ACTIVITY REPORT OF THE CONTROLLER OF PROCEDURAL GUARANTEES 2025
Date: 2026-08-07
Institutions: European Commission, Office for the Administration and Payment of Individual Entitlements
Subjects: EU control, European Anti-fraud Office, activity report, data protection, fundamental rights, institutional cooperation, operation of the Institutions, personal data, right to justice, rights of the defence




C_202604270EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2026/4270


7.8.2026






ACTIVITY REPORT OF THE CONTROLLER OF PROCEDURAL GUARANTEES 2025
(C/2026/4270)


Foreword

This is the fourth annual report on my activities as the Controller of procedural guarantees. The OLAF Regulation entrusts me with handling complaints by persons concerned. The complaints concern OLAF’s compliance with procedural guarantees and alleged infringements of the rules applicable to OLAF investigations. This includes potential breaches of procedural requirements and fundamental rights.
Before the function of Controller was created, people being investigated by OLAF could not complain about OLAF’s handling of the investigation to an independent body or authority. Their only option was to file a complaint to the European Ombudsman for maladministration or try to trigger the Commission’s non-contractual liability under very strict conditions.
To remedy this shortcoming, amendments to the OLAF Regulation in 2020 created a proper complaints mechanism, enabling every person concerned to lodge a complaint with the Controller.
Through this independent administrative remedy, the Controller is gradually but steadily adjusting the principles of effective judicial protection and aligning them with the principles of effective administrative protection. The Controller always takes into account the fundamental rights stemming from the Charter of Fundamental Rights of the EU, the specific procedural guarantees that govern OLAF’s activities and the general legal principles and case law of the EU Courts applicable to OLAF investigations.
For the Controller, it is important for the complaints mechanism not only to be an effective remedy for persons concerned, but also to increase the overall transparency of OLAF’s activities. Having an efficient and effective anti-fraud body capable of safeguarding the EU’s financial interests is a ‘must-have’ for the EU and for taxpayers. However, it is equally important for OLAF investigations into possible fraud to be conducted in full compliance with fundamental rights and procedural guarantees.
Nevertheless, to better understand the role of the Controller and its limitations, it is important to bear in mind that the Controller does not act as a judge who assesses the legality of OLAF’s decisions and acts. Rather, the Controller’s mission is to find and propose solutions to the issues raised by complainants. By proposing solutions and, ultimately, recommendations to the Director-General of OLAF, the Controller also seeks to solve the issues at stake and, looking ahead, improve OLAF’s administrative and investigative practices.
This report follows the structure of the Controller’s previous annual activity reports. It opens with an overview of the Controller’s mission and mandate and the functioning of the complaints mechanism. It then presents the main statistics and figures on the complaints handled in 2025. The report further examines the procedural aspects of handling complaints, highlighting the proposal for solution issued by the Controller during the year that was subsequently fully implemented by OLAF. It also sets out the Controller’s main findings on key substantive issues, notably the rights of defence of persons concerned, the application of the principle of proportionality in inspections and digital forensic operations, and the languages that can be used in OLAF investigations.
In addition, the report includes specific sections on the most important developments that took place during the year, including: (i) the adoption of the Working Arrangements between the Controller and OLAF; (ii) consultation of the Controller on the evaluation of the application and impact of the OLAF Regulation; and (iii) OLAF’s implementation of all of the Controller’s recommendations on the Guidelines on Investigation Procedures for OLAF Staff (‘GIPs’). The report concludes with remarks on the Controller’s engagement with stakeholders during the year and acknowledges the administrative and legal support provided by the Secretariat, for which the Controller is sincerely grateful.
The complaints mechanism has become an essential safeguard for persons concerned, ensuring that OLAF’s activities comply with the relevant procedural guarantees and rules on investigations. Beyond resolving individual complaints, the decisions handed down by the Controller have helped shape OLAF’s investigative practice by clarifying the scope and practical application of those procedural guarantees. In several instances, the legal reasoning developed in complaints decisions has informed revisions to OLAF’s GIPs, thereby extending the impact of individual cases beyond their immediate factual context
I hope that this report will help raise awareness of the kind of issues that are at the heart of the complaints made by persons concerned, while at the same time increasing OLAF’s accountability and people’s trust in the system that the EU has put in place to tackle fraud.



Prof Dr Julia LAFFRANQUE
               

Controller of procedural guarantees





Contents







Foreword

1











1.



The Controller’s mission and mandate

4











2.



The complaints mechanism

5











3.



Overview of the complaints submitted in 2025

5











4.



Procedural aspects: The steps of effective complaint handling

8










4.1

Admissibility
9










4.1.1

The one-month limitation period for lodging a complaint
10










4.1.2

Complaints falling outside the Controller’s mandate
11










4.1.3

Cases pending in legal proceedings
11










4.1.4

Discontinuation of correspondence on repetitive complaints
12










4.2

Adversarial procedure
12










4.3

Invitation to resolve the complaint
13










4.4

Closing decisions
13











5.



Substantive aspects: Overview of the Controller’s main findings

14










5.1.

Right of defence
14










5.1.1.

The right to be informed
14










5.1.2.

Right to be assisted by a person of choice
15










5.1.3.

Opportunity to comment on the facts established by OLAF
16










5.1.4.

Access to the file and to documents referred to in the statement of facts
18










5.2.

Proportionality of inspections of premises and digital forensic operations
19










5.3.

Languages used
21











6.



Adoption of Working Arrangements between the Controller and OLAF

21











7.



Consultation on the evaluation of the OLAF Regulation

22











8.



Follow-up on the adoption of the new GIPs

24











9.



Relations with stakeholders

27











10.



Administrative and legal support

27











11.



Contacting the Controller and submitting a complaint

28











Annex.



References

29








Legal framework
29








Annual activity reports and opinions
29



1.   The Controller’s mission and mandate

The Controller of procedural guarantees is a function created by Regulation 2020/2023 (EU, Euratom) 2020/20223 of the European Parliament and of the Council (1) amending Regulation (EU, Euratom) 883/2013 of the European Parliament and of the Council (2) (the ‘OLAF Regulation’) to protect the procedural guarantees and fundamental rights of the persons concerned (3) in investigations carried out by the European Anti-Fraud Office (‘OLAF’). Dr Julia Laffranque was appointed on 3 May 2022
             (4) as the first Controller, for a non-renewable term of five years. She is assisted by the Secretariat of the Supervisory Committee (the ‘Secretariat’).
In accordance with Article 9a(8) of the OLAF Regulation, the Controller:

‘
shall monitor the Office’s compliance with procedural guarantees referred to in Article 9, as well as the rules applicable to investigations by the Office. The Controller shall be responsible for handling complaints referred to in Article 9b
.’

The Controller carries out her tasks in complete independence and does not take instructions from anyone in the performance of her duties (5). Given that persons concerned cannot, in principle, seek judicial recourse against OLAF’s acts or omissions during an investigation, the possibility of filing a complaint with the Controller is of great importance. A complainant can turn to the Controller, within the strict deadlines set out in Article 9b of the OLAF Regulation, to seek an independent and thorough assessment of their complaint.
In handling complaints submitted by persons concerned regarding OLAF’s compliance with procedural guarantees and the rules applicable to investigations, the Controller does not seek to replace OLAF in deciding how to conduct an investigation or assess evidence, or what conclusions to reach. Instead, her role is to provide reassurance that OLAF has acted in conformity with the rules set out in its legal framework (if she finds that no breach has occurred) and to invite OLAF to take action to resolve a complaint through a proposal for a solution whenever she finds a breach of the procedural guarantees or the rules applicable to investigations. If the Controller does not find the action taken by OLAF to be satisfactory, as a second step she makes a recommendation to OLAF on how to resolve the complaint.
The Controller assesses complaints in an adversarial procedure and pays particular attention to the Charter of Fundamental Rights of the European Union (the ‘Charter’) (6), the general principles of EU law and the relevant case law of the EU Courts (7). However, she does not and cannot interfere with the conduct of an OLAF investigation (8).
2025 was both a challenging and a productive year given the complexity of the legal issues raised in the complaints received. The Controller cannot refer to individual cases investigated by OLAF and must ensure they remain confidential even after they are closed (9). This report nonetheless provides an overview of the types of concerns raised by persons concerned. It further outlines how those concerns were addressed and explains how the complaints mechanism works and what results were achieved by implementing it.
2.   The complaints mechanism

Since starting work in October 2022, the Controller has had the opportunity to address a number of noteworthy legal questions, gradually developing a solid conceptual framework for assessing complaints. During 2025, complaints were processed promptly and examined in a thorough and comprehensive manner.
To better understand how the complaints mechanism functions, it is important to bear in mind that it gives the Controller special, direct access to the OLAF case file of the relevant investigation. This is thanks to the Controller’s implementing provisions for the handling of complaints (the ‘Implementing Provisions’) (10) and the newly signed working arrangements between OLAF and the Controller (the ‘Working Arrangements’) (11). This form of access to the OLAF case file is of paramount importance for reassuring complainants that the Controller is able to look thoroughly into OLAF’s investigative activities, even in cases where some of the relevant information may be confidential and cannot be disclosed to the complainant. In that regard, the Controller often strikes a delicate balance between the confidentiality of the OLAF investigation, on the one hand, and the adversarial character of the complaints mechanism, on the other.
In 2025 the Controller completed the assessment of one complaint submitted in 2024. 19 new complaints were submitted in 2025 by natural and legal persons. During the reporting year, the Controller completed her assessment of 17 of them. One complaint was declared admissible during the third quarter of the year but required longer processing time on account of the adversarial procedure and requests for extensions of procedural deadlines submitted by both OLAF and the complainant. Another complaint was submitted shortly before the end of the year and was declared admissible. A decision was taken on both complaints in the first half of 2026.
3.   Overview of the complaints submitted in 2025

Most of the 19 complaints received by the Controller in 2025 were submitted by persons concerned in OLAF internal investigations (12) (12), whereas 6 related to external investigations (13) and one concerned a coordination case (14) (Figure 1). Most of the complaints were submitted in English, with other languages (Spanish, Romanian and Swedish) also used (Figure 2). 16 complaints were submitted by natural persons and 3 by legal persons (Figure 3). During the reporting year, some complainants submitted more than one complaint: the total number of persons complaining in 2025 was therefore 8, of which 5 were natural persons and 3 were legal entities (Figure 3). 4 of the complaints received were submitted with the representation of a lawyer.

