COMMISSION STAFF WORKING DOCUMENT Accompanying the document Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2019/1153 of the European Parliament and of the Council, as regards access of competent authorities to centralised bank account registries through the single access point
Date: 2021-07-20
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: account, banking, cross-border cooperation, exchange of information, fight against crime, information system, money laundering, offence, organised crime, terrorism financing

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 20.7.2021  SWD(2021) 210 final  COMMISSION STAFF WORKING DOCUMENT   Accompanying the document Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2019/1153 of the European Parliament and of the Council, as regards access of competent authorities to centralised bank account registries through the single access point {COM(2021) 429 final}  
 
 
1.  BACKGROUND 

Pursuant to Article 32a of the Fifth anti-money laundering directive1, Member States are 
to put in place by 10 September 2020 national centralised automated mechanisms, such 
as  central  registries  or  central  electronic  data  retrieval  systems,  which  allow  the  timely 
identification  of  any  natural  or  legal  person  holding  or  controlling  payment  accounts, 
bank  accounts  or  safe  deposit  boxes.  Article  32a(2)  provides  the  national  Financial 
Intelligence Units (FIUs)2 with immediate and unfiltered access to this data. It highlights 
that other competent authorities should also have access in order to fulfil their obligations 
under the Anti-money Laundering Directive. 

Directive 2019/11533 already at present extends the scope of authorities able to directly 
access  the  nationalcentralised  automated  mechanisms  (referred  to  in  Directive  (EU) 
2019/1153 as bank account registries, term used hereafter), by requiring Member States 
to designate the national authorities competent for the prevention, detection, investigation 
or  prosecution  of  criminal  offences  that  should  be  empowered  to  access  and  search 
directly  the  minimum  set  of  information  contained  in  the  centralised  bank  account 
registries.  It  also  requires  them  to  include  asset  recovery  offices  (AROs)4  among  their 
designated competent authorities and enables Member States to designate tax authorities 
and  anti-corruption  agencies  as  competent  authorities  to  the  extent  that  these  are 
competent for the prevention, detection, investigation or prosecution of criminal offences 
under national law. The Directive also sets out that access to the centralised bank account 
registries  shall  be  provided  for  the  purposes  of  preventing,  detecting,  investigating  or 
prosecuting a serious criminal offence.5  

Pursuant to the Commission’s proposal for a new anti-money laundering directive, which 
is  being  presented  alongside  the  proposal  amending  Directive  (EU)  2019/1153  of  the 
European  Parliament  and  of  the  Council,  as  regards  access  of  competent  authorities  to 
centralised bank account registries through the single access point, Member States  shall 
ensure that the information from centralised bank account registries is available through 

1   Directive  (EU)  2015/849  of  the  European  Parliament  and  of  the  Council  of  20  May  2015  on  the 
prevention  of  the  use  of  the  financial  system  for  the  purposes  of  money  laundering  or  terrorist 
financing, amending  Regulation (EU) 648/2012 of the  European Parliament and of the  Council, and 
repealing  Directive  2005/60/EC  of  the  European  Parliament  and  of  the  Council  and  Commission 
Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73). 

2   FIUs  are  operationally  independent  and  autonomous  units  with  the  authority  and  capacity  to  take 
autonomous  decisions  to  analyse,  request  and  disseminate  their  analyses  to  competent  authorities, 
where there are grounds to suspect money laundering, associated crimes or terrorist financing. Member 
States are required to set up FIUs in accordance with Article 32 of Directive (EU) 2015/849. 

3   Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down 
rules facilitating the use of financial and other information for the prevention, detection, investigation 
or prosecution of certain criminal offences (OJ L186 of 11.7.2019, p. 122-137). 

4   Asset  Recovery  Offices‘(AROs)  support  criminal  investigations  by  facilitating  the  tracing  and 
identification of proceeds of crime in view of their possible freezing and confiscation by a competent 
judicial  authority.  The  AROs  operate  as  national  central  points  for  the  exchange  of  information  on 
assets (e.g. bank accounts, real estate, registered vehicles, businesses and company shares) between the 
Member  States.  They  should  be  able  to  identify  assets  located  in  their  territories  upon  request  from 
another ARO. AROs have been established by Council Decision 2007/845/JHA of 6 December 2007 
concerning cooperation between Asset Recovery Offices of the Member States in the field of tracing 
and identification of proceeds from, or other property related to, crime (OJ L 332, 18.12.2007, p. 103). 
5   Article  4(1).  According  to  Art.  2(12)  of  the  Directive,  serious  criminal  offence  means  the  forms  of 

crime listed in Annex I to Regulation (EU) 2016/794 (Europol Regulation). 

