EUROPEAN COMMISSION Strasbourg, 17.4.2018 SWD(2018) 114 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Directive of the European Parliament and of the Council on laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences and repealing Council Decision 2000/642/JHA {COM(2018) 213 final}

{SWD(2018) 115 final}



Table of contents 1. Introduction: Political and legal context 1.2 Union and International legal context 2. Problem definition 2.1What is the problem? 2.1.1. Law enforcement authorities’ lack of or delayed access to financial information 2.1.2. Obstacles to cooperation between FIUs and for FIUs to obtain access

to information from LEAs 2.2What are the problem drivers? 2.2.1Existing legislation does not give law enforcement authorities efficient and

effective access to financial information necessary for the fulfilment of their tasks 2.2.2Obstacles to cooperation between FIUs and for FIUs to obtain access

to information from LEAs 2.3How will the problem evolve? 2.3.1. LEAs lack of or delayed access to financial information 2.3.2.Obstacles to cooperation between FIUs and between FIUs and LEAs 3. Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4. Objectives: What is to be achieved?

4.1.General objectives 4.2.Specific policy objectives 5. What are the available policy options? 5.1. What is the baseline from which options are assessed? 5.2. Description of the policy options 5.2.1.Non-legislative policy options (Option 0) 5.2.2.Legislative policy options 5.2.3.Options discarded at an early stage 6. What are the impacts of the policy options 6.1. Economic impacts 6.1.1. Options regarding law enforcement authorities’ access to information, stored

in centralised bank account registries 6.1.2. Enhancing cooperation between FIUs and between FIUs and LEAs 6.2. Social impacts 6.2.1. Law enforcement authorities’ access to information, contained in

centralised bank account registries 6.2.2. Enhancing cooperation between FIUs and between FIUs and LEAs 6.3. Fundamental rights impacts 6.3.1. Law enforcement authorities’ access to information contained in centralised bank account registries 6.3.2. Enhancing cooperation between FIUs and between FIUs and LEAs 7. How do the options and sub-options compare? 8. Preferred option

9. How will actual impacts be monitored and evaluated? Glossary Term or acronym Meaning or definition ACAs Anti-Corruption Agencies AROs Asset Recovery Offices CBAR Centralised bank account registry DRS Data Retrieval System EDPS European Data Protection Supervisor EIO European Investigation Order ESW Egmont Secure Web FATF Financial Action Task Force FIUs Financial Intelligence Units FIU.Net IT system IBOA EU institutions, bodies, offices and agencies LEA Law enforcement authority MLA Mutual Legal Assistance SIENA Secure Information Exchange Network Application STR Suspicious Transaction Report



1. Introduction: Political and legal context 1.1 Political context Criminal groups, including terrorists, often operate across different Member States and their financial means, including bank accounts, are usually located across the EU or even outside of it. They also make use of modern technology that allows them to transfer money between several different bank accounts and between different currencies in a matter of hours. Given these increasing risks posed by serious and organised crime, financial investigations are necessary to develop evidence against sophisticated, high-level criminals with a view to dismantling transnational and organised crime networks. Financial investigation has become an essential tool for a modern and effective response to criminal threats. It can provide valuable, hard evidence of criminal activities, map out entire criminal networks, including their transnational ramifications, and is key in developing preventive and proactive actions through the design of detection and monitoring tools. Financial investigation bears a proactive and preventive added value. It is an important tool to detect Money Laundering (ML), Terrorist Financing (TF) and other serious crimes. It can be used against all criminal markets. However, in order to be effective, financial investigation depends on the need for various public authorities to cooperate in correctly collecting, sharing and using for prosecution purposes financial information, while respecting the fundamental rights of the data subjects. To tackle the increasing threat posed by criminals and provide public authorities with adequate tools to prevent fight and prosecute serious crime, the European Agenda on Security underlined the need for measures to address terrorist financing in an effective and comprehensive manner. In the aftermath of terrorist attacks in the EU, the Commission adopted on 2 February 2016 an Action Plan on strengthening the fight against terrorist financing, which presented how the Commission would seek to upgrade Directive (EU) 2015/849 - the 4th Anti-money Laundering Directive (4AMLD). This included a new requirement that all Member States should establish centralised bank account registers, or retrieval systems, which contain information on all national bank accounts listed to one person. The Commission proposed amendments, here referred to as the 5th Anti-money Laundering Directive (5AMLD), included a proposal to establish the relevant registers to which all national FIUs and other competent authorities should have access. The relevant stakeholders have called upon the Commission to act. Already in January 2016, Europol emphasised the importance of centralised bank account registers to “swiftly trace, identify, and freeze criminal assets and to identify bank accounts of suspects in terrorism investigations”. More recently, during the expert meeting on broadening law enforcement access to bank account registries held in October 2017, the law enforcement community highlighted the importance of having swift access to information on bank accounts for the effective performance of their tasks. Promotion of a common understanding of the vast potential and wide applications of financial investigation has become a priority at the level of the EU Council and the European Parliament. Thus, one of the major objectives of the EU Dutch Presidency of 2016 was the formulation of an Action Plan to facilitate the systematic use of financial investigations, increase the knowledge and understanding of financial investigation procedures and techniques among law enforcement practitioners, and improve cooperation in this field in (cross-border) investigations. This materialised into the Conclusions and Action Plan on the way forward with regard to financial investigation of 9 June 2016, that highlight the need for the Union to act swiftly in this area and call for use of multidisciplinary cooperation in applying financial investigation and a pro-active approach with regard to financial investigations. The European Parliament, expressing regret at "the lack of greater harmonisation in Member States’ approaches to fighting financial crime" and at the fact that "several FIUs in Europe are still not allowed under their national legal framework to exchange data directly with foreign law enforcement bodies", has repeatedly called for the Union to tackle the need for more effective exchange of information and closer coordination between national authorities concerned in order to achieve better results, including by enacting the necessary Union legislation. The 2016 Action Plan also called for a mapping of obstacles to the access to, exchange and use of information and to the operational cooperation between FIUs. The 28 FIUs within the EU therefore jointly drafted and presented a report, adopted in December 2016. The Commission's Staff Working Document on improving cooperation between FIUs, published in June 2017, takes stock of the results of the mapping report. It identifies measures that would help tackle the difficulties identified in this analysis and other measures to reinforce cooperation between FIUs. In short, it identifies issues that could be addressed through guidance and enhanced cooperation as part of the work carried out by the EU FIUs' Platform and other issues that would require regulatory solutions. 1.2 Union and International legal context The main EU legal instrument dealing with access to and exchange of financial information is Directive 2015/849 (4AMLD). The Directive requires holders of financial information (in particular credit and financial institutions ) to report suspicious transactions (STRs) to a relevant authority - a Financial Intelligence Unit (FIU) - in the Member State where they are established, which will analyse them . With regard to FIUs, the 4AMLD grants them the following powers:

