COMMISSION STAFF WORKING DOCUMENT FRAUD RISK ASSESSMENT Accompanying the document COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS Commission Anti-Fraud Strategy: enhanced action to protect the EU budget
Date: 2019-04-29
Institutions: European Anti-Fraud Office, European Commission
Subjects: EU control, EU strategy, administrative check, administrative cooperation, exchange of information, financial control, fraud, fraud against the EU, general budget (EU)

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 29.4.2019  SWD(2019) 171 final  COMMISSION STAFF WORKING DOCUMENT FRAUD RISK ASSESSMENT Accompanying the document COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS Commission Anti-Fraud Strategy: enhanced action to protect the EU budget {COM(2019) 196 final} - {SWD(2019) 170 final}  
 
 
COMMISSION STAFF WORKING DOCUMENT 

FRAUD RISK ASSESSMENT 

Accompanying the document 

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL 
COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF 
AUDITORS 

Commission Anti-Fraud Strategy: enhanced action to protect the EU budget 

TABLE OF CONTENTS 

Key abbreviations................................................................................................................................ 3 

1. 

2. 

3. 

4. 

Introduction .......................................................................................................................... 5 

Scope and methods ............................................................................................................... 6 

Focus and structure ............................................................................................................. 8 

Detected fraud and fraud patterns in EU spending ........................................................ 10 

4.1. 

4.2. 

Detected fraud ....................................................................................................... 10 

Fraud patterns ....................................................................................................... 10 

4.2.1.   Overview ................................................................................................................ 10 

4.2.2.  External fraud ....................................................................................................... 11 

4.2.3. 

Internal fraud ........................................................................................................ 12 

4.2.4.  Fraud trends .......................................................................................................... 14 

5. 

Fraud vulnerabilities ......................................................................................................... 15 

5.1. 

5.2. 

Data collection and analysis ................................................................................. 15 

Coordination, cooperation and processes ........................................................... 18 

5.2.1.  Coordination of fraud risk management ............................................................ 18 

5.2.2.  Cooperation with other EU bodies and with Member States ........................... 19 

5.2.3.  Cooperation and flow of information between OLAF and Commission 

services/executive agencies and other EU bodies ............................................... 21 

5.2.4. 

 Procurement under shared management .......................................................... 21 

5.2.5.  Procurement and grants in direct management ................................................. 23 

5.2.6.  Financial instruments and budgetary guarantees .............................................. 24 

5.2.7.  External aid ........................................................................................................... 26 

5.2.8.  Cybersecurity ........................................................................................................ 28 

5.3. 

Integrity and compliance ...................................................................................... 29 

5.4.  Know-how and equipment ................................................................................... 31 

1 

 
 
 
 
5.5. 

5.6. 

Transparency......................................................................................................... 32 

Legal framework ................................................................................................... 33 

6. 

Revenue fraud .................................................................................................................... 35 

6.1. 

6.2. 

Traditional own resources (TOR) ....................................................................... 35 

Value added tax (VAT) ......................................................................................... 37 

2 

 
 
 
 
Key abbreviations 

Abbreviations 

Meaning 

AOD 

APC 

CAFS 

Authorising Officer by Delegation 

Audit Progress Committee 

Commission Anti-Fraud Strategy 

COCOLAF 

Advisory Committee for the Coordination of Fraud Prevention 

DG 

DG BUDG 

DG TAXUD 

Directorate-General 

Directorate-General for Budget 

Directorate-General for Taxation and Customs Union 

ECA 

EDES 

EIB 

EIF 

EPPO 

EU 

Eurojust 

Europol 

FDR 

FN 

FR 

IAS 

IDOC 

IMS 

European Court of Auditors 

Early Detection and Exclusion System 

European Investment Bank 

European Investment Fund 

European Public Prosecutor’s Office 

European Union 

EU Agency for Criminal Justice Cooperation 

EU Agency for Law Enforcement Cooperation 

Fraud detection rate 

Footnote 

Financial Regulation1 

Internal Audit Service 

Investigation and Disciplinary Office of the Commission 

Irregularity Management System 

1   Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the 
financial  rules  applicable  to  the  general  budget  of  the  Union,  amending  Regulations  (EU)  No  1296/2013, 
(EU)  No  1301/2013,  (EU)  No  1303/2013,  (EU)  No  1304/2013,  (EU)  No  1309/2013,  (EU)  No  1316/2013, 
(EU)  No  223/2014,  (EU)  No  283/2014,  and  Decision  No  541/2014/EU  and  repealing  Regulation  (EU, 
Euratom) No 966/2012, OJ L 193, 30.7.2018, p. 1. 

3 

 
 
 
                                                           
MAA 

MFF 

OLAF 

Mutual Administrative Assistance 

Multiannual Financial Framework 

European Anti-Fraud Office 

OLAF Regulation 

Regulation (EU, Euratom) No 883/20132 

PIF3 

PIF Directive 

PIF Report 

SOCTA 

TFEU 

TOR 

VAT 

WHO 

Protection of the EU’s financial interests 

Directive (EU) 2017/13714 

The Commission’s annual report to the European Parliament 
and to the Council on the protection of the European Union’s 
financial interests — Fight against fraud, provided for in 
Article 325(5) TFEU 

Serious and Organised Crime Threat Assessment 

Treaty on the Functioning of the European Union 

Traditional own resources 

Value added tax 

World Health Organisation 

2   Regulation  (EU,  Euratom)  No  883/2013  of  the  European  Parliament  and  of  the  Council  of  11 September 
2013  concerning  investigations  conducted  by  the  European  Anti-Fraud  Office  (OLAF)  and  repealing 
Regulation  (EC)  No  1073/1999  of  the  European  Parliament  and  of  the  Council  and  Council  Regulation 
(Euratom) No 1074/1999, OJ L 248, 18.9.2013, p. 1, as amended. 

3   French acronym for "protection des intérêts financiers de l'Union européenne". 
4   Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against 

fraud to the Union’s financial interests by means of criminal law, OJ L 198, 28.7.2017, p. 29. 

4 

 
 
 
 
 
                                                           
1. 

Introduction 

On 24 June 2011, the Commission adopted its current anti-fraud strategy. This comprised two 
documents:  (i) a  Communication  from  the  Commission5  to  the  other  EU  institutions, 
describing  strategic  objectives  and  key  operational  steps  to  attain  them;  and  (ii) a  more 
detailed Commission-internal Action Plan6.  

Taking  into  account  developments  in  the  (anti-)fraud  landscape  and  in  the  design  of  EU 
policies, the Commission has reviewed its anti-fraud strategy to prepare for the Multiannual 
Financial Framework (MFF) 2021 – 2027. The Commission services have carried out a fraud 
risk  assessment  for  that  purpose,  involving  also  the  executive  agencies.  The  results  are 
presented  in  this  staff  working  document,  which  accompanies  the  Communication 
‘Commission Anti-Fraud Strategy: enhanced action to protect the EU budget’7.  

The two main vulnerabilities identified in the fraud risk assessment are: (i) an underdeveloped 
central analytical capacity and (ii) certain gaps in the Commission’s supervision of fraud risk 
management  at  department  level.  The  priority  objectives  of  the  review,  explained  in  the 
Communication, are therefore to equip the Commission with a stronger analytical capability 
and a more  centralised system of oversight  for the anti-fraud  action of its departments.  The 
other  key  objectives,  also  based  on  the  fraud  risk  assessment  and  on  the  guiding  principles 
and  standards  of  the  2019  Commission  Anti-Fraud  Strategy  (‘the  2019  CAFS’)8,  are  to 
maintain  the  highest  standards  of  professional  ethics  and  competence,  to  optimise  the  legal 
framework  for  and  transparency  of  EU  funding  and  to  improve  the  fight  against  revenue 
fraud. 

The  Commission  has  prepared  an  action  plan  in  the  form  of  a  staff  working  document9  to 
achieve  the  objectives  and  rectify  the  weaknesses  identified  by  the  fraud  risk  assessment. 
Another (separate) staff working document presents an evaluation of the 2011 CAFS10. 

5  Communication from the Commission to the European Parliament, the Council, the European Economic and 
Social Committee, and the Committee of the Regions and the Court of Auditors of 24 September 2011 on the 
Commission Anti-Fraud Strategy, COM(2011) 376 final. 

6  Communication  to  the  Commission,  Commission  Internal  Action  Plan  for  the  Implementation  of  the 

Commission Anti-Fraud Strategy, SEC(2011) 787/3. 

7  COM(2019) 196. 
8 
See Section 4.1. of the Communication (reference in FN 7).  
9 
SWD(2019) 170. 
10  SWD(2019) 500. 

5 

 
 
 
 
                                                           
2. 

Scope and methods 

In  2017,  the  Commission  adopted  a  Communication  on  a  revised  Internal  Control 
Framework11.  This  includes  risk  assessment  as  one  of  its  five  main  components  (alongside 
information/communication  and  monitoring 
control  environment,  control  activities, 
activities). 

As  part  of  the  risk  assessment  component,  Principle  8  of  the  Internal  Control  Framework 
requires  that  ‘The  Commission  considers  the  potential  for  fraud  in  assessing  risks  to  the 
achievement  of objectives’.  In that context,  fraud is  characterised  as a broad concept  which 
includes ‘notably fraudulent reporting, loss of assets, disclosure of sensitive information and 
corruption.’ 

The scope of the 2019 CAFS strikes a balance between the nonspecific concept of fraud in the 
Internal Control Framework and a narrow understanding of fraud as a criminal offence. More 
broadly,  the  2019  CAFS  focuses  on  protecting  the  EU’s  financial  interests  from  fraud, 
corruption and other intentional irregularities and from the risk of serious wrongdoing inside 
the  EU’s  institutions  and  bodies.  These  areas  are  also  central  to  the  legislator  in  the  fight 
against fraud.12 As a result, the 2019 CAFS covers: 

o  fraud  –  including  VAT  fraud  –,  corruption  and  misappropriation  affecting  the  EU’s 

financial interests, as defined in Articles 3 and 4 of the ‘PIF Directive’13; 

o  other criminal offences  affecting the EU’s financial interests, e.g., offences linked to 

o 

an abuse of procurement procedures where they affect the EU budget; 
irregularities  as  defined  in  Article 1(2)  of  Regulation  (EC,  Euratom)  No  2988/9514 
(insofar  as  they  are  intentional15  but  not  already  captured  by  the  criminal  offences 
referred to above); and 

o  serious  breaches  of  professional  obligations  by  Members  or  staff  of  the  EU’s 
institutions  and bodies, as referred to  in  Article 1(4) of the OLAF Regulation  and in 
the  second  subparagraph  of  Article 2(1)  of  Commission  Decision  (EC,  ECSC, 
Euratom) No 352/199916. 

Other  non-financial  types  of  fraud  affecting  EU  interests  in  specific  policies  such  as 
intellectual  property  or  food  safety  are  of  a  less  cross-cutting  nature.  Coordinating  the 
Commission’s fight against such types of fraud is therefore not prioritised in the 2019 CAFS, 
which focuses on preparing for the MFF post-2020. 

To prepare for the CAFS review, all Commission services and executive agencies were asked 
to  update  their  own  service-level  fraud  risk  assessments  to  feed  into  a  corporate  fraud  risk 

11  Communication to the Commission from Commissioner Oettinger of 19 April 2017, Revision of the Internal 

Control Framework, C (2017) 2373 final. 

12   See Article 1, paragraphs 1 and 4, of the OLAF Regulation (reference in FN 2).  
13  Reference in FN 4. 
14  Council  Regulation  (EC,  Euratom)  No  2988/95  of  18 December  1995  on  the  protection  of  the  European 

Communities’ financial interests, OJ L 312, 23.12.1995, p. 1. 

15   All  irregularities  are  included  in  the  scope  of  the  OLAF  Regulation,  but  the  2019  CAFS  focusses  on 

intentional wrongdoing. 

16  Commission Decision (EC, ECSC, Euratom) No 352/1999 of 28 April 1999 establishing the European Anti-

Fraud Office (OLAF), OJ L 136, 31.5.1999, p. 20, as amended. 

6 

 
 
                                                           
assessment.  As  the  lead  service  for  the  CAFS,  OLAF  facilitated  the  exercise  by  organising 
five workshops among services with a comparable profile. 

OLAF’s  methodological  guidance  for  service-level  anti-fraud  strategies  sets  out  minimum 
standards  for  fraud  risk  assessments  but  leaves  the  Commission  services  and  executive 
agencies  a  certain  margin  of  discretion,  in  accordance  with  the  decentralised  model  of 
financial  management,  which  —  pursuant  to  the  second  sentence  of  Article 74(2)  of  the 
Financial Regulation17 — assigns the responsibility for risk analysis to the authorising officers 
by  delegation  (AODs).  A  bottom-up  approach  has  been  taken  to  assess  fraud  risks  at 
Commission  level,  meaning that the departments’ point of view is  taken  into account  and a 
variety of methods are applied to risk assessment at department level depending on its specific 
characteristics. 

