Jean-Claude Trichet: Interception of bank transfer data from the SWIFT system
by the US secret services
Statement by Mr Jean-Claude Trichet, President of the European Central Bank, at the public hearing
at the European Parliament on the interception of bank transfer data from the SWIFT system by the
US secret services, Brussels, 4 October 2006.
* * *
Madame la Présidente, Monsieur le Président, Mesdames et Messieurs les membres de la
commission des libertés civiles, de la justice et des affaires intérieures, Mesdames et Messieurs les
membres de la commission des affaires économiques et monétaires,
Je suis ici aujourd'hui pour vous expliquer plus en détail le rôle de la BCE dans la surveillance de
SWIFT après que SWIFT a répondu aux citations à comparaître émises par le Trésor américain en
vertu de son Programme de traque du financement du terrorisme (Terrorist Finance Tracking
Programme). Comme je l'ai déjà expliqué dans ma lettre du 3 août 2006 en réponse à M. le
Parlementaire Klinz, la BCE est membre du Groupe de surveillance de SWIFT
(SWIFT's
Co-operative Oversight Group - OG). Par conséquent, je voudrais, dans la première partie de ma
déclaration, préciser les objectifs et le mandat de ce Groupe de surveillance. Dans un deuxième
temps, j'exposerai les contraintes juridiques découlant des statuts du Système européen de banques
centrales et de la Banque centrale européenne dans ce domaine, y compris le régime de
confidentialité en vigueur. À la suite de la déclaration de M. Praet, je serai à votre disposition pour
répondre à toutes vos questions.
1. Umfang der Aufsichtstätigkeit
Zunächst einmal möchte ich darauf eingehen, was die Aufsichtstätigkeiten der Zentralbanken
umfassen und wie dies im Fall von SWIFT in der Praxis umgesetzt wird. Wie Ihnen bekannt sein
dürfte, sind die Zahlungs- und Wertpapierinfrastrukturen vielfältigen Risiken ausgesetzt,
beispielsweise Kreditrisiken, Liquiditätsrisiken und operationellen Risiken, die dem Systembetreiber,
den Systemteilnehmern und auch der breiten Öffentlichkeit Kosten verursachen können. Unter
bestimmten Umständen können diese Risiken sogar systemisch werden. Erfolgt nämlich seitens einer
Bank keine Verrechnung, kann dies in einigen Fällen die Fähigkeit anderer Banken, bereits
abgewickelte Geschäfte reibungslos zu verrechnen, beeinträchtigen und somit eine Kettenreaktion
auslösen, die zur Destabilisierung des gesamten Finanzsystems führen kann.
Similarly, delays in settling transactions by a participant will typically affect the ability of other
participants to pay. If the functioning of the system as a whole is disrupted, its participants and
possibly the general public might be adversely affected. In such cases, individual participants (or the
system operator) externalise costs to other parties and therefore do not necessarily have sufficient
incentives to act prudently and avoid risk. This is particularly true if the participants or operator assume
that they are "too big to fail" and expect that a public authority will intervene in a crisis situation. The
central bank oversight function represents one form of public involvement in controlling such systemic
risks. It aims to ensure that both participants and operators have adequate incentives to act prudently,
avoid risk and minimise social costs.
SWIFT is the most important provider of messaging services for financial transactions in the world. As
a consequence, the sound functioning of SWIFT is a precondition for the overall smooth functioning of
payment and settlement systems and, as such, also for financial stability. As a matter of fact, any
disruption of SWIFT's messaging activity could trigger further disruption amongst its users, which
include a very large number of systemically important payment and settlement systems.
In view of SWIFT's critical role in the smooth functioning of the global financial system, the G10 central
banks decided to set up a special cooperative framework for the oversight of SWIFT. This oversight
framework was formalised in 2004 through the establishment of the Oversight Group. The ECB
participates in this Group, which is led by the National Bank of Belgium (NBB). The ECB's involvement
in the oversight of payment and clearing systems is based on its role, under the EC Treaty, "to
promote the smooth operation of payment systems". The safe and efficient functioning of market
infrastructure, and of payment systems in particular, is also an indispensable precondition for the
proper implementation of two other core central bank tasks, namely to maintain financial stability and
to ensure price stability through the smooth implementation of monetary policy operations.
The Oversight Group has been given a very specific mandate. Its role is not to assess the entirety of
risks which may occur. Rather, the Oversight Group monitors SWIFT's activities only insofar as they
are relevant to the smooth functioning of payment systems and to financial stability. To that end, it
assesses whether SWIFT has in place the appropriate governance arrangements, risk management
procedures and controls to prevent and/or address effectively the risks posed to the smooth
functioning of payment systems and financial stability. The monitoring of activities that do not affect the
proper functioning of market infrastructure and financial stability is outside the Oversight Group's remit.
