REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purpose of the Terrorist Financing Tracking Program
Date: 2024-11-13
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: United States, agreement (EU), bilateral agreement, cross-frontier data flow, data protection, disclosure of information, exchange of information, financial services, personal data, terrorism financing

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 13.11.2024  COM(2024) 522 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purpose of the Terrorist Financing Tracking Program {SWD(2024) 252 final}  
 
 
On  1  August  2010,  the  Agreement  between  the  European  Union  and  the  United  States  of 
America on the processing and transfer of Financial Messaging Data from the European Union 
to the United States for the purposes of the Terrorist Finance Tracking Program ('TFTP') entered 
into force1. 

Procedural aspects 

Article 13 of the Agreement provides for regular joint reviews of the safeguards, controls, and 
reciprocity  provisions  to  be  conducted  by  review  teams  from  the  European  Union  and  the 
United States, including the European Commission, the U.S. Treasury Department (hereinafter 
“the Treasury”), and representatives of two data protection authorities from EU Member States, 
and may also include security and data protection experts and persons with judicial experience. 

This report concerns the seventh joint review of the Agreement since it entered into force and 
covers a period between 1 December 2021 and 30 November 2023. The previous joint reviews 
of the Agreement were conducted in February 20112, in October 20123, in April 20144, in March 
20165, in January 20196 and in March 20227. On 27 November 2013, the Commission adopted 
the Communication on the Joint Report from the Commission and the Treasury regarding the 
value of TFTP Provided Data pursuant to Article 6 (6) of the Agreement8. 

In  line  with  Article  13  (3)  of  the  Agreement,  for  the  purposes  of  the  review,  the  European 
Commission represented the European Union, and the Treasury represented the United States. 
The EU review team was headed by a senior Commission official and in total consisted of two 
members of Commission staff, as well as representatives from two EU national data protection 
authorities.  

The seventh joint review was carried out in two main stages: on 27 February 2024 in The Hague 
at Europol's premises and on 19 and 20 March 2024 in Washington DC at the Treasury.  

This  report  is  based  on  the  information  contained  in  the  written  replies  that  the  Treasury 
provided  to  the  EU  questionnaire  sent  prior  to  the  review,  information  obtained  from  the 
discussions  with  Treasury  personnel  and  members  of  the  US  review  team,  as  well  as 
information contained in other publicly available Treasury documents. In addition, the report 
considers  information  provided  by  Europol  staff  during  the  review.  To  complete  the 
information  available,  the  Commission  also  met  with  and  received  information  from  the 
Designated  Provider  financial  payment  messaging  services  and  organised  a  meeting  on  18 
January  2024  to  receive  feedback  from  Member  States  on  the  reciprocity  provisions  of  the 
Agreement. 

1   OJ L 195/5 of 27.7. 2010. 
2   SEC(2011) 438 final. 
3   SWD(2012) 454 final. 
4   COM(2014) 513 final and SWD (2014) 264 final of 11.8.2014. 
5   COM(2017) 31 final and SWD (2017) 17 final of 19.1.2017. 
6   COM(2019) 342 final, and SWD (2019) 301 final of 22.7.2019. 
7   COM(2022) 585 final and SWD (2022) 357 final of 11.11.2022. 
8   COM(2013) 843 final of 27.11.2013. 

1 

 
 
New developments and main findings  

The designated provider of financial payment messaging services is since March 2023 in the 
process  of  upgrading  a  new  messaging  architecture  (ISO  20022).  The  migration  to  a  new 
standard,  results  in  that  the  US  requests  to  obtain  data  from  the  provider  now  require  the 
production of two types of messages (MX messages (new) and the initial MT messages). As 
messages using the new standard are since March 2023 stored in the territory of the European 
Union, there has been a  substantial increase in  the geographical scope covered by Article 4 
requests. This transition is estimated to take place over the course of two years until November 
2025,  during  which  time  financial  institutions  will  gradually  change  from  the  previous  MT 
format to MX format. 