1 

 
 
                                                 
the bank account registers (BAR) single access point to be developed and operated by the 
Commission.  By  interconnecting  centralised  bank  account  registries,  authorities  with 
access  to  the  BAR  single  access  point  would  be  able  to  establish  quickly  whether  an 
individual  holds  bank  accounts  in  other  Member  States  without  having  to  ask  all  their 
counterparts in all Member States. In line with its legal basis (Article 114 of the Treaty 
on  the  Functioning  of  the  European  Union  (TFEU)),  the  new  anti-money  laundering 
directive will provide access  to  the BAR single  access  point only to FIUs, the national 
body  which  receives  suspicious  transaction  reports  from  obliged  entities6  and  forwards 
them, as appropriate, to criminal investigation authorities. 

The present document analyses the state-of-play and the impacts of enlarging the access 
to the BAR single access point, put in place pursuant to the proposed 2021 anti-money 
laundering  directive,  also  to  the  authorities  competent  for  the  prevention,  detection, 
investigation  or  prosecution  of  criminal  offences  designated  by  Member  States  under 
Directive 2019/1153. 

2.  STATE-OF-PLAY  WITH  REGARD  TO  THE  SETTING  UP  OF  CENTRALISED  BANK 
ACCOUNT  REGISTRIES  AND  ELECTRONIC  DATA  RETRIEVAL  SYSTEMS  IN  THE  EU 
MEMBER STATES 

In  many  Member  States,  where  centralised  bank  account  registries  exist,  also  law 
enforcement authorities, including the AROs have been provided with a direct access to 
these registries (BE, BG, FR, DE, EE, EL, IT, LV, LT, LU7, NL, SI). With the ending of 
the  transposition  period  of  Directive  2019/1153  on  1  August  2021,  all  Member  States 
should have provided direct access to authorities competent for the prevention, detection, 
investigation or prosecution of criminal offences, including AROs. By 1 December 2021, 
Member  States  should  notify  the  Commission  of  the  authorities  that  have  been 
designated. 

Table. Law enforcement authorities and Asset Recovery Offices direct access to bank account information 

MS 

AT 

BE 

BG 

CY 

CZ 

DE 

DK 

EE 

EL 

l

a
r
t
n
e
C

k
n
a
b

t
n
u
o
c
c
A

y
r
t
s
i
g
e
R

a
t
a
D

l

a
v
e
i
r
t
e
R

m
e
t
s
y
S

t
c
e
r
i
D

s
s
e
c
c
a

A
E
L

t
c
e
r
i
D

s
s
e
c
c
A

O
R
A

Yes 

Yes 

Yes 

Yes 

Yes 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

Yes 

Yes 

Yes 

Yes 

No 

No 

Yes 

No 

No 

Yes 

No 

Yes 

Yes 

No 

Yes 

Yes 

No 

No 

Yes 

No 

Yes 

Yes 

6  Legal  or  natural  person  within  the  scope  of  Anti-Money  Laundering  Directive  and  subject  to  Anti-

Money Laundering/Countering the Financing of Terrorism (AML/CFT) rules. 

7   Limited to money laundering / terrorism financing. 

2 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
ES 

FI 

FR 

HR 

HU 

IE 

IT 

LT 

LU 

LV 

MT 

NL 

PL 

PT 

RO 

SK 

SI 

SE 

Yes 

-- 

Yes 

Yes 

n/a* 

n/a* 

Yes 

Yes 

-- 

Yes 

Yes 

Yes 

No 

Yes 

Yes 

n/a* 

Yes 

-- 

-- 

Yes 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

-- 

No 

No 

Yes 

No 

n/a 

No 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

No 

No 

Yes 

No 

n/a 

No 

No 

Yes 

No 

Yes 

Yes 

Yes 

No (in progress) 

n/a** 

n/a** 

-- 

-- 

n/a 

-- 

Yes 

No 

Yes 

n/a 

Yes 

Yes 

No 

No 

n/a 

No 

Yes 

Source:  targeted  questionnaire  on  ARO/law  enforcement  access  to  bank  account  information,  October 
2020.  

Eleven  Member  States  indicated  that  AROs  have  access  to  bank  account  information,  one  of  them 
indirectly and ten directly (including one of them with approval from the prosecutor). In thirteen Member 
States one or more law enforcement authorities have access to centralised bank account registries or data 
retrieval systems, in one case only for money laundering and terrorism financing investigations and in two 
cases following the approval by a judge or a prosecutor.  

Judges  and  prosecutors  themselves  have  access  to  bank  account  information  respectively  in  five  and  in 
nine  Member  States  (in  two  of  them  prosecutors  only  have  such  access  for  money  laundering/terrorism 
financing cases). Five other Member States have indicated that they have given access to other designated 
authorities such as tax authorities or customs8. 

