EUROPEAN COMMISSION Brussels, 20.7.2021 SWD(2021) 210 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2019/1153 of the European Parliament and of the Council, as regards access of competent authorities to centralised bank account registries through the single access point {COM(2021) 429 final}



1.Background Pursuant to Article 32a of the Fifth anti-money laundering directive, Member States are to put in place by 10 September 2020 national centralised automated mechanisms, such as central registries or central electronic data retrieval systems, which allow the timely identification of any natural or legal person holding or controlling payment accounts, bank accounts or safe deposit boxes. Article 32a(2) provides the national Financial Intelligence Units (FIUs) with immediate and unfiltered access to this data. It highlights that other competent authorities should also have access in order to fulfil their obligations under the Anti-money Laundering Directive. Directive 2019/1153 already at present extends the scope of authorities able to directly access the nationalcentralised automated mechanisms (referred to in Directive (EU) 2019/1153 as bank account registries, term used hereafter), by requiring Member States to designate the national authorities competent for the prevention, detection, investigation or prosecution of criminal offences that should be empowered to access and search directly the minimum set of information contained in the centralised bank account registries. It also requires them to include asset recovery offices (AROs) among their designated competent authorities and enables Member States to designate tax authorities and anti-corruption agencies as competent authorities to the extent that these are competent for the prevention, detection, investigation or prosecution of criminal offences under national law. The Directive also sets out that access to the centralised bank account registries shall be provided for the purposes of preventing, detecting, investigating or prosecuting a serious criminal offence. Pursuant to the Commission’s proposal for a new anti-money laundering directive, which is being presented alongside the proposal amending Directive (EU) 2019/1153 of the European Parliament and of the Council, as regards access of competent authorities to centralised bank account registries through the single access point, Member States shall ensure that the information from centralised bank account registries is available through the bank account registers (BAR) single access point to be developed and operated by the Commission. By interconnecting centralised bank account registries, authorities with access to the BAR single access point would be able to establish quickly whether an individual holds bank accounts in other Member States without having to ask all their counterparts in all Member States. In line with its legal basis (Article 114 of the Treaty on the Functioning of the European Union (TFEU)), the new anti-money laundering directive will provide access to the BAR single access point only to FIUs, the national body which receives suspicious transaction reports from obliged entities and forwards them, as appropriate, to criminal investigation authorities. The present document analyses the state-of-play and the impacts of enlarging the access to the BAR single access point, put in place pursuant to the proposed 2021 anti-money laundering directive, also to the authorities competent for the prevention, detection, investigation or prosecution of criminal offences designated by Member States under Directive 2019/1153. 2.State-of-play with regard to the setting up of centralised bank account registries and electronic data retrieval systems in the EU Member States In many Member States, where centralised bank account registries exist, also law enforcement authorities, including the AROs have been provided with a direct access to these registries (BE, BG, FR, DE, EE, EL, IT, LV, LT, LU, NL, SI). With the ending of the transposition period of Directive 2019/1153 on 1 August 2021, all Member States should have provided direct access to authorities competent for the prevention, detection, investigation or prosecution of criminal offences, including AROs. By 1 December 2021, Member States should notify the Commission of the authorities that have been designated. Table. Law enforcement authorities and Asset Recovery Offices direct access to bank account information MS Central bank Account Registry Data Retrieval System Direct access LEA Direct Access ARO AT Yes -- No No BE Yes -- No Yes BG Yes -- Yes Yes CY Yes -- No No CZ Yes -- No No DE -- Yes Yes Yes DK -- Yes No No EE -- Yes Yes Yes EL -- Yes Yes Yes ES Yes -- No No FI -- Yes No No FR Yes -- Yes Yes HR Yes -- No No HU n/a* -- n/a n/a IE n/a* -- No No IT Yes -- Yes No LT Yes -- Yes Yes LU -- -- Yes No LV Yes -- Yes Yes MT Yes -- Yes Yes NL Yes -- Yes Yes PL No No (in progress) n/a** n/a** PT Yes -- No No RO Yes -- Yes No SK n/a* n/a n/a n/a SI Yes -- Yes No SE -- Yes Yes Yes Source: targeted questionnaire on ARO/law enforcement access to bank account information, October 2020. Eleven Member States indicated that AROs have access to bank account information, one of them indirectly and ten directly (including one of them with approval from the prosecutor). In thirteen Member States one or more law enforcement authorities have access to centralised bank account registries or data retrieval systems, in one case only for money laundering and terrorism financing investigations and in two cases following the approval by a judge or a prosecutor. Judges and prosecutors themselves have access to bank account information respectively in five and in nine Member States (in two of them prosecutors only have such access for money laundering/terrorism financing cases). Five other Member States have indicated that they have given access to other designated authorities such as tax authorities or customs. 