Figure 1


Types of OLAF investigations complained about in 2025







Figure 2


Languages of the complaints submitted in 2025







Figure 3


Persons complaining and number of complaints






In most cases, the complainants invoked breaches of the procedural guarantees under Article 9 of the OLAF Regulation and their fundamental rights under the Charter (Figure 4). These complaints concerned alleged breaches of: (i) the presumption of innocence and the right of defence (Article 48 of the Charter); (ii) the right to be heard and the effective exercise of the right of persons concerned to comment on facts concerning them (Article 9(4) of the OLAF Regulation); (iii) the right to be informed (Article 9(3) of the OLAF Regulation); (iv) the principles of fairness, objectivity and impartiality in the conduct of investigations (Article 9(1) of the OLAF Regulation); (v) the right to good administration (Article 41 of the Charter); (vi) the right to private and family life (Article 7 of the Charter); (vii) protection of personal data; and (viii) the right to be assisted by a person of choice (Article 9(2) of the OLAF Regulation) (Figure 5). Complainants also complained about the rules applicable to OLAF investigations (15), in particular concerning: (i) the conduct of digital forensics operations; (ii) rules on identification and notification of persons concerned; (iii) the respect of legal professional privilege; (iv) the scope of OLAF investigations; (v) the use of the OLAF case management system; (vi) unlawful surveillance; (vii) actions of OLAF staff exceeding their powers; and (viii) the confidentiality of OLAF investigations (Figure 6).

Figure 4


Subject matter of the complaints submitted in 2025







Figure 5


Analysis of the different allegations regarding procedural guarantees raised in 2025 (including admissible and inadmissible complaints)







Figure 6


Analysis of allegations regarding the rules applicable to investigations






4.   Procedural aspects: The steps of effective complaint handling

The Controller deals with complaints in a fair, independent and impartial manner. In line with the OLAF Regulation and the Controller’s Implementing Provisions, the procedure involves the following stages: (i) assessment of the admissibility of a complaint; (ii) assessment of the substantive arguments raised by the complainants. Where the Controller finds breaches, depending on the issues at stake, she may invite OLAF to resolve the complaint (proposal for a solution) and, if necessary, issue a recommendation to OLAF; and (iii) in any case, the Controller issues a closing decision informing the complainant of her findings.
4.1   Admissibility

Within 10 working days of receiving a complaint, the Controller must decide on its admissibility. The conditions for admissibility are set out in Article 9b(1) and (2) of the OLAF Regulation and Article 5 of the Implementing Provisions. For a complaint to be admissible, it should be lodged within one month of the complainant becoming aware of the relevant facts that constitute an alleged infringement of the procedural guarantees or the rules on investigations. In any event, it must be lodged no more than one month after the closure of the investigation.

When examining the admissibility of complaints, the Controller follows an approach that seeks to respect both the wording and the aims of the relevant provisions of the OLAF Regulation. In 2025, the Controller assessed the admissibility of all complaints within the prescribed time limit. She declared 3 complaints admissible, 4 partially admissible and 12 inadmissible (Figure 7).
The reasons for inadmissibility were the following: (i) in 10 instances the complaints made allegations falling outside the Controller’s mandate; (ii) in 10 cases the Controller found the allegations manifestly without merit, either because they were unsubstantiated (16) or unfounded (17); (iii) in 10 cases the complaints made repetitive allegations (see subsection 4.1.4 of the Activity Report); (iv) in 9 cases the complainants failed to respect the time limits set in Article 9b(2); and (v) in 1 case the complaint was submitted by someone who was not a person concerned (Figure 8).

Figure 7


Admissibility of complaints received in 2025







Figure 8


Grounds for inadmissibility of complaints received in 2025 (including partially admissible complaints)






4.1.1   The one-month limitation period for lodging a complaint

Also in 2025, admissibility remained an important ‘gatekeeper’ in the Controller’s complaints mechanism. In all instances where complaints or allegations were found to be inadmissible, the Controller explained in detail to the complainant the legal basis and the reasons for her decision. As pointed out above, Article 9b(2) of the OLAF Regulation establishes a dual limitation period for lodging complaints with the Controller. Under that provision, complaints must be submitted either: (i) within one month of the complainant becoming aware of the facts constituting the alleged infringement; or (ii) within one month of the closure of the investigation, if the investigation has been closed. For closed investigations, the OLAF Regulation sets out an additional, stricter admissibility condition: the complaint must be submitted no more than one month after the closure of the investigation, regardless of when the complainant becomes aware of the relevant facts (Article 9b(2) of the OLAF Regulation).
The Controller acknowledges that this undoubtedly restrictive condition applicable to closed investigations is designed to preserve the effectiveness both of any follow-up procedure at national or EU level and of her own proposals for solutions and recommendations in the specific case. Indeed, the Controller’s input would be of little use in closed cases, where there may be ongoing follow-up procedures before the relevant national or EU authorities. In such rare cases, the Controller considers that persons concerned can only pursue their grievances before those authorities by making use of the available judicial or administrative remedies.
Despite its functional justification, in certain cases the absolute one-month limitation period applicable to closed investigations may give rise to concerns about legal certainty and fairness (18). This is particularly problematic given that the OLAF Regulation does not currently require OLAF to inform persons concerned of the exact date on which an investigation involving findings against them is closed. As a result, the one-month limitation period may begin to run without the knowledge of the person concerned, which in practice could deprive them of effective access to the complaints mechanism.
In one of the complaints submitted in 2025, the Controller was faced with exactly this situation and had to strike a balance between strict application of the admissibility requirements laid down in Article 9b(2) of the OLAF Regulation (which would have resulted in the complaint being declared inadmissible as it was time-barred) and the overarching principles of fairness and good administration enshrined in Article 41 of the Charter.
In that case, OLAF had informed the complainant of the possibility of lodging a complaint with the Controller only after the one-month period for doing so had already elapsed. The Controller therefore considered that, given the exceptional circumstances of the case, automatic application of Article 9b(2), last indent, of the OLAF Regulation would undermine the principles of fairness and good administration, as guaranteed by Article 41 of the Charter. The Controller concluded that, when OLAF informed the complainant of the possibility of lodging a complaint with the Controller, it intended that notification to serve as the start of the limitation period. This was the only interpretation that would not render ineffective Article 9b(2) of the OLAF Regulation, while ensuring that in practice the complainant was not denied access to the complaints mechanism. The complaint was consequently deemed admissible.
In view of this, the Controller has identified the strict time limit for submitting complaints, especially but not exclusively in the case of closed investigations, as an issue that deserves careful consideration in the context of the evaluation and subsequent revision of the OLAF Regulation
                   (19).
4.1.2   Complaints falling outside the Controller’s mandate

OLAF’s daily work involves the processing of large amounts of personal data, including sensitive data. OLAF may also conduct investigative activities, such as digital forensic operations, that could be perceived as intrusive from a personal data protection perspective. It is therefore not surprising that during 2025 numerous complainants made allegations pertaining to their right to protection of their personal data, as guaranteed by Article 8 of the Charter and Regulation (EU) 2018/1725 (the ‘EU Data Protection Regulation’) (20).
As the Controller has previously pointed out (21), although her mandate includes checking OLAF’s compliance with fundamental rights, the EU has an independent supervisory authority – the European Data Protection Supervisor (‘EDPS’) – which has a number of responsibilities concerning the rights to privacy and data protection. Article 52 of the EU Data Protection Regulation provides that the EDPS is responsible for monitoring and ensuring the application of the Regulation and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by an EU institution or body. Since the EU has created a specialised body to guarantee the fundamental right to the protection of personal data, it is for that body (the EDPS) rather than the Controller to deal with complaints concerning alleged breaches of data protection rules. Under those rules, any person can lodge a complaint with the EDPS within two years of becoming aware of the facts on which the complaint is based. In the interest of transparency, the Controller included a corresponding provision in the Implementing Provisions to reflect this division of competences (22).
While the Controller will not deal with allegations purely involving the interpretation and application of the EU Data Protection Regulation, she will consider aspects relating to privacy and data protection when assessing OLAF’s overall compliance with procedural guarantees.
4.1.3   Cases pending in legal proceedings

