### 1. where , pursuant to article 25 of [op please insert the next number to the amld , com(2021)423] , a fiu of a member state identifies a potential need to conduct a joint analysis with one or several fius in other member states , it shall notify the authority thereof. the authority shall inform the fius in all the relevant member states and invite them to take part in the joint analysis within five days of the initial notification. to this end , the authority shall use secured channels of communication. the fius in all the relevant member states shall consider taking part in the joint analysis. the authority shall ensure that the joint analysis is launched within 20 days of the initial notification. ### 1. where , pursuant to article 25 of [op please insert the next number to the amld , com(2021)423] , a fiu of a member state identifies a potential need to conduct a joint analysis with one or several fius in other member states , it shall notify the authority thereof. within 10 working days , the authority shall assess the merits of such joint-analysis , in light of the priorities identified in the supervisory plan and of the available resources. the authority shall inform the fius in all the relevant member states and invite them to take part in the joint analysis within five days of the initial assessment. to this end , the authority shall use secured channels of communication. the fius in all the relevant member states shall consider taking part in the joint analysis. the authority shall ensure that the joint analysis is launched within 20 days of the initial assessment.


### 1. where , pursuant to article 25 of [op please insert the next number to the amld , com(2021)423] , a fiu of a member state identifies a potential need to conduct a joint analysis with one or several fius in other member states , it shall notify the authority thereof. the authority shall inform the fius in all the relevant member states and invite them to take part in the joint analysis within five days of the initial notification. to this end , the authority shall use secured channels of communication. the fius in all the relevant member states shall consider taking part in the joint analysis. the authority shall ensure that the joint analysis is launched within 20 days of the initial notification. ### 1. where , pursuant to article 25 of [op please insert the next number to the amld , com(2021)423] , a fiu of a member state identifies a potential need to conduct a joint analysis with one or several fius in other member states , it shall notify the authority thereof. the authority shall inform the fius in all the relevant member states and invite them to take part in the joint analysis within five days of the initial notification. the authority may also take the initiative to organise a joint analysis between two or more fius if it identifies a potential benefit. to this end , the authority shall use secured channels of communication. the fius in all the relevant member states shall consider taking part in the joint analysis. the authority shall ensure that the joint analysis is launched within 20 days of the initial notification.


### 3. upon explicit consent of the fius participating in the joint analysis , the staff of the authority supporting the joint analysis shall be granted access to all the data pertaining to the subject-matter of the joint analysis and shall be able to process those data. ### 3. the staff of the authority participating in the joint analysis shall be granted access to all the data pertaining to the subject-matter of the joint analysis and shall be able to process those data.


### 3. upon explicit consent of the fius participating in the joint analysis , the staff of the authority supporting the joint analysis shall be granted access to all the data pertaining to the subject-matter of the joint analysis and shall be able to process those data. ### 3. the staff of the authority organising the joint analysis shall be granted access to all the data pertaining to the subject-matter of the joint analysis and shall be able to process those data.


### 1. the fiu of each member state may delegate one staff member to the authority. the national fiu delegate shall have his or her regular place of work at the seat of the authority. ### 1. the fiu of each member state shall delegate one staff member to the authority. the national fiu delegate shall have his or her regular place of work at the seat of the authority.


### 2. the authority shall ensure uninterrupted functioning of the fiu.net and keep it and up to date. where necessary to support or strengthen the exchange of information and cooperation between the fius and based on the needs of fius , the authority shall design and implement , or otherwise make available , upgraded or additional functionalities of fiu.net. ### 2. the authority shall ensure uninterrupted functioning of the fiu.net and keep it and up to date. where necessary to support or strengthen the exchange of information and cooperation between the fius and based on the needs of fius , the authority shall design and implement , or otherwise make available , upgraded or additional functionalities of fiu.net. the authority shall ensure that fiu.net remains a decentralised computer network.


### the authority shall publish the fact that a supervisory authority does not comply or does not intend to comply with that guideline or recommendation. the authority may also decide , on a case-by-case basis , to publish the reasons provided by the supervisory authority for not complying with that guideline or recommendation. the supervisory authority shall receive advanced notice of such publication. ### the authority shall publish the fact that a supervisory authority does not comply or does not intend to comply with that guideline or recommendation and the reasons provided by the supervisory authority for not complying with that guideline or recommendation.


### if required by that guideline or recommendation , obliged entities shall report , in a clear and detailed way , whether they comply with that guideline or recommendation. ### obliged entities shall report , in a clear and detailed way , whether they comply with that guideline or recommendation.


### 4. the general board may decide to admit observers. in particular , the general board in fiu composition shall admit as an observer a representative of olaf , europol , eurojust and the eppo to meetings when matters fall under their respective mandates. the general board in supervisory composition shall admit a representative nominated by the supervisory board of the european central bank and a representative of each of the european supervisory authorities , where matters within the scope of their respective mandates are discussed. ### 4. the general board may decide to admit observers. in particular , the general board in fiu composition shall admit as an observer a representative of olaf , europol , eurojust and the eppo to meetings when matters fall under their respective mandates. the general board in supervisory composition shall admit a representative of the european central bank and a representative of each of the european supervisory authorities , where matters within the scope of their respective mandates are discussed. a representative of fra may also be invited as an observer to meetings of the general board.


### 5. the executive board shall select a vice-chair of the authority among its voting members. the vice-chair shall automatically replace the chair , if the latter is prevented from attending to his/her duties. ### deleted


### appointment of the chair of the authority ### appointment of the chair and of the vice-chair of the authority


### 2. if the chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council may , following a proposal by the general board in either composition , adopt an implementing decision to remove the chair of the authority from office. the council shall act by qualified majority. ### 2. if the chair or the vice-chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council may , following a proposal by the general board in either composition , and after approval of the european parliament , adopt an implementing decision to remove the chair or the vice-chair of the authority from office. the chair and vice-chair shall be accountable to parliament and council. parliament and council may also decide to deprive the chair or the vice-chair of his or her right to a pension or other benefits in case he or she is found guilty of serious misconduct. the council shall act by qualified majority.


### 2. if the chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council may , following a proposal by the general board in either composition , adopt an implementing decision to remove the chair of the authority from office. the council shall act by qualified majority. ### 2. if the chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council may , following a proposal by the general board in either composition and after having received the binding approval of the european parliament , adopt an implementing decision to remove the chair of the authority from office. the council shall act by qualified majority.


### 4. the executive director shall be selected on the grounds of merit and documented high-level administrative , budgetary and management skills , following an open selection procedure which shall be published in the official journal of the european union , and , as appropriate , other press or internet sites. the commission shall draw up a shortlist of two qualified candidates for the position of the executive director. the executive board shall appoint the executive director. ### 4. the executive director shall be selected on the grounds of merit and documented high-level administrative , budgetary and management skills , following an open selection procedure , which shall respect the principle of gender balance and which shall be published in the official journal of the european union , and , as appropriate , other press or internet sites. the commission shall draw up a gender-balanced shortlist of two qualified candidates for the position of the executive director. after the approval by the european parliament , the executive board shall appoint the executive director.


### the executive director may be removed from office by the executive board on proposal by the commission. ### the executive director may be removed from office by the executive board on proposal by the european parliament or by the commission.