a)In Article 32: FIUs are responsible for receiving, analysing suspicious transaction reports and other information and disseminating the results of analyses and any additional relevant information to the competent authorities where there are grounds to suspect money laundering, associated predicate offences or terrorist financing; they are able to obtain additional information from obliged entities; have access, directly or indirectly, in a timely manner, to the financial, administrative and law enforcement information that they require to fulfil their tasks properly; receive feedback about the use made of the information provided; take urgent action, directly or indirectly, where there is a suspicion that a transaction is related to money laundering or terrorist financing, to suspend or withhold consent to a transaction that is proceeding; b)in Article 52: FIUs have to cooperate with each other to the greatest extent possible, regardless of their organisational status; c)in Article 53: FIUs exchange, spontaneously or upon request, any information that may be relevant for the processing or analysis of information by the FIU related to money laundering or terrorist financing; use the whole range of its available powers which they would normally use domestically when replies to a request for information referred to in paragraph 1 from another FIU. Thus, FIUs have access to a wide range of registers and databases and they request and collect information to complete their financial analysis. Through these, the FIUs have become a hub of financial information. As mentioned above, the Union co-legislators agreed in December 2017, on the basis of the Commission proposal of July 2016, on a number of significant changes to the 4AMLD. These include an obligation for Member States to set up a central bank and payments account register or automatic data retrieval system (while foreseen in a recital of 4AMLD the establishment by Member States of these registries was nevertheless not compulsory). Most LEAs currently do not have direct access to financial information from centralised bank account registries or data retrieval systems (CBARs/DRSs). Therefore, they usually request the information from financial institutions via non-binding blanket requests. They may also be able to obtain this information through the FIUs. When the financial institution is located in other Member States, the relevant international cooperation mechanism or instruments can be used such as mutual legal assistance requests (MLAs) or the European Investigation Order (EIO). To strengthen cross-border cooperation in this area, the Commission committed to consider the possible interconnection of the centralised bank account registries. In respect of FIUs, the agreement on the 5AMLD reached by the Union co-legislators indicates that they shall be able to request, obtain and use information from any obliged entity even if no prior report is filed. While the adoption of the 4AMLD and the political agreement reached on the 5AMLD have brought important progress and created a stronger legal framework, they do not ensure all the tools required to combat money laundering and terrorist financing. The 4 and 5AMLD were adopted in an internal market context, as based on Article 114 TFEU (harmonisation in the internal market). They deal with the preventive side of efforts to address money laundering, associated predicate offences and terrorist financing, and the thrust of the obligations they lay down are directly linked to the "obliged entities", that is to say, economic operators, undertakings and professionals. A number of actions have been taken at EU level to complement preventive actions with a response on the law enforcement and judicial side. While the powers of law enforcement authorities are regulated at national level, various EU instruments require Member States to ensure that competent authorities are equipped with effective investigative tools in order to combat offences such as terrorism and money laundering. Other pieces of legislation promote the exchange of information among competent authorities through police and judicial cooperation channels (the European Investigation Order). The latter contains specific provisions for competent authorities in the issuing State to obtain information on bank and other financial accounts and operations held by entities in other Member States (the executing State). However, they do not set conditions under which law enforcement authorities could have access to centralised bank and payment account registries nor on the cooperation between LEAs and FIUs. Therefore preventive efforts must be reinforced by a framework that, building on the 5AMLD, sets out the precise conditions under which law enforcement authorities (LEAs) and FIUs can access and exchange information that is necessary for the purpose of performing their tasks and of conducting criminal investigations. Measures in this area also have to be in line with international standards and commitments undertaken at international level, and notably in the framework of the Financial Action Task Force (FATF), the most important international body in terms of global anti-money laundering and terrorism financing standards. As regards the access and exchange of financial information, there are four standards and recommendations more particularly relevant for the measures explored in this Impact Assessment as they require countries to ensure that policy-makers, the FIUs, LEAs, supervisors, and other competent authorities, establish effective mechanisms for domestic cooperation and coordination to combat ML/TF and that FIUs have timely access to law enforcement information that they require to undertake their functions. On the other hand, the FATF recommendations limit LEA’s power to request data from the FIUs only to cases when they are carrying out investigation of money laundering, associated predicate offences, and terrorist financing. Further developments at the international level comprise reports which the present impact assessment also takes into account. Amongst them is the work of a joint World Bank-Egmont Group project team currently carrying out a study entitled: FIUs Working With Law Enforcement: Report on the Findings. Drivers Problems Consequences Specific objectives General objectives Existing legislation does not give LEAs direct access to financial information at national level stored in centralised bank account registries or data retrieval systems Criminal investigations face delays in accessing financial information domestically Enable LEAs to get timely access, under well-defined conditions and for specified purposes, to information contained in the CBAR and DRS -Providing the relevant public authorities for the prevention, investigation and prosecution of crimes with an improved access to financial information; -Enhancing the ability of FIUs to more effectively combat money laundering and terrorist financing; -Defining the conditions for access and exchange of information between the various authorities and safeguards and providing for adequate procedural and data protection Reduce the administrative burden both for LEAs and the private sector in getting/providing access to information contained in the CBAR and DRS FIUs cannot carry out the required comprehensive financial analysis due to lack of national and cross border access to law enforcement information (data) Administrative burden on financial institutions and LEAs Improve LEAs' access to financial information for the purposes of preventing, investigating, enforcing and prosecuting serious crime without prejudice to national procedural safeguards. Obstacles in cross-border cooperation Speed up cooperation on investigations on crime by enabling LEAs to swiftly obtain financial information at the national and cross-border level; Facilitate FIUs' speedy access to law enforcement information to enable them to carry out their current tasks under the 4/5AMLD, without prejudice to national procedural safeguards Remove obstacles to the cooperation and exchange of information between FIUs, without prejudice to the provisions of the 4/5 AMLD Provide the competent authorities with adequate tools to trace and identify criminal assets Set out specific, adequate and harmonised safeguards for the protection of privacy and personal data. 2. Problem definition The EU is faced with an increased threat posed by serious crime and terrorism, with a clear cross-border dimension. Both the 2017 EU Serious and Organised Crime Threat Assessment (SOCTA) and the 2017 EU Terrorism Situation and Trend Report (TE-SAT) underline the links between these criminal activities. Terrorists are potentially exploiting organised crime infrastructures to procure tools and move goods and people and are involved in crime in order to obtain funding for their activities. The effectiveness of information-sharing is key to enable a quick, proportionate and adequate response by public authorities. Amid the information to be exchanged, financial information plays a major role. Across the Union, recourse to financial information is highly relevant for criminal investigations. However, the modalities in which law enforcement authorities and FIUs currently access and exchange financial information vary across the Union in such a way that it does not allow for a sufficiently dynamic flow of information between public authorities and financial institutions, across borders and domestically, able to address criminal threats. Many investigations come to a dead end because of failure to secure timely, accurate and comprehensive access to the relevant financial data. The Europol Report "From suspicion to action" published in 2017 again highlighted this challenge. To illustrate this challenge, the situation of FIUs provides a good example. FIUs have a central position in the flow of financial information when it comes to the prevention of money laundering and terrorism financing. On the basis of STRs, FIUs are required to produce rich financial analysis that is essential for the prevention of money laundering and terrorist financing and for law enforcement to uncover criminal activities, trigger new investigations or complement ongoing ones. The system is intended to protect customer data and reporting to law enforcement for the purpose of investigations. Yet, the tools placed today at their disposal do not match the growing importance of the tasks given to them and do not permit them to act to the best of their abilities and to provide to LEAs the information that they need for investigations on serious crimes. The problems met by the LEAs and FIUs in the access to and exchange of financial information will be analysed at two levels: -Law enforcement authorities’ financial investigations are hindered by the lack of or delayed access to financial information, including information stored in centralised bank account registries or data retrieval systems (2.1); and

-Several obstacles that hinder cooperation between FIUs and between FIUs and Law enforcement authorities, affecting the FIUs’ capacity to carry out their tasks and to respond effectively to requests for financial information from law enforcement authorities (2.2). Law enforcement authorities are understood, for the purpose of this impact assessment, as the Member States’ authorities or bodies competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the Asset Recovery Offices. The EU Data Protection Police Directive applies to the processing of personal data for the purposes that are examined in this impact assessment. The GDPR may also apply to certain parts, to the extent that it is applicable to Financial Intelligence Units, whose exact status depends on provisions of national law of the Member States. 2.1What is the problem? 2.1.1. Law enforcement authorities’ lack of or delayed access to financial information ·Criminal investigations face delays in accessing financial information domestically Within the framework of investigations, law enforcement authorities have to request the relevant financial information. Such financial information may either be information on the bank account holder or additional financial information, for example transactions. Different situations may occur depending on the national legal framework in place as far information on the bank account holder is concerned. In order to find such information, law enforcement authorities may directly contact the financial institutions, in which case they would have to issue “blanket requests” to the banks. A blanket request is the request for bank account information concerning a person of interest for the investigation that a law enforcement authority sends to all the banks in their country. Law enforcement authorities have to wait for a reply from each individual bank in the country in order to have a picture as complete as possible on the bank accounts owned or operated by a given person. In some countries the process may take weeks or even months to obtain all the responses. In one Member State answers are provided in between 1 to 3 weeks, in other Member States within 3 to 4 weeks and even in several months. The first consequence of these delays is its impact on the efficiency of investigations. It can also lead to inaction. Law enforcement authorities may be discouraged from the long delays and may decide not to pursue investigations because of the difficulty to obtain the information. Even when the relevant information is provided, delays in obtaining it may not allow law enforcement authorities to pursue new leads or complement the investigation at the right time. This may create the risks that criminals hide their assets before these are confiscated. Information on bank accounts listed to one person has already been centralised in sixteen Member States, where national bank account registers or data retrieval systems have been set up. Some Member States have granted access rights (direct or indirect) to some law enforcement authorities and, in certain cases, to the Asset Recovery Offices (AROs) (Annex 7 provides an overview of the situations in all the EU Member States), but in those where this is not the case, law enforcement authorities still have to issue “blanket requests”. Even in Member States that have already set up registries, some of the law enforcement authorities and AROs still issue “blanket requests” because they have not been granted access. The “blanket requests” practice and its consequences were a recurring issue during the Commission’s stakeholder consultations. The participants at the expert meeting on broadening law enforcement access to bank account registries, for example, noted that the practice of issuing blanket requests is highly unsatisfactory, as it not only slows down investigations and does not facilitate the fight against organised crime and terrorism, but is also problematic from a data protection point of view as it entails untargeted dissemination of personal information to the private sector. The proportions of such dissemination depend on the number of banks (or other financial institutions) in the country. Essentially, following a request from a law enforcement authority, a bank may decide to review the entire business relationship with the customer(s) involved and classify them in another risk category. They may also decide not to start a business relationship with a new customer because law enforcement authorities have requested information on him/her via a blanket request. During the targeted stakeholder consultations, the European Data Protection Supervisor (EDPS) emphasised that the practice of sending blanket requests is clearly unsatisfactory from a data protection perspective. The financial information may also be held by FIUs and in some Member States, particularly where the FIU is a law enforcement body, LEAs can request it. However, in most cases, the information provided by FIUs is limited to the results of their analyses of the suspicious transaction reports received from the obliged entities. In such cases therefore, LEAs do not have access through this channel to the raw data that FIUs received from obliged entities or to the full set of information regarding the bank account (e.g. balance and list of transactions), held by the obliged entities. If LEAs need such raw data or data that an FIU does not have in its possession (even though the FIU would have the right to request such additional information from a bank under Art.32 4AMLD and the bank would be obliged to respond), they will have to use the domestic procedures, for example judicial authorisation. This is because Art.32 4AMLD only obliges FIUs to respond to requests for information from competent authorities. This has been interpreted as covering information that FIUs already hold and does not necessarily extend to information that FIUs have the right to obtain. The length of these procedures does not always match with the need for efficient and timely action by LEAs, but remains an important safeguard. ·Administrative burden on financial institutions and LEAs The practice of blanket requests implies a significant administrative burden for both the banking sector and LEAs considering the number of requests for financial information issued each year in each Member State . As regards the LEAs, the burden comes from the time needed to prepare the requests but above all from the time needed to process the answers. As for the financial institutions, blanket requests imply that bank staff has to process a larger amount of requests than necessary since blanket requests are not targeting only the banks where the person of interest actually has a bank account but all banks, with their related staff costs. For example, in one of the Member States, where the law enforcement authorities have not been granted access to the national bank account registry, LEAs are sending blanket requests in bulk (approximately 3000 annually; the preparation of each request taking on average one hour). The most problematic part is the processing of the answers which is a very time-consuming exercise. Some of the police services of this particular Member State have dedicated full-time positions to handle the blanket requests. In another country, LEAs send roughly 50 000 – 60 000 individual requests for bank account information annually (the preparation of one request takes 15 minutes). The LEAs of a third Member State send around 10 000 blanket requests to the banking sector on an annual basis. When indirect access to the national centralised bank account registry or data retrieval system have been granted in Member States where those have already been set up, this also entails a substantial administrative burden for the intermediary. In one of the consulted Member States, for example, LEAs submit their requests for information to the authority managing the national data electronic system which then carries out the query and sends back the answer. However, the large number of LEA requests (more than 88000 in 2016) has led to a substantial backlog of requests that resulted in a time lapse of six weeks for a standard, non-urgent reply. The reason for this backlog is the fact that the staff of the management authority has to manually insert the request into the system, which takes a lot of manpower and resources. Where LEAs cannot access additional financial information via the FIU and would have to resort to judicial authorisation. Doing so usually involves burdensome procedure and costs. ·Obstacles in cross-border cooperation

