EUROPEAN COMMISSION Brussels, 23.9.2022 SWD(2022) 303 final COMMISSION STAFF WORKING DOCUMENT Follow-up by Member States to the recommendations of the PIF Report 2020 Accompanying the document REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT 33rd Annual Report on the protection of the European Union's financial interests and the fight against fraud - 2021 {COM(2022) 482 final} - {SWD(2022) 302 final} - {SWD(2022) 304 final} - {SWD(2022) 305 final} - {SWD(2022) 306 final} - {SWD(2022) 307 final}



TABLE OF CONTENTS TABLE OF CONTENTS LIST OF ABBREVIATIONS 1. Overview of Member States’ replies 1.1. Cross-cutting aspects of the fight against fraud 1.2. Revenue 1.3. Expenditure 2. Follow-up by recommendation 2.1. Cross-cutting aspects of the fight against fraud 2.1.1. Joining the EPPO 2.1.2. Adopting a national anti-fraud strategy (NAFS) 2.2. Revenue 2.2.1. Assessment of the national customs controls strategies 2.2.2. Assessment of the financial risks insufficiently addressed during 2020 2.3. Expenditure 2.3.1. Targeted risk management exercises linked to COVID-19 and the RRF 2.3.2. Improved data collection and usage 2.3.3. Integrated and interoperable information and monitoring system

3. Member States’ replies 3.1. Belgium 3.2. Bulgaria 3.3. Czechia 3.4. Denmark 3.5. Germany 3.6. Estonia 3.7. Ireland 3.8. Greece 3.9. Spain 3.10. France 3.11. Croatia 3.12. Italy 3.13. Cyprus 3.14. Latvia 3.15. Lithuania 3.16. Luxembourg 3.17. Hungary 3.18. Malta 3.19. Netherlands

3.20. Poland 3.21. Portugal 3.22. Romania 3.23. Slovenia 3.24. Slovakia 3.25. Finland 3.26. Sweden



LIST OF ABBREVIATIONS AFCOS: Anti-Fraud Coordination Service CA: Certifying Authority CF: Cohesion Fund CUP: Customs Union Performance DG: Directorate-General EAFRD: European Agricultural Fund for Rural Development EAGF: European Agricultural Guarantee Fund EC: European Commission EMFF: European Maritime and Fisheries Fund

ERDF: European Regional Development Fund ESF: European Social Fund ESI: Emergency Support Instrument IMS: Irregularity Management System ISF: Internal Security Fund MA: Managing Authorities NAFS: National Anti-Fraud Strategy PIF: Protection of the EU’s financial interests RRF: Recovery and Resilience Facility (N)RRP: (National) Recovery and Resilience Plan TFEU: Treaty on the Functioning of the European Union UBO: Ultimate Beneficial Owner VAT: Value added tax

1.Overview of Member States’ replies In the 2020 Report on the protection of the European Union’s financial interests, the Commission made three sets of recommendations to Member States, covering a) cross-cutting aspects of the fight against fraud; b) revenue; and c) expenditure. This staff working document collects and summarises the Member States’ replies to the follow-up on the 2020 PIF Report recommendations and provides updated information, initiatives, and measures taken in 2020/21 in the respective areas mentioned above. 1.1.Cross-cutting aspects of the fight against fraud EU Member States which have not joined the EPPO should consider doing so. EU Member States which have not adopted a national anti-fraud strategy should consider doing so. National strategies adopted in the past and not adapted to the new significant risks should be swiftly updated. The health crisis caused by COVID-19 has had a great economic and social impact on the lives of Europeans. The EU response, through the resources provided for the next EU budget and Next Generation EU (NGEU), represent the biggest recovery plan in Europe since the Marshall Plan. In light of these developments, the role of the EPPO to investigate and prosecute crimes against the EU budget consistently across EU Member States becomes more important than ever. Likewise, anti-fraud efforts must be enhanced and coordinated at the national level, which is the purpose of a National Anti-Fraud Strategy (NAFS).

Out of the five Member States that have not joined the EPPO, Denmark and Ireland - both with an opt-out from the area of freedom, security and justice (AFSJ), Hungary and Poland stated that they did not intend to join. Sweden reported that it was committed to joining the EPPO as soon as possible. Following the Commission’s recommendations, by the end of 2021, eleven Member States had adopted a NAFS and transmitted it to the Commission (OLAF), although some still needed to be updated. Four had adopted sectoral ones and one Member State a regional NAFS – of these, Germany and Portugal were yet to transmit the documents to the Commission. In eleven Member States no strategies were adopted to date, yet four of these reported that they were in the process of drafting or close to adopting one. While the overall number of NAFS has improved compared to last year, when fourteen Member States had adopted NAFS, the replies received from Member States show that there are variations in the coverage and content of these strategies. For example, some strategies still needed to be updated to cover the new financial framework, while at the other end of the spectrum several NAFS were already adapted to account for new risks such as COVID-19 or financial risks associated with the implementation of the Recovery and Resilience Facility (RRF). For example, Bulgaria, Greece, France, Italy, and Hungary reviewed their strategies in light of their COVID-19 experience and to account for the new significant risks associated with the implementation of RRF. Czechia noted that new risks would be reflected in the update it had foreseen for the end of 2022. 1.2.Revenue EU Member States are invited to assess the risks and shortcomings of the national customs control strategies revealed through the COVID-19 pandemic, and to report lessons-learned and remedial measures taken in order to: ·improve flexibility for the type of customs checks; ·diminish the potential impact of unexpected future events; ·ensure the implementation of uniform controls within the EU. Furthermore, Member States are invited to assess the financial risks that might not have been sufficiently addressed during 2020 and to establish catch-up plans for carrying out appropriate customs checks where due to confinement measures such customs checks had to be cancelled or postponed e.g. checks at operators’ premises and physical checks before releasing goods into free circulation. EU and national customs policies made a significant contribution to the EU’s COVID-19 response in 2020 ensuring smooth trade flows for Europeans and protecting the EU’s financial interests. Some EU Member States were faster and more flexible in adjusting their control activities. The degree of divergence at national level and the differing length of confinement measures as well as country-specific challenges had an impact on EU Member States’ capacity to adapt to the harsh reality of 2020. It is now essential to explore all avenues for ensuring that the customs union and EU Member States’ customs authorities operate optimally, remain flexible and resilient in times of crisis and better anticipate problems. To this end, the responses received showed that sixteen Member States fully implemented the Commission’s recommendation to assess the risks and shortcomings of their national customs measures, four partially implemented, and six did not implement the recommendation. Overall, the responses submitted showed that all Member States successfully adapted to the constraints imposed by the COVID-19 pandemic and implemented flexible arrangements to continue their work as effectively as possible. Three commonalities between Member States became apparent when analysing their answers. Firstly, nearly all Member States prioritised the verification of COVID-19 related treatment and protective equipment and introduced measures to ensure these were swiftly processed and that no sub-standard goods entered the EU market. To this end Germany and the Netherlands, for example, introduced special codes in customs declaration to facilitate the quick recognition and processing of such equipment. Secondly, and deriving from the above, all Member States showed flexibility in terms of conducting their controls by relying, except in critical cases, on the use of digital means to carry out their tasks. The introduction of telework, the increased use of documentary evidence, electronic checks, remote interviewing, and the use of IT platforms to prioritise controls were examples of measures introduced during the COVID-19 pandemic. For example, Germany relied on an electronic system to process customs declarations to minimise in-person operations. The Dutch customs authorities adjusted their ship inspection procedures and switched from physical checks to shore-based observation and enhanced surveillance when in-person verifications were not possible due to sanitary restrictions. Finally, in connection with the identification of risks, Member States relied on risk profiling to prioritise and focus their limited capabilities on operations with a high financial risk, while postponing or at times simplifying controls for medium-low risk operations. Countries such as Latvia upgraded their national IT platforms to enable, for example, the selection of customs declarations for post-clearance inspections. The Netherlands developed a new system for sharing crisis information, to anticipate further similar events, while Poland suggested the use of automatic risk analysis to increase controls on customs declarations in specific risk areas. Such changes in control practices could inevitably have affected the quality of verifications and could have led to inconsistencies in addressing financial risks. To this end, the Commission invited Member States to report on whether they had assessed the risks that may not have been addressed in 2020 and implemented remedial measures to address them. As a result, sixteen Member States answered that they had fully implemented the recommendation, three implemented it partially, and seven did not implement it. Most Member States relied on risk profiles or similar arrangements to prioritise their work and therefore assessed that they had properly addressed most financial risks arising in 2020 and did not have to take remedial measures. In certain cases, authorities reported that some high-risk operations were controlled a posteriori, such as in Slovenia, and that in instances where controls had to nevertheless be postponed they were resumed as soon as possible in the second half of 2021 or in the beginning of 2022. The Netherlands noted that in 2022 it would focus on verifying documents of origin, as companies had been allowed to provide only copies during the first period of the COVID-19 pandemic. 1.3.Expenditure If not already done, EU Member States are invited to launch targeted risk management exercises linked to the impact of COVID-19 and the upcoming implementation of the Recovery and Resilience Facility. The way in which underlying data, as well as those concerning detected irregularities and fraud, are collected and used, needs to be further improved. The Commission will further develop the Irregularity Management System.

