What Is R2v3 Certification for ITAD Providers?

Last updated: July 18, 2026

Key Takeaways on R2v3 and Full Circle Electronics

• R2v3 is the current ANSI-certified standard for responsible electronics recycling and IT asset disposition, with third-party audits and annual surveillance.
• The standard introduced stricter data security aligned with NIST SP 800-88, expanded downstream accountability and per-facility certification requirements.
• Ten Core Requirements apply to every certified facility, and modular Appendices A–G cover specialized processes such as data sanitization and materials recovery.
• Verification relies on SERI’s public directory, matching facility addresses, confirming active status and checking relevant appendices on each certificate.
• Full Circle Electronics holds R2v3 certification alongside NAID AAA, e-Stewards and ISO credentials. Contact us to discuss certified ITAD programs.

How R2v3 Replaced the Earlier R2 Standard

SERI manages the R2 family of standards. The original R2:2013 (R2v2) was replaced as the mandatory certification baseline on March 31, 2023, when all previously certified facilities completed transition audits to R2v3.

R2v3 introduced four headline changes from R2:2013. First, data security requirements aligned with NIST SP 800-88 Rev. 1, with documented sanitization procedures, chain-of-custody tracking and destruction verification records. Second, downstream accountability expanded so that certified facilities remain responsible for material after it leaves their facility and must verify every downstream vendor’s compliance.

Third, EHS requirements became more prescriptive, with documented management plans, monitoring protocols and explicit controls for hazardous materials. Fourth, each individual facility must now hold its own independent certification rather than operating under a shared certificate, which closed a significant verification loophole present in R2:2013.

The sole amendment since R2v3’s release is R2v3.1, effective January 2024. This update added Appendix G for photovoltaic modules without changing any existing Core Requirements or appendices.

Core R2v3 Requirements and What Each Appendix Covers

R2v3 defines ten Core Requirements that apply to every certified facility, regardless of size or business model.

1. Scope
2. Hierarchy of Responsible Management Strategies (reuse-first mandate)
3. EH&S Management System aligned with ISO or RIOS standards
4. Legal and Other Requirements
5. Tracking Throughout
6. Sorting, Categorizing and Processing via the R2 Equipment Categorization system
7. Data Security
8. Focus Materials management
9. Facility Requirements
10. Transport

Beyond these universal Core Requirements, R2v3 uses a modular structure for specialized processes. Process Requirement Appendices A through G apply only to facilities performing the relevant activities. Each appendix adds requirements specific to that operation.

• Appendix A: Downstream Recycling Chain, covering verification of all downstream vendors and tracking to final disposition
• Appendix B: Data Sanitization, covering logical wiping with device-level traceability, video surveillance and effectiveness verification
• Appendix C: Test and Repair, requiring a Quality Management System such as ISO 9001 or RIOS
• Appendix D: Specialty Electronics Reuse, applying to medical, telecom and lab equipment and requiring Appendix C certification
• Appendix E: Materials Recovery, adding risk assessment and pollution-liability insurance for dismantling operations
• Appendix F: Brokering, requiring a Quality Management System plus full downstream-chain verification under Appendix A
• Appendix G: Photovoltaic Modules, covering PV-specific handling, testing and reuse or recovery requirements added in R2v3.1

A facility’s certificate explicitly names the audited Core Requirements and applicable appendices. Buyers need to read the full certificate scope, not just the R2v3 logo, to confirm a provider’s actual capabilities.

How R2v3 Strengthens Downstream Accountability

R2v3 sets tighter expectations around accountability, risk management and downstream oversight than any prior version of the standard. Certified facilities maintain a documented vendor qualification and approval process, conduct risk-based due diligence for environmental, data security and regulatory risks and monitor downstream vendors on a defined schedule instead of treating compliance as a one-time exercise.

Under R2v3 Clause 6.6, facilities are accountable for downstream failures they reasonably could have detected. This change represents a meaningful shift from R2v2’s more limited accountability window. Written agreements with all downstream vendors must cover legal compliance, environmental performance and data security. Material flow must be documented as a flowchart to final disposition. The standard applies different levels of downstream control depending on material risk.

R2v3 introduces a tiered focus materials classification to support this risk-based approach. Category 1 materials (CRTs, batteries, mercury-containing devices) carry the strictest downstream controls, Category 2 (circuit boards, hard drives) requires chain-of-custody documentation, and Category 3 (plastics, metals, glass) uses standard recycling documentation.