3.What is the problem? A considerable part of criminal activity, especially serious and organised crime, is committed with the aim of generating profit. Criminal revenues in the nine main criminal markets in the European Union amounted to €139 billion in 2019 , corresponding to 1% of the Union’s Gross Domestic Product. Criminals and terrorists often operate in different Member States and their assets, including bank accounts, are located across the EU. They tend to be quick to adapt and make use of modern technology that allows them to transfer money between numerous bank accounts and between different currencies in a matter of hours. Information on financial activities can provide law enforcement with crucial leads about subjects of an investigation and judicial authorities with invaluable evidence to ascertain the criminal acts of a person subject to criminal proceedings. Moreover, swift access to bank account information is essential to ensure effective freezing and confiscation of proceeds of criminal activities, which are among the most effective means of combatting crime. However, confiscation rates are low: currently only about 1% of criminal assets are confiscated. Swift access to financial information is key to effective financial investigations and successfully tracing and confiscating the instrumentalities and proceeds of crime. In this regard, it is vital to know who holds a bank account in a Member State other than that carrying out the investigation: not only to be able to establish which Member State freezing and confiscation orders are to be sent to in order to secure the assets, but also to give investigators potentially crucial leads. However, in order for authorities responsible for preventing, detecting, investigating or prosecuting criminal offences in one Member State to obtain information on subjects of an investigation who hold bank accounts in another Member State, they currently have to collect the information via police cooperation or judicial cooperation channels. This is an often burdensome and time-consuming process that hampers speedy access to the information. This includes exchanges on the basis of Framework Decision 2006/960 JHA (also referred to as the “Swedish Initiative”). Since 19 December 2020, Member States are expected to apply the mutual recognition of freezing and confiscation orders in accordance with Regulation 2018/1805. This Regulation does not establish precise timelines for freezing orders, although the issuing Member State can request its execution in a maximum of 48 hours if it has grounds to believe that the property will be imminently removed or destroyed, and establishes a maximum of 45 days for the recognition and execution of confiscation orders. When issuing certificates for the mutual recognition of freezing and confiscation orders, Member States may indicate the details of the bank account of the affected person. Therefore, knowing where in the EU a suspect holds a bank account is invaluable information for competent authorities to quickly identify to which other Member States they should request the freezing, and subsequently confiscation, of money stored in those accounts before it is moved somewhere else. Designated authorities competent for the prevention, detection, investigation or prosecution of criminal offences need therefore to be able to more efficiently trace the financial trail that criminals leave behind, uncover criminal activities across borders and trace, freeze and confiscate illegally obtained assets - which is one of the most effective means of combatting crime. An access of the competent authorities to the BAR single access point would allow them to more quickly obtain information on whether a subject of an investigation holds a bank or payment account or a safe deposit box in another Member State, and therefore be an important element of enhancing their capabilities to secure assets before they disappear. 4.policy options

4.1.Baseline The baseline consists of the current status quo, whereby designated authorities competent for the prevention, detection, investigation or prosecution of criminal offences are empowered to directly access and search the national centralised bank account registries according to Directive 2019/1153. The Commission would monitor such transposition and would, where needed, open infringement proceedings in case of incomplete or incorrect transposition. However, without a direct access to the BAR single access point, authorities competent for the prevention, detection, investigation or prosecution of criminal offences would not have any cross-border access to bank account information stored in the registries. It is therefore very likely that the problems described in section 3 would persist and would even exacerbate with time as technologies will continue to develop and evolve, thus, providing criminals with the opportunity to transfer money between various bank accounts within or outside the EU expeditiously before authorities competent for the prevention, detection, investigation or prosecution of criminal offences are able to follow the money trail and freeze the assets. The baseline would entail that competent authorities rely on existing channels of communication for requests for information exchanges. This would either result in (a) an increased workload for competent authorities to respond to cross-border requests from competent authorities in other Member States or (b) that authorities competent for the prevention, detection, investigation or prosecution of criminal offences choose not to enrich their investigations with bank account information that is available in other Member States due to slower and less efficient procedures. The latter would also reduce the amount of assets that are detected, identified, frozen and, ultimately, confiscated. 