### the executive director may be removed from office by the executive board on proposal by the commission. ### the executive director may be removed from office by the executive board on proposal by the commission or the european parliament.


### 2. the authority shall submit on an annual basis to the european parliament , to the council , and to the commission a report on the execution of the tasks conferred on it by this regulation , including information on the planned evolution of the structure and amount of the supervisory fees referred to in article 66. the chair of the authority shall present that report in public to the european parliament. ### 2. the authority shall submit on an annual basis to the european parliament , to the council , and to the commission a report on the execution of the tasks conferred on it by this regulation , including information on the planned evolution of the structure and amount of the supervisory fees referred to in article 66 as well on guidelines and recommendations it has issued following the procedure foreseen in article 43.the chair of the authority shall present that report in public to the european parliament.


### 2. the authority shall submit on an annual basis to the european parliament , to the council , and to the commission a report on the execution of the tasks conferred on it by this regulation , including information on the planned evolution of the structure and amount of the supervisory fees referred to in article 66. the chair of the authority shall present that report in public to the european parliament. ### 2. the authority shall submit on an annual basis to the european parliament , to the council , and to the commission a report on the execution of the tasks conferred on it by this regulation , including information on the planned evolution of the structure and amount of the supervisory fees referred to in article 66 , as well on guidelines and recommendations it has issued following the procedure set out in article 43.the chair of the authority shall present that report in public to the european parliament.


### 4. the authority shall reply orally or in writing to questions put to it by the european parliament. ### 4. the authority shall reply orally or in writing to questions put to it by the european parliament as soon as possible and in any case at the latest within five weeks of their notification to the authority.


### cooperation with european supervisory authorities and the european data protection board ### cooperation with european supervisory authorities and the european data protection supervisor


### 2. when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall closely cooperate with the european data protection board established by regulation (eu) 2016/679 to avoid duplication , inconsistencies and legal uncertainty in the sphere of data protection. ### 2. when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall closely cooperate with the european data protection supervisor established by regulation (eu) 2018/1725 to avoid duplication , inconsistencies and legal uncertainty in the sphere of data protection.


### 2. when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall closely cooperate with the european data protection board established by regulation (eu) 2016/679 to avoid duplication , inconsistencies and legal uncertainty in the sphere of data protection. ### 2. when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall consult the european data protection supervisor established by regulation (eu) 2018/1725 to avoid duplication , inconsistencies and legal uncertainty in the sphere of data protection.


### where relevant for the fulfilment of the tasks referred to in sections 3 and 6 of chapter ii , the authority may participate in existing cooperation arrangements established in one or across several member states by supervisory authorities or fius , where such arrangements involve , inter alia , cooperation and information exchange between the aforementioned authorities and selected obliged entities. participation of the authority shall be subject to consent of the relevant national authority that has established such arrangement. ### where relevant for the fulfilment of the tasks referred to in sections 3and 6 of chapter ii , the authority shall participate in existing cooperation arrangements established in one or across several member states by supervisory authorities or fius , where such arrangements involve , inter alia , cooperation and information exchange between the aforementioned authorities and selected obliged entities.


### 2. the authority shall establish and maintain a close relationship with olaf , europol , eurojust , and the eppo. to that end , the authority shall conclude separate working arrangements with olaf , europol , eurojust , and the eppo setting out the details of their cooperation. the relationship shall aim in particular to ensure the exchange of strategic information and trends in relation to money laundering and terrorist financing threats facing the union. ### 2. the authority shall establish and maintain a close relationship with olaf , europol , eurojust , and the eppo. to that end , by the end of 2024 , the authority shall have concluded separate working arrangements with olaf , europol , eurojust , and the eppo setting out the details of their cooperation. the relationship shall aim in particular to ensure the exchange of strategic information and trends in relation to money laundering and terrorist financing threats facing the union.


### 5. the executive board shall adopt practical measures for applying regulation (ec) no 1049/2001 and the rules regarding disclosure of information relating to supervisory procedures. ### 5. the executive board shall adopt practical measures for applying regulation (ec) no 1049/2001 and the rules regarding disclosure of information relating to supervisory procedures. the authority shall publish an annual report on the implementation of the regulation for the preceding year.


### the impact of the activities related to support and coordination of fius , and in particular the coordination of the joint analyses of cross-border activities and transactions conducted by fius; ### the impact of the activities related to support and coordination of fius , and in particular the organisation and coordination of the joint analyses of cross-border activities and transactions conducted by fius;


### (13) considering the important role of thematic reviews in aml/cft supervision across the union as they enable to identify and compare the level of exposure to risks and trends in relation to obliged entities under supervision , and that currently supervisors in different member states do not benefit from these reviews , it is necessary that the authority identifies national thematic reviews that have a similar scope and time-frame and ensures their coordination at the level of the union. to avoid situations of possibly conflicting communications with supervised entities , the coordination role of the authority should be limited to interaction with relevant supervisory authorities , and should not include any direct interaction with non-selected obliged entities. for the same reason , the authority should explore the possibility of aligning or synchronising the timeframe of the national thematic reviews and facilitate any activities that the relevant supervisory authorities may wish to carry out jointly or similarly. ### (13) considering the important role of thematic reviews in aml/cft supervision across the union as they enable to identify and compare the level of exposure to risks and trends in relation to obliged entities under supervision , and that currently supervisors in different member states do not benefit from these reviews , it is necessary that the authority identifies national thematic reviews that have a similar scope and time-frame and ensures their coordination at the level of the union. to avoid situations of possibly conflicting communications with supervised entities , the coordination role of the authority should be limited to interaction with relevant supervisory authorities , and should not include any direct interaction with non-selected obliged entities. for the same reason , the authority should align or synchronise the timeframe of the national thematic reviews , request additional thematic reviews if it identifies a gap in the areas covered and facilitate any activities that the relevant supervisory authorities may wish to carry out jointly or similarly.


### (35) the authority should manage , host , and maintain fiu.net , the dedicated it system allowing fius to cooperate and exchange information amongst each other and , where appropriate , with their counterparts from third countries and third parties. the authority should , in cooperation with member states , keep the system up-to-date. to this end , the authority should ensure that at all times the most advanced available state-of-the-art technology is used for the development of the fiu.net , subject to a cost-benefit analysis. ### (35) the authority should manage , host , and maintain fiu.net , the dedicated it system allowing fius to cooperate and exchange information amongst each other and , where appropriate , with their counterparts from third countries and third parties. the authority should , in cooperation with member states , keep the system up-to-date. to this end , the authority should ensure that at all times the most advanced available state-of-the-art technology is used for the development of the fiu.net , subject to a cost-benefit analysis. the authority should ensure that the fiu.net remains a decentralised computer network.


