A purchasing or sustainability team that needs to know whether a supplier has been cited for hazardous-waste violations in the last five years does not need to file a records request. Resource Conservation and Recovery Act (RCRA) enforcement data is public, structured, and queryable by facility name, address, or EPA Identification Number. The workflow below pulls a supplier's most recent RCRA citations, benchmarks the penalty exposure, and cross-references state records — usually in under fifteen minutes per facility.
Step 1: Pull the Detailed Facility Report from ECHO
EPA's Enforcement and Compliance History Online (ECHO) publishes a Detailed Facility Report (DFR) for every regulated facility. Search by name, street address, or EPAID; the EPAID is the unambiguous key when a corporate parent operates multiple sites with similar names (EPA ECHO · 2026). Facilities with no relevant data return an explanatory note rather than a blank, so an empty result is informative — it usually means the supplier sits below RCRA thresholds, not that ECHO is broken (EPA ECHO · 2026).
The DFR is divided into six primary sections. Under "Enforcement and Compliance Summary" sits the Hazardous Waste Compliance Status (RCRA) block, which lists enforcement actions, monthly and quarterly compliance history, and both informal and formal enforcement actions (EPA ECHO · 2026). Parallel blocks cover the Clean Air Act, Clean Water Act/NPDES, and Safe Drinking Water Act — useful because RCRA inspections rarely stay siloed.
Step 2: Set the window — what "last five years" actually means
ECHO defines its five-year window as the twenty most recently completed quarters plus data from the current quarter up to the last refresh (EPA ECHO · 2026). The three-year window uses twelve completed quarters plus the current quarter (EPA ECHO · 2026). Two consequences matter for due diligence. First, a request for "the last five RCRA violations" almost always falls inside this twenty-quarter window for an active site; if the DFR shows fewer than five, the supplier's enforcement history is genuinely sparse, not truncated. Second, data freshness varies by source database. ECHO's "About the Data" section lists each source's last update; the "Known Data Problems" page documents completeness and timeliness gaps (EPA ECHO · 2026). Treat ECHO as a floor.
Step 3: Read each violation row carefully
Every cited violation in the RCRA section carries a CFR citation, an action type, a date, and — where assessed — a penalty. Two textual cues are easy to miss but matter for how the record should be characterized in an internal memo:
- ECHO labels violations as alleged unless a judicial or administrative body has issued a final adjudication (EPA ECHO · 2026).
- The duration shown for each violation is an estimate, not a legal determination (EPA ECHO · 2026).
A supplier scorecard that quotes ECHO durations as fact will be wrong about a non-trivial share of entries. Phrase findings as "alleged" or "EPA-cited" until the underlying order is in hand.
Step 4: Benchmark each citation against RCRAReady
RCRAReady's Penalty Explorer ingests ECHO enforcement data and lets a user filter by violation category — Storage Limits, Inspections, Waste Determination, Labeling, Manifests, Training — and by specific CFR citation (RCRAReady · 2026). The tool surfaces the regulatory section behind each action, so a row citing 40 CFR 262.11 (waste determination), 262.17 (large-quantity generator storage time), or 262.42 (Exception Reports) can be cross-referenced directly to the binding regulatory text (RCRAReady · 2026; eCFR · 2026).
Benchmarking matters because RCRA penalties accrue per day, per violation: a ten-day storage overage is treated as ten separate violations, not one (RCRAReady · 2026). EPA's current civil penalty maximum, effective January 8, 2025, is $93,058 per day, per violation (RCRAReady · 2026). The civil penalty itself is calculated from a two-part formula — Gravity (potential for harm) plus Economic Benefit (money saved by not complying, computed via EPA's BEN model) — multiplied by days of violation (RCRAReady · 2026).
Recent settlements illustrate the range a supplier-side citation should be measured against:
- $9,500,000 — Systemic Waste Services case, nationwide manifest violations (RCRAReady · 2026).
- $500,000 — chemical manufacturer, systemic storage and permit violations, Region 10 / Oregon (RCRAReady · 2026).
- $261,283 — tech hardware firm, failure to make accurate waste determinations, Region 9 / California (RCRAReady · 2026).
- $245,000 — metal finishing plant, failure to make hazardous waste determination, Region 9 / California (RCRAReady · 2026).
- $213,750 — paint manufacturer, failure to perform and document weekly Clean Air Act inspections, Region 4 / Florida (RCRAReady · 2026).
- $185,000 — electronics recycler, failure to perform waste determination on cathode-ray tubes, Region 6 / Texas (RCRAReady · 2026).
- $182,879 — plastic packaging firm, failure to make hazardous waste determinations, Region 7 / Kansas (RCRAReady · 2026).
Note the recurrence of "waste determination." Failure to make an accurate hazardous-waste determination under 40 CFR 262.11 is one of the most-cited deficiencies in the ECHO record and is required before any waste leaves a facility (Daniels Training · 2026; eCFR · 2026). Other recurring deficiencies visible in enforcement records include missing or incorrect container labels, missed accumulation start dates, and failure to provide annual refresher training (Daniels Training · 2026).
Step 5: Cross-check the state agency
Most U.S. states run authorized RCRA programs, conduct inspections through district offices, and report data to EPA for inclusion in ECHO (Florida DEP · 2025). State-level records often surface enforcement actions before they appear federally. Florida, for example, requires any facility managing more than 100 kg of RCRA hazardous waste per month (or 1 kg of acute hazardous waste) to obtain an EPAID and submit to compliance evaluations by Florida DEP district inspectors (Florida DEP · 2025). For time-sensitive diligence — an active onboarding decision, an audit response — querying the supplier's state environmental agency directly closes the lag between state inspection and federal aggregation.
A note on the manifest layer: e-Manifest use became mandatory on January 22, 2025, and continued use of paper-only manifests is now itself a citable violation (RCRAReady · 2026). A supplier whose recent record shows manifest deficiencies after that date should be examined more carefully than one whose manifest issues predate the cutover.
Step 6: Frame the multi-media risk
RCRA violations rarely arrive alone. Multi-media inspections are standard: once an inspector identifies one RCRA discrepancy, the audit typically expands to Clean Air Act, NPDES, and EPCRA records (RCRAReady · 2026). When summarizing a supplier's RCRA file, scan the parallel CAA, CWA, and SDWA blocks of the same DFR — a single facility tour generates linked findings, and a complete picture requires reading all four (EPA ECHO · 2026).
A final note on personal exposure: under RCRA's criminal provisions, corporate officers and EHS managers can face individual liability for "knowing and willful" violations (RCRAReady · 2026). That changes how a supplier's response to a cited violation should be read in diligence — a remediation plan signed by a named officer is meaningfully different from a generic corrective-action letter.
What "hazardous waste" actually covers
Waste is RCRA-regulated if it appears on the lists in 40 CFR Part 261 — the F-, K-, P-, and U-code lists — or if it exhibits one of four characteristics defined in 40 CFR Part 261, Subpart C: ignitability, corrosivity, reactivity, or toxicity (eCFR · 2026; Florida DEP · 2025). EPA's Consolidated List of Lists ties RCRA codes to parallel reporting obligations under EPCRA and CERCLA, which is useful when a single waste stream triggers multiple disclosure regimes (EPA · 2026). Suppliers below the Very Small Quantity Generator threshold are the narrow exception to the EPAID requirement (Florida DEP · 2025) — but most suppliers a procurement team is screening will sit above it, and their last five RCRA actions, if any exist, will already be sitting in ECHO waiting to be read.