EUROPEAN COMMISSION Brussels, 19.7.2016 COM(2016) 476 final REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT Progress Report on the implementation of the EU Strategy and Action Plan for customs risk management {SWD(2016) 242 final}



TABLE OF CONTENTs 1Introduction 2Overall assessment 2.1Purpose and methodology 2.2Objective 1 — Improving data quality and filing arrangements 2.3Objective 2 — Ensuring availability of supply chain data, sharing of risk-relevant information and control results 2.4Objective 3 — Implementing control and risk mitigation measures where required (‘assess in advance — control where required’) 2.5Objective 4 — Increasing capacity to ensure effective implementation of the Common Risk Management Framework and to increase responsiveness to newly identified risks 2.6Objective 5 — Promoting interagency cooperation and information sharing between customs and other authorities at Member State and EU level 2.7Objective 6 — Improving cooperation with trade 2.8Objective 7 — Tapping the potential offered by international customs cooperation 3. Preliminary conclusions



1Introduction The Council conclusions of 4 December 2014 endorsing the 2014 EU Strategy and Action Plan for customs risk management (hereinafter referred to as ‘the Strategy’ and ‘the Action Plan’) invite the Commission to report to the Council, within 18 months, on the implementation of the Strategy and the Action Plan and on the results achieved. This Progress Report (hereinafter referred to as ‘the Report’), constitutes the Commission’s response to that request. The overall aim of the Strategy is to achieve a high-quality, multi-layered approach to risk management that is effective and efficient. The Strategy identifies seven key objectives, namely:

I.improving data quality and filing arrangements; II.ensuring availability of supply chain data and sharing of risk-relevant information between customs authorities; III.implementing control and risk mitigation measures where required; IV.strengthening capacity; V.promoting cross-sectoral cooperation and information sharing between customs and other authorities at Member State and EU level; VI.improving cooperation with trade; and VII.tapping the potential offered by international customs cooperation. The Action Plan sets out a series of actions (totalling 22 actions and 54 sub-actions) to be taken for each objective. A roadmap for the implementation of the actions has been developed, identifying 64 deliverables. The majority of the actions are being carried out either by or under the responsibility of the Commission. The Commission is assisted in implementing the Strategy by the Risk Management Strategy Implementation Coordination Group, which is composed of representatives from all Member States. This group has contributed to the preparation of this Report. 2Overall assessment 2.1Purpose and methodology This Report gives an overall qualitative assessment of the implementation of the Strategy. It highlights the progress made under each of the seven key objectives and draws some preliminary conclusions. In view of the short time elapsed since the launch of the actions, this Report does not seek to assess their impact. The information presented in this Report was obtained by means of a survey conducted within the Commission and in Member States. It covered the implementation of the individual actions (both those already started and those yet to be launched), and allowed the Commission to identify both success stories and challenges encountered, and to gather comments and suggestions on the implementation process overall. The survey shows that, at the time of preparing this Report, i.e. 18 months into the implementation process, the great majority of the actions and sub-actions set out in the Action Plan have been launched and are under way. The Commission Staff Working Document, annexed to this Report, provides further information on the progress made on the individual actions and sub-actions. 2.2Objective 1 — Improving data quality and filing arrangements The Strategy and Action Plan call for a legal framework to be set up that will ensure that high-quality data on advance cargo information relating to supply chain movements is available and is correctly used by customs and other competent authorities for the purpose of risk management. Central to ensuring data quality is the introduction of ‘multiple filing’ — filing of information related to the same specific assignment by different operators — and the lifting of existing exemptions for postal and low-value consignments. The legal framework consists of the Union Customs Code and the detailed rules contained in the delegated and implementing acts. This new legislation is applicable from 1 May 2016 and the development and upgrading of relevant IT systems necessary for its implementation will take place in accordance with the timeline laid down in the Work Programme for the Union Customs Code. The objective of a complete legal framework providing requirements for multiple filling and improving data quality has thus been accomplished and only its implementation remains to be achieved. 2.3Objective 2 — Ensuring availability of supply chain data, sharing of risk-relevant information and control results Improving data quality and filing arrangements and ensuring the availability and sharing of supply chain data and risk-relevant information between customs authorities depends on the development and availability of the necessary IT systems, i.e. most notably the new Import Control System.

