Due Diligence on Your Own Supply Chain: The Risks Hiding in Tier-2 and Tier-3 Suppliers

Primary Audience: Chief Procurement Officers, Compliance Teams, Risk Officers

The Visibility Wall at Tier One

Most corporate supply chain due diligence programs are built around Tier-1 supplier relationships — the direct vendors from whom a company purchases goods and services. The suppliers beyond Tier 1 — the subcontractors and raw material providers who supply the suppliers — are largely invisible to most corporate programs, even as regulatory frameworks increasingly require visibility into the full supplier network.

A McKinsey analysis found that nearly 45% of organizations report ESG visibility only to their immediate Tier-1 trading partners, while nearly a third have no structured visibility beyond their own four walls. The regulatory and reputational risks that organizations are most concerned about concentrate precisely where the visibility doesn't.

▸ SOURCE: McKinsey & Company / SupplyChainBrain — supply chain visibility study — nearly 45% of organizations report ESG visibility only to Tier-1 suppliers; forced labor, sanctions exposures, and governance failures concentrate in sub-tier supplier relationships

The Regulatory Imperative for Sub-Tier Visibility

• The Uyghur Forced Labor Prevention Act: The UFLPA, enforced by US Customs and Border Protection since June 2022, creates a rebuttable presumption that goods produced wholly or in part in the Xinjiang Uyghur Autonomous Region are prohibited from import — including goods that contain Xinjiang inputs sourced anywhere in the supply chain. UFLPA enforcement detained $1.34 billion in goods in 2024, the majority from Tier-2 and Tier-3 supplier relationships.

▸ SOURCE: Uyghur Forced Labor Prevention Act — US Customs and Border Protection — UFLPA detained $1.34 billion in goods in 2024; burden of proof falls on the importer; Tier-2 and Tier-3 suppliers are the primary exposure vector for most large importers

• EU Corporate Sustainability Due Diligence Directive: The CSDDD extends human rights and environmental due diligence obligations across the full value chain, including sub-tier suppliers, for companies operating in the European market above relevant thresholds.

• Germany's Supply Chain Act (LkSG): Effective for large companies from January 2023, the LkSG requires due diligence on human rights and environmental risks across the full supply chain.

Axiom Verify's proprietary intelligence capability — combining proprietary access and human intelligence — provides the sub-tier visibility required for regulatory compliance and reputational protection.

Conclusion

Supply chain due diligence that stops at Tier 1 is compliance theater. The regulatory exposure and reputational risk concentrate precisely where the visibility doesn't. Axiom Verify provides the intelligence to see what most programs cannot. Visit axiomverify.com.