Based on the information and explanations received from the Treasury, Europol, the Designated 
Provider and the independent overseers, verification of relevant documents and of a randomly 
selected sample of requests of production orders and searches run on the TFTP provided data, 
the  Commission  is  overall  satisfied  that  the  Agreement  and  its  safeguards  and  controls  are 
properly implemented.  

Europol is accomplishing its verification tasks in full compliance with Article 4 on the basis of 
detailed  and  regularly  updated  supporting  documentation  received  from  the  Treasury.  The 
delayed verification of the Article 4 requests that followed the Designated Provider’s transition 
from MT to MX format messages, demonstrates that Europol makes all efforts to verify that 
these requests clearly substantiate the necessity of the data requested and that the safeguard set 
out in Article 4(4) works well.  

The  oversight  mechanism  is  functioning  smoothly  and  is  effective  in  ensuring  that  the 
processing of data complies with the conditions laid down in Article 5 including that data has 
only been searched where there is pre-existing information or evidence which demonstrates a 
reason to believe that the subject of the search has a nexus to terrorism or its financing. All non-
extracted data is deleted at the latest five years from receipt, in accordance with Article 6 (4) of 
the Agreement.  

The TFTP remains a key instrument to provide timely, accurate and reliable information about 
activities associated with suspected acts of terrorist planning and financing. It helps to identify 
and  track  terrorists  and  their  support  networks  worldwide.  In  some  cases,  the  information 
provided under the Agreement has been instrumental in bringing forward specific investigations 
relating to terrorist attacks on EU soil.  

The average number of leads per month decreased from 1 631 to 566 during the review period. 
This reduction of 33%, can partly be explained by the reduced number of completed, failed, 
foiled  terrorist  attacks  in  the  EU  (decreased  by  19%)  and  arrests  on  suspicion  of  terrorism 
(decreased by 23%). The number of searches per month decreased from 828 searches to 721, 
or by 13% compared with the previous review period. 

2 

 
 
 
Recommendations and conclusions 

The Commission welcomes the report by the EU Article 13 Review Team that is included in 
Section 3 and 4 of the accompanying Staff Working Document and its recommendations. In 
terms of potential for further improvement, the Commission support these recommendations:  

1.  Continuing  the  joint  efforts  to  demonstrate  the  value  of  the  TFTP.  The  Commission 
encourages  Europol  to  continue  its  efforts  to  demonstrate  the  value  of  the  reciprocity 
provisions set out in the TFTP Agreement and actively promote awareness of the TFTP and 
to support Member States seeking its advice in devising targeted Article 10 requests.  

2.  Explaining the value of requested financial message types. The Commission recognises that 
the Treasury, in the annual evaluation of its Article 4 Requests, assesses the message types 
and geographic regions that are the most and least responsive to searches, but suggests that 
the outcome of such an assessment should be explained in more details in subsequent Article 
4 requests, notably since the transition to a new message standard that started in March 2023 
requires the production of two types of messages (MX messages (new) and the initial MT 
messages). Such more detailed explanations could better demonstrate that the Treasury’s 
has  narrowly  tailored  its  request  to  minimise  the  amount  of  data  requested  from  the 
designated provider. 

3.  Reviewing the necessity of retaining “extracted data”. The Commission recognises the US 
efforts  to  minimise  the  amount  of  extracted  data  and  the  potential  value  of  the  newly 
introduced mechanism that should reduce the volume of extracted data by ensuring that the 
TFTP system does not retain a message unless an end user positively marks the individual 
messages  as  responsive  to  a  search.  The  Commission  further  suggests  that  the  Treasury 
continue  its  efforts  to  improve  its  mechanisms  to  review  the  necessity  of  retaining 
“extracted data” to  ensure that this data is only  retained for as  long  as  necessary for the 
specific investigation or prosecution for which they are used. The Commission suggests that 
the Treasury establishes written procedures for the review of such data retention in time for 
the next review. 

