The United States 

Department of theTreasury

TERRORIST FINANCE 

TRACKING PROGRAM

Questions and Answers

After the terrorist attacks on 

September 11, 2001, the United States 

Department of the Treasury initiated 

the Terrorist Finance Tracking 

Program (TFTP) to identify, track, and 

pursue terrorists–such as Al-Qaida–

and their networks. An agreement 

between the European Union (EU) and 

the United States (U.S.) on the transfer

and processing of data for purposes of 

the TFTP (the Agreement) entered into

force on August 1, 2010. This 

document is intended to answer many 

of the most common questions about 

the TFTP and the Agreement.
Q.1: What is the value of the TFTP?

A.1: Since its inception in 2001, the TFTP has provided valuable lead 

information that has helped discover planned terrorist attacks and 

has been used in the investigation of many notorious and violent 

terrorist attacks and attempted attacks, including, for example:

• the February 2020 attack in Vienna, Austria; 

• the August 2017 terror attack in Turku, Finland;

• the August 2017 La Rambla attack in Barcelona;

• the 2016 attacks in Brussels;

• the January and November 2015 attacks in Paris;

• the 2013 Boston Marathon bombings;

• threats to the 2012 London Summer Olympic games;

A significant number of TFTP-derived leads have been shared 

with European authorities and EU Member State Governments–

more than 160,930 through December 2022.

Q.2: What European bodies approved the Agreement?

A.2: Following the completion of negotiations, the Agreement was 

approved by the European Commission. The Agreement was then 

approved by the Council of the European Union and signed by the 

U.S. and the EU on June 28, 2010. The European Parliament gave 

its consent to the Agreement on July 8, 2010. The Agreement 

entered into force on August 1, 2010.

Q.3: Have any reviews of the TFTP taken place?

A.3: Yes. The EU and U.S. have conducted six Joint Reviews of the 

implementation and effectiveness of the Agreement, pursuant to 

Article 13 of the Agreement: February 2011, October 2012, April 
2014, March 2016, February 2019, and March 2022. In 

accordance with the Agreement, the EU delegations included 

European Commission officials, two data protection experts from 

EU member state data protection authorities. The EU delegations 

of the Joint Review teams reported their findings to the European 

Commission, and in March 2011, December 2012, August 2014, 

January 2017, July 22, 2019, and November 2022 the European 

Commission made those reports public. Those reports are 

available on the European Commission’s website: ec.europa.eu.

The U.S. government agrees with the reports’ findings that the

operation and implementation of the Agreement are consistent 

with the U.S. commitment to implement the robust data protection 

safeguards contained in the Agreement. The U.S. Treasury 

Department carefully considers the EU delegations’ 

recommendations as it continues to implement the Agreement, 

including continuing to engage in joint reviews.

It should be noted that the U.S. government committed itself to 

allow review of the TFTP even before the Agreement. The U.S.

government invited an independent person appointed by the EU to 

conduct a review of the TFTP in 2008 and 2009. Reports issued 

by this independent person in 2008 and in early 2010 concluded 

that the U.S. had implemented significant and effective controls 

and safeguards which ensure respect for the protection of personal 

data. The reports also stated that TFTP leads shared with EU 

authorities had not only been extremely valuable in investigating 

terrorist attacks which have taken place in Europe over the eight 

years preceding the reports, but had also been instrumental in 

preventing a number of terrorist attacks in Europe and elsewhere.

Q.4: How does the TFTP operate?

A.4: Under its domestic legal authorities, the U.S. Treasury 

Department prepares certain requests for data directed at data 
providers (Requests). Under the Agreement, the U.S. Treasury 

Department provides a copy of any Requests that concerns data 

stored in the EU, along with supplemental documents relating to 

the Requests, to Europol to verify that the Requests: clearly 

identify the data requested, is narrowly tailored, substantiates the 

necessity of the data, and does not seek Single Euro Payments 

Area data. Once Europol verifies that the Requests complies with 

the Agreement, it notifies the data provider and the data provider 

transmits the data to the U.S. Treasury Department. The U.S.

Treasury Department coordinates closely with Europol, since the 

entry into force of the Agreement, including by providing 

additional clarifying information in response to Europol inquiries.

Q.5: What are the safeguards protecting the data?

A.5: The protection of privacy and civil liberties is a top priority of 

the U.S. government. Consistent with this decision, and in 

accordance with past practice, the U.S. Treasury Department has 

applied strict controls to ensure data security and integrity, as 

well as to enforce appropriate limits on processing of data. 

Safeguards in the Agreement include the following:

• Data are maintained in a physically secure, stand-alone 

computer network–not connected to any other data 

system–and subject to highly limited access rights;

• Data may be searched only for counter-terrorism purposes 

and not for any other type of criminal activity or for any 

other purpose, including counter-proliferation;

• No search may be conducted on data unless a TFTP 

personnel provides pre-existing information 

demonstrating a nexus between the subject of the search 

and terrorism or its financing;

• The TFTP does not involve data mining or any other type 

of algorithmic or automated profiling or computer 

filtering;
• Detailed logs are maintained of all searches made, 

including the nexus to terrorism or its financing that is 

required to initiate the search;

• A select group of independent overseers, including one 

person appointed by the European Commission, have 

access to and authority to review all searches of the 

provided data undertaken by TFTP personnel. 

Independent overseers can block searches if they do not 

satisfy all of the safeguards; and

• The EU and the U.S. jointly review the implementation of 

the Agreement–with particular regard to the safeguards, 

controls, and reciprocity provisions set out in the 

Agreement–on a regular basis, and the European 

Commission thereafter presents a report on the review to 

the European Parliament and the Council.