Terrorists operate across borders – leaving a financial information trail in different countries. Money launderers and organised crime groups increasingly hide and reinvest assets in Member States other than the one where the original criminal act was committed. Therefore, financial information in other Member States can be crucial to detect and combat crime and terrorism. Insufficiently effective and efficient cross-border cooperation mechanisms also affect LEAs’ cross-border access to financial information. The conclusions of the high-level meeting assessing the need for additional measures to facilitate access to financial information of 20 November 2017 (Annex 2) pointed to the existence of obstacles for LEAs in getting access to financial information cross-border. This was also identified as a problem in the 2016 Mapping Report. In some cases, when LEAs seek to obtain information via its FIU, the FIU receiving the request may, for various reasons (notably its core functions and the purpose of the use of the data), not be in the position to share such information. Where requests cannot be channelled by FIUs, some LEAs are obliged to request the relevant information via judicial authorities by using MLAs or the EIO for the Member States that have implemented it. Therefore, while in situations where the FIU is law enforcement in nature, cross-border cooperation will be efficient and effective, if the FIU is administrative in nature, mutual legal assistance or EIO will be necessary. In this respect, access to the same type of information from two different Member States by a LEA, might result in very different results in terms of procedures and speed. Therefore, cross-border access to financial information is further hampered by the fact that current instruments do not make it possible to exchange such information in a timely and non-burdensome manner. Mutual legal assistance requests can be a very time-consuming, burdensome and costly procedure. It involves months of work for both the requesting and the requested Member State, while it involves substantial costs in respect of the staff involved throughout these months, translations, court appearances etc. Without efficient means to obtain access to financial information in another Member State the action of LEAs becomes prohibitively expensive, is time consuming and hence seriously jeopardises the application of the law. Timely availability of information is therefore relevant to prevent, detect, investigate and prosecute serious crime. The delays, often implied by the inefficient procedures to obtain financial information by LEAs at the national level have even more serious implications when information is needed by their counterparts from other Member States, which are of increasing prevalence. One of the reasons for this is that the 4AMLD only covers requests by FIUs to LEAs for information for domestic situations. The issue of cross-border requests is not regulated in the 4AMLD or in any other specific instrument. This represents a serious limitation in the investigations of financial crimes most of which have a cross-border element. Nevertheless, these procedural safeguards are crucial in safeguarding compliance with fundamental rights. Furthermore, the delays for LEAs, involved in cross-border cooperation in obtaining bank account information of persons who hold bank accounts in more than one country and in coordinating all such information may have negative implications for cross-border criminal investigations and the cooperation efforts between LEAs. Moreover, this situation makes it very difficult (if not impossible) for LEAs which do not have access to financial information to comply with the provisions of Framework Decision 2006/960 JHA (also referred to as the “Swedish Initiative”), which requires Member States to have procedures to respond within eight hours to an urgent request if the information is available in their databases. The differences in the national legal framework regarding LEAs’ and AROs’ access to national registries can have serious implications regarding cross-border cooperation and the exchange of information which, in practice, have a direct effect on cross-border criminal investigations. To illustrate this, the following example can be made. A LEA in Member State (MS) A started an investigation on Mr X. As Mr X is a national of MS B, the ARO of MS A requests information to the ARO in MS B on Mr X’s assets. Hypothesis 1: In MS A LEAs have access to the national registry; in MS B, however, the LEAs (together with the ARO) do not have access to the national registry. In this case the LEA in MS A queries the national registry, establishes that Mr X has a bank account and the account is frozen. In MS B the ARO has to send blanket requests to all the banks operating on its territory. When all banks finally reply to the blanket request, the ARO of MS B finds out that Mr X has a bank account in bank Y and immediately contacts the bank. Unfortunately, as soon as his bank account in MS A was frozen, Mr X had transferred the funds to a bank account in a third country, where they cannot be immediately frozen anymore. Hypothesis 2: LEAs in both MS do not have access to the national registries. Both the LEA in MS A and the ARO in MS B have to send out blanket requests. Alerted by the fact that he is investigated, Mr X transfers the funds from both accounts to bank account in a third country, where the funds cannot be immediately frozen anymore. Another issue in this context pertains to the role of Europol in assisting Member States in criminal investigations by, in particular, providing new leads and criminal analysis. However, having no access to financial information, including the one contained in the national CBAR/DRS, Europol faces limitations which prevent it from exploiting the full potential of its analytical capabilities. These limitations were stressed and explained in the Europol Report "From suspicion to action" published in 2017. The European Anti-Fraud Office (OLAF) is also faced with similar issues of inefficiency of financial investigations and delays in EU-wide cooperation on cross-border investigations due to the difficulty to access banking information. In order to have full access to banking information, OLAF is dependent on its national counterparts and their own powers under national law to provide bank data. This creates inconsistencies across Member States and makes it difficult for OLAF to fulfil its mandate to fight fraud affecting the Union’s financial interests. 2.1.2. Obstacles to cooperation between FIUs and for FIUs to obtain access to information from LEAs Under the provisions of the 4AMLD, access to information is also crucial for FIUs to be able to carry out their tasks and track illicit financial flows. FIUs must be able to exchange information between themselves spontaneously or upon request and have access, directly or indirectly, to the financial, administrative and law enforcement information that they require to fulfil their tasks (article 32 4AMLD). In order to carry out its function in an effective manner, an FIU must be able to collect any relevant information and exchange it with other FIUs within the EU . A first set of problems arises in the way FIUs cooperate between themselves in cross-border cases within the EU. The 2016 Mapping Report has shown that FIUs have difficulties to effectively cooperate and to access relevant information held by other FIUs and LEAs. Moreover, even when the cooperation mechanisms are acknowledged, there are time delays in responses to requests which affect FIUs’ cooperation and the replies to these requests are often of poor quality and lacking in detail. When they do share information, certain FIUs limit its use, including prohibiting use for judicial prosecution or fiscal investigations. Some FIUs have seen their requests for cooperation with non-European counterparts hindered because of legal or administrative rules or procedures in third-country jurisdictions. All Union FIUs have to carry out operational and strategic analysis, which is a task distinct and separate from (criminal) investigations. However, there is a risk that FIUs that are part of law enforcement merge analysis and law enforcement tasks into one inquiry on the basis of suspicious transactions or activity reports. If the distinction between analysis and investigation becomes blurred this has consequences in the capacity of FIUs to exchange information between them and comply with their obligations under the 4AMLD. For example a Police FIU may be treating the information it has as law enforcement sensitive, in which case it is unable to share such information with an administrative FIU. An additional problem identified by the Mapping Report is the difficulties met by FIUs to cooperate with their domestic LEAs. Despite the fact that the provisions of the 4AMLD enable FIUs to have direct or indirect access to all the law enforcement information that they require in order to fulfil their tasks, the Mapping Report indicates problems for FIUs getting access to such information. The stakeholder consultation revealed that not all FIUs in the EU do have the same possibilities to cooperate with their national LEAs and therefore they do not have access to the same level of information. More specifically, whereas law enforcement FIUs have no problem to access domestic law enforcement information, administrative and hybrid FIUs have more limited access to such information or, access that is subject to specific access procedures.