OLAF has compiled a qualitative fraud risk assessment for the Commission. This is based on 
the contributions received, a desk review of Commission reports, audit observations and other 
sources (such as the annual OLAF reports and Europol’s Serious and Organised Crime Threat 
Assessments).  This  assessment  is  qualitative  in  that  it  is  mainly  built  on  the  professional 
judgement  of  managers,  internal  control  coordinators,  operational  services,  financial  units, 
OLAF  investigators  and  OLAF  contact  points  in  the  Commission  services  and  executive 
agencies and supported in part by data from audit results, investigations and other sources. At 
present,  the  Commission  does  not  have  a  comprehensive  centralised  data  collection  and 
analysis  capacity  which  would  enable  it  to  develop  a  quantitative  fraud  risk  assessment. 
Therefore, the risk assessment does not  categorise the fraud risks in  order of likelihood and 
impact, as that could create a misleading impression of mathematical accuracy. 

The  qualitative  fraud  risk  assessment  presented  below  focuses  on  issues  that  affect  all 
Commission departments or that are particularly significant. More specific risks, on the other 
hand,  should  continue  to  be  reflected  in  the  services’  anti-fraud  strategies.  The  assessment 
does not give an exhaustive overview of policy-specific fraud risks as this would take away 
from the big picture. 

17  Reference in FN 1. 

7 

 
 
 
                                                           
3. 

Focus and structure 

The  fraud  risk  assessment  has  been  guided  by  the  questions  of  why  and  how  fraud  is 
committed. 

According  to  the  traditional  criminological  model  of  the  ‘Fraud  Triangle’18,  three  elements 
must  coincide  for  fraud  to  occur:  (i)  ‘pressure’  as  the  motivation;  (ii)  ‘rationalisation’  as  a 
self-justifying  attitude;  and  (iii)  perceived  ‘opportunity’.  The  traditional  Fraud  Triangle  has 
recently been developed into a slightly more complex ‘New Fraud Triangle’, 

The  New  Fraud  Triangle  further  differentiates  the  elements  of  pressure/motivation  and 
rationalisation/self-justification as follows. 

  Pressure  or  motivation  comprises  the  aspects  of  money,  ideology,  coercion  and  ego. 

For example: 

– 

ideological  motivation  is  that  which  considers  participation  in  a  fraud  act  as  a 
means to achieve some perceived greater good; 

–  coercion  occurs  when  individuals  may  be  unwillingly  pulled  into  a  fraud 

scheme, but those individuals can turn into whistle-blowers; 

–  ego  may  provide  a  motive  for  fraud  where  the  offence  serves  to  protect  the 

offender’s reputation or position of power. 

  Rationalisation  or  self-justification  reflects  the  potential  offender’s  personal  belief 
system  and  their  standards  of  personal  integrity.  From  a  practical  point  of  view, 
observing  a  person’s  commitment  to  ethical  decision-making  can  help  in  assessing 
integrity and thus an individual’s likelihood to commit fraud. 

The New Fraud Triangle also adds the fraudster’s capabilities to the equation19. 

18  W.  Steve  Albrecht,  Fraud  in  Government  Entities,  The  Perpetrators  and  the  Types  of  Fraud,  Government 
Finance Review Vol. 7 No 6, 1991, building on Donald R. Cressey, Other People’s Money:  A Study in the 
Social Psychology of Embezzlement, 1953, and others. 

19  R. Kassem / A.W. Higson, The New Fraud Triangle Model, Journal of Emerging Trends in Economics and 
Management  Sciences  Vol.  3  No 3,  2012,  building  on  David  T.  Wolfe  /  Dana  R.  Hermanson,  The  Fraud 
Diamond: Considering the Four Elements of Fraud, The CPA Journal Vol. 74 No 12, 2004, J. W. Dorminey / 
A.  S.  Fleming  /  M.-J.  Kranacher  /  R.  A.  Riley  Jr.,  The  Evolution  of  Fraud  Theory,  Issues  in  Accounting 
Education Vol. 27 No 2, 2012, and others. 

8 

 
 
 
 
 
 
                                                           
While  the  motivation  and  technical  capabilities  of  perpetrators  are  difficult  to  observe,  the 
above model suggests that any weaknesses of the Commission’s internal control system and 
any deficiencies in staff members’ integrity can increase fraud risks. The Commission’s fraud 
risk  assessment  therefore  focuses  on  potential  systemic  weaknesses.  As  deficiencies  in 
integrity  are  difficult  to  observe  directly  before  an  act  of  fraud  is  committed,  the  fraud  risk 
assessment looks at typical pitfalls and at the quality of systems in place to prevent them. 

The assessment below summarises vulnerabilities in seven categories: (i) data collection and 
analysis;  (ii)  coordination,  cooperation  and  processes;  (iii)  integrity  and  compliance; 
(iv) know-how and equipment; (v) transparency; (vi) legal framework; and (vii) revenue. The 
objectives set out in the Communication on the 2019 CAFS aim to mitigate the risks related to 
these categories. As the accompanying Action Plan refers to the objectives of the 2019 CAFS, 
it  indirectly  refers  to  the  risk  categories  outlined  in  the  Fraud  Risk  Assessment.  For  each 
action  point,  the  Action  Plan  indicates  which  objective  it  serves  and,  thus,  which  kind  of 
vulnerability that particular action is supposed to reduce. 

The assessment of vulnerabilities is complemented by key figures that show the dimension of 
detected fraud and an overview of generic fraud patterns as perceived by the Commission’s 
departments.  Knowledge  about  relevant  fraud  patterns  helps  us  analyse  how  fraudsters  may 
take  advantage  of  vulnerabilities  and  what  can  be  done  to  prevent  it.  'The  risk  assessment 
gives an overview of detected fraud and fraud patterns, which may take advantage of one or 
more than one of the vulnerabilities discussed, and then addresses each of the seven categories 
mentioned above. For revenue fraud, both fraud patterns and vulnerabilities are discussed in 
the last chapter of this staff working document. 

9 

 
 
 
 
4. 

Detected fraud and fraud patterns in EU spending 

4.1.  Detected fraud 
Based  on  the  Commission’s  accounting  system  and  the  Member  States’  reporting  on  fraud 
cases  in  shared  management,  in  2013–2017  the  overall  detected  fraud  in  EU  spending 
amounted to 0.27 % of total payments (fraud detection rate)20. 

The fraud detection rate (FDR) varies between spending areas. For the reference period 2013-
2017, the FDR in the overall area of ‘natural resources’ was 0.13 %, with a higher estimate 
for the subsection ‘rural development’ (0.25 %) than for ‘support to agriculture’ (0.09 %). In 
the  same  period  the  FDR  for  ‘direct  expenditure’  was  0.03 %.  Given  the  multiannual 
framework for spending  in  the ‘cohesion  and fisheries’  area, the relevant FDR is  calculated 
for  the  whole  programming  period.  For  2007-2013,  the  FDR  was  0.44 %.  With  the 
implementation still under way, there is insufficient data to provide a meaningful analysis for 
the 2014-2020 programming period. 

Fraud-related damage to the financial interests of the EU, which appears to be rather limited 
according to these figures, is not the only dimension of fraud. Internal fraud, i.e. misconduct 
by  EU  staff  or  Members  of  EU  institutions  with  potential  impact  on  the  institutions’ 
reputation is also an issue. For example, internal fraud was found in 12 OLAF investigations 
concluded in 2017 resulting in recommendations for follow-up across all EU institutions and 
bodies21 and in 24 cases concluded in 2017 with follow-up by the Commission’s Investigation 
and  Disciplinary  Office  (IDOC)2223.  However,  these  figures  must  be  taken  in  context.  They 
represent a very small proportion of the roughly 32 000 people working for the Commission24 
and approximately 50 000 working for all EU institutions and bodies. 

With the data and analytical tools currently available, the Commission is not in a position to 
provide a reliable estimate of undetected fraud. Out of roughly 1 000 examined transactions 
per  year,  the  European  Court  of  Auditors  found  suspected  fraud  in  11  cases  in  2016,  down 
from 27 in 201525. This indicates that although the proportion of fraud may be higher than in 
the above detection statistics, it remains limited. 

4.2. 

Fraud patterns 

4.2.1.   Overview 
Regarding fraud patterns, the suspected fraud found by the European Court of Auditors26 most 
frequently concerned: (i) the artificial creation of conditions to meet eligibility criteria; (ii) the 
non-delivery  of  goods/services;  (iii)  a  declaration  of  costs  that  does  not  meet  the  eligibility 
criteria;  (iv)  conflicts  of  interest;  and  (v)  other  procurement  irregularities.  According  to 

20   The fraud detection rate measures the financial impact of detected fraud as a proportion of total revenue or 

expenditure. It is determined for the budget as a whole and for particular sectors. 

21  OLAF Report 2017, p. 24: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2017_en.pdf 
22 

IDOC’s 2017 annual report p. 4 — IDOC’s annual reports are Commission-internal documents but are made 
available to members of the public on request. 

23  The sets of 12 OLAF and 24 IDOC cases may partially overlap where IDOC followed up on OLAF findings. 
24  https://ec.europa.eu/info/about-european-commission/organisational-structure/commission-staff_en 
25   European Court of Auditors, annual report on the implementation of the budget for the financial year 2016, 

together with the institutions’ replies, OJ C 322, 28.9.2017, p. 1, paragraph 1.35. 

26  See previous footnote. 

10 

 
 
                                                           
feedback by the Commission’s departments in the risk assessment exercise, the ‘top 10’fraud 
patterns cited were: 

EXTERNAL FRAUD27 

Cost overcharging in general 

Falsification of invoices or certificates 

Double-funding 

(Self-)Plagiarism 

Collusion between tenderers 

Falsification of timesheets 

Irregular subcontracting 

INTERNAL FRAUD28 

Cited by % of services 

50 % 

43 % 

38 % 

33 % 

26 % 

19 % 

19 % 

Cited by % of services 

Undeclared conflict of interest 

Leakage of confidential information 

Fraudulent entitlement claims 

60 % 

57 % 

21 % 

These  figures  obviously  only  give  a  rough  idea  of  fraud  patterns  based  on  the  professional 
judgement  of  managers  and  staff  responsible  for  operations  and  internal  control  in  the 
Commission  services  and  executive  agencies.  However,  they  are  partly  supported  by 
investigative experience.  

4.2.2.  External fraud 

The  OLAF  Report  2016  cites  public  procurement  fraud  —  facilitated  for  example  through 
corruption, irregular or fictitious subcontracting or the use of offshore accounts — as the most 
important  focus  of  OLAF  investigations29.  Recent  OLAF  reports  also  highlight  plagiarism, 
fraudulent  double-funding,  falsification  of  CVs  and  timesheets  and  creating  bogus 
subsidiaries or hiding links between companies as frequent fraud patterns30. The vulnerability 
of  public  procurement  is  also  reflected  in  the  European  Court  of  Auditors’  observation  that 
‘Failure to comply with public procurement rules has been a perennial and significant source 

27   External fraud means fraud committed by perpetrators other than EU staff and Members of EU institutions or 

bodies. 
Internal fraud means fraud committed by EU staff or Members of EU institutions or bodies. 

28 
29   OLAF Report 2016, pp. 15 – 18: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2016_en.pdf.  
See also OLAF Report 2017 (reference in FN 21), p. 14, referring to collusion and conflict of interest. 
30   OLAF Report 2016 (see previous footnote), pp. 10, 18; OLAF Report 2017 (see FN 21), pp. 17 - 19. 

11 

 
 
                                                           
of  error’31,  although  it  should  be  noted  that  the  complexity  of  rules  is  itself  a  significant 
source of errors. 

Involvement of organised criminal groups has been detected both in expenditure and revenue 
fraud,  and  is  especially  significant  in  the  latter32.  The  EU’s  response  to  organised  crime  is 
coordinated between EU institutions and agencies and the Member States in the framework of 
a  ‘policy  cycle’  in  which  Europol  and  the  Council’s  Standing  Committee  on  operational 
cooperation on internal security play key roles33. This policy cycle comprises: (i) fact-finding 
and  policy  development;  (ii)  policy  setting  and  decision-making;  (iii)  implementation  and 
monitoring; and (iv) evaluation and recommendations for further policy development. For the 
period 2018-2021, the Council has defined 10 policy priorities, several of which relate to the 
fight  against  fraud34.  The  EU  strategy  for  the  fight  against  cigarette  smuggling  and  other 
forms  of  illicit  trade  in  tobacco  products35,  whose  action  plan  was  recently  updated36,  also 
puts a strong focus on tackling organised crime. 

4.2.3.  Internal fraud 
Regarding  internal  fraud,  conflicts  of  interest  and  breaches  of  confidentiality  are  recurrent 
forms  of internal  misconduct  examined by the Commission’s Investigation and Disciplinary 
Office (IDOC)37. However the frequency of such incidents does not match the high alert they 

31   ECA  Special  Report  No  10/2015,  Efforts  to  address  problems  with  public  procurement  in  EU  cohesion 
III: 

intensified, 

Summary, 

Executive 

Section 

expenditure 
https://www.eca.europa.eu/en/Pages/DocItem.aspx?did=32488 

should 

be 

32  Europol,  European  Union  Serious  and  Organised  Crime  Threat  Assessment,  2017,  pp.  42–45: 
https://www.europol.europa.eu/activities-services/main-reports/european-union-serious-and-organised-crime-
threat-assessment-2017.  Concerns  about  organised  crime  affecting  the  EU’s  financial  interests  were 
expressed  in  paragraph  32  of  the  European  Parliament’s  resolution  of  8 March  2016  on  the  2014  annual 
report  on  the  Protection  of  the  EU’s  Financial  Interests  —  Fight  against  fraud,  2015/2128(INI), 
P8_TA(2016)0071 and in paragraph 55 of the European Parliament’s resolution of 16 May 2017 on the 2015 
annual  report  on  the  protection  of  the  EU’s  financial  interests  —  Fight  against  fraud,  2016/2097(INI), 
P8_TA(2017)0206: 
http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P8-TA-2016-0071&language=EN 
http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P8-TA-2017-

0206+0+DOC+XML+V0//EN 

33  Publication by the General Secretariat of the Council ‘The EU Policy Cycle to tackle organised and serious 

international crime’: http://www.consilium.europa.eu/media/30232/qc0114638enn.pdf 

34  Council conclusions of 18 May 2017 on setting the EU’s priorities for the fight against organised and serious 

international crime between 2018 and 2021, Council Document 9450/17: 
http://data.consilium.europa.eu/doc/document/ST-9450-2017-INIT/en/pdf 
Fraud-related priorities (not limited to fraud to the detriment of the EU budget) concern cybercrime, excise 
fraud and VAT fraud, money laundering and asset recovery and document fraud. 

