Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 322(1) thereof, in conjunction with the Treaty establishing the European Atomic Energy Community, and in particular Article 106a thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the Court of Auditors,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) In line with the requests of the European Parliament and in response to point 24 of the European Council conclusions of 17 to 21 July 2020, in order to enhance the protection of the Union budget and the European Union Recovery Instrument against fraud and irregularities, standardised measures should be introduced to collect, compare and aggregate information and figures on the final recipients and beneficiaries of Union funding, for the purposes of control and audit.

(2) To ensure effective controls and audits, it is necessary to collect data on those ultimately benefitting, directly or indirectly, from Union funding under shared management and from projects and reforms supported under Regulation (EU) 2021/241 of the European Parliament and of the Council of 12 February 2021 establishing the Recovery and Resilience Facility (1), including data on beneficial owners of the recipients of the funding. The rules related to the collection and processing of such data will have to comply with applicable data protection rules.

(3) To enhance the protection of the Union budget, the Commission should make available an integrated and interoperable information and monitoring system, including a single data-mining and risk-scoring tool, to access, store, aggregate and analyse the aforementioned data with a view to a generalised mandatory application by Member States. That system should ensure efficient checks on conflicts of interests, irregularities, issues of double funding, and any misuse of the funds. The Commission, the European Anti-Fraud Office (OLAF) and other Union investigative and control bodies should have the necessary access to that data in order to exercise their supervisory functions in relation to the controls and audits that are to be carried out by the Member States in the first place to detect irregularities and conduct administrative investigations into the misuse of the Union funding concerned, and to get a precise overview of its distribution;

(4) Regulation (EU, Euratom) 2018/1046 should therefore be amended accordingly.

HAVE ADOPTED THIS REGULATION:

Regulation (EU, Euratom) 2018/1046 is amended as follows:

(1) Article 36 is amended as follows: (a) In paragraph 3, the following point is inserted: ‘(ee) the collection of data on those ultimately benefitting, directly or indirectly, from Union funding’; (b) In paragraph 4, the following point is inserted: ‘(cc) reliance on an integrated and interoperable electronic information and monitoring system, including a single data-mining and risk-scoring tool, to access and analyse data on those ultimately benefitting, directly or indirectly, from Union funding.’;

(2) Article 38 is amended as follows: (a) Paragraph 1 is replaced by the following: ‘1. The Commission shall make available, in an appropriate and timely manner, information on those ultimately benefitting, directly or indirectly, from Union funding, drawing on the data collected in the integrated and interoperable electronic information and monitoring system established in accordance with Article 129a. The first subparagraph of this paragraph shall also apply to other Union institutions when they implement the budget pursuant to Article 59(1).Where the recipient of funds is a legal person, information shall be published on persons and entities holding more than 15 % ownership of that entity’; (b) Paragraph 2 is replaced by the following: ‘2. The following non-sensitive information shall be published, having due regard for the requirements of confidentiality and security, in particular the protection of personal data: (a) the name of the recipient; (b) the legal nature of the recipient, namely: (i) a natural person; (ii) a legal person; (iii) a public entity or institution; (iv) other.; (c) the locality of the recipient, namely: (i) the address of the recipient when the recipient is a legal person; (ii) the region on NUTS 2 level when the recipient is a natural person; (d) the amount legally committed; (e) the nature and purpose of the measure.’; (c) Paragraph 4 is deleted; (d) Paragraph 6 is replaced by the following: ‘6. Where personal data are published, the information shall be removed five years after the end of the financial year in which the funds were legally committed. This shall also apply to personal data referring to legal persons whose official name identifies one or more natural persons’;

(3) Article 63 is amended as follows: (a) the following paragraph is inserted: ‘1a. When executing tasks relating to budget implementation, Member States shall collect data on those ultimately benefitting, directly or indirectly, from Union funding in accordance with the requirements of the integrated and interoperable electronic information and monitoring system established under Article 129a. Complementary requirements for the use of the system in a given sector may be laid down in sector-specific rules.’; (b) In paragraph 2, first subparagraph, the following point is inserted: ‘(bb) collecting data on those ultimately benefitting, directly or indirectly, from Union funding, using the integrated and interoperable electronic information and monitoring system made available by the Commission in accordance with Article 129a.’; (c) In paragraph 4, the following point is inserted: ‘(bb) use the integrated and interoperable electronic information and monitoring system made available by the Commission in accordance with Article 129a.’;

(4) the following Article is inserted: ‘Article 129a Integrated and interoperable electronic information and monitoring system 1. The Commission shall set up, operate and make available to financial actors, other persons and entities involved in budget implementation, including competent national authorities under shared management, an integrated and interoperable electronic information and monitoring system, including a single data-mining and risk-scoring tool, to access and analyse data on those ultimately benefitting, directly or indirectly, from Union funding. 2. The system referred to in paragraph 1 shall be based on standardised measures to collect, compare and aggregate information and figures on those ultimately benefitting, directly or indirectly, from Union funding, for the purposes of control and audit. The system shall allow for efficient checks on conflicts of interests, irregularities, issues of double funding, and any misuse of the funds. 3. The compulsory information items collected in the system shall include inter alia: (a) VAT or registration number of legal entities; (b) national identification number for natural persons; (c) the legal nature of the recipient, namely: (i) a natural person; (ii) a legal person; (iii) a public entity or institution; (iv) other. (d) contractor(s) and sub-contractor(s); (e) beneficial owner(s) whenever the recipient, owner, contractor or sub-contractor is a legal person; (f) information on whether the beneficiary also receives state aid; (g) all beneficiaries’ and beneficial owners’ contact information; 4. The Commission, OLAF, the Court of Auditors and, in respect of those Member States participating in enhanced cooperation pursuant to Council Regulation (EU) 2017/1939, EPPO, as well as other Union investigative and control bodies, including the discharge authority, shall be granted access to the information contained in the system referred to in paragraph 1 where necessary for the exercise of their functions. 5. Any processing of personal data in the operation of the system shall comply with Regulation (EU) 2016/679. 6. The Commission is empowered to adopt delegated acts in accordance with Article 269 to lay down detailed rules on the operation and functioning of the system referred to in paragraph 1, including rules on the collection of data and on access to the information contained in the system.’;

(5) in Article 154(4), first subparagraph, the following point is inserted: ‘(dd) ensure the collection of data on those ultimately benefitting, directly or indirectly, from Union funding to an extent equivalent to the requirements of the system referred to in Article 129a.’;

(6) Article 269 is amended as follows: (a) In paragraph 3, the first sentence is replaced by the following: ‘The delegation of power referred to in Article 70(1), the third paragraph of Article 71, Article 129a, Article 161 and the second and third subparagraphs of Article 213(2) may be revoked at any time by the European Parliament or by the Council.’; (b) In paragraph 6, the first sentence is replaced by the following: ‘A delegated act adopted pursuant to Article 70(1), the third paragraph of Article 71, Article 129a, Article 161 and the second and third subparagraphs of Article 213(2) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object.’.