REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program
Date: 2017-01-19
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: United States, agreement (EU), bilateral agreement, disclosure of information, exchange of information, financial services, financing, terrorism

EUROPEAN 
COMMISSION 

Brussels, 19.1.2017  
COM(2017) 31 final 

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND 
THE COUNCIL 

On the joint review of the implementation of the Agreement between the European 
Union and the United States of America on the processing and transfer of Financial 
Messaging Data from the European Union to the United States for the purposes of the 
Terrorist Finance Tracking Program 

{SWD(2017) 17 final} 

EN 

   EN 

 
 
 
 
  
 
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND 
THE COUNCIL 

On the joint review of the implementation of the Agreement between the European 
Union and the United States of America on the processing and transfer of Financial 
Messaging Data from the European Union to the United States for the purposes of the 
Terrorist Finance Tracking Program 

On  1  August  2010,  the  Agreement  between  the  European  Union  and  the  United  States  of 
America  on  the  processing  and  transfer  of  Financial  Messaging  Data  from  the  European 
Union  to  the  United  States  for  the  purposes  of  the  Terrorist  Finance  Tracking  Program 
('TFTP') entered into force1. 

Procedural aspects 

Article 13 of the Agreement provides for regular joint reviews of the safeguards, controls, and 
reciprocity  provisions  to  be  conducted  by  review  teams  from  the  European  Union  and  the 
United  States,  including  the  European  Commission,  the  U.S.  Treasury  Department,  and 
representatives  of  two  data  protection  authorities  from  EU  Member  States,  and  may  also 
include security and data protection experts and persons with judicial experience.   

This report concerns the fourth joint review of the Agreement since it entered into force and 
covers a period of 22 months between 1 March 2014 and 31 December 2015. The first joint 
review  of  the  Agreement  conducted  in  February  20112  covered  the  period  of  the  first  six 
months after the entry into force of the Agreement (1 August 2010 until 31 January 2011) and 
the second joint review conducted in October 20123 covered the subsequent period of twenty 
months (1 February 2011 until 30 September 2012). The third joint review conducted in April 
2014 covered a period of seventeen months (1 October 2012 until 28 February 2014).4 On 27 
November 2013, the Commission adopted the Communication on the Joint Report from the 
Commission and the U.S. Treasury Department regarding the value of TFTP Provided Data 
pursuant to Article 6 (6) of the Agreement5. 

In  line  with  Article  13  (3),  for  the  purposes  of  the  review,  the  European  Union  was 
represented by the European Commission, and the United States was represented by the U.S. 
Treasury Department. The EU review team was headed by a senior Commission official and 
in  total  consisted  of  two  members  of  Commission  staff,  representatives  from  two  data 
protection authorities, and one judicial expert from Eurojust.  

1 OJ L 195/5 of 27.7. 2010 
2 SEC(2011) 438 final 
3 SWD(2012) 454 final 
4 COM (2014) 513 final and SWD (2014) 264 final of 11.8.2014 
5 COM (2013) 843 final of 27.11.2013 

2 

 
 
                                                            
The fourth joint review was carried out in two main stages: on 1 March 2016 in The Hague at 
Europol's  premises  and  on  15  and  16  March  2016  in  Washington  at  the  U.S.  Treasury 
Department (hereinafter “the Treasury”).  

This  report  is  based  on  the  information  contained  in  the  written  replies  that  the  Treasury 
provided  to  the  EU  questionnaire  sent  prior  to  the  review,  information  obtained  from  the 
discussions  with  Treasury  personnel  as  well  as  information  contained  in  other  publicly 
available Treasury documents. In addition, information provided by Europol staff during the 
review  was  used  and  the  inspection  report  of  Europol's  Joint  Supervisory  Body  (JSB)  from 
September 2015 was considered. To complete the information available, the Commission also 
met and received information from the Designated Provider. 

Recommendations and conclusion 

On  the  basis  of  the  information  and  explanations  received  from  the  Treasury,  Europol,  the 
Designated Provider and the independent overseers, verification of relevant documents and of 
a  representative  sample  of  the  searches  run  on  the  TFTP  provided  data,  the  Commission  is 
satisfied  that  the  Agreement  and  its  safeguards  and  controls  are  properly  implemented  and 
that the findings of the third joint review have been followed up by the Treasury. In particular, 
the  Commission  is  satisfied  with  the  outcome  of  the  discussions  on  the  interpretation  of 
Article 15 concerning the right of access and the manner in which the Treasury continues to 
assess the necessity of retaining extracted data in the sense of Article 6 (7) of the Agreement. 