35  Communication from the Commission to the Council and the European Parliament of 6 June 2013, ‘Stepping 
up  the  fight  against  cigarette  smuggling  and  other  forms  of  illicit  trade  in  tobacco  products  —  A 
comprehensive  EU  Strategy’,  COM(2013)  324  final.  In  2017,  the  Commission  reported  on  the 
implementation  of  the  strategy  in  the  report  from  the  Commission  to  the  Council  and  the  European 
Parliament  of  12 May  2017,  Progress  report  on  the  implementation  of  the  Commission  Communication 
‘Stepping up the fight against cigarette smuggling and other forms of illicit trade in tobacco products — A 
comprehensive EU Strategy’ (COM(2013) 324 final of 6.6.2013), COM(2017) 235 final. 

36  Communication from the Commission to the European Parliament, the Council and the European Economic 
and  Social  Committee  of  7  December  2018,  2nd  Action  Plan  to  fight  the  illicit  tobacco  trade  2018-2022, 
COM(2018) 846 final. 

37   For instance, IDOC annual report 2015, pp. 8-9, 2014, p. 9, 2012, pp. 21-22. — IDOC’s annual reports are 

internal Commission documents but are made available to members of the public upon request. 

12 

 
 
                                                           
 
raise  among  Commission  services  and  executive  agencies38.  There  are  three  possible 
explanations for this discrepancy, alone or in  combination:  (i) an insufficient  detection rate; 
(ii) conflict of interest may be an issue observed under shared management more than under 
direct  management;  and  (iii)  services  are  very  concerned  about  conflicts  of  interest  and 
breaches  of  confidentiality  because  of  the  potentially  high  reputational  impact  but  less  so 
because of the likelihood of those risks to materialise. 

Analysing  this  further,  reporting  on  irregularities  by  Member  States  does  not  support  the 
second explanation:  According to  the statistics for 201639, around 2 % only  of irregularities 
reported as fraudulent were linked to  ethics and integrity. While this finding would not rule 
out the first  explanation, i.e. an insufficient detection rate in  general, that explanation is not 
supported, at least for direct management, by observations of the European Court of Auditors, 
which attest to the good standard of procurement procedures managed by the EU institutions40 
– a domain that is particularly prone to conflict of interest and breaches of confidentiality. In 
conclusion,  the  most  persuasive  explanation  for  the  widespread  concern  about  those  issues 
among Commission services and executive agencies is the potentially serious impact of such 
infringements  of  professional  ethics  on  the  institution's  reputation,  rather  than  an  elevated 
likelihood of those infringements to occur within the Commission or its executive agencies. 

The IDOC’s annual reports reveal that one of the most frequent types of alleged misconduct 
registered in 2015–2017 was harassment and other inappropriate behaviour41. Harassment and 
other  behaviour  reflecting  adversely  on  a  member  of  EU  staff  is  prohibited  by  Articles  12a 
and  12,  respectively,  of  the  Staff  Regulations42.  As  a  serious  breach  of  professional 
obligations, harassment could fall under the concept of fraud as outlined in Section 2 above. 
However, although harassment and other inappropriate behaviour may negatively affect work 
inside the EU institutions and thus decrease the effectiveness of the EU’s fight against fraud, 
the  Commission  considers  that  the  challenge  is  being  met  through  existing  means  of  legal 
recourse. These are most notably the institutions’ disciplinary powers and their obligation to 
assist  the  victim  in  line  with  Article 24  of  the  Staff  Regulations43  but  also  informal 
mechanisms  —particularly  the  Network  of  Confidential  Counsellors  put  in  place  by  the 
Commission44.  While  the  CAFS  does  not,  therefore,  look  into  the  issue  of  harassment  and 

38   In 2015–2017, 6.5 % of the cases registered by IDOC  were on conflict of interest, 8.2 %  were breaches of 
confidentiality and 35.3 % (the largest proportion) concerned harassment and other inappropriate behaviour. 
39   Commission  Staff  Working  Document,  Statistical  evaluation  of  irregularities  reported  for  2016,  Own 
Resources,  Natural  Resources,  Cohesion  Policy,  Pre-accession  and  Direct  expenditure,  Accompanying  the 
document  ‘Report  from  the  Commission  to  the  European  Parliament  and  the  Council,  Protection  of  the 
European Union’s financial interests — Fight against Fraud Annual Report 2016’ — COM(2017) 383 final –, 
SWD (2017) 266 final, Part 2/2, p. 66. 

40   ECA  Special  Report  No  17/2016,  The  EU  institutions  can  do  more  to  facilitate  access  to  their  public 

procurement, Executive Summary, Section IV 
https://www.eca.europa.eu/en/Pages/DocItem.aspx?did=37137 

: 

41   82 out of 232 cases = 35.3 %, see FN 38. 
42   Council  Regulation  No  31  (EEC),  11  (EAEC)  of  18 December  1961  laying  down  the  Staff  Regulations  of 
Officials and the Conditions of Employment of Other Servants of the European Economic Community and 
the European Atomic Energy Community, OJ 45, 14.6.1962, p. 1385, recast by Regulation (EEC, Euratom, 
ECSC) No 259/68 of 29 February 1968 and subsequently amended and updated. 

43   See previous footnote. 
44   Commission Decision C (2006) 1624/3 of 26 April 2006 on the European Commission policy on protecting 

the dignity of the person and preventing psychological harassment and sexual harassment. 

13 

 
 
                                                           
other inappropriate behaviour in more depth, some of the measures proposed, for example on 
awareness-raising and whistle-blowing, will  also  help  with  the fight  against  harassment  and 
other such personal misconduct. 

4.2.4.  Fraud trends 
The above overview of fraud patterns does not point to any ground-breaking emerging trends 
in the ‘fraud landscape’. Ongoing and future developments are/could be linked to: 

–  changes  in  the  Commission’s  delivery  model  with  the  increased  use  of  digital 

communication channels and related increase in exposure to cybersecurity risks; 

–  changes in commercial delivery models that frustrate the usual control procedures (e.g. 
paperless boarding passes or, more generally, the rapid expansion of e-commerce and 
the challenges it poses to customs and tax administrations); and/or 

–  new technology that provides fresh opportunities for fraudsters, for example enabling 
ever  more  sophisticated  forgery45.  Risks  related  to  the  adequacy  of  measures  to 
prevent  and  respond  to  IT  security  threats  are  already  among  the  top  critical  risks 
affecting the Commission as a whole. 

45   Document  fraud  is  explained  in  Europol’s  ‘EU  Serious  and  Organised  Crime  Threat  Assessment  2017’ 

(reference in FN 32), pp. 20-21. 

14 

 
 
 
 
 
                                                           
5. 

Fraud vulnerabilities 

5.1.  Data collection and analysis 

Data collection and analysis contribute to the fight against fraud in various ways. 

o  Observing the ‘(anti-)fraud landscape’ in the EU and beyond may provide insight into 
emerging  fraud  patterns  and  innovative  ways  of  preventing  and  detecting  fraud. 

o  Collecting and analysing data on established and suspected cases of fraud may deepen 
knowledge  on  vulnerabilities,  fraud  patterns  and  profiles  of  fraudsters  and  help  to 
deploy  control  mechanisms  and  resources  in  the  most  effective  and  efficient  way 
possible. 

o  Project  databases  combined  with  tools  that  process  data  on  risk  profiles  and  fraud 
indicators (‘red flags’) may help with fraud detection or potentially reduce the risk of 
double-funding or overcharging of cost claims. 

Conversely,  any  missed  opportunities  in  this  respect  could  potentially  weaken  the 
Commission’s defences against attempts of fraud. 

The Commission is already active in anti-fraud intelligence and analysis. 

o  To observe the global anti-fraud landscape and to exchange views with experts from 
the public and the private sector, OLAF and other Commission departments regularly 
take an active part in anti-fraud and anti-corruption fora, such as: 

the conference of international investigators46; 
the Economic Crime Agencies’ Network (ECAN)47; 

– 
– 
–  European Partners against Corruption (EPAC) and the European contact point 

network against corruption (EACN)48; 

–  OECD’s Global Anti-Corruption and Integrity Forum49; 
– 
– 
– 

the International Association of Anti-Corruption Authorities (IAACA)50; 
the International Corruption Hunters’ Alliance (ICHA)51. 
the  Conference  of  State  Parties  to  the  United  Nations  Convention  against 
Corruption52  and  two  of  its  subsidiary  bodies,  the  Implementation  Review 
Group53  meetings  and  the  Open-ended  Intergovernmental  Working  Group  on 
the Prevention of Corruption54; 

46   http://www.conf-int-investigators.org/ 
47   https://ec.europa.eu/anti-fraud/media-corner/news/03-03-2016/rising-challenge-%E2 %80 %93-economic-

crime-agencies-cooperate-fight-against_en 

48   https://www.epac-eacn.org/ 
49   http://www.oecd.org/corruption/integrity-forum/ 
50   http://iaaca.org/ 
51   http://www.worldbank.org/en/about/unit/integrity-vice-presidency/icha 
52   https://www.unodc.org/unodc/en/corruption/COSP/conference-of-the-states-parties.html 
53   http://www.unodc.org/unodc/en/corruption/IRG/implementation-review-group.html 
54   http://www.unodc.org/unodc/en/corruption/WG-Prevention/working-group-on-prevention.html 

15 

 
 
 
 
 
                                                           
– 
– 

the G20 Anti-corruption working group; and 
the EU  anti-corruption experience-sharing programme55. 

o  Data  on  cases  of  established  and  suspected  fraud  are  mainly  collected  in  two 

databases. 

1)  Irregularity Management System (IMS): 

In  shared  management,  sector-specific  legislation  obliges  Member  States  to 
report  established  and  suspected  irregularities,  including  fraud,  to  the 
Commission. OLAF provides the necessary technical infrastructure — the IMS 
—  and  coordinates  reporting  procedures.  Data  collected  through  the  IMS  are 
increasingly analysed and used to prevent fraud. 

2)  Early Detection and Exclusion System (EDES): 

The EDES, established under Articles 135–145 of the Financial Regulation, is 
a  significant  advance  in  sanctioning  fraudsters  swiftly  and  effectively  and  in 
proactively  protecting  the  EU  budget  while  respecting  due  process.  It  allows 
Commission services and other EU institutions and bodies to flag up financial 
risks  posed  by  (potential)  recipients  of  EU  funds  and  to  exclude  unreliable 
ones  from  EU  funding 
indirect  management.  OLAF 
investigations,  audits  conducted  by  Commission  services  or  by  the  European 
Court of Auditors (ECA), alerts received from entrusted entities under indirect 
management  and  reports  transmitted  by  national  authorities  through  the  IMS 
provide valuable information for this process. 

in  direct  and 

o  The Commission processes risk profiles and supports the analysis of big data for fraud 
include: 

through  a  number  of  projects.  Examples 

prevention  purposes 

– 

– 

‘DAISY’ — an analytical tool for the departments responsible for research that 
processes  risk  profiles  and  red  flags  to  focus  audit  capabilities  and  other 
control resources on the most risk-prone projects. 

‘ARACHNE’ promotes a risk-based approach to project verification in shared 
management  (European  Structural  and  Investment  Funds).  ARACHNE  is  a 
risk  scoring  tool  that  feeds  a  database  of  projects  with  publicly  available 
information  to  identify  the  most  risk-prone  projects.  Based  on  a  set  of  pre-
defined risk indicators, it continually sifts through internal and external data on 
beneficiaries,  contractors  and  sub-contractors  and  determines  potentially 
irregular circumstances. 

–  The  Single  Electronic  Data  Interchange  Area  (‘SEDIA’),  put  in  place  for 
public  procurement  and  grants 
line  with 
Article 147(1) of the Financial Regulation can also facilitate checks for double-

in  direct  management 

in 

55 

https://ec.europa.eu/home-affairs/what-we-do/policies/organized-crime-and-human-

trafficking/corruption/experience-sharing-programme_en 

16 

 
 
 
 
 
 
 
 
 
 
 
 
 
                                                           
funding to a certain extent. 