Given that the core function of the FIUs is to carry out financial analysis of money laundering, terrorist financing and the predicate offences, it is imperative for them to have access to the sources of information they need to carry out these tasks. The issue also presents itself, in an aggravated manner, where an FIU needs access to law enforcement information from another Member State. The 4AMLD does not regulate this issue. Other Union legal instruments on LEA cooperation, for example the so-called "Swedish initiative", may provide the basis for some cooperation. But where an FIU is administrative in nature, then these instruments will not come into play and the requesting FIU would have to resort to mutual legal assistance requests. Such requests have the same implications as analyses above. Money laundering involves the laundering of proceeds of (underlying) criminal activity. For example, when an FIU is examining an STR, that STR might not by itself reveal a suspicion about a crime having been committed and therefore, will never be followed up. If however the FIU had access to information that shows that the person concerned by the STR is a convicted drug trafficker, then the analysis of the STR changes and further connections will be made. The inability or inefficiency for FIUs to obtain access to information from their domestic LEAs also has an important impact on the ability of FIUs to cooperate with other FIUs, but also to respond to requests for information by LEAs, as examined above. There is an urgent need to tackle these issues, which stem from legal obstacles and hamper the effective ability of FIUs to carry out their tasks and cooperate between them, as required by the provisions of the 4/5AMLD. The urgency for the Union to act has become more evident for the Commission during the legislative negotiations in 2017 in view of adopting the 5AMLD. While the legal instrument itself was neither aimed nor suited to tackle problems relating to access to and exchange of information by LEAs and FIUs in all cases, discussions between the co-legislators touched upon the need to anticipate the implementation of the rules of the 5AMLD and their enforcement. Thus, the Commission was called upon by both Council and the European Parliament to ensure that an adequate legal framework is in place to ensure that the new powers granted to FIUs under 5AMLD are further enhanced. All of the above-mentioned issues were the subject matter of dedicated stakeholders' meetings organised by the Commission in the preparation of this report and in the considering the legislative options put forward. As indicated in detail in Annex 2, at the meeting on 20 November 2017, the Commission presented the challenges identified in the analysis and measures mitigating these challenges. The participants were in particular asked to present their views on: • how they saw the role of FIUs in this context and if other options been considered; and • possible measures to enhance the powers of the FIUs in order to facilitate the exchange of information both among them and between FIUs and LEAs. At that meeting, some Member States stressed the importance of FIUs as hubs for financial intelligence and a number of Member States supported that FIUs have access to law enforcement data and diagonal cooperation more specifically. At another meeting with stakeholders on 7 March 2018, Member States were consulted (i) on FIU access to law enforcement information domestically where it seems that all FIUs have access, whether direct or indirect (through liaison officers of the police sitting in the FIUs). The main difference in Member States is as to the type of information that FIUs have access. FIUs acknowledged that harmonisation of the types of information they have access to would be important, (ii) law enforcement authorities access to financial information via the FIUs, where it seems that no FIU gives direct access to law enforcement authorities to its databases. However, the police FIUs are able to easily respond to requests for information from law enforcement authorities. For administrative FIUs it is not so easy, (iii) Diagonal cooperation, i.e. cooperation between an FIU in one MS with the LEA in another MS. Diagonal cooperation can be direct or indirect (i.e. via the FIUs in the Member State of the requesting LEA), where all Member States opposed to the idea of direct diagonal cooperation and all were in favour of indirect diagonal cooperation. FIUs stressed that the diagonal cooperation must be reciprocal, i.e. law enforcement authorities both receive info from FIUs and provide info to FIUs. Some Member States saw the need to have exceptions in urgent cases, for example terrorism cases, where direct diagonal cooperation should be allowed. Other Member States did not agree that such a need exists, (iv) Cooperation with Europol where 8 FIUs already exchange information with Europol. FIUs in general expressed an interest in exchanging information with Europol, on the condition that exchanges are reciprocal 2.2What are the problem drivers? 2.2.1Existing legislation does not give law enforcement authorities efficient and effective access to financial information necessary for the fulfilment of their tasks The first parameter of this problem driver is that the 4/5AMLD does not give LEAs direct access to financial information stored in centralised bank account registries or data retrieval systems and the use of the data in these registries is limited to money laundering and terrorist financing. Most LEAs currently do not have direct access to the centralised bank account registries and data retrieval systems created under the amended 4AMLD as access is often limited to the authorities concerned with money laundering and terrorist financing investigations. Furthermore, the reason for the creation and the purpose of the use of the centralised bank account registries and retrieval systems under the amended 4AMLD is the combat of money laundering and terrorist financing, whereas LEAs may want to use the information in such registries in a wider context of fighting all serious crime, as stressed during the expert meeting on broadening law enforcement access to centralised bank account registers. Centralised bank account registries and data retrieval systems are currently operational in 15 Member States and only in 6 Member States LEAs (and not all of them) have direct access. Therefore, they usually request the information from financial institutions either through blanket requests, or, if they have been granted indirect access via a request to an intermediary, with a risk of backlogs and delays. The second parameter of this problem driver is that current legislation does not give LEAs efficient and effective access to other types of financial information, which is necessary for their tasks. While the 4/5AMLD indeed provide that FIUs must be able to respond to requests for information from LEAs (art.32), the following issues remain: (i) LEAs can only request such information for the combat of money laundering and terrorist financing, while this information is necessary for all types of serious offences, (ii) the issue of cross-border requests for information is not regulated, (iii) Art.32 only covers information that is already in the possession of an FIU and does not also cover information that FIUs can obtain without coercive measures under their powers, and (iv) when FIUs are administrative in nature, they have legal difficulties to respond to requests for information from LEAs. The stakeholders' consultations highlighted these issues as noted above and in Annex 2.

Both these parameters significantly impair LEAs’ capacity to investigate serious crimes. Moreover, the fragmentation of approaches, adopted across the Union impact upon LEAs’ abilities to cooperate with their counterparts from other Member States, particularly in relation to cases where there is a need to react swiftly to requests for information. 2.2.2 Obstacles to cooperation between FIUs and for FIUs to obtain access to information from LEAs The 2016 Mapping Report has shown that FIUs have difficulties to effectively cooperate under Article 53 4AMLD and to access information from law enforcement authorities under Article 32 4AMLD based on information provided by representatives of the FIUs on an anonymised basis and on pre-identified questions. As regards both the cooperation between FIUs, as well the need for FIUs to obtain access to information from their national LEAs, FIUs have consistently referred to, as the most relevant obstacles that still limit the effectiveness of cooperation within the EU, issues related to: differences in regard to the methods for requesting and exchanging information due the various status and powers granted to FIUs nationally; the need to use law enforcement cooperation channels; the identification and type of associate predicate offences that give rise to money laundering; insufficient capacity to obtain and share information; insufficient capacity of law enforcement authorities to provide authorisation for further use or dissemination of the information exchanged. The common cause of the issues identified above is a legislative lacuna: no common rules are set out to indicate how a mandatory outcome (already foreseen by 4/5AMLD) can be achieved, under which conditions and with what safeguards for protection of fundamental rights. Specifically, while the 4AMLD requires that the information and documents received by an FIU from another FIU or LEA be used to process or analyse information relating to specific purpose of money laundering or terrorist financing and the natural or legal person involved, there is no rule to indicate how this must be achieved. Further, while the 4/5AMLD authorises FIUs to receive information from LEAs, it does not oblige LEAs to provide it. In addition, deeper cooperation is hampered by a lack of common rules that ensure sufficient, adequate and proportionate safeguards are in place when information is exchanged. To the extent that FIUs may be uncertain as to what exact information they can exchange, under which conditions, with which limitations and under what regime for confidentiality and ensuring respect for fundamental rights. This was highlighted at the stakeholders' consultations as noted above and in Annex 2. In concrete terms, the following causes can be schematised: •FIUs refuse to reply to requests for information by other FIUs due to a lack of a common set of rules and guarantees in place to ensure confidentiality, data security, data protection; •While the 4/5AMLD allow FIUs to receive information from LEAs (whether this is directly from LEA or from an FIU that is law enforcement in nature), it does not oblige LEAs to give access to such information; •FIUs are reluctant to request financial information from LEAs because there is no general rule on what type of LEA information they are entitled to receive and for what purposes; •FIUs do not perform the best value analysis they could, since they lack information that is very relevant for the cases and trends they are studying; •FIUs financial analysis as performed on the basis of data they collect is not put to best use by end-users which include the LEAs; •FIUs generally start conducting their analysis based on LEAs’ requests, although the conditions under which they may/should conduct analysis exist in less than half of the 28 Member States. 2.3How will the problem evolve? 2.3.1. LEAs lack of or delayed access to financial information ·Increased inefficiency in financial investigations and increasing administrative burden for all actors involved in the procedure The establishment of CBAR and DRS in all Member States by [26 months after the date of entry into force of the 5AMLD] will grant direct access to the CBAR and DRS to the FIUs and the authorities in charge of the prevention of money laundering and terrorist financing. When transposing the 5AMLD some Member States may decide to grant access also to the LEAs. They are, however, not obliged to do so and there is no guarantee that they will. The increased exchanges between LEAs, nationally and with other EU Member States (see below) could also lead to an actual increase of the overall number of blanket requests, even if these are issued in fewer countries. There is an upward trend in cross-border information exchange as illustrated by the substantial increase in the number of messages exchanged between the AROs in Europol’s Secure Information Exchange Network Application (SIENA). Merely 152 messages were exchanged in 2011, compared to 4217 in 2016, with an increase of more than 2600 % over 6 years. This reflects the increase of information exchange and operational cooperation in recent years to address cross-border criminal activities.