National authorities will need to report quality data that is reliable. All EU Member States should make use of the integrated and interoperable information and monitoring system that the Commission will make available for the Recovery and Resilience Facility and the EU budget. Risks can only be mitigated if they have been identified. A lost opportunity in terms of risk identification weakens EU Member States and exposes them to the full extent of the risks both in terms of impact and likelihood. It is therefore critical in the current circumstances that EU Member States perform in-depth and targeted risk assessments. This will contribute to strengthening rules on internal control frameworks. In this respect, transparency as regards the use of the public resources is key. It does not only constitute a deterrent element, but also involves civil society, contributing to improving taxpayers’ trust in how public authorities manage public money. Data analysis to identify and target suspicious transactions has become an essential part of the fight against fraud and its importance will continue to grow in the coming years. Asked whether they had launched risk management exercises linked to the impact of COVID-19 and the implementation of the RRF, eleven Member States reported that they had done so, fully implementing the recommendation, eleven did so only partially, and four did not implement the recommendation. Those Member States who undertook these exercises mostly integrated these risks into their annual risk assessments, particularly for COVID-19, or occasionally conducted separate analyses, as in the case of the RRF. Most Member States that had not yet implemented the recommendation stated their intention to include such risk assessments in the future. A few countries, among which Germany, estimated that there was no need to reassess their risk management strategies in light of the COVID-19 pandemic, for example. Some exceptions existed, mostly in the case of the RRF, whereby authorities noted they were still in the incipient phases of implementation of the RRF and did not have sufficient information to conduct such analyses, as for example in the Netherlands. When asked whether they had improved the manner in which they collected and used data, including on detected irregularities, fourteen Member States reported that they fully implemented the recommendation, seven did so partially, and five did not implement it. Those Member States that did not implement the recommendation assessed that the systems they had in place operated at optimal capacity and did not need improvements at the time. Most Member States reported that they had tailored their usage of IT systems such as IMS, Arachne, EDES, as well as a variety of national IT tools, to enhance the quality of the data they worked with. For example, for the management of the common agricultural policy in Croatia, the responsible authorities combined a variety of data sources to continuously monitor and evaluate implementation, including administrative IT resources, publicly available information, remote sensors, earth observation technology and space/satellite technology, mobile application, and geospatial data. Poland added three new IT applications to its system, which could be used to obtain data on entities from public registers, perform cross-checks to detect double financing of expenditure, or carry out electronic controls on projects. Concerning the final recommendation for the use of the integrated and interoperable information and monitoring system that the Commission made available for both the RRF and the EU budget, nineteen Member States reported they fully implemented it, four partially implemented, and three did not implement the recommendation. Arachne was the most commonly mentioned IT tool in relation to the implementation of both EU funds and the RRF, as most Member States had either been using it already or were planning to do so in the near future; it was followed by IMS and EDES. While Member States had clear plans concerning the use of these IT tools for the general management of EU funds, they were less specific in relation to the system they planned to use for the implementation of the RRF. Most Member States, however, noted that it was still early in the implementation of the national plans to be able to ascertain which system would fit their needs best, while a few national plans had not been approved yet.



2.Follow-up by recommendation Methodology and thematic analysis: The following section provides a comprehensive overview of the state of implementation of each recommendation and summarises the replies received from each Member State. This section is divided in three sub-sections, following the recommendations related to cross-cutting aspects of the fight against fraud, and the revenue and expenditure sides of the budget respectively. Each recommendation is analysed by firstly providing an overview of the number of Member States that addressed each of the questions related to a recommendation and secondly, by providing a summary of the most important details provided by each Member State. For the reader's specific reference, the Member States' original replies are listed in Section 3 of this document, "Member States’ replies". The analysis is based on 26 Member States’ replies collected during December 2021 – February 2022; Austria noted that they had no replies to the 2021 exercise. 1.4.Cross-cutting aspects of the fight against fraud The Commission provided the following questionnaire to the Member States with regard to addressing the first recommendation: Q.1 For the Member States not having joined the EPPO yet. Are there plans to join the EPPO in the short-medium term? If YES, can you provide some additional information on the state-of-play? Q.2 Have you adopted a national anti-fraud strategy?

If YES, did you communicate it to OLAF? If you did not communicate it, why? Please transmit it without delay. Has the NAFS been recently updated? If YES (+ date of update), does the strategy/update cover the new significant risks linked to the COVID-19 crisis and the RRF? Can you share what risks the new strategy has taken into account? If the updated strategy doesn’t cover such risks, why is it so? If NO (+ date of adoption of NAFS), is the update ongoing or are you considering updating it? Can you please indicate a timeline for the adoption of a new / updated anti-fraud strategy? The table below represents the overall results of the implementation of each question corresponding to the Commission’s recommendations. 1.4.1.Joining the EPPO Member States who had not joined the EPPO yet were asked whether they had plans to do so in the short-medium term. Twenty-two Member States had joined the EPPO at the time of reporting. Out of the five Member States that had not, Denmark and Ireland (both holding an opt-out from the area of freedom, security and justice), Hungary, and Poland stated that they did not intend to join. Sweden reported that it planned to join as soon as possible and that the government was working on a legislative proposal to this end that would be ready by the end of 2022. 1.4.2.Adopting a national anti-fraud strategy (NAFS) In response to the question of whether they adopted a national anti-fraud strategy (NAFS), eleven Member States replied that they adopted a NAFS, four adopted a sectoral one, while eleven were yet to adopt one. The replies showed a diverse picture in terms of the scope and content of the anti-fraud strategies adopted by the Member States, as reflected in the remainder of this section. Belgium had not yet adopted a NAFS at the time of reporting. The AFCOS was under restructuring, to enable the exchange of information between the various national and regional authorities, and ultimately the establishment of a national anti-fraud strategy. In the interim, its anti-fraud strategy was based on the strategies developed by the competent authorities managing the funds at regional level (e.g. ESF, ERDF) and the strategy implemented by Customs. Bulgaria adopted a NAFS in November 2020, covering the period 2021-2027, and communicated it to OLAF. It was developed by a working group of representatives of all authorities responsible for managing and controlling EU funds and those responsible for investigating fraud and took into account recommendations from the European Court of Auditors and Commission guidelines. The strategy reflects new significant risks, in particular in response to the outbreak of the COVID-19 pandemic and its economic and social consequences. It contains specific objectives for preventing and combating irregularities and fraud, responsibilities and a mechanism for monitoring the implementation of the measures. Czechia adopted a NAFS in June 2008 and updated it latest in May 2020; the strategy was communicated to OLAF. It further noted than an updated NAFS reflecting new risks, environment, and programming period would be adopted by the end of 2022. Denmark had not adopted a national antifraud strategy at the time of reporting, but several of the Danish AFCOS network-members had sectoral anti-fraud strategies, which also covered fraud with EU funds. Germany reported that it had not adopted a NAFS, but that a sectoral one was in place at the level of ERDF Lower Saxony, complementing the current management and control system and as a proportionate measure to prevent fraud. The authority expected that the risk of fraud and corruption for the 2014-2020 funding period would be low, based on its assessment of Lower Saxony’s performance in the 2007–2013 programming period. The strategy was being updated as part of the reform of the management and control system for the 2021-2027 funding period. Moreover, the ERDF managing authorities in the Länder focused on their own anti-fraud strategies and regarded their own management and control systems as a proportionate measure to prevent fraud. The risk of fraud was reviewed frequently in the context of the COVID-19 pandemic. Estonia updated its NAFS in February 2021, as the Anti-Corruption Action Plan 2021-2025, and a corresponding Action Report in January 2022. The Anti-Corruption webpage, which has been shared with the Commission, covers topics such as corruption or conflict of interests and consists of different guidelines, handbooks, e-courses. The Greek National Anti-Fraud Strategy for Structural Actions was adopted in 2014 and updated in 2017, including a comprehensive overview of its associated Action Plan; it was also communicated to OLAF. Although the action plan was completed, the Member State reported that the NAFS continues to be systematically implemented. In the context of the COVID-19 crisis and the new significant risks, a technical meeting of the Internal Cooperation Network on Anti-Fraud Strategy in Structural Actions was held in July 2021 and resulted in the adaptation of the managing authorities’ Fraud Risk Assessment Tool to include risks and measures related to the COVID-19 crisis. In addition, the Management and Control System (MCS) of the Fisheries and Maritime Operational Programme (MCS) incorporated procedures and measures to prevent and combat fraud specifically in the fisheries sector, although no formal anti-fraud strategy document was drafted. Concerning RRF actions, the Special Recovery Fund Coordination Service (ERFA) in Greece reported that an anti-corruption and anti-fraud strategy was developed based on prevention, detection and effective response, which set targets and specified further actions where necessary. Spain had not yet adopted a strategy but it reported that in 2020, the AFCOS prepared and presented to the Commission its project entitled “A national anti-fraud strategy for Spain”, related to financing within the framework of the Support Programme for Structural Reforms of the EU (SRSP – TSI). This project started in October 2021, with a duration of 19 months, and would serve to prepare a comprehensive NAFS, covering the four phases of the anti-fraud cycle (prevention, detection, investigation, and recovery/sanctions).

