risky (likely to be detected)
• Fragile (breaks under statistical scrutiny)
• Commercially dangerous (affects business relationships)

This is the same standard financial systems operate under, and regulators accept it as sufficient.

Chain of Custody Models Explained

UNTP treats chain of custody as a policy layer, not a data model. The same underlying stocks and flows support multiple custody models.

The key principle: Chain-of-custody models define what claims may be made—they do not change how physical reality is recorded.

The same facility-level material accounting ledger (stocks, flows, production records) works across all chain-of-custody models. Chain of custody determines which sustainability claims are allowed given the physical evidence.

Model Comparison

Below are four chain-of-custody models, each balancing operational practicality and assurance differently:

Model	Physical Separation	Data Requirement	Claim Strength
Identity Preserved	Strict (single source)	Complete traceability	Strongest
Segregated	Strict (certified only)	Complete traceability	Strong
Mass Balance	Mixing allowed	Time-bounded reconciliation	Moderate
Book and Claim	Fully decoupled	Registry-based	Market-driven

Identity Preserved (IP)

Under Identity Preserved, the exact certified source of the product remains unchanged and unblended throughout the supply chain. Every step, from producer to end-user, tracks and segregates the qualifying quantity so it is never mixed with non-qualifying quantities (or even other qualifying goods from a different source).

• Benefits: This approach achieves maximum traceability, the strongest assurance, and a direct link back to a specific manufacturer, farm, or origin. Its presence within a supply chain facilitates additional sustainability conformance requirements with minimal additional effort.
• Challenges: Identity Preserved is among the most costly and complex approaches to implement, as it requires physical or instance-level identification and segregation at every stage of the supply chain.
• Example: A bag of coffee beans labeled "single-origin" from a specific farm remains separate from other coffee beans (qualifying or non-qualifying) throughout processing and transport. Two production batches of coffee beans from different origins cannot be mixed, even if both batches have identical ESG claims.

Data Requirements

In the UNTP model:

• Each batch maintains a unique DPP identifier
• Production records show 1:1 lineage
• Facility stock records demonstrate no co-mingling
• Strict reconciliation with zero tolerance for mixing

Segregated (SG)

In the Segregated model, qualifying quantities and non-qualifying quantities are never mixed. However, qualifying quantities from different certified sources (all meeting the same standard) may be combined. The final product is still 100% qualifying, but it is not guaranteed to come from a single farm, manufacturer, or origin.

• Benefits: This scheme guarantees that the final product contains only qualifying material while allowing flexibility to pool multiple certified batches.
• Challenges: Still requires physical separation from non-qualifying quantities, which can increase logistics and storage costs.
• Example: A chocolate manufacturer mixes cocoa beans from several accredited farms or origins, without adding any non-qualifying beans. The resulting cocoa batch is 100% qualifying but is not linked to a single farm.

Data Requirements

In the UNTP model:

• Multiple certified batches can share a common sustainability claim DPP
• Production records show only certified inputs
• Facility stock records demonstrate separation from non-certified materials
• No mixing with non-qualifying materials at any stage

Mass Balance (MB)

In a Mass Balance system, controlled commingling of qualifying quantities and non-qualifying quantities is allowed, as long as the overall volume of qualifying outputs does not exceed the volume of qualifying inputs. Facilities and manufacturers track quantities over time to ensure that the percentage (or total amount) of "sustainable" outputs matches the actual qualifying inputs in the system.

• Benefits: Mass Balance allows for the mixing of qualifying and non-qualifying goods at any stage in the supply chain. When such mixing occurs, only the equivalent quantities of qualifying goods can be sold or claimed to be "Mass Balanced" products. This approach is well-suited for complex supply chains and provides flexibility for manufacturers to source goods sustainably, even when certain constraints exist, such as:
  • Facilities unable to keep products separate during transportation or storage
  • Minimum quantities required for manufacturing or production not being fully met by qualifying quantities
  • The cost of keeping qualifying and non-qualifying materials separate leading to non-competitive pricing and hindering market development of certified materials
• Challenges: Dilution occurs at the physical level, meaning end-users and buyers cannot be certain that their specific product is made from qualifying materials—only that an equivalent volume of qualifying material was used elsewhere in the process.
• Example: A flour mill receives both certified organic wheat (40%) and conventional wheat (60%). During processing, these grains are mixed together. Under Mass Balance, the mill can sell up to 40% of its total flour output as "organic" since this matches the proportion of organic input wheat. The remaining 60% must be sold as conventional flour. If the mill processes 100 tons of wheat in total (40 tons organic, 60 tons conventional), they can sell up to 40 tons of the resulting flour as organic, regardless of which specific flour particles came from which wheat source. This allows efficient processing while maintaining accurate sustainability claims based on input ratios.