4.2.Description of the policy option The only available policy option, apart from the baseline, is to provide the authorities competent for the prevention, detection, investigation or prosecution of criminal offences designated by the Member States pursuant to Article 3(1) of Directive 2019/1153 with the the possibilities to directly access and search the bank account registries of other Member States through via the single access point. The available policy option builds on existing policy documents by EU Institutions indicating the added value of providing competent authorities with access to such interconnection subject to appropriate safeguards and limitations: –The Commission’s report on the interconnection of centralised bank account registries of July 2019 concluded that such an interconnection would speed up access to financial information and facilitate the cross-border cooperation of the competent authorities. –The action plan for a comprehensive Union policy on preventing money laundering and terrorist financing, adopted by the Commission in May 2020, emphasised that an EU-wide interconnection of central bank account mechanisms is necessary to speed up access by FIUs and competent authorities to bank account information and facilitate cross-border cooperation and that it should be considered as a matter of priority. –The June 2020 Council conclusions on enhancing financial investigations to fight serious and organised crime called on the Member States to engage in a constructive discussion with the Commission regarding the future interconnection of national bank account registries and data retrieval systems. Moreover, the Council also called on the Commission to consider further enhancing the legal framework in order to interconnect the national registries and retrieval systems in order to accelerate access to financial information and facilitate cross-border cooperation between the competent authorities and their European counterparts. –The Commission’s Security Union Strategy adopted in July 2020 also refers to the interconnection of national centralised bank account registries, which could significantly speed up access to the financial information for FIUs and competent authorities. –The European Parliament’s resolution of 10 July 2020 welcomes the Commission’s plan to ensure interconnection of centralised bank account registries in order to facilitate faster access to financial information for competent authorities and FIUs during different investigation phases and facilitate cross-border cooperation in full compliance with applicable data protection rules”. –The EU strategy to tackle organised crime 2021-2025, adopted by the Commission in April 2021, stresses that swift access to financial information is essential for carrying out effective financial investigations and for successfully tracing and confiscating assets. It announces that the Commission will revise Directive 2019/1153 in order to provide competent authorities access to the future platform interconnecting bank account registries across the EU. These statements calling for the centralised bank account registries to be interconnected and access to be granted also to the authorities competent for the prevention, detection, investigation or prosecution of criminal offences reflect the operational need of such authorities to quickly identify whether a suspect holds bank accounts in other Member States. These operational needs indicate that this is the chosen option that should be assessed in greater detail below, in particular as regards its impact on effectiveness, its proportionality and its impact on relevant fundamental rights enshired in the Charter of Fundamental Rights of the EU (hereinafter the Charter). 5.impacts of the policy option 5.1.Effectiveness and efficiency The access of authorities competent for the prevention, detection, investigation or prosecution of criminal offences to the BAR single access point, put in place pursuant to the proposed 2021 anti-money laundering directive, will significantly improve the effectiveness of the investigations carried out by those authorities, including AROs, to combat serious crime and, in particular, trace and identify proceeds of crime. It will significantly improve and speed up the capacity of these authorities to obtain swiftly information on where a suspect in a criminal investigation into serious crimes holds bank accounts in other Member States. It will also facilitate cross-border cooperation within the EU, since information on whether a person subject to a criminal investigation or judicial proceeding holds a bank account in another Member State is essential for competent authorities to swiftly identify the Member States to which they should send, respectively, requests for further information (for investigative or evidential purposes) or freezing and confiscation orders to secure the assets. It will therefore be an important element to enhance freezing and confiscation of criminal assets and step up confiscation rates in accordance with the applicable laws. Providing access to the interconnection of central bank account registries would also improve the efficiency of law enforcement investigations insofar as it would allow them to determine to which Member State they should address freezing and confiscation orders or European Investigation Orders without previously requiring authorities in other Member States to ascertain whether a suspect holds accounts in that Member State – a process which often proves lengthy and burdensome at present. Providing competent authorities with access to the bank account registries single access point would bring significant benefits without requiring excessive additional costs. Practical example of potential operational benefits for law enforcement authorities Law enforcement authorities in Member States A and B receive a request from the law enforcement authority in Member State C, in a criminal investigation in a big drug trafficking case, to identify bank accounts held by the suspect. Law enforcement authorities in Member States A and B have a direct access to their national bank account registries. Member State A answer within a few hours, whilst Member State B provides the information after 1 week. When the law enforcement authority or the ARO in Member State C, on the basis of this information, requests freezing orders at the competent court, and subsequently issues certificates for the mutual recognition of freezing orders in order to freeze the substantial sums of money in the accounts, most of it has already disappeared.