During the reporting year, the Controller handled a complaint which had raised facts that were pending in legal proceedings before the General Court. Article 6 of the Implementing Provisions requires the Controller to close a case when she becomes aware that the facts which have been put forward in the complaint are, or have been, the subject of legal proceedings. Accordingly, as in 2023 (23), the Controller terminated the examination of the complaint in relation to the allegations that were pending before the General Court and admitted the remaining allegations.
This case highlighted a legislative gap in the OLAF Regulation, which contains no express provision addressing the interplay between the complaints mechanism and judicial proceedings before national or EU Courts. This absence creates uncertainty for both complainants and the administration as to how complaints should be treated when the underlying matters are already subject to judicial proceedings. As the complaints mechanism is intended to complement, rather than run in parallel with, actions brought before judicial authorities such as the General Court or the CJEU, the absence of an explicit provision in the OLAF Regulation means the same matter might be examined simultaneously by the Controller and a judicial authority. This duplication could result in inconsistent factual assessments.
For these reasons, the Controller has called on the EU co-legislators to amend Article 9b of the OLAF Regulation to include a clear obligation for the Controller to close a case where the underlying matter is pending before national or EU Courts (24).
4.1.4   Discontinuation of correspondence on repetitive complaints

The Controller did not encounter complaints containing abusive language during the reporting year. However, she was faced with situations in which complainants repeatedly submitted complaints raising the same allegations, despite the issues having already been addressed through a reasoned decision declaring the complaint inadmissible or a final decision on the merits. The Controller also dealt with instances in which complainants submitted a large number of complaints concerning issues of marginal or no relevance to OLAF investigations. Such patterns of behaviour risk diverting the complaints mechanism from its primary purpose, namely the effective safeguarding of fundamental rights and procedural guarantees for persons concerned by OLAF investigations. Such practices may also place a disproportionate administrative burden on both the Controller and the Secretariat, requiring the allocation of time and resources to matters that do not substantively contribute to protecting the rights the mechanism is designed to uphold. Ensuring that the complaints procedure remains focused on substantiated and relevant grievances is therefore essential to preserving its effectiveness and credibility.
The Controller notes that the OLAF Regulation does not explicitly contain a provision allowing her to declare complaints to be abusive and/or repetitive. To address this gap, the Controller has set out an internal procedure in Article 5(4) of the Implementing Provisions and has developed an administrative practice aimed at mitigating potential misuse of the complaints mechanism. This practice involves registering the complaint as a new complaint and issuing a formal inadmissibility decision with a first warning to the complainant, indicating that any further communications or complaints on the matter will be considered repetitive and will no longer be assessed. In the same decision, the complainant is also informed that correspondence on the matter will be discontinued, in accordance with the Commission’s Code of Good Administrative Behaviour (25). Any additional submissions or complaints that the complainant persists in making on the same issue will be treated as abusive.
In 2025, there were 4 instances where complainants raised allegations on matters that had already been addressed by the Controller through a reasoned inadmissibility decision or a final decision on the merits. As a result, following the administrative practice detailed above, the Controller took the decision to discontinue communications on those matters.
4.2   Adversarial procedure

After completing her preliminary assessment of the complaints, the Controller invited OLAF to provide its views on the 7 that were declared admissible or partially admissible. The Controller then sent OLAF’s replies to the complainants and invited them to comment on OLAF’s views.
As a matter of principle, the Controller tries to give the fullest possible effect to the principle of adversarial proceedings. All parties were therefore given the opportunity to state their case and submit supporting documents. In principle, they were also informed of each other’s submissions and could comment on them. However, in duly justified cases, the Controller decided to derogate from this principle and allow information submitted by OLAF to be treated confidentially in line with Article 7(2) of the Implementing Provisions. In particular, the Controller applied this clause to protect the confidentiality and efficiency of the relevant investigations when OLAF’s replies would reveal its working methods, prevent it from collecting the necessary evidence or even jeopardise the overall investigative strategy. In these cases, the Controller agreed with OLAF that OLAF would provide: (i) a non-confidential version of its replies to be sent to the complainant, so that the complainant could understand the reasons underpinning OLAF’s conduct and thus be in a position to challenge OLAF’s reply and provide counter-arguments; and (ii) a confidential, more detailed version to further explain the reasons put forward by OLAF in the non-confidential version. This balanced solution allowed the Controller to conduct a thorough assessment of all relevant cases while complying with her obligation to ensure the confidentiality of OLAF investigations. This practice has been formalised now in Article 10 of the Working Arrangements (26).
Therefore, although complainants are not entitled to receive all pieces of information, they can trust that the Controller carries out an independent and thorough examination of the case.
4.3   Invitation to resolve the complaint


In one of the admissible cases decided in 2025, the Controller invited OLAF to take action to resolve the complaint pursuant to Article 9b(3) of the OLAF Regulation. In that case, the complainant had raised concerns about OLAF’s fairness and impartiality in conducting the investigation, in particular during a specific evidence-gathering activity at the office of the complainant (27). On the basis of the examination of the case file, to which the Controller had special access (28), and the submissions of the parties, the Controller found a breach of: (i) the right to respect for private and family life under Article 7 of the Charter; and (ii) the right to good administration under Article 41 of the Charter, in connection to the right to be treated with fairness, dignity and politeness throughout the investigative process.
The Controller therefore proposed that OLAF take specific action to resolve the complaint. In particular, the Controller invited OLAF, among other things, to exclude OLAF staff members who had acted in breach of the complainant’s rights from any further involvement in the OLAF investigation. The Controller also invited OLAF to send the complainant a formal letter acknowledging the breaches she had identified in the course of the investigation and detailing the measures taken to address those shortcomings. All proposals for solution were fully implemented by OLAF, to the satisfaction of the Controller, who then closed the case without issuing a recommendation.
4.4   Closing decisions

By the end of 2025, the Controller had taken a closing decision on a total of 6 complaints: 1 complaint from 2024 and 5 complaints (admissible and partially admissible) submitted in 2025 (29).
The Controller assessed a variety of allegations and further developed the conceptual framework for assessing complaints. Moreover, almost four years of activity show the importance of the Controller’s assessment: a closing decision not only serves the purpose of inviting OLAF to make up for shortcomings in an investigation if breaches are found. It also strengthens the legitimacy of OLAF investigations and serves as an important learning opportunity for complainants where the Controller finds no breach after an adversarial procedure and thorough legal assessment.
The Controller found no breach of the procedural guarantees and complainants’ rights in 5 complaints. In the remaining complaint, the Controller closed the case following a positive reply from OLAF to her invitation to resolve the complaint in accordance with Article 9b(3) of the OLAF Regulation (i.e. proposal for solution). Although in the 5 other cases no breach was found in the specific circumstances of the case, the Controller did identify practices which could nevertheless give rise to concerns if repeated in other contexts. In such instances, the Controller drew OLAF’s attention to these aspects by way of obiter dicta (incidental comments) in the closing decision.
In these obiter dicta, the Controller invited OLAF to take the relevant considerations into account in the conduct of its future investigations and, where appropriate, to reflect on possible adjustments to its practices. This approach allows the Controller not only to assess compliance in individual cases, but also to contribute to the continuous improvement of OLAF’s investigative practices, with a view to preventing potential breaches of the procedural guarantees for persons concerned in similar situations in the future. As explained in more detail in Section 8 of this Activity Report, the legal reasoning developed in several decisions, including obiter dicta, has directly informed amendments to the Guidelines on Investigation Procedures for OLAF Staff (‘GIPs’), thereby extending the impact of individual cases beyond their immediate factual context.
The Controller also had the opportunity to draw OLAF’s attention to the importance of maintaining clear communication with complainants and of consistently using the terminology contained in the official language versions of the OLAF Regulation when communicating in languages other than English.
Furthermore, as further explained below, the Controller was able to contribute to clarifying the application of procedural guarantees and the fundamental rights of persons concerned where new evidence emerges in the course of an OLAF investigation concerning potential criminal conduct falling within the remit of the European Public Prosecutor’s Office (the ‘EPPO’). In particular, the Controller examined the interplay between the opportunity to comment under Article 9(4) of the OLAF Regulation and the applicability of the exception provided for in Article 12c(7) of the OLAF Regulation in situations where OLAF reports possible criminal conduct to the EPPO.
5.   Substantive aspects: Overview of the Controller’s main findings

In 2025, the Controller dealt with a variety of arguments raised by complainants concerning procedural guarantees and the rules applicable to OLAF investigations. Thanks to her special access to the case files of the relevant investigations, the Controller was able to assess every complaint on the basis of all available evidence and information.
The Controller considers that the conceptual framework which is progressively being established with her closing decisions provides clear guidance for OLAF’s investigative activities, whether in the form of proposals for solutions or obiter dicta.
In line with the principle of confidentiality, the Controller cannot disclose the substance of OLAF investigations. While respecting that principle, in the section below the Controller provides an overview of the most compelling arguments raised by complainants and the way she tackled them.
5.1.   Right of defence

As in 2024, the breach of the right of defence in an OLAF investigation was the most frequent allegation the Controller had to assess during the reporting year. The variety of supporting arguments raised enabled the Controller to assess many of the nuances of this pivotal procedural right.
5.1.1.   The right to be informed