IT systems for other customs procedures are also to be developed or upgraded as part of the Union Customs Code. Import Control System One priority action identified by the Strategy is the development and implementation of appropriate IT solutions for improving data quality, filing arrangements and data availability for the detection of security and safety risks at the point of entry of goods. The development of a new Import Control System is the main deliverable under this priority. The Commission, with the support of Member States, has prepared a business case and a vision document on the basis of external cost-benefit analysis and feasibility studies. The new Import Control System will bring significant improvements to EU customs risk management. A common repository of advance cargo information is at the core of, and constitutes a fundamental prerequisite for, the required improvements in data quality and availability. With the introduction of multiple filing and the expected increase in the volume of advance cargo information — from approximately 40 million declarations annually in the current system to some 400 million under the new Import Control System – a decentralised approach would be very burdensome for customs and trade. A cost-benefit analysis carried out in 2013 and further analysis of possible options have already identified that only a centralised approach can cover the need for a high-level of system availability, and will ensure a harmonised approach of customs risk management on advanced cargo information. The common repository will make it possible to store and process the increased volume of advance cargo information and will allow all Member States in any given supply chain to perform effective and efficient risk assessment directly and simultaneously using the information in the repository. It will also allow risk-relevant information and control results to be shared between Member States. The launch of the formal elaboration phase for ICS 2.0 has been delayed, but work is under way to resolve outstanding questions related to the budget, governance, delivery strategy and planning, operational mode, a dedicated implementing act for the IT system and capacity of the project. A pragmatic step-by-step approach (using ‘building blocks’) for its further development and implementation is to be followed. 2.4Objective 3 — Implementing control and risk mitigation measures where required (‘assess in advance — control where required’) The progress made in this area is due, in large part, to the progress made on activities already under way at the time of the adoption of the Strategy, namely those relating to prohibitions and restrictions. A set of factsheets has been produced (in cooperation with Member States) for selected pieces of legislation that set prohibitions and restrictions on imports and exports of goods, to be controlled at the external EU border. The factsheets give a description of the legislative framework, the role of customs and the documentary and physical checks to be applied. They provide a basis on which to determine the timing of customs controls and whether further recommendations for customs and other authorities are needed. The services of the Commission have prepared guidance to support the preparation or review of EU legal acts on how customs involvement is to be envisaged including how customs risk management should be taken into account. 2.5Objective 4 — Increasing capacity to ensure effective implementation of the Common Risk Management Framework and to increase responsiveness to newly identified risks Progress has been slow despite many ongoing actions designed to increase capacity of Member States and EU to implement the current customs risk management framework. While Member States have been active in identifying inconsistencies in the implementation of the Common Risk Management Framework at national level and finding ways to address these weaknesses, there are issues relating to Member States’ capacity to implement solutions and the EU’s ability to provide appropriate risk analysis capacity support to the Member States through the initiative of a new Import Control System. In 2015, the Commission and Member State experts assessed and identified the need for an improved IT system to share risk information, i.e. a next generation of the Customs Risk Management System. Common risk criteria were evaluated at both Member State and EU level. Pilot projects were launched by Member States in order to assess and test the implementation of common risk criteria. In parallel, data mining tools and designs for data analysis were tested on data available at EU level. The aim of these tests was to identify possible further risk management capabilities and improve targeting, in particular for containerised transport. As part of the ongoing process of developing common criteria for the full range of risks, the Commission and Member States began working on definitions for the various financial risks and revising the existing risk criteria for safety and security, in particular in respect of air cargo security. The Commission and Member States have also taken steps to ensure the harmonised implementation of risk criteria. In monitoring and evaluating the implementation, they have been able to achieve synergies with the Customs Union Performance exercise.



2.6Objective 5 — Promoting interagency cooperation and information sharing between customs and other authorities at Member State and EU level Interagency cooperation has been improved overall, in particular in non-customs policy areas. For example, a methodology has been developed for the exchange of risk information between customs and market surveillance authorities in the area of product safety. An outline of this methodology was shared with Member States in December 2015. Improvements can be achieved in the cooperation between customs and other border authorities on the aspect of information sharing in relation to controls of goods carried by travellers or crew members. The issue was highlighted in the April 2016 communication Stronger and Smarter Information Systems for Borders and Security.

