← Sourcing Intelligence

Compliance documentation gap in Bangladesh garment sourcing: the complete guide

In brief: The compliance documentation gap in Bangladesh garment sourcing is the distance between the point-in-time audit certificate a brand holds and the ongoing monitoring records CSDDD and Germany's LkSG actually require. Close it with quarterly financial monitoring, a six-monthly bank solvency certificate, midpoint production reports, and REACH coverage of the finishing facility.

1/yr

Certificate filed

Most brands hold a single annual audit certificate and nothing between the dates.

48 hrs

Response standard

A complete compliance file should be retrievable in two days, not assembled over weeks.

Tier 2

In scope

CSDDD and LkSG reach the factory and its finishing site, not just the buying house.

Bengal Origin Co. · The compliance documentation gap

The brands I speak to almost always have the certificate. Almost none have the ongoing monitoring records the regulation actually requires. These are not the same thing, and the difference is exactly where the gap sits. A BSCI certificate tells you what a factory looked like on one audit day. CSDDD asks what that factory looked like every month between audit days. That second question is the one most European buyers cannot answer from the documents they hold — and it is the question a regulator or a retailer's legal team eventually asks.

What is the compliance documentation gap in Bangladesh garment sourcing?

The gap is simple to define and hard to close. A brand sourcing from Bangladesh holds an annual audit certificate — BSCI, sometimes a Sedex SMETA report. That certificate is a snapshot of labour conditions on the main sewing floor, on the day the auditor visited, against one standard. CSDDD and the German Supply Chain Act both require ongoing due diligence: records showing the supply chain was watched continuously, not assessed once. The compliance documentation gap is the distance between those two states.

I see it most clearly when a German sourcing manager forwards me their file before an audit. The file contains a BSCI report dated fourteen months ago and nothing since. There is no record of what happened in the factory across those fourteen months. Under LkSG, in force for mid-market companies since January 2024, that absence is the finding. The certificate is genuine. The monitoring is missing. That is the gap.

It widens because the certificate omits more than time. It does not cover the separate finishing facility where the chemistry happens. It does not connect to the sustainability claim printed on the hangtag. A clean-looking file and a complete file are not the same thing.

Why does the gap exist between audit certificates and monitoring records?

It exists because audits are sold as compliance and brands reasonably assume the purchase is complete. An audit is a product with a date and a price. Monitoring is a process with no certificate at the end. Most buying houses provide the first and not the second, so brands end up holding what they were given rather than what the regulation asks for.

The certificate compounds this because it is designed to be self-contained. A SMETA or BSCI report states a scope, applies it, and produces a score. Nothing in it says "this assessment did not visit the dyeing facility" or "this score reflects one day in March." A sourcing manager reads a pass and concludes the supplier is compliant. I have watched experienced compliance teams file a BSCI A-grade and consider the matter closed. The document is honest about what it checked. It is silent about everything it did not — and that silence is what brands mistake for coverage. It is also why a BSCI score does not predict delivery reliability: the audit was never measuring the things that fail.

What does CSDDD actually require beyond a BSCI certificate?

CSDDD requires that a company identify, prevent, and remedy adverse human-rights and environmental impacts on an ongoing basis, including at Tier 2. The buying house is a direct supplier and in scope. The factory is a Tier 2 supplier and in scope. The directive asks for active monitoring records between audit dates — evidence the relationship was managed, not certified once. A BSCI A-grade satisfies the labour-snapshot requirement. It does not satisfy the ongoing-monitoring requirement, which is where the gap lives.

The table below contrasts what most brands currently hold with what the regulation actually asks a Bangladesh sourcing partner to produce.

Requirement	What most brands have	What CSDDD / LkSG requires
Audit	Annual BSCI certificate	Ongoing monitoring records between audits
Subcontracting	Verbal understanding	Signed prohibition per order
Financial health	Not assessed	Quarterly bank solvency check
Chemical safety	Main-factory REACH only	REACH covering the finishing facility
Sustainability claim	Supplier self-declaration	Third-party verified substantiation
Documentation	Assembled on request	Retrievable within 48 hours

Source: Bengal Origin Co. compliance review of mid-market European buying-house engagements, 2024–2026.

For the full operational breakdown I have written separately on what EU CSDDD requires from a Bangladesh sourcing partner and on what the German Supply Chain Act forces mid-market brands to document.

Where does the REACH gap hide in a Bangladesh supply chain?

It hides at the finishing facility, which is frequently not the factory named on the audit certificate. In Bangladesh, dyeing, washing, and finishing are regularly subcontracted to separate specialist sites. The main factory cuts and sews; a different facility handles the chemistry. REACH restricts hazardous substances in the finished garment, so the chemical risk sits precisely where the finishing happens — and that site is often outside the scope of the main BSCI or SMETA audit.

A brand can hold a spotless REACH file for the cutting-and-sewing factory and still ship garments finished at an unassessed wash, dye, or print house with no chemical-safety documentation behind them. The paperwork looks complete because every named document is present, but the highest-chemical-risk step in the process is undocumented.