### (58) without prejudice to the obligations of the member states and their authorities , the processing of personal data on the basis of this regulation for the purposes of the prevention of money laundering and terrorist financing should be considered necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the authority under article 5 of regulation (eu) 2018/1725 of the european parliament and of the council41 and article 6 of regulation 2016/679of the european parliament and of the council42 . when developing any instruments or taking any decisions that may have a significant impact on the protection of personal data , the authority should closely cooperate , where relevant , with the european data protection board established by regulation (eu) 2016/679 and with the european data protection supervisor established by regulation (eu) 2018/1725 to avoid duplication. ### (58) without prejudice to the obligations of the member states and their authorities , the processing of personal data on the basis of this regulation for the purposes of the prevention of money laundering and terrorist financing should be considered necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the authority under article 5 of regulation (eu) 2018/1725 of the european parliament and of the council41 and article 6 of regulation 2016/679of the european parliament and of the council42 . when developing any instruments or taking any decisions that may have a significant impact on the protection of personal data , the authority should consult with the european data protection board established by regulation (eu) 2016/679 and with the european data protection supervisor established by regulation (eu) 2018/1725 to avoid duplication.


### 2. by the end of each year , the chair of the authority shall present to the general board in supervisory composition as referred to in article 46(2) a consolidated planning of the thematic reviews that supervisory authorities intend to undertake during the following year. ### 2. by the end of each year , the chair of the authority shall present to the general board in supervisory composition as referred to in article 46(2) a consolidated planning of the thematic reviews that supervisory authorities intend to undertake during the following year. the general board in supervisory composition may request that supervisory authorities include additional thematic reviews in their next working programme


### 2. the authority shall facilitate and encourage at least the following activities: ### 2. the authority shall organise , facilitate and encourage at least the following activities:


### 3. each supervisory authority may submit a request for mutual assistance related to its supervisory tasks to the authority , specifying the type of assistance that can be provided by the staff of the authority , the staff of one or more supervisory authorities , or a combination thereof. if the request concerns activities that relate to the supervision of specific obliged entities , the requesting supervisory authority shall ensure that access to any information and data necessary for the provision of assistance may be granted. the authority shall keep and regularly update the information on specific areas of expertise and on the capacities of supervisory authorities to provide mutual assistance. ### 3. each supervisory authority may submit a request for mutual assistance related to its supervisory tasks to the authority , specifying the type of assistance that can be provided by the staff of the authority , the staff of one or more supervisory authorities , or a combination thereof. if the request concerns activities that relate to the supervision of specific obliged entities , the requesting supervisory authority shall ensure that access to any information and data necessary for the provision of assistance may be granted. the authority shall keep and regularly update the information on specific areas of expertise and on the capacities of supervisory authorities to provide mutual assistance. the authority may identify potential areas of interest and invite supervisory authorities to request mutual assistance.


### with respect to customer-related risk: the share of non-resident customers , the presence and share of customers identified as politically exposed persons (‘peps’); ### with respect to customer-related risk: the share of non-resident customers , the presence and share of customers identified as politically exposed persons (‘peps’); and the share of final beneficiaries of union funds;


### 2. the jst coordinator shall ensure the coordination of the work within the joint supervisory team. joint supervisory team members shall follow the jst coordinator’s instructions as regards their tasks in the joint supervisory team. this shall not affect their tasks and duties within their respective financial supervisors. the jst coordinator shall be delegated from the authority to the financial supervisor in the member state where a selected obliged entity has its headquarters , upon agreement of the relevant financial supervisors. the duration of the delegation shall be limited to the time period during which the authority carries out supervisory tasks with respect to the selected obliged entity. ### 2. the jst coordinator shall ensure the coordination of the work within the joint supervisory team. joint supervisory team members shall follow the jst coordinator’s instructions as regards their tasks in the joint supervisory team. this shall not affect their tasks and duties within their respective financial supervisors. the jst coordinator shall be delegated from the authority to the financial supervisor in the member state where a selected obliged entity has its headquarters. the duration of the delegation shall be limited to the time period during which the authority carries out supervisory tasks with respect to the selected obliged entity.


### 1. the authority shall disclose to the public every administrative pecuniary sanction and periodic penalty payment that has been imposed on a selected obliged entity pursuant to articles 21 and 22 , unless such disclosure to the public would cause disproportionate damage to the parties involved. ### 1. the authority shall disclose to the public every administrative pecuniary sanction and periodic penalty payment that has been imposed on a selected obliged entity pursuant to articles 21 and 22.


### 3. the authority shall produce a report setting out the results of each assessment. that report shall be prepared by the staff of the authority , or by the staff of the authority jointly with the staff of the financial supervisors where the staff of financial supervisors were involved in the review on an ad-hoc basis. the report shall be adopted by the executive board , taking into account the observations of the general board in supervisory composition. the report shall explain and indicate any specific follow-up measures required to be taken by the financial supervisor or financial supervisors subject to the assessment that are deemed appropriate , proportionate and necessary as a result of the assessment. the follow-up measures may be adopted in the form of guidelines and recommendations pursuant to article 43 including recommendations addressed to all or several financial supervisors or to any specific financial supervisor , as appropriate. ### 3. the authority shall produce a report setting out the results of each assessment. that report shall be prepared by the staff of the authority , or by the staff of the authority jointly with the staff of the financial supervisors where the staff of financial supervisors were involved in the review on an ad-hoc basis. the report shall be adopted by the executive board , taking into account the observations of the general board in supervisory composition. the report shall explain and indicate any specific follow-up measures required to be taken by the financial supervisor or financial supervisors subject to the assessment that are deemed appropriate , proportionate and necessary as a result of the assessment. the follow-up measures may be adopted in the form of guidelines and recommendations pursuant to article 43 including recommendations addressed to all or several financial supervisors or to any specific financial supervisor , as appropriate. those guidelines and recommendations shall be published on the website on the authority at the same time as they are sent to the financial supervisors.


### assist in the organisation of college meetings , where requested by the relevant financial supervisors; ### organise college meetings , where requested by the relevant financial supervisors;


### assist in the organisation of joint supervisory plans and joint examinations; ### organise joint supervisory plans and joint examinations;


### 2. for the purposes of paragraph 1 , the staff of the authority shall have full participation rights in the aml supervisory colleges and shall be able to participate in their activities , including on-site inspections , carried out jointly by two or more financial supervisors. ### 2. for the purposes of paragraph 1 , the staff of the authority shall have full participation rights in the aml supervisory colleges and shall be able to organise and participate in their activities , including on-site inspections , carried out jointly by two or more financial supervisors.


### 5. the authority shall publish the findings of the peer review on its website and submit an opinion to the commission where , having regard to the outcome of the peer review or to any other information acquired by the authority in carrying out its tasks , it considers that further harmonisation of union rules applicable to obliged entities in the non-financial sector or to non-financial supervisors would be necessary from the union’s perspective. ### 5. the authority shall publish the findings of the peer review , as well as the guidelines and recommendations , on its website and submit an opinion to the commission where , having regard to the outcome of the peer review or to any other information acquired by the authority in carrying out its tasks , it considers that further harmonisation of union rules applicable to obliged entities in the non-financial sector or to non-financial supervisors would be necessary from the union’s perspective.


### the commission shall issue such a formal opinion within three months after the adoption of the recommendation. the commission may extend this period by one month. ### the authority shall issue such a formal opinion within three months after the adoption of the recommendation. the authority may extend this period by one month.