France adopted a new anti-fraud strategy in February 2022, developed by the Inter-ministerial Anti-Fraud Coordination Mission (MICAF), as AFCOS, in consultation with its partners, which it communicated to the Commission. The strategy covers significant new risks related to the RRF. The Member State set up a coordinating authority for the RRF - the Secretariat-General of the Recovery Plan (SGPR), under the authority of the Prime Minister and the Minister for the Economy, Finance and Recovery - which will centralise, among other data, any irregularities detected in the implementation of the RRF measures. Additionally, a working group of the various actors involved in the management of the new EU funds, led by MICAF, will work to identify fraud risks specifically linked to the allocation of these funds and exchange information in order to establish a typology of fraud in view of future risk mapping. Croatia referred to its previous anti-fraud strategies, the latest for 2014-2016 and which was sent to OLAF at the time, and noted it had been fully implemented. As the AFCOS became operational and no major weaknesses were identified, it adopted no new anti-fraud strategies and did not update its existing ones. The AFCOS system has been constantly fine-tuned through softer measures (e.g. irregularity management guidelines, fraud risk assessment at the level of operational programmes). In addition, Croatia adopted in October 2021 a “Strategy for the Prevention of Corruption for the period 2021 – 2030”, which set strategic goals in the field of the fight against corruption for this period. One of the 95 measures elaborated in the Action Plans specifically referred to “Further strengthening of the framework for prevention of irregularities and fraud in the institutional framework for the implementation of ESI Funds”. Italy’s NAFS was updated in November 2021 and communicated to OLAF in December 2021. The AFCOS collaborated with all the competent institutions to revise not only the strategy’s content, but its duration, by extending it to overlap with the resources available from the long-term EU budget and NGEU, and the evolution of the new potential risks of economic illegality (associated with the increasingly extensive use of specially developed IT tools). The Italian AFCOS circulated a questionnaire across all its affiliated institutions to ascertain what measures had been adopted, or were being implemented, to deal with the new risks of fraud linked to the pandemic and strengthen the prevention and fight against corruption, fraud, conflicts of interest, the risk of double funding, and the possible infiltration by organised crime. Measures included a greater collaboration between managing and control authorities, an increase in IT security, a better interoperability of the multiple existing databases, and a more effective use of technological tools. Cyprus had not adopted a national anti-fraud strategy at the time of reporting. It noted however that it had put in place a national anti-corruption strategy and that its parliament had recently approved a law establishing an Independent Authority against Corruption. Latvia’s NAFS was adopted in May 2020 to cover the period 2020-2022. It included mostly horizontal activities related to all the funds covered by the AFCOS Network – including the RRF - and all the new risks and circumstances could be taken into account when implementing these activities. An evaluation of the implementation of the strategy would take place in the beginning of 2023, based on which the scope and activities of the following NAFS would be decided. Luxembourg reported that its NAFS had been drafted and was currently under internal review. Hungary adopted a national anti-fraud strategy for 2021-2027, signed in August 2021 and transmitted to OLAF in February 2022. The strategy was complemented by a sectoral RRF Anti-Fraud Strategy, adopted by the Head of the National Authority. The COVID-19 crisis was assessed in Hungary’s annual fraud risk analysis. Malta finalised the update of its 2008 NAFS, which it had communicated to OLAF, in 2021. It included 23 action points related to the strengthening of the fight against fraud and corruption, three of which were also included as milestones and targets under its RRP. It noted that the strategy would be reviewed at regular intervals to reflect new risks linked to the COVID-19 crisis and the RRF. Portugal adopted a sectoral anti-fraud strategy for 2014-2020, drafted by the Inspectorate-General of Finance (IGF) in its capacity as audit authority and AFCOS for European funds. The strategy was currently under review, to account for the results of the audits conducted during this period and the new key fraud prevention requirements under the new EU regulatory framework 2021-2027. It would be communicated to OLAF as soon as the update was concluded. The IGF further noted that it carried out a targeted audit of the anti-fraud measures adopted by the managing authorities of cohesion policy funds, considered by the Commission to be a pioneering example of best practice, and the update was ongoing. Romania planned to adopt a NAFS at the end of 2022. The 'National Strategy for the Protection of the European Union’s Financial Interests in the Slovak Republic’, dating from 2015, was last updated in June 2019. The reporting authority noted that it was aware of the need for an update in order to address new challenges in the area of the protection of the EU’s financial interests, but that an exact timeline for the update had not been determined yet. 1.5.Revenue The Commission provided the following questionnaire to the Member States with regard to addressing the second recommendation: Q.3 Have you assessed the risks and shortcomings of the national customs control strategies revealed through the COVID-19 pandemic and reported lessons-learned and remedial measures taken in order to a) improve flexibility for the type of custom checks; b) diminish the potential impact of unexpected future events; and c) ensure the implementation uniform controls within the EU? If you implemented fully the recommendation, can you share any specific findings of your assessment? Can you share examples of lessons-learned you have reported? Can you please indicate what remedial measures have you taken to a) improve flexibility for the type of custom checks; b) diminish the potential impact of unexpected future events; and c) ensure the implementation uniform controls within the EU? Can you specify any outcomes of the remedial measures you have implemented? If you implemented partially the recommendation, could you please explain why you think it was a partial implementation and why a full implementation was not possible? Can you indicate at what stage you are currently in the implementation of this recommendation? Can you specify any outcomes of measures adopted so far? Can you indicate any future measures you will implement to achieve full implementation? If you did not implement the recommendation, could you please explain why? Q.4 Have you assessed the financial risks that might not have been sufficiently addressed during 2020 and have you established catch-up plans for carrying out appropriate customs checks where due to confinement measures such customs checks had to be cancelled or postponed e.g. checks at operators’ premises and physical checks before releasing goods into free circulation? If you implemented fully the recommendation, can you please share any findings of your assessment? Which outstanding financial risks have you identified? What measures have you foreseen to address these risks? Can you please give examples of how you plan to catch-up on carrying out appropriate customs checks that had to be cancelled or postponed due to confinement measures? Have you already established a timeline for doing so? What types of checks have you foreseen? Have you anticipated the possibility of recurrent confinement measures and, if so, how have you addressed this in your plans? If you implemented partially the recommendation, could you please explain why you think it was a partial implementation and why a full implementation was not possible? Can you indicate at what stage you currently are in the implementation of this recommendation?

If you did not implement the recommendation, could you please explain why? The table below represents the overall results of the implementation of each question corresponding to the Commission’s recommendations. 1.5.1.Assessment of the national customs controls strategies Member States were asked whether they had assessed the risks and shortcomings of the national customs control strategies revealed through the COVID-19 pandemic and reported lessons-learned and remedial measures taken in order to a) improve flexibility for the type of custom checks; b) diminish the potential impact of unexpected future events; and c) ensure the implementation uniform controls within the EU. In continuation, they were asked to share any specific examples of such measures or, where applicable, justify the lack of such measures. Sixteen Member states fully implemented the recommendation and assessed the risk and shortcomings of their national customs strategies, four did so partially, and six did not implement the recommendation. In Belgium, FPS Finance (Customs and Excise) reported that during the COVID-19 restrictions it prioritised certain risk areas, as its audit capacity was limited. For example, in certain regions, it controlled primarily goods such as facemasks and other COVID-related items. Although, overall, its capacity to carry out documentary checks increased during the pandemic, owing to increased telework, modifications of the type of control were not always allowed and physical checks remained mandatory for certain risks/fraud mechanisms. FPS Finance concluded that a larger number of selections than normal remained unchecked. Bulgaria referred to the Union Customs Code and the legal requirement that each Member State had to establish its own customs risk management procedures based on specific characteristics and available information. Consequently, customs authorities would have had to carry out risk management to differentiate the levels of risk associated with goods subject to customs control or supervision and to determine whether and where the goods would be subject to special customs controls. Czechia reported that the Customs Administration did not have to cancel or postpone any post-release controls in connection with the COVID-19 pandemic. The only change was in terms of the manner in which controls were carried out, to account for restrictions to the freedom of movement of persons and limit contact with the persons inspected. Specifically, in-person meetings were often replaced by sending correspondence, such as summons and presentation of documents. Additionally, customs authorities extended the time limits set out in the documents accordingly. These modifications were reflected in a slight increase – in terms of days - in the average length of post-release controls. Denmark specified that the Customs administration had to cancel only 14 controls during the COVID-19 pandemic, of which only two had a financial impact and were subsequently assessed as releasable without further control. The other 12 controls were either random or regarding hazardous, dangerous, or illegal goods. Germany reported that the organisational measures and targeted resource management during the COVID-19 pandemic ensured that customs offices operated properly and efficiently. For example, a ‘cohort principle’ and telework were introduced to protect staff; electronic customs declarations were processed with the interoperable computerised clearance system “ATLAS”; and support staff were flexibly relocated to vulnerable areas. The focus during this period was on the speedy clearance of COVID-19 protective equipment, for example via the use of a special code in the customs declaration so that such goods were processed directly and as a priority. Overall, Germany concluded that the protective measures instituted against COVID-19 affected the activity of the Auditing Service during 2020, in particular by increasing the time required to carry out audits. Consequently, audits mainly focussed on parties with high-risk potential and checks were performed remotely or at customs offices instead of the economic operators’ premises. This was facilitated by the recognition of digital documents and the exchange of documents as PDF/scan by e-mail where this was legally possible, with the subsequent transmission of the original documents as required. In addition, for a limited period of time, medium risk operations were suspended to reduce the number of controls that were not absolutely necessary and ensure a smooth flow of COVID-19 equipment. Estonia reported that all controls were implemented as foreseen and that it had prioritised safety controls of COVID-19 personal protective equipment. Ireland reported that the government had designated Customs an essential service and therefore its staff continued to work at ports, airports, and approved premises, which remained fully operational throughout the COVID-19 pandemic. Due to the reduction in passenger numbers additional resources could be directed toward clearance checks such that performance levels were not affected. Safety measures such as the use of PPE, social distancing, team bubbles, and remote working where possible were introduced to protect customs officers and traders and minimise the impact of a potential COVID-19 outbreak. Flexible controls allowed traders, for example, to submit scanned copies of documentation rather than the original for clearance checks, with the requirement that trade retain the originals. Greece’s Independent Authority for Public Revenue (Directorate-General for Customs and Excise) reported that controls on COVID-19 related items were increased and staff were given appropriate instructions to protect themselves, and the customs services, against the risk of COVID-19 during checks. Continuous feedback from the “first line” services led to adjustments of the measures in order to achieve the necessary flexibility of customs controls. In Spain, the Tax Agency, responsible for customs controls, noted that the recommendation was impossible to fully implement, because the diversity of effects of and responses to COVID-19 across Member States would make it impossible to adopt national measures to ensure uniform controls within the EU. The Tax Agency nevertheless indicated that the effects of the COVID-19 pandemic had not been significant for its customs control strategy. It noted that the containment measures adopted at EU level led to a radical reduction in international trade, which largely compensated for the difficulty/impossibility of carrying out certain controls. The Agency added that the main effect was in terms of physical customs controls and inspecting operators’ premises, but that overall the need for such controls had been much lower because of the reduction in imports. France reported that because of the reduced number of in-person staff in favour of teleworking it had to adjust physical controls on traditional own resources (TOR) and that national targeting in this area focused on the EU requirements for handling mutual assistance cases linked to the protection of the EU’s financial interests. Local targeting focused on new operators and those who had changed their trading or supplies during the crisis. Priority was given to documentary checks. With respect to future crisis management, France referred to the need to review business continuity plans to develop the capacity to redistribute missions to handle exceptional situations. In order to be able to conduct customs missions during new crises, it was important to strengthen the capacity for anticipation and response by defining crisis governance and crisis steers at central level and in devolved services. It was also considering possibilities to assert the role of customs vis-à-vis its external partners and to strengthen inter-ministerial and European partnership synergies. Croatia reported that no changes had been made in terms of the flexibility of customs checks beyond additional protective equipment for customs officers. Where applicable, control checks were less frequent in order to minimise the exposure of customs officers to COVID-19. Nevertheless, custom authorities made no exceptions for financial risks and all controls were conducted during the release for free circulation, in line with the National Health Administration’s recommendations regarding the COVID-19 pandemic.