8   Directive 2019/1153 enables Member States to designate  tax authorities and anti-corruption agencies 
as  competent  authorities  to  the  extent  that  they  are  competent  for  the  prevention,  detection, 
investigation or prosecution of criminal offences under national law. Like any authority designated as 
competent  under  Directive  2019/1153,  they  can  only  access  the  register  “for  the  purposes  of 
preventing, detecting, investigating or prosecuting a serious criminal offence or supporting a criminal 
investigation concerning a serious criminal offence, including the identification, tracing  and freezing 
of the assets related to such investigation”. 

3 

 
                                                 
3.  WHAT IS THE PROBLEM? 

A  considerable  part  of  criminal  activity,  especially  serious  and  organised  crime,  is 
committed with the aim of generating profit. Criminal revenues in the nine main criminal 
markets in the European Union amounted to €139 billion in 20199, corresponding to 1% 
of  the  Union’s  Gross  Domestic  Product.  Criminals  and  terrorists  often  operate  in 
different Member States and their assets, including bank accounts, are located across the 
EU. They tend to be quick to adapt and make use of modern technology that allows them 
to transfer money between numerous bank accounts and between different currencies in a 
matter of hours. 

Information on financial activities can provide law enforcement with crucial leads about 
subjects of an investigation and judicial authorities with invaluable evidence to ascertain 
the criminal acts of a person subject to criminal proceedings. Moreover, swift access to 
bank  account  information  is  essential  to  ensure  effective  freezing  and  confiscation  of 
proceeds of criminal activities, which are among the most effective means of combatting 
crime. However, confiscation rates are low:  currently only  about  1% of  criminal  assets 
are confiscated10.  

Swift  access  to  financial  information  is  key  to  effective  financial  investigations  and 
successfully tracing and confiscating the instrumentalities and proceeds of crime. In this 
regard, it is vital to know who holds a bank  account in a Member State other than that 
carrying  out  the  investigation:  not  only  to  be  able  to  establish  which  Member  State 
freezing and confiscation orders are to be sent to in order to secure the assets11, but also 
to give investigators potentially crucial leads.  

However,  in  order  for  authorities  responsible  for  preventing,  detecting,  investigating  or 
prosecuting criminal offences in one Member State to obtain information on subjects of 
an investigation who hold bank accounts in another Member State, they currently have to 
collect the information via police cooperation or judicial cooperation channels. This is an 
often  burdensome  and  time-consuming  process  that  hampers  speedy  access  to  the 
information.  This  includes  exchanges  on  the  basis  of  Framework  Decision  2006/960 
JHA12 (also  referred to  as the “Swedish  Initiative”). Since 19 December 2020, Member 
States are expected to apply the mutual recognition of freezing and confiscation orders in 

9   This  covers  illicit  drugs,  trafficking  in  human  beings,  smuggling  of  migrants,  fraud  (‘missing  trader 
intra Community’ VAT fraud, infringements of intellectual property rights, food fraud), environmental 
crime (illicit waste and illicit wildlife trafficking), illicit firearms, illicit tobacco, cybercrime activities 
and organised property crime – Study on Mapping the risk of serious and organised crime infiltration 
in legitimate businesses, March 2021, DR0221244ENN, https://data.europa.eu/doi/10.2837/64101. 
10   Europol, Does crime still pay? Criminal Asset Recovery in the EU – Survey of statistical information 
2010-2014, 2016, available at: https://www.europol.europa.eu/publications-documents/does-crimestill-
pay.   

11  On  the  basis  of  Council  Framework  Decision  2003/757/JHA  and  2006/783  JHA,  and  (as  of  19 

December 2020), Regulation (EU) 2018/1805. 

12   Council  Framework  Decision  2006/960/JHA  of  18  December  2006  on  simplifying  the  exchange  of 
information  and  intelligence  between  law  enforcement  authorities  of  the  Member  States  of  the 
European  Union  (OJ  L  386,  29.12.2006,  page  89),  referred  to  as  the  “Swedish  initiative”.  This 
instrument  sets  out  rules  for  the  exchanges  of  criminal  information  and  intelligence  information 
between law enforcement authorities. It sets out rules for the exchanges of criminal information and 
intelligence  information  and  ensures  that  procedures  for  cross-border  data  exchanges  are  not  stricter 
than  those  applying  to  exchanges  at  national  level.  It  provides  for  the  following  time  limits  for 
exchanges of information: eight hours if the request is urgent and the information is in their databases; 
one  week  if  the  request  is  not  urgent  and  the  information  is  in  their  databases  and  two  weeks  if  the 
request is not urgent and the information is not available in their databases. 

4 

 
                                                 
accordance  with  Regulation  2018/180513.  This  Regulation  does  not  establish  precise 
timelines for freezing orders, although the issuing Member State can request its execution 
in  a  maximum  of  48  hours  if  it  has  grounds  to  believe  that  the  property  will  be 
imminently  removed  or  destroyed,  and  establishes  a  maximum  of  45  days  for  the  
recognition and execution of confiscation orders. When issuing certificates for the mutual 
recognition of freezing and confiscation orders, Member States may indicate the details 
of the bank account of the affected person. Therefore, knowing where in the EU a suspect 
holds  a  bank  account  is  invaluable  information  for  competent  authorities  to  quickly 
identify to which other Member States they should request the freezing, and subsequently 
confiscation, of money stored in those  accounts before it is moved somewhere else. 

