COMMISSION STAFF WORKING DOCUMENT Joint Review Report of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the Untied States for the purposes of the Terrorist Finance Tracking Program Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Financing Program
Date: 2024-11-13
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: United States, agreement (EU), bilateral agreement, cross-frontier data flow, data protection, disclosure of information, exchange of information, financial services, personal data, terrorism financing

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 13.11.2024  SWD(2024) 252 final  COMMISSION STAFF WORKING DOCUMENT Joint Review Report of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the Untied States for the purposes of the Terrorist Finance Tracking Program Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Financing Program {COM(2024) 522 final}  
 
 
Contents 

1. 

2. 

3. 

3.1. 

3.2. 

3.3. 

3.4. 

BACKGROUND 

PROCEDURAL ASPECTS 

THE OUTCOME OF THE JOINT REVIEW 

 The value of the TFTP Provided Data ...........................................................................................  

 The EU benefiting from TFTP data ...............................................................................................  

TFTP Provided Data accessed ........................................................................................................  

 Requests to obtain data from the Designated Provider ..................................................................  

3.5.   Monitoring safeguards and controls – the role of overseers ...........................................................  

3.6. 

3.7. 

3.8. 

3.9. 

Data security and integrity – independent audit .............................................................................  

Retention and deletion of data ........................................................................................................  

Transparency – providing information to the data subject .............................................................  

Right of access and to rectification, erasure, or blocking ...............................................................  

3.9.1. 

 Requests for access ........................................................................................................................  

3.9.2. 

 Requests for rectification, erasure, or blocking .............................................................................  

3.10.  Redress ............................................................................................................................................  

3.11.  Consultations under Article 19 .......................................................................................................  

4. 

RECOMMENDATIONS AND CONCLUSION 

Annex I – Composition of the review teams 

2 

2 

5 

5 

6 

9 

10 

13 

16 

17 

20 

20 

21 

22 

22 

23 

23 

28 

Annex II – Europol statistical information regarding Articles 4, 9 and 10 of the EU-US TFTP Agreement 

 29 

Annex III – Responses by the U.S. Treasury Department to the European Union Questionnaire for the  
seventh Joint Review of the EU – U.S. Terrorist Finance Tracking Program Agreement 

32 

Annex IV – Examples of cases in which TFTP has been used for the prevention, investigation, detection, or 
prosecution of terrorism or its financing 

52 

1 

 
 
 
 
 
 
1. 

BACKGROUND  

The Terrorist Finance Tracking Program (TFTP) was set up by the U.S. Treasury Department 
shortly after the terrorist attacks of 11 September 2001 when it began issuing legally binding 
production orders to a provider of financial payment messaging services for financial payment 
messaging data stored in the United States that would be used exclusively in the fight against 
terrorism and its financing. 

Until  the  end  of  2009,  the  provider  stored  all  relevant  financial  messages  on  two  identical 
servers, located in Europe and the United States. On 1 January 2010, the Designated Provider 
implemented its new messaging architecture, consisting of two processing zones – one zone in 
the United States and the other in the European Union. 

In  order  to  ensure  the  continuity  of  the  TFTP  under  these  new  conditions,  an  Agreement 
between the European Union and the United States on this issue was considered necessary. 
After  an  initial  version  of  the  Agreement  did  not  receive  the  consent  of  the  European 
Parliament,  a  revised  version  was  negotiated  and  agreed  upon  in  the  summer  of  2010.  The 
European Parliament gave its consent to the Agreement on 8 July 2010, the Council approved 
it on 13 July 2010, and it entered into force on 1 August 20101. 

Since  March  2023,  the  Designated  Provider  has  worked  to  upgrade  to  a  new  messaging 
architecture (from ISO 15022 to ISO 20022)2. As a result of migration to the new standard, the 
U.S.  requests  to  obtain  data  from  the  provider  now  require  the  production  of  two  types  of 
messages (new MX messages and the initial MT messages). Due to the ISO 20022 changes 
made by the Designated Provider, messages using the new standard are stored in the territory 
of the European Union. This change has resulted in a substantial increase in the geographical 
scope covered by Article 4 requests. This transition is estimated to take place over the course 
of  two  years  until  November  2025,  during  which  time  financial  institutions  will  gradually 
change from the previous MT format to MX format. 

2. 

PROCEDURAL ASPECTS  

Article 13 of the Agreement provides for regular joint reviews of the safeguards, controls, and 
reciprocity  provisions  to  be  conducted  by  review  teams  from  the  European  Union  and  the 
United States, including the European Commission, the U.S. Treasury Department (hereinafter 
“the Treasury”), and representatives of two data protection authorities from EU Member States, 
and may also include security and data protection experts and persons with judicial experience. 

1   OJ L 195/5 of 27.7. 2010. 
2   Standards for relaying electronic messages is a critical factor when initialising financial transactions and 

reporting financial activities. An international standard is a way to simplify interoperability between service 
providers, and enable the efficient, consistent and secure exchange of files. ISO 15022 focuses on a specific 
segment of financial messaging with the more rigid MT (message type) format typically divided into blocks 
that contain specific types of data divided into 10 primary categories of SWIFT message types. ISO 20022 
offers a comprehensive, flexible, and modern approach to financial messaging across various sectors on a 
XML-based technology. MT messages use a tag-value format, whereas MX messages use XML. Conversion 
tables are available, and an MX equivalent of an MT103 message would be the pacs.008 message in ISO 
20022. 

2 

 
 
 
 
Pursuant to Article 13 (2) of the Agreement, the review should have particular regard to: 

(a)  

The number of financial payment messages accessed; 

(b)  

(c)  

The number of occasions on which leads have been shared with Member States, third 
countries, and Europol and Eurojust; 

The implementation and effectiveness of the Agreement, including the suitability of the 
mechanism for the transfer of information; 

(d)   Cases in which information has been used for the prevention, investigation, detection, 

or prosecution of terrorism or its financing; 

(e)  

Compliance with the data protection obligations specified in the Agreement. 

Article 13 (2) further states that "the review shall include a representative and random sample 
of  searches  in  order  to  verify  compliance  with  the  safeguards  and  controls  set  out  in  this 
Agreement, as well as a proportionality assessment of the Provided Data, based on the value 
of  such  data  for  the  investigation,  prevention,  detection,  or  prosecution  of  terrorism  or  its 
financing." 

This Commission Staff Working Document that accompanies a report from the Commission 
to the European Parliament and the Council concerns the seventh joint review of the Agreement 
since it entered into force and covers a period between 1 December 2021 and 30 November 
2023.  

The previous joint reviews of the Agreement were conducted in February 20113, in October 
20124, in April 20145, in March 20166 and in January 20197, in March 20228. On 27 November 
2013, the Commission adopted the Communication on the Joint Report from the Commission 
and  the  U.S.  Treasury  Department  regarding  the  value  of  TFTP  Provided  Data  pursuant  to 
Article 6 (6) of the Agreement9. 

In  line  with  Article  13  (3)  of  the  Agreement,  for  the  purposes  of  the  review,  the  European 
Commission represented the European Union, and the U.S. Treasury Department represented 
the United States. The EU review team was headed by a senior Commission official and in 
total consisted of two members of Commission staff and representatives of two data protection 
authorities. A list of the members of both the EU and US review teams is included in Annex I 
to this Staff Working Document. 

The seventh joint review was carried out in two main steps: on 27 February 2024 in The Hague 
at Europol's premises and on 19 and 20 March 2024 in Washington DC at the U.S. Treasury 
Department (hereinafter “the Treasury”). The following methodology was applied: 

3   SEC (2011) 438 final of 30.3.2011. 
4   SWD (2012) 454 final of 14.12.2012. 
5   COM (2014) 513 final and SWD (2014) 264 final of 11.8.2014. 
6  COM (2017) 31 final and SWD (2017) 17 final of 19.1.2017. 
7  COM(2019) 342 final, and SWD (2019) 301 final of 22.7.2019 
8   COM (2022) 585 final and SWD (2022) 357 final of 11.11.2022 
9   COM (2013) 843 final of 27.11.2013. 

3 

 
 
 
 
 
–  

–  

– 

–  

–  

Both review teams first met in The Hague at Europol’s headquarters and were briefed 
by Europol  senior staff  and experts on Europol’s implementation  of the  Agreement. 
Prior to the visit, Europol provided a written contribution to the review, including the 
relevant statistical information (Annex II). 

To prepare for the visit in Washington, the EU team sent a questionnaire to the Treasury 
in advance of the review. This questionnaire contained a range of specific questions in 
relation to all the aspects of the review as specified in the Agreement. The Treasury 
provided written replies to the questionnaire (Annex III). The EU review team asked 
further questions to Treasury officials on the spot and was able to address all the various 
parameters of the Agreement. 

The EU team sent the Treasury a selection of 20 representative and random sample of 
searches and two Article 4 requests to obtain data from the Designated Provider to be 
verified during the review visit. 

All  meetings  were  held  in  a  dedicated  meeting  room,  and  the  EU  review  team  also 
visited the facilities of the TFTP overseers in the Treasury. For security reasons, review 
team  members  were  required  to  sign  a  copy  of  a  non-disclosure  agreement  as  a 
condition of their participation in this review exercise. 

The  review  teams  had  direct  exchanges  with  Treasury  personnel  responsible  for  the 
implementation of the TFTP program, the Treasury's Office of the General Counsel, 
the Privacy, Transparency and Records Department of the Treasury, the overseers who 
review  the  searches  of  the  data  provided  under  the  TFTP  Agreement,  and  the 
Designated Provider auditor of the TFTP. 

This  report  is  based  on  the  information  contained  in  the  written  replies  that  the  Treasury 
provided  to  the  EU  questionnaire  sent  prior  to  the  review,  information  obtained  from  the 
discussions  with  Treasury  personnel  and  members  of  the  US  review  team,  as  well  as 
information contained in other publicly available Treasury documents. In addition, the report 
takes into account information provided by Europol staff during the review. To complete the 
information available, the Commission members of the EU review team also met and received 
information  from  the  Designated  Provider  and  organised  a  meeting  on  18  January  2024  to 
receive feedback from Member States on the reciprocity provisions of the TFTP. 

Due to the sensitive nature of the TFTP, some information was provided to the review team 
under  the  condition  that  it  would  be  treated  as  classified  information  at  the  level  of  EU 
SECRET. Certain classified information was only made available for consultation and reading 
on the Treasury premises. All members of the EU team had to sign non-disclosure agreements 
exposing them to criminal and/or civil sanctions for breaches. However, this did not hamper 
the work of the joint review team, and all issues identified during the review are included in 
this report. 

As in case of the past reviews, the seventh review was based on the understanding that it was 
not its task to provide a political judgement on the Agreement, this being considered outside 

4 

 
 
 
the scope and mandate under Article 13. The focus of this report is therefore to present the 
results of the review in a manner which is as objective as possible. 

Before,  during,  and  after  the  review  there  has  been  an  exchange  of  views  in  an  open  and 
constructive  spirit,  which  covered  all  the  questions  of  the  review  teams.  The  Commission 
services would like to acknowledge the excellent cooperation on the part of all Treasury and 
other US personnel, Europol's and the Designated Provider's staff, as well as the EU overseer. 

The report and this Staff Working Document were prepared by, and reflects the views of, the 
EU review team, based on the work of the joint review team and other work independently 
conducted on the EU side. However, the modalities for the seventh review and the procedure 
for the issuance of this report were agreed with the Treasury, including an opportunity for the 
latter of prior reading of this report for the purpose of identifying any classified or sensitive 
information that could not be disclosed to the public.  

This  report  (or  the  outcome  of  the  review,  as  described  in  Section  3  of  this  Staff  Working 
Document) and the recommendations contained herein (section 4) have been approved by the 
members of the EU review team.  

3. 

THE OUTCOME OF THE JOINT REVIEW 

3.1. 

 The value of the TFTP Provided Data 

In line with Article 13 (2) of the Agreement, the proportionality of the TFTP Provided Data 
should be assessed on the basis of the value of such data for the fight against terrorism and its 
financing. Understanding the ways in which the TFTP-derived information may be used, as 
well as the provision of concrete examples, as underlying evidence is the balanced approach 
for such an assessment.  

During the first joint review, the Treasury provided several classified examples of high-profile 
terrorism-related cases where TFTP-derived information had been used. For the second joint 
review,  the  Treasury  provided  an  annex  containing  15  concrete  examples  of  specific 
investigations in which TFTP provided key leads to counter-terrorism investigators.  

Pursuant to Article 6 (6) of the Agreement, the Commission and the Treasury prepared a joint 
report  regarding  the  value  of  the  TFTP  Provided  Data10.  This  Joint  Value  Report  of  27 
November 2013 explains how the TFTP has been used and includes many specific examples 
where the TFTP-derived information has been valuable in counter-terrorism investigations in 
the United States and the EU.  

In the course of the following reviews, the Treasury emphasised the importance of the TFTP 
for  global  counter-terrorism  efforts  as  a  unique  instrument  to  provide  timely,  accurate  and 
reliable information about activities associated with suspected acts of terrorist planning and 
financing. The examples illustrate how the TFTP helps to identify and track terrorists and their 
support networks. The sixth review provided ten declassified examples on how TFTP leads 

10   COM(2013) 843 final of 27.11.2013. 

5 

 
 
 
 
had been used in European investigations and five additional US value examples. In addition 
to the examples provided during the past six reviews, Annex IV of this report provides for eight 
additional  examples  on  the  use  of  TFTP  data  during  the  review  period  and  an  US  Value 
statement summary on investigations involving terrorism and terrorist financing TFTP data has 
been  used  to  support  U.S.  law  enforcement  and  sanctions-related  investigations  involving 
terrorism and terrorist financing, which further demonstrate how the TFTP helped international 
counter-terrorism efforts. The review team heard from the Treasury analysts how the TFTP 
information is analysed and was given classified presentations of recent examples of counter-
terrorism  cases  in  the  EU  and  beyond  in  which  TFTP  information  played  a  decisive  or 
important role. 

On  the  basis  of  the  information  provided  by  the  Treasury,  Europol  and  Member  State 
authorities over the time, the EU review team are of the view that the TFTP remains a key and 
efficient instrument to support investigations involving terrorism and terrorist financing as it 
provides timely, accurate and reliable information about financial activities associated with 
completed,  failed,  foiled  terrorist  attacks  and  suspected  acts  of  terrorist  planning  and 
financing. It helps to identify and track terrorists and their support networks worldwide.  

3.2. 

 The EU benefiting from TFTP data  

Reciprocity is a basic principle underlying the Agreement, and two provisions (Articles 9 and 
10) are the basis for Member States as well as, where appropriate, Europol and Eurojust to 
benefit from TFTP data.  

Pursuant  to  Article  9,  the  Treasury  shall  ensure  the  availability  to  law  enforcement,  public 
security, or counter-terrorism authorities of concerned Member States, and, as appropriate, to 
Europol and Eurojust, of information obtained through the TFTP. Article 10 stipulates that a 
law enforcement, public security, or counter-terrorism authority of a Member State, or Europol 
or Eurojust, may request a search for relevant information obtained through the TFTP from the 
US if it determines that there is reason to believe that a person or entity has a nexus to terrorism 
or its financing. There is no legal obligation for the Treasury and Member States to channel 
Article 9 and 10 TFTP-derived information and requests through Europol. The EU review team 
notes that during the review period, Europol was involved in all Member States' requests under 
Article 10 and in all cases of provision of spontaneous information under Article 9.  

The overall use of this mechanism by Member States and the EU has increased since the initial 
phase of the implementation of the Agreement, but the decreased number of requests during 
the  review  period  reflects  the  real  number  of  completed,  failed,  foiled  terrorist  attacks  and 
suspected acts of terrorist planning and financing.  

Joint review 
Review period 

7th 
3rd 
01.12.21 -
01.10.12 - 
30.11.23 
28.02.14 
24 
17 
No of months  
170 
70 
No of requests 
Requests/month 
7.1  
4.1  
Table: Overview of requests per month from Member States and the EU received by the Treasury (Article 10) 

5th 
01.01.16 - 
30.11.18 
35 
402 
11.5  

4th 
01.03.14 - 
31.12.15 
22 
192 
8.7  

2nd 
01.02.11 - 
30.09.12 
20 
94 
4.7  

6th 
01.12.18 - 
31.11.21 
36 
464 
12.9  

1st 
01.08.10 - 
31.01.11 
6 
15 
2.5 - 

6 

 
 
 
Europol initiated in the current review period 30 requests (an increase with 11% per month) 
and transmitted 161 requests from Member States (a decrease with 47% per month)11. There 
were no new requests by Eurojust covered by this review. The number of leads generated by 
the TFTP in response to Article 10 requests has decreased since the two last reviews. During 
the current review period, there were 13 583 leads contained in the 12112 responses provided 
to Member States and Europol as compared to 47 845 leads contained in the 262 responses 
provided to Member States and Europol during the period of the sixth review. This represents 
a  reduction  with  33%  leads  per  month).  However,  the  number  of  leads  remains  higher 
compared  with  the  fourth  review,  both  in  terms  of  the  total  number  of  leads  and  leads  per 
request  and  the  reduction  of  the  average  number  of  leads  per  month,  based  on  Article  10 
requests, decreased from 1 329 to 566 during the review period, can be partly explained by the 
reduced number of completed, failed, foiled terrorist attacks in the EU (decreased by 19%) and 
arrests  on  suspicion  of  terrorism  (decreased  by  23%).  During  the  review  period  the  TFTP 
provided leads relating to several terrorist suspects, including 1660 financial leads relating to 
foreign fighters travelling to or returning from Syria and the support networks facilitating or 
funding their movements and training.  

Together with other support from Europol’s Analysis Project (AP) TFTP, TFTP data played 
an important  role in  investigations. For example, TFTP data played an important  role in  an 
investigation of a business network operating in several countries including Spain, thorough 
which funds were diverted to Libya with the purpose of financing a militia operating in that 
country under the umbrella of the terrorist organisation ISIL/Da’esh. The Treasury responded 
to two Article 10 requests with 1287 financial leads connected to the case (see Annex IV that 
also includes other examples of terrorism-related investigations by European authorities).  