R2v3 Data Security Requirements in Practice

Core Requirement 7 applies to every R2v3-certified facility and requires that all data-bearing devices are secured upon arrival and sanitized via physical destruction aligned with NIST SP 800-88. Core 7 alone does not cover logical, software-based wiping.

Appendix B is required for any facility performing logical data sanitization. It adds device-level traceability through unique identifiers, stronger verification controls, competency requirements for technicians and video surveillance with a minimum retention period for areas where data devices are received, stored or processed. Facilities performing only physical destruction under Core 7 may not require Appendix B. Buyers that need auditable logical sanitization records must confirm Appendix B is within scope.

R2v3 data security requirements are now substantially equivalent to e-Stewards. The standard mandates a comprehensive sanitization program with documented procedures, per-device verification and chain-of-custody tracking from intake through final disposition.

Full Circle Electronics maintains the certifications noted above across facilities in the United States, Mexico and Colombia. Contact us to discuss certified data destruction requirements for a specific project or program.

Step-by-Step R2v3 Certification Verification

The authoritative source for verification is SERI’s public “Find an R2 Certified Facility” directory, which lists current certification status, suspension or withdrawal notices, scope and covered facility locations. The checklist below outlines a connected sequence of verification steps.

• Search the SERI directory by exact company name and confirm the specific facility address matches where equipment will be processed. This step confirms that the facility claiming certification appears in the official registry.
• After locating the facility, match the certificate number in the SERI directory. If the number does not appear, the certificate is not valid or has lapsed. This prevents reliance on expired or fabricated certificates.
• Confirm the certificate references R2v3, not the prior R2:2013 standard. This ensures alignment with the current version of the standard.
• Check the certificate expiration date. An expired certification does not count as valid, even if the logo still appears on marketing materials.
• Read the full certificate scope to identify which appendices are listed, particularly Appendix B for logical data sanitization and Appendix A for downstream chain management. This confirms that the certification covers the required services.
• Request individual certificates for every facility location that will process assets, since R2v3 certification applies per facility, not per company. This step closes gaps created by uncertified satellite locations.
• Ask whether the certification has ever been suspended or limited and request the most recent surveillance audit date. This provides insight into the provider’s compliance history.
• Request the downstream vendor list and confirm all R2 Controlled Streams are tracked to final disposition. This verifies that downstream accountability requirements are in place.
• Ask for device-level serialized destruction or sanitization records and certificates of destruction. These records support internal audits and regulatory reviews.
• Hesitation or refusal to provide documentation suggests certification claims may not withstand scrutiny. This final check helps filter out providers that cannot support their claims.

How R2v3 Aligns With Other Standards

Companies must already hold ISO 9001, ISO 14001 and ISO 45001 certifications to become R2v3 certified. Because R2v3 requires these ISO credentials, a valid R2v3 certificate provides layered assurance across quality, environmental and occupational health and safety management systems.

NAID AAA certification, administered by the International Secure Information Governance & Management Association (i-SIGMA), addresses secure destruction of information assets and complements R2v3 Appendix B data sanitization requirements. Together, the two certifications provide layered, independently audited assurance for data-bearing devices.

For defense and aerospace clients, ITAR-controlled hardware requires specialized, restricted-destruction workflows that operate alongside R2v3 processes. SERI’s published R2v3 materials reference NIST SP 800-88 Revision 1 for physical destruction methods, which provides a recognized technical baseline for regulated industries. Providers holding e-Stewards certification alongside R2v3 add assurance on export controls and environmental standards, especially for organizations with global supply chains.

Why R2v3 Matters for IT, Security, Compliance and ESG Teams

A 2022 SERI survey found that over 73% of corporate sustainability managers listed R2 certification as a required or strongly preferred criterion when selecting ITAD and recycling vendors. R2v3 certification now functions as a market entry requirement for vendors serving enterprise clients with ESG reporting obligations.

For CISOs and compliance officers, R2v3 provides auditable chain-of-custody documentation from intake through final disposition, which supports HIPAA, PCI-DSS, GDPR and CCPA compliance obligations. For ESG and sustainability stakeholders, R2v3 facilities supply an audit trail and documentation proving hardware was handled according to the highest environmental standards. This documentation enables concrete data for Scope 3 Category 12 end-of-life reporting.

R2v3’s reuse-first hierarchy directly supports circular-economy outcomes. Core Requirement 2 requires facilities to evaluate devices, parts and components for reuse before materials recovery or disposal. Providers with multi-country facilities, such as Full Circle Electronics with certified operations across the United States, Mexico and Colombia, can execute reuse-first programs at scale while maintaining consistent reporting across international borders.

