The R2v3 Certification Field Guide: Reading the Scope, the Appendices, and the Directory

What R2v3 is — and what the certificate belongs to

R2 is a facility standard. Almost every misreading of an R2 certificate starts by forgetting that.

R2 — Responsible Recycling — is a voluntary standard for the reuse and recycling of used electronics, owned and administered by SERI (Sustainable Electronics Recycling International), a nonprofit. R2v3 is the current version. The standard governs how a facility handles used electronics from receipt to final disposition: the sorting and categorization of equipment, the tracking of material through the facility, the control of data-bearing devices, the management of hazardous “focus materials” such as batteries and mercury devices, and — centrally — the qualification of the downstream vendors that receive what the facility ships out.

The first fact to hold onto is that R2 certification attaches to a facility, not a company. SERI’s license process is explicit: one license application per facility address, a new application when a facility moves or a new campus location is added, and use of the “R2v3 Certified” mark only where a valid certificate has been issued for that facility. A company with six sites may hold certificates at three. A vendor’s website saying “R2v3 Certified” is therefore a claim about at least one location, and the buyer’s first question is whether the location that will receive their assets is one of them.

The second fact is that R2v3 sits on top of other certifications rather than replacing them. Core Requirement 3 requires the facility’s environmental, health and safety management system to be independently certified — SERI’s own materials describe the two paths as ISO 14001 plus ISO 45001, or the recycling industry’s integrated RIOS standard. Facilities that test and repair equipment for reuse under Appendix C must additionally hold a certified quality management system, ISO 9001 or RIOS. An R2v3 certificate therefore implies a small stack of other certificates beneath it, each of which can also be verified.

The ten Core Requirements every R2 facility meets

The core is universal. It is also where the data-security floor for every R2 facility lives, whether or not the certificate carries Appendix B.

Every R2v3 facility, whatever its business, is audited against ten Core Requirements: Scope (all R2-related processes the facility directly manages must be inside the audited scope); the Hierarchy of Responsible Management Strategies (reuse preferred over materials recovery, recovery over disposal); the certified EH&S Management System; Legal and Other Requirements (a documented compliance plan, including import and export law); Tracking Throughput (records that follow equipment and material through the facility); Sorting, Categorization and Processing (every item classified and routed by documented criteria, using SERI’s R2 Equipment Categorization document); Data Security; Focus Materials; Facility Requirements (physical security, storage, closure planning, insurance); and Transport.

Two of these deserve a buyer’s attention beyond the list. Core Requirement 1, Scope, is the rule that prevents a facility from carving out an activity to keep it away from the auditor: the scope must include all certifiable activities at the facility and only processes the facility itself directly manages — not downstream vendors (they are verified separately under Appendix A), not planned operations that cannot be demonstrated at audit, and not discontinued processes. The certification body, not the facility, determines the final scope wording based on what it could verify.

Core Requirement 7, Data Security, is the data floor every R2 facility must meet regardless of appendices: data-bearing devices must be identified, secured, and controlled through the process, and data must be destroyed or sanitized before equipment moves to reuse or materials recovery. What Core 7 does not do is certify a facility to perform logical sanitization — wiping drives for reuse — as a service. That is Appendix B. A facility with Core 7 alone handles data by physical destruction or by sending data-bearing devices to a downstream vendor qualified for sanitization; a buyer whose program involves wiped-and-remarketed assets needs the letter B.

The appendices: reading the letters on the certificate

The Core is the same for everyone. The Process Requirement appendices are where two R2v3 certificates diverge — and where an ITAD buyer’s attention belongs.

R2v3 attaches Process Requirements as lettered appendices, each covering an activity a facility may or may not perform. A facility is audited only for the appendices in its scope, and each appendix specifies the terms that must appear on the certificate when it applies. The letters: A — Downstream Recycling Chain: the qualification and ongoing verification of the vendors that receive the facility’s controlled streams, all the way to final disposition. B — Data Sanitization: logical and physical sanitization of data-bearing devices with enhanced security controls and traceability — the letter ITAD buyers look for. C — Test and Repair: testing, repair, and refurbishment of equipment for reuse, with a certified quality management system and product-safety verification. D — Specialty Electronics Reuse: commercial-grade specialty equipment (telecom, medical, scientific) handled in coordination with suppliers and customers. E — Materials Recovery: dismantling and mechanical processing into commodities. F — Brokering: arranging the movement of equipment without physically handling it, with responsibility for where it lands. G — Photovoltaic Modules: reuse and recycling of decommissioned solar panels, added to the standard in 2024.