Throughout the implementation of the Agreement, Europol played an active role in raising the 
awareness of the possibilities available under the TFTP by promoting the reciprocity provisions 
through the Liaison Bureaux at Europol and dedicated campaigns in Member States, Europol 
has organised several practitioners’ meetings with the aim of maximising the use of the TFTP, 
both in the interests of the US authorities and of Member States. In addition, Europol has during 
the review period proactively initiated a series of requests under Article 10. The leads received 
were  shared  with  relevant  EU  authorities  to  support  investigations.  This  has  helped  raise 
awareness  of added value of the TFTP, resulting  in  an increased use of the TFTP by those 
authorities. 

11   170 of these 191 Article 10 requests had an overseer- approved nexus to terrorism. 17 Article 10 requests did 
not have an overseer- approved nexus to terrorism and four Article 10 requests were still open at the end of 
the review period.  

12   The Treasury responded to all 464 requests received from Member States and the EU  that had an overseer- 
approved nexus to terrorism during the review period. Of these requests, 202 searches were returned without 
results,  which  is  more  than  during  the  previous  review  period.  Such  responses  may  provide  valuable 
information to a counter-terrorism investigator, including that the target may not be using the formal financial 
system to conduct transactions or that the target is no longer conducting transactions using a particular financial 
service provider. The Treasury noted that, due to the timing of some of the 464 requests, some of the responses 
were provided to Europol after the conclusion of the review period. 

7 

 
 
 
 
Europol  highlighted  its  role  in  European  investigations  of  terrorist  attacks  and  financing 
networks and its increasing role as an information hub since the European Counter Terrorism 
Centre (ECTC) took up its activities in January 2016. The fact that the average number of leads 
per month, based on Article 10 requests, decreased from 1 631 to 566 during the review period, 
can be partly explained by the reduction in the number of completed, failed, foiled terrorist 
attacks  in  this  period.  Europol  also  submitted  information  that  the  TFTP  is,  with  the 
establishment of the ECTC, now made use of in every terrorist incident in which Europol is 
involved  in  information  exchange  or  operational  support  activities  as  it  is  considered  an 
instrumental contribution to support common counter terrorism efforts.  

Pursuant to Article 9, the US supplied 2813 TFTP-derived reports consisting of 4 713 US leads 
during this review period, and 26 116 since the TFTP Agreement entered into force in 2010. 
This figure includes both the information provided to/through Europol and directly to Member 
States' authorities. Usually, the information provided directly would be shared in the context 
of an investigation of a counter-terrorism case of mutual concern for the US and a Member 
State. 

The U.S authorities submitted that they received positive feedback from Europol and certain 
EU Member States on the added value of information provided under the TFTP. However, in 
general, and in line with what was submitted in the fifth and sixth joint reviews, the Treasury 
explained  that  the  US  authorities  often  lack  feedback  on  the  usefulness  of  the  TFTP  leads 
supplied to Member States under Articles 9 and 10 of the Agreement. Such information would 
help to understand Member States' needs better, the desirability of a follow-up of cases and 
would further improve the future provision of TFTP leads. Europol has informed the EU review 
team that it always reminds the Member State receiving information under the Agreement to 
provide constructive feedback in relation to the accuracy and relevance of the data transmitted. 
Such feedback appears not to be provided in all cases and Europol has explained that it will 
develop  a  standard  evaluation/reply  form  that  will  be  sent  together  with  the  leads.  It  is 
nevertheless clear that EU Member States’ authorities would be able to process TFTP leads 
more efficiently if they were provided in a digital format. The Treasury submitted that replacing 
paper-based documents with dissemination of leads in digital format would require additional 
declassification  of  documents  under  the  current  arrangements  relating  to  the  security  and 
integrity of the TFTP and therefore result in a delay in the dissemination of leads. The Treasury 
also explained that requirements for establishing the nexus to terrorism and detailed written 
guidance to TFTP users/analysts in relation to the handling of the extracted data contained in 
printed results of searches, has been included in their training programmes.  

The Commission services notes that the EU has during the current review period, continued 
to  benefit  from  the  TFTP  and  recognise  the  value  of  the  support  from  Europol’s  Counter 
Terrorism Centre and its Analysis Project (AP) TFTP in to formulating EU requests for TFTP 
searches. 

13   The 28 packages of Article 9 leads received by Europol referred to in Annex II.C equals the 198 TFTP-

derived reports referred to by the Treasury in its reply to question 4 of the EU questionnaire in annex III. 
These includes an identical number of leads. 

8 

 
 
 
 
The  EU  review  team  invites  the  Treasury  and  Europol  to  continue  to  reflect  on  and  how 
declassification  of  the leads  to  allow  for  dissemination  of  digital  documents/leads  could  be 
processed more rapidly.  

The  EU  review  team  welcomes  Europol’s  intention  to  develop  a  standard  evaluation/reply 
form that will be sent to the requesting authority together with the leads to support feedback to 
the Treasury. The EU Review team also notes that the Treasury’s written guidelines to TFTP 
users/analysts could support Europol’s outreach activities with Member States.  

3.3.  TFTP Provided Data accessed  

Article 13 of the Agreement stipulates that the review should have a particular regard to, inter 
alia,  the  number  of  financial  payment  messages  accessed.  The  Treasury  explained  that  the 
volume of financial payment messages that are transferred in response to an Article 4 request 
vary  from  one  request  to  another,  but  it  never  exceeded  20%  of  the  messages  held  by  the 
Designated Provider. Less than 1% of this data was accessed.  

As explained by the Treasury in its reply to the EU questionnaire (Annex III) and during the 
review,  on  the  one  hand,  the  same  financial  payment  messages  may  respond  to  multiple 
searches needed in one or more investigations, while on the other hand, there are searches that 
return no results. Searches that yield multiple results may allow analysts to determine from the 
search results whether individual messages should be viewed, and thereby accessed, or whether 
they need not be accessed. The overwhelming majority of messages that are accessed will never 
be used; most will be viewed for a few seconds to determine their value and then closed, with 
no further action or dissemination. For these reasons, the most realistic and pragmatic way to 
measure the actual usage of TFTP data is to consider the number of searches run on the data. 

During  the  review  period,  TFTP  analysts  conducted  17  303  searches  of  the  TFTP,  for  an 
average of 721 searches  per month as compared to  828 searches per month  in  the previous 
reporting period (a reduction with 13%). This number includes searches involving data stored 
in and obtained from the United States, as well as data stored in and obtained from the EU 
pursuant to the Agreement. This number includes searches of financial payment messages from 
financial institutions around the world.  

The Treasury maintains its view that disclosure of overly detailed information on data volumes 
would in fact provide indications as to the message types and geographical regions sought (in 
combination with other publicly available information) and would have the effect that terrorists 
would try to avoid such message types in those regions. 

According  to  the  information  shared  by  the  Treasury,  the  trend  of  the  number  of  financial 
messages received  from  the Designated Provider  has been higher over the course of the 24 
months of the review period. The increase was primarily the result of an increase in the volume 
of message traffic transiting the Designated Provider’s system, along with the addition of a 
new jurisdiction to the Requests subject to the Agreement. Additionally, a small portion of the 
increase  could  be  attributed  to  the  inclusion  of  MX  messages  in  the  Designated  Provider’s 

9 

 
 
 
responses  to  Article  4  Requests  (“Requests”)  as  a  part  of  the  global  financial  community’s 
initial transition to the ISO 20022 standard for cross-border payments and reporting.  

The EU review team agrees with the Treasury that the most realistic and pragmatic way to 
measure the actual usage of TFTP data is to consider the number of searches run on the data, 
together with the number of leads these searches generate. 

3.4. 

 Requests to obtain data from the Designated Provider 

The Agreement gives an important role to Europol, which is responsible for receiving a copy 
of  data  requests,  along  with  any  supplemental  documentation,  and  verifying  that  these  US 
requests for data comply with conditions specified in Article 4 of the Agreement, including 
that  they  must  be  tailored  as  narrowly  as  possible  in  order  to  minimise  the  volume  of  data 
requested. Once Europol confirms that the request complies with the stated conditions, the data 
provider is authorised and required to provide the data to the Treasury. Europol does not have 
direct access to the data submitted by the data provider to the Treasury and does not perform 
searches on the TFTP data. 

A.  The  US  Treasury’s  requests  should  be  tailored  as  narrowly  as  possible  to  minimise  the 
amount of data requested. 

Article  4  requests  take  into  account  the  results  of  the  Treasury's  regular  evaluation  of  the 
extracted data received and the utility and necessity of the data for counter-terrorism purposes. 
A large-scale audit and analysis of the extracted data is conducted every year, analysing on a 
quantitative  and  qualitative  basis  the  types  of  data  most  relevant  to  counter-terrorism 
investigations, and the geographic regions where the terrorist threat is particularly high or most 
relevant or susceptible to relevant terrorist activity. 

The Treasury conducted two such large-scale evaluations during the review period. The 2021 
annual evaluation was submitted on 16 December 2022, and the 2022 evaluation on 4 April 
2023. These evaluations each concluded that the Requests were necessary for the purpose of 
the  prevention,  investigation,  detection,  or  prosecution  of  terrorism  or  terrorist  financing. 
During  the  2021  evaluation,  the  Treasury  did  not  recommend  adding  or  removing  any 
jurisdictions  or  message  types  to  the  requests.  During  the  2022  evaluation,  Treasury 
recommended adding one jurisdiction to the requests, due to its risk for terrorist financing. This 
jurisdiction  had  previously  been  identified  by  the  Financial  Action  Task  Force  (FATF)  as 
having  a  high  risk  of  terrorist  financing.  Additionally,  at  least  four  Hezbollah  financiers 
designated by the Treasury have exploited the jurisdiction’s corporate and financial systems to 
benefit  terrorist  groups  and  their  activities  around  the  world.  This  and  additional  justifying 
information is contained in the monthly Article 4 Request. The Treasury will be conducting its 
annual evaluation of jurisdictions and types of data covering January 2023 to December 2023 
during  the  first  half  of  2024.  The  Treasury  stressed  that  it  would  continue  to  review  its 
processes  and  procedures  for  assembling  Requests,  for  the  purpose  of  ensuring  that  the 
Requests  remain  tailored  as  narrowly  as  possible  based  on  past  and  current  terrorism  risk 
analysis. 

10 

 
 
 
In addition to information received both orally and in writing from the Treasury and Europol, 
the  EU  review  team  examined,  by  way  of  representative  sampling,  two  Article  4  requests’ 
classified supporting documentation during the review meeting in Washington DC.  

B. Requests to obtain data and the transition to a new standard for cross-border payments and 
reporting. 

Beginning on March 20, 2023, the global financial community began a transition to the ISO 
20022 standard14 for cross-border payments and reporting, in order to standardize messages 
between financial institutions. This transition is estimated to take place over the course of two 
years until November 2025, during which time financial institutions will gradually change from 
the previous MT format, based on a number (e.g., MT 102), to MX format, based on an ID 
(where for example pacs.008 corresponds to MT 102). The Treasury included, beginning with 
the March 2023 Request, those MX codes that are equivalent to the MTs already requested, 
and worked closely both with the Designated Provider and Europol to confirm that all the MXs 
requested remained equivalent and narrowly scoped to the existing TFTP Agreement. 

The  Requests  have  also  been  modified  to  include  information  that  demonstrates  that  the 
additional  information  requested  from  certain  newly  added  jurisdictions  is  sought  for  the 
prevention,  investigation,  detection,  or  prosecution  of  terrorism  or  terrorist  financing, 
consistent with  Article 4 of the TFTP Agreement. Treasury  added these jurisdictions  to  the 
Request under Article 4 to account for the ISO 20022 changes made by the Designated Provider 
that resulted in these jurisdictions’ data being stored in the European Union.  

However,  requests  that  include  cross-border  message  types  of  all  countries  world-wide  and 
individually  listed jurisdictions should clearly substantiate the necessity  of the data (Article 
4(2)(b)  of  the  TFTP  Agreement)  to  both  EU  and  US  authorities,  and,  in  light  of  the 
proportionality,  the  relationship  between  message  types  and  jurisdictions  should  be  better 
explained in the requests. 

C. The role of Europol and the transition to a new standard 

The  transition  to  ISO  20022  also  led  to  certain  operational  challenges,  which  delayed  the 
verification,  transfer,  and  ingestion  of  TFTP  data  for  March  and  April  2023,  the  first  two 
months in which Treasury requested MX data. As a result of these challenges, a small portion 
of data was not recoverable and, due to the lapse in time, could not be further retrieved by the 
Designated Provider. 

The requests under Article 4 were received every month and covered a period of four weeks, 
with the exemption of the period from March through June of 2023. The March 2023 Article 4 
request was initially submitted to Europol on 11 April 2023 and finalised on 7 June 2023. It 

14   See footnote 2. ISO 20022 is an open global standard for financial information, which includes rich data and 
more structured data fields; the ISO 20022 captures message data in message codes (MXs). This data is 
largely comprised of additional payment-specific financial data in structured fields, but any personal 
information related to the parties to a transaction provided through the MX format messages will be similar 
to that which was provided through MT message types.  

11 

 
 
 
 
took  into  account  the  Designated  Provider’s  ISO  20022  transition  from  MT  (based  on  ISO 
15022) to MX format messages, which had begun on 20 March 2023. The April, May, and 
June 2023 Article 4 requests were then combined into one request submitted to Europol on 
3 July 2023 to make up for delays related to the March 2023 request. Apart from this period, 
there  have  been  no  such  changes  in  the  frequency  of  Article  4  Requests  during  the  review 
period.  It  follows  that  Europol  did  not  complete  the  verification  of  the  Article  4  request  in 
April,  but  engaged  with  the  Designated  Provider  and  the  Treasury  to  obtain  detailed 
information on the change put in place by the Designated Provider and the resulting impact on 
the Article 4 request (content and technical aspects) on Europol’s verification responsibility 
under the Agreement. This verification took more time, with the result that the first Article 4 
verification after the change brought about by the Designated Provider, in March 2023, was 
completed by Europol in June 2023 for the March request. The requests for April, May, and 
June 2023 were completed in July 2023. 

During  the  period  under  review,  Europol  received  22  requests  from  the  Treasury.  With  an 
average  duration  of  two  days  to  perform  its  verification  of  requests  that  on  average  were 
comprised of a documentation set of 206 pages, the EU review team considers that Europol 
verifies requests made by the US “as a matter of urgency” as required by Article 4(4) of the 
Agreement  and  that  Europol  addressed  the  challenges  that  followed  the  transition  to  a  new 
message  standard  in  a  proactive  manner.  The  process  for  preparation,  verification,  and 
validation of Article 4 requests by the Treasury remained the same as in the previous review. 
The statistical information provided by Europol to the EU review team is attached as Annex II.  

Europol outlined its well-established verification process under Article 4 of the Agreement to 
the EU review team, which also includes a formal legal procedural review and obtaining advice 
from the Data Protection Officer of Europol for each request. The assessment of operational 
considerations,  including  security,  on  which  the  requests  are  based  and  against  which  the 
requirement for requests to be tailored as narrowly as possible is examined, remains core for 
an efficient verification. Europol, as a law enforcement agency, has the necessary knowledge 
and ability to cover these aspects.  

The Commission services acknowledge the benefits of the close cooperation between the US 
authorities, Europol and EU counter-terrorism authorities in assessing and communicating on 
terrorism-related threats, and underlines the importance of that such cooperation to  identify 
terrorism related threats, on which the requests are based, continues to remain distinct from 
Europol's verification role under Article 4 of the Agreement.  

The  EU  review  team  received  information  from  the  Designated  Provider  on  the  security 
measures  put  in  place  in  order  to  ensure  the  protection  of  Provided  Data.  Together,  they 
constitute an overall control framework, including for instance the role of the external security 
auditor and the Designated Provider scrutineers who oversee that the Provided Data are only 
used for the purpose of investigating terrorism financing and the monitoring of the deletion of 
unextracted  data  after  a  period  of  5  years.  The  Designated  Provider  also  informed  the 
Commission that, during an initial period after the change in its data storage practice (1 March 
until  23  April  2023),  it  had  encountered  technical  issues  in  the  delivered  MX  messages, 

12 

 
 
 
resulting in the MX messages for this period being unreadable by the Treasury. Both Europol 
and the Treasury confirmed, as required by Article 4.2.d, that no Single European Payments 
Area  data  has  been  requested  or  transmitted,  which  was  also  confirmed  by  the  Designated 
Provider.  

The  EU  review  team  welcomes  the  continued  efforts  to  ensure  that  the  annual  audit  and 
assessments  performed  by  the  Treasury  to  ensure  compliance  with  Article  4(2)  of  the 
Agreement are set up in both a quantitative manner, in particular by determining the message 
types and geographic regions that are the most and least responsive to TFTP searches, and a 
qualitative manner, such as by identifying a recent threat or waning threats to focus on the 
most  appropriate  message  types  and  geographic  regions.  Past  and  current  terrorism  risk 
analysis  should  be  updated  with  more  recent  examples  and  continue  to  be  legally  justified 
(necessity and proportionality stricto sensu) in accordance with Article 4 (2). Thus, requests 
that  include  cross-border  message  types  of  all  countries  world-wide  and  individually  listed 
jurisdictions  should  clearly  substantiate  the  necessity  of  the  data,  and,  in  light  of  the 
proportionality,  the  relationship  between  message  types  and  jurisdictions  should  be  better 
explained in the requests. 

The  EU  review  team  encourages  the  Treasury  to  continue  to  scrutinise  message  types,  in 
particular  cross-border  message  types,  and  geographic  regions  that  have  been  the  least 
responsive as part of their annual audit to determine their qualitative component — namely, 
whether the relatively few responses returned nevertheless contained high-quality information 
or  were  of  particular  value  for  the  purposes  of  the  prevention,  investigation,  detection,  or 
prosecution  of  terrorism  or  its  financing.  The  EU  review  team  welcomes  these  efforts  that 
resulted in updates of the geographic scope and in a reduced number of message types being 
covered  by  production  orders  during  the  review  period,  and  encourages  the  Treasury  to 
continue such efforts and consider more frequent assessments, also in order to minimise the 
data requested and transferred.  