Designated  authorities  competent  for  the  prevention,  detection,  investigation  or 
prosecution  of  criminal  offences  need  therefore  to  be  able  to  more  efficiently  trace  the 
financial trail that criminals leave behind, uncover criminal activities across borders and 
trace, freeze and confiscate illegally obtained assets - which is one of the most effective 
means  of  combatting  crime.  An  access  of  the  competent  authorities  to  the  BAR  single 
access point would allow them to more quickly obtain information on whether a subject 
of  an  investigation  holds  a  bank  or  payment  account  or  a  safe  deposit  box  in  another 
Member State, and therefore be an important  element of enhancing their  capabilities to 
secure assets before they disappear. 

4. 

POLICY OPTIONS 

4.1.  Baseline 

The baseline consists of the current status quo, whereby designated authorities competent 
for  the  prevention,  detection,  investigation  or  prosecution  of  criminal  offences  are 
empowered to directly access and search the national centralised bank account registries 
according  to  Directive  2019/1153.  The  Commission  would  monitor  such  transposition 
and  would,  where  needed,  open  infringement  proceedings  in  case  of  incomplete  or 
incorrect transposition.  

However, without a direct access to the BAR single access point, authorities competent 
for the prevention, detection, investigation or prosecution of criminal offences would not 
have  any  cross-border  access  to  bank  account  information  stored  in  the  registries.  It  is 
therefore  very  likely  that  the  problems  described  in  section  3  would  persist  and  would 
even  exacerbate  with  time  as  technologies  will  continue  to  develop  and  evolve,  thus, 
providing  criminals  with  the  opportunity  to  transfer  money  between  various  bank 
accounts  within  or  outside  the  EU  expeditiously  before  authorities  competent  for  the 
prevention, detection, investigation or prosecution of criminal offences are able to follow 
the money trail and freeze the assets. 

The  baseline  would  entail  that  competent  authorities  rely  on  existing  channels  of 
communication for requests for information exchanges. This would either result in (a) an 
increased  workload  for  competent  authorities  to  respond  to  cross-border  requests  from 
competent  authorities  in  other  Member  States  or  (b)  that  authorities  competent  for  the 
prevention,  detection,  investigation  or  prosecution  of  criminal  offences  choose  not  to 
enrich  their  investigations  with  bank  account  information  that  is  available  in  other 

13   Regulation (EU) 2018/1805 of the European Parliament and of the Council of 14 November 2018 on 

the mutual recognition of freezing orders and confiscation orders (OJ L 303, 28.11.2018, p. 1). 

5 

 
                                                 
Member States due to slower and less efficient procedures. The latter would also reduce 
the amount of assets that are detected, identified, frozen and, ultimately, confiscated. 

4.2.  Description of the policy option 

The  only  available  policy  option,  apart  from  the  baseline,  is  to  provide  the  authorities 
competent for the prevention, detection, investigation or prosecution of criminal offences 
designated  by  the  Member  States  pursuant  to  Article  3(1)  of  Directive  2019/1153  with 
the  the  possibilities  to  directly  access  and  search  the  bank  account  registries  of  other 
Member States through  via the single access point. The available policy option builds on 
existing  policy  documents  by  EU  Institutions  indicating  the  added  value  of  providing 
competent  authorities  with  access  to  such  interconnection  subject  to  appropriate 
safeguards and limitations: 

–  The Commission’s report on the interconnection of centralised bank account registries 
of  July  2019  concluded  that  such  an  interconnection  would  speed  up  access  to 
financial  information  and  facilitate  the  cross-border  cooperation  of  the  competent 
authorities.  

–  The  action  plan  for  a  comprehensive  Union  policy  on  preventing  money  laundering 
and terrorist financing, adopted by the Commission in May 2020, emphasised that an 
EU-wide  interconnection  of  central  bank  account  mechanisms  is  necessary  to  speed 
up  access  by  FIUs  and  competent  authorities  to  bank  account  information  and 
facilitate  cross-border  cooperation  and  that  it  should  be  considered  as  a  matter  of 
priority.14  

–  The  June  2020  Council  conclusions  on  enhancing  financial  investigations  to  fight 
serious and organised crime called on the Member States to engage in a constructive 
discussion with the Commission regarding the future interconnection of national bank 
account registries and data retrieval systems. Moreover, the Council also called on the 
Commission  to  consider  further  enhancing  the  legal  framework  in  order  to 
interconnect the national registries and retrieval systems in order to accelerate access 
to financial information and facilitate cross-border cooperation between the competent 
authorities and their European counterparts.15  

–  The Commission’s Security Union Strategy adopted in  July 202016 also  refers to  the 
interconnection  of  national  centralised  bank  account  registries,  which  could 
significantly  speed  up  access  to  the  financial  information  for  FIUs  and  competent 
authorities. 