– 

‘DIGIWHIST’, a project coordinated by the University of Cambridge and co-
financed  under  the  Horizon  2020  programme,  is  developing  an  open  data 
assessment  tool  for  public  procurement.  This  tool  will  systematically  collect, 
analyse,  and  broadly  disseminate  information  on  public  procurement  and  on 
systems  that  increase  the  accountability  of  public  officials.  It  covers 
35 countries  (EU-28  plus  some  neighbouring  countries).  This  data  will  be 
linked  to  data  on  company  and  public  body  finances  and  ownership  and  on 
to 
systems 
systematically  investigate  the  patterns  and  systems  of  allocating  public 
resources in Europe. 

increase  public  officials’  accountability.  The  aim 

that 

is 

However,  more  remains  to  be  done  in  each  of  these  areas  concerning  data  collection  and 
analysis, resources permitting. 

o  To  observe  the  (anti-)fraud  landscape,  a  more  intense  exchange  of  views  with 
academia from a criminological angle could be sought, e.g., by commissioning studies 
of national crime and organised crime statistics, studies of illegal or black markets and 
perception  surveys,  among  others.  Policy  suggestions  gathered  at  international  fora 
could be evaluated more systematically and criminological research on fraud could be 
supported and exploited more proactively.  

o  Data quality in the IMS is affected by inconsistent reporting practices among Member 
States. This shortcoming is only partially mitigated by guidance developed by national 
experts  in  the  Advisory  Committee  for  Coordination  of  Fraud  Prevention56  with 
support  from  OLAF.  The  analytical  dimension  of  the  IMS  has  not  yet  been  fully 
explored,  and  the  EDES  cannot  store  any  information  on  fraud  patterns  but  only 
records entities excluded due to fraud  or other grounds provided for in the Financial 
Regulation. 

o  Risk  scoring  tools  are  only  available  for  a  few  Commission  services  and  spending 
programmes  and  have  not  been  put  into  use  by  all  the  Member  States  in  shared 
management,  although  some  Member  States  use  their  own  alternative  tools57. 

Such gaps in the availability and analysis of data for fraud prevention and detection purposes 
could be filled if the Commission were to have a strong and centralised analytical capability. 

In  the  area  of  traditional  own  resources,  timely  data  analysis  is  crucial  in  the  fight  against 
fraud and has accordingly been put into practice. In addition to its key role in collecting data 
and  providing  EU-wide  databases,  the  Commission  —  notably  through  its  Joint  Research 

56   Handbook on Reporting of irregularities in shared management (2017). 
57   Report  from  the  Commission  to  the  European  Parliament  and  the  Council,  Protection  of  the  European 

Union’s financial interests — Fight against Fraud Annual Report 2016, COM(2017) 383 final, p. 14. 

17 

 
 
 
 
 
 
 
 
 
 
                                                           
Centre and OLAF — has developed several tools to monitor and identify suspicious activities. 
These  include  the  Automated  Monitoring  Tool  (AMT)58  and  the  Contraffic  project59.  This 
work  is  shared  with  Member  States  who  may  react  to  OLAF  alerts  or  conduct  their  own 
analysis.  Feedback  is  encouraged,  and  OLAF  is  keen  to  engage  with  users  to  identify 
possibilities  for  refining  its  alerts,  including  expanding  their  scope  and  using  wider  data 
sources to improve accuracy. The Commission is also developing data analysis tools together 
with Member States to make better use of the available data sources to fight customs fraud. 

5.2.  Coordination, cooperation and processes 

This section examines possible vulnerabilities in three areas: (i) in the coordination of fraud 
risk management across Commission services and executive agencies; (ii) in the structure of 
cooperation  with  other  EU  bodies  and  with  Member  States;  and  (iii)  in  processes  for  the 
prevention and detection of fraud in specific fields. 

5.2.1.  Coordination of fraud risk management 

Coordination  of  fraud  risk  management  ensures  that  largely  homogeneous  and  consistent 
approaches and methods are applied across Commission services and executive agencies and 
that  the  resources  available  to  prevent  and  detect  fraud  are  deployed  effectively  and 
efficiently.  Conversely,  a  lack  of  coordination  decreases  the  effectiveness  and  efficiency  of 
the Commission’s fight against fraud. 

Fraud risk management in the Commission is organised in a decentralised way. In line with 
Articles  74(2),  36(2)(d)  of  the  Financial  Regulation,  internal  control,  including  fraud 
prevention and detection, is under the responsibility of authorising officers by delegation. As 
set  out  in  Article 1(2)  of  the  OLAF  Regulation,  OLAF  contributes  to  the  design  and 
development of methods to prevent and combat fraud, corruption and any other illegal activity 
that  affects  the  EU’s  financial  interests.  The  heads  of  Commission  services  and  executive 
agencies play a key role in shaping the Commission’s anti-fraud policies at the stages of: 

implementation (control activities, recovery, administrative sanctions), and 

o  planning (service-level anti-fraud strategies, management plans), 
o 
o  reporting (annual activity reports, contributions feeding into the Commission’s Annual 
Management and Performance Report and annual Report on the Protection of the EU’s 
Financial Interests). 

To  fulfil  those  tasks,  Commission  services  and  executive  agencies  are  supported  by  the 
Commission’s  Secretariat  General  and  Directorate-General  for  Budget  (DG  BUDG)  and  by 
OLAF, in particular through: 

o  methodological  guidance  and,  on  request,  individual  advice  for  services’  anti-fraud 

strategies (OLAF); 

58  AMT monitors trade flows and identifies suspicious changes in volume or the average price of products thus 
enabling the detection of undervaluation cases as well as other types of customs fraud such as evasion of anti-
dumping duties or misdeclaration of the commodity. 

59  Contraffic  allows  cases  of  false  declaration  of  origin  to  be  detected  by  cross-checking  information  on 

physical movements of containers with information contained in customs declaration. 

18 

 
 
 
                                                           
o 

the  Commission’s  Internal  Control  Framework  and  Network  of  Internal  Control 
Coordinators, chaired by DG BUDG; 

o  review and advice on the anti-fraud aspects of services’ management plans and annual 

activity reports (OLAF); 

o  OLAF’s leading role in compiling the Commission’s annual Report on the Protection 

of the EU’s financial interests; 

o  DG BUDG’s role in carrying out recoveries and as lead service for the Early Detection 

and Exclusion System; and 

o  moderation of the Commission’s Fraud Prevention and Detection Network as a forum 

for the exchange of best practice among services’ anti-fraud experts (OLAF). 
Moreover, in accordance with Article 118(1) of the Financial Regulation, the Commission’s 
Internal  Audit  Service  (IAS)  assesses  departments’  risk  management  and  advises  the 
institution  in  that  respect.  The  quality  and  content  of  internal  audit  work  and  the  follow-up 
given to internal and external audit recommendations and to requests made by the discharge 
authority  are  monitored  by  the  Commission’s  Audit  Progress  Committee  in  line  with  its 
charter60. 

These coordination and monitoring activities provide services with several channels of advice 
and  exchange  while  leaving  them  plenty  of  room  to  develop  their  own  anti-fraud  policies. 
Despite  this  significant  support  at  corporate  level,  OLAF’s  support  role  is  only  advisory  in 
nature, which means that service-level approaches may diverge. 

OLAF’s  review  of  management  plans  and  annual  activity  reports  respects  the  departments’ 
autonomy and is mostly limited to avoiding major inconsistencies and observing a few formal 
criteria  such  as  the  frequency  of  updates  and  monitoring  exercises  for  services’  anti-fraud 
strategies. Services’ fraud risk assessments and mitigation strategies are rarely challenged in 
substance. 

Given  the  above,  a  residual  risk  exists  that  the  effectiveness  and  efficiency  of  anti-fraud 
controls across the spectrum of Commission services and executive agencies varies and that 
controls  can  be  suboptimal  in  some  cases.  Risks  related  to  certain  weaknesses  in  corporate 
oversight were also flagged in a 2015 audit by the Commission’s IAS on the ‘Adequacy and 
effective  implementation  of  DG’s  anti-fraud  strategies’.  OLAF  is  taking  up  a  stronger  role 
providing effective and targeted oversight in that regard. 

5.2.2.  Cooperation with other EU bodies and with Member States 

Other EU bodies for which the Commission bears a certain measure of political responsibility, 
namely decentralised agencies, joint undertakings (JU) and joint technology initiatives (JTI), 
are  in  charge  of  their  own  anti-fraud  policies.  In  defining  these  policies,  those  bodies  are 
subject to similar legal principles as the Commission and the executive agencies. Unlike the 
latter, the afore-mentioned EU bodies do not form part of the Commission’s Fraud Prevention 
and  Detection  Network,  but  policy  coordination  happens  in  different  ways.  In  the  research 

60   Composed  of  the  First  Vice-President,  five  Members  of  the  Commission  and  three  external  members  with 
proven  professional  expertise.  The  Charter  of  the  APC  was  updated  with  a  Communication  to  the 
Commission of 21 November 2018, C (2018) 7707 final. 

19 

 
 
                                                           
area, JUs have adopted the Research family anti-fraud strategy and are fully integrated in the 
groups managing the anti-fraud efforts. For decentralised agencies, coordination – to a lesser 
degree – is arranged through an Inter-Agency Network. The Commission is also represented 
on the management boards or similar governing bodies of decentralised agencies, JU and JTI.  

This relatively loose coordination poses risks to the quality of EU bodies’ anti-fraud controls. 
OLAF, DG BUDG and the partner DGs of decentralised agencies, JU and JTI mitigate such 
risks  in  the  following  ways:  (i)  by  using  methodological  guidance  for  anti-fraud  strategies; 
(ii) by  participating  in  training/knowledge-sharing  organised  by  the  Inter-Agency  Network; 
and (iii) through the monitoring of anti-fraud policies by the agencies’  management boards. 
However, the legal autonomy of the EU bodies in question sets limits to coordination. In the 
case of JU and JTI, cultural differences brought about by cooperation with partners from the 
private sector may add to potential difficulties but can also provide innovative perspectives.  

Concerning Member States, national authorities involved in shared management are subject to 
the principle of sound financial management but have some leeway as to its implementation. 
In the area of European Structural and Investment Funds61, in accordance with the Common 
Provisions  Regulation  (CPR)62,  national  authorities  must  prevent,  detect  and  correct 
irregularities  (Article 122(2)  CPR)  and  put  in  place  effective  and  proportionate  anti-fraud 
measures  taking  into  account  the  risks  identified  (Article 125(4)(c)  CPR).  Yet,  statistics 
gathered from Member States’ reporting through the IMS show that among EU countries, the 
fraud detection rate (i.e. the proportion of payments found to be affected by fraud out of total 
payments), varied between less than 0.01 % and 1.02 % in 2013-201763. While there could be 
many  reasons  for  such  discrepancies,  there  is  at  least  a  possibility  that  they  are  due  to 
differences in the effectiveness of anti-fraud measures between individual Member States. 

A lack of consistently effective anti-fraud policies in shared management, which accounts for 
up to 80 % of the EU budget, exposes the budget to substantial risks. 

Commission  services  responsible  for  shared  management  and  OLAF  regularly  work  with 
experts  from  the  Member  States  to  coordinate  anti-fraud  policies.  Under  the  Advisory 
Committee  for  the  Coordination  of  Fraud  Prevention  (COCOLAF),  OLAF  continues  to 
encourage Member States  to  develop  national  anti-fraud strategies, and in 2016 COCOLAF 
adopted guidelines in this respect. Ideally, anti-fraud measures required under the CPR should 
be  embedded  in  a  comprehensive  national  anti-fraud  strategy.  To  date,  10  Member  States 

61   With the exception of the European Agricultural Fund for Rural Development, to which different provisions 

apply. 

62   Regulation (EU) No 1303/2013 of the European Parliament and of the Council of 17 December 2013 laying 
down  common  provisions  on  the  European  Regional  Development  Fund,  the  European  Social  Fund,  the 
Cohesion  Fund,  the  European  Agricultural  Fund  for  Rural  Development  and  the  European  Maritime  and 
Fisheries  Fund  and  laying  down  general  provisions  on  the  European  Regional  Development  Fund,  the 
European  Social  Fund,  the  Cohesion  Fund  and  the  European  Maritime  and  Fisheries  Fund  and  repealing 
Council Regulation (EC) No 1083/2006, OJ L 347, 20.12.2013, p. 320, as amended. 

63   Commission  Staff  Working  Document,  Statistical  evaluation  of  irregularities  reported  for  2017,  Own 
Resources,  Natural  Resources,  Cohesion  Policy,  Pre-accession  and  Direct  expenditure,  Accompanying  the 
document ‘Report from the Commission to the European Parliament and the Council, 29th Annual Report on 
the  Protection  of  the  European  Union’s  financial  interests  —  Fight  against  Fraud  Annual  Report  2017’  — 
COM(2018) 553 final –, SWD (2018) 386 final, Part 1/2, p. 48. 

20 

 
 
                                                           
have put  in  place  a national  strategy. The European Parliament  expressed regret  that not  all 
Member States have taken that step64. 

5.2.3.  Cooperation and flow of information between OLAF and Commission 

services/executive agencies and other EU bodies 

Article 8(1) of the OLAF Regulation requires the institutions, bodies, offices and agencies to 
transmit  to  OLAF  without  delay  any  information  relating  to  possible  cases  of  fraud, 
corruption or any other illegal activity affecting the financial interests of the EU65. OLAF has 
observed  wide  variations  in  the  quality  and  quantity  of  the  information  flow  on  suspected 
fraud from the various Commission departments and the other institutions, bodies, offices and 
agencies. These variations in the information flow may lead to inconsistency of treatment or 
even to some suspicions not being treated at all. 