The  EU  review  team  concludes,  based  on  the  explanations  and  information  provided  by 
Europol  and  the  Treasury  during  the  review,  and  also  from  the  Designated  Provider,  that 
Europol  is  fully  accomplishing  its  verification  tasks  pursuant  to  Article  4.  The  delayed 
verification of the Article 4 requests that followed the Designated Provider’s transition from 
MT to MX format messages, demonstrates that Europol makes all efforts to verify that these 
requests clearly substantiate the necessity of the data requested and that the safeguard set out 
in Article 4(4) works well. 

3.5.   Monitoring safeguards and controls – the role of overseers 

Article 5 provides for safeguards to ensure that the Provided Data is only accessed in cases 
where there is a clear nexus to terrorism or its financing, and where the search of the data is 
narrowly  tailored.  The  Treasury  is  responsible  for  ensuring  that  the  Provided  Data  is  only 
processed in accordance with the Agreement. These safeguards are intended to ensure that only 
the data responsive to specific and justified searches on the subjects with a nexus to terrorism 
and  its  financing  is  actually  accessed.  This  means  in  practice  that  while  all  data  provided 

13 

 
 
 
pursuant to Article 4 is subject to search, only a small proportion of the data is actually viewed 
and accessed. Therefore, the data of persons not retrieved in a specific counter-terrorism search 
will not be accessed and will be permanently deleted after five years. 

The  EU  review  team  verified,  with  the  limitations  mentioned  below,  that  the  safeguards 
described in  Article 5 have been put  in  place and function as intended. In addition,  the EU 
review team specifically looked at the functioning of the oversight mechanism described in 
Article 12. 

Technical provisions have been put in place which aim at ensuring that no search can take place 
without the entry of information on the terrorism nexus of the search.  

The EU review team received explanation on how a search at the Treasury takes place. The 
analysts  operating  the  searches  explained  that  specific  measures  have  been  taken  with  the 
objective that the searches are tailored as narrowly as possible by meeting both operational and 
data  protection  considerations.  The  Treasury  highlighted  the  fact  that  the  operational 
effectiveness of the system would be reduced by searches that are not narrowly tailored, since 
these would return too many results and thus too much irrelevant data.  

The  respect  of  these  safeguards  is  ensured  through  the  work  of  independent  overseers,  as 
referred to in Article 12.  

The  EU  review  team  had  the  opportunity  to  speak  to  one  of  the  three  full-time  overseers 
appointed  by  the  Designated  Provider  and  the  overseer  appointed  by  the  European 
Commission. A new overseer appointed by the European Commission took up his post on 1 
October 2022, and the US authorities approved the required security clearance shortly after, 
which allowed the overseer to be operational with a minimum delay. All searches made on the 
provided data before the new overseer took office were scrutinised by the overseers appointed 
by the Designated Provider and by the EU overseer retrospectively. 

The EU review team was informed that the overseers verify 100% of the searches performed 
on  the  provided  data.  In  accordance  with  the  provisions  of  the  Agreement,  they  have  the 
possibility to review in real time and retroactively all searches made of the Provided Data, to 
request additional information to justify the terrorism nexus of these searches, and the authority 
to block any or all searches that appear to be in breach of the safeguards laid down in Article 
5. With regard to the detailed review of the representative and randomly selected 20 individual 
TFTP searches15 made within the review period, all 20 searches were identified and included 
searches requested by the US as well as the EU, but some information in the selected samples 
was considered classified according to US government security protocols and could, therefore, 
not be disclosed to the EU review team. However, the new EU overseer had the ability and 
necessary US security clearances to review all these searches without redactions per the terms 

15 The review covered 501 working days and one of these samples was moved to the Saturday in the weekend 
before. 6 samples were selected between day 1 - 167, 6 samples were selected between day 168 - 334, 6 
samples were selected between day 335 - 501 and the two last samples were selected from the whole review 
period (day 1-501). The Commission used an online random number generator to select the 20 days and a 
predefined list of search numbers for each day were provided).  

14 

 
 
 
 
of the agreement and could confirm that these searches complied with the safeguards applicable 
to the processing of provided data. The EU review team considers that it would be beneficial 
to have more background information relating to the selected searches and also an indication 
of whether and why the respective search was blocked or approved.  

The overseers confirmed that they had made full use of their powers: all overseers, including 
the overseer appointed by the European Commission, had requested additional information on 
an  ongoing  basis  and  also  blocked  searches.  The  overseers  performed  real-time  and 
retrospective  reviews.  It  was  confirmed  to  the  EU  review  team  that,  even  in  cases  of 
retrospective  review,  the  Treasury  does  not  disseminate  any  data  before  the  overseers  have 
completed their scrutiny procedures.  

During the review period, the overseers verified all 17 303 searches conducted by the analysts, 
queried 343 searches (the overwhelming majority of which were selected for routine auditing 
purposes) and blocked 52 searches (0.3% of the total number of searches) as the search terms 
included typos or as the search terms were considered to be too broad or vague. The Treasury 
analysts  conducting  searches  are  offered  to  receive  further  training  to  narrow  the  scope  of 
searches,  prior  to  taking  up  their  duties  or  on  an  ad  hoc  basis.  The  overseers  verified  the 
majority  of  the  searches  as  they  occurred  (approximately  75%)  and  all  of  the  searches, 
including those reviewed retroactively, within one working day. 

The overseers work in a complementary way by supporting each other in order to accomplish 
their tasks. The fact that a search has been selected for scrutiny by one of the overseers is visible 
to the other overseers, who would generally not select the same search in order to avoid the 
duplication and maximize the efficiency of the oversight.  In 2013, the Commission and the 
Treasury  agreed  on  measures  further  supporting  the  role  of  the  EU  overseer(s).  The  EU 
overseer(s) since then have the opportunity to: 

-  

- 

- 

discuss  general  developments,  day  to  day  cooperation  and  any  operational  matters 
relating  to  the  TFTP  during  the  quarterly  meetings  with  the  management  of  the 
Treasury; 

receive  quarterly  threat  briefings  on  terrorist  financing  methods,  techniques  and 
operations relevant to the TFTP in order to have up-to-date knowledge useful for the 
fulfilment of their function; 

discuss the results of the Designated Provider's oversight and audit functions during the 
quarterly and ad-hoc meetings.  

As a result of the Data Provider’s migration to a new messaging standard, responses to Treasury 
requests to obtain data from the provider include the new MX messages, which also contain an 
embedded, mirror image MT message. This change did not materially affect the safeguards, 
controls, or reciprocity provisions set out in the Agreement. The role of overseers, auditors, 
and the supervision of security measures to safeguard classified information were not affected.  

15 

 
 
 
The EU review team  takes note of the assurances by the overseers that  they have verified 
100% of the searches performed on the provided data and the Commission services appreciate 
the Treasury’s efforts to approve the EU Overseers security clearance with a minimum of delay. 

The EU review team underlines the importance of it being granted access to the original log 
files  of  representative  and  randomly  selected  samples,  subject  to  appropriate  security 
clearances and a classified location and controls. To this end the EU review team suggests that, 
at future reviews, the Treasury should provide more background information relating to these 
searches  (e.g.,  an  indication  of  whether  and  why  the  respective  search  was  blocked  or 
approved).  It  would  also  be  of  value  for  the  EU  Review  team  if  the  Treasury  could  make 
additional training material and written guidance to TFTP users/analysts available to the EU 
Review team. 

3.6.  Data security and integrity – independent audit  

The Treasury explained the technical safeguards and physical controls of the TFTP. Questions 
related to this issue in the questionnaire – as well as those raised orally during the on-site visit 
– were replied to comprehensively and satisfactorily by the Treasury.  

The EU review team had the opportunity to speak to Treasury staff as well as a representative 
of  the  Designated  Provider  responsible  for  auditing  procedures  to  test  data  security  and 
integrity which give additional assurances as to the compliance of the TFTP with the provisions 
of the Agreement. They provided a detailed presentation and replied to all subsequent questions 
raised  by  the  team.  The  EU  review  team  received  in  the  context  of  the  sixth  Joint  Review 
additional written information which sets forth the physical and technical security standards 
that applies to all sensitive compartmented information facilities. These standards facilitate the 
protection of sensitive compartmented information, including protection against compromise, 
emanations,  inadvertent  observation  and  overhearing,  disclosure  by  unauthorised  persons, 
forced entry, and the detection of surreptitious and covert entry. No instances of incidents that 
could affect the security and integrity of TFTP data were detected during the review period. 
Due to TFTP data being held in a secure physical environment, stored separately from other 
data on a standalone system with no interconnections with any other database and protected by 
high-level systems and physical intrusion security controls, TFTP data have not been impacted 
by  any  cyber-related  attacks  on  US  government  departments  or  agencies  that  may  have 
occurred during the review period. 

The various presentations to the joint review teams demonstrate that utmost care has been and 
is  being  taken  by  the  US  authorities  to  ensure  that  the  data  is  held  in  a  secure  physical 
environment; that access to the data is limited to authorised analysts investigating terrorism or 
its financing and to persons involved in the technical support, management, and oversight of 
the TFTP; that the data is not interconnected with any other database; and that the Provided 
Data shall not and cannot be subject to any manipulation, alteration or addition. In addition, no 
copies of the Provided Data can be made, other than for recovery back-up purposes. 

The  independent  auditors’  representative,  who  monitors  the  implementation  of  these 
safeguards on a daily basis, confirmed that they execute regular security tests related amongst 
16 

 
 
 
others  to  application,  physical,  logistical,  network  and  database  security.  They  also  closely 
monitor  and  verify  the  deletion  processes.  These  auditors  report  back  to  the  Designated 
Provider  every  three  months,  including  on  whether  there  have  been  any  discrepancies  or 
atypical occurrences related to the data traffic.  

Treasury  security  personnel  have  been  queried  about  adding  biometric  authentication  as  a 
physical security control. TFTP information is currently stored, controlled, and accessed in a 
manner  consistent  with  the  protection  of  domestic  classified  information,  which  does  not 
include  biometric  controls.  Treasury’s  security  team  has  indicated  that  due  to  these  already 
robust protections, current resources do not allow for the addition of biometric access controls. 

The Review Team considers based on the explanations by the Treasury, the measures taken to 
ensure data security and integrity as satisfactory.  

3.7.  Retention and deletion of data 

The EU review team received detailed explanations of the deletion process and its challenges 
due to the technical complexity of the system, the need to ensure strict compliance with the 
Agreement’s safeguards and the danger of causing any accidental harm to the functioning of 
the whole system, as well as on data not yet designated for deletion. The deletion process is 
closely monitored and verified by the independent auditors’ representative.  

The Treasury confirmed that all non-extracted data received prior to 1 March 2019 had already 
been deleted at the time of the review, in accordance with Article 6 (4) of the Agreement.  

Article 6 (1) requires that the Treasury undertake an ongoing and at least annual evaluation to 
identify non-extracted data that is  no longer necessary to  combat terrorism  or its financing. 
Where such data is identified, the Treasury should delete it as soon as technologically feasible. 
The Treasury explained that the annual review to identify non-extracted data is carried out in 
the context of the regular review, analysis, and audit of data, as described in section 3.4, and 
that no measures to identify unnecessary non-extracted data have changed since the 5th Joint 
Review. The Treasury stressed that it does not retain any non-extracted data past five years 
from the date received. It was also underlined that once a message type or geographic region 
is deleted from the Article 4 requests, all previous non-extracted data that had been received 
involving that message type or geographic region are permanently deleted during the course of 
a semi-annual deletion process. 

Article  6  (2)  requires  that  the  Treasury  should  promptly  delete  any  transmitted  financial 
payment  messaging  data  which  were  not  requested.  The  Treasury  confirmed  that  these 
procedures were consistently followed and stressed that there were strict oversight protocols in 
place. Following an upgrade of the system on 10 January 2018 all non-extracted data older than 
five  years  is  automatically  deleted  to  ensure  compliance  with  Article  6  (4).  Independent 
program auditors monitor and confirm that the automatic process is conducted. The Treasury 
explained that there were no audit incidents in which non-extracted data was held on the system 
past the review period.  

17 

 
 
 
Article 6 (5) requires the Treasury to undertake an ongoing, and at least annual, evaluation to 
assess the data retention periods of five years specified in  Article 6  (4), to ensure that they 
continue to be retained no longer than necessary to combat terrorism or its financing. According 
to information received both orally and in writing from the Treasury, the TFTP system is since 
10  January  2018  designed  to  automatically  delete  non-extracted  data  after  five  years.  In 
addition, the Treasury assesses the data retention periods as part of the regular evaluation of 
the  extracted  data  received  described  under  section  3.5  which  includes  investigators’ 
interviews, reviews of counter-terrorism investigations, and an evaluation of current terrorist 
threats and activity. The Joint Value Report adopted by the Commission on 27 November 2013 
concluded that the reduction of the TFTP data retention period to less than five years would 
result in a significant loss of insights into the funding and operations of terrorist groups. 

According  to  Article  6  (7),  the  information  extracted  from  the  Provided  Data,  including 
information shared under Article 7, shall be retained for no longer than necessary for specific 
investigations or prosecutions for which they are used. The EU review team discussed with the 
Treasury the reasonable and efficient implementation of this provision, which does not impose 
a specific retention period and may benefit from further guidance.  

The  Treasury  explained  that,  with  regard  to  the  disseminated  information,  it  notifies  law 
enforcement  and  partner  agencies  that  receive  leads  derived  from  the  TFTP  information 
extracted from Provided Data about the obligation to retain them for a period no longer than is 
necessary for the purpose for which they were shared. Furthermore, counter-terrorism analysts 
using  the  TFTP  receive  training  on  the  safeguards,  dissemination,  and  retention  procedures 
required by the Agreement, prior to use of the system. In addition, US Government agencies 
are  obliged  to  develop  and  implement  retention  schedules  describing  the  disposal  of  their 
records.  

As regards the extracted data retained in the TFTP database, it had been recommended during 
the third joint review that this aspect be included and specified in the Treasury’s instructions 
for the regular evaluations and continue to be monitored in the future. During the fourth joint 
review,  the  Treasury  informed  the  EU  review  team  that  data  extracted  in  the  context  of  its 
operations  is  subject  to  the  records  disposition  schedule  of  the  Office  for  Foreign  Assets 
Control. The Treasury assesses the necessity of retaining extracted data in the sense of Article 
6 (7) during its regular evaluations described under section 3.4., and in relation to, inter alia, 
ongoing investigations and prosecutions.  

Procedures and mechanisms to review the necessity of the retention of extracted data are in 
place. In the course of the current review, no extracted data has been identified as requiring 
deletion.  The  EU  review  team  considers  that  when  judicial  proceedings  have  been  finally 
disposed of, Article 6 (7) requires that the information extracted from Provided Data be deleted 
from  the  TFTP  database,  provided  that  the  information  is  not  being  used  for  other  specific 
investigations  or  prosecutions.  In  this  context,  the  EU  review  team  takes  note  that  Europol 
systematically, when disseminating leads, encourages Member States to inform Europol and 
the Treasury of the follow up of cases regarding which it has received leads from the TFTP.  

18 

 
 
 
In the opinion of the EU review team, it is important to note, in relation to the issue of the 
retention  of  extracted  data,  that  the  overwhelming  majority  of  financial  messages  that  are 
accessed  are  not  further  disseminated.  Most  search  results  are  viewed  for  a  few  seconds  to 
determine  their  value  and  then  closed,  with  no  further  action  or  dissemination.  Since  these 
messages were previously considered as “extracted data”, they also fall within the scope of 
Article 6 (7) of the TFTP Agreement and should only be retained as long as necessary. The EU 
review team would in future reviews welcome more clarity on the retention of analysts’ search 
history, which may include personal data. The EU review team did not receive any assurance 
that this data is deleted at one point in time, but welcomes that the Treasury recently rolled out 
a mechanism for analysts to further narrow the scope of the data extracted from search results. 
This system enhancement is expected to reduce the amount of data retained, but the Treasury 
still needs to evaluate how well it works. Prior to this upgrade, the system retained all messages 
that are opened, irrespective of whether they are responsive to a search. The new mechanism 
will ensure that the system does not retain a message unless an end user positively marks the 
individual messages as responsive to a search.  

The Treasury supplied 52 reports resulting from TFTP data to competent authorities of third 
countries  during  the  review  period.  These  reports  generally  summarise  the  results  of  an 
investigation of a subject and may contain multiple leads. Since the last joint review, all TFTP-
derived information provided to third countries was provided pursuant to existing protocols on 
information  sharing  and  based  on  prior  consent  between  the  United  States  and  the  relevant 
Member State. The Treasury underlined that it did not need to rely on a possible exception for 
the  prevention  of  an  immediate  and  serious  threat  to  public  security  to  share  information 
without prior consent of the concerned Member States. The EU review team did not receive a 
list of the relevant third countries, but notes this is not required under the Agreement. 

EU review team is of the opinion that that retention and deletion of data pursuant to Article 6 
is  satisfactorily  implemented,  and  strengthened  by  a  system  to  automatically  delete  non-
extracted data after five years and regular evaluations to assess the need of requesting data 
relating  to  message types  and geographic scope. These evaluations  result  in the permanent 
deletion of all previous non-extracted data involving the no longer needed message type(s) or 
geographic region(s) during a semi-annual deletion process. The EU review team welcomes 
the Treasury’s work to introduce functionalities in its IT system that would allow for the return 
of extracted data that is viewed by the Treasury analysts but not disseminated further in the 
context of a specific investigation to the database where it will be treated as non-extracted data 
and deleted after 5 years.  

The  EU  review  team  welcomes  that  the  Treasury  has  included  procedures  for  printing 
documents in written guidance documents and training materials, and its efforts to improve its 
mechanisms to review the necessity of retaining “extracted data” to ensure that this data is 
only retained for as long as necessary for the specific investigation or prosecution for which 
they are used (Article 6 (7)). When a case has been finally disposed of, this should lead to the 
deletion of extracted data relating to that case, unless there are other ongoing investigations 
based on the extracted data. The EU review team also notes that it would be helpful to better 

19 

 
 
 
understand the global value of the TFTP Agreement to get a list of those third countries with 
which TFTP data was shared in accordance with Article 7 of the TFTP Agreement (onward 
transfer). 