–  The  European  Parliament’s  resolution  of  10  July  2020  welcomes  the  Commission’s 
plan  to  ensure  interconnection  of  centralised  bank  account  registries  in  order  to 
facilitate  faster  access  to  financial  information  for  competent  authorities  and  FIUs 

14   Commission  Communication  from  the  Commission  on  an  Action  Plan  for  a  comprehensive  Union 

policy on preventing money laundering and terrorist financin (COM(2020) 2800 final). 

15   Council  conclusions  on  enhancing  financial  investigations  to  fight  serious  and  organised  crime,  17 

June 2020 (8927/20). 

16   Commission Communication from the Commission on the EU Security Union Strategy (COM (2020) 

605 final). 

6 

 
                                                 
during  different  investigation  phases  and  facilitate  cross-border  cooperation  in  full 
compliance with applicable data protection rules”.17 

–  The EU strategy to tackle organised crime 2021-2025, adopted by the Commission in 
April 2021, stresses that swift access to financial information is essential for carrying 
out  effective  financial  investigations  and  for  successfully  tracing  and  confiscating 
assets. It announces that the Commission will revise Directive 2019/1153 in order to 
provide  competent  authorities  access  to  the  future  platform  interconnecting  bank 
account registries across the EU18. 

These statements calling  for the centralised bank account registries to be interconnected 
and access to be granted also to  the authorities competent for  the prevention, detection, 
investigation  or  prosecution  of  criminal  offences  reflect  the  operational  need  of  such 
authorities  to  quickly  identify  whether  a  suspect  holds  bank  accounts  in  other  Member 
States.  These  operational  needs  indicate  that  this  is  the  chosen  option  that  should  be 
assessed in  greater detail below, in  particular  as regards its impact  on effectiveness,  its 
proportionality and its impact on relevant fundamental rights enshired in the Charter of 
Fundamental Rights of the EU (hereinafter the Charter). 

5. 

IMPACTS OF THE POLICY OPTION 

5.1.  Effectiveness and efficiency 

The  access  of  authorities  competent  for  the  prevention,  detection,  investigation  or 
prosecution of criminal offences to the BAR single access point, put in place pursuant to 
the  proposed  2021  anti-money  laundering  directive,  will  significantly  improve  the 
effectiveness  of  the  investigations  carried  out  by  those  authorities,  including  AROs,  to 
combat  serious  crime  and,  in  particular,  trace  and  identify  proceeds  of  crime.  It  will 
significantly  improve  and  speed  up  the  capacity  of  these  authorities  to  obtain  swiftly 
information on where a suspect in a criminal investigation into serious crimes holds bank 
accounts  in  other  Member  States.  It  will  also  facilitate  cross-border  cooperation  within 
the  EU,  since  information  on  whether  a  person  subject  to  a  criminal  investigation  or 
judicial  proceeding  holds  a  bank  account  in  another  Member  State  is  essential  for 
competent  authorities to  swiftly identify the Member States to  which they should send, 
respectively, requests for further information (for investigative or evidential purposes) or 
freezing and confiscation orders to secure the assets.19  

It will therefore be an important element to enhance freezing and confiscation of criminal 
assets and step up confiscation rates in accordance with the applicable laws.  

Providing  access  to  the  interconnection  of  central  bank  account  registries  would  also 
improve the efficiency of law enforcement investigations insofar as it would allow them 
to determine to which Member State they should address freezing and confiscation orders 
or  European  Investigation  Orders  without  previously  requiring  authorities  in  other 

17   European  Parliament  resolution  of  10  July  2020  on  a  comprehensive  Union  policy  on  preventing 
money  laundering  and  terrorist  financing  –  the  Commission’s  Action  Plan  and  other  recent 
developments (2020/2686(RSP)). 

18   Commission Communication on the EU Strategy to tackle Organised Crime 2021-2025 (COM(2021) 

170 final). 

19   On the basis of Council Framework Decision 2003/757/JHA and 2006/783 JHA, as of 19 December 

2020 on the basis of Regulation 2018/1805. 

7 

 
                                                 
Member States  to  ascertain  whether a suspect  holds  accounts in  that Member State  – a 
process  which  often  proves  lengthy  and  burdensome  at  present.  Providing  competent 
authorities  with  access  to  the  bank  account  registries  single  access  point  would  bring 
significant benefits without requiring excessive additional costs.  

