Proposal for a Council Decision on the signature of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program
Date: 2010-06-15
Institutions: European Commission
Subjects: United States, agreement (EU), data processing, exchange of information, financing method, personal data, signature of an agreement, terrorism

EN 

EN 

   EN 

 
 
EUROPEAN COMMISSION 

Brussels, 15.6.2010 
COM(2010) 317 final 

2010/0177 (NLE) 

  Proposal for a 

COUNCIL DECISION 

on the signature of the Agreement between the European Union and the United States of 
America on the processing and transfer of Financial Messaging Data from the European 
Union to the United States for purposes of the Terrorist Finance Tracking Program 

EN 

1 

   EN 

 
 
  
 
EXPLANATORY MEMORANDUM 

•  On  24  March  2010,  the  Commission  adopted  a  Recommendation  from  the 
Commission to the Council to authorise the opening of the negotiations between 
the  European  Union  and  the  United  States  of  America  to  make  available  to  the 
United  States  Treasury  Department  financial  messaging  data  to  prevent  and 
combat terrorism and terrorism financing. On 11 May 2010, the Council adopted a 
Decision,  together  with  negotiation  directives,  authorising  the  Commission  to 
open  negotiations  on  behalf  of  the  European  Union.  On  10  May  2010,  the 
European  Parliament  adopted  a  resolution  on  the  Recommendation  from  the 
Commission  to  the  Council  to  authorise  the  opening  of  the  negotiations  The 
Agreement  was  initialled  by  the  Parties  on  11  June  2010.  The  Agreement  has  a 
duration of 5 years. 

•  The  TFTP  has  generated  significant  intelligence  which  has  benefitted  Member 
States'  fight  against  terrorism.  The  purpose  of  the  Agreement  is  to  ensure  the 
continuation  of  the  TFTP  by  making  available  to  the  United  States  Treasury 
Department  financial  messaging  data  stored  in  the  EU  for  the  purposes  of  the 
Terrorist Finance Tracking Program (TFTP). Since the new systems architecture 
of  the  Society  for  Worldwide  Interbank  Financial  Telecommunication  –SWIFT- 
(hereinafter  referred  to  as  the  "designated  provider")  became  operational  on  1 
January 2010, a significant volume of the data which were previously received by 
the  U.S.  Treasury  Department  under  the  TFTP,  have  not  been  available, 
undermining  the  benefits  of  the  TFTP  not  least  for  the  European  Union.  This 
Agreement is therefore necessary to enable the functioning of the TFTP without 
the  limitations  derived  from  the  designated  provider's  new  systems  architecture 
and ensure that the TFTP can produce EU - and wider global – security benefits . 

**** 

•  The  TFTP  has  existed  since  end  2001,  pursuant  to  which  the  United  States 
Department of the Treasury served  administrative subpoenas on the  U.S. arm of 
the designated provider for the transfer to the Treasury Department of limited sets 
of financial messaging data which transit over the designated provider's financial 
messaging network. 

•  In  early  2007  the  Presidency  of  the  Council  of  the  European  Union  and  the 
European Commission engaged in discussions with the U.S. Treasury Department 
concerning the latter's processing of EU-originating personal data accessed under 
the TFTP. As a direct consequence of these discussions, the Treasury Department 
made  a  series  of  unilateral  commitments  to  the  European  Union  in  June  2007 
("the  TFTP  Representations").1  The  TFTP  Representations  expressly  limit  the 
Treasury's  processing  of  EU-originating  personal  data  accessed  pursuant  to  the 
TFTP.  Limitations  include,  for  example,  that  data  will  be  processed  exclusively 
for  counter  terrorism  purposes,  that  data  can  only  be  accessed  if  there  is  a  pre-
existing terrorism nexus (i.e. no data mining) and an obligation to delete data after 
a certain period. In addition, the TFTP Representations state that the Commission 

1 

The TFTP Representations, were acknowledged by the European Union by letter of 29 June 2007. The 
TFTP Representations and EU letter of acknowledgement were published in the Official Journal OJ C 
166/18 of 20.7.2007 and OJ C 166/26 of 20.7.2007.  

EN 

2 

   EN 

 
                                                 
may  appoint  an  "eminent  European  person"  who  will  verify  and  report  to  the 
Commission on U.S. Treasury compliance with its commitments.  

•  In  March  2008  the  Commission  announced  that  it  had  designated  Judge  Jean-
Louis Bruguière as the TFTP "eminent European person" whose role would be to 
verify  that  the  TFTP  is  implemented  in  accordance  with  the  Representations. 
Judge Bruguière completed his first report in December 2008. The Report which 
was presented to the Justice and Home Affairs Council in February 2009 and to 
the European Parliament's Civil Liberties Committee in February and September 
2009, finds that the U.S. Treasury Department complies with the commitments set 
out in the TFTP Representations. The Report further concludes that the TFTP has 
generated  considerable  value  for  Member  State  authorities'  investigation  of 
terrorism  and  that  Member  State  authorities  have  been  the  main  beneficiaries  of 
TFTP-derived  information2.  There  is  currently  no  equivalent  of  the  TFTP  in  the 
European Union. 

•  On  1  January  2010,  the  new  "systems  architecture"  of  the  designated  provider 
became operational. Under this new systems architecture, the designated provider 
retains  its  existing  EU-based  and  U.S.  servers  and  brings  into  operation  a  new 
operating centre in Switzerland. The net effect of this new arrangement is that a 
significant  volume  of  the  data  which  were  received  by  the  U.S.  Treasury 
Department under the TFTP is no longer stored in the United States. In order to 
ensure  that  the  TFTP  continues  to  produce  EU  -  and  wider  global  –  security 
benefits, it is necessary to put in place an international agreement that allows for 
data needed for the TFTP to continue to be made available to the U.S. Treasury 
Department.  

