(1)

Council Regulation (EU) No 904/2010 (3) lays down rules on the storage and exchange, through electronic means, of specific information in the field of value added tax (VAT) to help ensure the correct assessment of VAT, monitor the correct application of VAT, in particular regarding intra-Community transactions, and combat VAT fraud. However, it does not provide for rules governing access to that information by the European Public Prosecutor’s Office (‘the EPPO’) established by Council Regulation (EU) 2017/1939 (4) for the exercise of its tasks pursuant to Article 4 of that Regulation, nor for rules governing access to that information by the European Anti-Fraud Office (OLAF) established by Decision 1999/352/EC, ECSC, Euratom of the Commission (5) for the exercise of its tasks pursuant to Article 1 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (6).

(2)

Pursuant to Article 24(1) of Regulation (EU) 2017/1939, the institutions, bodies, offices and agencies of the Union and the authorities of the Member States competent under applicable national law are to report to the EPPO, without undue delay, any criminal conduct, including cross-border VAT fraud, in respect of which it could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation. Cross-border VAT fraud, by definition, involves several Member States, and the flow of information from individual Member States to the EPPO might, in certain cases, not be sufficient to ensure a timely and comprehensive overview of cross-border VAT fraud at Union level. Therefore, in order for the EPPO to be informed of VAT fraud risks at Union level in a more timely manner and to exercise its competence in accordance with Regulation (EU) 2017/1939, it is necessary to set out in more detail the rules under which Member States, within the network for the swift exchange, processing and analysis of targeted information on cross-border fraud between Member States and for the coordination of any follow-up actions (Eurofisc) established by Regulation (EU) No 904/2010, should transmit the results of the Eurofisc joint processing and analysis to the EPPO in the form of Eurofisc analysis reports on suspected cross-border fraudulent schemes.

(3)

When drawing up Eurofisc analysis reports, Eurofisc should include only the information that is strictly necessary to enable the EPPO to assess whether to exercise its competence. To determine the criteria on the basis of which Eurofisc analysis reports should be drawn up and the information that should be included in those reports and to establish a standard form for their transmission, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (7). In the preparation of the draft implementing act, the Commission should consult Eurofisc.

(4)

Furthermore, pursuant to Article 24(9) of Regulation (EU) 2017/1939, in specific cases, the EPPO might request further relevant information available to the institutions, bodies, offices and agencies of the Union and to the authorities of the Member States. Therefore, it is appropriate to set out the rules under which Eurofisc should communicate to the EPPO information on cross-border VAT fraud following an EPPO request.

(5)

Pursuant to Article 43(1) of Regulation (EU) 2017/1939, European Delegated Prosecutors are to be able to obtain any relevant information stored in national criminal investigation and law enforcement databases, as well as other relevant registers of public authorities, under the same conditions as those that apply under national law in similar cases. Pursuant to Article 43(2) of that Regulation, the EPPO is also to be able to obtain any relevant information falling within its competence that is stored in databases and registers of the institutions, bodies, offices and agencies of the Union. Cross-border VAT fraud, by definition, involves several Member States, and access at Member State level to relevant information stored in national databases might, in certain cases, not be sufficient for the EPPO to combat VAT fraud at Union level. Therefore, without prejudice to Article 43 of Regulation (EU) 2017/1939 and in order to ensure that the EPPO has access to relevant information at Union level in a timely manner, performs its regulatory mandate and fights against fraud at Union level, it is important to set out the rules under which the EPPO should have access to relevant VAT information at Union level from the relevant databases and registers of competent authorities in the Member States responsible for the application of the laws on VAT. For the same reason, it is important to give the EPPO centralised access, for targeted searches on a case-by-case basis, to relevant information concerning an investigation through a single-entry point, even if that information concerns several Member States. Such centralised access should be strictly limited to targeted searches related to specific cases and should not entail fishing expeditions or random or generalised monitoring of VAT information. The granting of centralised access to administrative databases to the EPPO for judicial and law enforcement purposes is exceptional in nature and is justified by the need to combat cross-border VAT fraud, and is not to be construed as setting a precedent for more general application.