Diagram 1: ARO Exchange of information via the SIENA platform Unless the access of LEAs to centralised bank account registries and data retrieval systems is made possible in all Member States through specific EU legislation, the access by these authorities to bank account information will remain slow, financial investigations will remain inefficient and the administrative burden will remain (or increase if the number of requests for information from the national bank account registry or data retrieval system increases). As regards access of LEAs to other types of financial information, it is expected that the current problems and problem drivers will remain, thereby hampering the ability of LEAs to carry out their tasks in relation to all serious crime. 2.3.2.Obstacles to cooperation between FIUs and between FIUs and LEAs Without a clear EU framework for cooperation mechanisms and exchange of information mechanisms: ·the problems faced by FIUs in fulfilling their tasks and in cooperating between them under the 4/5AMLD will remain; ·the number of requests for information between FIUs will increase, since the number of suspicious transactions is directly related to the number of total financial transactions, and the latter have seen both their volume, global reach and scale exponentially grow during the last decade. Rough estimates could range between 15 % to 25 % increase as compared to current figures over the coming 5 years (see Europol estimates in the study already quoted). ·the efficiency and timeliness of current means of requesting information will decrease under the strain of the ever increasing number of cooperation requests. In addition, the sheer growth in volume of direct requests might create a disincentive for continued cooperation; it is therefore likely that the situation will be solved in one of two (equally negative) ways: either information will not be given, in other words requests will be denied so as to not lead to overburdening, or requests will be directed to banks and other obliged entities, without any checks and added value or oversight for data protection; ·in the absence of a clear legal basis in national law, LEAs will continue to encounter the same problems in their requests for direct cooperation to FIUs. In addition, should the identified problems remain unresolved, the capacity of FIUs to provide information to LEAs as explained above will also be hampered, particularly in cross-border situations. All the problems identified above will remain unresolved, while other existing or planned EU legislative initiatives are not likely to effectively address the challenges, in the absence of specific EU action, as the domain is highly specific and would require structural changes to the nature of tasks and powers allocated to the FIUs. 3. Why should the EU act? Security and the prevention of serious crime is a high priority for the EU and the Member States. Criminal groups, including terrorists, operate across borders and the significant increase in information exchange demonstrates the need to provide the competent authorities with expedient access to information at the national level in order to cooperate effectively and efficiently with their counterparts from other Member States. Without adequate and efficient access to financial information by LEAs of Member States, including access to relevant information held in other Member States, it will be very difficult for these authorities to perform their duties in relation to the prevention, detection and investigation of terrorist and other serious criminal offences and hence to fight such cross-border crime effectively. In addition, without the effective resolution of the problems in the cooperation between FIUs, access to financial information by LEAs from FIUs in cross-border situations will remain difficult. Because of the very nature of these crimes, instruments at an EU level are required to set the ground for cooperation between Member States on all the above-mentioned issues. In the last years, security has been at the top of Europeans' concerns due to a series of terrorist attacks within the EU, foreign terrorist fighters returning to the EU from conflict zones and revelations of wide spread money laundering. A recent Eurobarometer report on the results regarding citizens’ overall awareness, experiences and perceptions of security, underlines that a significant majority of respondents in all Member States agree on the need to share information within the EU to better fight crime and terrorism. The report indicates that EU citizens think that cooperation between the police and other national LEAs is adequate to fight crime and terrorism, but also that 92% of the respondents agree that national authorities should share information with the authorities of the other EU Member States to better fight crime and terrorism. 3.1.Legal basis

The main EU instrument dealing with financial information the 4AMLD has its legal basis in the internal market, i.e. Art.114 TFEU, with the general aim of safeguarding the integrity of the EU financial system. However, the manner in which various authorities currently exchange and use financial information in various Member States varies dramatically from jurisdiction to jurisdiction. The current models do not create a dynamic flow of information between authorities and institutions within the private sector, or cross-border. The new envisaged EU measures would facilitate the use of financial information in the framework of serious offences and disrupt the activity of organised crime and terrorist groups and would facilitate financial investigations by the FIUs. The power to act is conferred by Article 87(2) TFEU, which enables the European Union to establish measures concerning the collection, storage and exchange of relevant information and common investigative techniques in relation to the detection of serious forms of organised crime, for the purpose of establishing police cooperation involving all the Member States' competent authorities (including police, customs and other specialized law enforcement services) in relation to the prevention, detection and investigation of criminal offences. In spite of the fact that FIUs are currently established and regulated under the 4AMLD, due to the fact that Member States have chosen to give different status to their FIUs (administrative or law enforcement in nature), Article 87(2) would be the appropriate legal basis to regulate existing problems in their cooperation and in their ability to obtain access to information from LEAs. Such new envisaged EU measures would be complementary to the current internal market legal framework and would tackle issues from a police and judicial cooperation point of view that is currently lacking. 3.2. Subsidiarity: Necessity of EU action According to Article 67 TFEU, it is the Union's objective to provide citizens with a high level of security by preventing and combatting crime. Action of the Union in this field should be taken only if, and in so far as, this objective cannot be sufficiently achieved by the Member States and can be better achieved by the Union. In this case it is necessary to act at a European level because of the cross-border dimension of crime, including organised crime and terrorism and the international nature of financial services, which allows criminals and terrorists to move funds across the EU. Organised crime groups are often set up internationally and are commonly active across various Member States. Due to its transnational nature, the terrorist and criminal threats affect the EU as a whole and, therefore, require a European response. Criminals may exploit, and will benefit from, the lack, or the lack of an efficient use, of financial information, including information, contained in the centralised bank account registries or data retrieval systems in one Member State, which can have consequences in another Member State. The problems and limitations related to the FIUs’ access to, and use of, financial information can only be effectively dealt with by an EU instrument. As massive flows of illicit money and investments in the legal economy can damage the stability and reputation of the financial sector and threaten the internal market, any measures adopted solely at national level could have adverse effects on the EU Security Union. It is noted that in October 2000, Council Decision 2000/642/JAI was adopted concerning arrangements for cooperation between FIUs of Member States with respect to exchanging information. The provisions of this Council Decision have later been included in the 4AMLD, but the Council Decision had not been repealed at the time. This Council Decision has therefore currently no added value. Any new EU measure should also take the opportunity to repeal and replace this Decision. 3.3. Subsidiarity: Added value of EU action The added value of the EU action would be to provide a harmonised approach that would strengthen domestic and cross-border cooperation in financial investigations on serious crimes and terrorism.