3.8.  Transparency – providing information to the data subject 
As required by Article 14, the Treasury has set up a specific website with information on the 
Terrorist Finance Tracking Program, to be found at http://www.treasury.gov/tftp. The website 
also  contains  a  document  containing  questions  and  answers  about  the  TFTP,  which  was 
updated in January 2023 and a TFTP Fact Sheet which was updated in December 2023. 

Apart from the website, the Treasury also has an e-mail service available, as well as a telephone 
hotline.  The  telephone  hotline  has  a  special  option  in  the  dial  menu  which  leads  to  more 
information on the TFTP. The automatic message the individual receives refers to the Treasury 
website and includes the possibility of leaving a voicemail message. The Treasury confirmed 
that its personnel will call back the individual, if possible, within 24 hours. During the review 
period, none of the recorded voicemail messages were related to the TFTP. Treasury personnel 
responded  to  several  emails  received  in  the  assigned  e-mail  account  (tftp@treasury.gov) 
containing questions about the scope of the TFTP. 

The  EU  review  team  welcomes  the  recent  update  of  the  Treasury  website,  including  of  its 
section on questions and answers about the TFTP that includes more recent value examples, 
that demonstrate that the programme remains valuable and relevant. 

3.9.  Right of access and to rectification, erasure, or blocking 

Upon the entry into force of the Agreement, the Treasury set up procedures for individuals to 
seek  access  to  their  personal  data  under  the  TFTP  Agreement  and  to  exercise  the  rights  to 
rectification, erasure or blocking of their personal data under the Agreement. These procedures 
are described in Annex III and can also be found on the Treasury website. They have to comply 
with US national law as well as the Agreement. The average number of individuals visiting the 
TFTP  Webpage  in  2022  and  2023  was  48  individuals  per  month,  resulting  in  1  348 
“pageviews” per month16; though there was a decline in the 2023 numbers compared to the 
previous years. 

The Commission and the Treasury worked together and in cooperation with the EU’s (former) 
Article 29 Working Party17 to establish uniform verification procedures and common templates 
to be applied by all National Data Protection Authorities (NDPAs) when receiving the requests 
from EU citizens. These procedures have been agreed upon and put in place as of 1 September 
2013. Prior to that, the Article 29 Working Party informed all its members and requested that 
they make the information and the forms available on their respective websites.  

16   Refreshing the page during same session would count as a second pageview. 
17   The Article 29 Working Party (“Working Party on the Protection of Individuals with regard to the Processing 
of Personal data”) was the independent European working party that dealt with issues relating to the protection 
of privacy and personal data until 25 May 2018 (entry into application of the GDPR). The composition and 
purpose of the Working Party was set out in Article 29 of the Data Protection Directive (Directive 95/46/EC), 

20 

 
 
 
 
During the sixth joint review period, the Treasury identified and shared with the EU review 
team certain refinements to the procedures that may facilitate the prompt receipt of requests 
from the NDPAs by the Treasury. The EU review team is not aware of any issues relating to 
the prompt receipt of requests from NDPAs during the current review period. 

The EU review team notes that the Privacy and Civil Liberties Oversight Board18 (“PCLOB”) 
is  authorised  to  review  the  implementation  of  executive  branch  policies,  procedures, 
regulations,  and  information  sharing  practices  relating  to  efforts  to  protect  the  nation  from 
terrorism, in order to ensure that privacy and civil liberties are protected, and that the TFTP is 
subject  to  PCLOB’s  oversight  authority.  The  PCLOB  concluded  in  November  2020  an 
oversight  review  of  the  TFTP  covering  the  period  of  January  2016  to  November  2018. 
Following  this  review,  it  issued  a  statement  noting  that  its  review  indicates  that  TFTP  is 
thoughtfully designed and not only provides significant value for counter-terrorism, but also 
appropriately protects individual privacy. In this context the PCLOB’s staff provided four non-
binding  recommendations  for  Treasury’s  consideration:  (1)  provide  consolidated,  detailed 
written guidance to TFTP users; (2) provide additional guidance and training on identification 
and handling of US person information; (3) expand its internal privacy function and integrate 
privacy and civil liberties experts into the operation and oversight of TFTP; and (4) consider 
additional measures to promote compliance with privacy protections. The EU review team was 
informed  that  the  Treasury  is  actively  considering  and  addressing  these  non-binding 
recommendations as appropriate. 

The EU review team takes note of the ongoing engagement with the Privacy and Civil Liberties 
Oversight  Board  to  address  its  non-binding  recommendations  from  2020  and  its  previous 
statement  (2020  review)  that  the  TFTP  is  thoughtfully  designed  and  not  only  provides 
significant value for counter-terrorism, but also appropriately protects individual privacy and 
these  non-binding 
welcomes 
recommendations. The EU Review team and the Commission services would welcome further 
updates on how these non-binding recommendations have been addressed.  

the  Treasury’s  consideration  and  work 

to  address 

3.9.1.   Requests for access 

Pursuant  to  Article  15  (1)  of  the  Agreement,  any  person  has  the  right  to  obtain  at  least  a 
confirmation transmitted through his or her NDPA as to whether that person’s data protection 
rights have been respected in compliance with the Agreement and, in particular, whether any 
processing of that person’s personal data has taken place in breach of this Agreement.  

The Treasury has  not  received any  Article 15 requests from  a European  NDPA wherein  an 
individual sought to exercise the provisions described in Article 15 of the Agreement. As of 30 
November 2023, the Treasury has received no requests pending pursuant to Articles 15 or 16 
of the TFTP Agreement. In view of the absence of requests, it was not possible for the EU 
review team to assess the efficiency of the process for right of access set out in Article 15.  

18   https://www.pclob.gov/ 

21 

 
 
 
 
The  Treasury  explained  to  the  EU  review  team  the  process  and  the  technical  aspects  of 
preparing a thorough and correct response to a request. During the process, the Treasury would 
review all search logs and extracted data in order to respond on whether the requester’s data 
protection  rights  have  been  respected  in  compliance  with  the  Agreement  and  in  particular 
whether any processing of that person’s data has taken place in breach of the Agreement in 
accordance with Article 15 (1). The EU Review team notes that identification processes for 
access and other requests might differ and that proof of identity via a photocopy of a passport, 
identity card or other official identity document is not required in all EU Member States. The 
EU Review team would therefore invite the US Treasury to explore how these processes and 
information  given  regarding  identification  could  be  aligned,  e.g.  with  the  procedure  and 
templates established for the EU-U.S. Data Privacy Framework redress mechanism.  

The EU review team encourages the Treasury to increase its efforts to raise awareness of the 
possibility to request access, and notes that the procedures to process requests from persons 
whether their data protection rights have been respected in compliance with the Agreement 
appear to function satisfactory.  

3.9.2.   Requests for rectification, erasure, or blocking 

Article 16 (1) of the Agreement provides for the right of any person to seek the rectification, 
erasure,  or  blocking  of  his  or  her  personal  data  processed  by  the  Treasury  pursuant  to  the 
Agreement where the data is inaccurate, or the processing contravenes the Agreement.  

No requests for rectification, erasure or blocking of personal data under the TFTP had been 
received by the Treasury by the time of the review. 

Administrative redress  under  US law consists of the right to  an administrative appeal  of an 
initial decision in response to a request under Article 15 or 16. The United States has agreed 
that the Treasury shall treat all persons equally in the application of its administrative redress 
process,  regardless  of  nationality  or  country  of  residence.  On  27  November  2017,  the 
Treasury’s  Deputy  Assistant  Secretary  for  Privacy,  Transparency,  and  Records  (DASPTR) 
issued a decision on the first administrative appeal Treasury has received under the Agreement. 
In this decision, the DASPTR upheld the Treasury Privacy Act Officer’s decision under Article 
15. The DASPTR also advised the requester that they may seek judicial review of the decision 
by filing suit in the United States District Court for the District of Columbia and explained in 
further detail  why additional  information  beyond a statement that the requester’s rights  had 
been respected under the TFTP Agreement could not be provided.  

3.10.  Redress 

According to Article 18, individuals have several possibilities for redress, both under EU and 
its Member States’ law and under US law. During the review, only the US redress mechanism 
was discussed. Since the entry into force of the Agreement there has not been any case of a 
claim for redress addressed to the US, so the possible options have not been asserted in practice. 

Article 18 of the Agreement provides that any person who considers his or her personal data to 
have been processed in breach of the Agreement may seek effective administrative or judicial 
22 

 
 
 
redress  in  accordance  with  the  laws  of  the  EU,  its  Member  States,  and  the  United  States, 
respectively. The United States has agreed that the Treasury should treat all persons equally in 
the application of its administrative process, regardless of nationality or country of residence. 
Subject  to  Article  20  (1),  the  Agreement  provides  for  persons,  regardless  of  nationality  or 
country of residence, to have available under US law a process for seeking judicial redress 
from an adverse administrative action. Relevant statutes for seeking redress from an adverse 
Treasury  administrative  action  in  connection  with  personal  data  received  pursuant  to  the 
Agreement  may  include  the  Administrative  Procedure  Act  and  the  Freedom  of  Information 
Act.  The  Administrative  Procedure  Act  allows  persons  to  seek  administrative  and  judicial 
review  of  certain  US  Government  agency  actions.  The  Freedom  of  Information  Act  allows 
persons to utilise administrative and judicial remedies to seek government records. According 
to  the  Treasury,  an  EU  citizen  or  resident  may  seek  judicial  redress  from  an  adverse 
administrative action by filing a complaint with a court in an appropriate venue.  

The Judicial Redress Act of 201519, subject to designation by the US Attorney General, extends 
to EU citizens certain core rights of judicial redress under Privacy Act of 1974.20 EU citizens 
have legal standing before US Courts to file lawsuits in cases of refused access, rectification 
or unlawful disclosure of their personal data. This  supplements the possibilities for judicial 
redress already provided for by the TFTP Agreement. 

The EU review team notes that since the entry into force of the Agreement there has not been 
any case of a claim for redress addressed to the US. 

3.11.  Consultations under Article 19  

In reply to the specific question of the EU review team (question 12 in Annex III), the Treasury 
confirmed the validity of the assurances given during the consultations. It stated that, since the 
TFTP  Agreement  entered  into  force  in  August  2010,  the  US  Government  –  including  all 
departments and agencies – has not collected financial payment messages from the Designated 
Provider in the European Union, except as authorized by the TFTP Agreement. The Treasury 
also  stated that, during that time, the  US Government  has  not  served any subpoenas on the 
Designated Provider in the EU or on the Designated Provider in the United States requesting 
the  production  of  data  stored  in  the  EU,  except  as  authorized  by  Article  4  of  the  TFTP 
Agreement. The Treasury also confirmed that the United States has remained and intends to 
remain in full compliance with all of its commitments under the TFTP Agreement.  

4. 

RECOMMENDATIONS AND CONCLUSION 

On  the  basis  of  the  information  and  explanations  received  from  the  Treasury,  Europol,  the 
Designated Provider and the independent overseers, verification of relevant documents and of 
a representative sample of the searches run on the TFTP provided data that was made available 
to  the EU review team,  the EU Review team  notes the improvements  in  terms of efforts to 
minimise the amount of data requested from the Designated Provider and finds that the Article 

19   Public Law 114 - 126 - Judicial Redress Act of 2015 
20   Public law: 93-579 - Privacy Act of 1974 

23 

 
 
 
 
4 Requests are narrowly tailored in accordance with the Agreement. The Review Team and the 
Commission services are overall satisfied that the Agreement and its safeguards and controls 
are properly implemented. However, it is of concern that the Treasury could not make all the 
samples request by the Commission available for verification. Treasury noted that some of the 
information  related  to  Treasury-provided  sample  searches  was  redacted  according  to  US 
government security protocols at the meeting on 19 and 20 March 2024 in Washington, DC. 
Treasury also noted that these same protocols were used for the EU Review team’s review of 
the  sample  searches  in  the  6th  Joint  Review  and  that  the  EU  overseer  has  the  ability  and 
necessary security clearances to review all the searches without redactions per the terms of the 
agreement.  

Recommendation 1: Continuing the joint efforts to demonstrate the value of the TFTP. 

The review shows efforts by the Treasury to  collect,  analyse and make available to  the EU 
review team and to the public examples demonstrating the important value of the TFTP for 
counter-terrorism  investigations  worldwide,  despite  the  limitations  given  by  the  highly 
sensitive nature of these investigations. The Treasury demonstrated, in its annual evaluation of 
Article 4 Requests, that it assesses the message types and geographic regions that are the most 
and  least  responsive  to  TFTP  searches  and  takes  the  outcome  of  such  an  assessment  into 
account in subsequent Article 4 requests, which results in updated requests that contribute to 
minimise the amount of data requested from the Designated Provider, in line with Article 4 (2). 
The Joint Value Report in Annex IV provides for a list of concrete cases, in which TFTP data 
were used, and explains in the context of this review the added value of the TFTP. The U.S. 
value statement demonstrated that TFTP data has been used to support U.S. law enforcement 
and sanctions-related investigations involving terrorism and terrorist financing.  

However, justifications for specified message types or geographic regions in Article 4 requests 
should be updated with more recent examples and continue to be legally justified (necessity 
and proportionality stricto sensu) in accordance with Article 4 (2) of the TFTP Agreement. 
Moreover, Article 4 requests that include cross-border message types of all countries world-
wide and individually listed jurisdictions should clearly substantiate the necessity of the data 
to both EU and US authorities, and, in light of the proportionality, the relationship between 
message types and jurisdictions should be better explained in the requests. 

It would also be helpful for the EU review team to get a list of those third countries TFTP data 
was shared with in accordance with Article 7 of the TFTP Agreement (onward transfer). 

Recommendation 2: Explaining the value of requested financial message types. 

The transition to a new message standard MX (based on ISO 20022) that started in March 2023 
requires the production of two types of messages: the initial MT messages, which are given a 
MT  number  based  on  10  primary  categories  of  SWIFT  message  types,  and  the  new  MX 
messages, which are given an ID that largely corresponds to a MT number. In view of the long 
transition period which will still last until November 2025, the review team would welcome if 
the  Treasury  could  provide  more  updated  explanations  on  how  the  respective  MX  and  MT 
codes correspond (a conversion table) and a more detailed justification of the value of keeping 
24 

 
 
 
or deleting the selected message type when producing the next annual  evaluation and when 
sending new Article 4 requests to the Designated provider.  

Recommendation 3: Reviewing the necessity of retaining “extracted data”.  

The EU review team recognises the potential value of the new mechanism that will reduce the 
volume of extracted data by ensuring that the TFTP system does not retain a message unless 
an end user positively marks the individual messages as responsive to a search. the EU review 
team  further  suggests  that  the  Treasury,  supported  by  Europol,  improve  its  mechanisms  to 
review the necessity of retaining “extracted data” to ensure that this data is only retained for as 
long as necessary for the specific investigation or prosecution for which they are used (Article 
6  (7)).  This  could  include  documentation  setting  out  the  processes  and  controls  in  place  to 
evaluate the value of extracted data and an evaluation of how well the mechanism for analysts 
to further narrow the scope of the data extracted from searches that do not result in any actions 
or dissemination works. In this context, it is important that Member States increase their efforts 
to  inform  Europol  as  a  Single  Point  of  Contact  for  subsequent  information  of  the  Treasury 
when  a  case  has  been  finally  disposed  of,  which  should  in  principle  lead  to  the  deletion  of 
extracted data relating to that case, unless there are other investigations based on the extracted 
data. Particular attention should be provided to extracted data that is viewed by the Treasury 
analysts, but not disseminated further in the context of a specific investigation.  

The EU review team would in future reviews welcome more clarity on the retention of analysts’ 
search history, which may include personal data.  

Recommendation 4: More feedback from EU Member States to the Treasury. 

As already stated in the last review, Member States’ regular feedback to Europol, for onward 
sharing with the Treasury as appropriate, on the added value of the TFTP leads received from 
the Treasury could further improve the quality and the quantity of information exchanged under 
Articles 9 and 10. The EU review team welcomes and support Europol’s suggestion to develop 
a standard evaluation/reply form that will be sent together with the leads.  

Recommendation 5: Europol’s role and support to EU Member States – promotion and advice. 

The  EU  review  team  acknowledges  the  benefits  of  the  close  cooperation  between  the  US 
authorities, Europol and EU counter-terrorism authorities in assessing and communicating on 
terrorism-related  threats  ensuring  that  the  TFTP  also  addresses  the  threat  from  the  EU 
perspective. Europol is fully accomplishing its tasks pursuant to Article 4. It is important that 
such cooperation continue to remain independent from the verification role of Europol under 
Article 4 of the Agreement. 

Europol is encouraged to continue its efforts to actively promote awareness of the TFTP and 
to  support Member States seeking  its advice and experience in  devising targeted Article 10 
requests. The EU Review team also notes that the Treasury’s requirements for establishing the 
nexus to terrorism and its written guidelines to TFTP users/analysts could support Europol’s 
outreach activities with Member States.  

25 

 
 
 
Recommendation 6: Reviewing the modalities for how, in the future, the EU Review team 
can verify the original log entries of the representative and randomly selected search samples. 

With regard to the detailed review of the representative and randomly selected 20 individual 
TFTP searches made within the review period, the EU review team was only given extracts of 
their logs as some of the selected samples were considered by the Treasury to be classified due 
to ongoing investigations. The EU review team considers that it would be beneficial to have 
more background information relating to these searches together with an indication whether 
and why the respective search was blocked or approved. 

While all the samples were reviewed by the overseers who ensured the compliance with the 
safeguards  listed  in  Article  5  (the  purpose  limitation  that  the  provided  data  exclusively  be 
processed  for  the  prevention,  investigation,  detection  or  prosecution  of  terrorism  or  its 
financing and that all the searches should have a nexus to terrorism or its financing), the review 
team could only indirectly verify the selected samples based on an extract from the log entries. 
While Treasury followed the same protocols for the EU Review team’s sample search review 
in  the  6th  Joint  Review  as  was  followed  in  this  review,  Treasury  should,  at  future  reviews, 
consider  additional  steps  to  better  support  the  review  of  the  original  log  files  of  selected 
samples to  allow for a more direct  verification of their compliance with  the safeguards and 
controls set out in the agreement, in accordance with Article 13 of the TFTP Agreement.  