### the authority and the supervisory authority in the non-financial sector shall provide the commission with all necessary information. ### deleted


### 5. the supervisory authority in the non-financial sector shall , within ten working days of receipt of the formal opinion referred to in paragraph 5 , inform the commission and the authority of the steps it has taken or intends to take to comply with that formal opinion. ### 5. the supervisory authority in the non-financial sector shall , within ten working days of receipt of the formal opinion referred to in paragraph 5 , inform the authority of the steps it has taken or intends to take to comply with that formal opinion.


### the decision of the authority shall be in conformity with the formal opinion issued by the commission pursuant to paragraph 4. ### deleted


### 3. on the basis of the feedback referred to in paragraph 2 , or on its own initiative , the authority may issue follow-up reports relating to the conduct of joint analyses , including specific suggestions on adjustments regarding the methods and procedures for the conduct of the joint analyses , and conclusions on the outcome of the joint analyses. the procedural and operational aspects of the follow-up report shall be shared with all fius , without disclosing confidential or restricted information on the case. the conclusions and recommendations relating to the conduct of the joint analyses shall be shared with the fius that participated in the relevant joint analyses , and with all the other fius insofar as these conclusions do not contain confidential or restricted information. ### 3. on the basis of the feedback referred to in paragraph 2 , or on its own initiative , the authority shall issue follow-up reports relating to the conduct of joint analyses , including specific suggestions on adjustments regarding the methods and procedures for the conduct of the joint analyses , and conclusions on the outcome of the joint analyses. the procedural and operational aspects of the follow-up report shall be shared with all fius , without disclosing confidential or restricted information on the case. the conclusions and recommendations relating to the conduct of the joint analyses shall be shared with the fius that participated in the relevant joint analyses , and with all the other fius insofar as these conclusions do not contain confidential or restricted information.


### personnel exchanges and secondment schemes , including secondment of fiu staff from a member state to the authority; ### personnel exchanges and secondment schemes , including secondment of fiu staff from a member state to the authority or from the authority to the fius;


### 2. any fiu may submit to the authority a request for assistance related to the tasks of the fiu , specifying the type of assistance that can be provided by the staff of the authority , the staff of one or more than one fiu , or a combination thereof. the fiu requesting assistance shall ensure the access to any information and data necessary for the provision of such assistance. the authority shall keep and regularly update information on specific areas of expertise and capacity of fius to provide mutual assistance. ### 2. any fiu may submit to the authority a request for assistance related to the tasks of the fiu , specifying the type of assistance that can be provided by the staff of the authority , the staff of one or more than one fiu , or a combination thereof. the fiu requesting assistance shall ensure the access to any information and data necessary for the provision of such assistance. the authority shall keep and regularly update information on specific areas of expertise and capacity of fius to provide mutual assistance. the authority may also suggest assistance to fius.


### coordinate , manage and support any testing activities; ### organise , coordinate , manage and support any testing activities;


### 4. for the purposes of carrying out the tasks referred to in paragraphs 1 , 2 and 3 , the authority shall be empowered to conclude or enter into legally binding contracts or agreements with third party service providers. ### 4. for the purposes of carrying out the tasks referred to in paragraphs 1 , 2 and 3 , the authority shall have dedicated staff to ensure the functioning and security of fiu.net .


### before submitting them to the commission , the authority shall conduct open public consultations on draft regulatory technical standards and shall analyse the potential related costs and benefits , unless those consultations and analyses are highly disproportionate in relation to the scope and impact of the draft regulatory technical standards concerned or in relation to the particular urgency of the matter. ### before submitting them to the commission , the authority shall conduct open public consultations on draft regulatory technical standards and shall analyse the potential related costs and benefits.


### the commission shall conduct open public consultations on draft regulatory technical standards and analyse the potential related costs and benefits , unless such consultations and analyses are disproportionate in relation to the scope and impact of the draft regulatory technical standards concerned or in relation to the particular urgency of the matter. ### the commission shall conduct open public consultations on draft regulatory technical standards and analyse the potential related costs and benefits.


### 2. where appropriate , the european parliament or the council may invite the responsible commissioner , together with the chairperson of the authority , within one month of the notice referred to in paragraph 1 , for an ad hoc meeting of the competent committee of the european parliament or the council to present and explain their differences. ### 2. where appropriate , the european parliament or the council may invite the responsible commissioner , together with the chairperson of the authority , within three months of the notice referred to in paragraph 1 , for an ad hoc meeting of the competent committee of the european parliament or the council to present and explain their differences.


### before submitting draft implementing technical standards to the commission , the authority shall conduct open public consultations and shall analyse the potential related costs and benefits , unless such consultations and analyses are highly disproportionate in relation to the scope and impact of the draft implementing technical standards concerned or in relation to the particular urgency of the matter. ### before submitting draft implementing technical standards to the commission , the authority shall conduct open public consultations and shall analyse the potential related costs and benefits.


### 3. the authority may , upon a request from the european parliament , from the council or from the commission provide technical advice to the european parliament , the council and the commission in the areas set out in the legislative acts referred to in article 1(2). ### 3. the authority shall , upon a request from the european parliament , from the council or from the commission provide technical advice to the european parliament , the council and the commission in the areas set out in the legislative acts referred to in article 1(2).


### 3. the executive director shall decide whether it is necessary to locate one or more staff in one or more member states for the purpose of carrying out the authority's tasks in an efficient and effective manner. before deciding to establish a local office , the executive director shall obtain the prior consent of the commission , the executive board and the member state(s) concerned. the decision shall specify the scope of the activities to be carried out at the local office in a manner that avoids unnecessary costs and duplication of administrative functions of the authority. a headquarters agreement with the member state(s) concerned shall be concluded. ### deleted


### 2. the authority shall accede to the interinstitutional agreement concerning internal investigations by olaf and shall immediately adopt appropriate provisions for all staff of the authority. ### 2. by the end of 2024 , the authority shall have acceded to the interinstitutional agreement concerning internal investigations by olaf and shall have immediately adopted appropriate provisions for all staff of the authority.


### when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall , after being authorized by the commission , consult the european data protection supervisor established by regulation (eu) 2018/1725. the authority may also invite national data protection authorities as observers in the process of drafting such guidelines and recommendations. ### when drafting guidelines and recommendations in accordance with article 43 , having a significant impact on the protection of personal data , the authority shall consult the european data protection supervisor established by regulation (eu) 2018/1725. the authority may also invite national data protection authorities as observers in the process of drafting such guidelines and recommendations.


### 6. a delegated act adopted pursuant to article 25 and article 65 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of one month of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by one month at the initiative of the european parliament or of the council. ### 6. a delegated act adopted pursuant to article 25 and article 65 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of three months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by one month at the initiative of the european parliament or of the council.


### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate an adequate percentage of its it budget to improve its level of cybersecurity; in the longer term a target in the order of 10% should be pursued. ### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate adequate resources from its it budget to improve its level of cybersecurity and to ensure at least a minimum level of cybersecurity corresponding to the risk assessment. the cost of ensuring cybersecurity is dependent on several factors such as size of the entity , need to ensure specific protections , surface of attacks and threat profile , and include fixed costs and a variable portion. due to the ever increasing threats , in the longer term up to of 10% of an entity budget could be necessary to ensure an appropriate security level.


### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate an adequate percentage of its it budget to improve its level of cybersecurity; in the longer term a target in the order of 10% should be pursued. ### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate an adequate percentage of its it budget to improve its level of cybersecurity; in the longer term a target in the order at least 15% should be pursued.


