Proposal for a directive European Parliament and Council

14.2.2024

PROVISIONAL AGREEMENT RESULTING FROM INTERINSTITUTIONAL NEGOTIATIONS

Subject: Proposal for a directive European Parliament and Council

(COM(2021)0429 – C90338/2021 – 2021/0244(COD))

The interinstitutional negotiations on the aforementioned proposal for a directive have led to a compromise. In accordance with Rule 74(4) of the Rules of Procedure, the provisional agreement, reproduced below, is submitted as a whole to the Committee on Civil Liberties, Justice and Home Affairs for decision by way of a single vote.

2021/0244 (COD)

Proposal for a

DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Directive (EU) 2019/1153 of the European Parliament and of the Council, as regards access of competent authorities to centralised bank account registries through the single access point

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 87(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee1,

Having regard to the opinion of the Committee of the Regions2,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) Optimising and facilitating access to financial information is necessary to prevent, detect, investigate or prosecute serious crime, including terrorism. In particular, swift access to financial information is essential for carrying out effective criminal investigations and for successfully tracing and subsequently confiscating instrumentalities and proceeds of crime, in particular as part of investigations into organised crime and cybercrime.

(2) Directive (EU) 2019/1153 of the European Parliament and of the Council3 enables authorities competent for the prevention, detection, investigation or prosecution of criminal offences designated by Member States to access and search, subject to certain safeguards and limitations, bank account information. Directive (EU) 2019/1153 defines bank account information as certain information contained in the centralised automated mechanisms that Member States set up pursuant to Directive (EU) 2015/849 of the European Parliament and of the Council4, referred to in Directive (EU) 2019/1153 as centralised bank account registries.

(3) The authorities designated under Directive (EU) 2019/1153 include at least the Asset Recovery Offices and can also include tax authorities and anti-corruption agencies to the extent that they are competent for the prevention, detection, investigation or prosecution of criminal offences under national law. Pursuant to that Directive, the competent authorities are empowered to directly access and search only the centralised bank account registries of the Member State that designated those authorities.

(4) Directive (EU) YYYY/XX of the European Parliament and of the Council,5 , which replaces Directive 2015/849 of the European Parliament and of the Council6, and retains the key features of the system established by that Directive, provides, in addition, that the centralised automated mechanisms are interconnected via the bank account registers (BAR) single access point, to be developed and operated by the Commission. However, under Directive (EU) YYYY/XX only FIUs continue to have direct access to the centralised automated mechanisms, including through the BAR single access point.

(5) Considering the cross-border nature of organised crime, the financing of terrorism, and money laundering, as well as the importance of relevant financial information for the purposes of combating serious criminal offences, including by swiftly tracing, freezing and confiscating illegally obtained assets where possible and appropriate, authorities competent for the prevention, detection, investigation or prosecution of criminal offences designated in accordance with Directive (EU) 2019/1153 should be able to directly access and search the centralised bank account registries of other Member States through the BAR single access point put in place pursuant to Directive (EU) YYYY/XX.

(6) The safeguards and limitations already established by Directive (EU) 2019/1153 should also apply in respect of the possibilities to access and search bank account information, through the BAR single access point, established by the present Directive. These safeguards and limitations include those concerning the limitation to the authorities that have the power to access and search bank account information, the purposes for which the access and search may be conducted, the types of information that are accessible and searchable while respecting the principle of data minimisation, requirements applicable to the staff of the designated competent authorities, the security of the data and the logging of access and searches.

(6a) Bank statements containing records of financial transactions and transfers (transaction records) carried out through a bank account provide crucial information for criminal investigations. However, financial investigations are hampered by the fact that the financial and credit institutions provide authorities competent for the prevention, detection, investigation or prosecution of criminal offences ("competent authorities") with transaction records in different formats, which are not immediately ready for analysis. Considering the cross-border nature of most investigations into serious criminal offences, the disparity of formats and difficulties of processing transaction records hamper the exchange of information among competent authorities between Member States and the development of cross-border financial investigations. In order to improve the capacity of competent authorities to carry out financial investigations, this Directive sets out measures to ensure that financial and credit institutions across the Union, including crypto-asset service providers, provide transaction records in a format that is easy to process and analyse by competent authorities.

(6b) The conditions and procedures under which competent authorities can request transaction records from financial and credit institutions are governed by procedural rules established in national law. The harmonisation of the technical modalities for the provision of transaction records by the financial sector upon request from competent authorities should not affect the national procedural rules and safeguards under which these authorities can request such information.

(6c) In order to ensure uniform conditions for the provision of transaction records by financial and credit institutions to competent authorities, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council 7

(6d) Access by competent authorities to bank account information across borders through the BAR single access point is based on the mutual trust among Member States derived from their respect of fundamental rights and of the principles recognised by Article 6 TEU and by the Charter of Fundamental Rights of the European Union, such as the right to respect for one’s private and family life, the right to the protection of personal data and procedural rights, including the right to an effective remedy and to a fair trial, the presumption of innocence and the right of defence and the principles of the legality and proportionality of criminal offences and penalties, as well as the fundamental rights and principles provided for in international law and international agreements to which the Union or all the Member States are party, including the European Convention for the Protection of Human Rights and Fundamental Freedoms, and in Member States’ constitutions, in their respective fields of application.

(6e) When implementing this Directive, Member States should consider the nature, organisational status, role and prerogatives of the authorities and bodies established under national law as responsible for preventing, detecting, investigating or prosecuting criminal offences, including the existing mechanisms to protect financial systems from money laundering and terrorist financing.

(7) Any processing of personal data by the competent authorities in connection with the access and search possibilities established by this Directive is subject to Directive (EU) 2016/680 of the European Parliament and of the Council which lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in line with a set of principles relating to the processing of personal data, in particular lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. This Directive respects the fundamental rights and observes the principles recognised by Article 6 of the Treaty on European Union and by the Charter of Fundamental Rights of the European Union, in particular the right to respect for one’s private and family life and the right to the protection of personal data.

(8) Given that the objective of this Directive, namely to empower designated authorities competent for the prevention, detection, investigation or prosecution of criminal offences to access and search the centralised bank account registries of other Member States through the BAR single access point established by Directive (EU) YYYY/XX , cannot be sufficiently achieved by Member States, but can be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Directive does not go beyond what is necessary in order to achieve this objective.

(9) In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified its wish to take part in the adoption and application of this Directive.

(10) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

(11) Directive (EU) 2019/1153 should therefore be amended accordingly.

(12) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Counand comments on 6 September 2021,

HAVE ADOPTED THIS DIRECTIVE:

Article 1

Article 1 of Directive (EU) 2019/1153 is amended as follows:

1. Paragraph 1 is amended as follows:

1. This Directive lays down measures to facilitate access to and the use of financial information and bank account information by competent authorities for the prevention, detection, investigation or prosecution of serious criminal offences. It also lays down measures to facilitate access to law enforcement information by Financial Intelligence Units (‘FIUs’) for the prevention and combating of money laundering, associate predicate offences and terrorist financing and measures to facilitate cooperation between FIUs. Furthermore, it lays down technical measures to facilitate the use of transaction records by competent authorities for the prevention, detection, investigation or prosecution of serious criminal offences.

2. In paragraph 2, the following point is added:

(e) procedures under national law under which authorities responsible for the prevention, detection, investigation or prosecution of serious criminal offences can require financial and credit institutions to provide transaction records, including the time-limits for transmitting such information.

Article 2 is amended as follows:

(a) point 7 is replaced by the following:

(7) ‘bank account information’ means the information set out in Article 14(3) of Directive …/… of the European Parliament and of the Council*+

_____________________

* Directive …/… of the European Parliament and of the Council of … on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU) 2015/849 (OJ L…, ELI: …).

In article 2 of Directive (EU) 2019/1153, the following points (7a), (7b) and (7c) are inserted after point (7):

(7a) ‘transaction records’ means the details of operations which have been carried out during a defined period through a specified payment account, a bank account identified by IBAN, as defined by Regulation (EU) No 260/2012 of the European Parliament and of the Council, or the details of transfers of crypto-assets, as defined by Article 3, point (10), of Regulation (EU) 2023/1113 of the European Parliament and of the Council**

(7b) "financial and credit institutions" means financial and credit institutions as defined in Article 2, first paragraph, of Directive (EU) …/… ++