Conclusion: Practical Framework for Evaluating R2v3 Vendors

Selecting an R2v3-certified ITAD provider requires more than confirming a logo on a website. The evaluation framework below summarizes the critical steps in a logical sequence.

1. Verify active certification in the SERI directory, matching facility address, certificate number and expiration date. This confirms that the certification is current and correctly assigned.
2. Confirm the certificate scope includes the appendices relevant to the services required, particularly Appendix B for logical data sanitization and Appendix A for downstream chain accountability. This ensures the provider is certified for the needed processes.
3. Request per-facility certificates for every location that will process assets. This step confirms that all operating sites meet the standard.
4. Confirm alignment with NIST 800-88 and request device-level sanitization records and certificates of destruction. These records support internal governance and regulatory audits.
5. Review the downstream vendor list and chain-of-custody documentation to final disposition. This validates downstream accountability and focus materials management.
6. Assess whether the provider holds complementary certifications such as NAID AAA, e-Stewards and ISO 9001/14001/45001 that provide independent, layered assurance. This broad view strengthens risk management.
7. Evaluate whether the provider’s facility footprint matches the organization’s geographic decommissioning needs. This final step connects certification strength with practical program coverage.

As outlined throughout this article, Full Circle Electronics holds the full suite of relevant certifications across its network of facilities in the United States, Mexico and Colombia. With more than 20 years of experience, white-glove decommissioning services, NIST 800-88 and DoD-compliant data destruction and a real-time client portal for audit-ready documentation, Full Circle Electronics supports IT, security, compliance and ESG requirements across multi-site and multi-country programs. Contact us to begin a vendor qualification review or request a quote.

Frequently Asked Questions

Does R2v3 certification cover all facilities operated by an ITAD company?

R2v3 certification applies to individual facilities, not to a company as a whole. Each processing location must hold its own independent certification, audited against the Core Requirements and any applicable appendices for the activities performed at that site. Organizations should request separate certificates for every facility that will handle their assets and verify each one in the SERI directory. A company may hold R2v3 at its primary facility while operating uncertified satellite locations, so facility-level verification remains essential.

What is the difference between R2v3 Core Requirement 7 and Appendix B for data security?

Core Requirement 7 applies to every R2v3-certified facility and requires that all data-bearing devices are secured upon arrival and sanitized via physical destruction aligned with NIST SP 800-88. It does not cover logical, software-based wiping. Appendix B is a modular process requirement that applies only to facilities performing logical data sanitization. It adds device-level traceability through unique identifiers, stronger verification controls, technician competency requirements and video surveillance with defined retention periods. Organizations that require auditable software wiping records must confirm that a provider holds Appendix B certification in addition to the core standard.

How does Full Circle Electronics support multi-site and international ITAD programs under R2v3?

Full Circle Electronics operates certified facilities across multiple U.S. states as well as in Mexico and Colombia, which allows service for organizations with international footprints under a single accountable provider. Standardized workflows, coordinated logistics and centralized reporting through a secure real-time portal support consistent chain-of-custody documentation and audit-ready records across all locations. This structure supports compliance with HIPAA, PCI-DSS, ITAR and other regulatory frameworks that apply across different jurisdictions, while maintaining the reuse-first processing model required by R2v3 Core Requirement 2.

What certifications should an ITAD provider hold alongside R2v3 for regulated industries?

R2v3 certification already requires concurrent ISO 9001, ISO 14001 and ISO 45001 certification. For organizations in healthcare, financial services, defense and government, additional certifications provide meaningful layered assurance. NAID AAA certification independently audits secure destruction of information assets and complements R2v3 Appendix B. e-Stewards certification adds further assurance on export controls and environmental standards. For ITAR-controlled hardware, providers must demonstrate specialized restricted-destruction workflows with background-checked personnel. Full Circle Electronics holds these certifications, which supports compliance across healthcare, financial services, government and defense sectors.

How often is an R2v3 certificate audited and renewed?

R2v3 certificates are valid for three years and require annual surveillance audits in years one and two to maintain active status. A full recertification audit occurs at the end of the three-year cycle. SERI also performs additional oversight, including audit-package reviews and unannounced spot inspections of certified facilities. Buyers should confirm the date of the most recent surveillance audit when verifying a provider’s certification, since a certificate that has not undergone its required annual audit may face suspension risk even if it has not yet expired.