It is important to understand that SWIFT is not a "payment" or "clearing" system, or a financial
institution. As a consequence, in performing their oversight role, the overseers of SWIFT have limited
competences vis-à-vis SWIFT. Indeed, oversight of SWIFT is not based on a comprehensive legal
framework, contrary to, for instance, the supervision of financial institutions. For example, the
Oversight Group cannot impose any sanctions on SWIFT to enforce decisions. Therefore, overseers
rely mainly on "moral suasion" to convince SWIFT of the need to improve the sound functioning of its
systems.
The Oversight Group was informed in 2002 about the subpoenas issued by the US Treasury. As you
know, these subpoenas were part of a US programme to track terrorist financing, targeted to specific
investigations. The Group considered that this matter would not have financial stability implications
and therefore concluded that it fell totally outside the remit of its oversight role.
I would like to stress that the SWIFT Oversight Group did not give SWIFT any kind of approval or
"blessing" in relation to its compliance with the US subpoenas. The Oversight Group could not in fact
have given such an authorisation, as it was outside its competence to do so. As the overseers'
competences only relate to oversight, they are obliged to refrain from any actions that go beyond
these parameters. SWIFT therefore remained solely responsible for its decisions concerning
compliance with the US subpoenas.
The question has recently been raised whether the Oversight Group should not have considered
SWIFT's compliance with applicable data protection rules. However, the task of protecting personal
data is outside the remit of the Group's oversight function, since it is unrelated to the functioning of
market infrastructure and financial stability. If the Oversight Group were to assume this task, it would
conflict with the competences assigned by the Data Protection Directive to national and EU data
protection authorities. In this regard, SWIFT informed the Oversight Group that it had obtained
significant protections and assurances from the US Treasury to ensure that the data concerned were
used exclusively for the purpose of antiterrorist investigations. An audit commissioned by SWIFT also
confirmed that there was no indication that the subpoenas and their implementation had any other
purpose than the fight against terrorism.
2. Professional confidentiality
Let me now turn to the second topic, that is, why the ECB was unable to use the information it
received in the context of the oversight framework for other purposes or to share such information with
other relevant authorities.
First, SWIFT has requested that the information it provides to the central banks in the context of
oversight must only be used for oversight purposes.
Second, the Memoranda of Understanding concluded by the NBB, in its capacity as lead overseer,
with each individual G10 central bank involved in the cooperative oversight of SWIFT, including with
the ECB, stipulate that all non-public information shared by the signatories, including information
provided by SWIFT, must be treated as confidential and must also be subject to the respective
obligations of professional secrecy of the signatories, as applicable.
Third, the applicable obligations of the ECB, as referred to in the Memorandum of Understanding
signed with the NBB, are laid down in Article 38 of the Statute of the ESCB, which imposes
professional secrecy on the ECB.
As I have explained, the SWIFT oversight function is not based on a comprehensive legal framework
including powers to impose sanctions, but on "moral suasion". The tool of "moral suasion" can only
work properly if there is a close dialogue and mutual trust between the overseers and SWIFT. In this
context, a strict confidentiality regime is of the essence. After all, the oversight role involves the
sharing of very sensitive information, and the disclosure of this information may have severe
consequences.
Although the ECB became aware of the subpoenas being imposed on SWIFT in June 2002, this
information could neither be transmitted to third parties nor be made public.
Moreover, the ECB has no authority to supervise SWIFT with regard to compliance with data
protection laws. The difficult questions arising in that regard must be addressed by the relevant data
protection authorities, as data protection is a matter which falls outside the ECB's competence.
3. Conclusions
Let me now conclude my remarks with a brief summary of the main points I have made. First, the G10
central banks, including the ECB, perform the oversight of SWIFT under the leadership of the NBB. As
such, our responsibilities are precisely to ensure that SWIFT has an appropriate framework in place to
avoid systemic risks. In executing these responsibilities, the central banks - as overseers - rely not on
a comprehensive legal framework, including powers to impose sanctions, but on "moral suasion".
Second, compliance with the US subpoenas fell outside the context of financial stability and thus
outside the remit of our oversight role. Third, we did not give SWIFT any blessing in relation to its
compliance with these subpoenas. In fact, we could not have given any such authorisation even if we
had wanted to, as this fell outside our competence. Therefore, SWIFT remained solely responsible for
its decisions. The conclusion that SWIFT's compliance with the US subpoenas was and is beyond the
remit of oversight by central banks remained unchallenged in the Belgian data protection authority's
report of 27 September 2006.