The reading rule is simple: the appendix list is the service list. A certificate scoped to A, B, and C describes a facility audited for downstream vendor management, data sanitization, and refurbishment for reuse — the classic ITAD profile, and the scope CyberCrunch holds. A certificate scoped to A and E describes a materials-recovery operation whose certificate says nothing about data sanitization. A certificate carrying F describes a company that may never touch your equipment but is accountable for where it sends it. None of these is better in the abstract; each is a different set of audited promises, and the buyer’s job is to match the letters to the work.

Appendix B: what “audited for data sanitization” means

Appendix B is R2v3’s own set of data-sanitization requirements. Knowing what it does and does not require is what lets a buyer ask the right next question.

Appendix B requires a facility to operate under a documented Data Sanitization Plan. SERI’s guidance describes the plan as covering five areas across thirteen elements: identifying the types of data storage devices and data the facility manages; defining the security and sanitization requirements that apply, including legal, supplier, and customer obligations; establishing the sanitization processes and procedures; establishing the security controls around them; and developing the training and validation processes that keep the controls effective. The plan is a living document, updated at least annually.

The requirement most worth understanding is verification. Appendix B requires documented quality controls to confirm that every device was processed as planned, and specifically requires that a minimum of five percent of logically sanitized data storage media be routinely sampled and verified — by a competent and independent party, meaning someone other than the person who performed the sanitization, using data-recovery software to demonstrate that data is not recoverable by commercial means. A sanitization tool’s own success message does not count as verification. After a sustained record of success the sampling rate may be reduced, to as low as one percent; if residual data is ever found, the effectiveness of the entire process is in question, previously processed devices must be reassessed, a root-cause nonconformity process must run, and the higher sampling rate returns until corrective action is verified. Records of sanitization activity are required under Core Requirement 7 so that a device’s processing can be shown after the fact.

What Appendix B does not do is name the technical standard for what counts as sanitized. SERI’s guidance notes that R2v3 does not rely on external data-security standards for its requirements; the facility’s plan must define the methods appropriate to each media type and the requirements it is meeting. That is not a weakness — it keeps the standard from going stale when NIST or IEEE revise — but it means a buyer must ask the follow-up: which technical standard does the plan name? The defensible answer in 2026 is NIST SP 800-88 Rev. 2 for the program and IEEE 2883 for the techniques; a plan that names them, and a NAID AAA certificate covering the operation’s security, together answer the question Appendix B alone leaves open.

Appendix A: the downstream chain, and why “we know where it goes” is a documented claim

The original reason R2 exists is the question of where retired electronics actually end up. Appendix A is how the standard makes the answer auditable.

Almost no facility processes electronics to their final form. Circuit boards go to a refiner, batteries to a battery processor, plastics to a compounder, whole units to a reuse channel, and each of those parties may ship onward again. Appendix A requires a facility that manages such a chain to qualify each downstream vendor before shipping — verifying its legal standing, its own R2 or equivalent status where applicable, its handling of focus materials, and its final disposition — and to monitor the chain on an ongoing basis, tracking controlled streams to the point where they cease to be a concern. The downstream vendors themselves are not inside the facility’s certificate scope (Core Requirement 1 excludes them); they are inside its due-diligence obligation.

For a buyer, Appendix A is the answer to two questions that used to be unanswerable: where did the material from our fleet go, and can the vendor prove it. A facility scoped to Appendix A can produce its downstream vendor list, its qualification records, and its throughput tracking. It is also the reason a buyer should be cautious about a vendor that describes its downstream as proprietary or declines to discuss it — under Appendix A, the chain is documented by requirement.

How certification actually works: license, two-stage audit, annual surveillance

Knowing the process explains what a certificate’s date means and why the directory, not the PDF, is the source of truth.

The roles are split. SERI owns the standard, licenses facilities to pursue certification, and authorizes the certification bodies; it does not audit. Certification bodies — independent, SERI-authorized auditing organizations operating under SERI’s R2 Code of Practices and accredited by a recognized accreditation body (in the United States, ANAB) — conduct the audits and issue the certificates. SERI then collects the certificates from every authorized certification body into a single public directory.