Europol is accomplishing its verification tasks in full compliance with Article 4 on the basis 
of detailed and regularly updated supporting documentation received from the Treasury. The 
oversight mechanism is functioning smoothly and is effective in ensuring that the processing 
of data complies with the conditions laid down in Article 5. All non-extracted data is deleted 
on a semi-annual basis in order to ensure that all such data is deleted at the latest five years 
from receipt, in accordance with Article 6(4) of the Agreement. Treasury's regular evaluation 
of  the  extracted  data  includes  an  assessment  of  the  data  retention  periods.  The  relevant 
information  about  the  process  of  rectification  of  data  has  been  included  on  the  Treasury's 
website. 

In  terms  of  potential  for  further  improvement,  the  Commission  suggests  that  the  Member 
States  consider  providing  regular  feedback  on  the  TFTP  data  received  from  the  Treasury 
which  could  further  improve  the  quality  and  the  quantity  of  information  exchanged  under 
Articles 9 and 10. The Commission also encourages Europol to continue its efforts to actively 
promote  awareness  of  the  TFTP  and  to  support  Member  States  seeking  its  advice  and 
experience in devising Article 10 requests. It is important that Europol continues fulfilling its 
verification role under Article 4 as thoroughly and independently as at present.  

In the context of the review, the Treasury confirmed in writing the validity of the assurances 
given  during  the  2013  consultations.  It  stated  that  since  the  TFTP  Agreement  entered  into 
force  in  August  2010,  the  U.S.  Government  –  including  all  departments  and  agencies  –  has 
not  collected  financial  payment  messages  from  the  Designated  Provider  in  the  European 
Union,  except  as  authorized  by  the  TFTP  Agreement.  The  Treasury  also  stated  that,  during 

3 

 
that time, the U.S. Government has not served any subpoenas on the Designated Provider in 
the EU or on the Designated Provider in the United States requesting the production of data 
stored in the EU, except as authorized by Article 4 of the TFTP Agreement. The Treasury also 
confirmed that the United States has remained and intends to remain in full compliance with 
all of its commitments under the TFTP Agreement. 

The  TFTP  remains  an  important  instrument  to  provide  timely,  accurate  and  reliable 
information about activities associated with suspected acts of terrorist planning and financing. 
It helps to identify and track terrorists and their support networks worldwide.  

The  Commission  welcomes  the  continued  increased  transparency  of  the  U.S.  authorities  in 
sharing  information  illustrating  the  value  of  the  TFTP  in  international  counter-terrorism 
efforts.  The  detailed  information  about  how  the  TFTP  Provided  Data  can  and  is  being  used 
and concrete cases thereof provided in the Joint Value Report and in the context of this review 
constitute  a  considerable  step  forward  in  further  explaining  the  functioning  and  the  added 
value of the TFTP. 

In the period under review, the EU has been able to benefit more from the TFTP than during 
the periods considered in previous reviews. In some cases, the information provided under the 
Agreement  has  been  instrumental  in  bringing  forward  specific  investigations  relating  to 
terrorist attacks on EU soil. The U.S. authorities have extensively made use of the possibility 
under Article 9 of the Agreement to spontaneously provide information from the TFTP to EU 
authorities. In addition, Europol has proactively initiated a series of requests under Article 10 
of  the  Agreement  in  the  period  under  review.  This  has  helped  raise  awareness  of  the  TFTP 
among EU authorities, resulting in an increased use of the TFTP by those authorities.   

A regular review of the Agreement is essential to ensure its proper implementation, to build 
up  a  relationship  of  trust  between  the  contracting  parties  and  to  provide  reassurances  to 
interested stakeholders on the usefulness of the TFTP instrument. It has been agreed between 
the Commission and the Treasury to carry out the next joint review according to Article 13 of 
the Agreement at the beginning of 2018. 

The  functioning  of 
its  outcome  and 
recommendations  are  described  in  detail  in  the  Staff  Working  Document  attached  to  this 
Report.  

joint  review  process, 

the  Agreement, 

the 

4