•  The JHA Council of 30 November 2009 authorised the Presidency of the Council 
of  the  European  Union  to  sign  an  interim  agreement  between  the  EU  and  the 
United States on the processing and transfer of Financial Messaging Data from the 
EU to the U.S. for purposes of the TFTP. The interim agreement, also signed on 
30 November 2009, was to have a maximum duration of 9 months. However, on 
11 February the European Parliament adopted its Resolution withholding consent 
for the TFTP Interim Agreement. A letter signed by the President of the Council 
was delivered to the US Secretary of State on 22 February 2010 stating that as a 
consequence of the Parliament's Resolution, the EU could not become a party to 
the  Interim  Agreement  and  terminating  the  provisional  application  of  the 
Agreement. No data were ever transferred under the Interim Agreement. 

•  Following  the  termination  of  the  provisional  application  of  the  Interim 
Agreement,  data  stored  by  the  designated  provider  in  its  EU  server  remains 
inaccessible  to  the  Treasury  Department  for  the  purposes  of  the  TFTP.  It  is 
necessary to conclude this Agreement as rapidly as possible in order to make these 
data  available  to  the  United  States  Treasury  Department  for  the  purposes  of 
preventing and combating terrorism and terrorist financing. 

**** 

2 

The "eminent European person" Report of December 2008 contains various examples of where TFTP-
derived  intelligence  has  been  shared  with  EU  Member  State  services  in  connection  with  the 
investigation, prevention and prosecution of terrorism in the European Union. The Report further states 
that United States authorities have shared approximately 1400 TFTP-derived leads with Member States 
since 2002.  

EN 

3 

   EN 

 
                                                 
•  In  the  longer-term,  there  is  an  ambition  for  the  European  Union  to  establish  a 
system equivalent to the TFTP, which could enable the analysis of data held in the 
European  Union  to  take  place  on  the  territory  of  the  European  Union.  This 
possibility is expressly recognised within the Agreement, and the United States of 
America  has  committed  to  support  this  development  in  order  to  enable  its 
successful establishment 

•  The  Agreement  aims  at  preventing  and  combating  terrorism  while  respecting 
fundamental  rights,  and  notably  the  protection  of  personal  data.  The  Agreement 
between the European Union and the United States of America on the processing 
and transfer of Financial Messaging Data from the European Union to the United 
States for purposes of the Terrorist Finance Tracking Program aims to ensure full 
respect  for  fundamental  rights  enshrined  in  Article  6  (2),  of  the  Treaty  on 
European Union, in particular the right to privacy with regard to the processing of 
personal  data  as  stipulated  in  Article  16  of  the  Treaty  on  the  Functioning  of  the 
European Union and for the principles of proportionality and necessity regarding 
the right to respect for private and family life and the protection of personal data 
as  set  out  in  Articles  7  and  8  of  the  Charter  of  Fundamental  Rights  of  the 
European Union. 

•  The  Agreement  has  secured  significant  safeguards  for  those  whose  data  is 
processed  by  the  designated  provider  within  the  European  Union  if  it  is 
transferred  to  the  Treasury  Department  under  this  Agreement.  Most  notably,  the 
Agreement  provides  for  transparency  of  the  use  of  data;  access,  blocking  and 
rectification  of  data;  as  well  as  administrative  redress  on  a  non-discriminatory 
basis and the availability of a process for seeking judicial redress under U.S. law, 
regardless of nationality or place of residence. Where leads resulting from the data 
are  shared  with  third  parties,  the  Member  State  concerned  will  be  consulted  as 
appropriate. The Agreement offers a strengthened process for the European Union 
to review its functioning, and to monitor the independent oversight of the TFTP. 

•  Article 218(2) of the Treaty on the Functioning of the European Union states that 

the Council shall authorise the signing of international agreements.  

**** 

•  The Commission therefore proposes to the Council to adopt a decision signing the 
Agreement between the European Union and the United States of America on the 
processing and transfer of Financial Messaging Data from the European Union to 
the United States for purposes of the Terrorist Finance Tracking Program.  

EN 

4 

   EN 

 
2010/0177 (NLE) 

Proposal for a 

COUNCIL DECISION 

on the signature of the Agreement between the European Union and the United States of 
America on the processing and transfer of Financial Messaging Data from the European 
Union to the United States for purposes of the Terrorist Finance Tracking Program 

THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Articles 87(2)(a) and 88 (2), in conjunction with Article 218 (5) thereof,  

Having regard to the proposal from the European Commission, 

Whereas: 

(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

On 11 May 2010, the Council adopted a Decision, together with negotiation directives, 
authorising  the  Commission  to  open  negotiations  on  behalf  of  the  European  Union 
between  the  European  Union  and  the  United  States  of  America  to  make  available  to 
the  United  States  Treasury  Department  financial  messaging  data  to  prevent  and 
combat  terrorism  and  terrorism  financing.  The  negotiations  were  successfully 
concluded by the initialling of the Agreement. 

The Agreement has not yet been signed. The procedures to be followed to that end by 
the European Union are governed by Article 218 of the Treaty on the Functioning of 
the European Union.  

The Agreement negotiated by the Commission should be signed, subject to its possible 
conclusion at a later stage. 

This  Agreement  respects  the  fundamental  rights  and  observes  the  principles 
recognised in particular by the Charter of Fundamental Rights of the European Union, 
notably the right to private and family life, recognised in Article 7 of the Charter, the 
right to the protection of personal data, recognised in Article 8 of the Charter and the 
right  to  effective  remedy  and  fair  trial  recognised  by  Article  47  of  the  Charter.  This 
Agreement should be applied in accordance with those rights and principles. 

[In  accordance  with  Article  3  of  the  Protocol  21  on  the  Position  of  the  United 
Kingdom and Ireland in respect of the area of Freedom, Security and Justice annexed 
to the Treaty on European Union and the Treaty on the Functioning of the European 
Union, the United Kingdom and Ireland take part in the adoption of this Decision.] 

In  accordance  with  Articles  1  and  2  of  the  Protocol  22  on  the  Position  of  Denmark 
annexed  to  the  Treaty  on  European  Union  and  the  Treaty  on  the  Functioning  of  the 
European Union, Denmark is not taking part in the adoption of this Decision and is not 
bound by the Agreement or subject to its application, 

EN 

5 

   EN 

 
HAS ADOPTED THIS DECISION:  

Article 1 

The  Commission  is  authorised  to  sign,  on  behalf  of  the  European  Union,  the  Agreement 
between the European Union and the United States of America on the processing and transfer 
of Financial Messaging Data from the European Union to  the United States  for purposes of 
the Terrorist Finance Tracking Program, and to designate the persons empowered to proceed 
to the signature.  