### (14) in addition to giving cert-eu more tasks and an expanded role , an interinstitutional cybersecurity board (iicb) should be established , which should facilitate a high common level of cybersecurity among union institutions , bodies and agencies by monitoring the implementation of this regulation by the union institutions , bodies and agencies and by supervising implementation of general priorities and objectives by cert-eu and providing strategic direction to cert-eu. the iicb should ensure representation of the institutions and include representatives of agencies and bodies through the union agencies network. ### (14) in addition to giving cert-eu more tasks and an expanded role , an interinstitutional cybersecurity board (iicb) should be established , which should facilitate a high common level of cybersecurity among union institutions , bodies and agencies by monitoring the implementation of this regulation by the union institutions , bodies and agencies and by supervising implementation of general priorities and objectives by cert-eu and providing strategic direction to cert-eu. the iicb should ensure representation of the institutions and include representatives of agencies and bodies through the union agencies network and enforce a gender balanced appointment procedure. the iicb should require that all its members nominate a gender balanced representation.


### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that an adequate percentage of the it budget is spent on cybersecurity. ### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that adequate resources from the it budget are spent on cybersecurity.


### members may be assisted by an alternate. other representatives of the organisations listed above or of other union institutions , bodies and agencies may be invited by the chair to attend iicb meetings without voting power. ### members may be assisted by an alternate. other representatives of the organisations listed above or of other union institutions , bodies and agencies may be invited by the chair to attend iicb meetings without voting power. the nominations of members shall be made under the application of the principle of gender balance.


### members may be assisted by an alternate. other representatives of the organisations listed above or of other union institutions , bodies and agencies may be invited by the chair to attend iicb meetings without voting power. ### members shall be nominated on a gender balance principle and may be assisted by an alternate. other representatives of the organisations listed above or of other union institutions , bodies and agencies may be invited by the chair to attend iicb meetings without voting power.


### the commission shall propose the reallocation of staff and financial resources from relevant union institutions , bodies and agencies to the commission budget. the reallocation shall be effective at the same time as the first budget adopted following the entry into force of this regulation. ### the commission shall propose the reallocation of staff and financial resources from relevant union institutions , bodies and agencies to the commission budget. this reallocation shall be effective at the same time as the first budget adopted following the entry into force of this regulation. the reallocations shall be made under due consideration of the principle of gender balance.


### the commission shall propose the reallocation of staff and financial resources from relevant union institutions , bodies and agencies to the commission budget. the reallocation shall be effective at the same time as the first budget adopted following the entry into force of this regulation. ### the commission shall propose the reallocation of staff and financial resources from relevant union institutions , bodies , offices and agencies to the commission budget for the use of cert-eu operations. the reallocation shall be effective at the same time as the first budget adopted following the entry into force of this regulation.


### (22) all personal data processed under this regulation should be processed in accordance with data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council.7 ### (22) all personal data processed under this regulation should be processed in accordance with data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council , including its rules on international transfers.7 this regulation should be without prejudice to the application of existing eu legislation governing the processing of personal data , including the tasks and competences of the european data protection supervisor. all cybersecurity systems and services involved in the prevention , detection , and response to cyber threats should be compliant with the current data protection and privacy framework , and should take relevant technical and organisational safeguards to ensure this compliance in an accountable way.


### (15) ‘joint cyber unit’ means a virtual and physical platform for cooperation for the different cybersecurity communities in the union , with a focus on operational and technical coordination against major cross-border cyber threats and incidents within the meaning of commission recommendation of 23 june 2021; ### (15) ‘joint cyber unit’ means a platform for cooperation within the meaning of commission recommendation of 23 june 2021;


### 5. each union institution , body and agency shall appoint a local cybersecurity officer or an equivalent function who shall act as its single point of contact regarding all aspects of cybersecurity. ### 5. each union institution , body and agency shall appoint a local cybersecurity officer or an equivalent function who shall act as its single point of contact regarding all aspects of cybersecurity. the local cybersecurity officer shall cooperate with the data protection officer designated in accordance with article 43 of regulation (eu) 2018/1725 , when dealing with overlapping activities applying data protection by design and by default to cybersecurity measures , selecting cybersecurity measures that involve protection of personal data , integrated risk management , and integrated security incident handling;


### 5. each union institution , body and agency shall appoint a local cybersecurity officer or an equivalent function who shall act as its single point of contact regarding all aspects of cybersecurity. ### 5. each union institution , body and agency shall appoint a local cybersecurity officer or an equivalent function who shall act as its single point of contact regarding all aspects of cybersecurity. the local cybersecurity officer shall cooperate with the data protection officer in accordance with article 43of regulation (eu) 2018/1725 , when dealing with overlapping activities applying data protection by design and by default to cybersecurity measures , selecting cybersecurity measures that involve protection of personal data , integrated risk management , and integrated security incident handling;


### v cooperation and reporting obligations ### v cooperation and reporting obligations , personal data


### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council. ### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council.


### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the consent of that entity. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the entity affected by the incident. ### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the authorization of that entity. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the authorization of the entity affected by the incident.


### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the consent of that entity. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the entity affected by the incident. ### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the consent of that entity. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the entity affected by the incident. in all cases , personal data shall be treated in accordance with applicable gdpr provisions.


### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### deleted


### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own baselines and cybersecurity plans. ### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own baselines and cybersecurity plans , based on the common framework set by this regulation.


### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should approve a cybersecurity baseline that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity baseline in all union institutions , bodies and agencies. ### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of an eu common board working with the highest level of management of each union institution , body and agency , who should approve a cybersecurity baseline that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , must become an integral part of a cybersecurity baseline in all union institutions , bodies and agencies.


### (10) union institutions , bodies and agencies should assess risks related to relationships with suppliers and service providers , including providers of data storage and processing services or managed security services , and take appropriate measures to address them. these measures should form part of the cybersecurity baseline and be further specified in guidance documents or recommendations issued by cert-eu. when defining measures and guidelines , due account should be taken of relevant eu legislation and policies , including risk assessments and recommendations issued by the nis cooperation group , such as the eu coordinated risk assessment and eu toolbox on 5g cybersecurity. in addition , certification of relevant ict products , services and processes could be required , under specific eu cybersecurity certification schemes adopted pursuant to article 49 of regulation eu 2019/881. ### (10) union institutions , bodies and agencies should assess risks related to relationships with suppliers and service providers , including providers of data storage and processing services or managed security services , and take appropriate measures to address them. these measures should form part of the cybersecurity baseline and be further specified in guidance documents or recommendations issued by cert-eu. when defining measures and guidelines , due account should be taken of relevant eu legislation and policies , including risk assessments and recommendations issued by the nis cooperation group , such as the eu coordinated risk assessment and eu toolbox on 5g cybersecurity. in addition , considering the threat landscape and the importance of building up resilience for the union institutions , bodies and agencies certification of relevant ict products , services and processes must be required , under specific eu cybersecurity certification schemes adopted pursuant to article 49 of regulation eu 2019/881.