(7c) "crypto-asset service provider" means crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114 of the European Parliament and of the Council***

_______________

** Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1, ELI: http://data.europa.eu/eli/reg/2023/1113/oj).

*** Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40, ELI: http://data.europa.eu/eli/reg/2023/1114/oj).

Article 3

In Article 4 of Directive (EU) 2019/1153, the following paragraph is inserted:

“1a. Member States shall ensure that the competent national authorities designated pursuant to Article 3(1) have the power to access and search, directly and immediately, bank account information in other Member States available through the bank account registers (BAR) single access point put in place pursuant to Article XX of Directive (EU) YYYY/XX [the new Anti-Money Laundering Directive] where necessary for the performance of their tasks for the purposes of preventing, detecting, investigating or prosecuting a serious criminal offence or supporting a criminal investigation concerning a serious criminal offence, including the identification, tracing and freezing of the assets related to such investigation.

Member States may limit the power to access and search bank account information through the bank account registers (BAR) single access point to situations where competent authorities have justified reasons to believe that there might be relevant bank account information in other Member States.

Without prejudice to Article 4(2) of Directive (EU) 2016/680, information obtained by means of accessing and searching the BAR single access point shall be processed only for the purpose for which it was collected.

Access and searches pursuant to this Article shall be without prejudice to national procedural safeguards and Union and national rules on the protection of personal data.

The second sentence of paragraph 1 of this Article applies mutatis mutandis.”

New paragraph in Article 12

Each Member State shall ensure that FIUs are able to invite Europol where relevant for supporting them when carrying out the joint analysis referred to in Article 25 AMLD and Article 33 AMLAR, subject to the agreement of all participating FIUs, within the limits of Europol’s mandate and for the performance of the tasks laid down in Article 4(1) letters (h) and (z) of Regulation 2016/0794 recast, and without prejudice to the competences of AMLA, as set out in AMLAR.

Article 4

The title of CHAPTER II of Directive (EU) 2019/1153 is amended as follows:

ACCESS BY COMPETENT AUTHORITIES TO BANK ACCOUNT INFORMATION, AND THE FORMAT OF TRANSACTION RECORDS

(2) In Article 5 of Directive (EU) 2019/1153, paragraphs 1 and 3 shall read as follows:

1. Access to and searches of bank account information in accordance with Article 4, including through the BAR single access point, shall be performed only on a case-by-case basis by the staff of each competent authority that have been specifically designated and authorised to perform those tasks.

3. Member States shall ensure that technical and organisational measures are in place to ensure the security of the data to high technological standards for the purposes of the exercise by competent authorities of the power to access and search bank account information, including through the BAR single access point, in accordance with Article 4.

(3) In Article 6 of Directive (EU) 2019/1153, the first sentence of paragraph 1 shall read as follows:

1. Member States shall provide that the authorities operating the centralised bank account registries ensure that logs are kept each time designated competent authorities access and search bank account information, including through the BAR single access point.

The following Articles 6a and 6b are inserted after article 6 of Directive (EU) 2019/1153:

"Article 6a Transaction records

Member States shall ensure that financial and credit institutions, including crypto-asset service providers, comply with the technical specifications established in accordance with article 6b when replying, in accordance with national legislation, to requests for transaction records issued by competent authorities within a criminal investigation, including the identification, tracing and freezing of the assets related to such investigation.

Article 6b [description of the implementing acts]

The Commission is empowered to adopt, by means of implementing acts, technical specifications in order to establish the electronic structured format and technical transmission means to be used for financial and credit institutions to provide transaction records to competent authorities in their Member State, in accordance with national procedural rules.

When adopting the implementing act, the Commission will consider the development of relevant financial services messaging standards as well as technological developments to ensure the secure transmission of transaction records, including technical measures to ensure the security of the data.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article X."

The following Article X10 is inserted:

"Article X Committee procedure

The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011."

Article 5

1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by [XXYY] [transposition period to be aligned with the application date set by the new Anti-Money Laundering Directive for the application of the provisions for interconnecting the centralised automated mechanism] at the latest. They shall forthwith communicate to the Commission the text of those provisions.

When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.

2. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.

Article 6

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 7

This Directive is addressed to the Member States in accordance with the Treaties.

Done at Brussels,

For the European Parliament For the Council

The President The President