The text of the Agreement to be signed is attached to this Decision. 

This Decision shall enter into force on the day of its adoption.  

Done at Brussels,  

Article 2 

For the Council 
The President 

EN 

6 

   EN 

 
 
 
ANNEX 

AGREEMENT 

BETWEEN THE EUROPEAN UNION 
AND THE UNITED STATES OF AMERICA 
ON THE PROCESSING AND TRANSFER 
OF FINANCIAL MESSAGING DATA 
FROM THE EUROPEAN UNION TO THE UNITED STATES 
FOR PURPOSES OF THE 
TERRORIST FINANCE TRACKING PROGRAM 

THE EUROPEAN UNION, 

THE UNITED STATES OF AMERICA, 

of the one part, and 

of the other part, 

Together hereinafter referred to as "the Parties", 

DESIRING to prevent and combat terrorism and its financing, in particular by mutual sharing 
of  information,  as  a  means  of  protecting  their  respective  democratic  societies  and  common 
values, rights, and freedoms; 

SEEKING  to  enhance  and  encourage  cooperation  between  the  Parties  in  the  spirit  of 
transatlantic partnership; 

RECALLING the United Nations conventions for combating terrorism and its financing, and 
relevant resolutions of the United Nations Security Council in the field of fighting terrorism, 
in particular United Nations Security Council Resolution 1373 (2001) and its directives that 
all States shall take the necessary steps to prevent the commission of terrorist acts, including 
by  provision  of  early  warning  to  other  States  by  exchange  of  information;  that  States  shall 
afford  one  another  the  greatest  measure  of  assistance  in  connection  with  criminal 
investigations or criminal proceedings relating to the financing or support of terrorist acts; that 
States  should  find  ways  of  intensifying  and  accelerating  the  exchange  of  operational 
information;  that  States  should  exchange  information  in  accordance  with  international  and 
domestic law; and that States should cooperate, particularly through bilateral and multilateral 
arrangements  and  agreements,  to  prevent  and  suppress  terrorist  attacks  and  to  take  action 
against perpetrators of such attacks; 

RECOGNISING  that  the  United  States  Department  of  the  Treasury's  ("U.S.  Treasury 
Department")  Terrorist  Finance  Tracking  Program  ("TFTP")  has  been  instrumental  in 
identifying  and  capturing  terrorists  and  their  financiers  and  has  generated  many  leads  that 
have  been  disseminated  for  counter  terrorism  purposes  to  competent  authorities  around  the 
world, with particular value for European Union Member States ("Member States"); 

NOTING the importance of the TFTP in preventing and combating terrorism and its financing 
in  the  European  Union  and  elsewhere,  and  the  important  role  of  the  European  Union  in 
ensuring  that  designated  providers  of  international  financial  payment  messaging  services 
provide financial payment messaging data stored in the territory of the European Union which 
are  necessary  for  preventing  and  combating  terrorism  and  its  financing,  subject  to  strict 
compliance with safeguards on privacy and the protection of personal data; 

EN 

7 

   EN 

 
 
 
MINDFUL  of  Article  6(2)  of  the  Treaty  on  European  Union  on  respect  for  fundamental 
rights,  the  right  to  privacy  with  regard  to  the  processing  of  personal  data  as  stipulated  in 
Article  16  of  the  Treaty  on  the  Functioning  of  the  European  Union,  the  principles  of 
proportionality  and  necessity  concerning  the  right  to  private  and  family  life,  the  respect  for 
privacy, and the protection of personal data under Article 8(2) of the European Convention on 
the  Protection  of  Human  Rights  and  Fundamental  Freedoms,  the  Council  of  Europe 
Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of 
Personal  Data,  and  Articles  7  and 8  of  the  Charter  of  Fundamental  Rights  of  the  European 
Union; 

MINDFUL  of  the  breadth  of  privacy  protections  in  the  United  States  of  America  (“United 
States”), as reflected in the United States Constitution, and in its criminal and civil legislation, 
regulations,  and  long-standing  policies,  which  are  enforced  and  maintained  by  checks  and 
balances applied by the three branches of government; 

STRESSING the common values governing privacy and the protection of personal data in the 
European Union and the United States, including the importance which both Parties assign to 
due process and the right to seek effective remedies for improper government action; 

MINDFUL  of  the  mutual  interest  in  the  expeditious  conclusion  of  a  binding  agreement 
between the European Union and the United States based on common principles regarding the 
protection  of  personal  data  when  transferred  for  the  general  purposes  of  law  enforcement, 
bearing in mind the importance of carefully considering its effect on prior agreements and the 
principle of effective administrative and judicial redress on a non-discriminatory basis; 

NOTING the rigorous controls and safeguards utilised by the U.S. Treasury Department for 
the  handling,  use,  and  dissemination  of  financial  payment  messaging  data  pursuant  to  the 
TFTP, as described in the representations of the U.S. Treasury Department published in the 
Official  Journal  of  the  European  Union  on  20  July  2007  and  the  Federal  Register  of  the 
United States on 23 October 2007, which reflect the ongoing cooperation between the United 
States and the European Union in the fight against global terrorism; 

RECOGNISING  the  two  comprehensive  reviews  and  reports  of  the  independent  person 
appointed  by  the  European  Commission  to  verify  compliance  with  the  data  protection 
safeguards  of  the  TFTP,  concluding  that  the  United  States  was  complying  with  the  data 
privacy  protection  practices  outlined  in  its  Representations  and  further  that  the  TFTP  has 
generated  significant  security  benefits  for  the  European  Union  and  has  been  extremely 
valuable not only in investigating terrorist attacks but also in preventing a number of terrorist 
attacks in Europe and elsewhere; 

MINDFUL of the European Parliament's resolution of 5 May 2010 on the Recommendation 
from the Commission to the Council to authorise the opening of negotiations for an agreement 
between  the  European  Union  and  the  United  States  of  America  to  make  available  to  the 
United States Treasury Department financial messaging data to prevent and combat terrorism 
and terrorist financing; 