The problems related to the law enforcement authorities' access to financial information have a cross-border dimension. This may lead to security gaps as criminals may move their activities to Member States that have put in place ineffective and inefficient mechanisms. It is, therefore, important for all Member States to provide swift access to financial information at the national level. By acting collectively and coherently, the measures will have a substantial impact on the security of the EU. The current EU instruments on money laundering and terrorist financing and on police and judicial cooperation are insufficient to resolve the identified problems. Without appropriate measures at an EU level, LEAs and FIUs will not be able to have access to the necessary information. Hence, EU action would also provide for i) a formal and harmonised obligation on FIUs to cooperate between them and with LEAs, irrespective of their status and current EU and national limitations of the access to and use of financial information, ii) a formal and harmonised access of FIUs to law enforcement information for the purpose of fulfilling their tasks, and iii) an effective and efficient access by LEAs to valuable financial information for the purpose of preventing, investigating, enforcing and prosecuting serious crime. In addition, action at the EU level will help to ensure harmonised provisions, including, for safeguarding data protection, whereas if Member States are left to legislate independently, a harmonised level of safeguards will be difficult to achieve. Furthermore, absence of action at EU level would be detrimental for data protection as it compels LEAs and the banking sector to process much more data than is required if LEAs would have direct access to the central bank account registers. In addition, unless the safeguards are harmonised at EU level, the level of protection of individuals with regard to the protection of their personal data would vary between Member States. The reason for this is that they have to resort to requests for the data to all the banks, rather than a single request to the relevant registry in a Member State or to a single authority (FIU). All these requests ultimately lead to the processing of much more data, which itself is detrimental to data protection. The problem drivers and the examples identified in Section 2.2.2 apply where a FIU has to reply to requests by the national LEAs or where a LEA has to reply to requests from its national FIU. It could therefore be deduced that it is the national law in each Member State is at the origin of limitations to powers of FIUs to exchange financial data. This is not the case. Each of the 28 FIUs established in the Union is endowed, under the national law establishing it, with the necessary powers to pro-actively participate in exchanges of information, produce high quality analysis and effectively contribute to the prevention and fight against money laundering, predicate criminal offences and terrorist financing. This is the case irrespective of the status of the FIU under national law and notwithstanding the varying formulation of the competences with which they are endowed (specific to each national legal system). The problem therefore arises not at national level, but at a level where the interaction of FIUs is required – which is to say the Union level. There is no need to change the current status or role of FIUs – as this is not among the causes of problems faced today, and it would in any case be a domestic matter for national law. However, it is only at Union level that the identified problem drivers may be removed, by creating a framework for the interaction between FIUs, by setting out minimum harmonisation rules that apply across Member States, defining specific, adequate guarantees on how cooperation and exchange of information respect privacy: retention periods, interdiction of unauthorised access, review of application by designated data protection supervisor, etc. In addition, it has to be stressed that these solutions must be designed and set out at Union level as the new framework for data protection, adopted in May 2016, aims to ensure a Union-wide, equal protection off citizens' fundamental right to data protection whenever personal data is used by criminal law enforcement authorities. 4. Objectives: What is to be achieved? 4.1.General objectives The general objective is to increase the security in the EU by: ·providing the relevant public authorities for the prevention, investigation and prosecution of crimes with an improved access to financial information; ·enhancing the ability of FIUs to more effectively combat money laundering and terrorist financing; ·defining the conditions for access and exchange of information between the various authorities and providing for adequate procedural and data protection safeguards. 4.2. Specific policy objectives These general objectives are translated into the following specific policy objectives: •Enable LEAs to get timely access, under well-defined conditions and for specified purposes, to information contained in the CBAR and DRS; •Reduce the administrative burden both for LEAs and the private sector in getting/providing access to the information in the CBAR and DRS; •Improve LEAs' access to financial information for the purposes of preventing, investigating, enforcing and prosecuting serious crime, without prejudice to national procedural safeguards; •Facilitate FIUs' access to law enforcement information to enable them to carry out their current tasks under the 4/5AMLD, without prejudice to national procedural safeguards;

•Remove obstacles to the cooperation and exchange of information between FIUs, without prejudice to the provisions of the 4/5AMLD; •Provide the competent authorities with adequate tools to trace and identify criminal assets; •Set out specific, adequate and harmonised safeguards for the protection of privacy and personal data. It is equally important to clearly set out that the envisaged EU measures would not aim to amend the 4/5AMLD, but rather to complement it. 5. What are the available policy options? 5.1. What is the baseline from which options are assessed? The baseline scenario against which the policy options are explored is the current system as based on national, EU and international rules and cooperation mechanisms establishing and regulating the Member States' national LEAs and FIUs. 5AMLD once formally adopted obliges the Member States to only provide the FIUs with direct access to the registries and data retrieval systems. Hence, the LEAs in certain Member States may have to continue issuing blanket requests or submit requests for access to the registries under the procedures of national law. In other Member States, some authorities might be provided with access but the nature of this access as well as the type of the authorities would differ depending on the Member State. This fragmentation was well illustrated during the expert meeting on broadening law enforcement access to centralised bank account registries, where the participants acknowledged that in some Member States some LEAs have been granted access to the registries, whereas in others not. Moreover, as already mentioned, the modalities of access granted to the various law enforcement authorities (direct/indirect access to the information contained in the registries) differ across the Union. In light of this, it is very likely that this risk of fragmentation at the Member State level regarding law enforcement access to the national bank registries would persist, unless action is taken at the EU level. Without further EU legislation, there is no obligation for the Member States to grant access to the registries, which will be established pursuant to the 5AMLD. Hence, the risk will remain that some law enforcement authorities might not be provided access; they would have to continue issuing blanket requests and would not be able to access relevant information in an expedient manner. At the same time, as the stakeholder consultations have illustrated, certain LEAs might be granted indirect access and, hence, submit requests to an intermediary in order to obtain information from the already existing registries. Other law enforcement authorities may be granted direct access to the registries. This situation, characterised by uncertainty and fragmentation, poses challenges not only from an operational point of view, but also from a data protection perspective, as blanket requests entail the dissemination of personal data related to the person(s) of interest to all the banks in a country. As regards access by LEAs to other types of financial information, in the baseline scenario the problems encountered today will remain. The situation will remain unregulated at EU level, access in some Member States will remain burdensome and inefficient, while cross-border cooperation will be hampered depending on the national status of FIUs. Moreover, as stated above it is expected that the problem will evolve in ways that will present questions on data protection and privacy. On the cooperation between FIUs and their ability to obtain access to LEA information domestically, the identified problems will remain. This will seriously hamper the ability of FIUs to carry out their tasks under the 4AMLD in order to prevent and combat money laundering and terrorist financing. As problems remain unresolved both at EU but also at global level, there is a risk that, at global level, different Member States might become involved in developing international standards in the field. Such international standards, once agreed, may become binding (as it currently happens with FATF standards). In a directly related matter, that of ensuring respect for fundamental rights including procedural rights, privacy and data protection, the main feature of the baseline scenario is the fact that access to information and exchange of information is performed according to rules in force in the Member States which implement the EU legislation on data protection, while ensuring the requirements of Union law are correctly implemented. This feature must be duly taken into account in designing the legislative options further analysed. In other words it will act both as a limitation for the design of the options and as a standard to be met. A main feature of the baseline scenario is also the activity of the EU FIUs' Platform. This expert group, set up in 2006 by the Commission, brings together EU countries’ FIUs and helps them cooperate with each other. The Commission takes part in the Platform and provides support. The missions of the Platform include: to provide advice and expertise to the Commission on operational issues in the context of the functions performed by FIUs; to facilitate cooperation among national FIUs and exchange views on co-operation related issues such as effective international FIU co-operation, the identification of suspicious transactions with a cross-border dimension, the standardisation of reporting. The EU FIUs' Platform also discusses matters related to FIU.Net – the IT system used by FIUs to exchange information. The EU ARO Platform, launched by the Commission in 2009, also plays an important role in the current baseline scenario. In 2016, the ARO Platform sub-working group on centralised bank account registries issued a best practice report on centralised bank account registries and data retrieval systems as effective tools for financial investigations and asset recovery . The report concluded that national bank account registries are a very effective tool facilitating investigations and asset recovery. It recommended that LEAs should be able to consult the registries not only for national investigations but also upon the request of a foreign authority (for example, an ARO or a FIU), and should be able to share this information with that authority without the need for mutual legal assistance (MLA) procedures. Due to their non-binding nature, however, these recommendations and best practices have not achieved the desired results and there is still considerable variation in the type of authorities with access and the nature of the access to the already operational centralised bank account registries or data retrieval systems. 5.2. Description of the policy options 5.2.1.Non-legislative policy options (Option 0)