Data Requirements

In the UNTP model:

• Production records convert mixed inputs to outputs
• Facility ledger enforces conservation: qualified output ≤ qualified input
• Time-bounded reconciliation (e.g., quarterly, annually)
• Tolerances applied to yield and loss calculations
• Same data model as segregated, but different audit logic

Book-and-Claim (BC)

In Book-and-Claim models, sustainability attributes (e.g., "deforestation-free," "carbon-neutral") are decoupled entirely from the physical flow of goods. A producer meeting the standard "books" or issues credits into a registry, and a buyer can purchase (or "claim") those credits even if the physical product they receive is not the certified batch or instance.

• Benefits: Book-and-Claim simplifies sustainable sourcing in complex supply chains where full traceability across all actors is prohibitively expensive. It provides a pathway for small and medium enterprises (SMEs), smallholder farmers, and similar entities to participate in sustainability initiatives without requiring their local procurers (e.g., mills, aggregators, or intermediaries) to adopt traceability or compliance practices.
  • For producers: SMEs or smallholder farmers can "book" credits for certified production and sell their goods into local, uncertified supply chains as usual. These credits can be transacted globally, overcoming geographic limitations and enabling access to new markets and potential premium pricing.
  • For buyers: When uncertified inputs are used in the production of final goods, purchasing or "claiming" credits allows buyers to offset the environmental or social impact of those uncertified inputs. The number of credits a producer can sell is strictly governed by the certification standard backing the credits they "book." This enables sustainable production to extend its reach even in supply chains lacking comprehensive traceability infrastructure.
• Challenges: A trusted registry is essential to ensure that no double-counting or over-issuance of credits occurs, as the decoupled nature of this model requires robust governance and verification mechanisms.
• Example: A palm oil producer in Indonesia receives certification that their production methods are deforestation-free. They sell their physical palm oil to local processors (who may not track sustainability credentials), but can separately sell "deforestation-free credits" to global manufacturers. A soap manufacturer in Europe, unable to source certified deforestation-free palm oil directly, can purchase these credits to offset their use of conventional palm oil. For every ton of conventional palm oil they use, they purchase and retire one ton of deforestation-free credits. This allows them to claim their soap products support deforestation-free palm oil production, even though the physical palm oil in their products may not be from certified sources. The credits ensure that for every ton of conventional palm oil used in Europe, an equivalent ton of certified deforestation-free palm oil was produced somewhere in the world.

Data Requirements

In the UNTP model:

• Physical ledger still records actual material flows
• Credits are minted as derivative instruments based on verified production
• Credits reference production records, not shipments
• Registry ensures credits ≤ eligible production
• Prevents double issuance and tracks credit lifecycle

Book-and-Claim Implementation

Due to the nature of Book-and-Claim, where sustainability credentials are entirely decoupled from physical goods, different implementation challenges arise:

1. Credential holders need a method to "book" quantities of certified goods they are eligible for
2. Credential holders need to be able to "transfer" credits to buyers globally
3. Credential holders cannot "book" the same quantity multiple times or "transfer" the same credit to multiple buyers
4. Buyers of credits must be able to subsequently transfer to future buyers without the original party knowing
5. Holders of credits must be able to "retire" credits when the quantity is used in manufacturing
6. Manufacturers consuming credits can provide evidence to buyers of credit ownership and retirement

Implementation Workflow

Below is a potential implementation using generic actor names—representative of any supply chain, commodity, product, or ESG credential.

Each section includes a rolling use case: a wheat producer receiving carbon-neutral certification from a trust anchor, tokenizing that credential against specific wheat quantities, transferring ownership to a miller outside their supply chain or geographic region, and finally the miller retiring credits after milling equivalent non-qualifying wheat and presenting evidence to flour buyers.