OLAF  has  prepared  a  document  entitled  ‘Tasks  and  responsibilities  of  the  OLAF  Contact 
Points  (OCPs)  of  the  EU  Commission  services  and  Executive  Agencies  and  OLAF’  for  the 
Commission  and  its  executive  agencies.  This  document  describes  the  role  entrusted  to  the 
OCPs  and  spells  out  their  tasks  and  duties  and  those  of  their  department  or  agency,  and  of 
OLAF, on all aspects of their cooperation. The necessary flow of information is also a topic in 
anti-fraud  training  and  in  the  exchange  of  best  practice  through  the  Commission’s  Fraud 
Prevention and Detection Network. 

Problems  with  the  flow  of  information  are  even  more  acute  for  the  decentralised  agencies, 
whose dispersed location and employment of non-permanent personnel as the large majority 
of  their  staff  may  risk  weakening  the  anti-fraud  process  to  some  extent.  Several  measures 
could  be  taken  to  remedy  such  weaknesses.  OLAF  could  provide  targeted  training  to  raise 
awareness  of  the  agencies’  management  and  staff  about  specific  risks  such  as  conflicts  of 
interest  and breaches  of  professional  secrecy, including leaks. These training sessions could 
help  reinforce  the  message  that  OLAF’s  involvement  is  key  for  addressing  fraud-related 
issues  appropriately  to  their  benefit,  and  that  it  does  not  cause  them  additional  difficulties. 
Training  could  also  cover  other  aspects  of  their  anti-fraud  responsibilities.  It  could  be 
provided  during  a  meeting  of  the  Inter-Agency  Legal  Network  which  provides  its  members 
with training and updates and a forum to exchange best practices. The network has a specific 
working group on anti-fraud issues. OLAF should regularly participate in this group. 

5.2.4.   Procurement under shared management 

As  OLAF’s  investigations  have  shown,  public  procurement,  which  remains  the  largest 
channel of public spending, is an attractive marketplace for fraudsters, who use corruption and 
offshore accounts to facilitate fraud. Many procurement fraud cases are transnational, as the 
new fraud scenarios often involve a contracting authority from one Member State and bidders 

64   Paragraph 5 of the resolution of the European Parliament of 3 May 2018 on the 2016 annual report on the 
protection  of  the  EU’s  financial  interests  —  Fight  against  fraud,  2017/2216(INI),  P8_TA(2018)0196: 
http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P8-TA-2018-
0196&format=XML&language=EN 

65  A  similar  requirement  is  established  by  the  Inter-institutional  Agreement  of  25 May  1999,  OJ  L  136/15, 
31.5.1999, and the internal decision adopted by the Commission and each executive agency pursuant thereto. 

21 

 
 
                                                           
from  several  other  Member  States  who  subcontract  their  works  to  companies  in  different 
countries66. 

Over  a  5  year  period  (2012–2016),  20 %  of  all  irregularities  reported  by  Member  States 
through the IMS have related to breaches of public procurement rules which account for 30 % 
of all reported irregular financial amounts67. 

In 2014, the EU adopted new procurement directives68, which was one of the priority actions 
of the 2011 CAFS. Among the features of the new directives were: 

introducing e-procurement as of 2018; 

o  creating a dedicated legal framework for concession contracts; 
o 
o  strengthening the provisions on conflict of interest; 
o  clarifying the rules on modifying contracts after they are awarded; and 
o  strengthening the exclusion grounds. 

In  2017,  the  Commission  adopted  a  procurement  package69  whose  aims  included 
professionalising  Member  States’  procurement  staff  and  introducing  a  voluntary  upstream 
assessment of large infrastructure projects. 

in  place  a 
The  Commission  departments  responsible  for  shared  management  put 
comprehensive  public  procurement  action  plan  in  2013,  which  has  been  updated  several 
times. An updated version was officially endorsed in April 2017 and includes a revised state 
of play of the actions to put a greater emphasis on strategic procurement and transparency. It 
also  includes  measures  which  contribute  to  preventing  fraud  and  corruption  in  public 
procurement. 

One  important  measure  of  the  action  plan  which  is  relevant  for  the  CAFS  is  the  ‘Integrity 
Pacts: A Civil Control Mechanism for Safeguarding EU Funds’70. This project is implemented 

66   OLAF Report 2016 (reference in FN 29), pp. 15–18. 
67   Report  from  the  Commission  to  the  European  Parliament  and  the  Council,  Protection  of  the  European 
Union’s  financial  interests  —  Fight  against  Fraud  Annual  Report  2016,  COM(2017)  383  final,  p.  32. 
Concerns about irregularities in public procurement under shared management were expressed in paragraph 
37 of the resolution of the European Parliament of 16 May 2017 on the Annual report 2015 on the protection 
of the EU’s financial interests — Fight against fraud (reference in FN 32). See also paragraph 50 of the same 
resolution, voicing concerns about irregular procurement procedures in the context of the refugee crisis. 
68   Directive  2014/24/EU  of  the  European  Parliament  and  of  the  Council  of  26 February  2014  on  public 

procurement and repealing Directive 2004/18/EC, OJ L 94, 28.3.2014, p. 65.  
Directive 2014/23/EU of the European Parliament and of the Council of 26 February 2014 on the award of 
concession contracts, OJ L 94, 28.3.2014, p. 1. 
Directive 2014/25/EU of the European Parliament and of the Council of 26 February 2014 on procurement 
by  entities  operating  in  the  water,  energy,  transport  and  postal  services  sectors  and  repealing  Directive 
2004/17/EC, OJ L 94, 28.3.2014, p. 243. 

69   Communication from the Commission to the European Parliament, the Council, the European Economic and 
Social Committee and the Committee of the Regions  of 3 October 2017, Making Public Procurement work 
in and for Europe, COM(2017) 572.  
Communication from the Commission to the European Parliament, the Council, the European Economic and 
Social  Committee  and  the  Committee  of  the  Regions    of  3 October  2017,  Helping  investment  through  a 
voluntary ex-ante assessment of the procurement aspects for large infrastructure projects, COM(2017) 573. 

22 

 
 
 
                                                           
 
 
in cooperation with the ‘Transparency International and pilots Integrity Pacts’ in a number of 
projects in the Member States co-financed by the EU Structural and Cohesion Funds.  

Another  measure  in  the  action  plan  is  the  public  procurement  guidance  that  aims  to  help 
practitioners avoid the most common errors in projects funded by the European Structural and 
Investment  Funds71.  The  updated  version,  published  in  February  2018,  incorporates  the  key 
changes  introduced  by  the  new  Public  Procurement  Directive  2014/24/EU  and  takes 
procurement  officers  step-by-step  through  all  stages  of  the  process  —  from  planning  to 
contract  implementation  —  while  highlighting  risk  areas.  It  includes  examples  of  good 
practice,  case  studies  and  useful  links  to  help  those  who  are  involved  in  the  planning, 
selection and implementation of EU-supported projects. 

Member  States’  managing  authorities/intermediate  bodies  will  also  be  provided  with  both 
internal and external training on the new directives and on strategic procurement. 

All  of  these  initiatives  will  gradually  improve  the  quality  of  procurement  procedures  in  the 
Member  States  and  strengthen  the  fight  against  fraud.  But  in  the  meantime,  public 
procurement  in  shared  management  is  likely  to  remain  a  fraud-prone  field  of  activities  for 
many years72. 

5.2.5.  Procurement and grants in direct management 
In  the  departmental  fraud  risk  assessments73,  a  considerable  number  of  services  engaged  in 
direct  management  mentioned  public  procurement  as  one  of  the  most  significant  areas  of 
fraud  risk.  Fraud  risks  include  collusion  among  tenderers  and  conflicts  of  interest  of  a  staff 
member. However, there are also fraud risks during a project’s implementation phase due to 
falsification  of  timesheets  and  other  documents,  which  play  an  equally  important  role  as 
double-funding74 in fraud related to grants.  

The  Commission  has  put  in  place  an  array  of  safeguards  and  controls  in  both  grants  and 
procurement  management.  Thanks  to  such  measures,  the  European  Court  of  Auditors  has 
given a positive assessment of the institutions’ ‘robust’ procurement procedures75. 

Progress should continue as the Commission extends its use of IT tools such as e-procurement 
and  e-grants,  as  these  can  help  to  detect  double-funding,  for  instance.  For  grants,  the 
increasing use of simplified cost options and the use of financing not linked to costs76 could 

70  http://ec.europa.eu/regional_policy/en/newsroom/news/2017/01/16-01-2017-integrity-pacts-better-

safeguarding-and-use-of-eu-funds 

71  http://ec.europa.eu/regional_policy/sources/docgener/informat/2014/guidance_public_proc_en.pdf 
72   In  line  with  this  observation,  public  procurement  regularly  features  among  OLAF’s  investigation  policy 
priorities,  determined  annually  by  the  Director  General  of  OLAF,  pursuant  to  Article 17(5)  of  the  OLAF 
Regulation. 
73   See p. 11/12. 
74   This is confirmed by both the departments’ fraud risk assessment and by OLAF’s investigative experience, 

OLAF’s annual report for 2016 (reference in FN 29), pp. 18–19. 

75   Reference in FN 40. 
76   Article 121(1)(e) of the Financial Regulation. 

23 

 
 
                                                                                                                                                                                     
reduce fraud risks still further77. Financing that is linked to outputs or results rather than costs 
and output-based lump sums largely remove the relevance of accounting for eligible costs and 
related risks of falsification and deceit. 

In parallel, the Commission services and executive agencies will have to avoid vulnerabilities 
regarding technical checks on whether all conditions have been met and the results achieved 
by  beneficiaries.  These  checks  need  to  be  thorough  and  effective  if  simplification  measures 
are to reduce fraudulent and non-fraudulent irregularities. 

Fraud risks at the point that lump sums are determined on the basis of estimated budgets also 
need  to  be  dealt  with.  In  procurement  and  possibly  also  in  cases  of  financing  not  linked  to 
costs or simplified forms of contributions (lump sums, unit costs and flat rates), further risks 
could  come  from  knowledge  gaps,  where  services  do  not  carry  out  preliminary  market 
consultations78 when preparing their calls for tenders or proposals. 

It should also be noted that dropping the requirement of time recording due to simplification 
will increase the importance of the control of the deliverables.  

5.2.6.  Financial instruments and budgetary guarantees 

Through  financial  instruments,  the  EU    directly  or  indirectly    provides,  or  contributes  to, 
funding  which  helps  to  attain  EU  policy  objectives  with  financial  support  in  the  form  of 
equity participation, loans, guarantees or other risk-sharing instruments. Financial instruments 
provide  benefits  such  as  a  high  degree  of  flexibility,  possibilities  to  bridge  investment  gaps 
and opportunities to combine EU funding with funds from national budgets and international 
organisations,  national  and  international  financial  institutions  and  private  investors.  As  a 
result,  financial  instruments  have  become  a  significant  delivery  model  for  the  EU  budget. 
During  the  2014-2020  programming  period,  EU  funds  invested  in  financial  instruments  are 
expected to amount to around EUR 9 billion in direct and indirect management79 and around 
EUR 21 billion in the European Structural and Investment Funds80. 

Most financial instruments are characterised by a contribution from the EU budget given to an 
entrusted  entity  –  usually  the  European  Investment  Bank  (EIB),  the  European  Investment 
Fund  (EIF)  or  another  international  financial  institution  such  as  the  European  Bank  for 
Reconstruction  and  Development  (EBRD).  It  can  also  be  a  national  promotional  bank  in  a 
Member  State  such  as  KfW  Group  in  Germany,  which  funds  projects  directly  or  indirectly, 
i.e.  through  other  financial  institutions  acting  as  financial  intermediaries  and  sub-
intermediaries or by  contributing to  an investment  fund or  ‘fund of funds’. Where possible, 

77   In  its  2016  annual  report  (reference  in  FN  25,  pp.  23-24),  the  European  Court  of  Auditors  underlines  the 
higher resilience of entitlement-based expenditure (which is based on the fulfilment of certain conditions) to 
error as compared to expenditure based on the reimbursement of eligible costs. 

78   As  noted  by  the  European  Court  of  Auditors,  preliminary  market  consultation  is  not  widely  practised  by 
Commission Services: ECA Special Report No 17/2016, The EU institutions can do more to facilitate access 
to their public procurement, Reference in FN 40, p. 27. 

79   Report from the Commission to the European Parliament and the Council of 25 September 2017 on financial 
instruments  supported  by  the  general  budget  according  to  Article 140.8  of  the  Financial  Regulation  as  at 
31 December 2016, COM(2017) 535 final, p. 6. 

80   Communication  from  the  Commission  of  14 December  2015,  Investing  in  jobs  and  growth  —  maximising 

the contribution of European Structural and Investment Funds, COM(2015) 639 final, p. 7. 

24 

 
 
                                                           
EU funding will be combined with investment capital made available by the entrusted entity, 
the  financial  intermediaries  and  sub-intermediaries  and  by  other  contributors  to  funds  and 
‘funds of funds’. 