(6)

To fulfil its tasks, the EPPO works closely with relevant national authorities which actively assist and support the investigations and prosecutions of the EPPO in accordance with Article 5(6) of Regulation (EU) 2017/1939. The EPPO also provides feedback and, where relevant, consults competent national authorities in accordance with the applicable provisions of that Regulation, including Article 5(6), Article 25, paragraphs 1 to 3, Article 27(7) and Article 34, paragraphs 1 to 4.

(7)

In accordance with the principle of sincere cooperation enshrined in Article 4(3) of the Treaty on European Union, Member States which do not participate in the EPPO are to support the activities of the EPPO and refrain from any action that could jeopardise the achievement of its objectives. Eurofisc is composed of both Member States participating and not participating in the EPPO. As cross-border VAT fraud can span across every Member State, it is essential that the EPPO has a complete overview of the fraud networks. Therefore, it is important for the EPPO to obtain relevant VAT information exchanged by Member States within Eurofisc, as well as from the databases and registers of competent authorities in the Member States responsible for the application of the laws on VAT, without prejudice to the EPPO’s competences under Regulation (EU) 2017/1939. This Regulation does not affect the scope of the competences of the EPPO as defined in Regulation (EU) 2017/1939.

(8)

The European Court of Auditors has recommended that the Commission and the Member States remove legal obstacles that prevent the exchange of information between administrative, judicial and law enforcement authorities at national and Union level. It has also recommended, in particular, that OLAF be given access to the VAT information exchange system as established by Regulation (EU) No 904/2010 (VIES) and Eurofisc data. In that respect, it is important that central access to the relevant databases and registers of competent authorities in the Member States responsible for the application of the laws on VAT has a clear legal basis.

(9)

In order for OLAF to be informed of suspected customs-related VAT fraud affecting the financial interests of the Union and to perform its regulatory mandate, it is necessary to set out the rules under which the Member States within Eurofisc should report to OLAF the results of the Eurofisc joint processing and analysis, which is to be in the form of Eurofisc analysis reports on suspected cross-border fraudulent schemes. Moreover, upon request by OLAF, Eurofisc should communicate information to OLAF on customs-related cross-border VAT fraud potentially affecting the financial interests of the Union.

(10)

When drawing up Eurofisc analysis reports, Eurofisc should include only the information which is strictly necessary to enable OLAF to assess whether to exercise its competence. To determine the criteria on the basis of which Eurofisc analysis reports should be drawn up and the information that should be included in those reports, and to establish a standard form for their transmission, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011. In the preparation of the draft implementing act, the Commission should consult Eurofisc.

(11)

Where there is a sufficient suspicion in accordance with Article 5 of Regulation (EU, Euratom) No 883/2013 that fraud has occurred, OLAF is to have the right of access to any relevant information in databases held by the institutions, bodies, offices or agencies while respecting the principles of necessity and proportionality. That right of access is to be exercised under the conditions set out in that Regulation. Therefore, in order for OLAF to access relevant VAT information at Union level that could be relevant for customs-related administrative investigations to exercise its competence, it is important to set out the rules under which OLAF should access relevant VAT information at Union level from relevant databases and registers of competent authorities in the Member States responsible for the application of the laws on VAT. For the same reason, it is important to give OLAF centralised access, for targeted searches on a case-by-case basis, to relevant information concerning an investigation through a single-entry point, even if that information concerns several Member States. Such centralised access should be strictly limited to targeted searches related to specific cases and should not entail fishing expeditions or random or generalised monitoring of VAT information. That centralised access to administrative databases for the purposes of carrying out customs-related administrative investigations is exceptional in nature and is justified by the need to fulfil OLAF’s mandate, and is not to be construed as setting a precedent for more general application.

(12)

To fulfil its tasks, OLAF works closely with relevant national authorities in accordance with Article 1(2) of Regulation (EU, Euratom) No 883/2013. OLAF also provides feedback and, where relevant, consults competent national authorities in accordance with the applicable provisions of that Regulation, including Article 12, paragraphs 1 and 5.