RECALLING that, to guarantee effective exercise of their rights, any person irrespective of 
nationality is able to lodge a complaint before an independent data protection authority, other 
similar authority, independent and impartial court or tribunal, to seek effective remedies; 

MINDFUL that non-discriminatory administrative and judicial redress is available under U.S. 
law  for  mishandling  of  personal  data,  including  under  the  Administrative  Procedure  Act  of 
1946,  the  Inspector  General  Act  of  1978,  the  Implementing  Recommendations  of  the  9/11 
Commission  Act  of  2007,  the  Computer  Fraud  and  Abuse  Act,  and  the  Freedom  of 
Information Act; 

EN 

8 

   EN 

 
RECALLING that by law within the European Union customers of financial institutions and 
of  providers  of  financial  payment  messaging  services  are  informed  in  writing  that  personal 
data contained in financial transaction records may be transferred to Member States' or third 
countries'  public  authorities  for  law  enforcement  purposes  and  that  this  notice  may  include 
information with respect to the TFTP; 

RECOGNISING the principle of proportionality guiding this Agreement and implemented by 
both the European Union and the United States; in the European Union as derived from the 
European  Convention  on  Human  Rights  and  Fundamental  Freedoms,  its  applicable 
jurisprudence,  and  EU  and  Member  State  legislation;  and  in  the  United  States  through 
reasonableness  requirements  derived  from  the  U.S.  Constitution  and  federal  and  state  laws, 
and  their  interpretive  jurisprudence,  as  well  as  through  prohibitions  on  overbreadth  of 
production orders and on arbitrary action by government officials; 

AFFIRMING that this Agreement does not constitute a precedent for any future arrangements 
between the United States and the European Union, or between either of the Parties and any 
State, regarding the processing and transfer of financial payment messaging data or any other 
form of data, or regarding data protection; 

RECOGNISING that Designated Providers are bound by generally applicable EU or national 
data  protection  rules,  intended  to  protect  individuals  with  regard  to  the  processing  of  their 
personal  data,  under  the  supervision  of  competent  Data  Protection  Authorities  in  a  manner 
consistent with the specific provisions of this Agreement; and 

FURTHER AFFIRMING that this Agreement is without prejudice to other law enforcement 
or information sharing agreements or arrangements between the Parties or between the United 
States and Member States, 

HAVE AGREED AS FOLLOWS: 

EN 

9 

   EN 

 
ARTICLE 1 

Purpose of Agreement 

The  purpose  of  this  Agreement  is  to  ensure,  with  full  respect  for  the  privacy, 

1. 
protection of personal data, and other conditions set out in this Agreement, that: 

(a) 
financial  payment  messages  referring  to  financial  transfers and related data stored in 
the territory of the European Union by providers of international financial payment messaging 
services,  that  are  jointly  designated  pursuant  to  this  Agreement,  are  provided  to  the  U.S. 
Treasury Department for the exclusive purpose of the prevention, investigation, detection, or 
prosecution of terrorism or terrorist financing; and 

(b) 
relevant  information  obtained  through  the  TFTP  is  provided  to  law  enforcement, 
public security, or counter terrorism authorities of Member States, or Europol or Eurojust, for 
the  purpose  of  the  prevention,  investigation,  detection,  or  prosecution  of  terrorism  or 
terrorist financing. 

The United States, the European Union, and its Member States shall take all necessary 
2. 
and  appropriate  measures  within  their  authority  to  carry  out  the  provisions  and  achieve  the 
purpose of this Agreement. 

ARTICLE 2 

Scope of Application 
Conduct Pertaining to Terrorism or Terrorist Financing 

This Agreement applies to the obtaining and use of financial payment messaging and related 
data with a view to the prevention, investigation, detection, or prosecution of: 

(a) 
Acts of a person or entity that involve violence, or are otherwise dangerous to human 
life or create a risk of damage to property or infrastructure, and which, given their nature and 
context, are reasonably believed to be committed with the aim of: 

(i) 

intimidating or coercing a population; 

intimidating,  compelling,  or  coercing  a  government  or 

(ii) 
organization to act or abstain from acting; or 

international 

(iii)  seriously  destabilizing  or  destroying  the  fundamental  political,  constitutional, 
economic, or social structures of a country or an international organization; 

(b) 
A  person  or  entity  assisting,  sponsoring,  or  providing  financial,  material,  or 
technological support for, or financial or other services to or in support of, acts described in 
subparagraph (a); 

(c) 
A person or entity providing or collecting funds, by any means, directly or indirectly, 
with the intention that they should be used or in the knowledge that they are to be used, in full 
or in part, in order to carry out any of the acts described in subparagraphs (a) or (b); or 

A person or entity aiding, abetting, or attempting acts described in subparagraphs (a), 

(d) 
(b), or (c). 

ARTICLE 3 

Ensuring Provision of Data by Designated Providers 

The Parties, jointly and individually, shall ensure, in accordance with this Agreement and in 
particular  Article  4,  that  entities  jointly  designated  by  the  Parties  under  this  Agreement  as 
providers  of  international  financial  payment  messaging  services  ("Designated  Providers") 

EN 

10 

   EN 

 
provide to the U.S. Treasury Department requested financial payment messaging and related 
data  which  are  necessary  for  the  purpose  of  the  prevention,  investigation,  detection,  or 
prosecution  of  terrorism  or  terrorist  financing  ("Provided  Data").  The  Designated  Providers 
shall  be  identified  in  the  Annex  to  this  Agreement  and  may  be  updated,  as  necessary,  by 
exchange of diplomatic notes. Any amendments to the Annex shall be duly published in the 
Official Journal of the European Union. 

ARTICLE 4 

U.S. Requests to Obtain Data from Designated Providers 

1. 
For  the  purposes  of  this  Agreement,  the  U.S.  Treasury  Department  shall  serve 
production  orders  (“Requests”),  under  authority  of  U.S.  law,  upon  a  Designated  Provider 
present in the territory of the United States in order to obtain data necessary for the purpose of 
the prevention, investigation, detection, or prosecution of terrorism or terrorist financing that 
are stored in the territory of the European Union. 

2. 