The 2022 report prepared by the EU delegation of the Joint 

Review team and adopted by the European Commission 

expressed the Commission's full satisfaction that the TFTP 

Agreement and its robust data protection safeguards are being 

properly implemented, and that the oversight mechanism is 

effective and functioning smoothly.

An external auditing firm appointed by the data provider 

continues to perform a separate, independent audit. The external 

auditors have full access to all TFTP systems and personnel.

Q.6: What redress provisions are available to EU citizens and

residents?

A.6: Under the Agreement, persons may seek a confirmation whether 

their data protection rights have been respected, as well as 

rectification, erasure, or blocking of inaccurate data. Requests for 

confirmation or rectification may be submitted to the relevant 

European national data protection authority, which shall transmit 
the requests to the privacy officer of the U.S. Treasury 

Department. After an appropriate review, the privacy officer then 

must: (a) inform the relevant European national data protection 

authority whether personal data may be disclosed to the data 

subject or whether data have been rectified, as appropriate; 

(b) confirm whether the data subject’s rights have been duly 

respected; and (c) when access to or rectification of personal data 

is refused based on reasonable legal limitations, explain the 

refusal in writing and provide information on the means available 

for seeking administrative and judicial redress in the United 

States.

The Agreement further provides that any person who considers 

his or her personal data to have been processed improperly may 

seek effective administrative or judicial redress in accordance 

with the laws of the EU, its Member States, and the U.S. The U.S.

Treasury Department will treat all persons equally in the 

application of its administrative redress processes, regardless of 

nationality or country of residence.

Under U.S. law, any person, regardless of nationality or country 

of residence, can seek judicial redress from an adverse 

administrative action of the U.S. government. How best to do so 

involves answering legal questions–for example whether to make 

a claim under the Freedom of Information Act, the Judicial 

Redress Act, the Administrative Procedure Act, or some other 

law–for which it is often necessary to assess the specific 

circumstances of the adverse action. Other processes may also be 

available under U.S. law.

Q.7: What does rectification mean in the context of the TFTP?

A.7: In the event that it is notified of an error warranting rectification in

the financial payment messaging data it has received, the U.S.

Treasury Department will take appropriate steps to prevent the 

future use or dissemination of the erroneous data, and will 
annotate any existing documents produced from the erroneous 

data. To date, the U.S. Treasury Department has received no such 

notice.

Q.8: How can I find out more about available redress options?

A.8: The U.S. Treasury Department has made available on its website a

detailing the procedures for seeking administrative redress under 

the Agreement (see “Redress Procedures for Seeking Access, 

Rectification, Erasure, or Blocking,” available at treasury.gov/tftp).

For additional information or inquiries regarding procedures for 

seeking access, rectification, erasure, blocking, or redress under the 

Agreement, you may also contact the U.S. Department of the 

Treasury or your national data protection authority (“NDPA”). 

Contact information for each NDPA in each EU Member State can 

be found via the official website of the European Commission at 

ec.europa.eu.

Q.9: To whom should request for access, rectification, erasure, 

or blocking be sent?

A.9: Appropriate requests for access, rectification, erasure, or blocking 

should be transmitted through express courier (or any delivery 

service that provides confirmation tracking numbers) by the 

relevant NDPA to the following address: Privacy Officer / TFTP, 

JBAB, Building 410 (Door 123), 250 Murray Lane SW, 

Washington, DC, USA 20222.

Q.10: How long are data stored under the TFTP?

A.10: The U.S. has agreed to destroy data after five years, which is the 

same time period the EU uses under Directive 2015/849/EC (on 

the prevention of the use of the financial system for the purpose 

of money laundering and terrorist financing) and Regulation 

(EC) No.1781/2006 (on information on the payer 

accompanying transfers of funds). Leads generated for use in 
specific matters are retained for no longer than necessary for 

specific investigations or prosecutions for which they are used.

Q.11: I heard that the TFTP may be the reason my bank blocked a 

transaction to my account and my goods were stopped at a 

border crossing. Is that possible?

A.11: No. The TFTP cannot interdict or view “live” transactions as 

they occur; instead, it involves a narrow review of specific, 

financial transactions that already have occurred, in order to 

assist investigations of terrorist plots and activity.

Q.12: Does the U.S. send an EU customer’s transaction data to

countries outside of the EU?

A.12: The U.S. shares counter-terrorism leads generated by the TFTP 

with relevant governments for counter-terrorism purposes only. 

We do this consistent with UN Security Council Resolution 

1373 (2001), which includes provisions stating:

• that States shall take the necessary steps to prevent the 

commission of terrorist acts, including by provision of 

early warning to other States by exchange of information;

• that States shall afford one another the greatest measure 

of assistance in connection with criminal investigations 

or criminal proceedings relating to the financing or 

support of terrorist acts;

• that States should find ways of intensifying and 

accelerating the exchange of operational information;

• that States should exchange information in accordance 

with international and domestic law; and

• that States should cooperate, particularly through bilateral 

and multilateral arrangements and agreements, to prevent 

and sup-press terrorist attacks and to take action against 

perpetrators of such attacks.

The Agreement limits the transfer to third countries of EU 
persons’ data and authorizes such transfers only for counterterrorism purposes and subject to a variety of additional 

safeguards.

Q.13: Is the U.S. assisting the EU to develop an equivalent to the TFTP?

A.13: If the EU decides to establish an EU system, the U.S. has agreed 

to provide assistance and advice to contribute to the system’s 

effective establishment. U.S. and EU authorities would 

cooperate to ensure that the U.S. and EU systems are 

complementary and efficient in a manner that further enhances 

citizens’ security.