Geopolitical Supply Chain Risk Doesn't Stop at Tier One

TL;DR: The suppliers most likely to break a company's supply chain are rarely the ones it has a contract with. Tier 1 visibility is improving across industry, but visibility into Tier 2 and beyond is getting worse, even as regulators pull back from requiring companies to look that far upstream.

Key takeaways:

• 60 percent of supply chain leaders reported comprehensive Tier 1 visibility in 2024, up for a second straight year, while deeper-tier visibility fell for a second straight year in the same survey.
• Honda cut 110,000 vehicles from its North America shipment forecast for the year ending March 2026 after a chip supplier three tiers removed from its contracts was pulled into a US export control action.
• A US rule effective 29 September 2025 automatically extends Entity List restrictions to any firm more than 50 percent owned by a listed company, which is how an unlisted Dutch chipmaker ended up under Chinese export controls within days.
• Only 17.1 percent of companies analyze critical suppliers down to Tier 4, up from 3.7 percent a year earlier, meaning deep-tier mapping is growing but still rare.
• The EU's February 2026 Omnibus reform cut the number of companies covered by supply chain due-diligence law by roughly 70 percent and made requests for deeper-tier supplier data a last resort, not a routine step.

Honda's chip supplier problem in the winter of 2025 did not start with a company Honda had ever signed a contract with. It started with a US rule that reaches through ownership structures, a Dutch subsidiary Honda's engineers had never chosen, and a production stoppage neither its Tier 1 relationships nor its risk register saw coming.

The Visibility Gap Below Tier One

Supply chain teams have spent the last two years getting better at the part of the map they already had, and worse at the part they did not.

• Tier 1 visibility is improving. McKinsey's 2024 Global Supply Chain Leader Survey found 60 percent of respondents reporting comprehensive visibility into Tier 1 suppliers, a figure that has now risen for two consecutive years.[^1]
• Visibility past Tier 1 is moving the other way. The same survey found the share of companies reporting good visibility into deeper tiers fell for a second consecutive year, even as Tier 1 visibility climbed.[^1]
• Deep-tier mapping exists, but from a very low base. A 2024 Business Continuity Institute report found 17.1 percent of respondents now analyze critical suppliers down to Tier 4 and beyond, up from 3.7 percent the year before, a real increase that still leaves most companies without it.[^2]
• Where mapping exists, it often is not current. A March 2025 BCI and Zurich survey of 240 supply chain leaders across Europe and the US found only 35 percent had detailed, up-to-date data further up and down their supply chain.[^3]

None of this is a company failing to try. It is optimizing the part of the chain it can see, while the part it cannot see accumulates risk quietly.

Concentration Risk Three Tiers Removed: The Nexperia Case

The mechanism that hit Honda is worth walking through, because it is the clearest current example of geoeconomic exposure traveling through ownership structures rather than direct contracts.

Nexperia, a Dutch chipmaker, supplies roughly 40 percent of the world's basic and discrete automotive semiconductors, the unglamorous chips that run window motors, airbags, and fuel pumps.[^4] Nexperia is owned by Wingtech Technology, a Chinese company the US Commerce Department added to its Entity List in December 2024.[^5] Nexperia itself was never listed. It did not need to be. On 29 September 2025, the Commerce Department's Bureau of Industry and Security adopted a new rule, modeled on a similar US Treasury ownership rule, that automatically extends Entity List restrictions to any company more than 50 percent owned by a listed firm.[^5] Nexperia crossed that line the moment it took effect.

The Dutch government seized control of Nexperia in mid-October 2025 under a Cold War-era statute, and China's Ministry of Commerce answered with its own export ban on Nexperia's Chinese-subcontracted chip output on 4 October 2025.[^6] Automakers with no direct relationship to Wingtech, including Volkswagen, BMW, Toyota, and Honda, found chip supply cut off through a subsidiary two or three tiers removed from any contract they held. Honda cut its North America shipment forecast by 110,000 vehicles for the fiscal year ending March 2026 and halted plants in China and Japan representing a meaningful share of its global output.[^7]

What the record shows: an ownership rule change at one regulator, applied to one unlisted subsidiary, disrupted production at six global automakers within weeks. What we infer: concentration risk in modern supply chains increasingly sits in ownership structures rather than in the direct supplier relationships companies actually track. What we recommend: mapping who owns a critical supplier, not just what that supplier makes, has become as important as mapping the supplier itself.