Apart from the risk of possible misrepresentation by the final recipient, other fraud risks and 
systemic  vulnerabilities  may  be  present  at  each  level  of  the  financial  instrument’s 
implementation — from the Commission service, executive agency or (shared management) 
managing  authority  providing  the  EU  funding  over  the  entrusted  entity  to  financial  (sub-) 
intermediaries  and  fund  managers.  They  include,  in  particular,  risks  of  staff  misconduct, 
weaknesses  of  internal  control  systems  and  a  lack  of  coordination  of  control  priorities 
between the various actors involved at different levels of implementation.  

o  Staff misconduct could include misuse of confidential sensitive information. 

o  Some  of  the  implementation  partners,  especially  local  partners  of  entrusted  entities 
and  managing  authorities,  may  have  weak  administrative  capacities  and  internal 
control systems. 

o  Diverging  control  priorities  at  different  levels  of  implementation  could  affect  the 

effectiveness of anti-fraud controls.    

o  A  multitude  of  funding  schemes  branching  out  under  a  variety  of  programmes  may 

also increase the risk of double-funding. 

Despite those potential fraud risks, financial instruments do not rank high on services’ internal 
fraud risk assessments. In practice, those risks rarely seem to materialise, as confirmed by a 
low number of OLAF investigations in the field of financial instruments81. Mitigating factors 
that play an important role in this respect are: 

o 

the  alignment  of  entrusted  entities  and  intermediaries’  interests  as  they  often  invest 
with their own risk capital and therefore have an economic interest in the success of 
the portfolio of projects invested in; 

o 

the chain of partners intervening in the process which creates vulnerabilities and also 
multiple layers of control; and 

o  comprehensive and sophisticated anti-fraud policies put in place by entrusted entities, 

most notably by the EIB8283. 

81   At  the  end  of  2016  only  8  out  of  344  ongoing  OLAF  investigations  were  related  to  financial  instruments, 
which persistently ranked last out of 9 fields of investigation in 2014–2016, OLAF Report 2016 (reference in 
FN 29), p. 14. At the end of 2017, ongoing investigations related to financial instruments had advanced to 7th 
position (18 out of 362 investigations), but this should not be interpreted as a trend pointing to higher fraud 
risks, OLAF Report 2017 (reference in FN 21), pp. 13, 16. 

82   http://www.eib.org/infocentre/publications/all/anti-fraud-policy.htm?f=search&media=search 

25 

 
 
 
 
  
 
 
 
 
 
 
                                                           
Nevertheless, mitigation is not complete and should therefore be reinforced where a systemic 
issue emerges.84 

For budgetary guarantees, an assessment of related fraud risks has to factor in the reliability of 
the  counterpart  and  the  risk  profile  of  the  transactions  supported  by  the  guarantee.  Here  it 
should  be  noted  that  the  setting  of  the  risk  profile  is  in  itself  a  key  moment  of  risk.  An 
erroneous, possibly manipulated, setting  of the risk (i.e. setting the  risk at  an unrealistically 
low  level)  could  lead  to  a  substantial  loss  for  the  EU  budget.  It  has  to  be  ensured  that  the 
controls for this risk setting operation are sound. 

The largest guarantee issued by the EU budget is the one underpinning the European Fund for 
Strategic  Investments  (EFSI)85  whose  amount  is  limited  to  EUR  26  billion.  While  the  EIB 
Group is  a reliable counterpart, financing operations under the EFSI are  similar to  financial 
instruments,  except  that  related  operations  will  either  involve  no  funding  or  only  partial 
funding  from  the  EU  budget,  with  the  remaining  investment  coming  from  the  EIB  or  EIF, 
backed partially by the EU guarantee. 

Conclusions on financial instruments will therefore apply to a certain degree also to budgetary 
guarantees keeping in mind that the multitude of funding schemes will be reduced in the next 
MFF. In the longer run, it should be re-examined whether the implementation framework for 
budgetary  guarantees  is  in  line  with  their  increasing  importance  as  a  delivery  model  of  EU 
financial support. 

5.2.7.  External aid 

The Commission services responsible for external aid, namely 

o  Service for Foreign Policy Instruments (FPI); 
o  Directorate-General Neighbourhood and Enlargement Negotiations (DG NEAR); 
o  Directorate-General International Cooperation and Development (DG DEVCO); 
o  Directorate-General  European  Civil  Protection  and  Humanitarian  Aid  Operations 

(DG ECHO); 

work  in  particularly  complex  and  challenging  geographical,  political  and  organisational 
settings  which  entail  specific  vulnerabilities  to  fraud.  A  number  of  factors  make  up  the 
operational environment specific to the external relations sector, in particular: 

84 

83  Only  a  small  proportion  of  the  volume  of  EU-level  financial  instruments  is  managed  by  entrusted  entities 
outside  the  EIB  Group:  European  Court  of  Auditors,  Annual  report  on  the  implementation  of  the  budget 
concerning the financial year 2015, OJ C 375, 13.10.2016, paragraph 2.23. 
In  its  Annual  Report  2016  (reference  in  FN  25,  paragraphs  6.35,  6.41),  the  European  Court  of  Auditors 
pointed  to  the  need  for  improvements  in  the  audit  of  financial  instruments  under  shared  management.  See 
also  Annual  Report  2015  (preceding  FN),  Figure  6.9,  where  the  ECA  cited  the  example  of  a  financial 
intermediary that issued a loan for a company belonging to its own group, excluded from eligibility. 

85   Pursuant to Articles 8–13 of Regulation (EU) 2015/1017 of the European Parliament and of the Council of 
25 June 2015 on the European Fund for Strategic Investments, the European Investment Advisory Hub and 
the  European  Investment  Project  Portal  and  amending  Regulations  (EU)  No  1291/2013  and  (EU)  No 
1316/2013 — the European Fund for Strategic Investments, OJ L 169, 1.7.2015, p. 1, as amended. 

26 

 
 
 
 
                                                                                                                                                                                     
o  geographically  dispersed  activities,  including  in  areas  with  difficult  legal  and/or 

political conditions; 

o  varying  levels  of  efficiency  of  the  national  legal,  regulatory  and  institutional 
framework and of responsiveness and enforcement regarding fraud and corruption in 
the areas of operation; 

o  multiple  aid  instruments  and  delivery  models  under  different,  and  sometimes 

changing, management modes (direct/indirect management); 

o  a  large  volume  of  financial  management  performed  by  implementing  authorities  in 

non-EU countries; 

o  diversity  of  implementing  organisations  and  partner  countries  with  different 

management and control capacities; 

o  difficulties in exchanging information with those partners; 
o  a  high  number  of  operations  and  associated  financial  transactions  with  limited 
resources  to  ensure  full-scale  supervision,  and  strong  reliance  on  desk  reviews  at 
headquarters; and 

o  a mixed composition of staff in local operations, characterised by 

–  a high ratio of contract agents and local agents; 
– 
–  difficulties  in  attracting  staff  in  countries  marked  by  (post-)crisis  or  (post-) 

regular turn-over of officials and contract agents; and 

conflict situations. 

All  the  departments  concerned  have  put  in  place  comprehensive  anti-fraud  controls  such  as 
staff  training,  requirements  for  authorisation  by  headquarters,  vetting  of  implementing 
partners and upstream verification of a significant proportion of financial transactions under 
indirect  management.  Still,  the  great  variety  of  implementing  partners  and  limits  to  checks, 
notably regarding non-EU countries and international organisations, expose the EU budget to 
potential  weaknesses  as  regards  fraud  risk  management  by  such  implementing  partners. 
Similarly,  the  latest  OLAF  report  highlights  vulnerabilities  to  fraud  in  the  area  of 
humanitarian aid86. 

With  regard  to  EU  trust  funds,  the  European  Court  of  Auditors  has  called  for  more 
transparency in the selection of implementing organisations. It has also voiced concerns that 
implementing  organisations  being  represented  on  the  operational  committee  of  a  trust  fund 
could lead to potential conflicts of interest87. 

Untargeted  budget  support  is  an  element  of  the  increasing  part  of  EU  funding  that  is  not 
linked to the reimbursement of specific costs but to the fulfilment of ‘conditionalities’, which 
are in the external aid context of a political, social or economic nature This feature is shared 
by  macro-financial  assistance  managed  by  the  Directorate  General  Economic  and  Financial 
Affairs  (DG  ECFIN).  Difficulties  in  verifying  such  pre-conditions  for  support  in  a  non-EU 
country need to be anticipated. 

86  OLAF Report 2017 (reference in FN 21), pp. 21–22. 
87   ECA  Special  Report  11/2017,  The  Bêkou  EU  trust  fund  for  the  Central  African  Republic:  a  hopeful 

beginning despite some shortcomings, paragraphs 39-42. 
https://www.eca.europa.eu/Lists/ECADocuments/SR17_11/SR_BEKOU_EN.pdf 

27 

 
 
                                                           
 
Financial  instruments  are  widely  used  in  the  external  aid  sector.  They  have  recently  been 
complemented  by the European  Fund for Sustainable Development88, an investment  vehicle 
backed  by  a  guarantee  from  the  EU  budget,  similar  to  the  EFSI.  In  this  respect,  the  risk 
assessment  for  financial  instruments  and  budgetary  guarantees  in  the  preceding  section 
applies with the proviso that the involvement of a broad spectrum of implementing partners 
from the external aid sector, including bodies governed by private law in a Member State or 
partner country, may carry additional risks. 

5.2.8.  Cybersecurity 

As mentioned in Section 4.2.4. (p. 14), risks related to the adequacy of measures to prevent 
and respond to IT security are among the top critical risks for the Commission as a whole. 

Cybersecurity risks in general are increasing exponentially. Studies suggest that the economic 
impact  of cybercrime rose fivefold between 2013 and 2017, and could  further quadruple by 
201989.  Cybersecurity  incidents  are  diversifying  both  in  terms  of  who  is  responsible 
(fraudsters, hacktivists, state actors but also insiders in organisations) and what they seek to 
achieve  (data  breach  or  identity  theft,  political  attention  or  defamation,  theft  of  confidential 
information or dissemination of incorrect information, theft of user and administrator log-ins 
and  passwords  to  manipulate  financial  circuits  or  databases  used  for  internal  reporting,  and 
many other purposes). Tools available within the deep web or darknet (‘crime-as-a-service’) 
make it easier for potential perpetrators to acquire cyberattack capabilities. 

Such risks are increasingly relevant to the Commission and other EU institutions and bodies 
due to the increased use of IT systems supporting EU policies, as required notably by the EU 
e-Government  action  plan  for  2016-202090  and  in  Articles  146–149  of  the  Financial 
Regulation. 

The Commission has responded at policy level in a number of ways. It adopted the 2013 EU 
cybersecurity strategy91 and proposed the NIS Directive92. It also recently adopted initiatives 
such as  a reform of the  EU Agency for Network and  Information  Security,  a Cybersecurity 
Certification  Framework,  a  Cybersecurity  Emergency  Response  Fund  and  a  European 
Cybersecurity Research and Competence Centre. Further details of this policy response can be 
found  in  a  Joint  Communication  with  the  High  Representative  of  the  Union  for  Foreign 
Affairs and Security Policy of 13 September 201793. 

88   Regulation  (EU)  2017/1601  of  the  European  Parliament  and  of  the  Council  of  26 September  2017 
establishing  the  European  Fund  for  Sustainable  Development  (EFSD),  the  EFSD  Guarantee  and  the  EFSD 
Guarantee Fund, OJ L 249, 27.9.2017, p. 1. 
Joint  Communication  from  the  Commission  and  the  High  Representative  of  the  Union  for  Foreign  Affairs 
and  Security  Policy  of  13 September  2017,  Resilience,  Deterrence  and  Defence:  Building  strong 
cybersecurity for the EU, JOIN (2017) 450, p. 2. 

89 

90   COM(2016) 179 final. 
91   JOIN (2013) 1 final. An assessment of this strategy is available in SWD (2017) 295. 
92   Directive  (EU)  2016/1148  of  the  European  Parliament  and  of  the  Council  of  6 July  2016  concerning 
measures  for  a  high  common  level  of  security  of  network  and  information  systems  across  the  Union,  
OJ L 194. 19.7.2016, p. 1. 

93  See FN 89. 

28 

 
 
                                                           
At managerial level, the Commission has put in place a new information security governance 
structure, which provides the foundation for a prioritised and business-driven development of 
IT  security  capabilities.  Already  in  2015,  following  recommendations  by  the  Internal  Audit 
Service,  the  Commission  created  an  Information  Security  Steering  Board,  chaired  by  a 
Deputy  Secretary-General  and  reporting  to  the  Corporate  Management  Board  at  corporate 
level.  Inter-service  coordination  between  the  lead  services  —  the  Secretariat  General,  the 
Directorate-General  for  Human  Resources  and  Security  and  the  Directorate-General  for 
Informatics, has thus been reinforced. In November 2016, the Information Security Steering 
Board  adopted  an  IT  security  strategy  for  the  European  Commission.  In  2017,  the 
Commission reviewed and updated its rulebooks94 to improve implementation of IT security 
controls  in  a  way  which  addresses  critical  risks  and  meets  business  priorities.  Finally,  in 
November  2018, the  European Commission  Digital  Strategy95 created  a new internal  policy 
framework for a digitally transformed Commission by 2022, whose working methods should 
be  embedded  in  a  sound  data  ecosystem,  which  is  adequately  protected  from  cyber  threats. 
The implementation of the strategy will be overseen by the new Information Technology and 
Cybersecurity Board, a subgroup of the Corporate Management Board96; it is taking over the 
responsibilities of the Information Security Steering Board and other actors. 