Italy noted that priorities for the control of financial risks had been defined more restrictively because of diminished organisational capacity and availability of human resources during the COVID-19 pandemic. In this context, the Customs and Monopolies Agency prioritised high-impact financial risks, as these could not have been managed properly in post clearance controls. This led to a focus on cases in which there was an elevated risk or a high probability of fiscal evasion, the possible disappearance of a subject, or on cases in which the inspection of goods constituted a crucial factor in mitigating the risk. Mid and low level financial risks were addressed with post clearance controls, submitting the declarations to a document review (without physical interaction with the economic operator). Cyprus reported that the Department of Customs and Excise implemented a series of measures to counteract the impact of the COVID-19 pandemic on customs controls and to ensure the implementation of uniform controls within the EU, aligned with the guidelines prepared by DG TAXUD in collaboration with Member States. Specifically, economic operators in whose case controls showed no irregularities over a certain period of time were excluded from certain profiles and control officers had the leeway to decide not to pursue controls in duly justified circumstances, with the approval of the District Senior Customs Officer. Control officers also had the option to pursue physical controls in cases where they were dissatisfied with the documentary control of declarations that had been selected via the risk profiles included in the national systems. In addition, the national systems enabled some profiles to select a percentage of specific declarations for control. The authorities reported that even though the shift to remote work was sudden the flexibility implemented, particularly in terms of staff adaptability and the use of technology to produce reliable analytical reports for controls, ensured that the quantity and quality of customs controls remained unaffected. To account for the effects of unexpected future events, the Department of Customs and Excise started to restructure its customs information systems to better monitor customs facilities and perform targeted controls through the collection of data in a user-friendly manner. A new integrated information system, which will enable authorities to communicate better with the customs departments of other Member States and organisations and contribute toward the uniformity of controls within the EU. Latvia reported that no systematic changes were made to the implementation of control measures, which had taken into account international risk information, including the activities identified in OLAF's mutual assistance reports for each Member State. It mentioned that feedback on control results and risk assessment was always provided in response to OLAF reports. In respect of post-release checks, the authorities implemented an analytical solution in the SAP HANA platform, which was under development to enable the selection of customs declarations for post-clearance inspections. At the time, it had the capacity to assess the level of risk associated with declarations and commodities and select declarations with the highest possible financial risks for inspection. Lithuania reported that the assessment of the risks and shortcomings of the national customs control strategies was taken into account when drawing up the annual plans for Post-Release Audits (PRAs) and other types of post-release controls. It observed that, during the COVID-19 pandemic, the number, scope, effectiveness, and results of PRAs and other types of post-release controls were similar to and even higher than in previous years. Inspections were more flexible and control methods were modified, while the lack of physical checks was largely offset by the increased use of analytical tools and methods. Furthermore, Lithuanian customs observed strict protective measures when carrying out controls of vehicles and passenger items and cargo vehicles, with minimal personal contact where possible. Nevertheless, standard physical inspections were maintained for cases with high risk of violations, as determined by risk analyses, and reinforced controls were introduced for goods used to combat the COVID-19 pandemic, especially personal protective equipment. Overall, the authorities noted the lessons learnt in terms of managing high cargo flows with limited human resources and developing techniques to react to and manage emerging threats. Luxembourg reported that it had carried out a thorough analysis of the customs clearance controls performed during the period of COVID-19 restrictions (16/03/2020 – 24/05/2020). It found, as it had expected, that approx. 24% fewer physical controls were performed overall, approx. 22% fewer in the specific area of financial risks, and that more documentary controls were carried out overall compared to the same period in 2019. Luxembourg anticipated limitations concerning physical controls and focused on the risks of substandard, dangerous, or counterfeit goods related to COVID-19, such as protective or medical equipment. It emphasised, however, that no risk profiles were overlooked during this period. Overall, controls were conducted with the necessary flexibility, by relying on more documentary and post-clearance checks, and in line with EU guidelines, which also ensured the implementation of uniform controls. The lessons learnt would be incorporated into a risk mapping, which should serve as a crisis-management tool to support priority setting and diminish the impact of unforeseen events in the future. Hungary reported that it instituted, beginning with March 2020, transitional measures to make the types of customs controls more flexible in view of the COVID-19 outbreak. The National Tax and Customs Administration (NTCA) reorganized its core tasks to ensure continued operation and the protection of staff, introducing telework and management rotation, and identified measures and controls that could be cancelled or postponed for the duration of the pandemic. Resources were first directed toward what the administration categorised as ‘primary tasks’, which ensured the continuous operation of the supply chain, economic security, and public safety, among which inspections for high-risk customs operations and for products subject to prohibitions and restrictions, export authorisations, and processing client request where physical presence was not needed. The remaining resources were then focused on ‘secondary tasks’, such as inspections in cases of medium-level risk, post-release and on-the-spot checks, and in-person interviews. Specific measures were implemented to increase the flexibility of post-release controls, primarily by relying on remote, digitally conducted audits whenever possible, to protect staff. On-the-spot checks were carried out only where strictly necessary, with strict sanitary protocols in place. The Hungarian authorities identified the digitalisation of controls and telework to ensure effective controls as strategies to reduce the potential adverse effects of future incidents. Malta specified that customs control strategies during the pandemic did not have any particular impact on the Department’s operations at the border and physical controls were in line with pre-pandemic levels. Risk-profiles, based on information received, inter alia, through RIF Alert, were nevertheless updated regularly. The Netherlands reported that it did not assess the shortcomings of its national control strategy explicitly, but that these aspects had been indirectly addressed in its handling of the COVID-19 crisis. It identified and prioritised to the extent possible several vital customs processes, such as physical surveillance activities at sea ports and airports and the processing of transactions to levy and collect import duties and excise duties, including providing information to businesses. Overall, the Dutch Customs scaled down the level of enforcement only to a limited extent, while risk-based checks were carried out fully throughout this period. Random checks and checks for risk detection were not carried out for a period of approximately three weeks, to prioritise the safety of staff. ‘COVID-19 protocols’ were implemented to ensure the continuity of controls. For example, for administrative checks, Dutch custom authorities agreed with companies to share documents electronically in a secure environment or by email and interviews were held via a conference call or via Webex. Additional substantive checks were also carried out entirely digitally. Specifically for ship inspections, shore-based observation and enhanced surveillance replaced physical controls on board in the beginning of the pandemic. To anticipate future lockdown situations, the Dutch authorities drew up a protocol for the scaling-up and scaling-down of the level of enforcement of customs checks. Furthermore, they developed a new system for sharing crisis information – the National Crisis Management System – that includes all functionalities necessary in a crisis to swiftly collect and share information with internal and external parties. Poland’s National Revenue Administration reported that the impact of the COVID-19 pandemic on the capacity to perform pre-release controls was low. Measures taken to increase the flexibility of customs controls included intensifying controls on security and safety risks and maintaining control levels on high-risk customs declarations, while temporarily reducing the levels of reservations in customs declaration acceptance systems for other risk areas. For post-release controls, the Revenue Administration ensured the continuity of tasks by implementing strict sanitary protocols and relying on documentary inspections that were carried out at the office’s premises instead of the operators’. With respect to the possible impact of unexpected future events, the Polish authorities assessed that it would be possible to use automatic risk analysis to intensify checks on customs declarations in specific risk areas while lowering the levels of control in lower priority areas. To ensure the implementation of uniform controls within the EU, measures included the harmonisation of pre-release controls in the area of risk of undervaluation covered by the EU Reference Price System and the introduction of two-step checks in this area, whereby requests for post-release controls at importers’ premises could be requested where the results of pre-release controls were suspicious. In terms of the results of the measures implemented during the pandemic, Poland referred to the Commission’s Customs Union Performance (CUP) draft report for 2020, which showed that the number of import declarations increased by 10 % and the control rates in standard declarations and the levels of effectiveness of these controls were close to or higher than the levels achieved in 2019. Portugal reported that the Authority for Tax and Customs continuously monitored, supervised, and controlled the supply chain of COVID-19 related goods during the course of 2021, as it had been the case in 2020. It assessed that its activity helped facilitate the flow of legitimate and essential goods, protect the citizens against unsafe, unlicensed or substandard goods and at the same time, protect the financial interests of the EU and European companies. The authority implemented a series of risk profiles across entry, import, and control systems, which facilitated supervision, profiling, targeting, and control. Customs experts’ work included the responsibility to immediately share intelligence, risk information, alerts, and general knowledge throughout all regional and local customs offices. In Romania, the Directorate for Customs Supervision and Inspection asked the regional customs directorates to carry out specific risk analyses and select, for post-clearance checks, customs declarations for the release into free circulation of goods intended to combat the effects of COVID-19 and likely to contain incorrect data. It accounted for the urgent need for customs formalities for goods related to the management of the COVID-19 pandemic and the introduction of measures to prevent and combat criminal activities. The National Agency for Fiscal Administration approved a customs action plan for medical devices, health supplies, and medicines for the prevention and treatment of conditions relating to COVID-19. Slovenia referred to the Customs Action Plan, which ensured uniform controls within the EU and defined priorities for 2022-2023, and reported that due to the particular circumstances around the COVID-19 pandemic some associated actions could not be finalised within the schedule. As a result, actions from the current action plan that would not be concluded until the end of June 2022 and needed to be continued would be transferred into the 11th LEWP Custom Action Plan. Slovakia noted that the period during which physical checks could not be carried out was relatively short and all cases during that time were submitted to post-release checks. Finland noted that they had not observed any special risks that affected controls. The checks at operators’ premises were replaced with documentary controls and video conferences and, in its assessment, the change of control type did not affect the results.