It would also be of value for the EU Review team if the Treasury could make additional training 
material and written guidance to TFTP users/analysts available to the EU Review team. 

Recommendation 7: Facilitating the processing of leads (digitalisation). 

EU  authorities  submitted  that  the  leads  provided  on  paper  by  the  Treasury  could  be  more 
efficiently processed if they are provided digitally. Even if the declassification of electronic 
documents  may  be  subject  to  more  lengthy  procedures  than  paper  documentation,  the  EU 
review team invite the Treasury and Europol to consider ways to facilitate the processing of 
leads, in compatibility with the security arrangements of the TFTP.  

Recommendation 8: Verification of data protection rights.  

The EU review team notes that the procedures to process requests from persons whether their 
data  protection  rights  have  been  respected  in  compliance  with  procedure  set  out  in  the 
Agreement appear to function well. However, the EU review team suggest that the Treasury 
ensures that such verifications cover all relevant rights under the Agreement, including that 
data  has  only  been  searched  where  there  is  pre-existing  information  or  evidence  which 
demonstrates a reason to believe that the subject of the search has a nexus to terrorism or its 
financing. The EU review team underlines the importance of that the Privacy Officer of the 
Treasury, charged with the implementation of Articles 15 and 16 of the Agreement, continue 
its  efforts  to  make  right  of  access  and  redress  more  available  to  persons  and  consider  how 
procedures can tested in the absence of specific requests. The EU Review team would therefore 
invite the US Treasury to explore how EU and US identification processes for access and other 
requests processes and information given regarding identification could be aligned.  

26 

 
 
 
---oOo--- 

A regular review of the Agreement is essential to ensure its proper implementation, to build up 
a relationship of trust between the contracting parties and to provide reassurances to interested 
stakeholders on the usefulness of the TFTP instrument. It was agreed to carry out the next joint 
review according to Article 13 of the Agreement in the beginning of 2026.  

27 

 
 
 
Annex I – Composition of the review teams 

The members of the Article 13 EU review team were: 

−  Mr.  Martin  Schieffer,  Head  of  the  EU  Article  13  review  team,  Head  of  Unit,  Counter 
Terrorism, Directorate-General Migration and Home Affairs, European Commission, Head 
of the EU Article 13 review team 

−  Mr. Bertil Vagnhammar Team leader, Counter Terrorism, Directorate-General Migration 

and Home Affairs, European Commission 

−  Ms. Ines Walburg, Head of a division, the Hessian Commissioner for Data Protection and 

Freedom of Information, Germany  

−  Mr. Ronny Saelens, Commissioner-Investigator, Member-director a.i., Supervisory Body 

for Police Information, Belgium  

It is noted that Ines Walburg and Ronny Saelens participated in the EU review team as 
experts for the Commission and not in their other professional capacities. 

The members of the Article 13 United States review team were: 

–  Ms.  Sara  Thannhauser,  Head  of  the  U.S.  Article  13  review  team,  Acting  Associate 
Director, Office of Foreign Assets Control, U.S. Department of the Treasury (Head of U.S. 
delegation)  

–  Mr. Joe Twinem, Senior Sanctions Policy Advisor, Office of Foreign Assets Control U.S. 

Department of the Treasury  

–  Ms.  Emma  Kapoor,  Sanctions  Investigator,  Office  of  Foreign  Assets  Control,  U.S. 

Department of the Treasury 

–  Ms. Rose O’Brien, Program Analyst, Office of Foreign Assets Control, U.S. Department 

of the Treasury 

–  Mr. John Snodgrass, Attorney-Advisor, Office of the General Counsel, U.S. Department 

of the Treasury  

–  Ms.  Rebecca  Richards,  Civil  Liberties  Protection  Officer,  Office  of  Civil  Liberties, 

Privacy, and Transparency, Office of the Director of National Intelligence 

–  Mr. Dylan Cors, International Director, National Security Division, U.S. Department of 

Justice  

28 

 
 
 
 
Annex II – Europol statistical information regarding Articles 4, 9 and 10 of the EU-US 
TFTP Agreement 

A.  Summary of statistics for Article 4 requests under the TFTP Agreement: 

May-22 

03/05/2022 

Period 

Month 

Dec-21 

Jan-22 

Feb-22 

Mar-22 

Apr-22 

Jun-22 

Jul-22 

Aug-22 

Sep-22 

Oct-22 

Nov-22 

Dec-22 

Jan-23 

Feb-23 

Mar-23 

Apr-23 

May-23 

Jun-23 

Jul-23 

Aug-23 

Sep-23 

Oct-23 

Nov-23 

December 2021 – November 2023 

Article 4 request 

Communication with the 
Designated Provider 

Total set of verification 
documentation 
(including DPO advice, 
verification decision) 

Date of receipt 

Number of pages 

Delay 
notification21 

Verification 

Number of pages 

07/12/2021 

11/01/2022 

01/02/2022 

15/03/2022 

06/04/2022 

07/06/2022 

06/07/2022 

04/08/2022 

08/09/2022 

03/10/2022 

08/11/2022 

05/12/2022 

10/01/2023 

08/02/2023 

07/03/2023 

149 

151 

153 

154 

157 

159 

161 

163 

164 

166 

156 

158 

157 

157 

157 

155 

08/12/2021 

12/01/2022 

03/02/2022 

18/03/2022 

07/04/2022 

04/05/2022 

08/06/2022 

07/07/2022 

08/08/2022 

09/09/2022 

04/10/2022 

10/11/2022 

06/12/2022 

11/01/2023 

09/02/2023 

08/03/2023 

07/06/202322 

188 

09/06/2023 

03/07/2023 

08/08/2023 

06/09/2023 

25/10/2023 

07/11/2023 

227 

223 

200 

217 

214 

172 
Average (rounded) 

05/07/2023 

10/08/2023 

08/09/2023 

25/10/2023 

08/11/2023 

187 

190 

192 

194 

195 

194 

195 

200 

201 

204 

192 

179 

177 

177 

177 

174 

216 

272 

248 

226 

246 

241 

204 

Average (rounded) 

21  A notification of delay is issued by Europol to the concerned parties when the verification process is 

expected to take longer than 48 hours of working days. 

22   Following the change on the side of the Designated Provider in March 2023 it took Europol between April 
until the beginning of June 2023, to verify the Article 4 requests. The first Article 4 verification after the 
change brought about by the Designated Provider was completed by Europol in June 2023, covering the 
period between March 2023, followed by the Article 4 verification in July 2023. 

29 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
B.  Summary of monthly figures (as per 1 December 2021) 

2021 

Month 

Article 4 

Article 923 

Article 1024 

2022 

Month 

Article 4 

Article 9 

Article 10 

2023 

Month 

Article 4 

Article 9 

Article 10 

01 
2021 

02 
2021 

03 
2021 

04 
2021 

05 
2021 

06 
2021 

07 
2021 

08 
2021 

09 
2021 

10 
2021 

11 
2021 

12 
2021 

1 

0 

5 

01 
2022 

02 
2022 

03 
2022 

04 
2022 

05 
2022 

06 
2022 

07 
2022 

08 
2022 

09 
2022 

10 
2022 

11 
2022 

12 
2022 

1 

0 

6 

1 

0 

17 

1 

0 

9 

1 

0 

7 

1 

0 

3 

1 

0 

5 

1 

0 

1 

0 

1 

0 

13 

11 

10 

1 

4 

5 

1 

0 

6 

1 

5 

5 

01 
2023 

02 
2023 

03 
2023 

04 
2023 

05 
2023 

06 
2023 

07 
2023 

08 
2023 

09 
2023 

10 
2023 

11 
2023 

12 
2023 

1 

4 

6 

1 

0 

1 

0 

13 

13 

0 

0 

5 

0 

7 

4 

1 

3 

4 

1 

1 

12 

1 

4 

7 

1 

0 

12 

1 

0 

5 

1 

0 

8 

C.  Summary for the review period 

12/2021 – 11/2023 
(review period) 

Article 4 

Article 9 

Article 10 

Sum 

22 

28 

191 

Requester 

2021 (12/21) 

2022 

2023 (11/2023) 

Article 10 requests 

EU Member States 

Europol 

Eurojust 

Total 

5 

0 

0 

5 

76 

21 

0 

97 

80 

9 

0 

89 

D.  Summary of intelligence leads (overall, as per 30 November 2023) 

23  The figures refer to the number of instances of information provided by the  US authorities under Article 9, routed 
through Europol; the overall number of intelligence leads is shown in Section D below (bilateral information provided 
to EU Member States is not included). 

24  The figures refer to the number of instances of information requests under the Article 10, routed through Europol; the 
number of overall intelligence leads is shown in Section D below (bilateral information requests between EU Member 
States and US are not included). 

30 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Article 9: Information spontaneously provided by the United States 

Instances 
26625 

Article 10: Requests for searches 

Requests 

1 488 

Leads 

26 116 

Leads 

145 803 

Article 10 Requests – Referrals by United States DoT26 

44 

E.  Use of TFTP in relation to the phenomenon of foreign fighters (overall, as per 30 November 

2023) 

Article 9: Requests for searches 

Requests 

146 

Article 10: Requests for searches 

Requests 

523 

Leads 

21 615 

Leads 

54 323 

25   The 28 packages of Article 9 leads received by Europol referred to in Annex II.C equals the 198 TFTP-

derived reports referred to by the Treasury in its reply to question 4 of the EU questionnaire in annex III. 
These includes an identical number of leads. 

26   Referrals for providing complementary information (e.g., establishment of nexus to terrorism) 

31 

 
 
 
 
 
 
 
 
Annex III – Responses by the U.S. Treasury Department to the European Union 
Questionnaire for the seventh Joint Review of the EU – U.S. Terrorist Finance Tracking 
Program Agreement  

(March 2024) 

I. Review Scope and Period 

The first Terrorist Finance Tracking Program (TFTP) Joint Review, carried out in February 
2011, covered the period of the first six months after the entry into force of the TFTP 
Agreement (1 August 2010 until 31 January 2011), and the Second Joint Review covered the 
ensuing period from 1 February 2011 until 30 September 2012. The Third Joint Review 
covered the period from 1 October 2012 until 28 February 2014. The Fourth Joint Review 
covered the period from 1 March 2014 to 31 December 2015. The Fifth Joint Review covered 
the period from 1 January 2016 to 30 November 2018. The Sixth Joint Review covered the 
period from 1 December 2018 to 30 November 2021. This Seventh Joint Review will cover 
the period from 1 December 2021 through 30 November 2023. 

Pursuant to Article 13(1), the Joint Review should cover “the safeguards, controls, and 
reciprocity provisions set out” in the TFTP Agreement. In this context, Article 13(2) 
specifies that the Joint Review should have particular regard to: 

a)  the number of financial payment messages accessed; 
b)  the number of occasions on which leads have been shared with Member States, third 

countries, and Europol and Eurojust; 

c)  the implementation and effectiveness of the TFTP Agreement, including the 

suitability of the mechanism for the transfer of information; 

d)  cases in which information has been used for the prevention, investigation, detection, 

or prosecution of terrorism or its financing; 

e)  compliance with the data protection obligations specified in the TFTP Agreement. 
Article 13(2) further states that "the review shall include a representative and random sample 
of searches in order to verify compliance with the safeguards and controls set out in this 
Agreement, as well as a proportionality assessment of the Provided Data, based on the value 
of such data for the investigation, prevention, detection, or prosecution of terrorism or its 
financing." 

Below are responses developed by the U.S. Department of the Treasury (Treasury) to 
questions provided by the European Commission in advance of the Seventh Joint Review. 
Where appropriate, these responses have been coordinated with Europol. 

32 

 
 
 
 
 
 
II. Statistical Information 

the 

total  number  of 

1.  In comparison to the period covered by the three previous joint reviews, what is the 
financial  payment  messages  provided 

trend  of 
(substantially/slightly higher/lower, about the same)? 
The trend of the total number of financial payment messages received from the Designated 
Provider has been higher over the course of the 24-month period between 1 December 2021 
through 30 November 2023 (“the review period”). This increase is primarily the result of 
an increase in the volume of message traffic transiting the Designated Provider’s system, 
along with the addition of a new jurisdiction to the Requests subject to the Agreement. 

Additionally, a small  portion of the increase could  be attributed to  the inclusion of MX 
messages in the Designated Provider’s responses to Article 4 Requests (“Requests”) as a 
part of the global financial community's initial  transition  to  the  ISO 20022 standard for 
cross-border payments and reporting. Please see the response to Question 14 for further 
explanation and background regarding the transition to ISO 20022. 

2.  How many searches were conducted during the period subject to this review and how 
many  financial  payment  messages  were  accessed  (i.e.,  extracted)  during  the  period 
covered by the review? 
During the review period, TFTP analysts conducted 17,303 searches of data provided by 
the Designated Provider, for an average of 721 searches per month. This number includes 
searches of financial payment messages sent by financial institutions around the world. 

A single investigation may require numerous TFTP searches. Each TFTP search may return 
multiple results or no results at all. Searches that yield multiple results may allow analysts 
to determine from the search results whether individual messages should be viewed, and 
thereby accessed, or whether they need not be accessed. In addition, most messages that 
are accessed are not disseminated. Most are viewed for a few seconds to determine value 
and  thereafter  closed,  with  no  further  action  or  dissemination.  Please  see  response  to 
Question 31 for further information regarding extracted data. 

3.  In  comparison  to  information  provided  to  competent  authorities  in  the  European 
Union and third countries, what is the trend of information derived from accessing 
these payment messages provided to competent U.S. authorities (substantially/slightly 
higher/lower, about the same)? 
The  provision  of  TFTP-derived  information  to  European  Union  and  third  countries  has 
decreased during the review period. Treasury has provided TFTP-derived information to 
competent  U.S.  authorities 
in  connection  with  ongoing  U.S.  counter-terrorism 
investigations  at  about  the  same  rate  as  in  the  prior  review  period.  For  more  detailed 
information, please see responses to Questions 4, 5, 10, and 11. 

4.  In how many cases was information derived from accessing these payment messages 
provided  to  competent  authorities  in  the  European  Union,  including  Europol  and 
Eurojust? 

33 

 
 
 
During the review period, U.S. investigators supplied 198 TFTP-derived reports, consisting 
of 4,713 leads pursuant to Article 9 and an additional 13,583 leads pursuant to Article 10, 
to competent authorities of European Union Member States and Europol. A TFTP “lead” 
refers to the summary of a particular financial transaction identified in response to a TFTP 
search  that  is  relevant  to  a  counter-terrorism  investigation.  A  single  TFTP  report  may 
contain  multiple  TFTP  leads.  For  example,  one  Article  10  report  provided  to  Europol 
during the review period contained 1,269 TFTP leads. 

Reports have been used to share TFTP-derived information with European Union Member 
States and third country authorities. This mechanism generally involves situations in which 
U.S.  counter-terrorism  authorities  are  working  with  a  counterpart  foreign  agency  on  a 
counter-terrorism  case  of  mutual  concern  or  where  U.S.  counter-terrorism  authorities 
discover counter-terrorism information that they believe affects or would assist the work of 
a foreign counterpart. In such a situation, TFTP-derived information regarding a particular 
terrorism suspect or case would be supplied to the foreign counterpart—generally with no 
indication that any of the information came from the TFTP. Since the TFTP Agreement 
entered into force in August 2010, the U.S. government has continued to use reports as the 
vehicle for the spontaneous provision of information to the competent authorities of EU 
Member States and Europol pursuant to Article 9. Article 9 reports provided to Europol are 
explicitly identified as containing TFTP-derived information. 

5.  In how many cases was information derived from accessing these payment messages 

provided to third countries? 
U.S. investigators supplied 52 reports, including Article 9 and Article 10 reports, resulting 
from TFTP data to competent authorities of third countries during the review period. As 
described in response to Questions 2 and 4, above, these reports generally summarize the 
results of an investigation of a subject, which typically encompass multiple TFTP searches, 
each potentially including numerous messages, and may contain multiple leads. 

6.  In how many cases was prior consent of competent authorities in one of the European 
Union Member States requested for the transmission of extracted information to third 
countries, in accordance with Article 7(d) of the Agreement? 
Article  7(d)  authorizes  the  sharing  of  certain  information  involving  European  Union 
persons “subject to the prior consent of competent authorities of the concerned Member 
State  or  pursuant  to  existing  protocols  on  such  information  sharing  between  the  U.S. 
Department of the Treasury and that Member State.” Since the last Joint Review, all TFTP-
derived information provided to third countries was provided pursuant to existing protocols 
on information sharing between the United States and the relevant Member State. 

In the event information could not be shared pursuant to existing protocols, Treasury would 
not  disseminate  the  information  without  prior  consent  of  the  concerned  Member  States, 
except where the sharing of the data was essential for the prevention of an immediate and 
serious threat to public security of a Party to the TFTP Agreement, a Member State, or a 
third  country.  Because  Treasury  relied  on  existing  protocols  with  relevant  EU  Member 
States for all information sharing with third countries during the review period, it did not 

34 

 
 
 
need to rely on this exception for the prevention of an immediate and serious threat to public 
security to share information. 

7.  For the sharing of information with third countries or other appropriate international 
bodies, what was the remit of their respective mandates as mentioned in Article 7(b) 
of the Agreement? 
In  accordance  with  Article  7(b),  TFTP-derived  information  was  shared  only  with  law 
enforcement, public security, or counter-terrorism authorities, for lead purposes only, and 
solely  for  the  investigation,  detection,  prevention,  or  prosecution  of  terrorism  or  its 
financing.  Certain  classified  information  also  was  shared  in  connection  with  the  U.S.- 
European Union Joint Review of the TFTP Agreement in February 2011, the Second Joint 
Review in October 2012, the Third Joint Review in April 2014, the Fourth Review in March 
2016, the Fifth Joint Review in January 2019, and the Sixth Joint Review in March 2022. 