Despite  these  actions,  because  of  the  rapidly  evolving  threat  landscape,  the  Commission 
remains exposed to a critical risk from politically or economically motivated criminal actors. 
Lower-level  risks  come  from  factors  such  as  the  outsourcing  of  IT  services,  opportunistic 
non-targeted attacks such as phishing attempts and the management of IT access rights. 

5.3. 

Integrity and compliance 

The effectiveness of even the best anti-fraud procedures could be undermined if integrity and 
compliance of staff were weak. Real and apparent lapses in integrity and impartiality also risk 
harming the institutions’ reputation in a particularly serious way. 

With  this  in  mind,  Commission  services  have  ranked  undeclared  conflicts  of  interest  and 
breaches  of  confidentiality  as  high  in  their  internal  fraud  risk  assessments.  However,  that 
ranking  does  not  imply  an  elevated  likelihood  of  conflict  of  interest  or  breaches  of 
confidentiality97 and the Commission has no evidence of a high rate of such infringements at 
corporate level98. 

94  Commission  Decision  (EU,  Euratom)  2017/46  of  10 January  2017  on  the  security  of  communication  and 
information  systems  in  the  European  Commission,  OJ  L  6,  11.1.2017,  p.  40,  and  Commission  Decision  C 
(2017) 8841 of 13 December 2017 laying down implementing rules for Articles 3, 5, 7, 8, 9, 10, 11, 12, 14, 
15 of Decision 2017/46 on the security of communication and information systems in the Commission. 
95   Communication to the Commission of 21 November 2018, European Commission Digital Strategy, A 

digitally transformed, user-focused and data-driven Commission, C(2018) 7118 final. 

96   See Commission Decision of 21 November 2018 on the Corporate Management Board, C(2018) 7706 final. 
97  See Section 4.2.3., pp. 12-13. 
98 

In  certain  decentralised  agencies  the  European  Court  of  Auditors  found  shortcomings  where  the  audited 
agencies applied specific expert selection and grant award procedures based on exemptions in the founding 
regulation. As a result of this practice, there were risks to the principles of equal treatment and transparency 
and  issues  on  potential  conflicts  of  interest  had  not  been  fully  addressed:  Special  Report  No  12/2016, 
Agencies’ use of grants: not always appropriate or demonstrably effective, paragraphs 32–38,    
https://www.eca.europa.eu/Lists/ECADocuments/SR16_12/SR_GRANTS_EN.pdf. 

29 

 
 
                                                           
Regarding  the  framework  in  place  to  ensure  staff  adhere  to  ethical  conduct,  a  number  of 
measures have been taken since the 2011 CAFS: 

o  Far-reaching  amendments  to  the  Staff  Regulations  entered  into  force  on  1 January 
201499.  That  reform  tightened  the  rules  on  the  professional  ethics  of  EU  staff,  for 
example in the following areas: 

–  conflict  of  interest,  notably  avoidance  of  conflicts  of  interest  when  a  staff 
member  is  recruited  or  reintegrated  after  a  leave  on  personal  grounds 
(Article 11, third and fourth paragraph); 
lobbying activities by senior officials after leaving the service (Article 16, third 
and fourth paragraph); and 

– 

–  whistle-blowing,  for  which  institutions  are  required  to  adopt  implementing 

rules and procedures and to inform staff accordingly (Article 22c). 
o  The  Commission  adopted  guidelines  on  whistle-blowing  already  in  2012100  and  was 

the first EU institution to do so; 
At  the  time  of  the  Staff  Regulations  reform,  the  Commission  revised  its  rules  on 
outside activities of staff members101, thereby strengthening its prevention of conflicts 
of interest. Since then, the rules have been updated once again102. 

The  Commission’s  staff  is  also  strongly  encouraged  to  participate  in  the  diverse  range  of 
training  available  on  professional  ethics.  Therefore,  the  Commission  does  not  identify  any 
particular  weaknesses  of  the  rules  of  staff  conduct  or  the  way  those  rules  are  applied. 
However, the ECA’s ongoing audit of the Commission’s ethical framework should help refine 
that analysis. 

The Commission has recently revised the code of conduct  for its members103, strengthening 
safeguards  for  impartiality  of  Commissioners,  for  instance  through  an  extended  cooling-off 
period for post-mandate activities and greater transparency on financial interests. 

Furthermore,  the  EU  legislator  and  the  Commission  have  taken  steps  to  apply  some  of  the 
rules that protect integrity in managing the EU budget to staff working for national authorities 
and other actors in the Member States. Apart from sectoral legislation, this drive is reflected 
in: 

o  Article 61  of  the  new  Financial  Regulation,  which  explicitly  extends  the  concept  of 
conflict of interest to those involved in shared management at Member State level; and 
the  Commission’s  proposal  for  a  Directive  of  the  European  Parliament  and  of  the 
Council on the protection of persons reporting on breaches of EU law104. 

o 

99  Regulation (EU, Euratom) No 1023/2013 of the European Parliament and of the Council of 22 October 2013 
amending  the  Staff  Regulations  of  Officials  of  the  European  Union  and  the  Conditions  of  Employment  of 
Other Servants of the European Union, OJ L 287, 29.10.2013, p. 15. 

100  Communication  from  Vice-President  Šefčovič  to  the  Commission  on  guidelines  on  whistle-blowing, 

SEC (2012) 679. 

101  Commission Decision of 16 December 2013 on outside activities and assignments, C (2013) 9037. 
102  Commission Decision of 29 June 2018 on outside activities and assignments and on occupational activities 

after leaving the Service, C (2018) 4048. 

103  Commission  Decision  of  31 January  2018  on  a  Code  of  Conduct  for  the  Members  of  the  European 

Commission, C (2018) 700 final, OJ C 65, 21.2.2018, p. 7. 

30 

 
 
 
                                                           
5.4.  Know-how and equipment 

Services' resilience to fraud also depends on their staff members’ awareness of fraud risks and 
on staff members’ skills in counteracting attempts at fraud. Therefore, awareness-raising and 
training already featured in the 2011 CAFS105. 

Numerous training activities continue to be carried out by OLAF and other departments. 

o  The  Commission’s  permanent  anti-fraud 

training  programme  comprises  an 
introductory course for all staff and an advanced class for auditors and investigators.

o  That  programme  is  complemented  by  training  given  by  OLAF  for  the  staff  of 
individual Directorates-General (including in the EU delegations), executive agencies, 
decentralised  agencies,  Civilian  Common  Foreign  and  Security  Policy  (CFSP) 
Missions    European  Union  Special  Representatives  and  other  EU  institutions  and 
bodies.  Many  Commission  departments  have  developed  local  awareness-raising 
measures as part of their service-level anti-fraud strategies.   

o  OLAF  and  other  Commission  departments  also  organise  training  for  the  staff  of 
Member  State  authorities  and  take  part  in  knowledge-sharing  events  in  the  Member 
States. 

o  Occasionally,  OLAF  trains  the  staff  of  international  organisations  and  other 

implementing partners. 

Further awareness-raising activities include: 

o  developing and maintaining a comprehensive Commission-internal anti-fraud website; 

and 

o  encouraging and/or facilitating the exchange of views and best practice: 

–  between representatives of Commission services and executive agencies in the 

Commission’s Fraud Prevention and Detection Network; 

–  with  and  among  staff  members  of  decentralised  agencies  and  similar  EU 

bodies in the Inter-Agency Network; and 

–  with  and among experts  from  the Member States in  the Advisory Committee 

for the Coordination of Fraud Prevention. 

Nevertheless,  according  to  the  internal  fraud  risk  assessment,  43 %  of  the  participating 
services  identified  insufficient  know-how  as  a  fraud  vulnerability.  The  Commission 
departments responsible for external aid, seconded by the European External Action Service, 

104  COM(2018)  218.  See  also  Communication  from  the  Commission  to  the  European  Parliament,  the  Council 
and the European Economic and Social Committee of 23 April 2018, Strengthening whistleblower protection 
at EU level, COM(2018) 214. 

105  2011 CAFS (reference in FN 5), p. 13. 

31 

 
 
 
 
 
 
 
 
 
                                                                                                                                                                                     
put special emphasis on training needs in the delegations, including for Heads of Delegation, 
as well as in the civilian CFSP missions and in the offices of EU Special Representatives. The 
Commission  departments  responsible  for  shared  management  underlined  the  importance  of 
continued  awareness-raising,  training  and  professionalisation  efforts  for  the  benefit  of  staff 
working in Member States, and so does the Commission for public procurement, taxation and 
customs matters106. 

The limited availability of appropriate data mining tools and of certain types of hardware (e.g. 
X-ray scanners for border controls) may also expose the EU budget to risks. 

Through relevant spending programmes, notably the new EU anti-fraud programme proposed 
by  the  Commission  (provided  it  is  approved  by  the  co-legislators)107,  the  Commission  will 
continue to co-finance awareness-raising measures and anti-fraud tools and equipment, such 
as data mining and optical scanning tools, for national authorities. 

5.5.  Transparency 

The public’s access to data on public financial management is a tool in the fight against fraud, 
because — up to a certain degree that will depend on the scope of public access — it allows 
civil  society  and  media  to  police  the  propriety  of  transactions  such  as  contract  and  grant 
awards. Transparency was therefore already an integral part of the 2011 CAFS108. 

As required by Article 38 of the Financial Regulation, the Commission operates a ‘Financial 
Transparency System’109, which gives the public access to some information on recipients of 
EU funding under direct management. The Commission has also committed to supporting the 
International  Aid  Transparency 
timely, 
comprehensive and forward-looking publication of aid information. 

(IATI)110,  which  promotes 

Initiative 

the 

However,  the  Financial  Transparency  System  is  limited  to  direct  management  and  does  not 
contain  detailed  information  on  contracts  and  grant  agreements,  tenders  and  grant 
applications,  or  the  terms  of  a  financial  instrument.  Providing  such  detailed  information 
would  open  up  far  greater  possibilities  of  analysing  the  conduct  of  spending  services  but 
would  have  to  be  weighed  against  the  rights  of  entities  and  persons  concerned.  Data 
protection legislation must be respected, and further measures, also protecting organisations, 
might be necessary in some cases. 

106  Communication from the Commission to the European Parliament, the Council, the European Economic and 
Social Committee and the Committee of the Regions  of 3 October 2017, Making Public Procurement work 
in and for Europe, COM(2017) 572, p. 9.  
Communication from the Commission to the European Parliament, the Council and the European Economic 
and Social Committee of 7 April 2016 on an action plan on VAT, Towards a single EU VAT area — Time to 
decide, COM(2016) 148, p. 7. 

107  Commission Proposal for a Regulation of the European Parliament and of the Council establishing the EU 

Anti-Fraud Programme of 30 May 2018, COM(2018) 386 final. 

108  2011 CAFS (reference in FN 5), p. 17. 
109  https://ec.europa.eu/info/about-european-commission/service-standards-and-principles/transparency/funding-

recipients_en 

110  https://www.aidtransparency.net/ 

32 

 
 
                                                           
5.6.  Legal framework 

‘Fraud-proofing’  the  legal  framework,  i.e.  optimising  its  resilience  to  fraud,  corruption  and 
other  irregularities,  has  long  been  part  of  the  Commission’s  anti-fraud  policy,  including  the 
2011 CAFS111. In practice, fraud-proofing should be fostered both through awareness-raising 
and the training of staff working in policy-making departments and by consulting OLAF from 
an early stage of the drafting process. 

Fraud-proofing  is  not  limited  to  legislation.  It  must  extend  to  implementing  rules,  model 
contracts/agreements,  procedures,  workflows,  etc.  While  the  2011  CAFS  established  anti-
fraud  clauses  in  the  basic  acts  of  spending  programmes112,  the  legislation  governing  the 
programming period after 2020 will have an all-encompassing provision on the protection of 
the  EU’s  financial  interests  (Article 129  of  the  revised  Financial  Regulation).  The 
requirements regarding access rights for the competent EU institutions, bodies and offices laid 
down in that provision will have to be clarified and implemented in the non-legislative legal 
documentation of the different spending programmes and funding mechanisms to avoid legal 
uncertainty and to ensure swift checks, audits and investigations in cases of suspected fraud. 

Another feature of the new programming period  — partly already present in the current and 
even the past one, though to a far lesser extent — will be an emphasis on lump sums and/or 
financing  not  linked  to  costs  in  direct  and  shared  management.  In  the  external  aid  sector, 
instruments  like  budget  support  and  macro-financial  assistance  (MFA)113  take  a  similar 
approach and are also  widely used. The main characteristic of such funding schemes is  that 
funding  depends  on  the  recipient  fulfilling  certain  conditions  rather  than  providing  proof  of 
the eligible costs they incurred. Where these forms of funding involve pre-financing114, there 
is  a  risk  that  fraudulent  non-/under-delivery  of  the  agreed  conditions  (by  a  recipient  who 
never  intended  to  meet  the  conditions)  may  go  undetected.  This  risk  may  be  aggravated  by 
reduced possibilities to verify the recipient’s operations. Therefore, in the framework of lump 
sums  and  financing  not  linked  to  costs,  there  is  a  need  to  develop  –  across  the  different 
management  modes  –  control  strategies  for  deliverables  and  for  the  analysis  of  non-/under 
delivery with a view to detecting fraud. 