### (16) the iicb should monitor compliance with this regulation as well as follow-up of guidance documents and recommendations , and calls for action issued by cert-eu. the iicb should be supported on technical matters by technical advisory groups composed as the iicb sees fit which should work in close cooperation with cert-eu , the union institutions , bodies and agencies and other stakeholders as necessary. where necessary , the iicb should issue non-binding warnings and recommend audits. ### (16) the iicb should monitor compliance with this regulation as well as follow-up of guidance documents and recommendations , and calls for action issued by cert-eu. the iicb should be supported on technical matters by technical advisory groups , including data protection institutions such as edps , which should work in close cooperation with cert-eu , the union institutions , bodies and agencies and other stakeholders as appropriate. where necessary , the iicb should issue warnings and requests for audits.


### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . where appropriate , dedicated arrangements between the two entities should be established to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with the european union agency for cybersecurity on threat analysis and share its threat landscape report with the agency on a regular basis. ### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . dedicated arrangements between the two entities shall be established , within the two first years of entry into force of this regulation , to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with the european union agency for cybersecurity on threat analysis and share its threat landscape report with the agency on a regular basis.


### (24) as the services and tasks of cert-eu are in the interest of all union institutions , bodies and agencies , each union institution , body and agency with it expenditure should contribute a fair share to those services and tasks. those contributions are without prejudice to the budgetary autonomy of the union institutions , bodies and agencies. ### (24) as the services and tasks of cert-eu are in the interest of all union institutions , bodies and agencies , each union institution , body and agency with it expenditure should contribute proportionally to those services and tasks. those contributions are without prejudice to the budgetary autonomy of the union institutions , bodies and agencies.


### (25) the iicb , with the assistance of cert-eu , should review and evaluate the implementation of this regulation and should report its findings to the commission. building on this input , the commission should report to the european parliament , the council , the european economic and social committee and the committee of the regions. ### (25) the iicb , with the assistance of cert-eu , should review and evaluate the implementation of this regulation and should report its findings to the commission. building on this input , the commission should report to the european parliament , the council , the european economic and social committee and the committee of the regions every year.


### obligations on union institutions , bodies and agencies to establish an internal cybersecurity risk management , governance and control framework; ### obligations on union institutions , bodies , offices and agencies to establish an internal cybersecurity risk management , governance and control framework;


### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency; ### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency and without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility;


### (7) ‘significant incident’ means any incident unless it has limited impact and is likely to be already well understood in terms of method or technology; ### (7) ‘significant incident’ means any incident unless it has limited impact , is already well understood in terms of method or technology and has been mitigated;


### (8) ‘major attack’ means any incident requiring more resources than are available at the affected union institution , body or agency and at cert-eu; ### (8) ‘major attack’ means any incident requiring more resources than are available at the affected union institution , body or agency;


### (14) ‘cybersecurity risk’ means any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems; ### (14) ‘cybersecurity risk’ means any identifiable circumstance or event having a potential adverse effect on the security of network and information systems;


### 1. each union institution , body and agency shall establish its own internal cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation]. ### 1. based on an full cybersecurity audit each union institution , body and agency shall establish its own internal cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management and be in its responsibility in order to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation].


### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance of their organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility. ### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance of their organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility , such as data protection.


### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity baseline to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy. the cybersecurity baseline shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii. ### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity baseline to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy in full compliance with the requirements of this regulation , following the guidance and recommendations of iicb and cert-eu and implementing the applicable eu cybersecurity schemes. the cybersecurity baseline shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii.


### 2. the senior management of each union institution , body and agency shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation. ### 2. the management and staff of each union institution , body and agency shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation.


### each union institution , body and agency shall carry out a cybersecurity maturity assessment at least every three years , incorporating all the elements of their it environment as described in article 4 , taking account of the relevant guidance documents and recommendations adopted in accordance with article 13. ### each union institution , body and agency shall carry out a cybersecurity maturity assessment at least every two years , incorporating all the elements of their it environment as described in article 4 , taking account of the relevant guidance documents and recommendations adopted in accordance with article 13. the maturity assessment must be based on cybersecurity audits.


### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework and the cybersecurity baseline. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response and recovery , such as security monitoring and logging. the plan shall be revised at least every three years , following the maturity assessments carried out pursuant to article 6. ### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework and the cybersecurity baseline. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response and recovery , such as security assessment of the suppliers and services , monitoring and logging. the plan shall be revised at least every two years , following the maturity assessments carried out pursuant to article 6.


### 2. the cybersecurity plan shall include staff members’ roles and responsibilities for its implementation. ### 2. the cybersecurity plan shall include staff members’ roles , preparedness and responsibilities for its implementation.


### 3. the cybersecurity plan shall consider any applicable guidance documents and recommendations issued by cert-eu. ### 3. the cybersecurity plan shall include the measures foreseen in all applicable guidance documents and recommendations issued by cert-eu.


### monitoring the implementation of this regulation by the union institutions , bodies and agencies; ### monitoring the implementation of this regulation by the union institutions , bodies and agencies and making recommendations for achieving a common high level of cybersecurity;


### establish as many technical advisory groups as necessary to assist the iicb’s work , approve their terms of reference and designate their respective chairs. ### establish technical advisory groups to assist the iicb’s work , approve their terms of reference and designate their respective chairs.


### recommend a relevant audit service to carry out an audit. ### request a relevant audit service to carry out an audit;


### raise to the attention of the iicb any issue relating to the implementation of this regulation and of the implementation of the guidance documents , recommendations and calls for action; ### raise to the attention of the iicb any issue relating to the implementation of this regulation and of the implementation of the guidance documents , recommendations and calls for action and make proposals for recommendations;


### 5. cert-eu may provide the following services not described in its service catalogue (‘chargeable services’): ### 5. cert-eu may provide to the union institutions , bodies , offices and agencies the following services not described in its service catalogue (‘chargeable services’):


### 6. cert-eu may organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with the european union agency for cybersecurity whenever applicable , to test the level of cybersecurity of the union institutions , bodies and agencies. ### 6. cert-eu shall organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with the european union agency for cybersecurity whenever applicable , to test the level of cybersecurity of the union institutions , bodies , offices and agencies on a regular basis.


### 7. cert-eu may provide assistance to union institutions , bodies and agencies regarding incidents in classified it environments if it is explicitly requested to do so by the constituent concerned. ### 7. cert-eu shall provide assistance to union institutions , bodies , offices and agencies regarding incidents in classified it environments if it is explicitly requested to do so by the constituent concerned.


### proposals to the iicb for recommendations addressed to individual union institutions , bodies and agencies. ### proposals to the iicb for recommendations addressed to individual or all union institutions , bodies , offices and agencies.


### where appropriate , the use of common technology , architecture and associated best practices with the aim of achieving interoperability and common standards within the meaning of article 4(10) of directive [proposal nis 2]. ### where appropriate , the use of common technology , open-source architecture and associated best practices with the aim of achieving control , interoperability and common standards within the meaning of article 4(10) of directive [proposal nis 2].


### 1. the commission , after having obtained the unanimous approval of the iicb , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post. ### 1. the commission , after having obtained the unanimous approval of the iicb , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post. the final list of candidates shall include at least one men and one woman.