Sweden reported that, due to existing contingency plans in the form of steering and supporting documents, Swedish Customs were able to react rapidly and adapt their organisation when the flow of goods changed as a result of the COVID-19 pandemic. It noted that Swedish Customs work in accordance with EU recommendations concerning customs controls. 1.5.2.Assessment of the financial risks insufficiently addressed during 2020 Member States were asked to report whether they had assessed the financial risks that might not have been sufficiently addressed during 2020 and if they had established catch-up plans for carrying out appropriate customs checks where due to confinement measures such customs checks had to be cancelled or postponed e.g. checks at operators’ premises and physical checks before releasing goods into free circulation. Sixteen Member States answered that they had fully implemented the recommendation, three partially implemented, and seven did not implement; they also provided details concerning the types of risks they had identified and compensatory measures for checks that had to be cancelled, some of which are summarised in this section. Belgium reported that declarations with a high potential financial impact, which could not be checked in 2020, were analysed a posteriori and the riskiest ones were controlled post-release. It mentioned that it was not, however, possible to include all selected but unaudited declarations for a posteriori control due to the limited capacity in the second line (post - release). The General Administration of Customs and Excise was considered an essential service during the crisis and critical controls continued to be carried out subject to some operational adjustments. Bulgaria reported that customs authorities assessed the newly emerging risks and updated their actions to control risky goods, operators or events in the context of the introduction of COVID-19 containment measures. They put in place risk profiles that identified risky goods that may not have met established standards — masks, protective clothing, disinfectants, tests - and risky companies entering the EU with substandard goods. The flexibility of customs controls was improved by introducing additional controls to identify financial risk events. It noted that improving customs controls, mitigating possible negative consequences of unforeseeable events, and ensuring consistency in the application of customs legislation was a constant priority for the administration. Germany considered that all financial risks were sufficiently addressed, as the appropriate measures had already been taken in 2020. Estonia reported no changes in custom control practices due to the COVID-19 pandemic and assessed that all controls were implemented as foreseen. Ireland referred to its multi-faceted risk focussed Customs annual compliance program that underpinned compliance with EU and national Customs legislation. The program combines frontier controls at clearance, both physical and documentary, with a post-clearance program ranging from single aspect checks to Customs audits. It identifies cases for both pre-clearance and post-clearance using sophisticated electronic risk assessment, including risks identified during both pre and post-clearance checks, and risk profiling tools. Ireland further reported that clearance checks were temporarily suspended for approximately three months in the beginning of the pandemic, but that no specific risks associated with the pandemic were identified in either pre or post clearance checks. Consequently, no controls targeting pandemic issues were pending. It noted however that the overall customs control and monitoring framework was dynamic and the national compliance program would be adapted to ensure it addressed any potential new risks. The Greek Independent Authority for Public Revenue (Directorate-General for Customs and Excise) reported that it identified no fiscal risks that had not been sufficiently addressed. Customs authorities prioritised controls according to established risk profiles drawn from the risk analysis system. The Spanish Tax Agency referred to its annual tax and customs controls plan, which covered all companies to be controlled and complemented the controls prior to customs clearance. The plan covered the risks related to the difficulties of carrying out controls under the restrictions imposed by COVID-19 sanitary measures. It noted that physical inspections during pre-clearance customs controls were maintained in areas in which such control was essential. France reported that during the COVID-19 crisis inspections associated with traditional own resources were maintained where mandatory, in particular as a result of mutual assistance cases or where they could only be carried out in the form of a documentary check. In addition, authorities requested that ex-post controls take into account the difficulties faced by companies in the context of the lockdown. To this end, the scope of requests for disclosure of documents had to be clearly defined. As part of the three-phase recovery plan, the documentary checks at the time of clearance were intended to prepare for ex-post controls. A specific inspection campaign was put in place to verify compliance with the obligations relating to exemption entitlements. Croatia reported that there had been no exceptions in addressing financial risks, as all of the detected ones were checked during the release of goods into free circulation. Italy’s Customs and Monopolies Agency reported that financial risks faced during 2020 had been managed adequately by the Italian system of risk management. There were no control activities leading to invalidation. Post-clearance controls (ex officio or at the economic operator’s request) were based on documentary evidence requested from economic operators. In addition, ex-post inspections were carried out to ensure that EU measures of exemption from import customs duties had been correctly applied for goods aimed at fighting the effects of the COVID-19 pandemic. The Department of Customs and Excise in Cyprus assessed that it was able to carry out all necessary checks during the period of confinement triggered by COVID-19, but noted that it had prioritised controls related to security and safety risks linked to it. In this respect, the department reported that the high demand for personal protective equipment during the pandemic led to an increase in IPR infringements for these types of products and the production of non-compliant goods. The Latvian Customs Administration developed a risk management policy and produced annual reports on the effectiveness of its customs risk management system, accompanied by plans for risk mitigation measures for the coming year. This included setting levels of specific financial risks based on potential impact and probability, and planning appropriate control measures. It concluded that the risk mitigation measures in 2020 were implemented in accordance with the prepared plans, set priorities, and international risk information and guidelines, and therefore no compensatory measures were required. Lithuania reported that the number, scope, effectiveness, and financial results of post-release audits (PRAs) and other kinds of post-release controls during the COVID-19 pandemic years were similar to and even higher than in previous years. There were no cases when, due to confinement measures, PRAs or other customs controls were cancelled or postponed for an unacceptable period and therefore there was no need to develop catch-up plans. Luxembourg referred to the results of its analysis of the customs clearance controls performed during the period of COVID-19 confinement (16/03/2020 – 24/05/2020) and noted that the report allowed the identification of customs declarations selected for control at clearance stage by electronic risk profiles, including financial risk profiles. The analysis showed that all financial risks had been addressed, at least by documentary control. By indicating amongst other elements the type of control, i.e. physical or documentary, as well as control results, the report served as a basis for the planning and focusing of post-clearance controls. A “safety-net” for any shortcomings in terms of customs controls would become part of the risk mapping mentioned under Q3. Hungary reported that it did not need to establish any catch-up plans since the customs authorities did not have to cancel or postpone checks because of COVID-19. Inspections of the premises of economic operators took place where necessary, in consultation with them and respecting sanitary conditions. It noted, however, that the post-clearance verification of the conditions for the exemption from customs duty for protective equipment related to the virus represented an additional burden for the directorates concerned. Malta reported that all planned controls and checks were conducted on time, prior to release into free circulation, which therefore eliminated the emergence of possible financial risks due to lack of planned customs controls.