Fraud-proofing also has to look into the legal framework for investigating fraud. The setting 
up  of  the  European  Public  Prosecutor’s  Office115  and  the  ongoing  transposition  and 
implementation  of  the  PIF  Directive  significantly  improve  the  legal  framework  for  the 
protection of the EU’s financial interests by means of criminal law. The recent evaluation of 
the  OLAF  Regulation116  concluded  that  it  allowed  OLAF  to  deliver  concrete  results  in 

111  2011  CAFS  (reference  in  FN  5),  p.  8  (‘Fraud  prevention’  —  ‘design  of  spending  programmes’).  See  also 
Communication  from the Commission to the Council, the  European Parliament and the  European Court of 
Auditors,  Prevention  of  fraud  by  building  on  operational  results:  a  dynamic  approach  to  fraud-proofing, 
COM(2007) 806 final, with further references. 

112  Reference in FN 5, p. 9. 
113  MFA is an exceptional financial instrument of untied and undesignated balance-of-payments support. 
114  MFA does not use pre-financing. 
115  Council  Regulation  (EU)  2017/1939  of  12 October  2017  implementing  enhanced  cooperation  on  the 

establishment of the European Public Prosecutor’s Office (‘the EPPO’), OJ L 283, 31.10.2017, p. 1. 

116  Report from the Commission to the European Parliament and the Council of 2 October 2017, Evaluation of 
the application of Regulation (EU, EURATOM) No 883/2013 of the European Parliament and of the Council 

33 

 
 
                                                           
protecting the EU budget. The 2013 changes brought about clear improvements in the conduct 
of  investigations,  in  cooperation  with  partners  and  in  the  rights  of  persons  concerned.  The 
evaluation also identified certain shortcomings in the application of the Regulation that reduce 
the effectiveness of OLAF investigations and thus the EU’s fight against fraud. Shortcomings 
that should be addressed in the short term concern, in particular: 

o  Conducting on-the-spot checks and inspections; 
o  Assistance of national competent authorities before and during an investigation; 
o  Access to information on bank accounts; and 
o  OLAF's tools for the investigation of VAT fraud. 

The Commission has consequently tabled a proposal to amend the OLAF Regulation117. The 
amendments  proposed will  allow OLAF  to  cooperate closely with  the EPPO and to  operate 
more effectively in its investigations. 

Finally,  a  sound  legal  framework  is  essential  in  international  cooperation  beyond  the 
territorial  scope  of  the  EU  Treaties.  In  a  world  with  global  trade,  financial,  travel  and  data 
flows, fraud takes on a globalised perspective and so too should the fight against fraud. The 
EU’s  external  borders  often  set  limits  to  cooperation  and  investigation,  so  OLAF’s 
competences  need  a  basis  in  international  instruments  (or  ad-hoc  permission)  for  any 
investigation outside the territory of EU Member States. 

Consequently,  agreements  with  non-EU  countries  and  international  organisations  normally 
have a clause on the protection of EU financial interests. OLAF investigations can sometimes 
be  conducted  more  easily  where  Administrative  Cooperation  Arrangements  —  concluded 
between  OLAF  and  a  non-EU  country  or  an  international  organisation  —  lay  down 
implementing  rules.  Aside  from  investigative  purposes,  international  agreements  may  also 
serve  to  set  up  data  exchange  between  administrations,  which  is  often  crucial  for  fraud 
prevention and detection. A notable example is the WHO Protocol to Eliminate Illicit Trade in 
Tobacco Products, which has been ratified by the EU118 but not yet by all Member States. 

While the network of international cooperation in the fight against fraud is far from complete, 
every international cooperation agreement helps to close a loophole. 

of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and 
repealing  Regulation  (EC)  No  1073/1999  of  the  European  Parliament  and  of  the  Council  and  Council 
Regulation (Euratom) No 1074/1999, COM(2017) 589 final. 
Commission Staff Working Document of 2 October 2017, EVALUATION of the application of Regulation 
(EU,  EURATOM)  No  883/2013  of  the  European  Parliament  and  of  the  Council  of  11 September  2013 
concerning  investigations  conducted  by  the  European  Anti-Fraud  Office  (OLAF)  and  repealing  Regulation 
(EC) No 1073/1999 of the European Parliament and of the  Council and  Council Regulation (Euratom) No 
1074/1999,  Accompanying  the  document  Commission  report  to  the  European  Parliament  and  the  Council, 
SWD (2017) 332. 

117  Commission  Proposal  of  23 May  2018  for  a  Regulation  of  the  European  Parliament  and  of  the  Council 
amending  Regulation  (EU,  Euratom)  No  883/2013  concerning  investigations  conducted  by  the  European 
Anti-Fraud  Office  (OLAF)  as  regards  cooperation  with  the  European  Public  Prosecutor’s  Office  and  the 
effectiveness of OLAF investigations, COM(2018) 338. 

118  Council Decision (EU) 2017/1749 of 17 June 2016 on the conclusion, on behalf of the European Union, of 
the Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation’s Framework 
Convention on Tobacco Control,  with the exception of its provisions falling within the scope of Title V of 
Part Three of the Treaty on the Functioning of the European Union, OJ L 268, 1.10.2016, p. 1. 

34 

 
 
 
 
                                                                                                                                                                                     
 
6. 

Revenue fraud 

Revenue fraud affects traditional own resources and value added tax. In this type of fraud, the 
harm done by organised crime groups is especially significant119. 

6.1.  Traditional own resources (TOR) 

Fraud  in  the  area  of  TOR  does  considerable  damage  to  the  EU  budget.  In  2016,  the  fraud 
detection  rate  of  0.33 %  in  TOR  exceeded  the  0.21 %120  fraud  detection  rate  on  the 
expenditure side of the budget. Even though the ‘gap’ was narrower121, this trend continued in 
2017  (0.30 %  against  0.29 %).  The  detected  fraud  mainly  concerned  anti-dumping, 
countervailing  and  other  customs  duties.  Fraud  may  be  committed  through  smuggling,  for 
example  cigarette  smuggling,  especially  trafficking  in  non-branded  cigarettes  (‘cheap 
whites’)122.  Fraud  may  also  occur  through  the  false  declaration123  of  the  origin  of  imported 
goods,  of  the  value  of  goods  (undervaluation)  or  of  their  classification  under  the  Combined 
Nomenclature124,  pursuant  to  Article 57  of  the  Union  Customs  Code125.  It  can  also  take  the 
form of ‘transit fraud’ — situations where goods are declared to be only transiting through the 
EU but in reality never leave the EU126. 

Three  Commission  departments  (DG  TAXUD,  DG  BUDG  and  OLAF)  share  the  main 
responsibilities in this area. 

Policy-making  is  mainly  the  responsibility  of  the  Commission’s  Directorate-General  for 
Taxation  and  Customs  Union  (DG  TAXUD).  A  new  Union  Customs  Code  has  been  in 
application since 1 May 2016. It aims to: 

o  streamline customs procedures; 
o  harmonise the implementation of customs legislation; 
o  better protect the internal market from safety, security and other threats linked with the 

flow of goods across the external borders; and 

o  better safeguard the financial interests of the EU and the Member States. 

While the implementation of the Customs Union is primarily the responsibility of the Member 
States,  DG  TAXUD  works  towards:  (i)  all  Member  States  and  the  Commission  sharing  an 
overall  vision;  (ii)  a  more  effective  enforcement  of  the  rules;  and  (iii)  a  stronger  role  for 
customs in joined-up border management and law enforcement. 

119  OLAF' Report 2016, p. 19: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2016_en.pdf 
120  PIF  Report  2016  (reference  in  FN  57),  p.  15.  The  fraud  detection  rate  measures  the  financial  impact  of 
detected fraud as a proportion of total revenue or expenditure. It is determined for the budget as a whole and 
for particular sectors. 

121  Detection  rates  for  years  2016  and  2017  do  not  take  into  account  the  UK  undervaluation  case  which  is 

explained in OLAF Report 2017 (reference in FN 21), pp. 26-27. 

122  OLAF Report 2016 (reference in FN 29), p. 20-21. 
123  OLAF Report 2016 (reference in FN 29), p. 19. 
124  Explanation  available  at  https://ec.europa.eu/taxation_customs/business/calculation-customs-duties/what-is-

common-customs-tariff/classification-goods_en. 

125  Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down 

the Union Customs Code, OJ L 269, 10.10.2013, p. 1. 

126  OLAF Report 2017 (reference in FN 21), p. 28. 

35 

 
 
 
                                                           
The Commission’s Directorate-General for Budget (DG BUDG) exercises the Commission’s 
powers to inspect how Member States comply with their responsibilities in the area of TOR, 
how they respect relevant EU legislation and protect the EU’s financial interests. DG BUDG 
also  assists  Member  States  in  improving  their  control  systems  to  mitigate  fraud  risks  and 
ensures the recovery to  the EU budget  of any TOR  losses for which the Member States are 
responsible. 

OLAF  investigates  customs  fraud  cases  and  cooperates  with  Member  States  and  non-EU 
countries to prevent them. OLAF also organises or supports joint customs operations with the 
Member  States  and  non-EU  countries  to  combat  illicit  cross-border  trafficking  in  specific 
goods. OLAF also has a unique administrative investigative mandate in the fight against the 
illicit tobacco trade. OLAF coordinates anti-tobacco-smuggling operations carried out by law 
enforcement  agencies  across  Europe  and  works  to  ensure  that  evaded  duties  are  recovered, 
that criminal smuggling networks are dismantled and that perpetrators are brought to justice. 

OLAF  and  DG  TAXUD  work  together  to  keep  the  legal  framework  up-to-date  to  enable 
effective  mutual  administrative  assistance  between  Member  States  and  cooperation  between 
them and the Commission to combat customs fraud. 

A 2016 audit by the Commission’s Internal Audit Service (IAS) looked at anti-fraud policies 
in the area of TOR. The IAS observed a lack of consistency and coordination in the strategies 
and activities of the Commission departments responsible for TOR and a lack of emphasis on 
TOR issues in the Commission’s anti-fraud strategy. 

In the meantime, the Commission departments concerned have taken action to remedy these 
shortcomings. This includes the following initiatives: 

o  DG TAXUD, DG BUDG and OLAF have intensified their cooperation, especially on 
undervaluation127, risk management and other fraud-related issues. A strategic steering 
function on fraud prevention and detection for TOR at directors’ level was established 
in 2017. The aim is to regularly discuss strategic policy issues to protect the revenue 
side of the budget. The three departments also coordinate their anti-fraud activities in 
the  newly  created  ad-hoc  subgroup  on  TOR  of  the  Fraud  Prevention  and  Detection 
Network; 

o  In  cooperation  with  DG  TAXUD  and  DG  BUDG,  OLAF  has  revised  its 
methodological  guidance  on  anti-fraud  strategies  with  an  addendum  in  the  area  of 
TOR, which was endorsed in 2017 by the Fraud Prevention and Detection Network’s 
ad-hoc subgroup on TOR; 

o  DG TAXUD adopted a new anti-fraud strategy in 2018, and DG BUDG is planning to 

do so in 2019, after the review of the CAFS coordinated by OLAF. 

127  Following  a  string  of  large-scale  investigations  in  this  area,  see  OLAF  Report  2017  (reference  in  FN 21), 

pp. 26–27. 

36 

 
 
 
 
 
 
                                                           
Thanks  to  this  new  framework  for  cooperation,  further  work  on  assessing  specific 
TOR-related  fraud  risks,  on  collecting,  exchanging  and  analysing  customs-related  data,  on 
training for Commission staff and on capacity building in Member States, will be even more 
effective and efficient in the future. 

6.2.  Value added tax (VAT) 

In  the  area  of  VAT,  it  is  estimated  that  cross-border  fraud,  such  as  ‘missing  trader’  or 
‘carousel’ fraud128, generates budgetary losses of around EUR 50 billion a year129. However, 
most of this is borne by the Member States. 

In  this  respect,  the  Commission  has  found  serious  shortcomings  in  the  current  system  of 
value-added  taxation  of  cross-border  transactions  that  make  it  vulnerable  to  fraud.  The 
Commission  has  outlined  its  preferred  way  forward130  and  presented  long  and  short-term 
solutions,  including  improvements  to  the  rules  governing  cooperation  with  and  among  the 
Member States. 

While the long-term solutions aim at a more fraud-proof, definitive VAT system for the EU, 
the short-term projects focus on improving the rules governing cooperation with and among 
the Member States. Such improvements would include joint administrative enquiries in cross-
border cases and an enhanced information exchange, both among Member States and between 
the latter and Europol, OLAF and the EPPO, once set up. 

128  Explained  in  Europol’s  2017  EU  Serious  and  Organised  Crime  Threat  Assessment  (reference  in  FN  32),  

p. 44. 

129  Communication from the Commission to the European Parliament, the Council and the European Economic 
and Social Committee of 7 April 2016 on an action plan on VAT, Towards a single EU VAT area — Time to 
decide, COM(2016) 148, p. 3. 

130  Communication from the Commission to the European Parliament, the Council and the European Economic 
and Social Committee of 4 October 2017, On the follow-up to the Action Plan on VAT, Towards a single EU 
VAT area — Time to act, COM(2017) 566 final. 

37