8.  Please elaborate on cases in which the information provided has been used for the 
prevention,  investigation,  detection,  or  prosecution  of  terrorism  or  its  financing  as 
mentioned in Article 13(2)(d) of the Agreement. 
Please see attached Value Statements. 

9.  Did any of these cases end in any judicial findings? If so, did the judicial authority 

accept the TFTP-derived information as supporting or indirect evidence? 
Article 7(c) provides that TFTP-derived information may be used for lead purposes only 
and for the exclusive purpose of the investigation, detection, prevention, or prosecution of 
terrorism  or  its  financing,  and  such  information  is  shared  based  on  those  conditions, 
meaning  that  U.S.,  European  Union,  and  third-country  authorities  may  not  directly  use 
TFTP-derived information in a criminal trial. Instead, the authorities must use the TFTP- 
derived information as a means to gather the evidence that may properly be presented to a 
judicial authority in a proceeding. Treasury does not and could not track where authorities 
may have used counter-terrorism lead information derived from the TFTP as a means to 
gather evidence that might be used in a judicial proceeding. Treasury is aware, however, 
that  TFTP-derived  information  has  been  used  with  some  frequency  by  U.S.  and  other 
counter-terrorism investigators for lead purposes to support their investigations, including 
in connection with obtaining evidence through legal process. 

10. In  how  many  cases  was  information  provided  spontaneously,  in  accordance  with 
Article  9  of  the  Agreement?  What  has  been  Treasury's  experience  with  receiving 
follow-on information conveyed back by Member States, Europol or Eurojust? 
During the review period, Treasury provided 28 reports consisting of 4,713 TFTP leads to 
European Union Member States and Europol as the spontaneous provision of information 
pursuant to Article 9. 

Treasury  has  received  positive  feedback  from  Europol  and  certain  European  Union 
Member States about the value of Treasury’s provision of TFTP-derived information and 
its  significant  impact  on  European  counter-terrorism  investigations.  However,  it  is 
uncommon  for  European  Union  Member  States  or  Europol  to  provide  Treasury  with 

35 

 
 
 
analytic “follow-on information” in response to the provision of information pursuant to 
Articles 9 and 10. Treasury appreciates Europol’s ongoing efforts to encourage European 
Union Member States to provide such feedback, where possible, to Treasury, and continues 
to believe that the provision of such follow-on information would greatly enhance its ability 
to provide valuable information to European Union authorities. 

11. How many European Union requests for TFTP searches in agreement with Article 10 
of the Agreement have been received? In how many cases did these requests lead to 
the transmission of information? In how many cases was there feedback to Treasury 
on that information coming from EU-MS or Agencies? 
Treasury received 191 requests from European Union Member States and Europol pursuant 
to Article 10 during the review period and responded to 170 requests that had an overseer- 
approved  nexus  to  terrorism.  Seventeen  Article  10  requests  did  not  have  an  overseer- 
approved  nexus  to  terrorism.  Four  Article  10  requests  were  still  open  at  the  end  of  the 
review  period.  All  Article  10  requests  are  reviewed  by  both  the  Designated  Provider 
Overseer  and  the  European  Union  Overseer  prior  to  performing  searches,  to  maintain 
compliance with the Agreement. TFTP searches resulted in the transmission of leads to the 
European  Union  in  response  to  121  of  the  170  requests.  The  other  49  requests  had  no 
responsive  leads.  There  were  13,583  leads  contained  in  the  121  Article  10  responses 
provided  to  European  Union  Member  States  and  Europol  during  the  review  period. 
Throughout the review period, Europol provided Treasury with European Union Member 
States’ feedback regarding TFTP information that provided significant leads to European 
counter-terrorism investigations via 15 Article 10 responses. 

III. Implementation and Effectiveness of the Agreement 

12. Can  you  confirm  that  the  assurances  given  by  Treasury  during  the  consultations 
carried  out  under  Article  19  of  the  Agreement  in  2013  are  still  valid  and  that  the 
United States has remained and will remain in full compliance with the Agreement? 
Yes.  Since  the  TFTP  Agreement  entered  into  force  in  August  2010,  Treasury  has  not 
collected financial payment messages from the Designated Provider in the European Union, 
except as authorized by the TFTP Agreement. Moreover, during that time, Treasury has 
not  served  any  subpoenas  on  the  Designated  Provider  in  the  European  Union  or  on  the 
Designated Provider in the United States requesting the production  of data stored in the 
European  Union,  except  as  authorized  by  Article  4  of  the  TFTP  Agreement.  Treasury 
confirms that the United States has been, is, and intends to remain in full compliance with 
all of its commitments under the TFTP Agreement. 

13. During  the  period  covered  by  the  review,  have  any  particular  issues related  to  the 
implementation  and  effectiveness  of  the  Agreement  been  identified,  including  the 
suitability of the mechanism for the transfer of information? If so, which? 
No such issues have been identified. 

36 

 
 
 
14. How has the introduction of a new standard for financial messaging data (ISO 20022), 
introduced during the period covered by the review, affected the implementation of 
the Agreement, including the impact on the geographical scope of Article 4 requests? 
Beginning on March 20, 2023, the global financial community began a transition to the 
ISO  20022  standard  for  cross-border  payments  and  reporting,  in  order  to  standardize 
messages between financial institutions. ISO 20022 is an open global standard for financial 
information,  which  includes  rich  data  and  more  structured  data  fields;  the  ISO  20022 
captures message data in message codes (MXs). This data is largely comprised of additional 
payment-specific financial data in structured fields, but any personal information related to 
the parties to a transaction provided through the MX format messages will be similar to 
that which was provided through MT message types. This transition is estimated to take 
place  over  the  course  of  two  years  until  November  2025,  during  which  time  financial 
institutions will gradually change from the previous MT format to MX format. Treasury 
included, beginning with the March 2023 Request, those MX codes that are equivalent to 
the MTs already requested. Treasury worked closely both with the Designated Provider and 
Europol to confirm that all of the MXs requested remained equivalent and narrowly scoped 
to the existing TFTP Agreement. 

The Requests have also been modified to include information that demonstrates that the 
additional information requested from certain newly added jurisdictions is sought for the 
prevention,  investigation,  detection,  or  prosecution  of  terrorism  or  terrorist  financing, 
consistent with Article 4 of the TFTP Agreement. Treasury added these jurisdictions to the 
Request  and  Article  4  to  account  for  the  ISO  20022  changes  made  by  the  Designated 
Provider that resulted in these jurisdictions’ data being stored in the European Union. 

The transition to ISO 20022 also led to certain operational challenges, which delayed the 
transfer  and  ingestion  of  TFTP  data  for  March  and  April  2023,  the  first  two  months  in 
which Treasury requested MX data. As a result of these challenges, a small portion of data 
was not  recoverable and, due to the lapse in time, could not  be further  retrieved by the 
Designated Provider. 

15. What  has  been  the  frequency  of  requests  to  Europol  and  the  Designated  Provider 
under Article 4 of the Agreement, and did these requests contain personal data? 
During the review period, Treasury submitted its  Article 4 Requests on a monthly basis 
with the exception of the period from March through June of 2023. The March 2023 Article 
4 Request was initially submitted to Europol on April 11, 2023 and finalized on June 7, 
2023. It took into account the Designated Provider’s ISO 20022 transition from MT to MX 
format messages, which had begun on March 20, 2023. The April, May, and June 2023 
Article 4 requests were then combined into one request submitted to Europol on July 3, 
2023 to make up for delays related to the March 2023 request. Apart from this period, there 
have been no such changes in the frequency of Article 4 Requests during the review period. 

The Article 4 Requests initially submitted to Europol following the entry into force of the 
Agreement contained minimal personal data, such as the names and business addresses of 
the sender and recipient  of the Requests and the names of two top  Al-Qaida leaders.  In 

37 

 
 
 
response to  comments  provided by Europol,  Treasury expanded the  amount  of personal 
data  included  in  its  Article  4  Requests—such  as  the  names  of  other  terrorists,  their 
supporters, and terrorism-related suspects—to  provide additional information relating  to 
the provisions of Article 4 regarding the necessity of the data and terrorism-related threats 
and vulnerabilities. 

Please see attached Value Statements. 

16. What  measures  have  been  put  in  place  to  ensure  that  the  requests  are  tailored  as 

narrowly as possible, as required under Article 4(2)(c)? 
Treasury  regularly  performs  a  review  of  the  extracted  data  received  and  the  utility  and 
necessity  of  the  data  for  counter-terrorism  purposes.  The  review  is  a  quantitative  and 
qualitative  analysis  that  determines  the  types  of  data  most  relevant  to  counter-terrorism 
investigations, and the geographic regions where the terrorist threat is particularly high or 
susceptible  to  relevant  terrorist  activity.  In  tandem  with  this  regular  review,  Treasury 
conducts a comprehensive annual evaluation of its Article 4 Requests to assess compliance 
with  Article  4(2)(C).  During  the  review  period,  Treasury  completed  two  annual 
evaluations.  Treasury  submitted  the  evaluation  of  2021  data  (“2021  evaluation”)  on 
December 16, 2022 and the evaluation of 2022 data (“2022 evaluation”) on April 4, 2023. 
These evaluations each concluded that the Requests were necessary for the purpose of the 
prevention,  investigation,  detection,  or  prosecution  of  terrorism  or  terrorist  financing. 
During  the  2021  evaluation,  Treasury  did  not  recommend  adding  or  removing  any 
jurisdictions to the Requests. 

During  the  2022  evaluation,  Treasury  recommended  adding  one  jurisdiction,  to  the 
Requests. The U.S. Department of the Treasury recommended adding this jurisdiction to 
the Requests due to its risk for terrorist financing. The Financial Action Task Force (FATF) 
had previously identified it as having a high risk of terrorist financing. Additionally, at least 
four Hizballah financiers designated by the U.S. Department of the Treasury have exploited 
its corporate and financial systems to benefit terrorist groups and their activities around the 
world. This and additional justifying information related to the inclusion of the jurisdiction 
is contained in the monthly Article 4 Request. 

Treasury will conduct its annual evaluation covering January 2023–December 2023 during 
the first half of 2024. 

Treasury  also  recommended  removing  three  message  types  that  provided  leads  of  only 
limited utility as a result of the 2022 evaluation. Accounting for the removal of these three 
MT message types, only 15 percent of all MT message types are now extracted for use in 
the TFTP. In addition, Treasury has  continued to streamline the Article 4 to include the 
most relevant information and most recent supporting evidence. 

Treasury will continue to review its processes and procedures for assembling Requests, for 
the purpose of ensuring that the Requests remain tailored as narrowly as possible based on 
past and current terrorism risk analysis. 

38 

 
 
 
17. Has  Europol  been  able  to  perform  its  verification  function  within  an  appropriate 
timeframe,  as  required  under  Article  4(4)?  What  has  been  the  average  timeframe 
Europol has required for this verification function? 
Yes, with one exception, the verification process has been performed in less than 48 hours 
since the receipt of the documentation. In the cases where additional information has been 
requested, the verification has also been carried out in less than 48 hours since the receipt 
of the additional/amended documentation. 

Based on reporting from Europol, the only exception was the request for March 2023, in 
which verification of the report took almost three months. This was due to the transition to 
the  new  ISO  20022  standard,  which  entailed  a  careful  evaluation  and  revisions  of  the 
correspondence  between  the  old  MT  and  the  new  MX  message  types  based  on  several 
meetings between Treasury, Europol, and the Designated Provider, on top of reviewing the 
technical documentation. Not taking into account the aforementioned verification for the 
period March 2023, the average timeframe for the verifications has been under 48 hours. 

18. In how many cases has Europol requested supplemental information for the requests 
under Article 4 (1)? Have there been any cases in which Europol came to a conclusion 
that the request under Article 4 (1) did not meet the requirements set out in Article 
4(2)? 
Europol  has  never  determined  that  a  Treasury  Article  4  Request  failed  to  satisfy  the 
requirements  set  out  in  Article  4(2).  During  the  review  period,  Europol  did  request 
supplemental  information  beyond  that  already  supplied  by  Treasury  with  respect  to 
Requests submitted pursuant to Article 4(1). All of these requests by Europol were related 
to the transition to ISO 20022. Following receipt of the March 2023 request, on April 20, 
2023, Europol requested that Treasury provide additional information on the type of data 
contained  in  MX,  an  updated  Attachment  A,  and  an  explanation  for  how  Treasury 
determined which MXs corresponded to the existing MTs. On May 12, 2023, and again 
related to the March 2023 request, Europol requested that Treasury provide the sources it 
relied on to determine the MX equivalencies. Following receipt of the April 2023 Request, 
on June 28, 2023, Europol  requested that Treasury update the timeframe covered in  the 
request  to  also  include  May  and  June  2023  rather  than  just  April  2023  and  indicated  it 
needed to confirm details with the Designated Provider. 

During  the  summer  of  2011,  Treasury  and  Europol  agreed  that  Europol  would  notify 
Treasury  in  advance,  if  possible,  whenever  Europol  decided  that  additional  types  or 
categories of information could be useful in the Requests, to allow Treasury adequate time 
to enhance future Requests and to ensure that verification of specific Requests would not 
be  delayed.  In  addition,  in  an  ongoing  effort  to  enhance  the  Requests  beyond  the 
requirements set out in Article 4(2), Europol officials have regularly provided comments 
aimed  at  making  the  Requests  easier  to  review  and  verify,  including  suggestions  for 
additional 
language,  and 
typographical  and  display  corrections  to  improve  the  clarity  and  focus  of  the  Requests. 
Treasury has carefully considered these suggestions and has generally adopted them. 

information,  condensation  of  repetitious  or  formulaic 

39 

 
 
 
19. What  is  your  overall  assessment  of  the  effectiveness  of  the  Agreement?  Have  any 
specific  impediments  to  achieving  the  stated  purpose  of  the  Agreement  been 
identified? If so, which? 
Treasury  assesses  that  the  TFTP  Agreement  is  important  and  effective  in  supporting 
European  and  global  counter-terrorism  efforts,  particularly  in  light  of  the  heightened 
terrorist threat to Europe. 

Treasury  has  identified  no  specific  impediments  to  achieving  the  stated  purpose  of  the 
TFTP Agreement  and  continues to  engage directly with  European authorities, including 
Member States and Europol, to improve the awareness and usage of the TFTP Agreement 
among relevant authorities. 

20. Is the TFTP subject to oversight by U.S. authorities? If so, please elaborate. What is 
the  role  of  U.S.  Congress  within  this  mechanism?  Has  the  oversight  mechanism 
resulted in any recommendations? 
In  addition  to  the  multiple,  mutually  reinforcing  data  safeguards  provided  by  the  EU- 
appointed  Overseers  and  the  independent,  external  Overseers,  the  TFTP  is  subject  to 
multiple layers of oversight by U.S. authorities. Treasury’s Office of the Inspector General 
(“OIG”) provides independent oversight of the programs and operations of the Treasury 
pursuant  to  its  statutory  authorities  and  consistent  with  Article  12(2)  of  the  TFTP 
Agreement.  The  OIG  has  fulfilled  and  continues  to  fulfil  its  responsibilities  regarding 
independent oversight with respect to the TFTP, although, due to system improvements, 
OIG is no longer required to oversee the deletion of data. 

Similarly, in addition to the OIG, Treasury’s Office for Privacy, Transparency, and Records 
provides verifications regarding Treasury’s implementation of the TFTP Agreement. The 
Office of the General Counsel is also closely involved in ensuring Treasury implements the 
TFTP in accordance with the terms of the TFTP Agreement. For more information, please 
see the response to Question 21, below. 

Furthermore,  the  U.S.  Congress  exercises  oversight  of  the  TFTP,  primarily  through  the 
Senate Select Committee on Intelligence and the House Permanent Select Committee on 
Intelligence.  The  Committees  can  and  do  request  information  on  Treasury’s  counter-
terrorism functions, which can include the TFTP, and Treasury officials periodically brief 
the Committees on these issues. 

Finally,  the  Privacy  and  Civil  Liberties  Oversight  Board  (“PCLOB”)  is  an  independent 
agency  within  the  Executive  Branch  of  the  U.S.  government.  PCLOB  is  authorized  to 
continually  review  the  implementation  of  Executive  Branch  policies,  procedures, 
regulations, and information sharing practices relating to efforts to protect the nation from 
terrorism, in  order to  ensure that privacy  and civil liberties are protected. As a counter-
terrorism  program,  TFTP  is  subject  to  PCLOB’s  oversight  authority.  How  PCLOB 
independently elects to exercise its oversight authorities with respect to TFTP is, of course, 
up to PCLOB. 

IV. Compliance with Data Protection Obligations Specified in the Agreement 

40 

 
 
 
21. What  is  the  role  and  what  are  the  findings  of  the  Privacy  Officer  of  the  U.S. 
Department of the Treasury (Articles 15(3) and 16(2)) in relation to the Agreement? 
Does  this  role  include  findings  relevant  for  the  compliance  with  data  protection 
obligations specified in the agreement (Article 13(2)(e) of the Agreement)? 
Treasury’s Director for Privacy and Civil Liberties (Privacy Officer) is the lead Treasury 
official charged with the implementation of Articles 15 and 16 of the Agreement. Under 
the supervision of the Deputy Assistant Secretary for Privacy, Transparency, and Records 
(DASPTR) and in close  coordination with  Treasury’s Office of  General  Counsel  (when 
Treasury receives inquiries related to TFTP) and Office of Foreign Assets Control (OFAC), 
the  Privacy  Officer  has  established  redress  procedures  to  facilitate  the  proper 
implementation  of Articles 15 and 16. These redress  procedures  —  allowing persons to 
seek  access,  rectification,  erasure,  or  blocking  pursuant  to  Articles  15  and  16  of  the 
Agreement  —  are  posted  on  Treasury’s  website  at  www.treasury.gov/tftp.  To  avoid 
potential conflicts, the Privacy Officer is not involved in the daily functioning of the TFTP 
or review of every search done on the system. 