In the situation where competent authorities in Member State C would be empowered to search and access the interconnection of central bank account registries, they would be able to identify the bank accounts held by the suspect in a matter of seconds. Authorities in Member State C would therefore be capable of requesting to both Member State A and B the freezing of money held in those accouns before it is transferred somewhere else. 5.2.Proportionality The proposed measure is proportionate to the objective to further strengthen the competent authorities’ ability to fight serious crime. Solely specifically designated authorities in accordance with Article 3(1) of Directive 2019/1153 (which are to be notified to the Commission by 1 December 2021 in accordance with Article 3(3) of the Directive) will be provided with direct access to the the bank account registries single access point. Under Article 4(1) of Directive 2019/1153 access is provided only for the purpose of preventing, detecting, investigating and prosecuting serious crime. According to Art. 2(12) of the Directive, serious criminal offence means the forms of crime listed in Annex I to Regulation (EU) 2016/794 (Europol Regulation). Directive 2019/1153 already lays down strict conditions for the access and for searches of bank account information contained in the centralised bank account registries by competent authorities designated at national level. These safeguards and limitations will also apply in relation to the access and search possibilities, through the BAR single access point, created under the proposed measures. Such conditions include, for example, the provision of access to the bank account registries only to specifically designated and authorised persons of each competent authority and only for the purposes of combating serious criminal offences. Another limitation is the fact that competent authorities of other Member States will only be able to directly access and search the following limited set of information through the BAR single access point (see Article 4(2) in conjunction with Article 2(7) of Directive (EU) 2019/1153; see also Article 32a(3) of the current Anti-Money Laundering Directive, as well as Article 14(3) of the proposed new Anti-Money Laundering Directive and Article 18(1) of proposed new Anti-Money Laundering Regulation):: ·for the customer-account holder and any person purporting to act on behalf of the customer: the name, complemented by either the other identification data or a unique identification number; ·for the beneficial owner of the customer-account holder: the name, complemented by either the other identification data required or a unique identification number; ·for the bank or payment account: the IBAN number and the date of account opening and closing; ·for the safe-deposit box: name of the lessee complemented by either the other identification data required or a unique identification number and the duration of the lease period. Pursuant to the measure hereby considered, authorities competent for the prevention, detection, investigation or prosecution of criminal offences will therefore still not be able to access and search sensitive data, such as information on transactions or the accounts balance. Only information strictly required to identify a holder of a bank or payment account or a safe deposit box will be made accessible through the BAR single access point. Once the authorities identify, by virtue of the access provided under the proposed measure, with which financial institution the subject of an investigation holds a bank account in another Member State, they will, where deemed necessary, have to request further information (e.g. a list of transactions) via appropriate judicial cooperation channels. 5.3.Fundamental rights The applicable safeguards described above, will also ensure that the impact on relevant fundamental rights, such as the right to the protection of personal data and the right to private life, is limited to what is strictly nessesary. Centralised bank account registries contain personal data relating to legal or natural persons. An access by authorities competent for the prevention, detection, investigation or prosecution of criminal offences to these data has an impact on the fundamental rights of the data subjects. In particular, it will interfere with the right to privacy and the right to the protection of personal data, respectively under Articles 7 and 8 of the Charter. Any resulting limitations on the exercise of the rights and freedoms recognised by the Charter, in particular those laid down in its Articles 7 and 8, comply with the requirements set by the Charter, in particular those of its Article 52(1). The limitation is provided for by law and is justified by the need to pursue an objective of general interest recognised by the Union, namely, combating serious crime. With regard the right to privacy, the impact is limited insofar as the measures hereby analysed does not require the collection of additional account-holder data and considering that the information from other Member States accessible via the BAR single access point can already be obtained through police and judicial cooperation channels. Moreover, the interference with the right to privacy is relatively limited in terms of gravity as the accessible and searchable data does not cover financial transactions or the account balance. It will only cover the described limited set of information (e.g. the owner’s name bank account number) that is strictly necessary for the competent authority of a given Member State to establish with which banks in other Member States the subject of an investigation holds an account. With regard to the protection of personal data, information on bank accounts constitutes or can constitute personal data and access to this data by authorities competent for the prevention, detection, investigation or prosecution of criminal offences authorities would constitute processing of personal data. At the same time, all provisions of the Directive (EU) 2016/680 apply to the processing of data from the centralised bank account registries accessed and searched by these authorities through the BAR single access point, as is presently the case for data accessed and searched on the basis of Directive (EU) 2019/1153 . Further on, the resulting interconnection could reduce from a certain perspective the processing of personal data, insofar as authorities competent for the prevention, detection, investigation or prosecution of criminal offences could identify whether the subject of a criminal investigation holds bank accounts in other Member States without disclosing personal information on the suspect to one or more authorities in several other Member States. Without interconnection, in order to obtain information on subjects of an investigation holding bank accounts in another Member State requests have to be sent on the basis of police or judicial cooperation instruments, i.e. Framework Decision 2006/960 JHA or Regulation 2018/1805, thus by disseminating personal information to the relevant authorities in different Member States. At the same time, all the safeguards and limitations provided for in Directive (EU) 2019/1153 will also apply in respect of any access or search of designated authorities competent for the prevention, detection, investigation or prosecution of criminal offences to or in centralised automated mechanisms, such as a central registers or central electronic data retrieval systems through the BAR single access point. It concerns in particular the safeguards provided for in Articles 3, 4, 5, and 6 of the Directive, which provide in particular for the following safeguards: ·only the authorities competent for the prevention, detection, investigation or prosecution of criminal offences, which have been designated by Member States will have the power to access and search the centralised bank account registries, including through the BAR single access point (Article 3(1) of the Directive in conjunction with the proposed measures).