Before an audit can begin, the facility completes a SERI license application for that address. SERI’s eligibility rules bar applicants that in the preceding 24 months engaged in deceptive marketing, illegal acts, or fraud related to the activities in scope, or in conduct that would impair the R2 mark. The initial certification audit is two-stage: Stage 1 reviews the documented processes and procedures; Stage 2, typically 30 to 60 days later, assesses the facility and its records on site. Nonconformances must be corrected before a certificate is issued. Thereafter the facility passes annual surveillance audits and renews its license each year; certification is a standing state, not an event.

The buying-side implication is that a certificate PDF is a snapshot. It shows that a facility was certified on a date, for a scope. It does not show that the facility passed its most recent surveillance, that the certificate has not been suspended, or that the scope has not been narrowed. SERI’s directory does — which is why the verification path in the next section runs through the directory first and the PDF second.

How to verify an R2v3 certificate in SERI’s directory

Five minutes on SERI’s website answers most of the questions this guide has raised.

SERI publishes a searchable directory of R2 Certified Facilities, built from the certificates it collects from all authorized certification bodies. It can be searched by facility name, by location and radius, and through an advanced search that filters by certificate status (active, suspended, revoked, expired), by process requirements (the appendices), by business workflow type, by R2 version, and by whether the facility accepts drop-offs. SERI invites reports of omissions or errors and publishes a guide to interpreting search results.

• Step 1 — Find the facility, not the company. Search by the name and confirm the listed address is the location that will receive your assets. A different address is a different certificate, or no certificate.
• Step 2 — Read the status. Only active is certified. Suspended, revoked, and expired are the states a vendor’s website will not mention.
• Step 3 — Read the process requirements. The directory shows which appendices are in scope. For sanitization services you need B; for refurbishment and remarketing, C; for any facility that ships material onward, A.
• Step 4 — Request the certificate and scope statement. Compare the scope wording and appendix list to the statement of work. The certification body wrote the scope based on what it could verify — if a service you are buying is not in it, it was not audited.
• Step 5 — Verify the layer underneath. Ask for the EH&S management-system certificate (ISO 14001 and 45001, or RIOS) and, for Appendix C facilities, the QMS certificate (ISO 9001 or RIOS). These are separately verifiable with their certification bodies.
• Step 6 — Check the destruction-security half. R2v3 Appendix B governs the management of sanitization; the security of a destruction operation — screened people, cameras, custody, unannounced audits — is what NAID AAA certifies. For data-bearing assets, look for both.

The Vendor Due Diligence Guide walks these steps with the other credentials, and the Vendor Due Diligence Scorecard scores the result.

Using R2v3 as a buyer: the questions that matter

You do not need to read the standard. You need to know what a facility that has been audited to it should be able to show you.

• “Which facility will process our assets, and is that the address on the certificate?” The only acceptable answer is the address in SERI’s directory, active.
• “Which appendices are in your scope?” For ITAD with sanitization and remarketing, A, B, and C. Read the scope statement; do not accept a summary.
• “What technical standard does your Data Sanitization Plan name, and how do you verify?” NIST SP 800-88 Rev. 2 and IEEE 2883 for the standard; independent sampling verification of at least five percent of wiped media with data-recovery tooling for the check. Ask to see a verification record.
• “Who are your downstream vendors, and how were they qualified?” Under Appendix A this is documented by requirement. Reluctance is information.
• “What is your EH&S management system certified to, and by whom?” ISO 14001 and 45001, or RIOS, with a certificate you can verify.
• “What happens to a data-bearing device that fails sanitization?” The plan should say: physical destruction, with the failure recorded per serial and reported to you.

CyberCrunch’s R2v3 certification is scoped to Appendices A, B, and C, with RIOS as the management system beneath it and NAID AAA covering the destruction operation — and the certificate, scope statement, and directory listing are provided on request, as this guide tells you to ask of any vendor. The Data Destruction Field Manual covers what happens to a device once the letters check out.

Frequently asked questions

This guide is informational only and reflects SERI’s public program materials for the R2v3 Standard — including its published descriptions of the Core and Process Requirements, the certification process, the R2 Code of Practices, and the directory of R2 Certified Facilities — as of September 2026. The R2v3 Standard is a licensed document available from SERI; this guide describes its structure and requirements at a summary level and does not reproduce normative text. R2 and R2v3 are marks of their owner. This guide is not legal or compliance advice and does not certify any vendor’s conformance; verify any certificate directly in SERI’s directory and confirm current requirements with SERI before relying on a specific clause. CyberCrunch credential statements reflect certificates held at the time of publication.