Credential Issuance

A certifier assesses against ESG criteria and issues a sustainability credential to the seller. The credential specifies the allowable production quantities that can be "booked" (converted into credits) under the claim.

The issuer determines the upper limit of bookable credits based on volume prediction models, historical averages, or comparable industry benchmarks.

Example: The wheat producer provides evidence that their farming enterprise is carbon-neutral and receives a credential attesting this. The certifier, using wheat production averages for the region, understanding of production area size, and satellite imagery, assesses that 1000t of wheat production for the upcoming harvest period is feasible.

The wheat producer now has the ESG credential and the ability to "book" up to 1000t of wheat produced.

"Booking" Credits

The seller performs production activities, and when a quantity is produced, they can tokenize the ESG credential as credits.

The seller tokenizes credits against the certifier's register (potentially an Identity Resolver operated by or on behalf of the certifier). The seller receives a credential from the certifier for the qualifying quantity.

{
    "credentialSubject": {
        "id": "did:example:seller",
        "quantity": {
            "quantity": 1,
            "uom": "KGM"
        },
        "schema": "https://.../schema.json"
    },
    "proof": { ... }
}

This VC enables the seller to present evidence of their certified claim to potential buyers. Buyers can independently verify the credential's authenticity and confirm genuine ownership via the certifier's Identity Resolver.

Example: The wheat producer harvests 75t of wheat and receives 75 one-tonne carbon-neutral credits from the certifier. The producer now has 75 credits to sell globally.

Potential buyers can verify the VC to ensure it is valid, not revoked, in date, actually owned by the producer, and reflects the correct ESG schema.

The producer is free to sell any allotment of these 75 credits to any number of buyers.

Transferring (Selling) Credits

The seller wishes to sell credits to a buyer in a different geographic region.

To initiate transfer:

1. The seller submits a transfer request to the certifier register operator, providing:

   • The buyer's DID
   • Reference to specific credit(s) being transferred
   • Digital signature using the seller's private key

2. The register operator verifies by:

   • Authenticating seller and buyer DIDs
   • Confirming validity of referenced credit(s)

3. Upon approval:

   • Ownership transfers to the buyer
   • Original credential held by seller is revoked
   • Buyer receives a new credential representing transferred credits

The buyer retrieves this credential using DID authentication.

The register operator ensures no double counting and satisfies verification requirements.

Example: The wheat producer and miller agree to transfer 10 one-tonne credits of carbon-neutral wheat. The producer initiates transfer with the certifier, providing buyer information and the 10 credits to transfer.

The register operator verifies credits are legitimate, no double counting occurs, credits aren't in escrow in another transaction, and other industry requirements are met.

The buyer requests the 10 credits from the register operator, who issues a new set of 10 credits to the buyer and revokes the previous 10 held by the seller.

The buyer can then transfer these 10 credits or provide them as evidence to other supply chain actors without the original seller knowing.

Retiring Credits

Once the buyer performs manufacturing using non-qualifying quantities, they retire equivalent credits to ensure sustainability attributes are appropriately accounted for.

Steps to retire:

1. Buyer submits retirement request to certifier register, authenticated using their DID, referencing specific credit(s)
2. Certifier register processes the request, marking credits as retired and preventing reuse, double-counting, or future transfer
3. Buyer receives retirement evidence, potentially as a Verifiable Credential referencing the original credit—forming an evidence chain of retirement, credit purchase, and reference to underlying ESG schema

This retirement evidence can link to the Digital Product Passport (DPP) for manufactured products, enabling downstream buyers to verify:

• Schema associated with the original credit
• Identity of the certifier who issued the initial credential
• Integrity of the credit lifecycle, including transfer and retirement, validated by the certifier register operator

Example: The miller purchases 10 one-tonne carbon-neutral wheat credits from the farmer. The miller mills 10t of non-qualifying wheat as they have no practical physical access to certified carbon-neutral wheat, but wants to claim 10t of output flour as carbon-neutral.

The miller retires the 10 credits with the certifier register operator and receives retirement evidence. In a Digital Product Passport for the flour, the miller references this evidence as proof to buyers.

Flour buyers can be confident that 10t of carbon-neutral wheat production occurred somewhere globally under a framework they trust (per the credential schema) and that this 10t has not been double counted elsewhere in the supply chain.