In one instance, a complainant argued that OLAF had breached Article 9(3) of the OLAF Regulation by failing to provide them with information on the stage of the investigation. In the complainant’s view, the general principles of good administration require any person concerned by an OLAF investigation to be provided with at least minimal information regarding the progress of the investigation.
The Controller took the opportunity to clarify the scope of Article 9(3) of the OLAF Regulation and the rights it confers upon persons concerned. She first noted that the provision requires OLAF to inform an official or servant of an EU institution that they may be personally implicated in an irregularity provided this does not prejudice the conduct of the investigation. In this sense, Article 9(3) states that ‘as soon as an investigation reveals that an official, other servant, member of an institution or body, head of office or agency or staff member may be a person concerned, that official, other servant, member of an institution or body, head of office or agency, or staff member shall be informed to that effect’. Similarly, Article 28(1) of the GIPs requires OLAF to ‘inform members, officials or other servants of the EU institutions, bodies, offices and agencies as soon as they are identified as a person concerned’ (30).
The Controller further noted that an individual’s right to be informed of their status as a person concerned is explicitly recognised only in the context of internal investigations. By contrast, the OLAF Regulation does not expressly grant the right to be informed to persons concerned in external investigations, leaving the precise time and manner of notification less clearly defined.
The Controller pointed out that in LA International Cooperation Srl v Commission
                   (31), the General Court confirmed its previous case law in Oikonomopoulos v Commission
                   (32), ruling that the obligation to inform a person concerned in the context of an OLAF investigation, laid down in Article 9(3) of the OLAF Regulation, also applies to external investigations. According to that case law, where it becomes apparent during an external investigation that an individual or legal entity may be concerned by it, that individual or entity should be informed of their status as a person concerned, provided that notification does not prejudice the conduct of the investigation or any investigative proceedings falling within the remit of a national judicial authority.
In line with the General Court’s case law, the Controller argued that the OLAF Regulation should explicitly recognise the right of persons concerned in external investigations to be informed of their status as a person concerned as soon as possible. Accordingly, in her Opinion on the evaluation of the application and impact of the OLAF Regulation, the Controller proposed that Article 9(3) be amended in line with the existing case law of the EU Courts (33).
However, in the particular case analysed by the Controller, the complainant did not focus on whether they were informed of their status as a person concerned. On the contrary, the complainant’s claims concerned their alleged right to be informed of the progress of the investigation. In this context, the Controller pointed out that the OLAF Regulation does not confer a right to be informed of the precise stage or progress of an ongoing investigation, or of the investigative activities carried out by OLAF. As a result, the Controller found the complainant’s claim to be unsubstantiated.
5.1.2.   Right to be assisted by a person of choice

In two complaints the Controller addressed the issue of the right of the person concerned to be assisted by a person of their choice and the right to avoid self-incrimination in the context of internal investigations. In both cases, the complainants claimed that OLAF had failed to provide them with sufficient explanations of their rights of defence, and particularly their right to be assisted by a lawyer and their right to avoid self-incrimination at the start of the inspection of premises within an institution, body, office or agency (IBOA). In both cases, the Controller acknowledged that, in internal investigations, Article 4(2)(a) of the OLAF Regulation does not make express reference to the right of the person concerned to be assisted by a lawyer during an inspection. Nor does it refer to a right of the person concerned to be informed when an inspection is carried out by OLAF at their office. Indeed, Article 4(2)(a) gives OLAF the right to ‘immediate and unannounced access to any relevant information and data relating to the matter under investigation […] held by the institutions, bodies, offices and agencies, and to their premises’. Article 47(1) of the GIPs (34) further specifies that OLAF can carry out inspections on the premises ‘at any time during an investigation’.
It follows from the applicable legal framework that the presence of the person concerned, or their lawyer, is not a prerequisite for the legality of an inspection of premises carried out by OLAF. If necessary, OLAF can carry out an inspection even in the absence of the person concerned, provided that another staff member or a security guard of the EU IBOA concerned is present. OLAF therefore does not have a clear obligation, under the OLAF Regulation, to inform persons concerned in internal investigations of the possibility of being assisted by a lawyer during an inspection of their office.
In the specific cases in question, the Controller concluded that OLAF did not infringe the complainants’ rights of defence and acted in line with the applicable legal framework. Furthermore, it emerged from the case file and the parties’ submissions in both cases that, in practice, the complainants could and did effectively exercise their rights of defence.
However, the Controller held the view that, while the OLAF Regulation does not provide for a formal right to legal assistance in the context of an OLAF inspection of premises within IBOAs, it equally does not prohibit persons concerned from being assisted by a lawyer. In both cases, the Controller held that OLAF cannot prevent a person concerned from seeking or receiving legal assistance, and therefore the individual retains the ability to consult a lawyer at any time during such inspections. However, this possibility must not be an obstacle to the conduct of an OLAF inspection (35).
In addition, the Controller stressed that, while the applicable legal framework does not prescribe the specific way in which OLAF must communicate these rights, she considered that, given their fundamental importance, the information on the fundamental rights and procedural guarantees afforded to persons concerned should be communicated in writing, as a matter of good administrative practice. Furthermore, even in the absence of a formal requirement in the OLAF Regulation, the Controller encouraged OLAF to adopt the practice of clearly informing persons concerned during inspections that they remain free to seek legal advice should they so wish
                   (36).
5.1.3.   Opportunity to comment on the facts established by OLAF

Under Article 9(4) of the OLAF Regulation, once the investigation has been completed and before conclusions referring by name to a person concerned are drawn up, OLAF must give that person the opportunity to comment on facts concerning them. Article 9(4) further specifies how this opportunity is to be granted, i.e., by providing a summary of facts.
The opportunity to comment on OLAF’s summary of facts is the expression of the right to be heard in the context of OLAF investigations and an essential procedural guarantee for the persons concerned. According to the EU Courts’ case law, the right to be heard forms part of the rights of defence, and respect for those rights is a general principle of EU law (37). The EU Courts specify that the right to be heard affords the person the opportunity to articulate their views effectively during an administrative procedure and before any decision liable to adversely affect their interests is taken (38).
It follows from this case law (39) that the primary objective of the statement of facts is to ensure that the person concerned is aware of the facts and evidence that OLAF has gathered during the investigation. This allows the individual to understand the case against them and to exercise their right to defend themselves by providing comments, explanations or additional information. By giving the person the opportunity to comment, OLAF ensures fairness and upholds the principle of due process. It prevents decisions based on incomplete or one-sided information, offering the person a chance to challenge any potentially incorrect or incomplete facts presented by OLAF. Finally, the opportunity to comment may also help improve the overall quality of the investigation. The person concerned could provide information that OLAF may not have considered that could potentially impact the outcome of the investigation. The Controller considers that drafting the statement of facts and giving individuals the opportunity to comment on those facts is a key procedural safeguard to ensure impartiality and fairness in the investigation. For the Controller, it is of the utmost importance that the statement of facts provided by OLAF to persons concerned include clear, objective and fact-based findings, without drawing conclusions or making a legal assessment of those facts. This ensures the fairness of the process, protects against any bias or prejudgment in the investigative phase and upholds the rights of the individuals involved.
In one case, the complainant argued that Article 9(4) of the OLAF Regulation and their right to have a fair, impartial and objective investigation had been breached. In the complainant’s view, the statement of facts they received contained not only facts established by OLAF in the course of the investigation, but also OLAF’s conclusions and subjective interpretations, which reflected a subjective judgement and created ambiguity in the document.
In general terms, the Controller reminded OLAF that it should be careful in drafting the statement of facts to avoid using any wording which could be perceived by the complainant as, or give the impression of, a qualitative assessment. Nevertheless, in the specific case, the Controller considered that the wording used by OLAF in the statement of facts addressed to the complainant did not breach the complainant’s rights.
The Controller found that the summary of the facts was sufficiently detailed for the complainant to understand the nature and scope of the case against them and thus to exercise in a meaningful way their right to be heard. Furthermore, the Controller did not find in the statement of facts any conclusive assessment or statements that could be considered ambiguous or could be interpreted as a subjective assessment by OLAF that could jeopardise the objectivity, impartiality and fairness of the investigation. The Controller confirmed that the terms used by OLAF in the statement of facts referred to concrete factual and contextual elements. In addition, in all relevant sections OLAF provided additional explanations and factual context which enabled the person concerned to fully understand the facts as established by OLAF.
In another case, the Controller had the opportunity to assess the interplay between the opportunity to comment under Article 9(4) of the OLAF Regulation and the applicability of Article 12c(7) of the OLAF Regulation in cases were OLAF reports to the EPPO.
In this case, the complainant argued that OLAF had breached their rights under Article 9(4) of the OLAF Regulation as it did not provide them with the opportunity to comment on the facts established before deciding to discontinue its investigation, in accordance with Articles 12c(5) and 12c(7) of the OLAF Regulation.
In this case, the Controller pointed out that, pursuant to Article 12c of the OLAF Regulation, OLAF is under a strict obligation to report to the EPPO any criminal conduct that may affect the EU’s financial interests falling within the EPPO’s competence as defined in Chapter IV of the EPPO Regulation. Under this provision, OLAF is obliged to submit a report (‘ECR’) to the EPPO without undue delay, as soon as it becomes aware that the conduct in question may be criminal and falls within the EPPO’s remit. If the EPPO informs OLAF of the opening of a criminal investigation into the same facts, OLAF discontinues its own investigation to avoid duplication and informs the EPPO accordingly. Under Article 12c(5), when the EPPO decides to open an investigation, OLAF cannot continue its own investigations of the same facts (40).

In this situation, the Controller stated that Article 12c(7) of the OLAF Regulation expressly provides for an exception to the right to comment under Article 9(4) of the OLAF Regulation in cases where OLAF discontinues an investigation following the transmission of an ECR to the EPPO.

In the case in question, the Controller confirmed that OLAF had not concluded its own investigation on the basis of investigative findings under Article 11 of the OLAF Regulation, but instead had discontinued its investigation pursuant to Article 12c(5) of the OLAF Regulation. Therefore, in compliance with the obligations stemming from the interplay of the OLAF Regulation and the EPPO Regulation (41), OLAF: (i) suspended its own investigation; (ii) transmitted a crime report to the EPPO and, upon being informed that the EPPO was opening a criminal investigation into the same facts; (iii) discontinued its own investigation; and (iv) transferred the case file to the EPPO. The Controller also confirmed that, in accordance with those provisions, OLAF was precluded from drawing any substantive conclusions about the complainant and had transmitted the relevant information in its possession to the EPPO for assessment.
As a consequence, the OLAF investigation never reached the point at which the complainant’s right to comment on the facts concerning them would have been triggered, as those relevant facts had not yet been established. Therefore, the Controller concluded that OLAF had acted in full compliance with the applicable legal framework in not giving the complainant the opportunity to comment, pursuant to the exception laid down in Article 12c(7) of the OLAF Regulation.
Despite the Controller’s findings, she reassured the complainant that their fundamental rights and the procedural guarantees would continue to be upheld throughout the EPPO investigation. The complainant would have the opportunity to submit to the EPPO any allegations or documentation that they could have presented at the appropriate stage of the OLAF investigation. Moreover, the complainant’s fundamental rights and procedural guarantees would be afforded a high standard of protection considering that, in contrast to the administrative investigations conducted by OLAF, the EPPO conducts criminal investigations that are subject to the strict procedural safeguards set out in Chapter VI of the EPPO Regulation.
5.1.4.   Access to the file and to documents referred to in the statement of facts

During 2025, the Controller also handled a complaint regarding an alleged breach of the fundamental rights and procedural guarantees under Article 9(1) of the OLAF Regulation, including the right of defence and the right to be heard, in connection with OLAF’s refusal to give the complainant access to the case file of the ongoing investigation and to all the documents referred to in the summary of facts.
The Controller first pointed out that: (i) access to the file of OLAF investigations is not a right included among the procedural guarantees provided by Article 9 of the OLAF Regulation; and (ii) the OLAF Regulation does not entitle the person concerned to access all evidence gathered by OLAF, since this could jeopardise OLAF’s activity or any possible follow-up actions by the competent authorities where OLAF has issued a recommendation. Indeed, according to the case law of the EU Courts (42), OLAF is under no obligation to grant a person concerned in an investigation access to the documents which are the subject of such an investigation or to those drawn up by OLAF itself for that purpose, since the effectiveness and confidentiality of the mission entrusted to OLAF and OLAF’s independence could be compromised. As the EU Courts have stated, the right of defence of a person concerned in an OLAF investigation is sufficiently guaranteed by the information they receive and by the fact that they are given the opportunity to comment on the summary of facts upon completion of OLAF’s investigation and before conclusions referring to them by name are drawn up.
It follows from the applicable case law of the European Courts that a person concerned does not have a right to access the case file of an ongoing OLAF investigation. The Controller therefore concluded that OLAF’s refusal of such access does not infringe Article 41 of the Charter.
The complainant also argued that they could not effectively exercise their right to be heard because they did not have access to the documents referred to in the summary of facts. On this, the Controller found that any alleged infringement of the right of defence during an OLAF investigation, which includes the right to be heard, must be examined in relation to the information the complainant has received and to the fact that they were given the opportunity to state their views and be heard (43). In the present case, the Controller considered that OLAF had provided a statement of facts that was sufficient for the complainant to be able to exercise their right to be heard. The Controller also noted that the complainant made use of their right to be heard and submitted detailed observations to OLAF on multiple occasions. The Controller therefore concluded that the complainant was able to submit their comments on the facts established by OLAF, stating their point of view, and was given a meaningful right to be heard. Finally, the Controller pointed out that there is no provision which gives the person concerned the right to take a position on each statement of evidence or to express views on the conclusions which can be drawn by OLAF (44).
5.2.   Proportionality of inspections of premises and digital forensic operations

Inspections of premises and digital forensic operations are investigative activities which are considered ‘intrusive in character’ and, therefore, are subject to specific rules (45). During 2025, there were two instances where complainants questioned the proportionality of those investigative activities, especially regarding privately owned devices.
Before entering into the merits of both complaints, the Controller first addressed the general principles governing OLAF’s digital forensic operations.

Framework applicable to digital forensic operations

In the context of internal investigations, Article 4 of the OLAF Regulation enables OLAF to conduct digital forensic operations on the premises of EU institutions. To this effect, Articles 47(1) and 53(1) of the GIPs list both inspections of premises and digital forensic operations as means for the investigation units to gather evidence during the investigation phase.
Article 4(2)(a) of the OLAF Regulation particularly states that OLAF must have immediate and unannounced access to any ‘relevant information and data relating to the matter under investigation, irrespective of the type of medium on which it is stored, held by the institutions, […] and to their premises.’ Article 47(3) of the GIPs contains similar provisions.
Article 4(2)(a) of the OLAF Regulation specifies that OLAF may inspect privately owned devices under three cumulative conditions: (i) the devices are used for work purposes; (ii) the specific conditions for doing so are laid down in the internal decisions adopted by the institutions concerned; and (iii) OLAF has reasonable grounds to suspect that their content may be relevant for the investigation.
The Controller also pointed out that, according to Article 1(5) of the Guidelines on digital forensic procedures for OLAF staff (‘DFPs’) (46), a digital forensic operation is ‘a technological

inspection, acquisition, and examination

of digital media and/or their contents, carried out by OLAF’s Digital Evidence Specialists (DES) using forensic equipment and software tools. The objective is to locate, identify, collect and/or acquire and preserve data which may be relevant to an investigation, and may be used as evidence in administrative, disciplinary and judicial procedures.’
During a digital forensic procedure OLAF performs the following distinct operations: (i) digital forensic collection, which is the process of gathering the physical devices that contain potential digital evidence (47); (ii) digital forensic acquisition, which is the acquisition (copying) of any data stored on a digital medium through a forensic imaging process (48); (iii) a preview of the data, which consists in a first inspection of a digital medium using an appropriate forensic tool in order to establish whether it may contain data potentially relevant to the investigation (this can be done before (49) or after (50) the digital acquisition of the data); and (iv) a digital forensic examination, which is the process of analysing the data gathered during a digital forensic operation (51).
The Controller also stated that the GIPs further specify that forensic operations should be conducted in accordance with the principle of necessity and proportionality and with the focus on the devices which have a clear indication of business use
                (52). Digital forensic operations may also include access to privately owned devices used for work purposes. Finally, the digital forensic examination and analysis of the data collected during the digital forensic operation must be limited to extracting data necessary and relevant to the investigation concerned.

Application in the specific cases

Regarding the specific circumstances of the two complaints that made these allegations, in both cases the Controller noted that the digital devices that had been provided to the complainants by an IBOA were the IBOA’s property, given to the complainant first and foremost for work purposes. They belonged to the IBOA, which was the one ‘holding’ the devices and the data contained in them for the purposes of Article 4(2)(a) of the OLAF Regulation. Consequently, irrespective of the specific use which the complainant made of them, their collection and acquisition was fully justified under the above-mentioned provision. In both cases, the Controller could confirm through her special access to the case file that the privately owned devices had been used for work purposes. In this regard, the Controller noted that once a professional use is identified, the extent of that use (limited or substantial) or the reason for it (own-initiative or requested) is irrelevant. Accordingly, in both instances, the Controller’s view was that OLAF’s decision to collect the devices and acquire the data contained in them under Article 4(2)(a) of the OLAF Regulation was lawful.

Proportionality analysis


On the proportionality of the investigative activities, the Controller pointed out the following. As confirmed by the General Court, the power of OLAF investigators to access (under the same conditions as national administrative inspectors and in compliance with national legislation) all the relevant information and documentation required for the proper conduct of on-the-spot checks and inspections cannot be interpreted as allowing the person concerned to determine the relevant data for the purposes of an OLAF investigation
                (53).
The Controller also stressed that not all data initially acquired during an inspection and digital forensic operation form part of the OLAF case file. In accordance with Article 8(4) of the DFPs, only data relevant for the investigation are transferred to the case file. In practical terms, the forensic image that OLAF acquires is first transformed into a ‘forensic work file’, which is a copy of the digital forensic data acquired, but in a form that can be ‘indexed’ by OLAF. Once the data are indexed, OLAF can finally proceed with ‘searching and identification’ of the relevant data for the investigation. If, at the end of the search, any file is identified as ‘relevant’ for the ongoing investigation, it then becomes part of the OLAF case file and becomes evidence OLAF can use.

