Cotton Sourcing Explained: Fibre Origin, Organic Claims and Traceability

In 2020 about 20,000 tonnes of Indian cotton was sold as organic, and it wasn't. The paperwork looked perfect. The fraudsters had built transaction certificates on India's own government template and printed a QR code on each one, and the QR code opened a cloned copy of the APEDA website that happily confirmed the certificate was real (GOTS, 30 October 2020 (opens in a new tab)). Every buyer who scanned the code did the right thing, and every one of them was fooled.

We'll carry that story through this guide, because it holds most of what you need to know about cotton today. Where your fibre grew now decides whether goods clear the US border and, from December 2027, whether they can be sold in the EU. The organic labels prove less than buyers think, and the proof sits two or three companies upstream of the factory you meet. One honest caveat - we can show you how the chain works and what to ask for, but nobody can hand you a guarantee on paper, and anyone who offers one is selling something.

Last researched 28 September 2026 · Next review 15 December 2026 · Written by SourcingFrom

1. One Garment, Three Birthplaces

A cotton T-shirt has more than one origin. The cotton was grown and ginned somewhere, spun into yarn somewhere, knitted and dyed somewhere, then cut and sewn somewhere. Your care label shows one country, usually the last.

Customs origin for duty mostly follows where the garment was made, and trade agreements add their own tests on yarn and fabric (those live on proof of origin). Forced-labour laws ignore all of that and look straight through to the fibre. The US presumption covers goods made "wholly or in part" in Xinjiang (CBP (opens in a new tab)), so a T-shirt sewn in Tiruppur from yarn that holds Xinjiang cotton is caught, whatever the label says.

Here's why that matters for India in particular. India is the world's second cotton producer, but the more useful number sits in the same USDA outlook - Indian mills use 25.5 million bales against a crop of 23.8 million, and imports rose 38% to 4.2 million bales (USDA ERS, April 2026 (opens in a new tab)). So "Indian yarn" does not mean "Indian cotton". Mills buy fibre where price and quality suit them, which is normal trade, but it means the garment maker you talk to may genuinely not know which country's bales went into its yarn.

Importers have started to notice. A UK importer warned others in 2026 that "SOME manufacturers input Chinese cotton" (buyers on r/smallbusinessuk, 2026 (opens in a new tab)). That isn't an accusation against Indian makers. It's a question nobody used to ask, and it's the same question that would have caught the 2020 fraud at the gin.

2. Why Fibre Origin Now Decides Whether Goods Clear

In the United States, the Uyghur Forced Labor Prevention Act presumes that goods made wholly or in part in Xinjiang, or by a company on the UFLPA Entity List, were made with forced labour. To get them released you must show "by clear and convincing evidence" that they weren't (CBP (opens in a new tab)). Apparel, cotton and cotton products are named high-priority sectors, and DHS says CBP had examined more than 16,700 shipments since June 2022 and denied more than 10,000 of them (DHS strategy update, 2025 (opens in a new tab)). We found no India-located companies on the entity list as updated on 31 July 2026. For Indian goods the risk is the input, not the factory.

If CBP detains a shipment you get 30 days to respond, and that's far too short to start building a file from scratch. The file CBP describes for cotton is demanding. It asks for records "from the origin of the cotton at the bale level to the final production of the finished product", a numbered flow chart, maps of where each step happens, and the name of every company in the chain, including the ones you never dealt with (CBP operational guidance, June 2026 (opens in a new tab)). Most suppliers expect a lot less than that.

The EU is next. The Forced Labour Regulation, Regulation (EU) 2024/3015, applies from 14 December 2027, and from then "no product made with forced labour may be sold in or exported from the EU market" (European Commission (opens in a new tab)). The Commission opened a portal on 30 June 2026 with guidelines and a risk database. A range you order in late 2027 sells under it, so the chain map you build for the US is the one you'll want for Europe too.

The UK and Australia have no import ban, but both make larger businesses report. In the UK a business supplying goods with a turnover of £36 million or more publishes a modern slavery statement every year (GOV.UK (opens in a new tab)). In Australia the Modern Slavery Act 2018 applies at AUD 100 million consolidated revenue (as law firms report it, because the government page (opens in a new tab) timed out on our read). And if you sell to a big retailer then its due diligence becomes yours, whatever your own size. We found no forced-labour import rule in New Zealand or the UAE.

India has moved as well. It adopted its own ban on imports made with forced labour in mid-2026, which is why the US tariff under the Section 301 forced-labour action sits at 10% for India and not 12.5% (the rate and the notice are on India to the US).

3. What "Organic" Proves, and Where It Breaks

Organic cotton carries two layers of certification, and buyers mix them up all the time.

The farm layer certifies that the fibre was grown organically. In India that's the National Programme for Organic Production (NPOP), run by APEDA, which also runs a traceability system called TraceNet (APEDA NPOP (opens in a new tab)). India's share of this world is huge. Of roughly 706,000 tonnes of certified organic cotton grown in 2023/24, about 437,000 tonnes was certified under India's regulation, which is about 62% by our arithmetic (Textile Exchange Materials Market Report 2025 (opens in a new tab)). The US doesn't accept NPOP though. USDA ended its recognition of APEDA on 11 January 2021, so an Indian operation selling USDA organic must be certified directly by a USDA-accredited certifier, and organic imports from India need an electronic NOP Import Certificate (USDA AMS (opens in a new tab)). If your market is the US then an NPOP certificate alone won't get you the word "organic".