(13)

Information on intra-Community transactions, cross-border payments and VAT exempt importations is collected by national competent authorities and is important in the fight against fraud. With regard to the protection of personal data, the Commission facilitates the exchange of that information as a data processor, while the competent authorities of the Member States act as data controllers under Regulation (EU) 2018/1725 of the European Parliament and of the Council (8) and Regulation (EU) 2016/679 of the European Parliament and of the Council (9), respectively. The EPPO and OLAF’s centralised access to VAT information at Union level should be granted without prejudice to the roles and responsibilities of the competent authorities in the Member States responsible for the application of the laws on VAT in respect of the protection of personal data under Regulation (EU) 2016/679. The EPPO and OLAF are bound by the rules for the protection of personal data under Regulation (EU) 2018/1725, including the principles of proportionality and accountability and the rules on the implementation of appropriate technical and organisational measures and the supervision by the European Data Protection Supervisor. The information subject to targeted searches by the EPPO and OLAF through centralised access consists of information on VAT identification numbers, on intra-Community transactions, on importations exempt from VAT in relation to the special scheme for distance sales of goods imported from third territories or third countries established by Council Directive 2006/112/EC (10) and on importations under customs procedure 42/63, and payment information stored in the central electronic system of payment information established by Regulation (EU) No 904/2010 (CESOP). The information stored within the Eurofisc Transaction Network Analysis (TNA) system is not subject to targeted searches by the EPPO or OLAF.

(14)

In order to protect access to personal data, only European Prosecutors and European Delegated Prosecutors, and identified staff of the EPPO and OLAF who have been previously authorised by the EPPO or OLAF, respectively, should be able to access VAT information to carry out their tasks. The competent authorities of the Member States should have access to audit logs of EPPO’s and OLAF’s access for information purposes, including the attribution of each access to specific investigation case files and users. The relevant parts of the audit log should be made available to the EPPO and OLAF for the purposes of internal control mechanisms concerning the correct access to and use of data in accordance with the applicable data protection legislation, the compliance with which is to be monitored by the Data Protection Officers designated in accordance with Regulations (EU) 2017/1939 and (EU, Euratom) No 883/2013. To ensure uniform conditions for such access, implementing powers should be conferred on the Commission in respect of the technical details concerning the centralised access, the technical data protection measures, the requirements of the audit log and practical arrangements for accessing it. Those powers should be exercised in accordance with Regulation (EU) No 182/2011.

(15)

This Regulation respects fundamental rights and observes the principles enshrined in the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data.

(16)

As the systems, infrastructure and technical means facilitating the exchange of VAT information at Union level need to be adapted to allow secure access by the EPPO and OLAF, it is necessary to defer the application of the relevant provisions to enable the Commission, the EPPO and OLAF to make the necessary adaptations. Those adaptations should take into account the date on which the central VIES is expected to become operational and the date on which the legacy system of exchange of VAT information established by Regulation (EU) No 904/2010 is expected to phase out. The EPPO and OLAF should be responsible for the costs of establishing and maintaining the relevant infrastructure and technical means for secure access to VAT information. When examining and evaluating the functioning of the arrangements for administrative cooperation provided for in Regulation (EU) No 904/2010, the Member States and the Commission should pay particular attention to the practical application and impact of the EPPO’s and OLAF’s centralised access to VAT information, including the effectiveness of the relevant systems, infrastructure and technical means.

(17)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 7 January 2026.

(18)

Regulation (EU) No 904/2010 should therefore be amended accordingly,

(1)

in Article 21, the following paragraph is inserted:

(*1)  Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (“the EPPO”) (OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj)."

(*2)  Decision 1999/352/EC, ECSC, Euratom of the Commission of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 20, ELI: http://data.europa.eu/eli/dec/1999/352/oj).’;"

(2)

Article 24d is replaced by the following:

(3)

in Article 24k, the following paragraph is inserted:

(4)

in Article 36, the following paragraphs are inserted:

(*3)  Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union’s financial interests by means of criminal law (OJ L 198, 28.7.2017, p. 29, ELI: http://data.europa.eu/eli/dir/2017/1371/oj)."

(*4)  Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/883/oj).’;"

(5)

in Article 49, paragraph 1 is replaced by the following:

(6)

in Chapter XIII, the following Articles are added: