Proposal for a COUNCIL REGULATION amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level
Date: 2025-11-14
Institutions: Directorate-General for Taxation and Customs Union, European Commission
Subjects: European Anti-fraud Office, European Public Prosecutor's Office, European tax cooperation, VAT, administrative cooperation, data protection, exchange of information, fraud, information system, tax offence

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 14.11.2025  COM(2025) 685 final 2025/0348 (CNS)  Proposal for a COUNCIL REGULATION amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level  
 
EXPLANATORY MEMORANDUM 

1. 

• 

CONTEXT OF THE PROPOSAL 

Reasons for and objectives of the proposal 

This  proposal  sets  up  the  European  Public  Prosecutor’s  Office’s  (EPPO)  and  the  European 
Anti-Fraud Office’s (OLAF) access to Value Added Tax (VAT) data exchanged at EU level 
under Council Regulation (EU) No 904/20101. Its objective is to ensure consistency between 
Council  Regulation  (EU)  2017/19392  (hereafter  the  ‘EPPO  Regulation’),  Regulation  (EU, 
Euratom) No 883/20133 (hereafter ‘OLAF Regulation’) and Regulation (EU) No 904/2010 on 
administrative cooperation and combating fraud in the field of VAT.  

This proposal is addressing the urgent problem of combating intra-Community VAT fraud. In 
fact,  the  VAT  loss  due  to  the  Missing  trader  intra-Community  (MTIC)  fraud4  in  2023  was 
estimated between an amount of EUR 12.5 and EUR 32.8 billion annually5. In 2023, Eurofisc 
detected  MTIC  fraudulent  transactions  for  an  amount  of  EUR  12.7  billion,  which  roughly 
translates into EUR 2.5 billion in VAT loss (applying a VAT rate of 20%). Considering the 
prudent estimate of EUR 12.5 billion of VAT loss due to MTIC fraud, compared to the EUR 
2.5 billion uncovered by Eurofisc, suggests that the actors involved in the fight against VAT 
fraud at EU level, such as Eurofisc, the EPPO and OLAF, can be more effective to close that 
gap.  Cross-border  VAT  fraud  is  largely  driven  by  organised  crime,  with  a  small  number  of 
networks responsible for the vast majority of cases. According to Europol and the European 
Court  of Auditors6,  around  2%  of  organised  crime  groups  are  behind  up  to  80%  of  missing 
trader  intra-Community  (MTIC)  fraud,  generating  annual  VAT  revenue  losses  estimated  at 
EUR 40–60 billion. The European Court of Auditors therefore calls in its report for a common 
and multidisciplinary approach to effectively tackle intra-Community VAT fraud7. 

Pursuant  to  the  EPPO  Regulation,  the  EPPO  is  competent  to  investigate  and  prosecute 
criminal  offences  affecting  the  Union’s  financial  interests  provided  for  in  Directive  (EU) 

1 

2 

3 

4 

5 
6 
7 

 Council Regulation (EU) No 904/2010 of 7 October 2010 on administrative cooperation and combating 
fraud in the field of value added tax (OJ L 268, 12.10.2010, p. 1-18) 
Council  Regulation  (EU)  2017/1939  of  12  October  2017  implementing  enhanced  cooperation  on  the 
establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1–71) 
Regulation  (EU,  Euratom)  No 883/2013  of  the  European  Parliament  and  of  the  Council  of  
11 September  2013  concerning  investigations  conducted  by  the  European  Anti-Fraud  Office  (OLAF) 
and  repealing  Regulation  (EC)  No 1073/1999  of  the  European  Parliament  and  of  the  Council  and 
Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1) 
This type of fraud takes advantage of the VAT exemption on intra-Community supplies. The so-called 
Missing Traders acquire goods without accounting right away for the VAT. Any VAT charged on the 
subsequent  domestic  sales  should  be  declared  and  paid  to  the  Member  State’s  revenue  authority. 
However, the Missing Traders charge VAT to buyers without remitting the value to the tax authorities. 
In more complex cases of MTIC fraud, known as carousel frauds, goods are acquired and sold through a 
series of companies before being sold again in another Member State. The first seller in the domestic 
chain  is  the  missing  trader.  The  last  seller  that  sells  these  goods  to  another  taxable person  in  another 
Member State, claims and receives the reimbursement of VAT payments that never occurred. 
VAT Gap - European Commission 
Paragraph 93 Tackling intra-Community VAT fraud: More action needed 
European Court of Auditors Special Report 08/2025 ‘Value Added Tax fraud on imports  – The EU’s 
financial interests are insufficiently protected under simplified import customs procedures’, and Special 
report no 24/2015 Recommendation N. 12. 

EN 

0 

  EN 

 
2017/1371  (hereinafter  the  ‘PIF  Directive’)8,  including  serious  cross-border  VAT  fraud 
involving a total damage of at least EUR 10 million. Criminal investigations of cross-border 
VAT fraud require swift and effective access to VAT information. Any delay in the analysis 
of  the  relevant  information  allows  the  fraudsters  to  hide  evidence  or  assets  and  possibly 
escape  prosecution  and  conviction  as  well  as  making  recovery  of  funds  less  likely.  The 
amendments will ensure that relevant VAT information available at EU level can be accessed 
swiftly by the EPPO.  

The  EPPO  may  access  information  stored  in  databases  of  law  enforcement  authorities  and 
registers  of  other  national  public  authorities  under  the  same  conditions  as  those  that  apply 
under national law (Article 43(1)), and of the institutions, bodies, offices and agencies of the 
Union (Article 43(2)). However,  Regulation  (EU) No 904/2010  does  not  include an  explicit 
reference to the EPPO. Furthermore, Regulation (EU) No 904/2010 sets up IT systems for the 
automated access of relevant information that is “pulled” from national databases but that is 
not stored at EU level (e.g. the VAT Information Exchange System – VIES), or that is stored 
at  EU  level  but  still  accessible  only  and  transmitted  by  national  authorities  (e.g.  Central 
Electronic System of Payment data – CESOP). That information is only available to national 
authorities and not to the Commission. Finally, given that VAT data contains personal data, 
processing  and accessing VAT data must be provided for by law in  a clear and  foreseeable 
manner. In consequence, currently access is provided to the EPPO in a decentralised manner, 
through  the  competent  authorities  of  the  Member  States  (Article  43(1)  of  the  EPPO 
Regulation).  This  modality  of  access  may  not  allow  the  EPPO  to  conduct  its  investigations 
with the required degree of speed and effectiveness. 

Pursuant to the OLAF Regulation, OLAF is competent to fight against fraud, corruption and 
any  other  illegal  activity  affecting  the  financial  interests  of  the  European  Union,  including 
revenues, expenditures and assets covered by the budget of the European Union. The ECJ (C-
105/149)  held  that  the  financial  interests  of  the  Union  also  include  the  Union’s  revenue 
derived  from  applying  a  uniform  rate  to  the  harmonised  VAT  assessment  bases  determined 
according to EU rules. 

The OLAF Regulation provides that OLAF may have access to any relevant information and 
data, irrespective of the medium on which it is stored, held by the institutions, bodies, offices 
and  agencies,  connected  with  the  matter  under  investigation,  where  necessary  in  order  to 
establish  whether  there  has  been  fraud,  corruption  or  any  other  illegal  activity  affecting  the 
financial interests of the Union. Pursuant to the same Regulation, prior to the opening of an 
investigation,  OLAF  shall  have  the  right  of  access  to  any  relevant  information  in  databases 
held  by  the  institutions,  bodies,  offices  or  agencies  when  this  is  indispensable  in  order  to 
assess  the  basis  in  fact  of  allegations.  Finally,  the  competent  authorities  of  Member  States 
shall  transmit  without  delay  to  OLAF,  at  its  request  or  on  their  own  initiative,  any  other 
information,  documents  or  data  considered  pertinent  which  they  hold,  relating  to  the  fight 

8 

9 

Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight 
against fraud to the Union's financial interests by means of criminal law (OJ L 198, 28.7.2017, p.  29–
41) 
Judgment  of  the  Court  (Grand  Chamber)  of  8  September  2015.  Criminal  proceedings  against  Ivo 
Taricco  and  Others.  Request  for  a  preliminary  ruling  from  the  Tribunale  di  Cuneo.  Reference  for  a 
preliminary ruling  — Criminal proceedings concerning offences in relation to value added tax (VAT) 
— Article 325 TFEU  — National legislation laying down absolute limitation periods which may give 
rise  to impunity in respect of offences  — Potential prejudice  to the financial  interest of the  European 
Union  —  Obligation,  for  the national  court,  to  disapply  any  provision of  national  law  liable  to  affect 
fulfilment of the Member States’ obligations under EU law. Case C-105/14 

EN 

1 

  EN 

 
against fraud, corruption and any other illegal activity affecting the financial interests of the 
Union. 

Regulation  (EU) No 904/2010  does not  explicitly provide for OLAF’s access  to  IT systems 
with  relevant  VAT  information  defined  under  Regulation  (EU)  904/2010.  The  European 
Court of Auditors has recommended that the Commission and Member States should remove 
legal  obstacles  preventing  the  exchange  of  information  between  administrative,  judicial  and 
law enforcement authorities at national and  Union level and, in particular, noted that OLAF 
“should have access  to  VIES and Eurofisc data”. Moreover, in  2025 the European Court of 
Auditors found that in relation to VAT fraud on imports and to cooperation between EU-level 
bodies  the  legal  provisions  on  data  sharing  and  information  exchanges  still  hamper  the 
cooperation  between  Eurofisc  and  OLAF  and  result  in  time-intensive  procedures  impacting 
the effectiveness of the OLAF and the EPPO cases in relation to VAT fraud10. 

Therefore, both the EPPO and the OLAF Regulation already provide for  individual Member 
States’  obligations  to  transmit  –  under  different  grounds  and  means  –  relevant  VAT 
information necessary for the EPPO and OLAF to perform their mandates. On the other hand, 
Regulation (EU) No 904/2010 provides for an EU centralised exchange of VAT information 
amongst  Member  States,  mainly  within  the  Eurofisc  network  and  through  EU  IT  systems 
(such  as  VIES  and  CESOP  that  are  both  used  within  Eurofisc).  Eurofisc  and  the  EU  IT 
systems  have  been  introduced  in  Regulation  (EU)  No  904/2010  to  cope  with  the  emerging 
need of combating intra-Community fraud and e-commerce VAT fraud, which by definition 
involves several Member States. Combating this kind of fraud with bilateral exchanges makes 
the detection of cross border fraud schemes too slow.  

Member State tax authorities’ multilateral sharing of information happens on two main levels: 
(1)  through  sharing  of  national  risk  analysis  within  the  Eurofisc  network,  and  (2)  via  the 
automated  access  to  VAT  information  through  EU  IT  systems  such  as  the  VIES  and  the 
CESOP. The first allows tax authorities to exchange the result of national risk analysis, share 
feedback and have  an EU level  risk  analysis of potential fraudulent schemes. The second is 
key for tax authorities to access VAT information at EU level, to run their own risk analysis 
or  to  verify  the  outcome  of  the  risk  analysis,  and  for  Eurofisc  risk  analysis  as  well.  The 
current  legal  basis  allows  Member  States  to  access  VAT  information  at  EU  level  only 
between  tax  administrations.  Regulation  (EU)  No  904/2010  has  not  been  amended 
accordingly  to  streamline  the  way  the  EPPO  and  OLAF  can  access  this  information  at  EU 
level,  giving  them  a  tool  to  execute  their  regulatory  tasks  and  combat  fraud.  Access  to 
information  at  EU  level  is  necessary  for  the  EPPO  and  OLAF  in  order  to  distinguish 
fraudulent  transactions  from  legitimate  transactions,  and  to  conduct  investigations  on  the 
entire  fraudulent  chain.  This  implies  access  to  VAT  information  at  EU  level.  In  practice, 
under the current situation, the EPPO and OLAF must fulfil their mandate of combating fraud 
at EU level by cooperating bilaterally with tax authorities at national level. If the EPPO and 
OLAF  investigate  an  EU  fraud,  they  can  only  go  through  a  national  authority  to  find  VAT 
identification information of the fraudulent taxpayers in that Member State, and information 
on the fraudulent transactions in that Member State. Under the current scenario, the EPPO and 
OLAF  must  repeat  this  bilateral  cooperation  with  all  the  Member  States  they  believe  are 
involved  in  a  fraud,  possibly  coming  back  to  the  same  Member  States  if  new  suspicious 
taxpayers  are  involved.  This  long  and  cumbersome  process  does  not  fit  with  the  need  of 

10 

European Court of Auditors Special Report 08/2025 ‘Value Added Tax fraud on imports – The EU’s 
financial interests are insufficiently protected under simplified import customs procedures’, and Special 
report no 24/2015 Recommendation N. 12.  

EN 

2 

  EN 

 
investigating  intra-Community  VAT  fraud  that  involves  several  Member  States.  The  most 
recent EPPO investigations spanning more than half of the Member States11 prove that the EU 
fight against VAT fraud can only benefit from an EU level access to VAT information. The 
sooner  the  EPPO  and  OLAF  have  the  complete  picture  of  the  fraud  through  an  EU 
perspective, the sooner they can take actions to stop the fraud. This proposal addresses these 
shortcomings with a limited amendment, in order to provide to the EPPO and OLAF a direct 
and streamlined communication with Eurofisc and a specific, direct and centralised access to 
relevant  VAT  information  in  relation  with  their  respective  mandates,  in  terms  of  fighting 
fraud  and  without  prejudice  to  the  existing  rights  of  access  stemming  from  the  EPPO  and 
OLAF Regulations. 

• 

Consistency with existing policy provisions in the policy area 

This proposal is consistent with the legislation of the VAT in the digital age package, which 
has  entered  into  force  but  is  not  yet  applicable12.  The  VAT  in  the  digital  age  package 
envisages the creation of a system for the centralised exchange and processing of information 
on  intra-EU  transactions  and  VAT  registration  information  (central  VAT  Information 
Exchange System - VIES). A legal amendment is creating the EPPO’s and OLAF’s access to 
the central VIES information, once it becomes applicable.  

Regulation (EU) No 904/2010 lays down rules for the Member States’ competent authorities 
to  share  information  on  cross-border  payments  through  the  Central  Electronic  System  of 
Payment  data  (CESOP).  Therefore,  this  proposal  is  also  addressing  the  access  of  the  EPPO 
and OLAF to the CESOP. 

• 

Consistency with other Union policies 

This proposal is consistent with the ongoing review of the EU anti-fraud architecture aimed at 
streamlining tasks, competences and coordination between the different EU actors in charge 
of  prevention,  investigation  and  repression  of  fraud  affecting  the  EU’s  financial  interests, 
which extends to efficient sharing of data and intelligence. It is in line with the White Paper 
for the anti-fraud architecture review13. In particular, the White Paper stresses how the fight 
against fraud can benefit from focusing on better information collection, a strengthened access 
to  data  and  improved  synergies  in  the  use  of  investigative  means,  both  criminal  and 
administrative, and improved cooperation. The White Paper mentions that it might be useful 
to create rules for the EPPO and OLAF to exchange information with Eurofisc and give them 
centralised access to relevant VAT information. 

11 

12 

13 

The  EPPO  investigation  cluster  Midas,  a  large-scale  VAT  fraud  case  spanning  17  countries  and 
involving an estimated damage of €195 million. (Germany: Fourth person convicted in large-scale VAT 
fraud investigation Midas | European Public Prosecutor’s Office). The investigation carried out by the 
EPPO, code-named ‘Calypso’, has dealt a significant blow to criminal networks flooding the EU market 
with  goods  fraudulently  imported  from  China,  while  evading  custom  duties  and  VAT.    It  spans  14 
countries.  The  total  damage  of  the  criminal  activities  under  investigation  is  currently  estimated  at 
approximately €700 million: over €250 million come from evaded customs duties (which revert entirely 
to the EU budget), and close to €450 million from unpaid VAT which damages both the EU budget and 
the  national  budgets  of  Member  States  (Investigation  ‘Calypso’:  EPPO  strikes  criminal  networks 
flooding EU with fraudulent Chinese imports | European Public Prosecutor’s Office). 
Council  Regulation  (EU)  2025/517  of  11  March  2025  amending  Regulation  (EU)  No  904/2010  as 
regards the VAT administrative cooperation arrangements needed for the digital age (OJ L, 2025/517, 
25.3.2025) 
COM(2025) 546 final 

EN 

3 

  EN 

 
This  proposal  is  consistent  with Council Regulation (EU) 2017/1939  establishing the EPPO 
and defining its competence in respect of the criminal offences affecting the financial interests 
of  the  Union,  as  provided  for  by  the  PIF  Directive,  including  cross-border  VAT  fraud 
involving a total damage of at least EUR 10 million. 

This proposal is consistent with the Commission Decision 1999/352/EC14 establishing OLAF 
and  defining  its  competence  in  respect  of  administrative  investigations  for  the  purpose  of 
strengthening  the  fight  against  fraud,  corruption  and  any  other  illegal  activity  adversely 
affecting the Community's financial interests, as well as any other act or activity by operators 
in breach of Community provisions. 

This proposal is also consistent with ProtectEU, a European Internal Security Strategy,15 in so 
far  as  it  allows  better  use  of  both  criminal  and  administrative  means,  interoperability  of  IT 
systems  and  improved  cooperation  in  the  fight  against  fraud  and  organised  crime.  It  is 
coherent  with  the  possibility  of  a  future  enhancement  of  cooperation  between  Europol  and 
Eurofisc in the framework of the comprehensive assessment of Council Regulation (EU) No 
904/2010  and  in  the  framework  of  the  overhaul  of  Europol’s  mandate,  as  envisaged  under 
ProtectEU. 

The proposal respects the current personal data protection legislation, the GDPR16, as well as 
the  Regulation  (EU)  2018/1725,  which  applies  to  Union  institutions,  bodies,  offices  and 
agencies,  as  well  as  the  standalone  data  protection  regime  of  Chapter  VIII  of  the  EPPO 
Regulation17 

2. 

• 

LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY 

Legal basis 

This Regulation amends Council Regulation (EU) No 904/2010 on the basis of Article 113 of 
the Treaty on the Functioning of the European Union. This Article provides for the Council, 
acting unanimously in accordance with a special legislative procedure and after consulting the 
European  Parliament  and  the  Economic  and  Social  Committee,  to  adopt  provisions  for  the 
harmonisation of Member States' rules in the area of indirect taxation.  

• 

Subsidiarity (for non-exclusive competence)  

Providing  for the modalities  in  which the EPPO  and OLAF  should obtain  VAT data that is 
exchanged  under  Council  Regulation  (EU)  No  904/2010  (i.e.  at  Union  level)  cannot  be 
achieved  solely  at  Member  State  level  or  using  non-legislative  instruments.  It  can  only  be 
achieved by clarifying the relevant legal basis at Union level. Therefore, it is necessary for the 
Commission to propose action to amend Council Regulation (EU) No 904/2010.  

14 

15 

16 

17 

Commission Decision of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (notified 
under document number SEC(1999) 802) (OJ L 136, 31.5.1999, p. 20–22) 
Communication  from  the  Commission  to  the  European  Parliament,  the  Council,  the  European 
Economic and Social Committee and the Committee of the Regions on ProtectEU: a European Internal 
Security Strategy (COM/2025/148 final) 
Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data and on the free movement of 
such data (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1–88 ) 
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the 
protection of natural persons with regard to the processing of personal data by the Union institutions, 
bodies, offices and agencies and on the free movement of such data (OJ L 295, 21.11.2018, p. 39–98 ) 

EN 

4 

  EN 

 
• 

Proportionality 

The  proposal  entails  only  a  very  targeted  amendment  to  the  current  legal  framework  for 
administrative cooperation in the field of VAT and adds elements to it only where necessary 
to  create  EPPO’s  and  OLAF’s  access  to  VAT  information  exchanged  under  VAT 
administrative cooperation arrangements. The proposed changes are expected to have positive 
effects on the fight against VAT fraud, due to the removal of legal uncertainties that currently 
hinder efficient cooperation with the EPPO and OLAF at EU level. The new provisions would 
not  entail  any  significant  additional  costs  for  national  authorities,  except  for  certain  IT 
developments  for  the  EPPO,  OLAF  and  the  Commission.  Even  in  these  instances,  the 
associated development costs would remain very low. There is no impact on businesses. 

In  respect  to  the  EPPO,  the  new  provisions  do  not  go  beyond  what  is  strictly  necessary  to 
make  VAT  data  exchanged  under  administrative  cooperation  instruments  available  to  the 
EPPO to make it more efficient in investigating and prosecuting cross-border VAT fraud and 
enhancing the fight against criminal organisations. Regulating how the EPPO can obtain the 
information  on  VAT  fraud  at  Union  level,  instead  of  obtaining  data  from  each  competent 
authority of the Member States separately, is necessary for the EPPO to efficiently investigate 
and  prosecute  criminal  offences  affecting  the  Union’s  financial  interests  provided  for  in 
Directive (EU) 2017/137118, and in particular serious cross-border VAT fraud.  

In respect to OLAF, the new provisions do not go beyond what is strictly necessary to make 
VAT data exchanged under administrative cooperation instruments available to the OLAF to 
make it more efficient in its administrative investigations of fraud, corruption and any other 
illegal  activity  adversely  affecting  the  Community's  financial  interests,  as  well  as  any  other 
act or activity by operators in breach of Community provisions.  

The  EPPO  and  OLAF  will  be  able  to  obtain  relevant  VAT  information  over  a  secure 
communication  network,  such  as  the  networks  that  currently  support  exchanges  of 
information among tax and customs authorities. The network should provide all the necessary 
security  features  (including  encryption  of  information).  This  proposal  notes  that  the 
safeguards  laid  down  under  the  EPPO  Regulation,  the  OLAF  Regulation  and  the  European 
data protection laws will continue to apply. The overall purpose for exchanging and analysing 
VAT-relevant information is in accordance with the EPPO’s and OLAF’s mandate to combat 
fraud.  Fighting  fraud  is  an  important  objective  of  general  public  interest  for  the  EU  and  its 
Member States.  

• 

Choice of the instrument 

A Council Regulation is needed to amend Council Regulation (EU) No 904/2010. 

3. 

• 

RESULTS 
CONSULTATIONS AND IMPACT ASSESSMENTS 

EX-POST 

EVALUATIONS, 

OF 

STAKEHOLDER 

Ex-post evaluations/fitness checks of existing legislation 

An evaluation of Council Regulation (EU) No 904/2010 was carried out in 2025. Overall, the 
Member States take a positive view of the legal  and practical  framework implemented. The 
administrative cooperation legal framework which was evaluated does not make any explicit 

18 

Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight 
against fraud to the Union's financial interests by means of criminal law  (OJ L 198, 28.7.2017, p. 29–
41) 

EN 

5 

  EN 

 
reference  to  the  EPPO.  A  key  finding  of  the  evaluation  was  that  the  lack  of  an  explicit 
reference  to  EPPO  in  Council  Regulation  (EU)  No  904/2010  leads  to  non-optimal  inter-
institutional cooperation and thereby undermines the effective fight against VAT fraud. The 
evaluation  also  showed  that  cooperation  tools  between  Eurofisc  and  OLAF  provided  by 
Regulation (EU) No 904/2010 are not effective.  

• 

Stakeholder consultations 

Extensive  stakeholder  consultations  took  place  during  the  evaluation  and  prior  to  this 
proposal. In the context of the evaluation, the Commission surveyed the national authorities 
competent in the field of VAT cooperation and other stakeholders. A questionnaire was made 
available  to  Member  States  in  2023,  and  all  Member  States  provided  their  replies  in  two 
months. Member States were asked among others about the EPPO-Eurofisc cooperation and 
EPPO’s  access  to  VAT  data.  Member  States  were  generally  positive  in  amending  the  legal 
framework  in  respect  to  the  EPPO,  while  noting  the  challenge  of  not  all  Member  States 
participating in the EPPO and the need for EPPO to access VAT data in the frame of ongoing 
EPPO  investigations.  The  stakeholders’  views  were  taken  into  account  while  drafting  this 
proposal. 

• 

Collection and use of expertise 

The  collection  and  use  of  expertise  relied  on  extensive  stakeholder  consultations,  including 
the  competent  authorities  of  the  Member  States  in  respect  to  Council  Regulation  (EU)  No 
904/2010, Eurofisc representatives, OLAF and the EPPO.  

• 

Impact assessment 

No  impact  assessment  was  carried  out  for  this  proposal  to  ensure  consistency  between  the 
EPPO  Regulation,  OLAF  Regulation  and  Council  Regulation  (EU)  No  904/2010.  Some 
Member States are already sharing with the EPPO and OLAF their own information, which is 
also  exchanged under the Eurofisc network, based on the national  legislation and the EPPO 
and  OLAF  Regulation.  However,  this  national  approach  with  lack  of  EU  coordination  only 
provides the EPPO and OLAF with fragmented information, a partial view of the wider EU 
frauds.  VAT  fraud  in  the  EU  is  becoming  more  and  more  organised  at  EU  level  and 
Regulation (EU) No 904/2010 has been amended accordingly to provide Member States with 
the  legal  tool  for  an  EU  approach.  However,  the  EPPO  and  OLAF  access  to  these  new  EU 
tools for the exchange of information, only available through Regulation (EU) No 904/2010, 
has  not  been  foreseen.  Providing  these  legal  tools  is  essential  for  the  EPPO  to  conduct 
criminal  investigations  and  effectively  dismantle  VAT  fraud  networks.  This  is  particularly 
urgent given the existing operational needs highlighted in the EPPO’s 2024 Annual Report19. 
The EPPO is advancing in dismantling VAT-based cross-border organised crime groups and 
any  delay  for  updating  the  Regulation  will  result  in  significant  losses  for  Member  States  in 
terms  of  the  VAT  revenues  that  they  will  not  collect.  Similarly,  as  the  European  Court  of 
Auditors noted in  its  Special Report 8 of 2025 on VAT  fraud on imports and in  its  Special 
Report  24  of  2015  on  Intra-Community  Fraud  (recommendation  12),  OLAF  should  be 
provided  with  access  to  VIES  and  Eurofisc  information  because  it  is  essential  for 
strengthening effective VAT cooperation. 

Amending the Regulation (EU) No 904/2010 is the only viable policy to give the EPPO and 
OLAF access to VAT information at EU level. The budgetary impact is negligible, as access 

19 

2024 Annual Report: : EPPO leading the charge against EU fraud,  3 March 2025. 

EN 

6 

  EN 

 
would  be  granted  through  existing  IT  infrastructure.  There  is  no  impact  on  citizens  or 
businesses.  

• 

Regulatory fitness and simplification 

Under  the  one-in-one-out  (OIOO)  principle,  the  Commission  committed  to  offsetting  new 
burdens from  legislative proposals  by reducing  existing  burdens in  the same policy area, so 
that  negative  impacts  for  businesses  and  citizens  are  limited.  The  offset  concerns 
administrative  burdens  and  not  necessarily  adjustment  costs  (e.g.  the  investment  needed  for 
upgrades). This proposal does not have any impact on businesses or citizens and therefore 
the OIOO principle is fulfilled.  

The  proposal  is  ready  for  the  digital  environment  and  relies  on  existing  IT  communication 
tools (Digital Check). 

• 

Fundamental rights 

The  proposal  relates  to  exchange  and  processing  of  VAT-related  information  and  personal 
data by the EPPO and OLAF. The General Data Protection Regulation (GDPR)20 gives a wide 
definition of personal data including any information relating to an identified or identifiable 
natural  person that can  be identified directly or  indirectly. As such the data relevant  for the 
fight against fraud contain information falling under the scope of the GDPR and the principles 
for the protection of personal as laid down in the Charter of Fundamental Rights21. The GDPR 
sets the principles and data subjects rights to be respected while processing personal data. As 
explained  in  section  1,  given  the  scale  and  complexity  of  cross-border  VAT  fraud  it  is 
necessary for EPPO and OLAF to obtain VAT information at EU-level in order to fulfil their 
regulatory mandates. Moreover, obtaining VAT information at EU level is proportional since 
it relates to suspected VAT fraud cases and investigation22.  

The  EPPO  Regulation  contains  a  standalone  data  protection  regime  for  processing  of 
operational personal data, and the OLAF Regulation includes specific provisions to ensure the 
protection  of  personal  data  in  accordance  with  EU  data  protection  standards,  particularly 
Regulation (EU) 2018/1725. Personal data processed by the EPPO –  especially data related to 
criminal  investigations  –  has  to  be  lawful,  fair,  and  only  for  specified,  legitimate  purposes. 
The EPPO Regulation sets limits on data retention, mandates appropriate security measures, 
and  guarantees  data  subjects'  rights  such  as  access,  rectification,  erasure,  and  restriction  of 
processing,  subject  to  certain  limitations  due  to  the  nature  of  the  EPPO's  work.  It  also 
provides for independent supervision by the European Data Protection Supervisor (EDPS) to 
ensure compliance. Similarly, as a service of the European Commission, OLAF is subject to 
Regulation  (EU)  2018/1725  of  the  European  Parliament  and  of  the  Council  of  23  October 
2018 and is thus under the supervisory powers of the EDPS. 

20 

21 
22 

Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the  Council of 27 April 
2016 on the protection of natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text 
with EEA relevance) (OJ L 119, 4.5.2016, p. 1) 
Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012, p. 391) 
Article  23(1)(e)  of  the  General  Data  Protection  Regulation  and  Article  25(1)(c)  of  Regulation  (EU) 
2018/1725 

EN 

7 

  EN 

 
4. 

BUDGETARY IMPLICATIONS 

The  proposal  will  lead  to  limited  costs  for  the  EPPO,  OLAF  and  the  Commission  for 
adjusting  existing  information  systems  to  facilitate  exchange  of  information  and  access  to 
VAT information. The budgetary implications are set out in detail in the financial statement of 
this proposal. 

5. 

• 

OTHER ELEMENTS 

Implementation plans and monitoring, evaluation and reporting arrangements 

The  Standing  Committee  on  Administrative  Cooperation  (SCAC),  established  under  Article 
58(1)  of  the  Council  Regulation  (EU)  No  904/2010,  will  deal  with  issues  regarding 
administrative cooperation between Member States, OLAF and the EPPO.   

Pursuant to Article 37 of Regulation (EU) No 904/2010, the Eurofisc chairperson shall submit 
an annual report on all Eurofisc activities to the SCAC, including exchanges with the EPPO 
and OLAF. In addition, under Article 49, to evaluate how well administrative cooperation is 
combating tax evasion and avoidance, Member States must communicate to the Commission 
any available information relevant to the application of the Regulation and, inter alia, annual 
statistics  about  the  information  accesses  by  EPPO  and  OLAF.  Based  on  these  strands  of 
evidence the Regulation’s application is reviewed every five years. 

Explanatory documents (for directives) 

• 

N/A 

• 

Detailed explanation of the specific provisions of the proposal 

The proposed amendments are as follows:  

(a)  Under Article 36 (2a),  Eurofisc working field coordinators must communicate 
spontaneously  to  the  EPPO  any  indication  of  suspected  fraud  based  on  the 
information exchanged between  Member States on cross-border VAT fraud, in 
respect  of  which  the  EPPO  could  exercise  its  competence.  Under  Article  36 
(2b) Eurofisc working field coordinators must communicate to the EPPO upon 
request  any  information  relevant  during  the  EPPO  investigations  into  VAT 
fraud. 

(b)  Under Article 36 (2c) Eurofisc  working  field  coordinators must communicate 
to  OLAF  any  indication  of  suspected  fraud  based  on  the  information 
exchanged between Member States on cross-border VAT fraud, in accordance 
with  OLAF  mandate  unless  prevented  by  national  law.  Under  Article  36(2d) 
Eurofisc working field coordinators must communicate to OLAF upon request 
any information relevant for OLAF mandate, unless prevented by national law. 

(c)  Article 36 paragraphs (2a)-(2d) provide access to data collected from Member 
States  but  not  to  any  data  received  by  Eurofisc  from  Europol  pursuant  to 
Article 36(3). 

(d) 

In  Chapter  XIII  “RELATIONS  WITH  THE  COMMISSION  AND  OTHER 
INSTITUTIONS,  BODIES,  OFFICES  AND  AGENCIES  OF  THE  UNION”, 
under Article 49a, the competent authorities of the Member States must grant 
the EPPO centralised access for targeted searches to VAT relevant information 
through  the  EU  IT  systems  for  the  purpose  of  investigating  specific  criminal 

EN 

8 

  EN 

(e) 

offences  as  defined  in  Article  4  of  the  EPPO  Regulation.  Access  will  be 
granted to European Prosecutors, European Delegated Prosecutors and selected 
staff of the EPPO who hold a personal user identification. This access refers to 
the information referred to in Article 49a, and does not include access to  risk 
indicators and processes applied by the Eurofisc Liaison officials. The access is 
limited  to  targeted  searches  based  on  specific  data  categories,  which  will  be 
defined  in  an  implementing  act  and  for  the  purpose  of  investigating  or 
prosecuting specific suspected criminal  offences as referred to  in  Article 4 of 
Regulation (EU) 2017/1939, e.g. not for random searches. 

In  the  same  Chapter,  under  Article  49b,  the  competent  authorities  of  the 
Member  States  must  grant  OLAF  centralised  access  for  targeted  searches  to 
VAT  relevant  information  through  the  EU  IT  systems  for  the  purposes  of 
opening  and  carrying  out  investigations  in  accordance  with  OLAF  tasks. 
Access will be granted to authorised staff by OLAF who hold a personal user 
identification. This  access  refers to  the information  referred to  in  Article 49a, 
and  does  not  include  access  to  risk  indicators  and  process  applied  by  the 
Eurofisc Liaison officials. The access is limited to targeted searches based on 
specific data categories, which will be defined in an implementing act and for 
the  purposes  of  opening  and  carrying  out  investigations  in  accordance  with 
OLAF  tasks  as  referred  to  in  Article  1(1)  of  Regulation  (EU,  Euratom)  No 
883/2013, e.g. not for random searches. 

The legal provisions in Article 49a and 49b cover the EPPO’s and OLAF’s access: 

(a)  Through  the  VAT  Information  Exchange  System  (VIES)  to  information  on 
VAT  identification  numbers  and  intra-Community  transactions  (Article  17(1) 
points (a)-(c)), 

(b)  Through  the  SURVEILLANCE  system  to  relevant  information  on  VAT 
exempt  importations  (Article  17(1)  points  (e)  and  (f)  related  to  I/OSS  and 
Customs procedure 42/63 importations),  

(c)  Through the CESOP system to payment information (Article 24b(3)) . 

References  to  EPPO’s  and  OLAF’s  access  according  to  Articles  49a  and  49b  are  added  to 
Articles 21 and 24d for coherence.   

The EPPO and OLAF will be able to obtain information related to the VAT One-Stop-Shop 
and  the  SME  special  scheme  (Article  17(1)  points  (d),  (g)  respectively)  through  Eurofisc 
pursuant the amended Article 36, given the specificities of the relevant IT systems, which do 
not  include  central  components  at  EU  level  and  their  adaptation  would  have  IT  impact  to 
national authorities.  

Legal provisions are adapted as of 1 July 2030 to accommodate for the central VIES, which 
will start operations at that moment and will replace the legacy VIES. A reference to EPPO’s 
and OLAF’s access to central VIES according to Articles 49a and 49b is added to Article 24k 
for coherence. 

EN 

9 

  EN 

 
2025/0348 (CNS) 

Proposal for a 

COUNCIL REGULATION 

amending Regulation (EU) No 904/2010 as regards the access of the European Public 
Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value 
added tax information at Union level 

THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Article 113 thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national parliaments, 
Having regard to the opinion of the European Parliament1,  
Having regard to the opinion of the European Economic and Social Committee2,  

Acting in accordance with a special legislative procedure, 

Whereas: 

(1) 

Council Regulation (EU) No 904/20103 lays down rules on the storage and exchange 
through electronic means of specific information in the field of value added tax (VAT) 
that  may  help  to  effectuate  a  correct  assessment  of  VAT,  monitor  the  correct 
application  of  VAT,  particularly  on  intra-Community  transactions,  and  combat  VAT 
fraud.  However,  it  does  not  set  out  how  the  European  Public  Prosecutor’s  Office 
(EPPO) can obtain that information for the exercise of its tasks pursuant to Article 4 of 
Council Regulation (EU) 2017/19394, or the European Anti-Fraud Office (OLAF) can 
obtain  that  information  for  the  exercise  of  its  tasks  in  accordance  with  Article  1  of 
Regulation  (EU,  Euratom)  No  883/2013  of  the  European  Parliament  and  of  the 
Council5. 

(2) 

Pursuant  to  Article  24(1)  of  Regulation  (EU)  2017/1939,  the  institutions,  bodies, 
offices and agencies of the Union and the authorities of the Member States competent 
under  applicable  national  law  are  to  report  to  the  EPPO,  without  undue  delay,  any 

1 
2 
3 

4 

5 

in 

of 

the 

field 

value 

OJ C , , p. . 
OJ C , , p. . 
Council Regulation (EU) No 904/2010 of 7 October 2010 on administrative cooperation and combating 
fraud 
p. 1).1, 
added 
ELI: http://data.europa.eu/eli/reg/2010/904/oj).  
Council  Regulation  (EU)  2017/1939  of  12  October  2017  implementing  enhanced  cooperation  on  the 
establishment  of  the  European  Public  Prosecutor’s  Office  (‘the  EPPO’)  (OJ  L  283,  31.10.2017,  p.  1, 
ELI: http://data.europa.eu/eli/reg/2017/1939/oj). 
Regulation  (EU,  Euratom)  No  883/2013  of  the  European  Parliament  and  of  the  Council  of  11 
September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and 
repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council 
ELI: 
(OJ 
Regulation 
http://data.europa.eu/eli/reg/2013/883/oj). 

(Euratom)  No 

12.10.2010, 

(OJ L 268, 

1074/1999 

18.9.2013, 

248, 

tax 

1, 

p. 

L 

EN 

10 

  EN 

 
criminal  conduct,  including  cross-border    VAT  fraud,  in  respect  of  which  it  could 
exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that 
Regulation. Cross-border VAT fraud is by definition involving several Member States, 
and the flow of information from individual Member States to the EPPO does not fit 
the purpose of combating VAT fraud at EU level. Therefore, in order for the EPPO to 
be informed of VAT fraud risks at EU level and to perform its regulatory mandate, it 
is necessary to set out in more detail the modalities under which the Member States, 
within the Eurofisc network referred to in Article 33 of Regulation (EU) No 904/2010, 
should  report  to  the  EPPO  any  suspicious  indication  and  eventually  precise 
information on VAT fraud. Furthermore, pursuant to Article 24(9) of Regulation (EU) 
2017/1939,  in  specific  cases,  the  EPPO  may  request  further  relevant  information 
available  to  the  institutions,  bodies,  offices  and  agencies  of  the  Union  and  the 
authorities of the Member States. Therefore, it is appropriate to set out the rules under 
which Member States  within Eurofisc should communicate to  the EPPO information 
on cross-border VAT fraud following an EPPO request. 

Pursuant  to  Article  43(1)  of  Regulation  (EU)  2017/1939,  European  Delegated 
Prosecutors  are  to  be  able  to  obtain  any  relevant  information  stored  in  national 
databases, as well as relevant registers of public authorities, under the same conditions 
as those that apply under national law in similar cases. Pursuant to Article 43(2) of that 
Regulation,  the  EPPO  is  also  to  be  able  to  obtain  any  relevant  information  falling 
within  its  competence  that  is  stored  in  databases  and  registers  of  the  institutions, 
bodies,  offices  and  agencies  of  the  Union.  Cross-border  VAT  fraud  is  by  definition 
involving  several  Member  States,  and  the  access  at  Member  State  level  to  relevant 
information  stored  in  national  database  is  not  sufficient  for  the  EPPO  for  combating 
VAT fraud at EU level. Therefore, without prejudice to Article 43 of Regulation (EU) 
2017/1939,    in  order  for the EPPO to  have  access  to  information  at EU  level  and to 
perform its regulatory mandate and fight against fraud at EU level, it is important to 
define  the  rules  under  which  the  EPPO  should  obtain  relevant  VAT  information  at 
Union  level  from  databases  and  registers  of  competent  authorities  as  referred  to  in 
Article  1(1)  of  Council  Regulation  (EU)  No  904/2010.  For  the  same  reason,  it  is 
important  to  give  the  EPPO  a  centralised  access,  for  targeted  searches,  to  all  the 
information  concerning  an  investigation  through  a  single-entry  point,  even  if  that 
information concerns several Member States. 

The Member States not participating  in the EPPO are obliged, under the principle of 
sincere  cooperation  enshrined  in  Article  4(3)  of  the  Treaty  on  European  Union,  to 
support the activities of the EPPO and to refrain from any action that could jeopardise 
the  attainment  of  its  objectives.  Eurofisc  is  composed  of  both  Member  States 
participating  and  not  participating  in  the  EPPO.  Therefore,  it  is  important  to  have  a 
clear legal basis for the EPPO access to information processed by Eurofisc. 

The  European  Court  of  Auditors  has  recommended  that  the  Commission  and  the 
Member  States  remove  legal  obstacles  preventing  the  exchange  of  information 
between administrative, judicial and law enforcement authorities at national and Union 
level and in particular that OLAF has access to the VAT information exchange system 
(VIES) and Eurofisc data6. In that respect it is important that a central access to EU IT 
systems is set out in a clear legal basis.  

(3) 

(4) 

(5) 

6 

European Court of Auditors Special Report No 24/2015, Tackling intra-Community VAT fraud: More 
action needed (https://www.eca.europa.eu/en/publications/SR15_24). 

EN 

11 

  EN 

 
(6) 

(7) 

(8) 

7 

8 

Pursuant  to  Article  8(3)  of  Regulation  (EU,  Euratom)  No  883/2013,  the  competent 
authorities of Member States are to transmit without delay to OLAF, at its request or 
on their own initiative, any other information, documents or data considered pertinent 
which  they  hold,  relating  to  the  fight  against  fraud,  corruption  and  any  other  illegal 
activity  affecting  the  financial  interests  of  the  Union.  Cross-border  VAT  fraud  is  by 
definition  involving  several  Member  States,  and  the  flow  of  information  to  OLAF 
does not fit the purpose of combating VAT fraud at EU level. Therefore, in order for 
OLAF to be informed on VAT fraud at EU level and to perform its regulatory mandate 
it is necessary to set out the detailed rules under which the Member States, within the 
Eurofisc  network  referred  to  in  Article  33  of  Regulation  (EU)  No  904/2010,  should 
report to OLAF any suspicious indication and eventually precise information on cross-
border VAT fraud, either on their own initiative or at the request of OLAF. 

 Pursuant  to  Article  3(11)  of  Regulation  (EU,  Euratom)  No  883/2013,  OLAF  may 
have access to any relevant information and data, irrespective of the medium on which 
it is stored, held by the  institutions, bodies, offices and agencies, connected with the 
matter  under  investigation,  where  necessary  in  order  to  establish  whether  there  has 
been fraud, corruption or any other illegal  activity affecting the financial interests of 
the Union. Pursuant to Article 6(1) of Regulation (EU, Euratom) No 883/2013, prior to 
the  opening  of  an  investigation,  OLAF  is  to  have  the  right  of  access  to  any  relevant 
information in databases held by the institutions, bodies, offices or agencies when this 
is indispensable in order to assess the basis in fact of allegations while respecting the 
principles  of  necessity  and  proportionality.  That  right  of  access  is  to  be  exercised 
under the conditions set out in Regulation (EU, Euratom) No 883/2013 . Cross-border 
VAT fraud is by definition involving several Member States, but Regulation (EU) No 
904/2010 does not give OLAF access to information exchanged or stored in the EU IT 
systems,  thus  jeopardising  OLAF  capacity  for  combating  VAT  fraud  at  EU  level. 
Therefore, in order for OLAF to access VAT information at EU level and to perform 
its regulatory mandate and fight against fraud at EU level it is important to define the 
rules under which OLAF should access relevant VAT information at Union level from 
databases and registers of competent authorities referred to Article 1(1) of  Regulation 
(EU)  No  904/2010.  For  the  same  reason,  it  is  important  to  give  OLAF  a  centralised 
access,  for  targeted  searches,  to  all  the  information  concerning  an  investigation 
through a single-entry point, even if that information concerns several Member States. 

Information  on  intra-Community  transactions,  cross-border  payments  and  VAT 
exempt importations is important for the fight against fraud. That information is stored 
by national competent authorities.  With regard to the protection of personal data, the 
Commission is facilitating the exchange of that information as data processor  and the 
competent  authorities in  the Member States  act as data controllers, under  Regulation 
(EU) 2018/1725 of the European Parliament and of the Council7 and Regulation (EU) 
2016/679 of the European Parliament and of the Council8 respectively. The EPPO and 

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the 
protection of natural persons with regard to the processing of personal data by the Union institutions, 
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 
39, 
and  Decision  No 
45/2001 
ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 
Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data and on the free movement of 
such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, 
p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj). 

1247/2002/EC 

21.11.2018, 

295, 

(OJ 

p. 

L 

EN 

12 

  EN 

 
(9) 

OLAF’s  centralised  access  to  VAT  information  at  Union  level  should  be  granted 
without prejudice to  the roles and responsibilities of the competent  authorities in  the 
Member States as referred to Article 1(1) of Regulation (EU) No 904/2010 in respect 
of the protection of personal data under Regulation (EU) 2016/679. 

In  order  to  protect  the  access  to  personal  data,  only  the  European  Prosecutors,  the 
European  Delegated  Prosecutors,  as  well  as  selected  staff  of  the  EPPO  and  OLAF, 
previously  authorised  respectively  by  the  EPPO  and  OLAF,  should  access  VAT 
information to execute their tasks, under the oversight of the Eurofisc Liaison officials. 
To  ensure  uniform  conditions  for  that  access,  implementing  powers  should  be 
conferred  on  the  Commission  in  respect  of  the  technical  details  and  practical 
arrangements,  including  on  access  control  mechanism  and  users’  profile  and 
identification. Those powers should be exercised in accordance with Regulation (EU) 
No 182/2011 of the European Parliament and of the Council9.  

(10)  This Regulation respects the fundamental rights and observes the principles recognised 
by the Charter of Fundamental Rights of the European Union, particularly the right of 
protection of personal data. 

(11)  As the systems,  infrastructure  and technical  means  facilitating the  exchange of  VAT 
information  at  Union  level  need  to  be  adapted  to  allow  secure  access  of  EPPO  and 
OLAF,  it  is  necessary  to  defer  the  application  of  the  relevant  provisions  in  order  to 
allow  the  Member  States,  the  Commission,  the  EPPO  and  OLAF  to  carry  out  the 
necessary  adaptations.  This  should  consider  the  dates  when  the  central  VIES  will 
become  operational  and  the  legacy  VIES  will  be  phased  out.  The  EPPO  and  OLAF  
should  be  responsible  for  the  costs  of  establishing  and  maintaining  the  relevant 
infrastructure and technical means for secure access to VAT information. 

(12)  The  European  Data  Protection  Supervisor  was  consulted  in  accordance  with  Article 

42(1) of Regulation (EU) 2018/1725 and delivered an opinion on […]. 

(13)  Regulation (EU) No 904/2010 should therefore be amended accordingly, 

HAS ADOPTED THIS REGULATION: 

Article 1 

Amendments to Regulation (EU) No 904/2010 

Regulation (EU) No 904/2010 is amended as follows: 

(1) 

In Article 21, the following paragraph 2c is inserted: 

‘2c.  Every  Member  State  shall  grant  to  the  European  Public  Prosecutor’s  Office  (EPPO) 
and  the  European  Anti-Fraud  Office  (OLAF)  access  to  the  information  referred  to,  and  in 
compliance with the limits and rules set out in, Article 49a and 49b.’; 

(2) 

Article 24d is replaced by the following: 

‘Article 24d 

9 

Regulation  (EU)  No 182/2011  of  the  European  Parliament  and  of  the  Council  of  16 February  2011 
laying down the rules and general principles concerning mechanisms for control by Member States of 
(OJ L 55,  28.2.2011,  p. 13).13,  ELI: 
the  Commission’s  exercise  of 
http://data.europa.eu/eli/reg/2011/182/oj 

implementing  powers 

EN 

13 

  EN 

 
1.  Access  to  CESOP  shall  be  granted  to  Eurofisc  liaison  officials,  as  referred  to  in  Article 
36(1),  who  hold  a  personal  user  identification  for  CESOP  and  where  that  access  is  in 
connection with an investigation into suspected VAT fraud or is to detect VAT fraud.  

2. The EPPO and OLAF shall access CESOP information in compliance with the limits and 
rules set in Article 49a and 49b.’; 

(3) 

In Article 24k, the following paragraph 1a is inserted: 

‘1a.  The EPPO and OLAF shall access  the  central  VIES information  in  compliance with 
the limits and rules set in Article 49a and 49b’; 

(4) 

In Article 36, the following paragraphs 2a, 2b, 2c and 2d are inserted: 

‘2a.  Eurofisc  working  field  coordinators  shall  communicate  to  the  EPPO,  in  accordance 
with  Article  24(1)  of  Council  Regulation  (EU)  2017/1939*  as  regards  the  Member  States 
participating  in  the  EPPO  and  in  accordance  with  this  Article  as  regards  the  other  Member 
States,  without  undue  delay  any  indication  of  suspected  cross-border  VAT  fraud  based  on 
information  communicated  or  collected  pursuant  to  this  Regulation  in  respect  of  which  the 
EPPO could exercise its competence.  

2b 
In the course of an investigation or a prosecution by, and at the request of the EPPO, 
in  accordance  with  Article  24(9)  of  Council  Regulation  (EU)  2017/1939  as  regards  the 
Member States participating in the EPPO and in accordance with this Article as regards the 
other  Member  States,  Eurofisc  working  field  coordinators  shall  communicate  to  the  EPPO, 
any information from Member States on cross-border VAT fraud communicated or collected 
under this Regulation. 

2c. 
In accordance with Article 8, (2) and (3), of Regulation (EU, Euratom) No 883/2013 
of  the  European  Parliament  and  of  the  Council**  Eurofisc  working  field  coordinators  shall 
communicate  to  OLAF  without  delay  any  indication  of  suspected  cross-border  VAT  fraud 
based  on  information  from  Member  States  communicated  or  collected  pursuant  to  this 
Regulation to enable OLAF to consider appropriate action in accordance with its mandate. 

2d. In accordance with Article 8 (2) and (3) of Regulation (EU, Euratom) No 883/2013 and at 
the  request  of  OLAF,  Eurofisc  working  field  coordinators  shall  communicate  to  OLAF  any 
information  from  Member  States  on  cross-border  VAT  fraud  communicated  or  collected 
pursuant to this Regulation to enable OLAF to consider appropriate action in accordance with 
its mandate. 

*  Council  Regulation  (EU)  2017/1939  of  12  October  2017  implementing  enhanced 
cooperation  on  the  establishment  of  the  European  Public  Prosecutor’s  Office  (‘the  EPPO’) 
(OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj). 

** Regulation (EU, EURATOM) No 883/2013 of the European Parliament and of the Council 
of  11  September  2013  concerning  investigations  conducted  by  the  European  Anti-Fraud 
Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and 
of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248 18.9.2013, p. 1, 
ELI: http://data.europa.eu/eli/reg/2013/883/oj).’; 

(5) 

in Chapter XIII, the following Articles 49a and 49b are added: 

‘Article 49a 

EN 

14 

  EN 

 
1. 

(a) 

(b) 

(c) 

Without  prejudice  to  Article  43  of  Regulation  (EU)  2017/1939,  the  competent 
authorities of the Member States shall grant to EPPO centralised access, for targeted 
searches the following information: 

From  1  September  2026  until  30  June  2032,  the  information  referred  to  in  Article 
17(1), points (a), (b) and (c), of this Regulation; 

From 1 September 2026, the information referred to in Article 17(1), points (e) and 
(f), of this Regulation; 

From  1  September  2026,  the  information  referred  to  in  Article  24b(3)  of  this 
Regulation; 

(d) 

From  1  July  2030,  the  information  referred  to  in  Article  24g(2)  of  this  Regulation.

2. 

(a) 

(b) 

(c) 

3. 

The  centralised  access  referred  to  in  paragraph  1  shall  be  granted  under  all  of  the 
following conditions:  

to  European  Prosecutors,  European  Delegated  Prosecutors,  and  staff  authorised  by 
the EPPO’s Central Office who hold a personal user identification for the electronic 
systems allowing centralised access to the information referred to in paragraph 1 of 
this Article; 

for the purpose of  investigating  or prosecuting  specific suspected  criminal offences 
as referred to in Article 4 of Regulation (EU) 2017/1939; 

under the oversight of the Eurofisc Liaison officials. 

That  centralised  access  shall  be  an  access  through  a  single-entry  point,  to  all  the 
information  concerning  an  investigation,  even  if  that  information  concerns  several 
Member States. 

4. 

The Commission shall determine, by means of implementing acts, the following: 

(a) 

(b) 

the  technical  details  concerning  the  centralised  access  to  the 
information  referred to  in paragraph  1of this  Article including  the 
list  of  data  categories,  with  which  the  targeted  searches  can  be 
carried out; 

the  practical  arrangements,  including  access  control  mechanism 
and  users  profile,  to  identify  the  users  referred  to  in  paragraph  2, 
point (a) and (c), of this Article; 

(c) 

the practical arrangements for the oversight of the Eurofisc Liaison 
officials. 

The  implementing  acts  referred  to  in  the  first  subparagraph  shall  be  adopted  in 
accordance  with  the  examination  procedure  referred  to  in  Article  58(2)  of  this 
Regulation. 

The costs of establishing, operating and maintaining the infrastructure and technical 
means allowing the secure access to the information referred to in paragraph 1 of this 
Article shall be borne by the EPPO. 

Article 49b 

The  competent  authorities  of  the  Member  States  shall  grant  to  OLAF  centralised 
access for targeted searches to the following information: 

5. 

1. 

EN 

15 

  EN 

 
 
(a) 

(b) 

(c) 

(d) 

2. 

(a) 

(b) 

(c)  

3. 

From  1  September  2026  until  30  June  2032,  the  information  referred  to  in  Article 
17(1), points (a), (b) and (c), of this Regulation; 

From 1 September 2026, the information referred to in Article 17(1), points (e) and 
(f), of this Regulation; 

From  1  September  2026,  the  information  referred  to  in  Article  24b(3)  of  this 
Regulation; 

From 1 July 2030, the information referred to in Article 24g(2) of this Regulation. 

The  centralised  access  referred  to  in  paragraph  1  shall  be  granted  under  all  of  the 
following conditions: 

to staff authorised by OLAF who hold a personal user identification for the electronic 
systems allowing the centralised access to the information referred to in paragraph 1 
of this Article; 

for  the  purposes  of  opening  and  carrying  out  investigations  in  accordance  with 
OLAF tasks as referred to in Article 1(1) of Regulation (EU, Euratom) No 883/2013; 

under the oversight of the Eurofisc Liaison officials. 

That  centralised  access  shall  be  an  access  through  a  single-entry  point,  to  all  the 
information  concerning  an  investigation,  even  if  that  information  concerns  several 
Member States. 

4. 

The Commission shall determine by means of implementing acts the following: 

(a) 

(b) 

the  technical  details  concerning  the  centralised  access  to  the 
information referred to in paragraph 1 of this Article including the 
list  of  data  categories,  with  which  the  targeted  searches  can  be 
carried out; 

the  practical  arrangements,  including  access  control  mechanism 
and  users  profile,  to  identify  the  users  referred  to  in  paragraph  2, 
point (a) and (c), of this Article; 

(c) 

the practical arrangements for the oversight of the Eurofisc Liaison 
officials. 

The  implementing  acts  referred  to  in  the  first  subparagraph  shall  be  adopted  in 
accordance  with  the  examination  procedure  referred  to  in  Article  58(2),  of  this 
Regulation. 

5. 

The costs of establishing, operating and maintaining the infrastructure and technical 
means allowing the secure access to the information referred to in paragraph 1 of this 
Article shall be borne by OLAF.’. 

Article 2 

Entry into force and date of application 

This Regulation shall enter into force on the twentieth day following that of its publication in 
the Official Journal of the European Union. 

Article 1, points (1), (2), (4) and (5) shall apply from 1 September 2026. 

Article 1, point (3), shall apply from 1 July 2030. 

EN 

16 

  EN 

 
This Regulation shall be binding in its entirety and directly applicable in all Member States. 

Done at Brussels, 

For the Council 
The President 

EN 

17 

  EN 

 
 
LEGISLATIVE FINANCIAL AND DIGITAL STATEMENT 

1. 

1.1. 

1.2. 

1.3. 

FRAMEWORK OF THE PROPOSAL/INITIATIVE ................................................. 3 

Title of the proposal/initiative ...................................................................................... 3 

Policy area(s) concerned .............................................................................................. 3 

Objective(s) .................................................................................................................. 3 

1.3.1.  General objective(s) ..................................................................................................... 3 

1.3.2.  Specific objective(s) ..................................................................................................... 3 

1.3.3.  Expected result(s) and impact ...................................................................................... 3 

1.3.4. 

Indicators of performance ............................................................................................ 3 

1.4. 

1.5. 

The proposal/initiative relates to: ................................................................................. 4 

Grounds for the proposal/initiative .............................................................................. 4 

1.5.1.  Requirement(s) to be met in the short or long term including a detailed timeline for 

roll-out of the implementation of the initiative ............................................................ 4 

1.5.2.  Added value of EU involvement (it may result from different factors, e.g. 

coordination gains, legal certainty, greater effectiveness or complementarities). For 
the purposes of this section 'added value of EU involvement' is the value resulting 
from EU action, that is additional to the value that would have been otherwise 
created by Member States alone. ................................................................................. 4 

1.5.3.  Lessons learned from similar experiences in the past .................................................. 4 

1.5.4.  Compatibility with the multiannual financial framework and possible synergies with 
other appropriate instruments ....................................................................................... 5 

1.5.5.  Assessment of the different available financing options, including scope for 

redeployment ................................................................................................................ 5 

1.6. 

1.7. 

2. 

2.1. 

2.2. 

2.2.1. 

2.2.2. 

Duration of the proposal/initiative and of its financial impact .................................... 6 

Method(s) of budget implementation planned ............................................................. 6 

MANAGEMENT MEASURES................................................................................... 8 

Monitoring and reporting rules .................................................................................... 8 

Management and control system(s) ............................................................................. 8 

Justification of the budget implementation method(s), the funding implementation 
mechanism(s), the payment modalities and the control strategy proposed .................. 8 

Information concerning the risks identified and the internal control system(s) set up 
to mitigate them............................................................................................................ 8 

2.2.3.  Estimation and justification of the cost-effectiveness of the controls (ratio between 

the control costs  and the value of the related funds managed), and assessment of the 
expected levels of risk of error (at payment & at closure) ........................................... 8 

2.3. 

3. 

3.1. 

Measures to prevent fraud and irregularities ................................................................ 9 

ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE ............ 10 

Heading(s) of the multiannual financial framework and expenditure budget line(s) 
affected ....................................................................................................................... 10 

EN 

1 

  EN 

3.2. 

Estimated financial impact of the proposal on appropriations ................................... 12 

3.2.1.  Summary of estimated impact on operational appropriations.................................... 12 

3.2.1.1.  Appropriations from voted budget ............................................................................. 12 

3.2.1.2.  Appropriations from external assigned revenues ....................................................... 17 

3.2.2.  Estimated output funded from operational appropriations......................................... 22 

3.2.3.  Summary of estimated impact on administrative appropriations ............................... 24 

3.2.3.1. Appropriations from voted budget .............................................................................. 24 

3.2.3.2.  Appropriations from external assigned revenues ....................................................... 24 

3.2.3.3.  Total appropriations ................................................................................................... 24 

3.2.4.  Estimated requirements of human resources.............................................................. 25 

3.2.4.1.  Financed from voted budget....................................................................................... 25 

3.2.4.2.  Financed from external assigned revenues ................................................................ 26 

3.2.4.3.  Total requirements of human resources ..................................................................... 26 

3.2.5.  Overview of estimated impact on digital technology-related investments ................ 28 

3.2.6.  Compatibility with the current multiannual financial framework.............................. 28 

3.2.7.  Third-party contributions ........................................................................................... 28 

3.3. 

4. 

4.1. 

4.2. 

4.3. 

4.4. 

4.5. 

Estimated impact on revenue ..................................................................................... 29 

DIGITAL DIMENSIONS .......................................................................................... 29 

Requirements of digital relevance .............................................................................. 30 

Data ............................................................................................................................ 30 

Digital solutions ......................................................................................................... 31 

Interoperability assessment ........................................................................................ 31 

Measures to support digital implementation .............................................................. 32 

EN 

2 

  EN 

1. 

FRAMEWORK OF THE PROPOSAL/INITIATIVE  

1.1. 

Title of the proposal/initiative 

Amending  Council  Regulation  (EU)  No  904/2010  as  regards  the  VAT  cooperation 
arrangements with the EPPO and OLAF 

1.2. 

Policy area(s) concerned  

VAT administrative cooperation, Fight against fraud 

1.3. 

Objective(s) 

1.3.1.  General objective(s) 

This  proposal  clarifies  the  European  Public  Prosecutor’s  Office’s  (EPPO)  and  the 
European  Anti-Fraud  Office’s  (OLAF)  access  to  Value  Added  Tax  (VAT)  data 
exchanged at EU level under Council Regulation (EU) No 904/2010. Its objective is 
to  ensure  coherence  between  Council  Regulation  (EU)  2017/1939  (hereafter  the 
‘EPPO  Regulation’),  Regulation  (EU,  Euratom)  No  883/2013  (hereafter  ‘OLAF 
Regulation’)  and  Regulation  (EU)  No  904/2010  on  administrative  cooperation  and 
combating fraud in the field of VAT.  

The purpose is fight against fraud, corruption and any other illegal activity affecting 
the financial interests of the European Union.  

1.3.2. 

Specific objective(s) 

The  specific  objective  is  to  provide  for  specific  direct  and  centralised  access  to 
relevant VAT information to the EPPO and OLAF without prejudice to the existing 
rights  of  access  stemming  from  the  EPPO  and  OLAF  Regulations.  In  details, 
Eurofisc must communicate to the EPPO and OLAF any information on cross-border 
VAT  fraud  in  accordance  with  their  mandate  and  Member  States  must  grant  the 
EPPO  and  OLAF  centralised  access  for  targeted  searches  to  VAT  relevant 
information through the EU IT systems. 

1.3.3.  Expected result(s) and impact 

Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted. 

The proposal will provide legal certainty for the modalities of EPPO’s and OLAF’s 
access and processing of VAT information available at EU level. 

This  will  improve  the  cooperation  between  the  EPPO,  OLAF  and  Member  States 
(including Eurofisc). It will bring efficiency gains, i.e. getting information available 
at  EU  level  faster  and  from  all  MS,  in  comparison  to  the  current  practice  where 
information is obtained through bilateral contacts with Member States. 

1.3.4. 

Indicators of performance 

Specify the indicators for monitoring progress and achievements. 

The indicators that could be used to monitor the performance are: 

• 

• 

Number of risk alerts communicated by Eurofisc to the EPPO and OLAF 

Number of EPPO and OLAF information accesses per VAT information type 

EN 

3 

  EN 

1.4. 

The proposal/initiative relates to:  

 a new action  
 a new action following a pilot project / preparatory action32  

 the extension of an existing action  

 a merger or redirection of one or more actions towards another/a new action 

1.5. 

Grounds for the proposal/initiative  

1.5.1.  Requirement(s) to be met in the short or long term including a detailed timeline for 

roll-out of the implementation of the initiative 

The  proposal  will  rely  on  the  practical  arrangements  currently  used  under  Council 
Regulation  (EU)  No  904/2010.  Technical  details  and  conditions  for  information 
access by the EPPO and OLAF will be provided through an implementing act. The 
exchange  of  information  will  take  place  in  accordance  with  the  technical 
developments by the EPPO, OLAF and Commission. Preparatory work could start in 
2025  and  implementation  would  take  place  in  2026.  The  full-scale  operations  are 
planned after July 2030, when the central VIES system will become available. 

1.5.2.  Added  value  of  EU  involvement  (it  may  result  from  different  factors,  e.g. 
coordination gains, legal certainty, greater effectiveness or complementarities). For 
the  purposes  of  this  section  'added  value  of  EU  involvement'  is  the  value  resulting 
from  EU  action,  that  is  additional  to  the  value  that  would  have  been  otherwise 
created by Member States alone. 

Reasons for action at EU level (ex-ante)  

Providing  legal  certainty  which  ensures  access  of  the  EPPO  and  OLAF  to  relevant 
VAT data that is exchanged under the Council Regulation (EU) No 904/2010 cannot 
be achieved solely at Member State level or using non-legislative instruments. It can 
only  be  achieved  at  EU  level  by  providing  a  clear  legal  basis.  Therefore,  it  is 
necessary for the Commission to propose action to amend Council Regulation (EU) 
No 904/2010.  

Expected generated EU added value (ex-post)  

The  proposal  will  provide  legal  certainty  for  the  access  and  processing  of  VAT 
information  available  at  EU  level  by  the  EPPO  and  OLAF.  This  will  improve  the 
cooperation  between  the  EPPO,  OLAF  and  Member  States  (including  Eurofisc).  It 
will bring efficiency gains, i.e. getting  information available at  EU level faster and 
from  all  MS,  in  comparison  to  the  current  practice  where  information  is  obtained 
through bilateral contacts with Member States. 

1.5.3.  Lessons learned from similar experiences in the past 

Not applicable 

1.5.4.  Compatibility with the multiannual financial framework and possible synergies with 

other appropriate instruments 

As  the  proposal  is  designed  to  amend  Regulation  (EU)  No  904/2010  on  VAT 
administrative  cooperation,  the  procedures,  arrangements  and  IT  tools  already 

32 

As referred to in Article 58(2), point (a) or (b) of the Financial Regulation. 

EN 

4 

  EN 

 
established or under development in the context of that Regulation will be available 
for the purposes of this proposal. 

1.5.5.  Assessment  of  the  different  available  financing  options,  including  scope  for 

redeployment 

Pre-financing  of  the  work  will  be  done  via  the  Fiscalis  program  and  charge  back 
done  for  the  actual  costs  via  a  Memorandum  of  Understanding  (MoU)  or  Service 
Level Agreement (SLA) with OLAF and EPPO as appropriate.  

EN 

5 

  EN 

1.6. 

Duration of the proposal/initiative and of its financial impact 

 limited duration  

–    in effect from [DD/MM]YYYY to [DD/MM]YYYY  

–    financial  impact  from  YYYY  to  YYYY  for  commitment  appropriations  and 

from YYYY to YYYY for payment appropriations.  

  unlimited duration 

–  Implementation with a start-up period from 2025 to 2030, 

–  followed by full-scale operation. 

1.7.  Method(s) of budget implementation planned   

 Direct management by the Commission 

–   by its departments, including by its staff in the Union delegations;  

–    by the executive agencies  

 Shared management with the Member States  

 Indirect management by entrusting budget implementation tasks to: 

–   third countries or the bodies they have designated 

–   international organisations and their agencies (to be specified) 

–   the European Investment Bank and the European Investment Fund 

–   bodies referred to in Articles 70 and 71 of the Financial Regulation 

–   public law bodies 

–   bodies governed by private law with a public service mission to the extent that 

they are provided with adequate financial guarantees 

–   bodies governed by the private law of a Member State that are entrusted with 
the  implementation  of  a  public-private  partnership  and  that  are  provided  with 
adequate financial guarantees 

–   bodies or persons entrusted with the implementation of specific actions in the 
common  foreign  and  security  policy  pursuant  to  Title  V  of  the  Treaty  on 
European Union, and identified in the relevant basic act 

–  bodies  established  in  a  Member  State,  governed  by  the  private  law  of  a 
Member  State  or  Union  law  and  eligible  to  be  entrusted,  in  accordance  with 
sector-specific  rules,  with  the  implementation  of  Union  funds  or  budgetary 
guarantees,  to  the extent that such bodies are controlled by public law bodies or 
by bodies governed by private law with a public service mission, and are provided 
with adequate financial guarantees in the form of joint and several liability by the 
controlling bodies or equivalent financial guarantees and which may be, for each 
support.
action, 

the  maximum 

amount  of 

the  Union 

limited 

to 

EN 

6 

  EN 

2. 

MANAGEMENT MEASURES  

2.1.  Monitoring and reporting rules  

The  Commission  will  evaluate  the  functioning  of  the  intervention  against  the  main 
policy  objectives.  Monitoring  and  evaluation  will  be  carried  out  in  alignment  with 
the other elements of VAT administrative cooperation. 

Member States / Eurofisc will submit data on an annual basis to the Commission on 
the  indicators  of  performance  outlined  in  the  section  1.3.4  that  will  be  used  to 
monitor compliance with the proposal.  

2.2.  Management and control system(s)  

2.2.1. 

Justification  of  the  budget  implementation  method(s),  the  funding  implementation 
mechanism(s), the payment modalities and the control strategy proposed 

Digital  systems  have  been  set  up  for  the  current  scope  of  the  Regulation.  The 
Commission will reuse the infrastructure, that allows exchanges to be made between 
Member States’ authorities.  

The  Commission  will  pre-finance  the  adaptations  of  the  systems  needed  to  allow 
exchanges  to  take  place.  The  pre-financing  of  these  adaptations  will  undergo  the 
main  elements  of  control  for  procurement  contracts,  technical  verification  of  the 
procurement,  ex-ante  verification  of  commitments,  and  ex-ante  verification  of 
payments. 

Pre-financing of the work will be done via the Fiscalis program and the costs will be 
charged back to OLAF and the EPPO via a Memorandum of Understanding (MoU) 
or Service Level Agreement (SLA) as appropriate. 

2.2.2. 

Information concerning the risks identified and the internal control system(s) set up 
to mitigate them 

The main elements of the control strategy are:  

Procurement contracts  

The  control  procedures  for  procurement  defined  in  the  Financial  Regulation:  any 
procurement  contract  is  established  following  the  defined  procedure  of  verification 
by  the  services  of  the  Commission  for  payment,  taking  into  account  contractual 
obligations  and  sound  financial  and  general  management.  Anti-fraud  measures 
(controls,  reports,  etc.)  are  foreseen  in  all  contracts  concluded  between  the 
Commission and the beneficiaries. Detailed terms of reference are drafted and form 
the  basis  of  each  specific  contract.  The  acceptance  process  follows  strictly  the 
TAXUD TEMPO methodology: deliverables are reviewed, amended if necessary and 
finally  explicitly  accepted  (or  rejected).  No  invoice  can  be  paid  without  an 
"acceptance letter".  

Technical verification of procurement  

DG  TAXUD  performs  controls  of  deliverables  and  supervises  operations  and 
services  carried  out  by  contractors.  It  also  conducts  quality  and  security  audits  of 
their  contractors  on  a  regular  basis.  Quality  audits  verify  the  compliance  of  the 
contractors' actual processes against the rules and procedures defined in their quality 
plans. Security audits focus on the specific processes, procedures and set-up.  

EN 

7 

  EN 

In  addition  to  the  above  controls,  DG  TAXUD  performs  the  traditional  financial 
controls:  

Ex-ante verification of commitments  

All  commitments  in  DG  TAXUD  are  verified  by  the  Head  of  the  Finances,  public 
procurement,  compliance  Unit.  Consequently,  100%  of  the  committed  amounts  are 
covered by the ex-ante verification. This procedure gives a high level of assurance as 
to the legality and regularity of transactions. Ex-ante verification of payments 100% 
of payments are verified ex-ante. Moreover, at least one payment (from all categories 
of  expenditures)  per  week  is  randomly  selected  for  additional  ex-ante  verification 
performed  by  the  head  of  the  Finances,  public  procurement  and  compliance  Unit. 
There is  no target  concerning the coverage,  as the purpose of this verification is  to 
check payments "randomly" in order to verify that all payments were prepared in line 
with the requirements. The remaining payments are processed according to the rules 
in force on a daily basis.  

Declarations of the Authorising Officers by Sub-Delegations (AOSD) 

 All the AOSD sign declarations supporting the Annual Activity Report for the year 
concerned.  These  declarations  cover  the  operations  under  the  programme.  The 
AOSD declare that the operations connected with the implementation of the budget 
have  been  executed  in  accordance  with  the  principles  of  the  sound  financial 
management, that the management and control systems in place provided satisfactory 
assurance concerning the legality and regularity of the transactions and that the risks 
associated  to  these  operations  have  been  properly  identified,  reported  and  that 
mitigating actions have been implemented. 

2.2.3.  Estimation  and  justification  of  the  cost-effectiveness  of  the  controls  (ratio  between 
the control costs  and the value of the related funds managed), and assessment of the 
expected levels of risk of error (at payment & at closure)  

The  established  controls  enable  DG  TAXUD  to  have  sufficient  assurance  of  the 
quality  and regularity  of the expenditure  and to  reduce the  risk of non-compliance. 
The  above  control  strategy  measures  reduce  the  potential  risks  below  the  target  of 
2%  and  reach  all  beneficiaries.  Any  additional  measures  for  further  risk  reduction 
would  result  in  disproportionately  high  costs  and  are  therefore  not  envisaged.  The 
overall costs linked to implementing the above control strategy – for all expenditures 
under Fiscalis 2027 programme – are limited to 1.6% of the total payments made. It 
is  expected  to  remain  at  the  same  ratio  for  this  initiative.  The  programme  control 
strategy limits the risk of non-compliance to virtually zero and remains proportionate 
to the risks entailed. 

2.3.  Measures to prevent fraud and irregularities  

The European Anti-Fraud Office (OLAF) may carry out investigations, including on 
the-spot  checks  and  inspections,  in  accordance  with  the  provisions  and  procedures 
laid  down  in  Regulation  (EC)  No  883/2013  of  the  European  Parliament  and  of  the 
Council  and  Council  Regulation  (Euratom,  EC)  No  2185/96.  These  investigations 
aim to determine whether fraud, corruption, or any other illegal activity affecting the 
financial interests of the Union has occurred in connection with any grant agreement, 
grant decision, or contract funded under this Regulation.  

EN 

8 

  EN 

 
 
3. 

ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 

The digital solution, consists in: 

• 

• 
• 

• 

establishing  the network connectivity between TAXUD and  the EPPO on the 
other side, as depicted on the above diagram; 
granting access to OLAF and EPPO users; 
Providing the EPPO and OLAF with a VIES and OSS / IOSS web interface to 
query these two systems; 
Provide the EPPO and OLAF access to Surv.3 data. 

The following assumptions / considerations have been made: 
• 

The assessment includes all types of costs from development to infrastructure 
to service delivery; 
User  to  System  access  to  the  different  types  of  data  sources  is  implemented 
implying moderate volume of data exchanges; 
All  cost  elements  are  split  by  50%  ratio  to  the  EPPO  and  OLAF  with  the 
exception  of  network  connectivity  which  is  2/3  for  the  EPPO  and  1/3  for 
OLAF due to the complexity of the EPPO connectivity (outside of Commission 
security perimeter). 

• 

• 

3.1. 

Heading(s)  of  the  multiannual  financial  framework  and  expenditure  budget 
line(s) affected  

•  Existing budget lines  

In order of multiannual financial framework headings and budget lines. 

Heading of 
multiannual 

Budget line 

Type of 
expenditure 

Contribution  

EN 

9 

  EN 

 
 
 
 
financial 
framework 

Number  

E.03040100  – EPPO  

E.03040100 -- OLAF 

Heading 
1 

Heading 
1 

Diff./Non-
diff.33 

from 
EFTA 
countries
34 

from 
candidate 
countries 
and 
potential 
candidates
35 

From 
other 
third 
countries 

other assigned 
revenue 

Diff. 

Diff. 

NO 

NO 

NO 

NO 

NO 

NO 

NO 

NO 

33 
34 
35 

Diff. = Differentiated appropriations / Non-diff. = Non-differentiated appropriations. 
EFTA: European Free Trade Association.  
Candidate countries and, where applicable, potential candidates from the Western Balkans. 

EN 

10 

  EN 

 
 
 
 
3.2. 

Estimated financial impact of the proposal on appropriations  

3.2.1. 

Summary of estimated impact on operational appropriations  

–    The proposal/initiative does not require the use of operational appropriations  

–   The proposal/initiative requires the use of operational appropriations, as explained below 

3.2.1.1.  Appropriations from voted budget 

Heading of multiannual financial framework  

Number 

EUR million (to three decimal places) 

DG: TAXUD 

Year 

Year 

2024 

2025 

Year  Year  TOTAL 
MFF 
2021-
2027 

2027 

2026 

Operational appropriations  

E.03040100  (Fiscalis) - EPPO 

E.03040100  (Fiscalis) - OLAF 

Commitments 

Payments 

Commitments 

Payments 

(1a) 

(2a) 

(1b) 

(2b) 

0.950 

0.475 

0.380 

0.950 

 0.475 

0.850  

0.425 

0.340 

   0.850  

0.425 

Appropriations of an administrative nature financed from the envelope of specific programmes 
Budget line 

(3) 

TOTAL appropriations 
for DG TAXUD 

Commitments 

=1a+1b+3 

Payments 

=2a+2b+3 

1.800 

0.900 

0.720 

0.000 

1.800 

0.900 

1.805 

1.425 

1.615 

1.275 

0.000 

3.420 

2.700 

TOTAL 
operational 
appropriations  

Commitments 

Payments 

(4) 

(5) 

Year 

2025 

Year 

2024 

0.000 

0.000 

Year 

2027 

TOTAL MFF 
2021-2027 

1.800 

0.900 

0.000 

1.800 

0.720 

0.900 

3.420 

2.700 

0.000 

0.000 

Year 

2026 

EN 

11 

EN 

 
 
 
 
  
  
  
  
 
  
  
  
  
  
  
  
 
TOTAL  appropriations  of  an 
administrative  nature  financed 
from  the  envelope  for  specific 
programmes  
TOTAL 
appropriations 
under 
HEADING 1 
of the 
multiannual 
financial 
framework 

Commitments 

Payments 

Payments 

Commitments 

• TOTAL operational 
appropriations 
(all 
operational headings) 
•  TOTAL  appropriations  of  an 
administrative  nature  financed from 
the 
specific 
programmes 
operational 
headings) 

envelope 

(all 

for 

(6) 

0.000 

0.000 

0.000 

0.000 

0.000 

=4+6 

0.000 

1.800 

0.900 

0.720 

3.420 

=5+6 

0.000 

0.000 

1.800 

0.900 

2.700 

Year 

2024 

Year 

2025 

Year 

2026 

Year 

2027 

TOTAL MFF 
2021-2027 

0.000 

1.800 

0.900 

0.000 

0.000 

1.800 

0.720 

0.900 

3.420 

2.700 

0.000 

0.000 

0.000 

0.000 

0.000 

(4) 

(5) 

(6) 

TOTAL 
appropriations 
Under          

Heading 1 to 6 
of the multiannual 
financial framework 
(Reference amount) 

Commitments 

=4+6 

0.000 

1.800 

0.900 

0.720 

3.420 

Payments 

=5+6 

0.000 

0.000 

1.800 

0.900 

2.700 

Heading of multiannual financial  framework  

7 

‘Administrative expenditure’  

DG: TAXUD 

Year 

2024 

Year 

2025 

Year 

2026 

Year 

2027 

TOTAL 
MFF 2021-
2027 

EN 

12 

EN 

 
 
 
 
 
 
 
 
 
 
 
 Human resources  
 Other administrative expenditure  
TOTAL DG TAXUD 

Appropriations  

0.000 

0.000 

0.000 

0.188 

0.000 

0.188 

0.094 

0.000 

0.094 

0.094 

0.000 

0.094 

0.376 

0.000 

0.376 

TOTAL appropriations under HEADING 7 of the multiannual financial 
framework  

(Total 
commitments 
= Total 
payments) 

0.000 

0.188 

0.094 

0.094 

0.376 

TOTAL appropriations under HEADINGS 1 to 7 

Commitments 

0.000 

1.988 

0.994 

0.814 

of the multiannual financial framework  

Payments 

0.000 

0.188 

1.894 

0.994 

3.796 

3.076 

EUR million (to three decimal places) 

Year 

2024 

Year 

2025 

Year 

2026 

Year 

2027 

TOTAL MFF 
2021-2027 

EN 

13 

EN 

 
 
 
 
 
 
 
 
 
 
 
  
 
3.2.3. 

Summary of estimated impact on administrative appropriations  

–    The  proposal/initiative  does  not  require  the  use  of  appropriations  of  an 

administrative nature  

–  The  proposal/initiative  requires  the  use  of  appropriations  of  an  administrative 

nature, as explained below 

3.2.3.1. Appropriations from voted budget 

VOTED APPROPRIATIONS 

Year 

2024 

Year 

2025 

Year 

2026 

Year 

2027 

TOTAL 
2021 - 2027 

HEADING 7 

Human resources  

Other administrative expenditure  

Subtotal HEADING 7 

Outside HEADING 7 

Human resources  

Other expenditure of an administrative nature 

Subtotal outside HEADING 7 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

0.188 

0.000 

0.188 

0.000 

0.000 

0.000 

0.094 

0.000 

0.094 

0.000 

0.000 

0.000 

0.094 

0.000 

0.094 

0.000 

0.000 

0.000 

0.376 

0.000 

0.376 

0.000 

0.000 

0.000 

TOTAL 

0.000 

0.188 

0.094 

0.094 

0.376 

VOTED APPROPRIATIONS                            

+                                                               

Year 

2024 

Year 

Year 

Year 

2025 

2026 

2027 

TOTAL 
2021 - 
2027 

3.2.3.3.  Total appropriations 

TOTAL 

EXTERNAL ASSIGNED REVENUES 

HEADING 7 

Human resources  

Other administrative expenditure  

Subtotal HEADING 7 

Outside HEADING 7 

Human resources  

Other expenditure of an administrative nature 

Subtotal outside HEADING 7 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

0.188 

0.000 

0.188 

0.000 

0.000 

0.000 

0.094 

0.000 

0.094 

0.000 

0.000 

0.000 

0.094 

0.000 

0.094 

0.000 

0.000 

0.000 

0.376 

0.000 

0.376 

0.000 

0.000 

0.000 

TOTAL 

0.000 

0.188 

0.094 

0.094 

0.376 

The  appropriations  required  for  human  resources  and  other  expenditure  of  an  administrative  nature 
will  be  met  by  appropriations  from  the  DG  that  are  already  assigned  to  management  of  the  action 
and/or  have  been  redeployed  within  the  DG,  together,  if  necessary,  with  any  additional  allocation 
which may be granted to the managing DG under the annual allocation procedure and in the light of 
budgetary constraints. 

3.2.4.  Estimated requirements of human resources  

–    The proposal/initiative does not require the use of human resources  

–    The  proposal/initiative  requires  the  use  of  human  resources,  as  explained 

below 

EN 

14 

  EN 

 
  
  
3.2.4.1.  Financed from voted budget 

Estimate to be expressed in full-time equivalent units (FTEs) 

VOTED APPROPRIATIONS 

Year 

2024 

Year 

2025 

Year 

2026 

Year 

2027 

 Establishment plan posts (officials and temporary staff) 

20 01 02 01 (Headquarters and Commission’s Representation Offices) 

20 01 02 03 (EU Delegations) 

01 01 01 01 (Indirect research) 

01 01 01 11 (Direct research) 

Other budget lines (specify) 

• External staff (in FTEs) 

20 02 01 (AC, END from the ‘global envelope’) 

20 02 03 (AC, AL, END and JPD in the EU Delegations) 

Admin. Support 
line 
[XX.01.YY.YY] 

- at Headquarters 

- in EU Delegations  

01 01 01 02 (AC, END - Indirect research) 

 01 01 01 12 (AC, END - Direct research) 

Other budget lines (specify) - Heading 7 

Other budget lines (specify) - Outside Heading 7 

TOTAL 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0.5 

0.5 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0.5 

0.5 

Considering  the  overall  strained  situation  in  Heading  7,  in  terms  of  both  staffing  and  the  level  of 
appropriations,  the  human  resources  required  will  be  met  by  staff  from  the  DG  who  are  already 
assigned  to  the  management  of  the  action  and/or  have  been  redeployed  within  the  DG  or  other 
Commission services. 

The staff required to implement the proposal (in FTEs):  

To be covered by 
current staff 
available in the 
Commission 
services  

Exceptional additional staff* 

Establishment 
plan posts 

External 
staff 
(CA, SNEs, INT) 

1 

0 

To be financed 
under Heading 7 
or Research 

To be financed 
from BA line 

To be financed 
from fees 

0 

0 

N/A 

0 

0 

0 

Description of tasks to be carried out by: 

Officials and temporary staff 

The person will have the role of project manager. The person will be 
responsible for scoping, planning, and overall coordination with the various 

EN 

15 

  EN 

 
 
 
 
 
stakeholders, as well as assessing risks and identifying mitigation measures. 
The person will hold overall responsibility for the execution of the project. 

External staff 

NA 

3.2.5.  Overview of estimated impact on digital technology-related investments 

Compulsory: the best estimate of the digital technology-related investments entailed 
by the proposal/initiative should be included in the table below.  

Exceptionally,  when  required  for  the  implementation  of  the  proposal/initiative,  the 
appropriations under Heading 7 should be presented in the designated line.  

The  appropriations  under  Headings  1-6  should  be  reflected  as  “Policy  IT 
expenditure on operational programmes”. This expenditure refers to the operational 
budget to be used to re-use/ buy/ develop  IT platforms/ tools directly linked to the 
implementation  of  the  initiative  and  their  associated  investments  (e.g.  licences, 
studies, data storage etc). The information provided in this table should be consistent 
with details presented under Section 4 “Digital dimensions”. 

TOTAL Digital and IT 
appropriations36 

Year 

Year 

Year 

Year 

HEADING 7 

IT expenditure (corporate)  

Subtotal HEADING 7 

Outside HEADING 7 

Policy IT expenditure on operational 
programmes 

2024 

2025 

2026 

2027 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

1.800 

0.900 

0.720 

Subtotal outside HEADING 7 

0.000 

1.800 

0.900 

0.720 

TOTAL 
MFF 
2021 - 
2027 

0.000 

0.000 

3.420 

3.420 

TOTAL 

0.000 

1.800 

0.900 

0.720 

3.420 

3.2.6.  Compatibility with the current multiannual financial framework  

The proposal/initiative: 

–  can be fully financed through redeployment within the relevant heading of the 

multiannual financial framework (MFF) 

The costs associated to this will be covered by Fiscalis program and charged back to 
EPPO  and  OLAF  on  the  basis  of  a  MoU  or  Service  Level  Agreement  (SLA)  as 
appropriate. 

–    requires use of the unallocated margin under the relevant heading of the MFF 

and/or use of the special instruments as defined in the MFF Regulation 

–    requires a revision of the MFF 

36 

IT  development  and  procurement  strategy  choices  will  be  subject  to  pre-approval  by  the  European 
Commission Information Technology and Cybersecurity Board. 

EN 

16 

  EN 

 
 
 
  
 
NA 

3.2.7.  Third-party contributions  

The proposal/initiative: 

–  does not provide for co-financing by third parties 

–    provides for the co-financing by third parties estimated below: 

Appropriations in EUR million (to three decimal places) 

Year  
2024 

Year  
2025 

Year  
2026 

Year  
2027 

Total 

Specify the co-financing body  

TOTAL appropriations co-
financed  

3.3. 

Estimated impact on revenue  

–  The proposal/initiative has no financial impact on revenue. 

–    The proposal/initiative has the following financial impact: 

– 

– 

– 

Budget revenue line: 

Article …………. 

