How to transfer an ISO certificate to a new registrar

A transfer is not a new Stage 1. It is also not a logo swap you do in a week because a salesperson promised a friendlier auditor. It is the accepting certification body recognizing a valid, accredited management-system certificate that another accredited body already issued — then putting its own name on the remainder of the cycle.

The rule set is IAF MD 2:2023, the IAF mandatory document for transfer of accredited management-system certification. This page translates that document for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — who already hold ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001 and are deciding whether to move.

It does not publish prices. It does not invent accreditation identifiers or certificate numbers. You still look the legal entity up live before you award the work. If you do not yet hold a certificate, start with how to choose a registrar instead.

1. What you are actually moving

IAF MD 2 defines transfer as recognition of an existing and valid certificate, granted by one accredited CB (the issuing body), by another accredited CB (the accepting body) so the accepting body can issue its certificate.

Three things that are not a transfer: a new certification (unaccredited, expired, suspended, or a missed required audit — that is Stage 1 and Stage 2); a group acquisition (confirm the legal entity and mark that will appear next year; you did not choose a new registrar); and two certificates for the same scope. Concurrent certification is not a transfer. IAF does not encourage it.

The product you want is continuity: same scope, same cycle clock, a new mark that your customers will actually accept.

2. When transfer makes sense — and when it does not

Stay if the irritation is local. One blunt lead auditor or a late report is usually cheaper to manage than a transfer.

Transfer when the fit is wrong:

• The mark is wrong. A customer portal, importer, or prime writes “ANAB only” or “UKAS only,” and your certificate carries a different IAF MLA mark. Equivalence is real; portal configuration is not. See how to verify accreditation.
• The legal entity is wrong. The brochure was global. The contract named a regional company that does not hold the scope you thought you bought.
• The path is wrong. Your 9001 registrar cannot issue accredited ISO/IEC 27001 or ISO/IEC 42001 in the quarter you need it. The 9001 → 27001 → 42001 guide lists the honest options: wait, add a second CB, or plan a transfer. There is no fourth option called “the brochure said they do AI.”
• Competence is wrong. Factory-quality auditors are sampling an ISMS they do not understand, or a security boutique is wandering a heat-treat line.
• The issuing CB lost the scope. Accreditation expired, was suspended, or the firm ceased trading. MD 2 puts a clock on those cases: finish the transfer within six months or at certificate expiry, whichever is sooner. The accepting CB must tell its accreditation body before it takes the file.

Do not transfer to escape open major nonconformities. The accepting CB cannot issue until those majors are closed and it has accepted your plan for remaining minors. Shopping for a softer closer is visible in the file. What those grades usually hold, and what a response has to contain, is closing ISO nonconformities.

3. Eligibility: valid, accredited, and in both scopes

MD 2 is short on marketing and long on gates.

The certificate must sit under an IAF or Regional MLA accreditation at the management-system level (and the relevant sub-scope). Unaccredited “ISO certificates” are not transferable. They are new work. If a prior registrar sold you a mark that never appeared in an accreditation-body directory, you do not have a transfer problem. You have a verification problem.

The certificate must be valid. Suspended certificates are not accepted for transfer. Withdrawn or expired papers are not a transfer either.

Both CBs must be able to cover the scope. The accepting body confirms that your certification falls inside the accredited scope of the issuing CB and of itself, and that the issuing CB’s accredited scope sits inside its AB’s MLA scope. A 27001 certificate does not drag an unaccredited 42001 along with it. A single-site 9001 certificate does not automatically cover the warehouse you opened in another country last spring.

Sites transferring must each hold valid accredited certification. You cannot move a plant that was never on the certificate and call it a transfer. That site is a scope extension — usually its own audit, not a paperwork hop.

Write the legal names down before anyone opens a proposal: issuing entity, accepting entity, accreditation body on each side. Then look those names up. This site’s directory is an editorial shortlist, not a live feed.

4. Documents the accepting CB will actually request

The pre-transfer review is a documented file review. Where the file is thin or majors are open, MD 2 requires a pre-transfer visit. That visit is not an audit.

Build the pack yourself so you are not waiting on a slow inbox:

Item	Why they want it
Current certificate (legal entity, scope, sites, expiry, marks)	Confirms what is being recognized
Last recertification report, or the initial certification reports if you are still in the first cycle	Shows how the system was last fully sampled
Latest surveillance report	Shows the system still lives
Status of every open nonconformity	Majors must be closed before issue; minors need an accepted plan
Complaints received and what you did	Part of the minimum review
Site list and exclusions, matching the certificate	Multi-site sampling only covers sites that were in
Written authorization to the issuing CB	They will not release the file on a phone call
Any live regulatory engagement in the certified scope	Legal-compliance context, not a consulting session

If the reports are not made available, or a required surveillance or recertification was skipped, MD 2 is explicit: treat the organization as a new client. That is the expensive surprise. Ask the issuing CB for the file before you sign with the accepting CB.

A complete transfer quote should also say how many review days they assume and whether a visit is likely — see what CB quotes include. This page will not invent those day counts.

5. What happens to the three-year clock

Accredited management-system certification is a cycle: initial certification, surveillance, recertification. What those remaining visits actually sample is in surveillance and recertification. Transfer does not reset that clock when the review is clean.