The Request (together with any supplemental documents) shall: 

(a) 

(b) 

(c) 

identify as clearly as possible the data, including the specific categories of data 
requested,  that  are  necessary  for  the  purpose  of  the  prevention,  investigation, 
detection, or prosecution of terrorism or terrorist financing; 

clearly substantiate the necessity of the data;  

be  tailored  as  narrowly  as  possible  in  order  to  minimize  the  amount  of  data 
requested,  taking  due  account  of  past  and  current  terrorism  risk  analyses 
focused on message types and geography as well as perceived terrorism threats 
and vulnerabilities, geographic, threat, and vulnerability analyses; and 

(d) 

not seek any data relating to the Single Euro Payments Area. 

3. 
Upon  service  of  the  Request  on  the  Designated  Provider,  the  U.S.  Treasury 
Department  shall  simultaneously  provide  a  copy  of  the  Request,  with  any  supplemental 
documents, to Europol. 

4. 
Upon  receipt  of  the  copy,  Europol  shall  verify  as  a  matter  of  urgency  whether  the 
Request complies with the requirements of paragraph 2. Europol shall notify the Designated 
Provider that it has verified that the Request complies with the requirements of paragraph 2. 

For  purposes  of  this  Agreement,  once  Europol  has  confirmed  that  the  Request 
5. 
complies with the requirements of paragraph 2, the Request shall have binding legal effect as 
provided  under  U.S.  law,  within  the  European  Union  as  well  as  the  United  States.  The 
Designated  Provider  is  thereby  authorized  and  required  to  provide  the  data  to  the  U.S. 
Treasury Department. 

6. 
The  Designated  Provider  shall  thereupon  provide  the  data  (i.e.,  on  a  “push  basis”) 
directly to the U.S. Treasury Department. The Designated Provider shall keep a detailed log 
of all data transmitted to the U.S. Treasury Department for the purposes of this Agreement. 

7. 
Once  the  data  have  been  provided  pursuant  to  these  procedures,  the  Designated 
Provider shall be deemed to have complied with this Agreement and with all other applicable 
legal  requirements  in  the  European  Union  related  to  the  transfer  of  such  data  from  the 
European Union to the United States. 

Designated Providers shall have all administrative and judicial redress available under 

8. 
the laws of the United States to recipients of U.S. Treasury Department Requests. 

EN 

11 

   EN 

 
The Parties shall jointly coordinate with regard to the technical modalities necessary to 

9. 
support the Europol verification process. 

ARTICLE 5 

Safeguards Applicable to the Processing of Provided Data 

General Obligations 

1. 
The  U.S.  Treasury  Department  shall  ensure  that  Provided  Data  are  processed  in 
accordance with the provisions of this Agreement. The U.S. Treasury Department shall ensure 
the protection of personal data by means of the following safeguards, which shall be applied 
without discrimination, in particular on the basis of nationality or country of residence. 

Provided  Data  shall  be  processed  exclusively  for  the  prevention,  investigation, 

2. 
detection, or prosecution of terrorism or its financing; 

The TFTP does not and shall not involve data mining or any other type of algorithmic 

3. 
or automated profiling or computer filtering. 

Data Security and Integrity 

To prevent unauthorized access to or disclosure or loss of the data or any unauthorised 

4. 
form of processing: 

(a) 

(b) 

(c) 

(d) 

(e) 

Provided Data shall be held in a secure physical environment, stored separately 
from  any  other  data,  and  maintained  with  high-level  systems  and  physical 
intrusion controls; 

Provided Data shall not be interconnected with any other database; 

Access to Provided Data shall be limited to analysts investigating terrorism or 
its  financing  and  to  persons  involved  in  the  technical  support,  management, 
and oversight of the TFTP; 

Provided Data shall not be subject to any manipulation, alteration, or addition; 
and 

No  copies  of  Provided  Data  shall  be  made,  other  than  for  disaster  recovery 
back-up purposes. 

Necessary and Proportionate Processing of Data 

5. 
All  searches  of  Provided  Data  shall  be  based  upon  pre-existing  information  or 
evidence which demonstrates a reason to believe that the subject of the search has a nexus to 
terrorism or its financing. 

6. 
Each  individual  TFTP  search  of  Provided  Data  shall  be  narrowly  tailored,  shall 
demonstrate a reason to believe that the subject of the search has a nexus to terrorism or its 
financing, and shall be logged, including such nexus to terrorism or its financing required to 
initiate the search. 

7. 
Provided  Data  may  include  identifying  information  about  the  originator  and/or 
recipient  of  a  transaction,  including  name,  account  number,  address,  and  national 
identification number. The Parties recognize the special sensitivity of personal data revealing 
racial  or  ethnic  origin,  political  opinions,  or  religious  or  other  beliefs,  trade  union 
membership, or health and sexual life (“sensitive data”). In the exceptional circumstance that 
extracted data were to include sensitive data, the U.S. Treasury Department shall protect such 
data in accordance with the safeguards and security measures set forth in this Agreement and 
with full respect and taking due account of their special sensitivity. 

EN 

12 

   EN 

 
ARTICLE 6 

Retention and Deletion of Data 

1. 
During the term of this Agreement, the U.S. Treasury Department shall undertake an 
ongoing  and  at  least  annual  evaluation  to  identify  non-extracted  data  that  are  no  longer 
necessary  to  combat  terrorism  or  its  financing.  Where  such  data  are  identified,  the  U.S. 
Treasury Department shall permanently delete them as soon as technologically feasible. 

2. 
If it transpires that financial payment messaging data were transmitted which were not 
requested, the U.S. Treasury Department shall promptly and permanently delete such data and 
shall inform the relevant Designated Provider. 

Subject  to  any  earlier  deletion  of  data  resulting  from  paragraphs  1,  2,  or  5,  all  non-

3. 
extracted data received prior to 20 July 2007 shall be deleted not later than 20 July 2012. 

4. 
Subject  to  any  earlier  deletion  of  data  resulting  from  paragraphs  1,  2,  or  5,  all  non-
extracted data received on or after 20 July 2007 shall be deleted not later than five (5) years 
from receipt. 