### 2. cert-eu may exchange incident-specific information with national counterparts in the member states to facilitate detection of similar cyber threats or incidents without the consent of the affected constituent. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the affected constituent. ### 2. cert-eu may exchange incident-specific information with national counterparts in the member states to facilitate detection of similar cyber threats or incidents without the authorization of the affected constituent , as long as personal data is protected according to applicable gdpr provisions.. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the authorization of the affected constituent and in full compliance with applicable gdpr provisions.


### in duly justified cases and in agreement with cert-eu , the union institution , body or agency concerned can deviate from the deadline laid down in the previous paragraph. ### deleted


### 2. the union institutions , bodies and agencies shall contribute to the inventory of technical expertise by providing an annually updated list of experts available within their respective organisations detailing their specific technical skills. ### 2. the union institutions , bodies and agencies shall contribute to the inventory of available technical expertise by providing an annually updated list of experts available within their respective organisations detailing their specific technical skills.


### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major attack in a member state , in line with the joint cyber unit’s operating procedures. ### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major attack in a member state , in line with the joint cyber unit’s operating procedures. specific rules on access to and use of technical experts from union institutions , bodies , offices and agencies shall be approved by iicb at the proposal of cert eu.


### (7) system acquisition , development and maintenance; ### (7) system acquisition , development , maintenance and transparency of the source code;


### (5) to avoid an excessively regressive impact on contributions from the emissions trading , a maximum contribution should be established for eligible member states. for the period from 2023 to 2027 , member states are eligible if the gross national income per capita , measured in purchasing power standard and calculated on the basis of union figures for 2020 is below 90% of the eu average. for the period from 2028 to 2030 , the gross national income per capita in 2025 should be used. the maximum contribution should be established by comparing member states’ shares in the total emission trading based own resource with the shares of those member states in the union gross national income. a minimum contribution should be established for all member states if their share of the total amount of ets-based own resources is lower than 75% of their share in the union gross national income. ### (5) to avoid an excessively regressive impact on contributions from the emissions trading , a maximum contribution should be established for eligible member states until 2030. for the period from 2023 to 2027 , member states are eligible if the gross national income per capita , measured in purchasing power standard and calculated on the basis of union figures for 2020 is below 90% of the eu average. for the period from 2028 to 2030 , the gross national income per capita in 2025 should be used. the maximum contribution should be established by comparing member states’ shares in the total emission trading based own resource with the shares of those member states in the union gross national income. a minimum contribution should be established for all member states if their share of the total amount of ets-based own resources is lower than 75% of their share in the union gross national income.


### the application of a uniform rate of 25% to: ### the application of a uniform rate of 50% to:


### the application of a uniform call rate equal to 75% of the revenues from the sale of certificates of the carbon border adjustment mechanism established by regulation (eu) [xxx] of the european parliament and of the council18 . ### the application of a uniform call rate equal to 100% of the revenues from the sale of certificates of the carbon border adjustment mechanism established by regulation (eu) [xxx] of the european parliament and of the council18 .


### the application of a uniform call rate of 15% to the share of residual profit of multinational enterprises reallocated to member states pursuant to [the directive on implementation of the global agreement on re-allocation of taxing rights19 .] ### the application of a uniform call rate of 15% to the share of residual profit of multinational enterprises reallocated to member states pursuant to [the directive on implementation of the global agreement on re-allocation of taxing rights19 .] , provided that the oecd/g20 if pillar 1 agreement has been successfully implemented by a critical mass of countries by 1 january 2025.


### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; ### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements , or any allowances or rights of the displaced workers , to ensure full additionality of the allocation;


### 3. welcomes the measures undertaken by the french authorities , such as the provisions of the new emergency legislation , the support plan for the aeronautics industry and the long-term part-time activity programme which significantly reduced the number of redundancies; ### deleted


### 5. recalls that the social impacts of the redundancies are expected to be important for both regions , and that in the first quarter of 2021 , the amount of unemployed persons already stood at 9 ,4 % in occitanie and 6 ,9 % in pays de la loire1; ### 5. recalls that the social impacts of the redundancies are expected to be important for both regions , and that in the first quarter of 2021 , the percentage of unemployed persons already stood at 9 ,4 % in occitanie and 6 ,9 % in pays de la loire1


### 8. recalls that personalised services to be provided to the workers and self-employed persons consist of the following actions: start-up grants , business creation training , allowances for expenditure related to business creation training , as well as salary top-ups; ### 8. insists that personalised services to be provided to the workers and self-employed persons that consist of the following actions: start-up grants , business creation training , allowances for expenditure related to business creation training , as well as salary top-ups must prepare them for a green and digital european economy and therefore fasten the twin transitions;


### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; ### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements , or any allowances or rights of the recipients of the egf allocation to ensure full additionality of the allocation;


### 11. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; ### 11. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements , or any allowances or rights of the displaced workers , to ensure full additionality of the allocation;


### 1. stresses the key role of cohesion policy in fostering economic , social and territorial convergence across the eu; expresses concern , however , about persistent inequalities , socio-economic disparities and uneven demographic decline , with many less developed regions falling behind and getting caught in a ‘development trap’ in the wake of the covid-19 pandemic; ### 1. stresses the key role of cohesion policy in fostering economic , social and territorial convergence across the eu; expresses concern , however , about persistent inequalities , socio-economic disparities and uneven demographic decline , with many less developed regions falling behind and getting caught in a ‘development trap’ in the wake of the covid-19 pandemic; notes with concern the severe drop in recent years of an adequate level of national funding of member states' towards their poorer regions; recalls the importance of respecting the eu rule on additionality;


### 2. recalls that cohesion policy , with a budget of eur 392 billion between 2021 and 2027 , remains the eu’s primary investment tool and notes that its share of public investment in member states increased considerably over the 2014-2020 period; ### 2. recalls that cohesion policy , with a budget of eur 392 billion between 2021 and 2027 , remains the eu’s primary investment tool and notes that its share of public investment in member states increased considerably over the 2014-2020 period; is convinced that cohesion policy can only continue to play its present role as a vector for investment and job creation and a solidarity mechanism for all eu regions if it has solid funding and is guided by a strategic approach; underlines that the current cohesion policy is just enough to halt the further economic separation of european regions , but that it is not able to reverse the trend;


### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff; ### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; calls on the commission to ensure that national authorities duly take into account internal cohesion while drafting and implementing structural and investment funds’ projects; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes without jeopardizing compliance with the charter of fundamental rights , rule of law , and the european code of conduct on partnership; stresses that the european commission should diligently implement the guidance on "do no significant harm" in the negotiation of the programmes as well as through the entire implementation process and should monitor carefully all projects in this respect; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments and in the "reste à liquider" (ral) in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff;


### 5. welcomes the flexibility introduced through the cohesion’s action for refugees in europe (care) proposals to help member states deal with the impact of the war in ukraine , following the model of the coronavirus response investment initiatives , crii and crii+; underlines , however , that cohesion policy funding must primarily serve its long-term policy objectives and not become a source of financing to make up for shortcomings in budgetary flexibility or crisis response mechanisms within the mff. ### 5. welcomes the flexibility introduced through the cohesion’s action for refugees in europe (care) proposals to help member states deal with the impact of the war in ukraine , following the model of the coronavirus response investment initiatives , crii and crii+; highlights that this flexibility undermines the strategic approach of cohesion policy that aims to tackle regional disparities across the eu in the long-run , with a dedicated budget for climate and a thematic concentration for specific policy objectives and , in particular , strengthening resilience , and that cohesion policy must not become a source of financing to make up for shortcomings in budgetary flexibility or crisis response mechanisms within the mff.