Practical example of potential operational benefits for law enforcement authorities  

Law enforcement authorities in Member States A and B receive a request from the law 
enforcement  authority  in  Member  State  C,  in  a  criminal  investigation  in  a  big  drug 
trafficking  case,  to  identify  bank  accounts  held  by  the  suspect.  Law  enforcement 
authorities in Member States A and B have a direct access to their national bank account 
registries. Member State A answer within a few hours, whilst Member State B provides 
the  information  after  1  week.  When  the  law  enforcement  authority  or  the  ARO  in 
Member  State  C,  on  the  basis  of  this  information,  requests  freezing  orders  at  the 
competent  court,  and  subsequently  issues  certificates  for  the  mutual  recognition  of 
freezing orders in order to freeze the substantial sums of money in the accounts, most of 
it has already disappeared.  

In the situation where competent authorities in Member State C would be empowered to 
search and  access  the interconnection of central  bank account  registries,  they  would be 
able to identify the bank accounts held by the suspect in a matter of seconds. Authorities 
in Member State C would therefore be capable of requesting to both Member State A and 
B the freezing of money held in those accouns before it is transferred somewhere else. 

5.2. 

Proportionality  

The  proposed  measure  is  proportionate  to  the  objective  to  further  strengthen  the 
competent  authorities’  ability  to  fight  serious  crime.  Solely  specifically  designated 
authorities  in  accordance  with  Article  3(1)  of  Directive  2019/1153  (which  are  to  be 
notified to the Commission by 1 December 2021 in accordance with Article 3(3) of the 
Directive)  will  be  provided  with  direct  access  to  the  the  bank  account  registries  single 
access point.  

Under  Article  4(1)  of  Directive  2019/1153  access  is  provided  only  for  the  purpose  of 
preventing,  detecting,  investigating  and  prosecuting  serious  crime.  According  to  Art. 
2(12) of the Directive, serious criminal offence means the forms of crime listed in Annex 
I to Regulation (EU) 2016/794 (Europol Regulation). 

Directive 2019/1153 already lays down strict conditions for the access and for searches 
of  bank  account  information  contained  in  the  centralised  bank  account  registries  by 
competent authorities designated at national level20. These safeguards and limitations will 
also  apply  in  relation  to  the  access  and  search  possibilities,  through  the  BAR  single 
access point, created under the proposed measures. Such conditions include, for example, 
the provision of access to the bank account registries only to specifically designated and 
authorised persons of each competent authority and only for the purposes of combating 
serious criminal offences.  

20   Directive  (EU)  2019/1153.  This  Directive  is  based  on  article  87(2)  of  the  Treaty,  and  therefore  any 
opening  of  interconnected  bank  account  registries  to  authorities  competent  for  the  prevention, 
detection,  investigation  or  prosecution  of  criminal  offences  would  normally  have  to  use  the  same 
Treaty base. 

8 

 
                                                 
Another limitation is the fact that competent authorities of other Member States will only 
be able to directly access and search the following limited set of information through the 
BAR single  access  point (see Article 4(2) in  conjunction  with  Article 2(7) of Directive 
(EU)  2019/1153;  see  also  Article  32a(3)  of  the  current  Anti-Money  Laundering 
Directive,  as  well  as  Article  14(3)  of  the  proposed  new  Anti-Money  Laundering 
Directive and Article 18(1) of proposed new Anti-Money Laundering Regulation):: 

  for the customer-account holder and any person purporting to act on behalf of the 
customer:  the  name,  complemented  by  either  the  other  identification  data  or  a 
unique identification number; 

  for 

the  beneficial  owner  of 

the  name, 
complemented  by  either  the  other  identification  data  required  or  a  unique 
identification number; 

the  customer-account  holder: 

  for  the  bank  or  payment  account:  the  IBAN  number  and  the  date  of  account 

opening and closing; 

  for  the  safe-deposit  box:  name  of  the  lessee  complemented  by  either  the  other 
identification data required or a unique identification number and the duration of 
the lease period. 

Pursuant  to  the  measure  hereby  considered,  authorities  competent  for  the  prevention, 
detection, investigation or prosecution of criminal offences will therefore still not be able 
to access and search sensitive data, such as information on transactions or the accounts 
balance.  Only  information  strictly  required  to  identify  a  holder  of  a  bank  or  payment 
account  or  a  safe  deposit  box  will  be  made  accessible  through  the  BAR  single  access 
point. Once the authorities identify, by virtue of the access provided under the proposed 
measure,  with  which  financial  institution  the  subject  of  an  investigation  holds  a  bank 
account  in  another  Member  State,  they  will,  where  deemed  necessary,  have  to  request 
further  information  (e.g.  a  list  of  transactions)  via  appropriate  judicial  cooperation 
channels. 

5.3. 

Fundamental rights 

The applicable safeguards described above, will also ensure that the impact on relevant 
fundamental  rights,  such  as  the  right  to  the  protection  of  personal  data  and  the  right  to 
private life, is limited to what is strictly nessesary.  