The initial  step in  the redress  procedures  requires  that a European Union National  Data 
Protection Authority (“NDPA”), acting on behalf of a person, submit a request in writing 
to the Treasury Privacy Officer pursuant to Articles 15 and/or 16 of the Agreement. Prior 
to submitting a request, the NDPA must obtain proof of the requestor’s identity to ensure 
that there are no unauthorized disclosures of personal data. After obtaining proof of the 
identity of the person making the request, the NDPA must send (preferably via a method 
of delivery that allows tracking) to the Treasury Privacy Officer the original access request 
form and/or the rectification, erasure, or blocking request form and the waiver form (all 
completed  in  English),  together  with  a  signed  copy  of  the  standard  request  letter.  Upon 
sending the request, the NDPA must notify the Treasury Privacy Officer via email that the 
request is in transit. Once the Treasury Privacy Officer receives a request via regular mail 
with all of the required information (a “perfected request”), the Privacy Officer processes 
the perfected request as follows: (1) notify the NDPA of receipt of the perfected request (or 
ask  for  additional  information,  where  necessary);  (2)  work  with  the  TFTP  management 
team  and/or  analysts  to  verify  whether  any  data  relevant  to  the  request  have  ever  been 
extracted  as  a  result  of  a  TFTP  search;  (3)  assess  whether  the  relevant  safeguards  with 
respect  to  any  extraction  of  data  have  been  satisfied;  and  (4)  provide  written  notice 
explaining  whether  the  data  subject’s  rights  have  been  duly  respected  and,  where 
appropriate, whether personal data may be disclosed (and if not, the underlying reasons); 
whether personal data have been rectified, erased, or blocked (and if not, the underlying 
reasons);  and  the  means  available  for  seeking  administrative  and  judicial  redress  in  the 
United  States.  The  Treasury  DASPTR  also  reviews  administrative  appeals,  where 
applicable, from the Treasury Privacy Officer’s Article 15 and 16 request determinations. 
Other officials — including Europol and the independent Overseers — have oversight with 
respect to other data protection obligations specified in the TFTP Agreement. Treasury’s 

41 

 
 
 
senior  management  and  counsel,27  along  with  the  Treasury  Inspector  General,  have 
oversight with respect to the Program. 

22. Have  any  particular  issues  related  to  the  role  or  findings  of  the  Privacy  Officer  of 

Treasury been identified (Articles 15(3) and 16(2))? 
Treasury has not identified any new issues related to the role or findings of the Privacy 
Officer  during  the  reporting  period.  Prior  to  the  2019  Joint  Review,  Treasury  officials 
worked  constructively  with  the  Commission,  which  consulted  on  this  topic  with  the 
European Union’s Article 29 Working Party, to establish uniform procedures, whereby the 
verification of identity of European Union persons — required by Articles 15 and 16 and 
the TFTP redress procedures posted on Treasury website — could be delegated to European 
Union NDPAs. This  delegation made it possible to  verify a requester’s identity without 
sending additional personal data to the United States. This authorized those officials closest 
to requesters — e.g., an NDPA within a requester’s own country and presumably familiar 
with its national identity documents — to make the identity verification decisions necessary 
to  ensure  the  identity  of  requesters  and  reduce  the  risk  of  unauthorized  disclosures  of 
personal data. 

During the review period, Treasury has not received any Article 15 or Article 16 requests 
under the agreement. 

23. Have  any  of  the  measures  put  in  place  to  ensure  that  provided  data  shall  be  used 
exclusively  for  the  prevention,  investigation,  detection,  or  prosecution  of  terrorism 
and  its  financing  changed  since  the  last  Joint  Review  (Article  5(2))?  If  so,  what 
changes have occurred? 
There have been no changes to the implementation of the Article 5 safeguards during the 
review period. The team of Commission-appointed Overseers continues to carry out the 
functions related to the Article 5 safeguards and has all the necessary access to fully review 
all TFTP searches in  real  time and is  an integral part of the implementation of the data 
safeguards embedded in the TFTP. 

The  comprehensive  and  multi-layered  set  of  systems  and  controls  previously  reviewed 
remains in place to ensure that provided data is processed exclusively for the prevention, 
investigation, detection, or prosecution of terrorism or its financing, and that all searches 
of  provided  data  is  based  on  pre-existing  information  or  evidence  that  demonstrates  a 

27   Treasury’s  Office  of  the  General  Counsel  and  the  Office  of  the  Chief  Counsel  (Foreign Assets 
Control) work closely with OFAC, the TFTP manager, and other Treasury officials to review TFTP-
related  policies  and  procedures  and  ensure  they  are  consistent  with  U.S.  obligations  under  the 
Agreement, as well as relevant U.S. laws. Counsel support includes, but is not limited to: reviewing 
the Request to the Designated Provider and associated supplemental documents provided to Europol 
to ensure they meet the standards of Article 4; responding to questions regarding the legal sufficiency 
of a search justification and its associated query to ensure that they satisfy the standards of Article 
5; providing legal guidance regarding the retention and deletion requirements of Article 6, including 
the necessity-based review; and reviewing dissemination requests to ensure they comply with the 
standards of Article 7. 

42 

 
 
 
 
reason to believe that the subject of the search has a nexus to terrorism or its financing. 
These systems and controls include the following: 

All  analysts  who  have  access  to  the  TFTP  system  are  extensively  trained  and  retrained 
regularly to ensure the fulfillment of all requirements for searches, including that a pre-
existing nexus to terrorism or its financing is documented for every search; if an analyst 
even  attempted  a  search  that  did  not  satisfy  the  requirements,  Treasury  would  respond 
appropriately, with responses varying from mandating additional training for the analyst to 
removing access rights to the TFTP and instituting disciplinary proceedings; 

Detailed logs are maintained of all searches made, including the identity of the analyst, date 
and time of search, the search terms used, and the justification for the search; these logs are 
regularly analyzed by outside auditors as part of the regular independent audit of the TFTP; 

Electronic controls (in addition to human review and oversight) have been implemented 
that prevent analysts from conducting a search without inputting the pre-existing nexus to 
terrorism or its financing; 

Other electronic controls aim to prevent certain technical mistakes, such as inputting an 
“or” instead of an “and” as a search term, that inadvertently could result in an overly broad 
search; for example, the system automatically aborts searches that could potentially return 
with over 10,000 leads; 

Independent overseers retained by the Designated Provider and the European Commission 
with  appropriate U.S.  government  national  security  clearances review searches either as 
they occur or shortly  thereafter, prior to  dissemination of any results, to  ensure that the 
counter-terrorism purpose limitation and other safeguards have been satisfied; and 

Independent  Auditors  retained  by  the  Designated  Provider  evaluate  the  technical  and 
systemic  controls  to  ensure  the  integrity  of  the  system  and  the  satisfaction  of  all  the 
safeguards. 

Treasury  trains  all  users  and  their  supervisors  on  all  aspects  of  the  TFTP  Agreement 
including the handling of printed TFTP material, on an annual basis. As a part of this annual 
training, users and supervisors are instructed that paper documents should be stored in a 
secure manner and be clearly identifiable as TFTP data. Additionally, users and supervisors 
are trained to conduct a review every six months of all printed and stored TFTP information 
and  destroy  paper  documents  that  are  no  longer  part  of  an  active  investigation.  This 
guidance has also been incorporated into the TFTP User Guidebook. 

24. Have any of the measures put in place to ensure that the TFTP does not and shall not 
involve  data  mining  or  any  other  type  of  algorithmic  or  automated  profiling  or 
computer  filtering  changed  since  the  last  Joint  Review  (Article  5(3))?  If  so,  what 
changes have occurred? 
The enhanced systems and controls outlined in response to Question 23, above, prevent any 
type of data mining or profiling because they require individualized searches, based on a 

43 

 
 
 
pre-existing nexus to terrorism or its financing. No additional measures have been put into 
place since the Sixth Joint Review. 

25. Have any measures been put in place to implement the provisions of Article 5(4) on 
data security and integrity or have any measures been changed since the last Joint 
Review? If so, what changes have occurred? In particular, can you confirm that the 
provided data is held in a secure physical environment, stored separately from other 
data and that there are no interconnections with any other database? 
Multiple physical and technical security layers exist to ensure data security and integrity. 
The  data  is  stored  in  a  secure  location  accessible  only  by  U.S.  government-cleared 
personnel  and  in  a  secure  analysis  area  accessible  only  by  a  limited  number  of  TFTP 
managers and analysts and security personnel. The data is stored separately from other data, 
are not interconnected with any other database, and are protected by multiple security layers 
that  prevent  unauthorized  access  to  the  data.  Significant  physical  and  technical  security 
controls exist to ensure that no unauthorized copies of TFTP data may be made, except for 
disaster recovery purposes. The independent Auditors retained by the Designated Provider 
review and verify these physical and technical security safeguards. 

Treasury security personnel have been queried about adding biometric authentication as a 
physical security control. TFTP information is currently stored, controlled, and accessed in 
a manner consistent with the protection of domestic classified information, which does not 
include biometric controls. Treasury’s security team has indicated that due to these already 
robust  protections,  current  resources  do  not  allow  for  the  addition  of  biometric  access 
controls. 

26. Have there been any cases of incidents that could affect the security and integrity of 
TFTP  data?  If  so,  have  any  technical  and  organisational  measures  put  in  place  to 
address such security incidents, including notification? 
No  instances  have  been  detected.  TFTP  data  is  held  in  a  secure  physical  environment, 
stored separately from other data on a standalone system with no interconnections with any 
other database and protected by high-level systems and physical intrusion security controls. 
As  such,  TFTP  data  have  not  been  impacted  by  any  cyber-related  attacks  on  U.S. 
government departments or agencies that occurred during the review period. 

27. Have  the  measures  put  in  place  to  implement  the  provisions  of  Article  5(4)  been 

subject to oversight defined in Article 12 (1) of the Agreement? 
Yes. The Designated Provider has three full time staff, who are independent contractors 
and  monitor  all  access.  The  Designated  Provider  has  one  full  time  and  four  part  time 
Overseers who provide oversight of duties mentioned in Article 12(1). The European Union 
has an Overseer who fulfils the functions of Article 12(1) who has been provisioned access. 

28. What is the policy for log files (which data processing activities are logged, who have 
access,  is  there  any  monitoring  procedure  in  place,  what  is  the  retention  period 
foreseen for logs)? 

44 

 
 
 
In accordance with Articles 5(6) and 7(f) of the TFTP Agreement, Treasury maintains logs 
of individual TFTP searches, including the nexus to terrorism or its financing required to 
initiate the search, and of the onward transfer of TFTP-derived information. TFTP search 
log files may be subject to review by Scrutineers or Auditors, and are retained for audit and 
compliance purposes, in accordance with U.S. government records retention requirements. 
Please see the responses to Question 23, above, and Question 38, below. 

29. Have any measures  (other than the measures mentioned in Article 12) been put in 
place  to  ensure  that  all  searches  of  provided  data  are  based  on  pre-existing 
information or evidence which demonstrates a reason to believe that the subject of the 
search  has  a  nexus  to  terrorism  or  its  financing  (Article  5(5)),  or  have  any  such 
measures  been  changed  since  the  last  Joint  Review?  If  so,  what  changes  have 
occurred? 
Please see the response to Question 23, above. 

30. Have there been any cases where the extracted data included personal data revealing 
racial  or  ethnic  origin,  political  opinions,  or  religious  or  other  beliefs,  trade  union 
membership,  or  health  and  sexual  life  (sensitive  data)?  If  so,  have  any  special 
safeguards or measures been taken to take into account the sensitivity of these data 
(Article 5(7))? 
Treasury is not aware of any cases in which such data have been extracted. 

31. Have  any  measures  put  in  place  to  organise  the  on-going  and  at  least  annual 
evaluation  to  identify  non-extracted  data  that  are  no  longer  necessary  to  combat 
terrorism or its financing changed since the last Joint Review (Article 6(1)? If so, what 
changes have occurred? Have such data been promptly and permanently deleted since 
the last Joint Review? 
No measures to identify unnecessary non-extracted data have changed since the Sixth Joint 
Review.  Treasury  does  not  retain  any  non-extracted  data  past  five  years  from  the  date 
received. Additionally,  Treasury recently  rolled  out  a mechanism for analysts to  further 
narrow the scope of the  data extracted from  search results. This  system  enhancement is 
expected to reduce the amount of data retained. Prior to this upgrade, the system retained 
all messages that  are opened, despite whether they are  responsive to a search. The new 
mechanism  will  ensure  that  the  system  does  not  retain  a  message  unless  an  end  user 
positively marks the individual messages as responsive to a search. 

32. Have there been any cases where financial payment messaging data were transmitted 
which were not requested? If so, has the Treasury promptly and permanently deleted 
such data and informed the relevant Designated Provider (Article 6(2))? 
While  Treasury  works  to  ensure  that  its  requests  continue  to  be  as  narrowly  tailored  as 
possible,  due  to  the  ISO  20022  transition  and  the  associated  introduction  of  the  MX 
message type, the Designated Provider’s system may require it to send a small number of 
unrequested  MT  payment  messages  as  attachments  to  requested  message  types.  To  the 
extent that the Designated Provider sends any message type that Treasury does not request, 
Treasury’s system is designed to reject the unrequested data. As such, during the reporting 

45 

 
 
 
period, Treasury’s system did not ingest any messages that may have been provided by the 
Designated Provider but were not requested by Treasury. 

33. Have  all  non-extracted  data  received  prior  to  30  November  2018  been  deleted  as 

provided for in Article 6(4) of the Agreement? 
Yes. Per Auditor requests, Treasury previously added additional monitoring to the TFTP 
system  in  the  form  of  daily  in-system  notifications  confirming  the  data  deletions. 
Additionally, the auditors maintain a separate log indicating the expected deletion date for 
each batch of data. The Auditors then cross-check this log against the actual deletion dates 
from the in-system notifications to confirm that data is being deleted on time. Further, the 
Auditors conduct occasional searches for data that should be deleted in order to verify that 
the data is actually deleted. 

34. Have  any  measures  been  taken  to  provide  for  the  ongoing  and  at  least  annual 
evaluation to continuously assess the data retention periods specified in Article 6(3) 
and 6(4) of the Agreement changed since the last Joint Review? If so, what changes 
have occurred? 
Treasury  continues  to  assess  these  data  retention  periods  as  part  of  its  regular  review, 
analysis,  and  audit  of  data,  as  described  in  response  to  Question  16,  above.  A 
comprehensive  assessment  consisting  of  investigator  interviews,  reviews  of  counter-
terrorism  investigations,  and  an  evaluation  of  current  terrorist  threats  and  activity  is 
conducted regularly to ensure that TFTP data retention periods are appropriate to ongoing 
counter-terrorism  efforts.  Based  on  past  annual  evaluations  completed  since  the  TFTP 
Agreement entered into force, as well as the ongoing assessments, Treasury continues to 
find valuable counter-terrorism leads in data retained for the limits of the current retention 
periods specified in the TFTP Agreement and believes the current retention periods to be 
appropriate. 

35. Have there been any cases where these retention periods have been reduced by the 

U.S. Department of the Treasury in accordance with Article 6(5)? 
No. See the responses to Questions 33, above, and 36, below. 

36. How is it ensured that the time period for deletion of the data five years after their 
reception referred to in Article 6(4) of the Agreement is met in reality? What is the 
process for deletion of such data? 
The TFTP system is designed to automatically delete non-extracted data after five years. 
This process is conducted in a way that ensures the system remains fully operational and 
all safeguards remain in place. This system upgrade was completed and implemented on 
January 10, 2018. Independent program Auditors monitor and confirm automatic process 
is conducted. 

All non-extracted data received prior to March 1, 2019 has been deleted. See Question 33 
for additional information on process  improvements  to  ensure old  data is removed if or 
when such data is transitioned between storage areas. 

46 

 
 
 
37. Have any measures been put in place to ensure that onward transfer of information 
extracted from the provided data is limited pursuant to the safeguards laid down in 
Article 7 of the Agreement changed since the last Joint Review? If so, what changes 
have  occurred?  Have  there  been  any  cases  of  onward  transfer  of  information 
involving citizens or residents of European Union Member States? 
No  changes  have  occurred  since  the  last  Joint  Review.  Onward  transfer  of  information 
occurred  during  the  period  of  review,  some  of  which  involved  citizens  or  residents  of 
European Union Member States. Any onward transfers of information involving citizens 
or  residents  of  European  Union  Member  States  would  be  protected  by  the  information 
sharing  agreements  between  the  United  States  and  the  receiving  country.  The  onward 
transferred information can only be used for counter-terrorism lead purposes and is marked 
with appropriate caveats and handling instructions, as with all TFTP information. 

38. Please describe how requests for subsequent dissemination of original TFTP-derived 

information are handled. Have any of these requests been rejected? 
No changes have occurred since the last Joint Review. TFTP-derived information continues 
to be shared with counter-terrorism, law enforcement, or public security authorities in the 
United  States,  European  Union  Member  States,  third  countries,  and  with  Europol  or 
Eurojust,  for  lead  purposes  only  and  for  the  exclusive  purpose  of  the  investigation, 
detection,  prevention,  or  prosecution  of  terrorism  or  its  financing.  Counterterrorism 
analysts using the TFTP receive training on the safeguards, dissemination, and retention 
procedures required by the TFTP Agreement prior to use of the system. Information is only 
disseminated  after  approval  by  management  trained  on  the  safeguards  identified  in  the 
TFTP Agreement. Any subsequent dissemination requires the express written approval of 
Treasury. 

In cases in which Treasury is aware that TFTP-derived information of a citizen or resident 
of a Member State is  to be shared with  a third country, Treasury abides  by the existing 
protocols on information sharing with that Member State. In cases where existing protocols 
do not  exist, Treasury will  not  disseminate the information  without prior consent  of the 
Member  State  except  where  the  sharing  of  data  is  essential  for  the  prevention  of  an 
immediate and serious threat to the public security of a Party to the TFTP Agreement, a 
Member State, or a third country. 

39. Have all searches run on the TFTP data been subject to oversight defined in Article 

12 (1) of the Agreement? 
Yes. At all times during the review period, searches run on TFTP data were subject to real 
time and retrospective review. 

