Amendments to Regulation (EU) No 904/2010
Article 1
Open ↗Regulation (EU) No 904/2010 is amended as follows: (1) in Article 21, the following paragraph is inserted: ‘2c. Every Member State shall grant the European Public Prosecutor’s Office (“the EPPO”), established by Council Regulation (EU) 2017/1939 ( *1 ) , and the European Anti-Fraud Office (OLAF), established by Decision 1999/352/EC, ECSC, Euratom of the Commission ( *2 ) , access to the information referred to, and in accordance with the limits and rules set out, in Articles 49a and 49b of this Regulation. ( *1 ) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (“the EPPO”) ( OJ L 283, 31.10.2017, p. 1 , ELI: http://data.europa.eu/eli/reg/2017/1939/oj )." ( *2 ) Decision 1999/352/EC, ECSC, Euratom of the Commission of 28 April 1999 establishing the European Anti-fraud Office (OLAF) ( OJ L 136, 31.5.1999, p. 20 , ELI: http://data.europa.eu/eli/dec/1999/352/oj ).’;" (2) Article 24d is replaced by the following: ‘Article 24d 1. Access to CESOP shall only be granted to Eurofisc liaison officials, as referred to in Article 36(1), who hold a personal user identification for CESOP and where that access is in connection with an investigation into suspected VAT fraud or is to detect VAT fraud. 2. By way of derogation from paragraph 1 of this Article, the EPPO and OLAF shall have access to CESOP information in accordance with the limits and rules set out in Articles 49a and 49b.’ ; (3) in Article 24k, the following paragraph is inserted: ‘1a. The EPPO and OLAF shall have access to central VIES information in accordance with the limits and rules set out in Articles 49a and 49b.’ ; (4) in Article 36, the following paragraphs are inserted: ‘2a. Eurofisc shall communicate to the EPPO, in accordance with Article 24(1) of Regulation (EU) 2017/1939 as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, specific Eurofisc analysis reports that identify cases of suspected cross-border fraudulent schemes as defined in Article 3(2)(d) of Directive (EU) 2017/1371 of the European Parliament and of the Council ( *3 ) based on information from Member States exchanged pursuant to this Regulation and following its analysis as referred to in Article 33 of this Regulation, in respect of which the EPPO could exercise its competence. The specific Eurofisc analysis reports referred to in the first subparagraph of this paragraph shall: (a) be drawn up based on the criteria determined in the implementing act referred to in paragraph 2e; (b) contain the information determined in the implementing act referred to in paragraph 2e; and (c) be communicated to the EPPO without undue delay after they are drawn up using the standard form established in the implementing act referred to in paragraph 2e. 2b. In the course of an investigation or a prosecution by, and at the request of, the EPPO, in accordance with Article 24(9) of Regulation (EU) 2017/1939 as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, Eurofisc shall communicate to the EPPO any available relevant information from Member States on cross-border VAT fraud exchanged pursuant to this Regulation. 2c. Eurofisc shall communicate to OLAF, in accordance with Article 8(2) and (3) of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council ( *4 ) , specific Eurofisc analysis reports that identify cases of suspected customs-related VAT fraud affecting the financial interests of the Union based on information from Member States exchanged pursuant to this Regulation and following its analysis as referred to in Article 33 of this Regulation, to enable OLAF to consider appropriate action in accordance with its mandate. The specific Eurofisc analysis reports referred to in the first subparagraph of this paragraph shall: (a) be drawn up based on the criteria determined in the implementing act referred to in paragraph 2e; (b) contain the information determined in the implementing act referred to in paragraph 2e; and (c) be communicated to OLAF without undue delay after they are drawn up using the standard form established in the implementing act referred to in paragraph 2e. 2d. In accordance with Article 8(2) and (3) of Regulation (EU, Euratom) No 883/2013, at the request of OLAF, Eurofisc shall communicate to OLAF any available information from Member States on suspected customs-related VAT fraud affecting the financial interests of the Union exchanged pursuant to this Regulation to enable OLAF to consider appropriate action in accordance with its mandate. 2e. The Commission, by means of an implementing act, shall determine the criteria based on which the Eurofisc analysis reports are to be drawn up and the information to be included in those analysis reports in order to enable the EPPO or OLAF to assess their competence and shall establish the standard forms for the transmission of those reports. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 58(2). In the preparation of the draft implementing act, the Commission shall consult Eurofisc. ( *3 ) Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union’s financial interests by means of criminal law ( OJ L 198, 28.7.2017, p. 29 , ELI: http://data.europa.eu/eli/dir/2017/1371/oj )." ( *4 ) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 ( OJ L 248, 18.9.2013, p. 1 , ELI: http://data.europa.eu/eli/reg/2013/883/oj ).’;" (5) in Article 49, paragraph 1 is replaced by the following: ‘1. The Member States and the Commission shall examine and evaluate how the arrangements for administrative cooperation provided for in this Regulation are working. The evaluation shall include the practical application of Article 36, paragraphs (2a) to (2d), and of Articles 49a and 49b. The Commission shall pool the Member States’ experience with the aim of improving the operation of those arrangements.’ ; (6) in Chapter XIII, the following Articles are added: ‘Article 49a 1. For the purpose defined in paragraph 2(b) of this Article and without prejudice to Article 43 of Regulation (EU) 2017/1939, the competent authorities of the Member States shall grant the EPPO centralised access, for targeted searches, to the following information: (a) from 17 August 2027 to 30 June 2032, the information referred to in Article 17(1), points (a), (b) and (c), of this Regulation; (b) from 17 August 2027, the information referred to in Article 17(1), points (e) and (f), of this Regulation; (c) from 17 August 2027, the information transmitted in accordance with Article 24b(3) of this Regulation; (d) from 1 July 2030, the information referred to in Article 24g(2) of this Regulation. 2. Centralised access as referred to in paragraph 1 of this Article shall be granted subject to the following conditions: (a) centralised access shall only be granted to European Prosecutors, European Delegated Prosecutors, and identified staff authorised by the EPPO’s Central Office who hold a personal user identification for the electronic systems allowing centralised access to the information referred to in paragraph 1 of this Article; (b) centralised access shall only be granted for the purpose of exercising the competence referred to in Article 22 of Regulation (EU) 2017/1939; (c) audit logs of the centralised access shall be available to the competent authorities of the Member States for information and to the EPPO for internal control purposes. 3. Centralised access as referred to in paragraph 1 shall be provided through a single-entry point to all information relating to an investigation, including information concerning several Member States. 4. The Commission shall determine by means of implementing acts: (a) the technical details concerning centralised access to the information referred to in paragraph 1, including the categories of targeted searches that can be carried out; (b) the technical data protection measures that lower the risk of unauthorised access, untargeted searches or abuse, including identification of the users referred to in paragraph 2, points (a) and (c), user profiles, access controls and mechanisms ensuring the attribution of every access to a specific investigation case file and user; (c) the requirements of the audit log, including the attribution of every access to a specific investigation case file and user, and the practical arrangements for accessing it. The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 58(2). 5. The costs of establishing, operating and maintaining the infrastructure and technical means allowing the secure access to the information referred to in this Article shall be borne by the EPPO. Article 49b 1. For the purposes defined in paragraph 2(b) of this Article, the competent authorities of the Member States shall grant to OLAF centralised access, for targeted searches, to the following information: (a) from 17 August 2027 to 30 June 2032, the information referred to in Article 17(1), points (a), (b) and (c); (b) from 17 August 2027, the information referred to in Article 17(1), points (e) and (f); (c) from 17 August 2027, the information transmitted in accordance with Article 24b(3); (d) from 1 July 2030, the information referred to in Article 24g(2). 2. Centralised access as referred to in paragraph 1 of this Article shall be granted subject to the following conditions: (a) centralised access shall only be granted to identified staff authorised by OLAF who hold a personal user identification for the electronic systems allowing the centralised access to the information referred to in paragraph 1 of this Article; (b) centralised access shall only be granted for the purposes of assessing existing suspicions that there has been fraud prior to opening, and for the purposes of carrying out, specific customs-related administrative investigations in accordance with OLAF tasks as referred to in Article 1(1) of Regulation (EU, Euratom) No 883/2013; (c) audit logs of the centralised access shall be available to the competent authorities of the Member States for information and to OLAF for internal control purposes. 3. Centralised access as referred to in paragraph 1 shall be provided through a single-entry point to all information relating to an investigation, including information concerning several Member States. 4. The Commission shall determine by means of implementing acts: (a) the technical details concerning the centralised access to the information referred to in paragraph 1, including the categories of targeted searches that can be carried out; (b) the technical data protection measures that lower the risk of unauthorised access, untargeted searches or abuse, including identification of the users referred to in paragraph 2, point (a) and (c), user profiles, access controls and mechanisms ensuring the attribution of every access to a specific investigation case file and user; (c) the requirements of the audit log, including the attribution of every access to a specific investigation case file and user, and the practical arrangements for accessing it. The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 58(2). 5. The costs of establishing, operating and maintaining the infrastructure and technical means allowing the secure access to the information referred to in this Article shall be borne by OLAF.’.