An evaluation of the cooperation between customs and border guards, including the implementation of the April 2013 guidelines, is ongoing. The initial results show a good level of cooperation overall and a set of good practices has been identified. A high level seminar on passenger controls was organised in Riga on 7-8 May 2015 to improve integrated border management between customs and other authorities. The seminar identified an agenda for further work and cooperation between customs and other border authorities, including making advance passenger data available for customs use. To improve cooperation with Frontex, a formal dialogue has been launched focusing on the functions falling within the agency’s framework and those of customs, including customs risk management. The risk management section of the Customs Code Committee has assessed the implications, as relates to customs, of the sharing of information provided for under the Passenger Name Record (PNR) and Advanced Passenger Information (API) Directives. Securing customs participation in the national Passenger Information Units (PIUs) and/or customs access to this data, according to Directive (EU) 2016/681, is important for effective and efficient customs supervision of goods in passenger traffic. The data is considered to be very valuable for the identification of risks related to passenger luggage (or cash carried by passengers) and allows customs to carry out targeted and risk-based controls at arrival, thus contributing to the fight against serious and organised crime, terrorism and the financing of terrorism whilst respecting data protection and privacy safeguards. Ensuring cooperation with other law enforcement authorities remains a challenge (including, in some cases, between the departments responsible for customs controls/risk management and those responsible for investigations within a customs administration). Over the reporting period, focus has been put on better communicating and explaining the role of risk management, and existing and possible future customs capacities. Mutual understanding of the different responsibilities of customs and other law enforcement authorities has improved as a result, but further efforts are needed. The scope of the exchange of information for the purpose of mutual assistance between Member State customs authorities and between those authorities and the Commission has been extended with the amendment of the Regulation on mutual assistance. The amended Regulation offers a wider legal basis for a number of actions aiming at better compliance of economic operators with customs and agricultural legislation. Access to the data collected under the amended Regulation for risk management would improve customs risk management at Member States and EU level. One contribution made by customs to the implementation of the European Agenda on Security is the development of specific risk rules (common risk criteria) for air cargo security. A preliminary set of common risk criteria has been agreed. As the criteria in the air cargo domain concern not only customs but also other authorities, relevant Commission services, EU Intelligence Analysis Centre, and national customs, civil aviation and counter-terrorism experts have therefore been involved in their development. The common risk criteria for air cargo are therefore based upon multi-disciplinary, cross-sectorial input from all relevant parties and will complement existing civil aviation security measures for cargo and post as an additional layer of security. As the new risk rules will only be applied on the basis of the new Import Control System, they will not be implemented before the end of 2020. The Strategy also supports the implementation of the EU Maritime Security Strategy and its action plan, adopted by the Council on 16 December 2014. In particular the implementation of the Common Information Sharing Environment (CISE) that has been developed as a meta-project for enhanced cooperation and information exchange between civil and military authorities with a view to further enhance a common maritime situational awareness picture and data exchange. With the aim of improving supply chain security and supporting the risk-based surveillance of the movement of goods in the maritime domain CISE promotes the exchange of information between the different authorities involved in the fight against terrorist and organised crime (e.g. smuggling of goods, trafficking of arms and narcotics and cross-border movements of the cash proceeds of illegal trade). Relevant EU agencies are invited to reinforce inter-agency cooperation. The Pre-Operational Validation project 'EUCISE2020' is to test CISE at large scale by 2017-18, followed by a step-by-step implementation until 2020. Any of the above mentioned information sharing will respect the fundamental rights, and in particular the rights to privacy and protection of personal data. 2.7Objective 6 — Improving cooperation with trade Cooperation between customs and trade has already been improved through the strengthening of the Authorised Economic Operator (AEO) concept. Changes to the AEO concept were introduced by the Union Customs Code and its delegated and implementing acts and these changes necessitated an update to the AEO guidelines. The AEO Network Group, created in 2007 to monitor the implementation of the AEO concept, launched its second monitoring initiative in 2013, designed to ensure correct and uniform application of AEO rules. The monitoring exercise confirmed that the AEO concept is strong and reliable. Member States have developed robust procedures guaranteeing high-quality, efficient and consistent management of the concept. In 2015, two specific target groups were created within the Customs Risk Management System for the exchange of risk information relating to AEO processes and procedures: one group for the exchange of sensitive information in the AEO process and another group for the exchange of information on irregularities involving a partner country AEO. Progress has been slower in other areas such as improving the knowledge of supply chains. The creation of a legal framework to ensure the availability of high-quality data for risk management purposes has led to the question being raised as to whether and how the data submitted by traders and included in the customs declarations for postal parcels (i.e. the CN23 declaration) could be made available and re-used for submitting an entry summary declaration for safety and security and the customs declaration. This discussion is also pertinent given the ever-increasing volume of small consignments being sent as a result of e-commerce. Member State customs authorities, postal operators, trade associations and international partners (the US, Canada and China) have been involved in analysing the options available within the global postal model of the Universal Postal Union. Whichever option is chosen, it is important for it to be able to operate with the new Import Control System. 2.8Objective 7 — Tapping the potential offered by international customs cooperation A number of activities have been launched and are ongoing with the objective of improving the risk management of the supply chain by means of international cooperation. The successes include the revision of the World Customs Organisation’s (WCO) SAFE Framework of Standards, the development of international standards, e.g. on pre-loading air cargo information, and the development of mutual recognition of Authorised Economic Operator (AEO) concepts . A number of projects are under way relating to the exchange of information with non-EU countries (e.g. in the context of the Smart and Secure Trade Lanes pilot project with China). These projects will, however, require reliable IT systems to be created if they are to succeed. 3. Preliminary conclusions The reform of customs risk management is a resource-intensive exercise. Achieving results takes time. Although a large number of actions have been launched, progress has been uneven.