What goes into a supplier code of conduct, and how to check one

What a supplier code of conduct actually is

A supplier code of conduct is a document a company gives to the businesses and freelancers it pays, setting the minimum standards those suppliers must meet on labour, safety, environmental impact and business ethics. It exists because a company's own sustainability claims are only as solid as the practices of the people it buys from.

Two readers land on this page. One works in procurement or compliance at a company running due diligence on Ripe Leads as a potential supplier, and wants to know whether a supplier code exists, what it actually says, and how honestly its limits are stated. The other runs a small company that has just been asked for a supplier code of conduct by a customer, a bank or a tender, and has never written one.

Ripe Leads, the trading name of UAB "Kofi Tech", publishes its own version as TTP-1, the Supplier and Partner Sustainability Policy, one of thirteen governance documents on its sustainability page. This page explains what a document like TTP-1 covers, what the law actually requires of a company our size, and what TTP-1 itself commits to, clause by clause.

Who has to have one, and why a small supplier gets asked anyway

No EU law requires a small company to publish a supplier code of conduct. The obligation that pushes these documents down supply chains sits with much larger companies. The Corporate Sustainability Due Diligence Directive, after the Omnibus I amendments adopted as Directive (EU) 2026/470, now applies only to companies with more than 5,000 employees and more than EUR 1.5 billion in worldwide turnover, or third-country companies generating that much turnover inside the EU. That is a large narrowing from the directive's original 2024 text, which also covered companies with 1,000 or more employees and turnover above EUR 450 million; a future Commission review may bring that lower tier back in, but it is not the current law.

A company that size has to run due diligence across its own operations and its business partners' chain of activities, upstream and downstream, and that duty does not stop at the edge of its own payroll. A small supplier can still be asked for a signed code of conduct, human rights and environmental data, or a right to audit, because the large company's due diligence obligation runs through everyone it buys from, regardless of how small that supplier is.

Omnibus I put a limit on how far that request can go. Directive (EU) 2026/470 creates a value chain cap: a company with fewer than 1,000 employees, a "protected undertaking" in the directive's own term, has a statutory right to refuse to hand over value chain information beyond what the voluntary VSME reporting standard specifies, and the large company asking has to tell them about that right. It caps the practice; it does not remove it, since a large customer can still ask up to that cap, or beyond it if the supplier agrees.

Outside the EU, the UK's Modern Slavery Act adds a separate route: any commercial organisation with GBP 36 million or more in turnover that does business in the UK has to publish an annual statement on the steps it takes against slavery and trafficking in its own business and its supply chains, and that duty reaches non-UK companies with any UK business.

What belongs inside a supplier code of conduct

Nothing in EU or Lithuanian law dictates the contents of a supplier code of conduct, so what goes into one is a matter of practice rather than statute. In practice, a supplier code of conduct usually covers five things: labour standards, no forced or child labour, freedom of association, defined working hours and wages; environmental compliance; anti-corruption commitments; health and safety; and a subcontracting-disclosure clause requiring the supplier to pass the same standards down to its own subcontractors.

A serious code also states how a supplier is chosen in the first place, not only what it must do once contracted: whether price is the only factor, whether the buyer checks public registers for debt or legal proceedings before signing, and whether a supplier's own environmental or labour record enters the decision at all.

The strongest codes attach consequences to a breach: a stated right to end the contract, a deadline to fix a gap before that happens, and a record of the check kept somewhere the company can produce later. A code with no consequence clause is a statement of intent, not a contract term.

Reading someone else's supplier code of conduct

When checking a supplier's own code of conduct, look past the headline commitments to the mechanics behind them. Does the document name specific selection criteria, or only general language about "responsible sourcing"? Does it say what happens when a supplier fails to meet a standard: a deadline to fix it, a termination right, or nothing at all?

Check whether the code is a one-off signature at contract stage or an ongoing check. A code reviewed once and never revisited tells a buyer less than one with a stated annual review against its own criteria, logged in a register the company keeps.

Check the training claim, if there is one. A code that requires suppliers to know the rules but never trains anyone on them is weaker than one that ties training to onboarding and repeats it on a schedule.

Finally, check how the document describes itself. A supplier code that calls itself audited, certified or verified should say by whom, and against what standard. A self-authored document is not a weaker one for saying so, but it is a different kind of document, and a reader should be able to tell the difference at a glance.

What TTP-1, our own supplier and partner policy, commits to

TTP-1 applies to "every supplier and freelance partner the Company contracts with" (clause 1.2). Its selection criteria, set out in clauses 2.1 to 2.7, run beyond price and quality fit: the Company checks public registers for debts and legal proceedings before contracting (2.3), requires no labour law or safety breaches (2.4), and no child labour or forced labour, cross-referenced to our own ŽTP-1 human rights policy (2.5). Environmental impact factors into the decision too: preference for used or refurbished equipment and recycled or certified paper under our TAV-1 waste policy (2.6), and any supplier that processes data on our behalf has to meet the data-protection standard set in section 8 of IAP-1, our information and data protection policy (2.7).

Once a partner is contracted, TTP-1 requires the contract itself to carry an undertaking to comply with sections 3 and 4 of our ESG statement, ESG-1 (3.1), to state the fee, payment term and liability (3.2), and, where the partner processes data, to sign Article 28 GDPR terms (3.3). The contract gives the Company a termination right if the partner breaches the labour or safety clause 2.4 or the forced or child labour clause 2.5 (3.4).

Freelance partners complete two training modules from our EIP-1 educational programme within their first 30 days, M1 and M3, the latter covering responsible selling, GDPR requirements for collecting contacts, and honest claims (4.1, 4.2), followed by a quarterly refresher session (4.3).

On payment, TTP-1 commits the Company to paying supplier and partner invoices within 10 days (6.1), and states plainly that it "does not extend a payment term unilaterally" (6.2).

Keeping a supplier code current

TTP-1 requires the director to review the active supplier and partner list annually against the section 2 criteria (5.1). Where a gap turns up, the policy sets a deadline to close it; if it stays open, the contract ends (5.2), and the outcome of each check is logged in a supplier register (5.3). Policy changes go through the same route as every other document in this set: the director reviews it annually and approves any change by order (7.2).

TTP-1 was approved by director's order effective 22 September 2026, alongside the other twelve documents in this set, and is published in full at its own anchor on the sustainability page, mirrored at kofitech.eu/tvarumas.

What this document does not prove

TTP-1 is self-authored and approved internally by UAB "Kofi Tech". It has not been audited, certified or verified by any third party, and Ripe Leads makes no label, badge or score claim about it. From 27 September 2026, the Empowering Consumers Directive, (EU) 2024/825, bans a self-awarded sustainability label outright, one more reason this page carries no badge.

The policy describes a process, not a completed audit trail. It does not name an actual current supplier list or the results of any specific compliance check; those records sit in the internal supplier register the policy establishes, not in the published text. A buyer evaluating Ripe Leads on this document should read it as a statement of what the Company commits to do, and ask, in the same way this page recommends for any supplier's code, what evidence sits behind that commitment.