40. How  many  searches  have  been  queried  by  the  Overseers?  On  which  basis  did  the 

Overseers select a search for further verification? 
The  Overseers  mentioned  in  Article  12  of  the  TFTP  Agreement—one  appointed  by  the 
European  Commission  and  the  others  employed  by  the  Designated  Provider—routinely 
request additional information to ascertain strict adherence to the counter-terrorism purpose 
limitation and other safeguards described in Articles 5 and 6 of the TFTP Agreement. The 

47 

 
 
 
overseers may request additional justification or clarification of the counter-terrorism nexus 
as well as documentation to ensure that the search is as narrowly tailored as possible. In the 
overwhelming majority of cases, the overseers request additional information simply for 
routine auditing purposes and not out of any concern with the search itself. 

During the review period, the Overseers queried 343 searches—the overwhelming majority 
of which were selected for routine auditing purposes. All searches queried by the Overseers 
are blocked until any Overseer concerns have been fully addressed. In the overwhelming 
majority of searches conducted (over 98 percent), the Overseers were fully satisfied with 
the search as formulated. The Overseers stopped five searches at the time of the search and, 
of all searches queried, blocked 47 searches during their retrospective review of the search 
logs, because they believed the search terms were too broad. Stopped searches accounted 
for a small number of cases (five total searches during the 24 months of the review period 
or  0.03  percent  of  all  searches).  In  all  cases  where  the  searches  were  queried  by  the 
Overseers at the time of the search, no results were returned to the analyst unless and until 
the  search  satisfied  the  overseers.  In  cases  where  the  searches  were  identified  through 
retrospective  review, no  information  obtained through the searches was disseminated or 
used unless and until the overseers were satisfied. 

In terms of the 343 searches queried, Treasury cannot accurately break them down between 
the  Designated  Provider  and  the  European  Union  Overseers,  because  when  one  party 
queried a search, it was treated as having been queried by the overseers generally. 

48 

 
 
 
 
 
41. In how many cases have the Overseers queried or stopped searches on the grounds 
that they appear to be in breach of Article 5 of the Agreement? How many searches 
were finally identified, possibly on the basis of additional information, as not being in 
line  with  the  Agreement?  What  are  the  typical  reasons  for  intervention  by  the 
overseers and what measures are taken to ensure compliance with the Agreement? 
As noted in response to Question 40, above, in a small number of cases the Overseers either 
stopped or blocked the searches (52 total searches during the review period or 0.38 percent). 
Fifty-two  percent  of  the  stopped  or  blocked  searches  were  stopped  or  blocked  due  to 
overbroad search terms, a typographical error in the spelling of a terrorism suspect’s name, 
or the inadvertent transposition of digits in a bank account number. Forty-eight percent of 
stopped or blocked searches were determined to have an insufficient nexus to terrorism, 
meaning that the subject was too far removed from the nexus to terrorism and the search 
was therefore deemed overly broad. 

As noted in response to Question 23, above, all analysts who have access to the TFTP are 
extensively trained and re-trained regularly to ensure the fulfilment of all requirements for 
searches. If an analyst attempted a search that does not satisfy the requirements, Treasury 
would respond appropriately, including mandating additional training for the analyst and/or 
temporarily  suspending  the  analyst’s  access  rights  to  the  TFTP  until  Overseer  concerns 
with  the  search  are  fully  resolved.  Treasury  may  also  permanently  revoke  an  analyst’s 
access rights to the TFTP or institute disciplinary proceedings, although Treasury has not 
needed to exercise these options to date. 

42. Have  any  measures  been  taken  to  ensure  that  the  results  of  the  searches  are  not 
disseminated before the Overseers have had a chance to review the search changed 
since the last Joint Review? If so, what changes have occurred? 
No changes have occurred since the last Joint Review. Any dissemination of TFTP-derived 
information  continues  to  require  management  approval,  and  subsequent  dissemination 
requires the express approval of Treasury. Treasury trains counter-terrorism analysts on the 
proper  procedures  for  using,  and/or  requesting  and  receiving  approval  to  disseminate, 
TFTP-derived information. All TFTP analysts have been trained to ensure that there is no 
dissemination of TFTP-derived information prior to the completion of the overseer review 
process, and no information obtained through TFTP searches was disseminated over the 
objections of the Overseers. 

43. Have  there  been  any  cases  where  individuals  have  exercised  their  rights  of  access, 
rectification,  erasure  or  blocking  in  accordance  with  Article  15  and  16  of  the 
Agreement? If so, how many, and how have these cases been resolved? 
Treasury has not received any Article 15 requests from European NDPAs during the current 
review period. 

Administrative redress under U.S. law consists of the right to an administrative appeal of 
an initial decision in response to a request under Article 15 or 16. The United States has 
agreed that Treasury shall treat all persons equally in the application of its administrative 
redress process, regardless of nationality or country of residence. On November 27, 2017, 

49 

 
 
 
Treasury’s  DASPTR  issued  a  decision  on  the  first  administrative  appeal  Treasury  has 
received under the Agreement. In this decision, the DASPTR upheld the Treasury Privacy 
Officer’s decision under Article 15. The DASPTR also advised the requester that they may 
seek judicial review of the decision by filing suit in the United States District Court for the 
District of Columbia and explained in further detail why additional information beyond a 
statement that the requester’s rights had been respected under the TFTP Agreement could 
not be provided. 

Judicial redress under U.S. law would consist of seeking redress in U.S. federal court from 
an adverse administrative action and the United States has defences to such a suit. Relevant 
statutes for seeking redress from an adverse Treasury administrative action in connection 
with  personal  data  received  pursuant  to  the  TFTP  Agreement  may  include  the 
Administrative Procedure Act, the Freedom of Information Act, and the Judicial Redress 
Act. The Administrative Procedure Act allows persons who have suffered harm as a result 
of certain U.S. government administrative actions generally to seek judicial review of such 
actions.  The  Freedom  of  Information  Act  allows  persons  to  utilize  administrative  and 
judicial remedies to seek government records, subject to specific exceptions. The Judicial 
Redress Act, which was enacted into law in 2016, provides European Union citizens and 
citizens of other designated countries the right to seek redress in U.S. courts if they are 
wrongfully  denied  access  to  personal  data  that  their  home  countries  have  shared  with 
certain U.S. authorities (including the relevant elements of Treasury) for law enforcement 
purposes,  wrongfully  denied  the  ability  to  rectify  such  data,  or  if  such  information  is 
knowingly,  wrongfully  disclosed.  As  of  November  30,  2023,  Treasury  has  received  no 
requests pending pursuant to Articles 15 or 16 of the TFTP Agreement. 

44. Have  those  access  requests  been  answered  positively,  including  the  disclosure  of 
personal data processed under the Agreement? In case where an exception was used 
for not providing a positive answer what was the procedure followed, what was the 
content of the answer provided to the data subject? 
Since  the  2019  Joint  Review,  Treasury  received  no  requests  pursuant  to  Article  15  or 
Article 16 of the TFTP Agreement. Treasury has not received a perfected request from the 
European Union since 2016. The European Union persons who submitted the four perfected 
requests to date were searched by Treasury in the TFTP system and none of them turned 
up in search results. 

45. Have  there  been  any  cases  where  you  have  become  aware  that  data  received  or 
transmitted pursuant to the Agreement were not accurate? If so, what measures have 
been taken to prevent and discontinue erroneous reliance on such data, including but 
not limited to supplementation, deletion or correction (Article 17(1))? 
Treasury is not aware of any instance in which inaccurate data was received or transmitted 
pursuant to the TFTP Agreement. 

46. Were  any  notifications  regarding  inaccuracy  or  unreliability  of  transmitted 
information made by either of the Parties as set out in Article 17(2) of the Agreement? 
If so, please elaborate. 

50 

 
 
 
No. 

47. Were any notifications and consultations regarding cases of personal data processed 
in breach of the Agreement made by either of the Parties as set out in Article 18(1) of 
the Agreement? If so, please elaborate. 
No. 

48. Have there been any cases where individuals have made use of the means of redress 
provided for under Article 18 of the Agreement? If so, how many, and how have these 
cases been resolved? 
No. 

If possible and where relevant, please make available documentation related to the measures 
and procedures put in place for the various safeguards under the agreement, especially those 
mentioned in Articles 4, 5, 6, 7, 12, 15 and 16. 

51 

 
 
 
 
 
 
 
Annex  IV  –  Examples  of  cases  in  which  TFTP  has  been  used  for  the  prevention, 
financing 
investigation, 

prosecution 

detection, 

terrorism 

its 

or 

or 

of 

EU Value Examples: 2019-2021  

The Terrorist Finance Tracking Program (TFTP) is a vital counter-terrorism tool that provides 
valuable lead information that helps discover planned terrorist attacks and has been used in the 
investigation  of  numerous  actual  and  attempted  terrorist  attacks.  TFTP  data  provides  key 
information, including account numbers, names, addresses, transaction amounts, dates, branch 
locations, and, occasionally, bills of lading, that are of tremendous value to counter-terrorism 
analysts in identifying previously unknown terrorist operatives and financial supporters. TFTP 
provided key leads, as well as the various methods in which TFTP-derived data helped identify 
the financial support networks behind terrorist organizations currently under investigation by 
U.S. and European authorities. The examples below highlight cases in which the U.S. Treasury 
Department  provides  spontaneous  counter-terrorism  information  to  Europol  (Article  9)  and 
when Europol request the U.S. Treasury Department for certain counter-terrorism information 
(Article 10). 

2022 

1.  TFTP data assisted Spain in Operation Kital, on 1 February 2022; Spain National Police 

arrested three individuals charged with terrorist financing offences. 
The investigation established that the individuals were part of a business network operating 
in several countries including Spain, thorough which funds were diverted to Libya with the 
purpose of financing a militia operating in that country under the umbrella of the terrorist 
organization  DAESH.  The  funding  of  the  terrorist  activities,  amongst  other  means  of 
payments,  was  carried  out  mainly  via  banking  transactions.  AP  TFTP  supported  this 
investigation  with  the  identification  of  terrorist  financers  within  the  principal  suspect’s 
network, as well as helped to develop new lines of investigation. AP TFTP submitted two 
Article  10  requests  to  the  U.S.  Department  of  the  Treasury  to  identify  potential  leads 
connected to the case. Treasury responded with 1287 financial leads. Europol supported 
this case also on the spot with the deployment of Europol Staff in Spain. This operation is 
still ongoing. 

2.  TFTP data assisted Switzerland in a Case led by The Swiss CT Unit. Swiss authorities are 
carrying  out  an  investigation  on  several  FTFs  (Foreign  Terrorist  Fighters)  involved  as 
senders/beneficiaries in financial transactions spanning from 2016 until 2022. There is the 
suspicion that those persons have provided financial assistance/support to Jabhat Al-Nusra, 
organization  close  to  Al-Qaida.  The  funding  of  the  terrorist  activities  was  carried  via 
banking transactions and remittances from Money Service Business. EUROPOL submitted 
three Article 10 requests on behalf of Switzerland to the U.S. Department of Treasury to 
identify  potential  leads  connected  to  the  case.  U.S.  DoT  responded  with  1555  financial 
leads. The leads contributed by AP TFTP has proven to assist the investigation to reach the 
Attorney General of Switzerland for further assessment. This operation is still ongoing. 

3.  TFTP data assisted Sweden in a Case led by SÄPO (Swedish Security Service) so-called 
Operation  AXE.  The  Swedish  authorities  are  carrying  an  investigation  on  an  individual 
Foreign Terrorist Fighter. The suspect has carried out nine bitcoin transactions in order to 
fund the terrorist organization Al Qaida. Additionally, to Crypto-assets payments, the main 
suspect used MSB remittances and Banking Transactions were used as well with the same 

52 

 
 
 
 
 
purpose of funding. Within the framework of the same case, Europol received from Spain 
Guardia  Civil  CT  Intelligence  Service  a  similar  case  on  a  Spanish  national  who  from  a 
virtual exchange was managing funds for terrorism financing. Spanish investigators have 
detected a modus operandi for obtaining and channelling the funds, consisting in carrying 
fundraising  campaigns  through  different  social  networks,  in  which  financial  support  is 
requested.  Either  for  the  terrorist  organization’s  military  actions  and  for  its  support 
networks with the aim of sustaining the jihadist ideology, mainly in the different refugee 
camps such as Al – Hol. AP TFTP submitted two Article 10 requests on behalf of Sweden 
and Spain to the U.S. Department of the Treasury to identify potential leads connected to 
the case. Treasury responded with 25 financial leads. The leads provided by AP TFTP has 
proven to assist further the investigation in both countries. The main suspects have been 
arrested  and  some  interviews  were  conducted  to  know  more  about  the  TF  system.  This 
operation is still ongoing. 

4.  TFTP data assisted Spain in a Case led by Spanish Guardia Civil CT Intelligence Service, 
so-  called  Operation  Morsa.  This  operation  involves  an  individual  arrested  by  Guardia 
Civil,  who  has  been  sentenced  in  Spain  for  the  offence  of  financing  of  terrorism.  The 
investigation  started  as  a  case  of  jihadist  radicalization  and  moved  into  financing  of 
terrorism after the seizure of the devices of the suspect. The main suspect collected funds 
directly  from  donators  and  sent  them  to  “higher-  hierarchy”  collectors.  The  channels  to 
fund  terrorist  activities  were  driven  via  bank  transfers,  MSB  remittances  and  bitcoins 
transactions.  Thanks  to  the  TFTP  Article  10  requests,  (533  leads  were  provided),  and  a 
report  produced  by  AP  TFTP  that  proved  the  financing  of  terrorism  according  to  the 
checklist  established  by  FATF,  Spanish  authorities  could  demonstrate  the  guilt  of  the 
suspect. The suspect was sentenced to six years of prison after accepting the charges. This 
Operation is still ongoing due to new lines of investigations. 

5.  TFTP data assisted Colombia in a case led by CT Colombian authorities, in an operation 
so-called Operation Mercury. The suspects were of Colombian and Lebanese origin. The 
TFTP art. 10 request returned 7 leads which provided links to other suspects in Malaysia 
and Qatar. There was a system of financing of terrorism via banking transactions in order 
to fund activities of the terrorist organization Hezbollah. This Operation is still ongoing. 
2023 

6.  Europol/TFTP is assisting an international investigation led by Italy CT Polizia de Stato, 
focused on the radical group so-called Lions of the Balkans. This group is considered a 
terrorist  network  spanning  the  EU  territory  on  at  least  eight  EU  Member  States.  The 
investigation started due to the involvement of one of the perpetrators of the Vienna attack 
(diligently  supported  by  TFTP  intelligence).  This  operation  is  well  known  by  some  EU 
MSs  and  TPs  as  the  suspects  are  investigated  for  different  reasons:  membership  of  a 
terrorist organization and a foiled terrorist attack in France and or financing of terrorism. 
Moreover, intelligence from different countries demonstrated the access of this group to 
weapons, heavy weaponry and explosives; therefore, Europol considers that case a high 
priority investigation. 
The TFTP art 10 request returned 411 leads, which provided evidence of the existence of a 
terrorist financing network. This operation is still ongoing. 

53 

 
 
 
 
 
 
 
7.  Europol/TFTP  is  assisting  Belgium  in  a  case  led  by  the  Belgium  CT  Directorate,  in  a 
counterterrorist  investigation  (dossier  T22RLOLA)  into  several  individuals  acting  as 
money  collectors  for  the  Islamic  State  group  using  the  Syrian  Wallet  modus  operandi. 
There is serious evidence against the targeted entities that engaged in financial transactions 
with persons (located in Turkey) whose profiles match that of money collectors working 
for Islamic State group. The suspects were Belgian, French and Turkish nationals. 
The  TFTP  art  10  request  returned  1184  leads  which  provided  further  directions  of 
investigation. The main suspects have been arrested and interviews were conducted. This 
operation is still ongoing. 

8.  Europol/TFTP  is  supporting  an  investigation  of  Spain  Guardia  Civil  Counter  Terrorism 
Unit,  on  a Spanish  natural,  born  in  Ceuta  (Spanish  city  located  in  Africa),  suspected  of 
carrying  activities  on  jihadist  terrorism.  The  investigators  consider  the  individual  well 
connected  with  international  terrorism.  The  main  suspect  is  a  key  player  on  the  role  of 
recruitment and radicalization, in a business centre (telephone booth) situated in Algeciras 
(Cadiz), in the south of Spain. This city is the busiest and most important entry point from 
European Union to  Africa. The Counter Terrorism  operation counts with other Member 
States and Third Parties involved due to the involvement of the main suspects with other 
individuals connected all over Europe. 
The TFTP art 10 request returned 178 leads, which provided key data for the investigation. 
This operation is still ongoing. 

United States Value Statement Summary, TFTP 7th Joint Review 

The  Terrorist  Finance  Tracking  Program's  (TFTP)  7th  Joint  Review  was  held  at  the  U.S. 
Department  of the Treasury March 19-20, 2024.  The Joint Review consisted of delegations 
from the U.S. Department of the Treasury and the European Union. During the review, twenty 
TFTP-derived value  examples  were shared in  order to  illustrate the usage and utility  of the 
data. The value examples highlighted the importance of TFTP data in terrorism investigations. 
The examples ranged from complicated cross-border terrorism financing schemes to querying 
TFTP  data  to  identify  subjects'  involvement  in  transactions  and/or  activities  regarding 
terrorism.  In  all  examples,  TFTP  analysts  used  TFTP  data  to  build  networks  and  inform 
investigations. Additionally, during the period of review, TFTP data supported the search of at 
least 37 U.S. Department of Treasury Specially Designated Global Terrorist designations. 

TFTP data has been used to support U.S. law enforcement and sanctions-related investigations 
involving terrorism and terrorist financing. For example, the U.S. Department of the Treasury 
used TFTP information in several counter-terrorism sanctions investigations, including those 
resulting in: the April 2023 designations of the Nazem Said Ahmad network; the May 2023 
designation of a Somali charcoal-smuggler, linked to al-Shabaab; the July 2023 designation of 
ISIS financial facilitators in the Maldives; and the January 2023 designation of a key Hizballah 
money exchanger. 

54