### 10. points out that air france regularly offers trainings for its staff in which attention is paid to digital skills and skills required in a resource-efficient economy , as part of it 'skills development plan' and welcomes that those trainings remain available to the displaced workers for the duration of their participation in the egf measures; ### 10. points out that air france regularly offers trainings for its staff in which attention is paid to digital skills and skills required in a resource-efficient economy , as part of it 'skills development plan' and welcomes that those trainings remain available to the displaced workers for the duration of their participation in the egf measures; stresses the importance of preparing workers for a green and digital european economy and therefore hastening the twin transitions;


### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; ### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; or any allowances or rights of the displaced workers , to ensure full additionality of the allocation;


### 1. welcomes the council’s conclusions on enhancing the european financial architecture for development and underlines the key role of the ‘neighbourhood , development and international cooperation instrument – global europe‘ , the european fund for sustainable development plus (efsd+) and the external action guarantee in providing a strategic framework for blended finance and guarantees and in mobilising resources from the private sector with the support of the eu budget; ### 1. takes note of the council’s conclusions on enhancing the european financial architecture for development (efad) and underlines the key role of the ‘neighbourhood , development and international cooperation instrument – global europe‘ , the european fund for sustainable development plus (efsd+) and the external action guarantee in providing a strategic framework for blended finance , de-risking investments and guarantees and in mobilising resources from the private sector with the support of the eu budget; takes notes of the commission's roadmap for an improved european financial architecture for development and the 2021 progress report; expects the eib and ebrd to ensure that all projects , and in particular blended finance projects contribute to development goals and benefit the least developed countries;


### 1. welcomes the council’s recognition that an enhanced european financial architecture for development (efad) should follow the ‘policy first’ principle and stresses that the eu’s crucial efforts in development cooperation must be consistent with other eu external activities and in line with its strategic interests , and especially with the eu’s values; ### 1. welcomes the council’s recognition that a new european financial architecture for development (efad) should follow the ‘policy first’ principle and stresses that the eu’s crucial efforts in development cooperation respecting the interests of partner countries must be consistent with other eu external activities and in line with its strategic interests , its transformation needs , and especially with the eu’s values , including rule of law , democracy , human rights , gender equality and climate;


### 2. stresses that despite some recent improvements , the current status quo is characterised by a lack of coordination , fragmentation , duplication and continued competition between the european investment bank (eib) , the european bank for reconstruction and development (ebrd) and european development and finance institutions; underlines the need to make the current system more efficient and focused to ensure an optimal use of resources , a better return on eu taxpayers’ money and a stronger development impact; ### 2. recognises the progress and improvements made under efad since the council’s conclusions in terms of enhancing coordination and cooperation between the european investment bank (eib) , the european bank for reconstruction and development (ebrd) and european development and finance institutions; underlines the need to make the current system more efficient and focused to ensure an optimal use of resources , a better return on eu taxpayers’ money and a stronger development impact; calls for further efforts to ensure better coordination and avoid fragmentation , duplication and inefficient competition; calls on the commission to play a more active role in giving political guidance , in particular clearer policy direction and orientations , for the implementation of the efad , to ensure high standards and sound development banking prevail;


### 2. calls on the commission to move forward from the current status quo and provide a strong and clear policy steer to ensure consistency of eu action as team europe by applying the enhanced efad in the successful implementation of european initiatives , such as the global gateway strategy , the green deal or the strategic compass after its adoption , in order to strengthen the eu’s strategic autonomy and promote the eu’s values through its partnerships; ### 2. calls on the commission to move forward from the current status quo and provide a strong and clear policy steer to ensure consistency of eu action as team europe by applying the new efad in the successful implementation of european initiatives , such as the global gateway strategy , the green deal or the strategic compass after its adoption , in order to strengthen the eu’s strategic sovereignty , strategic solidarity with like-minded countries , and the union’s ability to contribute to international stability , security and peace , in particular as regards the promotion and respect for international law , in close cooperation with the un , nato , osce , au and partner countries , or if needed , alone and to promote the eu’s values through its partnerships;


### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests and values; ### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests and values; underlines that ensuring development and financial additionality as well as country ownership and development effectiveness with a focus on results are a prerequisite for projects financed through the efad;


### 3. recognises that the european financial architecture for development is mainly focused on least developed and fragile countries , particularly in sub-saharan africa; recalls , however , that a considerable share of investments is channelled to the western balkans and the eastern and southern neighbourhood , and underlines the need to provide funding to deal with new challenges and support new priorities in these regions; calls on the commission , the eib , the ebrd and european development and finance institutions to work on action plans for the reconstruction of ukraine as soon as it is re-established as a sovereign and independent country after the war; ### 3. recognises that the european financial architecture for development should be mainly focused on least developed and fragile countries , particularly in sub-saharan africa; recalls , however , that a considerable share of investments is channelled to the western balkans and the eastern and southern neighbourhood , and underlines the need to provide funding to deal with new challenges and support new priorities in least developed regions; calls on the commission , the eib , the ebrd and european development and finance institutions to work on action plans for the reconstruction of ukraine after the war , to build back better , greener and in a more inclusive approach , without jeopardising development goals for least developed countries;


### 3. reaffirms the specific role and responsibility of the european investment bank (eib) as the eu’s financial arm with a global reach; calls for the eib to be further capitalised on as an exclusively eu-owned tool for reinforcing the eu’s external policy priorities; welcomes , in this regard , the establishment of eib global; ### 3. reaffirms the specific role and responsibility of the european investment bank (eib) as the eu’s financial arm with a global reach; calls for the eib to be further capitalised on as an exclusively eu-owned tool for reinforcing the eu’s external policy priorities; notes , in this regard , the establishment of eib global;


### 3. underlines the interconnection between development and security; highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored development-security nexus; ### 3. highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored development-security nexus which does not promote an economic vision of development which emphasizes the role of infrastructure and construction and related employment while obscuring the important dimensions of food and nutrition insecurity , failing governance and lack of access to essential services , human rights violations , climate change , unequal wealth distribution and gender inequality;


### 4. calls on the eib , the ebrd and european development and finance institutions to strengthen their cooperation within the efsd+ open architecture by taking a team europe approach; stresses the need for greater specialisation and a better division of labour to ensure synergies and complementarities; underlines the need to move away from the current project-based approach towards sector-based programming involving all stakeholders from the start , including private investors , to increase leverage and impact; ### 4. calls on the eib , the ebrd and european development and finance institutions to strengthen their cooperation within the efsd+ open architecture by taking a team europe approach; recalls the european parliament’s key role in scrutinising the objectives of team europe; calls in this context for a solid level playing field in terms of governance of the efsd+ and access to eu resources as key for a fruitful cooperation among european dfis members of efad; stresses the need for greater specialisation and a better division of labour to ensure synergies and complementarities;