 

 

on own resources  

on other revenue 

  please indicate, if the revenue is assigned to expenditure lines 

Appropriations 
available for the 
current financial 
year 

     EUR million (to three decimal places) 

Impact of the proposal/initiative37 

Year 2024 

Year 2025  Year 2026 

Year 2027 

For assigned revenue, specify the budget expenditure line(s) affected. 

NA 

Other  remarks  (e.g.  method/formula  used  for  calculating  the  impact  on  revenue  or 
any other information). 

NA 

4. 

DIGITAL DIMENSIONS 

The  effectiveness  of  this  initiative  relies  on  a  strong  digital  foundation,  enabling  timely, 
secure,  and  structured  access  to  VAT-related  data  across  the  EU.  Key  digital  enablers 
include: 

37 

As regards traditional own resources (customs duties, sugar levies), the amounts indicated must be net 
amounts, i.e. gross amounts after deduction of 20% for collection costs. 

EN 

17 

  EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
•  Use of existing EU infrastructures 

Data exchange should be built on established secure channels such as the Common 
Communication Network (CCN), ensuring reliability and confidentiality. 

• 

Interoperable and structured access 

OLAF and EPPO should benefit from a harmonised, role-based digital access point 
covering  VIES,  IOSS,  CESOP,  CP42  surveillance  reports,  and  TNA,  in  line  with 
EU interoperability standards. 

4.1. 

Requirements of digital relevance 

To  strengthen  the  EU's  capacity  to  combat  fraud  effectively,  it  is  essential  to  ensure  that 
both the European Public Prosecutor's Office (EPPO) and the European Anti-Fraud Office 
(OLAF)  have  timely  and  secure  access  to  key  datasets  related  to  VAT  operations  and 
compliance. The following access requirements should be implemented: 

•  VIES  (VAT  Information  Exchange  System),  Enable  the  EPPO  and  OLAF  to 

• 

• 

retrieve intra-EU VAT registration and transaction information  
IOSS  (Import  One  Stop  Shop  Data),  grant  visibility  into  IOSS  trader  registration 
details  
 Surveillance  Reports  on  IOSS  and  Customs  Procedure  42  (CP42),  provide 
analytical and transactional reports on the use of IOSS and CP42  

•  CESOP  (Central  Electronic  System  of  Payment  Information),  facilitate  access  to 

cross-border payment data 

•  TNA  (Transaction  Network  Analysis)  Data,  allow  Eurofisc  to  share  specific 

information stored in the TNA system with direct consultation  

These data access measures should be governed by strict confidentiality protocols, limited 
to cases of legitimate investigative interest, and integrated into existing EU-level antifraud 
frameworks. 

EN 

18 

  EN 

 
 
 
Reference to 
the 
requirement 

Article 36 

Requirement description 

working 

field 
Eurofisc 
coordinators 
shall 
communicate any information 
on cross-border VAT fraud to 
the EPPO and OLAF 

Actor affected 
or concerned 
by the 
requirement 

High-level 
Processes 

Category 

EPPO,  OLAF, 
Eurofisc 

Report 

Data 

information 

Member States shall grant the 
EPPO  and  OLAF  access  to 
points 
the 
(a)-(c)  of 
referred 
(intra-
Article 
- 
Community 
VIES)  

in 
17(1) 

transactions 

to 

Member States shall grant the 
EPPO  and  OLAF  access  the 
information points referred to 
in  (e),  (f)  of  Article  17(1), 
(customs information relevant 
for  VAT  controls  at  import, 
VAT  exempt  imports,  IOSS 
imports) 

information 

Member States shall grant the 
EPPO    and  OLAF  access  to 
the 
points 
referred  to  in  Article  24b(3) 
(payment 
– 
CESOP) 

information 

EPPO,  OLAF 
Member  States, 
Eurofisc 

Access 
registry; 

Monitor; 

Digital 
Solution(s); 

EPPO,  OLAF, 
Member  States, 
Eurofisc 

Access 
registry; 

Monitor; 

Digital 
Solution(s); 

EPPO,  OLAF, 
Member  States, 
Eurofisc 

Access 
registry; 

Monitor; 

Digital 
Solution(s); 

Article 
49b 

49a, 

Article 
49b 

49a, 

Article 
49b 

49a, 

4.2. 

Data 

EPPO and OLAF should be granted controlled, centralised access to specific datasets from: 

•  VIES (VAT Information Exchange System) 

• 

Provides information on the validity of VAT numbers and intra-EU transactions. 
IOSS (Import One Stop Shop) 
Contains details on IOSS-registered traders and import declarations 

•  Surveillance Reports on IOSS and CP42 

These contain information on importations under IOSS and CP42 (import with VAT 
exemption followed by intra-EU supply).  

EN 

19 

  EN 

 
 
 
 
 
 
 
•  CESOP (Central Electronic System of Payment Information) 

Aggregates payment data from payment service providers (PSPs) on cross-border 
transactions. 

•  TNA (Transaction Network Analysis) 

Contains Eurofisc information on VAT fraud  

Data Flow and Access Mechanism 

•  Data is primarily collected at national level by tax and customs authorities and 

transmitted to EU-level platforms (e.g. CESOP, VIES, TNA). 

•  OLAF and EPPO would access this data through secure, role-based interfaces, 

without altering the existing reporting flows. 

•  Access is limited and subject to strict confidentiality and audit protocols. 

Type of data 

Reference(s) to 
the 
requirement 

Standard and/or specification (if 
applicable) 

any information on VAT fraud  

Article 36 

When relevant, according to the 
commonly agreed formats used in 
Eurofisc exchanged over existing 
secure communication channels. 

information points referred to in (a)-
(c) of Article 17(1) (intra-
Community transactions - VIES)  

Article 49a(1), 
Article 49b(1) 

In accordance with the common 
standardised format set out in VIES 
functional specifications 

information points referred to in (e), 
(f) of Article 17(1), (customs 
information relevant for VAT 
controls at import, VAT exempt 
imports, IOSS imports) 

Article 49a(1), 
Article 49b(1) 

In accordance with the common 
standardised format set out in 
Commission Implementing 
Regulation (EU) No 79/201238 

information points referred to in 
Article 24b(3) (payment 
information – CESOP) 

Article 49a(1), 
Article 49b(1) 

In accordance with the common 
standardised format set out in 
Commission Implementing 
Regulation (EU) 2022/150439 

Data flows 

Type of data 

Reference(s) to  Actor 

Actor 

Trigger for 

Frequency 

38 

39 

Commission  Implementing  Regulation  (EU)  No  79/2012  of  31  January  2012  laying  down  detailed 
rules  for  implementing  certain  provisions  of  Council  Regulation  (EU)  No  904/2010  concerning 
administrative cooperation and combating fraud in the field of value added tax (OJ L 29, 1.2.2012, p. 
13–32) 
Commission Implementing Regulation (EU) 2022/1504 of 6 April 2022 laying down detailed rules for 
the application of Council Regulation (EU) No 904/2010 as regards the creation of a central electronic 
system of payment information (CESOP) to combat VAT fraud (OJ L 235, 12.9.2022, p. 19–27) 

EN 

20 

  EN 

 
 
 
the 
requirement(s) 

who 
provides 
the data 

who 
receives 
the data 

the data 
exchange 

(if 
applicable) 

Article 36 

Eurofisc 

EPPO, 
OLAF 

N/A 

Spontaneous 
or upon 
request 

Member 
States 

EPPO, 
OLAF 

Spontaneous  N/A 

Article 49a, 49b 

Member 
States 

EPPO, 
OLAF 

Spontaneous  N/A 

Article 49a, 49b 

Member 
States 

EPPO, 
OLAF 

Spontaneous  N/A 

Article 49a, 49b 

any information on 
cross-border VAT 
fraud 

information points 
referred to in (a)-
(c) of Article 17(1) 
(intra-Community 
transactions - 
VIES)  

information points 
referred to in (e), 
(f) of Article 17(1), 
(customs 
information 
relevant for VAT 
controls at import, 
VAT exempt 
imports, IOSS 
imports) 

information points 
referred to in 
Article 24b(3) 
(payment 
information – 
CESOP) 

4.3. 

Digital solutions 

The  digital  solution  consists  in  extending  access  to  existing  VAT-related  EU  systems  for 
OLAF and the EPPO, without creating new ones. It includes three core components: 

•  Ensuring  secure  network  connectivity  between  OLAF/EPPO  and  the  relevant  EU-

level systems (VIES, IOSS, CESOP, TNA, CP42 surveillance reports); 

•  Adapting  existing  software  modules,  notably  for  access  rights  management,  user 

provisioning, and audit logging; 

•  Developing dedicated reports and views in CESOP and TNA, tailored to OLAF and 

EPPO, while respecting data protection and access limitation principles. 

This  targeted  solution  builds  on  the  current  infrastructure  and  governance  model, 
minimising complexity while ensuring operational effectiveness. 

Digital solution 

Reference(s) 

Main 

Responsib

How is 

How is 

Use of AI 

EN 

21 

  EN 

 
 
to the 
requirement
(s) 

mandated 
functionaliti
es 

le body 

accessibility 
catered for? 

reusability 
considere
d? 

technologi
es (if 
applicable) 

Eurofisc 

Reuse of 
Eurofisc 
practices 

NO 

Existing 
tools will 
be reused 

Information 
exchange 
(spontaneou
s or upon 
request) 

Information 
access 

Existing IT 
tools used by 
Eurofisc 

Article 36 

VIES 

SURVEILLAN
CE  

CESOP 

Article 
49a(1) 

Article 
49b(1) 

Article 
49a(1) 

Article 
49b(1) 

Article 
49a(1) 

Article 
49b(1) 

Member 
States / 
Commissi
on 

The 
Commission ado
pts an 
implementing act 

Existing 
tools will 
be reused 

Information 
access 

Member 
States / 
Commissi
on 

The 
Commission ado
pts an 
implementing act 

Existing 
tools will 
be reused 

Information 
access 

Member 
States / 
Commissi
on 

The 
Commission ado
pts an 
implementing act 

Existing 
tools will 
be reused 

NO 

NO 

NO 

Digital and/or sectorial 
policy (when these are 
applicable) 

Explanation on how it aligns 

AI Act 

Not applicable 

EU Cybersecurity 
framework 

Without  prejudice  to  Regulation  (EU)  2016/679  and  Regulation 
(EU)  2018/1725,  Member  States,  OLAF  and  the  EPPO  shall 
ensure  the  security,  integrity,  authenticity  and  confidentiality  of 
the data exchanged.  

Security aspects to be further detailed in the implementing acts 
and specifications. 

eIDAS 

Single Digital Gateway 
and IMI 

Not applicable 

Not applicable 

Others 

// 

EN 

22 

  EN 

 
 
 
 
 
4.4. 

Interoperability assessment 

While interoperability is a key principle in EU digital policy, its application in this project 
is  limited.  The  initiative  does  not  involve  building  new  systems  or  developing  new  data 
exchange formats. Instead, it consists in granting access to existing datasets (VIES, IOSS, 
CESOP,  CP42,  TNA)  to  additional  entities—namely  OLAF  and  the  EPPO—within  the 
current technical frameworks. As such, no interoperability gaps are expected, provided that 
these entities are integrated into the existing access management and security protocols of 
the  respective  platforms.  The  focus  should  therefore  be  on  secure  access  provisioning, 
inter-system  communication  or  data 
logging,  and  authorisation,  rather 
standardisation.  

than  on 

4.5.  Measures to support digital implementation 

While  the  project  does  not  require  the  creation  of  new  IT  systems,  certain  technical  and 
operational measures are necessary to enable secure and effective access for OLAF and the 
EPPO. These include ensuring network connectivity to the relevant EU platforms, adapting 
existing  software  components  (e.g.  access  control  modules  or  user  interfaces),  and 
onboarding  authorised  users.  In  addition,  support  and  training  may  be  required  to  ensure 
appropriate use of the tools. These measures should remain limited in scope and leverage 
the existing infrastructure and security frameworks already in place. 

Description of the 
measure 

Reference(s) to 
the 
requirement(s) 

Commission role  

(if applicable) 

Articles  49a, 
49b 

The Commission 
shall adopt such acts 

The Commission shall 
adopt implementing 
acts establishing 
technical details and the 
practical arrangements 
to identify persons with 
access to the 
information 

Actors to be 
involved 

Expected 
timeline 

(if 
applicable) 

(if 
applicable) 

// 

Member 
States; 
EPPO, 
OLAF 

Committee procedure 

Article 58 

SCAC 
committee 

// 

The Commission 
shall be assisted by a 
committee. That 
committee shall be a 
committee within the 
meaning of 
Regulation (EU) No 
182/2011. 

EN 

23 

  EN