5. 
During the term of this Agreement, the U.S. Treasury Department shall undertake an 
ongoing  and  at  least  annual  evaluation  to  assess  the  data  retention  periods  specified  in 
paragraphs  3  and  4  to  ensure  that  they  continue  to  be  no  longer  than  necessary  to  combat 
terrorism or its financing. Where any such retention periods are determined to be longer than 
necessary  to  combat  terrorism  or  its  financing,  the  U.S.  Treasury  Department  shall  reduce 
such retention periods, as appropriate. 

6. 
Not  later  than  three  years  from  the  date  of  entry  into  force  of  this  Agreement,  the 
European  Commission  and  the  U.S.  Treasury  Department  shall  prepare  a  joint  report 
regarding  the  value  of  TFTP  Provided  Data,  with  particular  emphasis  on  the  value  of  data 
retained for multiple years and relevant information obtained from the joint review conducted 
pursuant to Article 13. The Parties shall jointly determine the modalities of this report. 

7. 
Information extracted from Provided Data, including information shared under Article 
7, shall be retained for no longer than necessary for specific investigations or prosecutions for 
which they are used. 

ARTICLE 7 

Onward Transfer 

Onward transfer of information extracted from the Provided Data shall be limited pursuant to 
the following safeguards: 

Only information extracted as a result of an individualized search as described in this 

(a) 
Agreement, in particular Article 5, shall be shared; 

(b) 
Such  information  shall  be  shared  only  with  law  enforcement,  public  security,  or 
counter terrorism authorities in the United States, Member States, or third countries, or with 
Europol  or  Eurojust,  or  other  appropriate  international  bodies,  within  the  remit  of  their 
respective mandates; 

Such information shall be shared for lead purposes only and for the exclusive purpose 

(c) 
of the investigation, detection, prevention, or prosecution of terrorism or its financing; 

(d)  Where the U.S. Treasury Department is aware that such information involves a citizen 
or resident of a Member State, any sharing of the information with the authorities of a third 
country  shall  be  subject  to  the  prior  consent  of  competent  authorities  of  the  concerned 
Member State or pursuant to existing protocols on such information sharing between the U.S. 

EN 

13 

   EN 

 
Treasury Department and that Member State, except where the sharing of the data is essential 
for  the  prevention  of  an  immediate  and  serious  threat  to  public  security  of  a  Party  to  this 
Agreement, a Member State, or a third country. In the latter case the competent authorities of 
the concerned Member State shall be informed of the matter at the earliest opportunity; 

In  sharing  such  information,  the  U.S.  Treasury  Department  shall  request  that  the 
(e) 
information shall be deleted by the recipient authority as soon as it is no longer necessary for 
the purpose for which it was shared; and 

(f) 

Each onward transfer shall be duly logged. 

ARTICLE 8 

Adequacy 

Subject to ongoing compliance with the commitments on privacy and protection of personal 
data set out in this Agreement, the U.S. Treasury Department is deemed to ensure an adequate 
level  of  data  protection  for  the  processing  of  financial  payment  messaging  and  related  data 
transferred from the European Union to the United States for purposes of this Agreement. 

ARTICLE 9 

Spontaneous Provision of Information 

1. 
The U.S. Treasury Department shall ensure the availability, as soon as practicable and 
in  the  most  expedient  manner,  to  law  enforcement,  public  security,  or  counter  terrorism 
authorities of concerned Member States, and, as appropriate, to Europol and Eurojust, within 
the  remit  of  their  respective  mandates,  of  information  obtained  through  the  TFTP  that  may 
contribute to the investigation, prevention, detection, or prosecution by the European Union of 
terrorism or its financing. Any follow-on information that may contribute to the investigation, 
prevention, detection, or prosecution by the United States of terrorism or its financing shall be 
conveyed back to the United States on a reciprocal basis and in a reciprocal manner. 

2. 
In  order  to  facilitate  the  efficient  exchange  of  information,  Europol  may  designate  a 
liaison officer to the U.S. Treasury Department. The modalities of the liaison officer's status 
and tasks shall be decided jointly by the Parties. 

ARTICLE 10 

EU Requests for TFTP Searches 

Where a law enforcement, public security, or counter terrorism authority of a Member State, 
or Europol or Eurojust, determines that there is reason to believe that a person or entity has a 
nexus  to  terrorism  or  its  financing  as  defined  in  Articles  1  to  4  of  Council  Framework 
Decision  2002/475/JHA,  as  amended  by  Council  Framework  Decision  2008/919/JHA  and 
Directive 2005/60/EC, such authority may request a search for relevant information obtained 
through  the  TFTP.  The  U.S.  Treasury  Department  shall  promptly  conduct  a  search  in 
accordance with Article 5 and provide relevant information in response to such requests. 

ARTICLE 11 

Cooperation with Future Equivalent EU System 

During the course of this Agreement, the European Commission will carry out a study 
1. 
into  the  possible  introduction  of  an  equivalent  EU  system  allowing  for  a  more  targeted 
transfer of data.  

EN 

14 

   EN 

 
2. 
If,  following  this  study,  the  European  Union  decides  to  establish  an  EU  system,  the 
United States shall cooperate and provide assistance and advice to contribute to the effective 
establishment of such a system. 

3. 
Since the establishment of an EU system could substantially change the context of this 
Agreement,  if  the  European  Union  decides  to  establish  such  a  system,  the  Parties  should 
consult to determine whether the Agreement would need to be adjusted accordingly. In that 
regard,  U.S.  and  EU  authorities  shall  cooperate  to  ensure  the  complementariness  and 
efficiencies  of  the  U.S.  and  EU  systems  in  a  manner  that  further  enhances  the  security  of 
citizens  of  the  United  States,  the  European  Union,  and  elsewhere.  In  the  spirit  of  this 
cooperation,  the  Parties  shall  actively  pursue,  on  the  basis  of  reciprocity  and  appropriate 
safeguards, the cooperation of any relevant international financial payment messaging service 
providers  which  are  based  in  their  respective  territories  for  the  purposes  of  ensuring  the 
continued and effective viability of the U.S. and EU systems. 