If the pre-transfer review finds no problems:

• The accepting CB continues the previous cycle.
• It writes the audit programme for the time that remains — next surveillance, or recertification if you are near expiry.
• It decides certification before it starts those remaining audits.
• The new certificate may quote the original certification date, with a note that another CB held the certificate before a stated date.

If the review fails — missing reports, scope the accepting CB cannot cover, unresolved majors, a certificate that is not what it seemed — you are a new client. The cycle starts at the new certification decision. That is Stage 1 / Stage 2 again, with surveillance after.

Timing matters more than pride:

• Do not start a transfer in the month a surveillance is due unless both CBs have agreed who will perform it. The issuing CB still owns the programme until the accepting CB has issued.
• Do not wait until thirty days before expiry. A transfer plus recertification in the same quarter is two jobs.
• Do not skip a due surveillance so the new CB can “pick it up.” A missed audit is how you lose eligibility.

Bring the issuing CB’s audit calendar in the pack. Mid-market plants cannot pause a line because two registrars both thought the other owned June.

6. Multi-site and multi-country caveats

A certificate that lists five sites is not five transferable stickers. It is one certification with a sampling design.

Before you invite accepting CBs:

• List every site on the current certificate and every site you wish were on it. The wish list is a scope change.
• Note which sites are central functions (head office, design, ISMS governance) versus sampled locations.
• Name the countries. Language, shift patterns, and which legal entity the accepting CB will use all change with geography. Global groups operate many companies; the choose-a-registrar guide is blunt about this.
• If only some sites are moving — a carve-out after a sale, or a plant staying with the old CB — say so. Partial transfers fail when nobody redraws the scope statement.
• Do not assume the accepting CB can keep the same sampling reduction the issuing CB used. They have to justify their own programme.

For 27001, remote work, cloud, and a development team in a second country are in-scope questions, not footnotes. For 42001, a shop-floor vision model and a third-party copilot are different objects. Confirm the accepting entity’s live AIMS schedule in the quarter you transfer; do not infer it from a 27001 accreditation.

7. Tell customers before the mark changes

The certificate number will change. The CB name on the PDF will change. Some accreditation marks will change even when both ABs are IAF MLA signatories.

Who needs a letter, a portal update, or a new PDF before the old certificate disappears:

• Customer quality manuals that name the CB or the mark.
• Supplier portals that store a certificate file or an IAF CertSearch link.
• Primes and exporters that list you as an approved source against a named registrar.
• Insurers or finance teams that filed the certificate with a credit package.
• Sister companies whose integrated programme assumed one CB.

Write the notification as facts: old legal entity, new legal entity, standards and editions, site list, and that you will send the new certificate number when it exists. Do not promise a date the accepting CB has not put in writing.

Search the current certificate on IAF CertSearch before you move, and search again after issue. Upload lag exists; a transfer that never appears is still a question for the accepting CB.

8. Cooperation, refusal, and what you can demand

You authorize the issuing CB to release the file. They are expected to send the documents MD 2 lists. They must not suspend or withdraw your certificate merely because you announced a transfer, if you still satisfy the certified system.

If they stall or punish: keep the system running (a lapse you caused is not their non-cooperation), put the request in writing, and ask the accepting CB to request the file. MD 2 tells them to record why contact failed and to try other sources. If the issuing CB still withholds information, or suspends or withdraws without cause, the accepting CB and/or you contact the accreditation body that accredits the issuing CB.

Once the accepting CB issues, it informs the issuing CB. That is their job, not a courtesy you chase in month four.

9. Red flags

Slow down, or walk away, when you see:

• A transfer quote that is only a Stage 2 price. If they have not described the pre-transfer review, they have not described the job.
• A promise to ignore open majors. MD 2 does not allow issue until those corrections are verified.
• No legal entity on the proposal. “Our global network” cannot hold a certificate.
• A request that you hide the transfer from the issuing CB. The file has to move. Secrecy is how reports go missing.
• Pressure to skip a due surveillance so the new CB can “start fresh.” Fresh is the new-client path. It is not a favor.
• A 42001 transfer inferred from 27001. Confirm the AIMS schedule for the named entity. Press releases age.
• A guarantee that every customer portal will accept the new mark. Portals are configured by people. Check the ones that pay you.
• Consulting and certification from the same team. Independence does not loosen because you are transferring.

10. How to run the transfer as a buying decision

1. Write one page: standards and editions, sites, headcount bands, integration versus separate certificates, why you are transferring, customer mark constraints, and the current cycle dates (last audit, next audit, expiry).
2. Verify the outgoing certificate is valid and accredited — verification walkthrough.
3. Shortlist three to five accepting CBs in the directory and score them with the compare scorecard. Include at least one body that already covers the next standard on your path if 27001 or 42001 is the reason you are leaving.
4. Send the same pack to each. Compare review assumptions, visit likelihood, remaining surveillance design, and the legal entity — not a single bottom-line number. Anatomy is in what quotes include.
5. Authorize file release after you know which accepting CB you intend to use, unless the issuing CB has ceased trading.
6. Notify customers whose portals store the old mark. Then submit the pack through Get quotes or send it directly.

Record the issuing entity, accepting entity, ABs you viewed and on which date, and the planned first audit under the new programme. If you are still choosing in the first place, use how to choose a registrar. Transfer is the later chapter, not a substitute for competence and independence.