The Netherlands reported that it did not scale down at all the level of enforcement with respect to financial risks. Random checks and checks for risk detection were only scaled down for a short period of approximately three weeks. In terms of financial risks, it underlined that in 2022 administrative checks would focus on the original documents of origin, as companies were allowed to provide copies of these documents during the initial phase of the crisis. In addition, authorities continuously prioritised COVID-19 protective equipment with the exemption code C26. Poland noted that no physical checks carried out before goods were released into free circulation had to be cancelled or postponed due to restrictions on movement. Similarly, no checks at the premises of operators had to be cancelled or postponed for post-release controls. Consequently, it was not necessary to establish supplementary plans for carrying out the checks in question. Portugal referred to specific methodologies that were designed and implemented for audits and other controls when checks on site (at economic operators’ premises) cold not take place. Level one checks were carried out by relying on the information available on the tax and customs authority’s systems - concerning accounts, movements of goods, stocks in warehouses, internal sales/purchases, intracommunity information on sales and acquisition of goods and services - as well as open sources, to prepare for future checks at economic operators’ premises. It noted, however, that services at border and customs offices were always delivered physically, even during the hardest times of the pandemic. Romania reported that during 2020 the authorities controlled companies that released into free circulation goods necessary to combat the effects of the COVID-19 pandemic and that benefited from relief from customs duties and from import VAT exemption. Related risk analyses were carried out at regional and local level, including the selection of customs import declarations. Slovenia specified that in the first half of 2020, a number of post-release controls were postponed due to the lower availability of taxpayers due to the COVID-19 epidemic and no checks were carried out at the headquarters of companies. However, these postponed controls were resumed in the second half of 2020 and an appropriate number of ex-post controls were carried out on an annual basis. Slovakia reported that physical inspections of goods were carried out, in full compliance with COVID-19 hygiene measures, as soon as checks were possible again. It noted a lower number of reported irregularities (fraudulent and non-fraudulent) compared to previous years, due to the overall decrease in the import volume caused by the COVID-19 pandemic. Finland noted that the number of controls before releasing goods into free circulation was the same as in the previous year and did not have to be replaced with post-clearance controls. Audits and post-clearance controls were carried out according to the audit plan. Auditors inspected documents or electronic material in their offices and had video conferences with companies; they visited premises only if necessary. Sweden reported that the pandemic did not affect, from an operational perspective, the Swedish Customs’ capabilities in terms of profiling, risk-assessment and intelligence operations. The organisation was never in lockdown, staff absenteeism was not critical, and the adaptation to telework was quick and not affected by the circumstances. 1.6.Expenditure The Commission provided the following questionnaire to the Member States with regard to addressing the third recommendation: Q.5 Have you launched targeted risk management exercises linked to the impact of COVID-19 and the upcoming implementation of the Recovery and Resilience Facility? If you implemented fully the recommendation, can you please describe what type of exercises have you launched? Can you share any specific findings of such exercises? If you implemented partially the recommendation, could you please explain why you think it was a partial implementation and why a full implementation was not possible? If you did not implement the recommendation, could you please explain why? Q.6 Have you improved the manner in which underlying data, as well as those concerning detected irregularities, are collected and used? If you implemented fully the recommendation, can you indicate how this was achieved? Could you indicate which new data collection methods you have introduced and/or how you have improved existing ones? Could you indicate which measures you have implemented to improve the usage of data? Could you specify how these measures strengthen the existing framework for data collection and usage? What measures have you put in place to ensure the quality and reliability of data? Can you share any specific findings in relation to these measures? Has the quality and reliability of data, including those concerning detected irregularities, increased or remained stable overall? If you implemented partially the recommendation, could you please explain why you think it was a partial implementation and why a full implementation was not possible? What was the outcome of the procedures you have introduced so far? If you did not implement the recommendation, could you please explain why? Could you explain how your current framework already ensures high quality and reliability of data? Q.7 Will you use the integrated and interoperable information and monitoring system that the Commission has made available for both the Recovery and Resilience Facility and the EU budget? If you implemented fully the recommendation, can you indicate whether it is already fully or partially operational? By when will it be fully operational? Add any useful detail to explain the state of play.

If you implemented partially the recommendation, could you please explain why you think it was a partial implementation and why a full implementation was not possible? To what extent will the use of the system cover the RRF and the programmes for the programming period 2021-2027? If you did not implement the recommendation, could you please explain why? The table below represents the overall results of the implementation of each question corresponding to the Commission’s recommendations. 1.6.1. Targeted risk management exercises linked to COVID-19 and the RRF In response to the Commission’s recommendation that Member States launch risk management exercises linked to the impact of COVID-19 and the implementation of the RRF, eleven Member states reported that they had fully implemented it, eleven partially implemented, and four did not implement the recommendation. In Belgium, the Brussels-Capital Region ERDF Programme Management Authority set up a targeted risk management exercise for the implementation of the RRF, fully implementing the recommendation. It deployed a system for detecting, preventing, and sanctioning serious irregularities (fraud, corruption and conflicts of interest) among the projects selected. Project managers participated in collective and individual trainings on the specifics of their projects in terms of irregularities. Project fiches were drawn up for each project containing all the information project managers are required to send periodically to ensure there are no irregularities. It therefore assessed it fully implemented the recommendation. In addition, Belgium’s ERDF Wallonia authority reported partial implementation. It noted that the main COVID-related risks concerning ERDF expenditure were covered by the existing control systems and subject to the same requirements. Specifically for the RRF, the authority would carry out risk management exercises in the very near future and would audit the management and control system before the first payment request to the Commission. Notably, an inter-federal monitoring committee was set up to coordinate the work of the various RRF stakeholders, including in terms of anti-fraud strategy. Bulgaria carried out an assessment of the risks related to the COVID-19 pandemic, including the lack of sufficient time for verifications, less rigorous controls by managing authorities in general and reduction of on-the-spot checks, poor communication during teleworking, and pressure for speedy payments for measures financed in response to the COVID-19 crisis. As a result, the audit methodology for project verification and contractor selection procedures were adapted, as well as the methodology for verifying compliance with state aid rules. In relation to the risk management of the implementation of the RRF, in 2021 the Bulgarian National Fund Directorate - the RRF central coordinating unit – circulated a questionnaire to help the structures responsible for the implementation, monitoring, and reporting of the Recovery and Resilience Plan (RRP) assess their internal financial management and control systems, including administrative capacity, in order to identify areas that needed to be strengthened. Additionally, the draft management and control system for the facility required the National Fund Directorate and each monitoring and reporting structure to conduct a fraud risk assessment to identify effective and proportionate anti-fraud measures concerning the investments it monitors. It covered risks and restrictive controls in three key areas — selection of proposals to implement investments, implementation of investments and public procurement – and would be implemented after the launch of the RRP and the implementation of its management and control activities. Czechia reported full implementation concerning COVID-19 and partial in reference to RRF. The National Coordination Authority (NCA) identified several risks in connection with the impact of the COVID-19 pandemic, including the non-eligibility of expenses, delays in supply and suspension of some activities financed from ESI funds due to force majeure, and not meeting project objectives. In response, the NCA in cooperation with the Ministry of Finance prepared methodological instructions on the eligibility of expenditure and preventive measures due to force majeure, which the managing authorities implemented by, for example, adjusting the implementation time schedule or the range of project activities. The managing authority of national programmes in the area of home affairs (i.e. ISF and AMIF) continued its standard yearly risk analysis, which included risks linked to the impact of COVID-19, both on the level of programmes and supported projects. As a result, it adopted measures to mitigate such risks and provide more flexibility to beneficiaries (e.g. providing remote services) to successfully complete these projects, while focusing on the audit trail. In relation to the implementation of the RRF, the NCA categorised component owners into one of three ‘readiness’ groups – most, medium, and least prepared - based on an assessment of the opportunities and risks/uncertainties of implementation that included its management and control system. The least prepared groups took action to address existing deficiencies. Among the most common risks identified were the setup of the information system for data collection or project intake and staff capacity. The NCA noted that the assessment only reflected initial risks and expected that these would continuously change as implementation progressed (e.g. unavailability of certain materials, extending delivery times). Denmark reported that the different bodies that were executing the projects under the RRF were included in an assessment regarding project-specific risks and resulting controls. Furthermore, auditing would be based upon an overall risk assessment for every project conducted by the responsible bodies. Germany reported that no new targeted risk management was to be introduced with regard to the impact of COVID-19 on the federal ESF programme. However, the ESF managing authority was planning to examine and include possible new risks arising from the COVID-19 pandemic in its next self-assessment. ERDF Berlin concluded that there was no need to reassess, in the context of the COVID-19 pandemic, the risk of fraud related to measures under the ERDF operational programme for Berlin. Its review considered, in particular, the relaxations introduced as part of the adjustment of the legal framework in connection with the Corona Response Investment Initiative (CRII and CRII+), the temporary framework for state aid and simplifications in public procurement. Similarly, the Bremen ERDF Management Authority did not implement any additional targeted risk management exercises. However, one of the intermediate bodies, the Bremer Aufbau Bank (BAB), launched control mechanisms for COVID-19 financial aid. ERDF Lower Saxony relied on its own systems, which it considered sufficient. ERDF Rhineland-Palatinate reported that it was not directly affected by the implementation of the RRF in the ERDF, but that it had coordinated the new ERDF OP with the Federal Government’s recovery and resilience plans (DARP) and, as part of the ERDF approval process, carried out crosschecks with the beneficiaries of special COVID-19 aid. Estonia reported that in the autumn of 2020, at the start of its annual risk assessment exercise, the ESIF Managing Authority (State Shared Service Centre) held a workshop focused on the potential impact of the COVID-19 crisis, both in terms of finances and action indicators; it aimed to map, assess, and identify possible risks. Managing authorities used risk assessments in their day-to-day controls to inspect the costs of COVID-19 (e.g., procurement of medical supplies and vaccines, vaccination costs), in conformity with the required two-level checks of procurements. Concerning measures for the reimbursement of vaccination costs, the managing authority validated the control procedures of the beneficiary (Estonian Health Insurance Fund) to guarantee the effectiveness of their controls and performed additional random checks. When implementing the RRF the respective ministry, as the developer of the measure, was obliged to assess possible risks in the project implementation in the following categories: double funding; target group risks, including fraud and conflict of interest; state aid, and ensuring competition. In addition, an annual assessment of cross-administrative risks was carried out in the context of all external instruments implemented – for example, in 2021 Estonia assessed the RRF risks, the 2014-2020 period, the 2021+ period, and the Norwegian / EEA risks together. Ireland noted that its current focus was on implementing the projects in the National Recovery and Resilience Plan in compliance with the RRF regulation. The Greek Financial and Economic Crime Unit reported that it increased controls of undertakings marketing critical products for the management of the COVID-19 pandemic, such as antiseptic solutions and surgical masks, to ensure that products that did not meet the necessary specification and posed a threat to public health did not enter the market. The Financial Audit Committee (Audit Authority) noted that the operations/sub-projects addressing the consequences of the COVID-19 outbreak constituted a separate stratum per fund in its audit strategy, because the risk associated with these operations was different from the other operations. In addition, it drew up specific instructions concerning the audit of these operations/subprojects, aimed at risks related to, among others, the eligibility of expenditure, on-the-spot verifications, and public procurement procedures.