ARTICLE 12 

Monitoring of Safeguards and Controls 

1. 
Compliance  with  the  strict  counter  terrorism  purpose  limitation  and  the  other 
safeguards  set  out  in  Articles  5  and  6  shall  be  subject  to  independent  monitoring  and 
oversight.  Such  oversight,  subject  to  appropriate  security  clearances,  shall  include  the 
authority to review in real time and retrospectively all  searches made  of  the Provided  Data, 
the authority to query such searches and, as appropriate, to request additional justification of 
the terrorism nexus. In particular, independent overseers shall have the authority to block any 
or all searches if it appears that one or more searches have been made in breach of Article 5.  

The  independent  oversight  shall  also  include  the  ongoing  monitoring  of  compliance 

2. 
with and reporting on all safeguards set out in Articles 5 and 6. 

3. 
The oversight described in paragraphs 1 and 2 shall be subject to ongoing monitoring, 
including  of  the  independence  of  the  oversight  described  in  paragraphs  1  and  2,  by  an 
independent  person  appointed  by  the  European  Commission,  with  the  modalities  of  the 
monitoring  to  be  jointly  coordinated  by  the  Parties.  The  Inspector  General  of  the  U.S. 
Treasury Department will ensure that the independent oversight described in paragraphs 1 and 
2 is undertaken pursuant to applicable audit standards. 

ARTICLE 13 

Joint Review 

1. 
At the request of one of the Parties and at any event after a period of six (6) months 
from  the  entry  into  force  of  this  Agreement,  the  Parties  shall  jointly  review  the  safeguards, 
controls and reciprocity provisions set out in this Agreement. The review shall be conducted 
thereafter on a regular basis, with additional reviews scheduled as necessary. 

The  review  shall  have  particular  regard  to  (a)  the  number  of  financial  payment 
2. 
messages  accessed,  (b)  the  number  of  occasions  on  which  leads  have  been  shared  with 
Member  States,  third  countries,  and  Europol  and  Eurojust,  (c)  the  implementation  and 
effectiveness of the Agreement, including the suitability of the mechanism for the transfer of 
information,  (d)  cases  in  which  the  information  has  been  used  for  the  prevention, 
investigation, detection, or prosecution of terrorism or its financing, and (e) compliance with 
data  protection  obligations  specified  in  this  Agreement.  The  review  shall  include  a 
representative  and  random  sample  of  searches  in  order  to  verify  compliance  with  the 
safeguards and controls set out in this Agreement, as well as a proportionality assessment of 
the Provided Data, based on the value of such data for the investigation, prevention, detection, 

EN 

15 

   EN 

 
or prosecution of terrorism or its financing. Following the review, the European Commission 
will  present  a  report  to  the  European  Parliament  and  the  Council  on  the  functioning  of  the 
Agreement, including the areas mentioned above. 

3. 
For purposes of the review, the European Union shall be represented by the European 
Commission,  and  the  United  States  shall  be  represented  by  the  U.S.  Treasury  Department. 
Each Party may include in its delegation for the review experts in security and data protection, 
as  well  as  a  person  with  judicial  experience.  The  European  Union  review  delegation  shall 
include representatives of two data protection authorities, at least one of which shall be from a 
Member State where a Designated Provider is based. 

4. 
For  purposes  of  the  review,  the  U.S.  Treasury  Department  shall  ensure  access  to 
relevant  documentation,  systems,  and  personnel.  The  Parties  shall  jointly  determine  the 
modalities of the review. 

ARTICLE 14 

Transparency – Providing Information to the Data Subjects 

The  U.S.  Treasury  Department  shall  post  on  its  public  website  detailed  information 
concerning  the  TFTP  and  its  purposes,  including  contact  information  for  persons  with 
questions. In addition it shall post information about the procedures available for the exercise 
of the rights described in Articles 15 and 16, including the availability of administrative and 
judicial redress as appropriate in the United States regarding the processing of personal data 
received pursuant to this Agreement. 

ARTICLE 15 

Right of Access 

1. 
Any  person  has  the  right  to  obtain,  following  requests  made  at  reasonable  intervals, 
without constraint and without excessive delay, at least a confirmation transmitted through his 
or  her  data  protection  authority  in  the  European  Union  as  to  whether  that  person's  data 
protection rights have been respected in compliance with this Agreement, after all necessary 
verifications  have  taken  place,  and,  in  particular,  whether  any  processing  of  that  person's 
personal data has taken place in breach of this Agreement. 

2. 
Disclosure to a person of his or her personal data processed under this Agreement may 
be  subject  to  reasonable  legal  limitations  applicable  under  national  law  to  safeguard  the 
prevention, detection, investigation, or prosecution of criminal offences, and to protect public 
or national security, with due regard for the legitimate interest of the person concerned. 

3. 
Pursuant to paragraph 1, a person shall send a request to his or her European national 
supervisory  authority,  which  shall  transmit  the  request  to  the  Privacy  Officer  of  the  U.S. 
Treasury Department, who shall make all necessary verifications pursuant to the request. The 
Privacy  Officer  of  the  U.S.  Treasury  Department  shall  without  undue  delay  inform  the 
relevant European national supervisory authority whether personal data may be disclosed to 
the  data  subject  and  whether  the  data  subject's  rights  have  been  duly  respected.  In  the  case 
that  access  to  personal  data  is  refused  or  restricted  pursuant  to  the  limitations  referred  to  in 
paragraph 2, such refusal or restriction shall be explained in writing and provide information 
on the means available for seeking administrative and judicial redress in the United States. 

ARTICLE 16 

Right to Rectification, Erasure, or Blocking 

EN 

16 

   EN 

 
1. 
Any  person  has  the  right  to  seek  the  rectification,  erasure,  or  blocking  of  his  or  her 
personal data processed by the U.S. Treasury Department pursuant to this Agreement where 
the data are inaccurate or the processing contravenes this Agreement. 

2. 
Any  person  exercising  the  right  expressed  above  shall  send  a  request  to  his  or  her 
relevant  European  national  supervisory  authority,  which  shall  transmit  the  request  to  the 
Privacy Officer of the U.S. Treasury Department. Any request to obtain rectification, erasure, 
or blocking shall be duly substantiated. The Privacy Officer of the U.S. Treasury Department 
shall make all necessary verifications pursuant to the request and shall without undue delay 
inform the relevant European national supervisory authority whether personal data have been 
rectified, erased, or blocked, and whether the data subject's rights have been duly respected. 
Such  notification  shall  be  explained  in  writing  and  provide  information  on  the  means 
available for seeking administrative and judicial redress in the United States. 