The non-legislative option consists in promoting best practice at EU level on broadening the access of LEAs to centralised bank account registries and, facilitating access of LEAs to other financial information. This would be achieved through issuing guidelines, organising seminars and workshops, training and awareness raising initiatives. This is in fact a mere extension of the baseline scenario, as the EU is currently actively involved in all of the strands of action mentioned above. Nevertheless, the issues and problems identified cannot be resolved with such guidelines and workshops. The problems are regulatory in nature and have serious implications on fundamental rights, including privacy and data protection. As such, they require regulatory solutions which will enable the access to information, while setting the conditions and safeguards for such access. More specifically, despite the recommendations in the ARO Platform’s second updated report on the establishment of centralised bank account registers as an effective tool for financial investigations and asset recovery, access by the AROs to the already established bank account registries remains inconsistent. Several AROs have been provided with direct access to the national bank account registers and data retrieval systems; some have been granted with indirect access and have to submit their request to an intermediary whereas others do not have any access and have to issue blanket requests. As regards the cooperation between FIUs and their access to LEA information, the EU FIU’s Platform is drafting and issuing guidelines/recommendations in respect of exchange of information between FIUs. Nevertheless, as analysed in the Staff Working Document of 2017, it is not possible to resolve the specific problems described above with non-regulatory options alone. Again, the problems are regulatory in nature and require regulatory solutions which will enable the access to information, while setting the conditions and safeguards for such access. To illustrate the limited effectiveness of guidelines or self-regulation in this field a good example is the EU FIUs' Platform report on Confidentiality and data protection in the activity of FIUs of 28 April 2008. Even when dedicated efforts by FIUs themselves are targeting self-regulation and identification of common grounds at Union level, with the support of the Commission, the results are far from sufficient. In the dedicated chapter on Use and exchange of data by the FIUs, the report did not achieve a common understanding of practical modalities of cooperation that would satisfy the national requirements of all Member States, and only sets out a number of basic principles, as follows: compliance with the principle of purpose limitation, exceptions to the confidentiality principle, principle of adequate level of protection, principle of prior consent, FIUs access to other national files, feedback to disclosing professions. For all the above reasons, the policy option of pursuing only non-regulatory measures, including the issuing of recommendations and guidelines must be rejected as a valid option on its own, since exchanges of financial data, particularly in cross-border cases, need a proper legal basis. 5.2.2.Legislative policy options The legislative options would facilitate the access and the exchange of information by means of binding rules at EU level that will provide for: ·Providing access and safeguards for access for law enforcement authorities to financial information held in central bank account registries and data retrieval systems; ·Broadening access and providing safeguards for access by FIUs to LEA information for the purpose of fulfilling their tasks; ·Broadening access and providing safeguards for access by LEAs to financial information ; ·Facilitating the cooperation between FIUs and removing obstacles to their cooperation. Given that the envisaged EU measures could have an important impact on procedural rights, privacy and data protection, the legislative options should address key concerns on these issues. Therefore, the options are split into Blocks relating to “when” the information will be accessible (otherwise known as the purpose of the use of the information); “how” the information will be accessible and by “whom” it will be accessible.

All the safeguards established by Regulation (EU) 2016/679 and Directive (EU) 2014/680 (hereinafter the “Data Protection Police Directive”) will apply to the options examined by this Impact Assessment notably: ·The provision of prior information to the data subjects that their data are centralised in registers and accessible by law enforcement authorities; ·The rights of the data subjects in case of misuse, abuse or unlawful access; ·The details of every law enforcement access to the registry would be recorded in a log; ·The logs would be stored for a minimum period of time; ·The data controller of the registry and Data Protection Supervisors would make spot checks on the access logs of the LEAs. Moreover, in respect of procedural safeguards set out in the national criminal law of the Member States, an important issue must be clearly set out. In the case of a law enforcement authority requesting specific financial information from an FIU, Art. 32(4) of the 4AMLD indicates that FIUs must respond to requests for information by LEAs in cases relating to money laundering, associated predicate offences or terrorist financing. The procedure for issuing and replying to such requests for information is not harmonised across Member States. In Member States where the FIU is a law enforcement body (part of police or prosecution system) this does not represent a salient problem. In other Member States, where the FIU is an administrative body a form of prior (judicial) authorisation may be required. None of the options set out in this Block aim to change the current approach. Union law should continue to only establish an obligation of result – leaving it to the Member States to lay down the exact means to attain this objective, including the procedural safeguards applicable. The aim of the options set out is to only propose additional safeguards, at Union level, as appropriate. The envisaged new EU measures will not bring any changes to the core functions or the organisational status of the authorities that must apply the rules, which will continue to perform the same functions as currently set out in national and Union legislation already in force. It is important to note at this stage that, given that this impact assessment analyses different problems encountered by different authorities, the analysis of impacts and preferred option might lead to a mix of these options. The aim would be to achieve the most targeted and proportionate result, while addressing the encountered problems. The envisaged new EU measures will apply to the following types of information: - data which is held by Financial Intelligence Units, or any type of information or data which is held by public authorities or by obliged entities and which is available to Financial Intelligence Units without the taking of coercive measures as defined under national law; - data which is held by law enforcement or any type of information or data which is held by public authorities or by private entities and which is available to law enforcement/competent authorities without the taking of coercive measures as those are defined by national law; - bank account information contained in the centralised bank account registries: (i) for the customer-account holder and any person purporting to act on behalf of the customer: the name, complemented by either the other identification data required under the national provisions transposing Article 13(1)(a) of Directive 2015/849/EU on identifying the customer and verifying the customer's identity, or a unique identification number;

(ii) for the beneficial owner of the customer-account holder: the name, complemented by either the other identification data required under the national provisions transposing Article 13(1)(b) of Directive 2015/849/EU on identifying the beneficial owner and verifying the beneficial owner's identity, or a unique identification number; (iii) for the bank or payment account: the IBAN number and the date of account opening and closing; (iv) for the safe deposit box: name of the lessee complemented by the other identification data required under the national provisions transposing Article 13 (1) of Directive 2015/849/EU on the identification of the customer and the beneficial owner and verification of his/her identity, or a unique identification number and the duration of the lease period. Block A: the "WHEN": in what cases should the relevant authorities have access to or exchange information? This Block examines the types of crime for the prevention and combat of which the competent authorities would be able to access and exchange information. This immediately presupposes that there must be limited cases when a competent authority will be able to request information, it will have to clearly indicate its reasons and ensure that the relevant data is not going to be further processed in a way that is incompatible with those purposes. OPTION A.1 The measures to facilitate access to and exchange of information will apply only in cases of preventing and combatting money laundering (and its associate predicate offences) and terrorist financing. This option would maintain the current purpose for the use of financial information in the 4AMLD. Nevertheless, this option is not the same as the baseline, as it would have added value in terms of LEAs getting access to CBAR and DRS and access of LEAs to financial information will be facilitated at least for money laundering and terrorist financing. OPTION A.2 The measures to facilitate access to and exchange of information will apply only in respect of the "Eurocrimes" set out in Article 83 TFEU. This option would complement the purpose for the use of financial information of the 4AMLD. It would have added value in terms of LEAs getting access to CBAR and DRS and access of LEAs to financial information will be facilitated at least for such Eurocrimes. OPTION A.3 The measures to facilitate access to and exchange of information will apply in respect of the forms of crimes as set out in Article 3(1) of the Europol Regulation . This option would further complement the purpose for the use of financial information of the 4AMLD. It would have added value in terms of LEAs getting access to CBAR and DRS and access of LEAs to financial information will be facilitated for all serious crimes. Block B: the "HOW": how should public authorities access and exchange information? This Block examines different modalities of access and takes into account the need of the competent authorities to be capable to expediently access and exchange financial information strictly for the purposes, specified in Block A. The means to access and exchange information must be described from the 2 perspectives: i) what type of information is sought; ii) who requests the information. Specifically, on the one hand, from the point of view of what type of information is sought, financial information must be distinguished as data stored in the CBAR and other data. OPTION B.1 The measures to facilitate access to and exchange of information will require each Member States to provide LEAs with access to the national CBAR and DRS according to one of the following sub-options: ·Sub-option B.1.a: direct access to the CBAR/DRS, under well-defined conditions; ·Sub-option B.1.b: indirect access to the CBAR/DRS, under well-defined conditions. This option applies to access to information contained in the bank account registries and data retrieval systems. This option entails two sub-options, direct access to the registries (option B.1.a) or indirect access (option B.1.b), whereby the law enforcement authority would submit its request for information to an intermediary, which would carry out the query on its behalf and provide the result. Additional safeguards will apply to the access to the registries under this option. Both analysed sub-options would expand the current access rights to the CBAR and DRS as provided in the 4/5AMLD. OPTION B.2 The measures to facilitate access to and exchange of information will require each Member State to provide LEAs with access to all other financial information, meaning all types of information from obliged entities under the 4AMLD or held by FIUs, including transaction data, according to one of the following sub-options: ·Sub-option B.2.a: direct access from the financial institutions ·Sub-option B.2.b: indirect access via the FIUs. This option pertains to the access of LEAs to all other types of information from obliged entities under the 4AMLD, including transaction data (the data the FIU hold already, and the data that are held by the obliged entities). Similarly, this access could either be direct (B.2.a), whereby the respective authority accesses the additional information directly from a bank, or indirect (B.2.b), whereby it accesses this information via the FIU. This set of options is analysed separately from the options in B.1 as it entails access to a different type of financial information. Both sub-options will set out conditions and data protection safeguards for the access to and exchange of information and will be without prejudice to national applicable procedural safeguards. This option would complement the scope of the 4AMLD as LEAs would obtain access not only to information already held by FIUs and to which they can currently have access, but also to additional information which is held by obliged entities (e.g. banks) and which can be accessed by FIUs without coercive measures. OPTION B.3 The measures to facilitate access to and exchange of information will set out the conditions and safeguards for the exchange of information between FIUs and for FIUs access to and exchange of information that LEAs hold: ·Sub-option B.3.a: direct cooperation between FIUs ·Sub-option B.3.b: establish a central EU FIU This option addresses the situation when an FIU requests for financial information from another FIU or from a LEA. Thus, Option B.3 tackles the interaction between FIUs with respect to requesting information from other FIUs and includes 2 sub-options. The required mechanisms could either involve direct contacts between FIUs in different Member States (Option B.3.a), whereby the requests for and exchange of information between FIUs will be facilitated and at the same time regulated, or be dealt with by establishing a central EU FIU (Option B.3.b). This would require the adoption of a Union act laying down the powers to receive, analyse and disseminate financial information to national competent authorities or to support national FIUs in their tasks This option does not expand the scope of the 4AMLD but rather regulates and sets additional safeguards for the exchanges of information. For the purposes of this impact assessment, direct access to centralised bank account registries means that a qualified LEA has access to the registry through an IT interface, without the need to request the information to the authority managing the registry or to another authority in that country. For example, if the Ministry of Interior in country X has access to the registry, the police services of that country can access the registry in their offices through an IT interface. Or, they can request the authorised persons within the Ministry of Interior to access the registry and provide them with the requested information. Indirect access means that a LEA requests information to the authority managing the registry, or to the FIU which has direct access. The authority receiving the request checks the registry and provides the requested information. Box 5: Direct and indirect access to centralised bank account registries Block C: the "WHO": to which public authorities do the conditions apply? Another set of limiting conditions in respect of the scope of application of the act refers to the categories of competent authorities allowed or empowered to apply the act, or, in other words, public authorities which are empowered to access or exchange information. The following options can be envisaged:

OPTION C.1 The measures to facilitate access to and exchange of information will apply to a set of public authorities with designated responsibilities in the field of preventing, investigating, detecting or prosecuting criminal offences as defined in Article 3(7)(a) of the Data Protection Police Directive. This option covers the public authorities as defined in Article 3(7)(a) of the Data Protection Police Directive. It would complement the current EU framework given that access will not be limited only to authorities competent for money laundering and terrorist financing but it would give access to other authorities responsible for fighting all serious crime. OPTION C.2 The measures to facilitate access to and exchange of information will apply to the set of public authorities in Option C.1 and additional authorities as listed in sub-options a, b and c. ·Sub-option C.2.a: the Asset Recovery Offices. ·Sub-option C.2.b: the European Union Agency for Law Enforcement Cooperation (EUROPOL) ·Sub-option C.2.c: OLAF – the European Anti-Fraud Office This option would further expand the types of authorities that will have access to the information. Three sub-options are proposed, which do not fall within the definition of a public authority in accordance with Article 3(7)(a) of the Data Protection Police Directive. These authorities are, firstly, pursuant to sub-option C.2.a, the Asset Recovery Offices of the Member States, whose mandate is to facilitate the tracing and identification of proceeds from crime, in view of their possible freezing and confiscation; Europol (sub-option C.2.b), assisting the Member States to fight international crime; the European Anti-Fraud Office (OLAF, sub-option C.2.c), which investigates fraud against the EU budget, corruption and serious misconduct within the European institutions. 5.2.3.Options discarded at an early stage Option O: non-legislative action For the reasons expounded in Section 5.1.2.1, by itself, and in addition to what is already been done in this field, this option does not meet a minimum threshold of effectiveness that merits evaluation of impacts. Therefore, the option of non-regulatory measures will not be analysed further. Option B.3.b: An EU act establishing a Union FIU The Commission has already considered and dismissed this option in the impact assessments assessment accompanying the 5AMLD. As no new salient developments either in the Member States or at Union level have occurred since then, this option cannot be further analysed here. This option must also be discarded for the purposes of the present impact assessment since the Commission has been mandated to issue a specific report to the European Parliament and the Council with respect to the feasibility of establishing a Union FIU. This legal obligation was assigned to the Commission in the framework of the agreement reached by the co-legislators in respect of the amendments to the 4AMLD, due to be adopted and published in early 2018. Accordingly, the Commission will have to perform a detailed analysis of this specific issue. Granting Europol with direct access to the centralised bank account registries for the purposes of any of the crimes listed in Block A The role of Europol is to assist Member States in criminal investigations by, in particular, providing new leads and criminal analysis. The assistance is often essential in cross-border serious and organised crime investigations and terrorism cases. The option of granting Europol direct access merely for the purposes of carrying out analysis is considered as not able to satisfy the “proportionality” criterion. However, depending on the impacts analysis and the conclusions of the Impact Assessment, Europol might be granted indirect access to the bank account registries. 6. What are the impacts of the policy options The policy options presented above are assessed on the basis of their economic, social and fundamental rights (mainly the right to the protection of personal data) impacts. Environmental impacts are not relevant in the context of this initiative and are not analysed in this impact assessment As a general note, it must be observed that the various options set out in Section 5 address different, even if, related objectives. The impacts of the options will be analysed according to their specific objectives but against a common set of parameters. 6.1. Economic impacts

The possible causal effects of the options analysed on the economy of the Member States is very difficult to assess although it is clear that the more effective the fight against serious and transnational crime, money laundering and terrorism is, the greater are the positive impacts on the economy. In order to complement the qualitative assessment of the options, the analysis also takes into consideration their potential costs. There are also serious limitations for doing so in absence of reliable data. However, a number of parameters associated with the costs and burden of financial investigations have been used, providing indications on the impacts of the different options. They relate to investigative costs and resources dedicated to implement procedures, resulting in costs both for public authorities and private entities. The legislative options having been built upon the 5AMLD, the costs of establishing central registries at national level are not relevant. Costs to be considered only relate to the connection to the registries and the number of authorities to be connected. 6.1.1. Options regarding law enforcement authorities’ access to information, stored in centralised bank account registries Baseline With the current legal framework, situation in the EU is characterized by the practice of blanket requests, and situations where Member States may have central registries already established and LEAs having an indirect access to them. In other Member States, LEAs may have a direct access to them. If no action is taken at EU level, despite the fact that the practice of the blanket requests may decrease after the implementation of the 5AMLD, it is most likely that in some Member State the competent authorities would continue issuing blanket requests in order to proceed with their investigations. Although it is not possible to provide a precise quantification of the costs of not acting at EU level due to the lack of data, some indication of the scale of these costs is given by the current practices. The cost needed to process each blanket request by LEAs and banks was acknowledged by the law enforcement authorities as a considerable administrative and financial burden during consultations. In the impact assessment accompanying the proposal for the modification of 4AMLD, the costs of the blanket requests sent by the FIUs to the banking sector had been estimated as ranging between € 94 000 to € 245 000 000 per year. The current number of blanket requests sent by LEAs to the banks in some Member States being similar, it can be assumed that the annual costs of the requests sent by LEAs to the banks would be within the same ranges. This is supported by the estimations which could be done in the context of this impact assessment in a number of countries. For example, in one Member State (LEAs send 50 000 - 60 000 blanket requests annually to the banks, the preparation of one blanket request takes 10-15 minutes and the hourly labour costs are € 38) the annual costs for the law enforcement authorities can be estimated at around € 600 000. As each request has to be processed individually, costs are more substantial for the banks and reach more than € 11 000 000. In another Member State (LEAs send 3 000 blanket requests annually in bulk to the banks, the preparation of one blanket request approximately 1 hour and the hourly labour costs are € 39.2) the annual costs can be estimated at around € 120 000 for the law enforcement sector and can reach almost € 5 000 000 for the banking sector. Moreover, the costs of issuing the requests are limited compared to those implied by the processing of the answers that requires time and resources. A full-time administrative position has been established in some police stations, whose primary responsibility is to handle and process the hundreds of answers to blanket requests. In some Member States LEAs already have an indirect access to central registries and there are, therefore, indications of the related costs. Although the costs related to issuing blanket requests may disappear, another category of costs has to be taken into account related to the authority managing the registry which carries out the check and sends the answer. This procedure also entails substantial administrative costs. In the case of one Member State, assuming that it takes an employee of the intermediary on average 20 minutes to process a request and send the result back to the requesting authority, then the indirect access has led to administrative costs of almost € 1 000 000 in 2016. Currently, 37 people are working for the Data Retrieval System at the intermediary, of whom 29 process requests for information (some in addition to their primary tasks).

Legislative options Options related to the purposes for which the competent authorities should have access to or exchange information, stored in the centralised bank account registries (Block A) There is no data to assess the costs of options according to the set of crimes which would be selected. It can, however, be assumed that the broader the list of crimes for which the authorities can obtain information from central registries is, the greater savings can be made on investigation costs. Public authorities having access to the registries with respect to more criminal investigations, the overall costs related to these investigations, notably those related to the blanket requests, would decrease. Options related to how public authorities should access and exchange financial information (Block B) Options in Block B have to be assessed according the type of connection to the national centralised bank account registry or data retrieval system they entail, which can be either direct or indirect. When considering the costs of establishing a direct connection, this assessment would however need to take into account the national IT infrastructure and the IT capabilities of the authorities to be connected in order to be more reliable. These aspects would have been too complex to be analysed and factor in this impact assessment. In order to assess the costs incurred by the establishment of a direct connection to a system (option B.1a), the connection costs of the AROs to the Europol SIENA system or the costs incurred by Business Registers Interconnection System (BRIS) project to set up the network between releva