A Method for Mapping What You Cannot Fully See

The uncomfortable part of this problem: regulation is moving opposite the operational case. The EU's Corporate Sustainability Due Diligence Directive, as revised under the Omnibus I reform adopted 24 February 2026, raised the company-size thresholds it covers by roughly 70 percent and narrowed the due-diligence scope to primarily direct, Tier 1 business partners, turning deeper-tier information requests into a last resort rather than a standard step.¹ Germany's own Supply Chain Due Diligence Act has not been repealed, but its supervisory authority suspended review of company reports in October 2025 and now pursues only the most serious violations.² A company that wanted a regulatory mandate to justify deep-tier mapping work has less of one in 2026, even as Nexperia shows exactly why that work matters.

US enforcement is moving the other direction. Customs and Border Protection detained shipments worth close to $4 billion cumulatively under the Uyghur Forced Labor Prevention Act since 2022, and on 31 July 2026 added 43 new entities to the law's Entity List in the largest single expansion since enactment.³ Electronics and automotive parts are the two largest categories by detained cargo value, the same sectors the Nexperia case ran through.⁴ A company selling into the US now faces real forced-labor enforcement risk several tiers upstream, while the EU is telling the same company it no longer needs to ask.

Full sub-tier visibility is not a realistic goal for most companies, and claiming otherwise misrepresents what the data can support. A more workable method starts narrower: identify the handful of components where a single supplier or country holds the overwhelming majority of global capacity, trace ownership two tiers up on those specific relationships, and recheck that picture on a schedule, since it was a rule change, not a supplier change, that caught Honda. Resilinc has begun building tools aimed at this narrower problem, combining Tier 1 data with trade signals to flag sub-tier ownership shifts as they happen.⁵

The companies hurt by Nexperia were not careless about suppliers. They were careful about the wrong layer. A Tier 1 contract tells a company who makes its parts. It does not tell the company who could be forced to stop, and geopolitical risk increasingly runs through that second question.

Fortius Intel note: Sub-tier mapping will never be complete, and treating incompleteness as a reason not to start is the more expensive mistake. The companies that mapped even their five most concentrated supplier relationships two tiers up would have seen the Nexperia exposure coming. The rest found out from a production line.

This analysis draws on McKinsey and Business Continuity Institute supply chain visibility survey data, US Bureau of Industry and Security and Commerce Department actions as reported by Davis Polk and Z2Data, Honda's own financial disclosures as reported by WardsAuto and Automotive World, and EU and German due-diligence law status as reported by Clifford Chance and KPMG Law, cross-checked across at least two independent sources for the Nexperia ownership mechanism and the Honda production impact figures.

---

Footnotes

Footnotes

1. Clifford Chance, "Omnibus I: The European Union Concludes CSDDD and CSRD Reforms," February 2026. https://www.cliffordchance.com/insights/resources/blogs/business-and-human-rights-insights/2026/02/omnibus-i-the-european-union-concludes-csddd-and-csrd-reforms.html. Retrieved 24 August 2026. Source for: the 24 February 2026 adoption date, the roughly 70 percent reduction in covered companies, and the narrowing of due-diligence scope to primarily Tier 1 relationships. ↩

2. KPMG Law, "Supply Chain Act: Reporting Obligation No Longer Applies, Sanctions Reduced," 2026. https://kpmg-law.de/en/supply-chain-act-reporting-obligation-no-longer-applies-sanctions-reduced/. Retrieved 24 August 2026. Source for: BAFA's October 2025 suspension of routine review of German Supply Chain Due Diligence Act reports and the law's continued formal existence. ↩

3. Covington & Burling, "DHS Expands UFLPA Entity List Amid Intensifying Enforcement Landscape," August 2026. https://www.cov.com/en/news-and-insights/insights/2026/08/dhs-expands-uflpa-entity-list-amid-intensifying-enforcement-landscape. Retrieved 24 August 2026. Source for: the cumulative near-$4 billion value of shipments detained under the Uyghur Forced Labor Prevention Act since 2022 and the 43-entity Entity List expansion on 31 July 2026. ↩

4. Holland & Knight, "New Compliance Tools: CBP Issues Comprehensive Forced Labor Guidance," July 2026, citing US Customs and Border Protection enforcement data. https://www.hklaw.com/en/insights/publications/2026/07/new-compliance-tools-cbp-issues-comprehensive-forced-labor-guidance. Retrieved 24 August 2026. Source for: electronics and automotive/aerospace as the largest categories by detained cargo value under UFLPA enforcement in the FY2025 to FY2026 reporting window. ↩

5. Resilinc, "Resilinc Advances Its Agentic Supply Chain Intelligence Platform," 18 March 2026. https://www.globenewswire.com/news-release/2026/03/18/3258242/0/en/resilinc-advances-its-agentic-supply-chain-intelligence-platform-adding-enterprise-interoperability-and-strengthening-its-data-foundation.html. Retrieved 24 August 2026. Source for: sub-tier supplier mapping technology combining Tier 1 relationship data with trade signals and public sources. ↩