4.   More  feedback  from  EU  Member  States  to  the  Treasury.  The  Commission  requests 
Member  States  to  increase  their  efforts  to  inform  Europol  as  a  Single  Point  of  Contact 
(SPoC)  when  a  case  has  been  finally  disposed  of,  for  the  subsequent  provision  of  such 
information to the Treasury, which should in principle lead to the deletion of extracted data 
relating to that case, unless there are other investigations based on the extracted data. The 
Commission  welcomes  and  support  Europol’s  suggestion  to  develop  a  standard 
evaluation/reply form that will be sent together with the leads.  

5.  Europol’s  role  and  support  to  EU  Member  States  –  promotion  and  advice.  Europol  is 
encouraged to continue its efforts to actively promote awareness of the TFTP and to support 
Member States seeking its advice and experience in devising targeted Article 10 requests. 
The Commission invites the Treasury’s to share its requirements for establishing a nexus to 
terrorism  and  its  written  guidelines  to  TFTP  users/analysts  with  Europol  to  support 
Europol’s  outreach  activities  with  Member  States  and  to  ensure  that  these  have  a  better 

3 

 
understanding of what is required to demonstrate a reason to believe that the subject of the 
search has a nexus to terrorism or its financing. 

6.  Facilitating the processing of leads (digitalisation). Member States’ authorities submitted 
that the leads that are disseminated as physical copies on paper by the Treasury could be 
more efficiently processed if they were provided digitally. However, it can be noted that the 
original leads that are extracted from the TFTP database, are exclusively printed on paper, 
and that converting these into a digital format would require an additional declassification 
process. The Commission invites the Treasury, and Europol, to consider possible ways to 
rationalising  the  rather  lengthy  declassification  processes  of  converted  digital  leads  to 
facilitate  the  processing  of  leads,  in  compatibility  with  the  security  arrangements  of  the 
TFTP.  

7.  Verification of data protection rights. The Commission notes that the procedures to process 
requests  from  persons  to  ensure  that  their  data  protection  rights  have  been  respected  in 
compliance with the Agreement appear to function efficiently. The Commission also notes 
that the U.S. Privacy and Civil Liberties Oversight Board, in November 2020, stated in the 
context of an oversight review of the TFTP that the review indicates that the programme is 
thoughtfully designed, provides significant value for counter-terrorism, and appropriately 
protects individual privacy. The Commission welcomes the Treasury’s consideration and 
work to address non-binding recommendations made by the U.S. Privacy and Civil Liberties 
Oversight Board and would welcome further updates on how they have been addressed. The 
Commission  underlines  the  importance  that  the  Privacy  Officer  of  the  U.S.  Treasury 
Department,  charged  with  the  implementation  of  Articles  15  and  16  of  the  Agreement, 
continues its efforts to make right of access and redress more easily available to persons 
and that it also considers how procedures can be tested in the absence of specific requests. 

The  Commission  welcomes  the  continued  transparency  of  the  United  States’  authorities  in 
sharing information illustrating the value of the TFTP in international counter-terrorism efforts. 
The detailed information about how the TFTP Provided Data can and is being used and concrete 
cases thereof provided in the Joint Value Report and in the context of this review clearly explain 
the functioning and demonstrate the added value of the TFTP for security on both sides of the 
Atlantic as it remains an essential tool to support counter-terrorism analysts and investigations, 
for example in identifying previously unknown terrorist operatives and financial supporters.  

In  the  period  under  review,  the  US  authorities  have  extensively  made  use  of  the  possibility 
under Article 9 of the Agreement to spontaneously provide information from the TFTP to EU 
authorities. In addition, Europol has continued to proactively initiate a series of requests under 
Article 10 of the Agreement in the period under review and supported investigations in partner 
countries  with  TFTP  searches  and  leads.  A  regular  review  of  the  Agreement  is  essential  to 
ensure its proper implementation, to build up a relationship of trust between the contracting 
parties  and  to  provide  reassurances  to  interested  stakeholders  on  the  value  of  the  TFTP 
instrument.  The  Commission  and  the  Treasury  agreed  to  carry  out  the  next  joint  review 
according to Article 13 of the Agreement in the beginning of 2026. 

4 

 
The functioning of the Agreement, the joint review process, its outcome and recommendations 
are described in detail in the Staff Working Document attached to this Report.  

5