When I onboard a factory I ask one question first: where is finishing done, and is it on the certificate? Most of the time it is a separate address. I then require the REACH compliance certificate to name that finishing facility specifically. If finishing is off-site, the main factory's certificate does not transfer. Under the tightening Green Claims regime, an undocumented finishing facility is a substantiation problem as much as a REACH one.

What does the Green Claims Directive require that a certificate does not?

It requires third-party verified substantiation for every environmental claim — and a self-declaration from the supplier does not qualify. If a brand prints "sustainably manufactured" on a hangtag, the Green Claims Directive, with enforcement tightening from 2026, expects independently assessed evidence behind those words. A factory's own statement that it runs an efficient effluent plant is not evidence. A LEED certification is, because it is independently assessed against documented metrics — which is part of what LEED Gold actually measures in a garment factory.

The gap here is subtle. Brands have claims on their products and certificates in their files, but the two are not connected by a verified trail. The claim says one thing; the documentation supporting it either does not exist or rests on a supplier's word. Under scrutiny, that is greenwashing risk — and fewer than 50 Bangladesh factories hold LEED Gold or Platinum, so the verifying document is not one a brand can assume is in the file.

How do I close the compliance documentation gap on every order?

I close it with records that exist independent of any audit date, decided before the first order ships rather than improvised when a regulator asks. There are four.

1. A 48-hour documentation response. When a compliance officer asks for a file, it arrives in two days, assembled and current — not reconstructed over three weeks.
2. Quarterly financial monitoring. A traffic-light status on every active factory, plus a bank solvency certificate from each factory refreshed every six months. Healthy capacity utilisation runs 60–85%; above 95% is the danger zone, and I record it.
3. A midpoint production report at 50% completion, with dated floor photographs. This is also the point where quiet subcontracting becomes visible.
4. A written subcontracting prohibition on both the purchase order and the service agreement — because a verbal understanding under financial pressure is worth nothing.

These records turn a relationship into evidence. When the LkSG annual report is due — and that report is public — the brand has a continuous trail rather than a single fourteen-month-old certificate. My full financial vetting protocol sets out the monitoring side in detail.

A real example: the failure that built every protocol I run

In 2022 a factory partner lost its bank financing mid-production. Bangladesh factories operate on bank credit, not their own cash; the back-to-back letter of credit lets a factory use the buyer's LC as collateral to buy fabric. When that credit is withdrawn, production halts.

The withdrawal was visible months earlier — in the factory's wage-payment timing and its utility-payment delays. Factories under stress fall behind on utility bills before they fall behind on orders, because utility providers tolerate delay that fabric mills do not. But I had no monitoring system recording those signals. I had the audit certificates. I did not have the monitoring records that would have flagged the deteriorating credit position. Three client orders failed and every European client left.

Every protocol above was built to close the documentation gap that failure exposed. A certificate never captures a wage-timing shift. A monitoring record does.

Frequently asked questions

Is a BSCI or SMETA certificate enough for CSDDD compliance?

No. It satisfies the point-in-time labour requirement but not the ongoing-monitoring requirement. CSDDD and LkSG both expect dated records between audits showing the supply chain was watched continuously, not assessed once a year.

Does my main factory's audit cover the finishing facility?

Usually not. Dyeing, washing, and finishing are commonly subcontracted to separate sites in Bangladesh, and those addresses fall outside the main audit scope. Require a REACH certificate that names the finishing facility specifically.

Who is responsible under LkSG — the brand, the buying house, or the factory?

All three sit in scope. The buying house is a direct supplier; the factory is a Tier 2 supplier. But the public LkSG report is the brand's, so an open documentation gap becomes the brand's liability, not the factory's.

How quickly should a complete compliance file be available?

Within 48 hours. If your partner needs weeks to assemble a file, the monitoring records did not exist before you asked — which is itself the finding a regulator looks for.

Closing the compliance documentation gap

What actually closes the gap

Dated monitoring records between audits

Bank solvency certificate refreshed every six months

Midpoint production report at 50% completion

REACH certificate naming the finishing facility

Signed subcontracting prohibition per order

The whole file retrievable within 48 hours

What most brands actually have

One annual BSCI or SMETA certificate

Financial health never assessed

No record between the last audit and today

REACH for the main factory only

A verbal understanding on subcontracting

A file assembled from scratch on request

What This Means for European Brands

Check what you actually hold, not what you assume you hold. Pull your Bangladesh file and ask one question: between the last audit date and today, what record shows the supply chain was monitored? If the answer is "the certificate," you have the gap. Then ask two more — do I know where finishing is done and is it documented for REACH, and is every sustainability claim backed by third-party verified evidence? The fix is not another audit. It is a partner who produces monitoring records as standard.

Audit your own file before a regulator does. If you are holding audit certificates but cannot say whether the records between them would survive a CSDDD or LkSG review, that is the place to start — and it is fixable order by order, not all at once.