Centralised  bank  account  registries  contain  personal  data  relating  to  legal  or  natural 
persons. An access by authorities competent  for the prevention, detection, investigation 
or prosecution of criminal offences to these data has an impact on the fundamental rights 
of the data subjects. In particular, it will interfere with the right to privacy and the right to 
the protection of personal data, respectively under Articles 7 and 8 of the Charter. 

Any  resulting  limitations  on  the  exercise  of  the  rights  and  freedoms  recognised  by  the 
Charter,  in  particular  those  laid  down  in  its  Articles  7  and  8,  comply  with  the 
requirements set by the Charter, in particular those of its Article 52(1).  

The limitation is provided for by law and is justified by the need to pursue an objective of 
general interest recognised by the Union, namely, combating serious crime.  

9 

 
With  regard  the  right  to  privacy,  the  impact  is  limited  insofar  as  the  measures  hereby 
analysed  does  not  require  the  collection  of  additional  account-holder  data  and 
considering that the information from other Member States accessible via the BAR single 
access  point  can  already  be  obtained  through  police  and  judicial  cooperation  channels. 
Moreover,  the  interference  with  the  right  to  privacy  is  relatively  limited  in  terms  of 
gravity as the accessible and searchable data does not cover financial transactions or the 
account  balance.  It  will  only  cover  the  described  limited  set  of  information  (e.g.  the 
owner’s name bank account number) that is strictly necessary for the competent authority 
of  a  given  Member  State  to  establish  with  which  banks  in  other  Member  States  the 
subject of an investigation holds an account. 

With regard to the protection of personal data, information on bank accounts constitutes 
or  can  constitute  personal  data  and  access  to  this  data  by  authorities  competent  for  the 
prevention, detection, investigation or prosecution of criminal offences authorities would 
constitute processing of personal data. At the same time, all provisions of the Directive 
(EU)  2016/68021  apply  to  the  processing  of  data  from  the  centralised  bank  account 
registries  accessed  and  searched  by  these  authorities  through  the  BAR  single  access 
point,  as  is  presently  the  case  for  data  accessed  and  searched  on  the  basis  of  Directive 
(EU) 2019/1153 . Further on,  the resulting interconnection could reduce from a certain 
perspective  the  processing  of  personal  data,  insofar  as  authorities  competent  for  the 
prevention,  detection,  investigation  or  prosecution  of  criminal  offences  could  identify 
whether  the  subject  of  a  criminal  investigation  holds  bank  accounts  in  other  Member 
States without disclosing personal information on the suspect to one or more authorities 
in several other Member States. Without interconnection, in order to obtain information 
on subjects of an investigation holding bank accounts in another Member State requests 
have to be sent on the basis of police or judicial cooperation instruments, i.e. Framework 
Decision  2006/960  JHA22  or  Regulation  2018/180523,  thus  by  disseminating  personal 
information to the relevant authorities in different Member States.  

At  the  same  time,  all  the  safeguards  and  limitations  provided  for  in  Directive  (EU) 
2019/1153  will  also  apply  in  respect  of  any  access  or  search  of  designated  authorities 
competent for the prevention, detection, investigation or prosecution of criminal offences 
to  or  in  centralised  automated  mechanisms,  such  as  a  central  registers  or  central 
electronic  data  retrieval  systems  through  the  BAR  single  access  point.  It  concerns  in 
particular the safeguards  provided for in Articles 3, 4, 5, and 6 of the Directive, which 
provide in particular for the following safeguards: 

  only  the  authorities  competent  for  the  prevention,  detection,  investigation  or 
prosecution of criminal offences, which have been designated by Member States 
will have the power to access and search the centralised bank account registries, 
including through the BAR single  access  point (Article 3(1) of the Directive in 
conjunction with the proposed measures).  

21  Directive  (EU)  2016/680  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data by competent authorities 
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the 
execution  of  criminal  penalties,  and  on  the  free  movement  of  such  data,  and  repealing  Council 
Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 

22   Council  Framework  Decision  2006/960/JHA  of  18  December  2006  on  simplifying  the  exchange  of 
information  and  intelligence  between  law  enforcement  authorities  of  the  Member  States  of  the 
European Union, OJ L 386, 29.12.2006, p. 89. 

23   Regulation (EU) 2018/1805 of the European Parliament and of the Council of 14 November 2018 on 

the mutual recognition of freezing orders and confiscation orders, OJ L 303, 28.11.2018, p. 1.  