In one of the complaints, the person concerned even argued that they should have been invited to comment on the list of keywords prepared by OLAF investigators to search the acquired data. On this issue, the Controller held the view that discussing the list with the person concerned or agreeing on it with them would undermine the investigators’ independence and jeopardise the investigation. The Controller underscored that OLAF conducts its investigations in full independence under the OLAF Regulation. Therefore, the choice of keywords is exclusively within the remit of the investigators, and it reflects their investigative strategy, which OLAF can neither share nor agree with third parties, in particular with persons concerned. Likewise, the Controller rejected the complainant’s proposal to have her scrutinise the list of keywords and the corresponding justification for their use. She affirmed that it is up to OLAF to decide, in each case, which keywords may be relevant for the purposes of the investigation.
Both complainants took issue with how long OLAF kept their privately owned devices for. In both instances, through her special access to the case file, the Controller confirmed that OLAF kept the devices for the time necessary to complete the data acquisition. Nevertheless, the Controller pointed out that mobile phones were becoming universal and central to people’s daily lives and invited OLAF to reflect on that. Far from being mere communication devices, smartphones now functioned as, for instance, gateways to banking and payment systems, home security systems, professional resources, transport passes, healthcare applications, and even the location and safety of children. Denying access to these devices may therefore have a more profound impact on the personal sphere of a person concerned than it did some years ago. While in the particular case the acquisition of the complainant’s privately own device was not disproportionate, the Controller encouraged OLAF to remain attentive to this reality and to always ensure that personal mobile phones were kept only for the time that was strictly necessary for the purposes of the investigation.
In both cases, the Controller considered that OLAF’s investigative activities and digital forensic operations: (i) were conducted according to the law; (ii) pursued the legitimate aim of investigating allegations of possible misconduct by the complainants; and (iii) were in line with the scope and purpose of the investigation in that they were necessary to prove or disprove the allegations. The Controller thus found that OLAF has acted in accordance with the applicable legal framework and the procedure outlined in the DFPs, and within the scope of the investigation. Therefore, the Controller found no breach of the principle of necessity and proportionality in the digital forensic operations carried out by OLAF.
5.3.   Languages used

In one case, the Controller was asked to assess whether a person concerned in an internal investigation, who was an EU staff member (54), had the right to ask for information or communications sent by OLAF in one of their working languages (English) to be also provided in their mother tongue.
As previously stated by the Controller (55), the EU institutions’ obligation under Article 41(4) of the Charter to correspond with citizens in their chosen language only applies to relations between EU institutions and citizens, not EU staff. The complainant, being an EU public servant, was expected to have a thorough knowledge of English. English was also one of the complainant’s working languages.
As laid down in the case law of the EU Courts (56), the right to use the language of one’s choice is not an absolute right for EU staff since the EU institutions need to operate smoothly. As a result, the Controller found that OLAF’s refusal to provide the requested translations did not breach the complainant’s procedural rights.
6.   Adoption of Working Arrangements between the Controller and OLAF

A key milestone in the cooperation between OLAF and the Controller was the signature of the Working Arrangements by Mr Ville Itälä, former Director-General of OLAF, and Dr Julia Laffranque. The arrangements entered into force on 18 July 2025
             and are publicly available on the Controller’s website (57).
The Working Arrangements provide greater clarity in the handling of the complaint mechanism and prove a useful instrument for ensuring even smoother and more effective cooperation with OLAF. The arrangements formalise and codify the well-established practices that have already guided the constructive cooperation between the two Offices. In this regard, the Controller welcomes the constructive dialogue with OLAF throughout the drafting process, which allowed the text to accurately reflect the respective mandates, roles and operational needs of both parties.
In full respect of the applicable legal framework and both OLAF’s and the Controller’s independence, the Working Arrangements specify relevant aspects in the complaint handling process. These include: (i) the procedure to be followed after the receipt of a complaint and its initial processing; (ii) the information-gathering actions available to the Controller; (iii) the distinction between invitations to resolve a complaint under Article 9b(3) and the Controller’s recommendations under Article 9b(5) of the OLAF Regulation; (iv) the calculation of the relevant time limits; and (v) the procedure to be followed when either OLAF or the Controller becomes aware of the initiation of legal proceedings or inquiries by the European Ombudsman or the EDPS into facts raised in a complaint.
Other provisions of the Working Arrangements concern access to case-related information in the OLAF case management system (‘OCM’), to which the Controller has special access under Article 8(1) and (2) of the Implementing Provisions. The Working Arrangements also clarify: (i) OLAF’s information obligations towards the Controller in the handling of complaints; (ii) the procedure to be followed when the Controller and the Secretariat are granted electronic access to case-related information in the OCM; and (iii) alternative arrangements for the Controller’s access to case-related information.
As further set out in the Activity Report, the Working Arrangements have also formalised the Controller’s obligation to ensure the confidentiality of OLAF investigations when handling complaints. In addition, the Working Arrangements address situations in which a complainant may request access to the case file of the complaint, as well as the processing of requests for public access to documents held by the Controller under Regulation (EC) 1049/2001 (58) and the detailed rules for the application of the Regulation, annexed to the Commission’s Rules of Procedure (59).
7.   Consultation on the evaluation of the OLAF Regulation

Article 9b(9) of the OLAF Regulation provides that the Director-General of OLAF ‘may request the opinion of the Controller on any matter related to procedural guarantees or fundamental rights that falls within the Controller’s mandate’.
On this basis, on 15 September 2025, the Director-General of OLAF formally asked for the Controller’s opinion on the provisions of the OLAF Regulation related to procedural guarantees and fundamental rights that fall within the Controller’s mandate. This was in the context of the Commission’s evaluation of the application and impact of the Regulation under Article 19(1) of the OLAF Regulation.
The Controller welcomed the opportunity to be consulted on this important matter and drew on the substantial experience accumulated during her mandate (60). In her opinion, she put forward a total of 31 proposals for improvement in areas where practice had demonstrated that clearer, stronger or more effective safeguards were warranted (61).
The opinion was structured around six main areas: (i) fundamental rights and procedural guarantees (proposals 1-12); (ii) the complaints mechanism (proposals 13-19); (iii) the function of the Controller (proposals 20-25); (iv) relations between the Controller and the Director-General of OLAF (proposal 26); (v) relations between the Controller and the Supervisory Committee (proposals 27-30); and (vi) relations with other stakeholders (proposal 31) (Figure 9).

Figure 9


Number of proposals put forward by the Controller in the Opinion on the evaluation of the application and impact of the OLAF Regulation






The proposals on fundamental rights and procedural guarantees, which are the most numerous, address: (i) the lack of an explicit reference to the Charter in Articles 9 and 9b(1) of the OLAF Regulation; (ii) the need for clarity on when an individual or economic operator acquires the status of person concerned; (iii) the equalisation of the rights of persons concerned in internal and external investigation to the greatest extent possible; (iv) the need to provide in writing information on procedural guarantees and the fundamental rights of persons concerned; (v) the principle of fairness that must be observed by OLAF staff, in compliance with the highest professional standards; (vi) the strengthening of the right to be heard; (vii) the strengthening of the right to be informed; and (viii) the lack of clarity on the status, rights and procedural guarantees afforded to whistleblowers under the Whistleblowing Directive (62), to informants under Article 22a of the Staff Regulations (63) and to other sources of information and victims of misconduct falling within OLAF’s investigative mandate (64).
The potential areas for improvement in the complaints mechanism identified in the Opinion concern: (i) the personal, material and temporal scope of the admissibility requirements; (ii) the absence of a review procedure for admissibility decisions; (iii) the question of whether complaints could or should have a suspensive effect; (iv) the handling of complaints that raise issues pending before courts; and (v) the legal consequences of a hypothetical decision by the Director-General of OLAF not to follow a recommendation issued by the Controller under Article 9b(5) of the OLAF Regulation.
As is often the case when significant institutional reforms are introduced, the creation of the function of Controller by Regulation 2020/2223 was accompanied by certain conceptual ambiguities that persist to this day. That is why the Opinion puts forward proposals for addressing the ambiguities concerning the independence of the Controller vis-à-vis the Supervisory Committee and the Controller’s administrative status, as well as on the need for clarification in the OLAF Regulation of the dual role of the Secretariat, which provides legal and administrative support to both the Supervisory Committee of OLAF and the Controller.
Furthermore, the Opinion argues that including a legal basis in the OLAF Regulation for the Controller to issue own-initiative opinions addressed to the Director-General of OLAF would add value and transparency to her decisions and obiter dicta and would contribute overall to the effective exercise of the Controller’s mandate.
While the Controller and the Supervisory Committee have complementary aims and pursue common objectives, they are distinct functions and bodies, each operating on an equal footing within the scope of their respective mandates. Accordingly, in order to strengthen the Controller’s independence, the Opinion proposes that the OLAF Regulation be amended so that, instead of reporting or consulting, she informs the Supervisory Committee of any systemic issues reported to the Director-General of OLAF by means of an opinion, as well as of any recommendation addressed to the Director-General of OLAF or any revisions to the Implementing Provisions.
Finally, regarding relations with other stakeholders, the Opinion proposes that Article 16 of the OLAF Regulation be amended to expressly provide for the Controller’s participation in the exchange of views between the European Parliament, the Council and the Commission. In the Controller’s view, this amendment would help raise awareness of the types of allegations made under the complaints mechanism and provide greater visibility of how OLAF deals with procedural guarantees and the fundamental rights of persons concerned.
The opinion was sent to the Director-General of OLAF on 27 February 2026, and it will be annexed to the Commission’s submission to the co-legislators. The Controller trusts that the evaluation and possible revision of the OLAF Regulation will benefit significantly from the implementation of the observations presented in her Opinion.
8.   Follow-up on the adoption of the new GIPs

In November 2023, in the context of the revision of the GIPs, the Controller was invited to provide her opinion on any matter related to procedural guarantees or fundamental rights that fell within her mandate. The Controller sent her opinion to OLAF in June 2024. The redacted version of the Controller’s opinion on the GIPs was published on her website in July 2025 (65).
In her opinion, the Controller made five main remarks concerning:






(i)


The need for a clear and well-defined scope of OLAF investigations.










