Skip to content
REPORT (COM(2025)0685 – C100298/2025 – 2025/0348(CNS))

On the proposal for a Council regulation amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level

A-10-2026-0159

Committee on Economic and Monetary Affairs · Rapporteur: Michalis Hadjipantela

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed Council regulation gives the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) targeted, centralised access to VAT information, with safeguards to prevent untargeted searches and ensure data protection. It requires customs authorities to spontaneously transmit data indicating VAT fraud to Eurofisc, EPPO and OLAF, and asks the Commission to propose minimum harmonisation of penalties for serious VAT fraud. It also sets rules on data deletion, annual statistics, interoperability, and funding for IT systems, and requires Member States not in the EPPO to designate an equivalent authority.

Committee position. The Committee on Economic and Monetary Affairs proposes that Parliament approve the Commission proposal as amended, with amendments focusing on data protection safeguards, targeted access, and reporting requirements.

Key points

  1. Approves the Commission proposal as amended and calls on the Commission to alter its proposal accordingly.
  2. Requires Member States not participating in the EPPO to designate a competent national authority for cooperation with Eurofisc and OLAF, notify the Commission within six months, and report annually.
  3. Requires customs authorities to spontaneously communicate to Eurofisc, EPPO and OLAF information indicating VAT fraud, including discrepancies and undervaluation, without delay.
  4. Expands the data to be stored on importations to include import declaration identifier, VAT or IOSS numbers, declared customs value, and country of origin.
  5. Grants EPPO and OLAF centralised access to VAT information via a secure central interface, limited to what is necessary for their mandates and active investigations.
  6. Prohibits untargeted searches, bulk data extraction, and automated profiling; requires each access to be attributable to a specific investigation and authorised user, with logging.
  7. Requires EPPO and OLAF to publish annual statistics on their use of the access, including number of inquiries and investigations advanced.
  8. Deletes provisions that made EPPO and OLAF bear the costs of infrastructure; instead, the Commission must assess the need for additional Union funding.
  9. Sets rules for personal data received via spontaneous transmission: deletion within 90 days (EPPO) or 60 days (OLAF) if irrelevant, and notification of transmitting authority.
  10. Requires the Commission to submit a legislative proposal within 18 months for minimum harmonisation of administrative penalties for serious VAT and customs infringements.
  11. Requires the Commission to report every three years on the regulation's application, assessing operational effectiveness, coherence, and enforcement outcomes.

Who is affected

  • EPPO and OLAF: gain targeted access to VAT data, subject to safeguards and reporting duties.
  • Customs authorities of member states: must transmit fraud indicators and share data with Eurofisc, EPPO and OLAF.
  • Member states not participating in the EPPO: must designate an equivalent authority and report annually.
  • Importers and taxable persons: their import data, including VAT and IOSS numbers, may be accessed and shared.

Figures and deadlines

  • 1 September 2026: date from which EPPO and OLAF can access information under Article 17(1)(e) and (f).
  • 90 days: period for EPPO to delete irrelevant data received via spontaneous transmission.
  • 60 days: period for OLAF to delete irrelevant data received via spontaneous transmission.
  • 18 months: deadline for the Commission to submit a proposal on minimum harmonisation of penalties.
  • Six months: period for member states not in the EPPO to notify the Commission of their designated authority.
  • Every three years: frequency of the Commission's report on the regulation's application.

Legal basis: Article 113 of the Treaty on the Functioning of the European Union