Concerning the National Recovery and Resilience Plan (NNRP), the Greek Audit Authority reported that it adopted an initial audit strategy in October 2021, focused on aspects such as specificity, value, materiality and retroactivity of NRRP actions. The authority noted that the strategy would be updated and more specific planning based on risk analysis for audits related to the RRF would be reflected in its 2022 report. Spain referred to the Recovery, Transformation, and Resilience Plan Management System, which introduced the obligation that the entities responsible for the implementation of the Recovery, Transformation, and Resilience Plan carry out fraud risk assessments of the activities they undertook. However, given the date of the approval of the plan and the progress with its implementation, these evaluations were still under development. Concerning other EU funds, periodic evaluations of the risk of fraud were carried out, but included those associated with the COVID-19 pandemic only for certain programmes. France’s ANCT, as coordinating authority, communicated to the managing authorities in March 2021 the European Commission’s recommendations concerning COVID-19 impact risk assessments, in a letter titled “Necessity to update fraud risk assessments and to adapt anti-fraud measures by the managing authority in the context of CRII/CRII + and REACT-EU measures”. These elements were clarified in a working group addressed to the internal control correspondents of the French managing authorities in May 2021. Croatia reported that the risks associated with the COVID-19 pandemic were taken into account in the annual risk assessment of the Operational Programme Competitiveness and Cohesion 2014-2020, to which all bodies in the management and control system of the ESI funds participate. The findings showed an increased risk in relation to the extension of the deadlines for the submission of documentation by the beneficiaries and those for the grant award procedure. In addition, it identified the risk of an increased number of requests for contract changes in the implementation phase due to the circumstances caused by the COVID-19 pandemic. No information was yet available regarding risks associated with the implementation of the RRF. Italy’s Agency for Territorial Cohesion reported that in 2020 it modified several operational projects in order to maximise the opportunities offered by EU structural funds that targeted needs arising, directly or indirectly, from COVID-19 emergencies. The Ministry for Sustainable Infrastructures and Mobility analysed, in December 2021, the impact of COVID-19 and related measures put in place to reduce the risk of fraud and concluded that the operational project it managed was exposed to a tolerable risk. The Ministry of Economy and Finance – DRGS IGRUE and the Agency for Territorial Cohesion issued "Operational guidelines for the Management Authorities and Audit Authorities for the execution of the verifications of their respective competence on the operations implemented to deal with the health emergency ". The document provided indications on the methods of controls in the new simplified regulatory context, in order to guarantee the legality and regularity of the operations in any case. In particular, it advised audit authorities to examine the composition of the population in order to obtain an appropriate sampling method and recommended the use of the stratification of expenses related to the COVID-19 health emergency. Cyprus reported that it conducted separate fraud risk assessments concerning the implementation of the RRF and COVID-19 schemes, which accounted for all relevant risks associated with several key pillars: selection, implementation, verification, certification, payment, and procurement. All potential risks were identified and described, and controls were designed in order to mitigate the risks associated with each pillar. A specific action plan was put together to eliminate any material impact of any remaining risks resulting from potentially ineffective controls. Additionally, it designed several other procedures to be implemented from 2022 onward. The Treasury of the Republic of Cyprus and the Directorate General Growth developed a circular to align national and EU measures for public procurement and ensure the prevention, detection, and correction of any possible suspicions of fraud or conflict of interest. Additionally, all procurement and grant schemes selection procedures above specific thresholds would be controlled for conflicts of interest, facilitated by the use of the Arachne tool and the Ultimate Beneficial Owner (UBO) national register. A modification of the applicable national regulation granted all European level audit and control bodies (OLAF, EPPO, ECA, EC) access to the UBO registers. Several of Latvia’s ministries reported that they had carried out risk assessments concerning both the impact of the COVID-19 pandemic and the RRF. The Ministry of Finance informed that the risks of the Recovery and Resilience Facility (RRF) were evaluated and approved during a risk management group meeting held in 2021, during which it also assessed the impact of COVID-19 on human resources and capacity. At the end of 2020 the Ministry of Agriculture, which performs yearly updates of its risk register, assessed that the probability of manipulation of cost demands and delivery of non-compliant products had increased. In order to prevent possible fraud, the Rural Support Service performed remote controls and in suspicious cases carried out enhanced controls and, as far as possible, suspended the approval of payment claims until the situation improved. The Ministry of Environmental Protection and Regional Development identified the risk of increased supplies of non-compliant goods or unjustified changes to contracts and took corrective measures. It performed remote controls and, where there were doubts about the projects, carried out on-the-spot inspections when COVID restrictions were lifted. Finally, the Ministry of Welfare and the Ministry of the Interior informed that risk assessments included the impact of COVID-19 risk and that mitigation measures were identified accordingly. Luxembourg informed that its Recovery and Resilience Plan contained an assessment of all relevant risks related to control systems and outlined the different actions to be taken to implement an adequate system that managed these risks. However, it noted that the plan included only a small number of projects, mainly linked to the digital and green transition, which were not specifically vulnerable to the impact of COVID-19 related risks and concluded that the specific risks related to COVID-19 were limited. Hungary reported that its national legislation had to be amended as a consequence of the emergency measures associated with the COVID-19 pandemic, but that these measures were provisional. The impact of the COVID-19 crisis was included in the yearly fraud risk analysis and managing authorities would continue to address these risks at first level controls. The authorities identified no increased risk in the area of public procurement, as the derogations related to the state of emergency triggered by COVID-19 were not applicable in the case of EU development funds. Concerning the RRF, it recalled that negotiations on Hungary’s Recovery and Resilience Plan (RRP) were still ongoing. It specified that Chapter 3 of the Plan would set out in detail all the planned control and audit activities to ensure that implementation risks would be mitigated and that funds would be used properly. Malta reported that work on its risk register linked to the Recovery and Resilience Plan was in its final stages under the responsibility of the Planning and Priorities Coordination Division (PPCD). It specified that the foreseen measures would strengthen the internal control system by putting in place mitigation measures for the prevention, detection and correction of cases of irregularities, conflict of interest, corruption, fraud and double funding. The Netherlands noted that the modalities for the implementation of the RRF were not sufficiently clear yet to complete a full risk management exercise, but that risk assessments would nevertheless be included during implementation. In respect of shared management funds, it reported that its assessments of COVID-19 related risks concluded that since only a few additional activities were undertaken, there had been few additional risks that the money were used improperly. In the context of the COVID-19 outbreak, Poland set up several mechanisms to ensure that the spending, accounting, and control of EU funds continued to be properly monitored, based on the so-called ‘special fund law’ that was extended until 31 December 2023. The law introduced measures such as extensions of the deadlines for submitting applications for funding in individual competitions; conducting extraordinary calls for projects; extending/suspending deadlines in administrative proceeding; and allowing controls and audits to be suspended in exceptional circumstances (provided they would be supplemented subsequently, where justified by the risks involved) or, if possible, carrying them out remotely or using electronic means of communication. The application of part of the ‘Guidelines for monitoring the implementation of 2014-2020 operational programmes’ was suspended to ensure that controls continued to be carried out efficiently. Specific measures included carrying out on-the-spot checks remotely, based on the documentation provided/available and planning to carry out monitoring visits to project sites to confirming the initial verifications once the pandemic restrictions were lifted. Furthermore, two specific IT applications developed by Poland, SKANER (for the verification of entities based on data from public registers) and Cross-Checks (correlated invoices which could be used to detect double financing of expenditure), assisted in both the implementation of the RRF and with measures associated with the impact of COVID-19. Portugal reported that it had collected information to identify risks of fraud, including those related to the impact of COVID-19 and the implementation of the National Recovery and Resilience Plan (NRRP), as part of the update to its NAFS but that it had no definitive results that could be shared yet. The Institute for the Financing of Agriculture and Fisheries (IFAP) explained that they systematically weighed risk analysis in several of their areas of activity, namely administrative checks, on-the-spot checks and audits, including related to the impact of COVID-19 and the RRP. The Agency for Development and Cohesion (IP - AD&C) stated that under the RRP, there had been systemic analyses of double funding from cohesion policy funds and RRP financing. Romania’s Ministry of Investments and European Projects — Managing Authority for the Operational Programme ‘Technical Assistance’ (AM-POAT) reported that, in the context of the COVID-19 pandemic, most training activities, conferences, and seminars planned for 2021 as part of technical assistance programmes were held online where possible or were postponed to 2022. A series of programmes were consequently modified to account for the changes in the implementation of the corresponding activities. AM-POAT also identified two main risks linked to the impact of COVID-19, in relation to the emergency procurement procedure and management verifications. It noted that management verifications were carried out at the same high level as in previous years and that there were no specific findings resulting from these checks. As in previous years, the number and amount of irregularities remained at the lowest level. No emergency procurement had been submitted to AM-POAT for ex-post verification by January 2022. The Ministry of European Investment and Projects — Managing Authority for Competitiveness Operational Programme (AM-COP) finalised the fraud risk assessment based on the need to adapt anti-fraud measures in the context of the CRII/CRII + and REACT-EU objectives. The Ministry of Investment and European Projects — Directorate-General for Management of Recovery and Resilience Mechanism (MIPE — DGMMRR) noted that it had already defined a set of risks identified for all components/reforms and investments in the preparation phase of the RRP. Concerning the implementation phase of the RRP, it was in the process of defining risks in terms of both impact and probability. The Office of the Republic of Slovenia for Recovery and Resilience was established in August 2021 and had only started the implementation system of its RRP. It committed to include targeted risk management exercises in the documents it would prepare. Slovakia reported variation in how the AFCOS network partners addressed risk management in the context of COVID-19 and the implementation of the RRF. The Ministry of Environment, the Ministry of Health, the Ministry of Agriculture and Rural Development and the Agricultural Paying Agency, in their capacity as managing authorities for various operational programmes, all evaluated the impact of COVID-19 on individual risks within the framework of their regular risk analysis and assessments. The Ministry of Investments, Regional Development and Informatisation (MIRDI) also noted that it used all IT tools, such as Arachne, to protect the EU's financial interests. In 2021, however, it identified no specific risks associated with the COVID-19 pandemic, as the Interreg programs did not introduce simplified expenditure control rules, but would consider risks in preparation for the following programming period. It had already planned several risk mitigation measures, including avoiding double financing; the interoperability of IT systems for the Cohesion Policy and the Recovery and Resilience Mechanism; and ensuring a fully electronic data exchange between bodies involved in the implementation of EU funds, including setting up a framework for online meetings and control of activities.