(ii)


The timely registration in the case file of a person’s status as a person concerned where they are already named in the Opening Decision.










(iii)


The need to inform persons concerned of the existence of the complaints mechanism under Article 9b and of the applicable time limits for lodging a complaint.










(iv)


The clarification that the invitation to resolve a complaint under Article 9b(3) and the Controller’s recommendation under Article 9b(5) constitute two distinct steps in the complaint mechanism.










(v)


The importance, as a matter of good administrative practice, of ensuring that comments submitted by persons concerned are duly reflected in the Final Report. In this respect, the Controller recommended a cumulative approach consisting of the following steps: (a) annexing the comments of the person concerned on the facts concerning them to the Final Report; (b) where necessary, describing these comments in the corresponding relevant parts of the Final Report; and (c) explaining how OLAF took these comments into consideration or, where appropriate, why they were considered unfounded or irrelevant.




The final version of the revised GIPs was adopted in November 2025 and entered into force on 1 January 2026. Overall, the Controller welcomes the adoption of the new GIPs and notes with satisfaction that most of her remarks were taken into account by OLAF and reflected in the provisions of the GIPs, in particular Articles 21(1), 37(2), 37(3), 66(2), 66(3) and 72(3) (Figure 10).
The Controller first welcomes the explicit incorporation of her first remark in Article 21(1) of the GIPs on the scope of the case. The amendment is positive, in the sense that it specifies that the scope of the investigation ‘shall always be clearly defined in the opening decision’.
The Controller notes positively the clarifications added in Article 37(2) of the GIPs, read together with Article 28(1), which address the main concern about when the status of person concerned is identified. Article 37(2) provides that the individual or legal entity named as a person concerned in the opening decision should be registered in the OCM within one month of the opening decision. The introduction of this deadline aims to avoid delays in the identification of the person concerned which might impact their right to be informed under Article 9(3) of the OLAF Regulation. Furthermore, in the context of internal investigations, Article 28(1) of the GIPs ensures that a person identified as a person concerned in an opening decision is also informed accordingly (and is also notified of the scope of the investigation to the extent that it relates to them), provided that this information does not prejudice the conduct of the investigation.
The Controller further observed that her third remark on the information to be provided to persons concerned (66) has been implemented in Article 2(2) of the Working Arrangements and Article 37(4) of the GIPs. First, the Working Arrangements stipulate that when OLAF receives a complaint intended for the Controller, OLAF ‘will inform the complainant about the complaint’s mechanism procedure and the strict admissibility deadlines for lodging a complaint with the Controller’. Second, among the procedural guarantees afforded to persons concerned that must be observed by OLAF, Article 37(4)(e) of the GIPs lists ‘the right to lodge a complaint with the Controller of procedural guarantees’.
The Controller notes with satisfaction the clear reference introduced in the GIPs to the two distinct legal bases for the Controller’s invitations to resolve a complaint and the Controller’s recommendations. Article 66(2) of the GIPs now refers to the Controller’s invitation to resolve the complaint pursuant to Article 9b(3) of the OLAF Regulation, while Article 66(3) refers to the Controller’s recommendation to resolve a complaint pursuant to Article 9b(5) of the OLAF Regulation. This separation provides more clarity for complainants in understanding the separate steps of the complaint mechanism.
The Controller also welcomes the inclusion in the new GIPs of her remarks on how OLAF should incorporate the comments of the persons concerned in the Final Report. Article 72(3) of the new GIPs accommodates the essence of her recommendation, while not strictly following the suggested cumulative approach. The GIPs now require the comments of the person concerned to be described and accompanied by OLAF’s assessment of them and additionally provide for the comments to be annexed to the Final Report. While the GIPs set out exceptions to this annexing on account of confidentiality, the protection of procedural rights or the conduct of other investigations, the Controller’s view is that those exceptions should be interpreted restrictively, as they are intrinsically linked to the procedural guarantees for the person concerned. Furthermore, the Controller considers that, when comments concerning crucial elements of the preliminary findings are not taken on board in the Final Report, OLAF’s assessment should reflect the reasoning for not doing so.

Figure 10


Implementation of the Controller’s remarks from the Opinion on the draft GIPs






Additionally, the Controller values positively the amendments introduced in Articles 37(4), 37(5) and 80(1), which are the result of the handling of the complaints mechanism. These modifications reflect findings made during the first year of her activities, as well as obiter dicta from several of her decisions, and are aligned with some of the proposals put forward in her Opinion on the application and impact of the OLAF Regulation (67).
During the first year of her activities, the Controller found a breach of a complainant’s right to be informed of the closing of an OLAF investigation without findings against them. Under Article 11(7) of the OLAF Regulation, there is a clear obligation on OLAF to inform the person concerned, within 10 working days of the decision to close an investigation in which no evidence has been found against them. Upon completion of the investigation, OLAF found no evidence against the complainant. However, OLAF did not inform the complainant in an unequivocal manner. In this particular case, the Controller did not put forward a proposal for solution since the complainant had obtained access to the Final Report while the complaint was being processed, thus becoming aware that no evidence had been found against them. Nevertheless, the Controller reminded OLAF that this was a serious breach and invited OLAF to pay careful attention to similar cases in the future (68). Against this background, the Controller welcomes the introduction in Article 37(5) of the GIPs of the several means of communication available to investigation units to ensure that persons concerned are effectively notified of the opening of an investigation, the opportunity to comment and the closure of an investigation.
Furthermore, the Controller highlights that Article 37(4) of the GIPs clearly indicates the procedural guarantees applicable to persons concerned that must be observed by OLAF staff when conducting investigations, in particular:






(i)


the right to avoid self-incrimination;










(ii)


the right to be assisted by a person of their choice during interviews, inspections and on-the-spot checks;










(iii)


the notification of the opening and closure of an investigation;










(iv)


the right to lodge a complaint with the Controller.




The first two rights are aligned with the Controller’s decisions referred to in Section 5.1.1 of this Activity Report. The notification of the opening and closure of an investigation relates, respectively, to the Controller’s remarks on the registration of the person concerned in the OCM (69) and to concerns raised by the Controller about the absolute one-month limitation period applicable to closed investigations under Article 9b(2) of the OLAF Regulation (70). The right to lodge a complaint with the Controller, as mentioned above, relates to the remark made by the Controller in her opinion on the draft GIPs as to the information to be provided to persons concerned (71).
Finally, the Controller observes that Article 80(1) now provides that “the person concerned shall be informed of the Director-General’s decision to close the investigation, unless it is detrimental to the implementation of recommendations, or if confidentiality requirements are applicable”. The provision further specifies that “[t]his includes indicating the closing date of the investigation”. In this respect, the GIPs codify the good administrative practice developed by OLAF of going beyond the minimum requirement set out in Article 11(7) of the OLAF Regulation, which only requires that the person concerned be informed within 10 working days of the closing of an investigation if no evidence has been found against them. This good administrative practice had been commended by the Controller in the past and is in line with the proposals made by the Controller in the framework of the evaluation of the OLAF Regulation (72).
9.   Relations with stakeholders

The Controller considers it important to maintain regular contact with the EU institutions, the Director-General of OLAF and other stakeholders to obtain feedback about the role of the Controller and, ultimately, to improve the protection of procedural guarantees and the fundamental rights of the persons concerned in investigations carried out by OLAF.
On 11 September 2025, the Controller presented the Activity Report for 2024 to the Council Working Party on Combating Fraud and had an exchange of views with its members on her role and the protection of procedural guarantees for those under investigation by OLAF. She also presented her Activity Report for 2024 to the European Parliament’s Committee for Budgetary Control on 16 October 2025.
The Controller also maintained regular exchanges and fruitful working relations with the Director-General of OLAF, based on mutual trust and good cooperation. One key example was the meeting held by the Controller on 16 October 2025, alongside the members of the Secretariat, with Ms Salla Saastamoinen (then acting Director-General of OLAF) and the staff members of OLAF’s Legal Advice Unit and Review Team to discuss the complaints mechanism. This meeting proved to be a useful opportunity to reflect on the experience gathered during the first years of the Controller’s activity and on ways of improving the safeguards for procedural guarantees and the fundamental rights of persons concerned in OLAF investigations.
10.   Administrative and legal support