The processing layer then follows the fibre through the gin, the spinner, the knitter, the dye house and the garment unit. GOTS is the main standard, and India holds 27.8% of the world's 17,800 GOTS-certified facilities, more than any other country (GOTS Annual Report 2025 (opens in a new tab)). What each label grade means, and how GOTS compares with OCS and the rest, is on what textile certifications actually prove. We won't repeat it here.

Now back to 2020. The fraud didn't happen at the garment factory. It happened at the very front of the chain, and the public record still shows it there. On the GOTS ban list updated 5 June 2026, 40 of the 52 banned companies have Indian addresses, and nearly all are gins, cotton traders, fibre firms or spinners. The most common reason given is fake or forged input certificates for raw cotton, followed by certificates claimed for more cotton than a gin could physically process (GOTS certification bans (opens in a new tab), our count). A garment unit with a spotless GOTS certificate can still receive yarn made from fibre that was never organic, which is why one company's certificate tells you so little.

To be fair to Indian suppliers, most of the world's organic cotton is Indian, so most of the fraud is too. That's where the volume is. GOTS tightened the front end after 2020. Farmer groups must now register in a farm-gin registry that is "currently implemented in India", raw cotton may travel no more than 500 km from farm to certified gin, seed cotton is tested for GMO, and the gin's first certificate must name the farm's certificate and the state of origin (Global Standards integrity page (opens in a new tab)). If a mill tells you its organic fibre came from a gin 1,200 km away then you've learned something useful.

4. The Four Tools That Actually Trace Cotton

None of these works alone, and anyone who sells you one of them as the whole answer is overselling.

Transaction certificates come first. A scope certificate says a site is certified, and a transaction certificate says your specific shipment is. Under GOTS each one lists the certified raw material with its country and, where required, its state (GOTS TC procedure v4.0 (opens in a new tab), Box 11). That box is the closest thing to a fibre passport you'll get on paper. And here is the lesson from 2020 - check a certificate by typing the address of the scheme's own database yourself, never by scanning a code or clicking a link the supplier sent. The fraudsters' QR codes worked perfectly. They just pointed somewhere else.

Physical chains beat credits. Some programmes let a mill sell sustainable cotton "credits" that don't follow the fibre. The Better Cotton Initiative says it plainly about its mass balance model, where the units "do not have to stay connected to the original BCI Cotton", so "the cotton is not traceable to its country of origin" (BCI (opens in a new tab)). Its separate Physical BCI Cotton, launched at the end of 2023, is traced to country. Credits support farmers, which is fine, but they won't answer CBP. Ask which one you're being sold.

Isotope testing checks the paper against the fibre. Cotton takes on a chemical fingerprint from "the environmental conditions experienced by the plant during growth, not the seed's origin", and a lab compares your sample with reference samples to say whether it's consistent with the claimed origin. CBP encourages it, notes it's slow and doesn't suit every product, and "does not endorse any particular testing facility" (CBP guidance (opens in a new tab), Appendix D). A matching result is good evidence, but it doesn't name a single company, and CBP's list asks for names. Use it as a spot check, never as the chain.

Arithmetic is the fourth tool, and it's free. Kilograms of yarn bought, fabric knitted, garments shipped. They won't match exactly, because cutting wastes fabric, but they shouldn't be wildly off. Certifiers call it volume reconciliation, and inflated volumes are exactly how the banned gins were caught.

5. How to Ask an Indian Maker to Prove Fibre Origin

Most Indian garment makers have never been asked for bale-level origin, and that's not evasion. Many buy yarn through a dealer and have no reason to know the gin. So ask early, in writing, as part of the order. Here's the sequence we'd use -

1. Put it in the RFQ and the PO. State the fibre origin you need for each fabric, and for organic the certificate and label grade. A requirement added after the price is agreed is a renegotiation.
2. Ask for the chain map. The name and address of the gin, the spinning mill, the knitter, the dyer and the garment unit, marked in-house or job work. Job work is how much of Indian textiles runs, and it's normal. Within GOTS a certified company's subcontractors don't even need their own transaction certificates (GOTS TC procedure 2.7.2).
3. Ask for one document per link. The yarn invoice naming the mill, count and lot. The mill's cotton purchase record, and if the fibre was imported, the bill of entry showing the country. For organic, the transaction certificate for each stage and, at the gin, the farm certificate number and state.
4. Check it yourself, from the source. Look every certificate up in the scheme's own database, reached by typing its address. For NPOP that's APEDA's TraceNet e-verification on npop.apeda.gov.in (opens in a new tab).
5. Do the kilogram sum, and keep it per shipment, in English. CBP expects English translations, and the file belongs with the shipment, not in a supplier folder.
6. Test where the risk is highest. For US-bound cotton lines, an isotope test on a sample drawn from bulk.

What if the maker can't get past its yarn dealer? Then you have a choice. Nominate the spinning mill yourself and accept what that does to the price, or keep that product away from the markets that need the file. Mapping a chain back to the gin means visits and document chasing at five or six companies, and if you'd rather not do that yourself then SourcingSync (opens in a new tab) can map it on the ground. How to check the supplier as a business, before any of this, is on how to verify Indian suppliers.

Current Rules, as of 28 Sep 2026

We update this box in place. The method above doesn't change when the rules do.

FAQ

The Short Version

The buyers who got caught in 2020 didn't skip the check. They ran it through a link the fraudster controlled. That's the whole lesson of cotton traceability in one line - ask for every company in the chain, get a document for every link, and check each one at the source yourself. It is unglamorous work, and it's a lot of paper for a simple tee until you compare it with 30 days to answer a detention notice.

For the product itself, start with cotton T-shirts from India, and read the border rules for your market on the US, EU, UK and Australia pages. Hope this helps.