ARTICLE 17 

Maintaining the Accuracy of Information 

1. 
Where  a  Party  becomes  aware  that  data  received  or  transmitted  pursuant  to  this 
Agreement are not accurate, it shall take all appropriate measures to prevent and discontinue 
erroneous reliance on such data, which may include supplementation, deletion, or correction 
of such data. 

2. 
Each  Party  shall,  where  feasible,  notify  the  other  if  it  becomes  aware  that  material 
information  it  has  transmitted  to  or  received  from  the  other  Party  under  this  Agreement  is 
inaccurate or unreliable. 

ARTICLE 18 

Redress 

The Parties shall take all reasonable steps to ensure that the U.S. Treasury Department 
1. 
and  any  relevant  Member  State  promptly  inform  one  another,  and  consult  with  one  another 
and the Parties, if necessary, where they consider that personal data have been processed in 
breach of this Agreement. 

2. 
Any person who considers his or her personal data to have been processed in breach of 
this Agreement is entitled to seek effective administrative and judicial redress in accordance 
with the laws of the European Union, its Member States, and the United States, respectively. 
For  this  purpose  and  as  regards  data  transferred  to  the  United  States  pursuant  to  this 
Agreement, the U.S. Treasury Department shall treat all persons equally in the application of 
its  administrative  process,  regardless  of  nationality  or  country  of  residence.  All  persons, 
regardless of nationality or country of residence, shall have available under U.S. law a process 
for seeking judicial redress from an adverse administrative action. 

ARTICLE 19 

Consultation 

1. 
The Parties shall, as appropriate, consult each other to enable the most effective use to 
be made of this Agreement, including to facilitate the resolution of any dispute regarding the 
interpretation or application of this Agreement. 

2. 
The  Parties  shall  take  measures  to  avoid  the  imposition  of  extraordinary  burdens  on 
one another through application of this Agreement. Where extraordinary burdens nonetheless 
result, the Parties shall immediately consult with a view to facilitating the application of this 
Agreement, including the taking of such measures as may be required to reduce pending and 
future burdens. 

EN 

17 

   EN 

 
3. 
The  Parties  shall  immediately  consult  in  the  event  that  any  third  party,  including  an 
authority of another country, challenges or asserts a legal claim with respect to any aspect of 
the effect or implementation of this Agreement. 

ARTICLE 20 

Implementation and Non-derogation 

1. 
This Agreement shall not create or confer any right or benefit on any person or entity, 
private or public. Each Party shall ensure that the provisions of this Agreement are properly 
implemented.  

2. 
Nothing  in  this  Agreement  shall  derogate  from  existing  obligations  of  the  United 
States  and  Member  States  under  the  Agreement  on  Mutual  Legal  Assistance  between  the 
European Union and the United States of America of 25 June 2003 and the related bilateral 
mutual legal assistance instruments between the United States and Member States. 

ARTICLE 21 

Suspension or Termination 

1. 
Either Party may suspend the application of this Agreement with immediate effect, in 
the  event  of  breach  of  the  other  Party’s  obligations  under  this  Agreement,  by  notification 
through diplomatic channels. 

2. 
Either  Party  may  terminate  this  Agreement  at  any  time  by  notification  through 
diplomatic channels. Termination shall take effect six (6) months from the date of receipt of 
such notification. 

The Parties shall consult prior to any possible suspension or termination in a manner 

3. 
which allows a sufficient time for reaching a mutually agreeable resolution. 

Notwithstanding any suspension or termination of this Agreement, all data obtained by 
4. 
the  U.S.  Treasury  Department  under  the  terms  of  this  Agreement  shall  continue  to  be 
processed  in  accordance  with  the  safeguards  of  this Agreement,  including  the  provisions  on 
deletion of data. 

ARTICLE 22 

Territorial Application 

Subject to paragraphs 2 to 4 of this Article, this Agreement shall apply to the territory 
1. 
in which the Treaty on European Union and the Treaty on the Functioning of the European 
Union are applicable and to the territory of the United States. 

The  Agreement  will  only  apply  to  Denmark,  the  United  Kingdom,  or  Ireland  if  the 
2. 
European  Commission  notifies  the  United  States  in  writing  that  Denmark,  the  United 
Kingdom, or Ireland has chosen to be bound by the Agreement.  

If the European Commission notifies the United States before the entry into force of 
3. 
the Agreement that it will apply to Denmark, the United Kingdom, or Ireland, the Agreement 
shall apply to the territory of such State on the same day as for the other EU Member States 
bound by this Agreement. 

4. 
If the European Commission notifies the United States after the entry into force of the 
Agreement that it applies to Denmark, the United Kingdom, or Ireland, the Agreement shall 
apply  to  the  territory  of  such  State  on  the  first  day  of  the  month  following  receipt  of  the 
notification by the United States.  

EN 

ARTICLE 23  

18 

   EN 

 
Final Provisions 

1. 
This Agreement shall enter into force on the first day of the month after the date on 
which  the  Parties  have  exchanged  notifications  indicating  that  they  have  completed  their 
internal procedures for this purpose. 

2. 
Subject to Article 21 paragraph 2, this Agreement shall remain in force for a period of 
five  (5)  years  from  the  date  of  its  entry  into  force  and  shall  automatically  extend  for 
subsequent  periods  of  one  (1)  year  unless  one  of  the  Parties  notifies  the  other  in  writing 
through diplomatic channels, at least six (6) months in advance of its intention not to extend 
this Agreement. 

Done  at  ……  this  day  ……  of  ……  2010,  in  two  originals,  in  the  English  language.  This 
Agreement shall also be drawn up in the Bulgarian, Czech, Danish, Dutch, Estonian, Finnish, 
French, German, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, 
Romanian,  Slovak,  Slovenian,  Spanish,  and  Swedish  languages.  Upon  approval  by  both 
Parties, these language versions shall be considered equally authentic. 

EN 

19 

   EN 

 
ANNEX 

Society for Worldwide Interbank Financial Telecommunication (SWIFT) 

EN 

20 

   EN