The Supreme Audit Office of the Slovak Republic (SAO SR) changed the goals and focus of its planned audits due to the pandemic. In 2021, based on its risk analyses, it planned two audits related to COVID-19 for 2022 and it will present the results in individual reports. Overall, drawing on its activities during the pandemic, the office underlined the need for the increased digitalisation of public administration processes. Representatives of SAO SR were also participating in regular exchange of views, via the international working group for the RRP, to discuss specific issues related to the oversight of the RRF and national RRPs. Concerning the RRF, the Government Office of the Slovak Republic, acting as the National Implementation and Coordination Authority (NICA) responsible for the implementation, monitoring and overall coordination of the RRP, reported that it had launched the process of risk management concerning its upcoming implementation. It had planned to create a risk database, which would monitor thematic and horizontal risks – e.g. public procurement, Strategic Environmental Assessment (SEA), and Environmental Impact Assessment, political risks - as a tool for detailed monitoring of risks at the level of milestones and targets. Furthermore, NICA imposed an obligation on the executors of the RRP to perform fraud risk self-assessments, before 31 March 2022, which would be centralised into a catalogue/list of risks. Finland noted that the preparations for the implementation of the RRF were still ongoing, yet it had paid particular attention to the organisation of internal controls to mitigate the risk of fraud, corruption, conflicts of interest, and double funding. The implementation of the RRF would be based on the regular national budget management system, but the latter would need to be supplemented in order to meet EU level requirements related to controls and collection of data. Sweden noted that the government advocated a risk-based approach when it came to the management of EU-funds and the implementation of the RRF and ensured system-level capacity for an appropriate management through the framework for internal management and control. The managing agencies and the auditing agency were responsible for risk management exercises and had considerable freedom in their daily operational work. 1.6.2. Improved data collection and usage When asked whether they had improved the manner in which they collected and used data, included on detected irregularities, fourteen Member States reported that they fully implemented the recommendation, seven partially implemented it, and five did not implement it. In Belgium, the Managing Authority for the ERDF Programme of the Brussels-Capital Region reported partial implementation. It described that it adapted to the new logic of milestones and targets inherent in the RRF and consequently extended the focus of its risk analysis from concentrating exclusively on the regularity of expenditure to analysing projects as a whole. To this end, it had for example asked project managers to communicate the mechanisms for detecting irregularities that were already in place within their organisations, to ensure that these constituted an effective first barrier. The Authority would also collect more systematically the information provided for in Article 22(2)(d) of the RRF Regulation, to optimise its use of the Arachne tool. The Belgian ERDF Wallonia authority reported that improvements to the data collection system had already been done in 2020, following the Audit Authority’s conclusion that the system was reliable. A new and improved system was currently under design and would be operational in the second quarter of 2022, which is why it assessed it had not yet implemented the recommendation. The system would integrate 2021-2027 ERDF programming period expenses and indicators as well as RRF expenses. Bulgaria referred to the whistleblowing systems that were set up in the structures administering funds, instruments and programmes co-financed by the EU budget. It explained that the competent bodies established whistleblowing/irregularity files in which all relevant documents would be attached. Overall, the analyses of the procedures for the management of irregularities showed a significant improvement in the mechanisms for reporting irregularities to the European Commission, via the Management and Monitoring Information System 2020 (UMIS 2020) and IMS. Annual analyses of the results and activity reports of the bodies administering funds, instruments and programmes co-financed by the EU budget showed an improvement in the internal financial management and control systems, as well as the reinforcement of anti-fraud measures. The Central Coordination Unit Directorate of the Administration of the Council of Ministers in Bulgaria, the national coordinator of the Arachne system and manager of access profiles, reported that 510 user accounts had been created by the end of 2020. Increasing the number of users helped to identify and assess projects with a high risk of fraud, conflict of interest and irregularities at an early stage. Czechia noted that while several managing authorities concluded that it was not necessary to improve the manner in which underlying data, as well as those concerning detected irregularities, were collected and used, others focused mainly on improving the quality of collected data concerning the identification of interconnected irregularities. Their aim was to find and identify links between reported cases of irregularities in order to report the irregularity in IMS, even if the currently solved separate irregularity did not exceed the 10000 EUR limit and thus would not require a division of irregularities. This measure aimed to strengthen the relevance and use of the collected data. It added that the existing framework and procedures already provided for close cooperation between beneficiaries and managing authorities, thus enabling lasting and optimal data mining/extraction. Czech authorities assessed that no additional measures were needed since there were no sources of new data linked to the impact of COVID-19 and the functioning of the system so far had proven capable to guarantee high quality and reliability of the data. Denmark outlined an approach to assess underlying data in collaboration with the relevant bodies, but noted it had not begun the process of including these bodies in examining specific data and identifying what type of data they could deliver. Germany assessed that, with respect to the federal ESF programme, the established reporting procedures for collecting and reporting information on detected irregularities and fraud at all levels of ESF implementation already provided reliable, high-quality data. Regional authorities provided similar assessments, concluding that the systems in place ensured the high quality and reliability of data. ERDF Bremen pointed to the Transparency Register as an example of good practice, while ERDF Bavaria referred to a database system (FIPS2014) for reporting and monitoring that was also used for programme management. ERDF Rhineland-Palatinate did not consider that any improvements were necessary. ERDF Lower Saxony concluded that the risk of fraud and corruption in Lower Saxony remained low. Estonia planned for all detected irregularities (ESIF, EGF, Norway/EEA, and in the future RRF) to be entered into a single national database, with no thresh