10 

 
                                                 
  the power to access  and search in centralised bank account registries, including 
through  the  BAR  single  access  point,  is  granted  only  for  the  purpose  of 
prevention,  detecting,  investigating  or  prosecuting  ‘serious  criminal  offence’ 
(Article  4(2)  in  conjunction  with  the  proposed  measures).  Serious  criminal 
offenced  in  this  context  refer  to  the  forms  of  crime  listed  in  Annex  I  to 
Regulation (EU) 2016/79424 (Article 2(12) of the Directive). 

  as  set  out  above,  only  a  limited  set  of  the  information  in  the  centralised  bank 
account  registries,  as  strictly  required  to  ascertain  whether  the  subject  of  an 
investigation holds an account  with  a bank and  with  which banks, is  accessible 
and searchable, including through the BAR single access point (e.g. the owner’s 
name and bank account number) (Article 4(2) in conjunction with Article 2(7)).  

  access  and  searches,  including  when  conducted  through  the  BAR  single  access 
point, have to be performed by case by the staff of each competent authority that 
have been specifically designated and authorised to perform those tasks (Article 
5(1) and (2)). Member States must put measures in place to ensure the security of 
the  data  to  high  technological  standards  for  the  purposes  of  accessing  and 
searching bank account information (Article 5(3)). 

  logs  of  any  access  and  searches,  including  when  conducted  through  the  BAR 
single access point, have to be kept (Article 6(1)). These logs have to be checked 
regularly  by  the  data  protection  officers  for  the  centralised  bank  account 
registries,  and  have  to  be  made  available,  on  request,  to  the  competent 
supervisory  authority  (Article  6(2)).  The  logs  may  be  kept  only  for  data 
protection monitoring; they have to be protected by appropriate measures against 
unothorised access and shall be erased 5 years after their creation, unless they are 
required for monitoring procedures(Article 6(3) of the Directive). 

In  conclusion, the essence of the rights  and freedoms in  question are respected and the 
limitations are proportionate to the objective pursued. 

5.4.  Costs of the preferred policy option 

Enlarging  access to  the  BAR  single  access  point beyond  FIUs to  competent  authorities 
will generate rather minor costs.  

The  costs  of  establishing  the  BAR  single  access  point  will  already  be  quite  low.  In  its 
July  2019  report  on  the  interconnection  of  bank  account  registries,  the  Commission 
considered several model examples of existing EU systems and the costs linked to their 
establishment in  order to  provide an indicative figure of the potential expenses that the 
interconnection  of  bank  account  registries  will  entail.  In  the  majority  of  examples 
considered,  the  costs  linked  to  the  EU  component  interconnecting  the  various  national 
databases  (the  EU  platform  or  central  routing  component)  were  covered  by  the  EU 
budget,  whereas  the  Member  States  bore  the  costs  linked  to  the  modification  of  their 
national systems in order to make them interoperable with the EU central component. For 

24   Regulation  (EU)  2016/794  of  the  European  Parliament  and  of  the  Council  of  11  May  2016  on  te 
European  Union  Agency  for  law  Enforcement  Cooperation  (Europol)  and  replacing  and  repealing 
Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968 JHA, 
OJ L 135, 24.5.2016, p. 53. 

11 

 
                                                 
example,  the  costs  for  the  development  of  the  first  version  of  the  Business  Register 
Interconnection System (BRIS) amounted to approximately € 1,700,000. As regards the 
insolvency  registers  interconnection  system  (IRI),  the  setting  up  of  the  central  search 
pilot system (IRI 1.0) cost approximately € 280,000, whereas its adaptation towards the 
establishment  of  IRI  2.0  is  estimated  to  amount  to  approximately  €  170,000. 
Furthermore,  with  regard  to  the  European  Criminal  Records  Information  System 
(ECRIS) the costs of the development of the software to exchange criminal records data 
between  the  Member  States  reached  €  2,050,000,  whereas  its  annual  maintenance 
amounts to approximately € 150,000.  

In order to assess the costs for the establishment of a direct connection to a system, the 
connection  costs  of  the  AROs  to  the  Europol  SIENA  system  or  the  costs  incurred  by 
Business Registers Interconnection System (BRIS) project to set up the network between 
relevant  authorities  can  be  used  as  proxies.  The  basic  cost  of  these  connections  varies 
between € 5 000 and € 30 000 per authority. These costs have then to be multiplied by 
the number of authorities connected to the network.  

The costs of providing authorities competent for the prevention, detection, investigation 
and  prosecution  of  serious  criminal  offences  with  an  access  to  the  BAR  single  access 
point appear rather low compared to the benefits such a project would bring in the fight 
against serious and organised crime. 

6.  CONCLUSIONS 

The  policy  option  consisting  of  providing  designated  law  enforcement  authorities  with 
the possibility to access and search the bank account registries via the single access point, 
put  in  place  pursuant  to  the  proposed  2021  anti-money  laundering  directive,  would 
increase  the  effectiveness  of  activities  for  the  prevention,  detection,  investigation  or 
prosecution of serious crime in an efficient  and proportionate manner, having regard to 
the  limited  impact  on  fundamental  rights  and  the  robust  safeguards  and  limitations 
contained in EU data protection rules and in Directive 2019/1153.  

12