With a view to an efficient use of resources, the OLAF Regulation entrusted the Secretariat of the Supervisory Committee with the task of providing legal and administrative support to the Controller.
This choice is further justified by the complementarity of the missions and the common goals pursued by the Controller and the Supervisory Committee. The Secretariat ensures continuity, ongoing communication and smooth cooperation with both complainants and OLAF.
A dedicated team of highly qualified staff in the Secretariat, acting under the direction of its Head, provided valuable advice and assistance to the Controller while respecting professional secrecy and confidentiality.
In her Opinion on the evaluation and application of the OLAF Regulation, the Controller held that the current administrative attachment of the Secretariat to the Office for the Administration and Payment of Individual Entitlements, also known as the Paymaster Office (the ‘PMO’), should be reconsidered (73). Given that the Secretariat’s status and functions do not align with the PMO’s core mission, the Controller sees the need to identify a more appropriate and functionally consistent organisational location for the Secretariat that better aligns with its mandate while also guaranteeing its independence. In this regard, she considers that a more suitable place could be found, for instance, within the Commission’s Secretariat-General or the Directorate-General for Justice and Consumers.
Following the departure of the Head of Secretariat (‘HoS’) in February 2025, the most senior member of the Secretariat took over as acting HoS as of March 2025. The recruitment of a new HoS was finalised in early 2026, and the new HoS was appointed on 1 April 2026.
The Controller was invited to participate as an observer in the selection process for the new HoS as a matter of institutional courtesy. However, the Controller stresses that there is no provision in the OLAF Regulation, similar to that for the Supervisory Committee (74), detailing a formal procedure for the consultation of the Controller and outlining how the Controller’s opinion should be taken into consideration by the appointing authority in the selection of Secretariat staff.
In light of the Secretariat’s dual role in supporting both the Supervisory Committee and the Controller, it is the Controller’s view that it would be beneficial for both entities to be involved in the recruitment process on an equal footing and for their views be duly taken into account. Accordingly, the Controller has called upon the co-legislators to consider this issue in the context of the current evaluation and possible future revision of the OLAF Regulation (75).
11.   Contacting the Controller and submitting a complaint

The Controller can be reached by email or post at the following addresses:

OLAF-FMB-Controller-Procedural-Guarantees@ec.europa.eu






Controller of Procedural Guarantees / Secretariat of the Supervisory Committee of OLAF




Rue Joseph II, 30




B-1049 Brussels, Belgium




To submit a complaint to the Controller, complainants are kindly asked to:






(i)


fill in the form;










(ii)


send it by email or post to the addresses above.




For more information, please consult the website:

https://supervisory-committee-olaf.europa.eu/controller-procedural-guarantees_en



(1)  Regulation (EU, Euratom) 2020/2223 of the European Parliament and of the Council of 23 December 2020 amending Regulation (EU, Euratom) No 883/2013, as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations (OJ L 437, 28.12.2020, p. 49, ELI: http://data.europa.eu/eli/reg/2020/2223/oj).

(2)  Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).

(3)  Under Article 2(5) of the OLAF Regulation, a person concerned is ‘any person or economic operator suspected of having committed fraud, corruption or any other illegal activity affecting the financial interests of the Union and who is therefore subject to investigation by the Office’. Complaints submitted by persons other than persons concerned, including witnesses and informants, fall outside the Controller’s mandate.

(4)  The Controller took up office in September 2022.

(5)  Article 9a(6) of the OLAF Regulation.

(6)  Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012, p. 391).

(7)  The Court of Justice of the European Union (‘CJEU’) consists of two courts: the Court of Justice and the General Court.

(8)  Article 9b(6) of the OLAF Regulation.

(9)  Article 9a(9) of the OLAF Regulation.

(10)  Article 8(1) and (2) of the Decision of the Controller of procedural guarantees adopting implementing provisions for the handling of complaints, 2022/C 494/07, PUB/2022/1609 (OJ C 494, 28.12.2022, p. 17), also available at: https://supervisory-committee-olaf.europa.eu/controller-procedural-guarantees/about-controller/legal-framework_en.

(11)  See Chapter III of the Working Arrangements between the European Anti-Fraud Office and the Controller of Procedural Guarantees of 18 July 2025, available at: https://supervisory-committee-olaf.europa.eu/document/download/ea81e700-4540-4ae6-b7ab-e56fb9a2d075_en?filename=SIGNED_WA_OLAF-Controller.pdf.

(12)  Internal investigations are investigations conducted by OLAF within European institutions, bodies, offices and agencies established by, or on the basis of, the EU Treaties. The purpose of these investigations is fighting fraud, embezzlement, corruption and any other illegal activity affecting the EU’s financial interests. To that end, OLAF investigates: (i) serious matters relating to the discharge of professional duties constituting a dereliction of the obligations of officials and other servants of the EU liable to result in disciplinary or, as the case may be, criminal proceedings; or (ii) an equivalent failure to discharge obligations by members of institutions and bodies, heads of offices and agencies or staff members of institutions, bodies, offices or agencies not subject to the Staff Regulations (Articles 1(4) and 4 of the OLAF Regulation).

(13)  External investigations are investigations that OLAF conducts pursuant to Article 3 of the OLAF Regulation. OLAF’s mandate covers all EU expenditure (i.e. European Structural and Investment Funds, agricultural policy, direct expenditure and external aid) and a substantial part (but not all) of the EU’s revenue (mainly customs duties and agricultural duties).

(14)  Coordination cases are those that could be the subject of OLAF external investigations, but where OLAF’s role is instead limited to contributing to investigations being carried out by other national or EU services. It does this, among other things, by facilitating the gathering and exchange of information and ensuring operational synergy among the relevant national and EU services. The legal basis can be found in Article 12b of the OLAF Regulation and sector-specific legislation, such as Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters (OJ L 82, 22.3.1997, p. 1) and Regulation (EU) No 608/2013 of the European Parliament and of the Council of 12 June 2013 concerning customs enforcement of intellectual property rights and repealing Council Regulation (EC) No 1383/2003 (OJ L 181, 29.6.2013, p. 15).

(15)  These include the rules set out in the OLAF Regulation and those contained in various texts, including Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ L 292, 15.11.1996, p. 2). Other notable examples include the Guidelines on Investigation Procedures for OLAF staff (the ‘GIPs’) valid as of 1 January 2026, available at: https://anti-fraud.ec.europa.eu/document/download/e1994c22-7d58-4e61-8d34-0937a0be8f98_en; and the Guidelines on Digital Forensic Procedures for OLAF Staff (the ‘DFPs’), of 15 February 2026, available at: https://anti-fraud.ec.europa.eu/document/download/87e5deb1-8a64-42ca-8e08-234355dbe544_en.

(16)  Unsubstantiated complaints contain allegations that are unsupported by clear evidence or are internally contradictory.

(17)  Manifestly unfounded complaints consist of clearly false allegations or frivolous claims.

(18)  See Activity Report of the Controller of Procedural Guarantees for 2022 (OJ C 248, 13.7.2023, p. 1), subsection 3.3.1.; Activity Report of the Controller of Procedural Guarantees for 2023 (OJ C, C/2024/5673, 23.9.2024), Section 4.1; and Activity Report of the Controller of Procedural Guarantees for 2024 (OJ C, C/2025/4511, 7.8.2025), Section 4.1.

(19)  See Controller’s Opinion on the evaluation of the application and impact of Regulation No 883/2013, available at https://supervisory-committee-olaf.europa.eu/document/download/3c7a4446-920f-4cdb-92a3-f465e766a30e_en?filename=Annex%20-%20CTR%20Opinion%20on%20evaluation.pdf, proposals 9 and 16.

(20)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, PE/31/2018/REV/1 (OJ L 295, 21.11.2018, p. 39).

(21)  See Activity Report of the Controller of Procedural Guarantees for 2022, subsection 3.3.2.

(22)  Article 5(3) of the Implementing Provisions provides ‘[t]he Controller shall also declare inadmissible any complaint raising issues that fall under the competence of the European Data Protection Supervisor (EDPS), that is complaints relating to the application of Regulation 2018/1725 (EU, Euratom) and the respect of the fundamental right to the protection of personal data.’

(23)  See Activity Report of the Controller of Procedural Guarantees for 2023, op. cit., Section 4.3.

(24)  See Controller’s Opinion on the evaluation of the application and impact of Regulation No 883/2013, op. cit., proposal 19.

(25)  See Commission Decision (EU) 2024/3083 of 4 December 2024 establishing the Code of Good Administrative Behaviour for Staff of the European Commission in their relations with the public (OJ L, 2024/3083, 5.12.2024).

(26)  See footnote 10.

(27)  For more details on the substance of the complaint, see subsection 5.1.2 and Section 5.2 below.

(28)  See footnote 9.

(29)  The Controller declared admissible 7 complaints submitted during 2025. However, she issued closing decisions on the merits for 5 of them during that same year. As mentioned above in Section 2, a decision was taken on the 2 remaining admissible complaints during the first half of 2026.

(30)  The investigations that were the subject of complaints handled by the Controller in 2025 were conducted under the 2021 Guidelines on Investigation Procedures for OLAF staff (the ‘2021 GIPs’), available at: https://anti-fraud.ec.europa.eu/document/download/3dc10699-df07-4782-ae0d-232cd698286c_en?filename=gip_2021_en.pdf. The GIPs were subsequently amended and replaced by a new version, which entered into force on 1 January 2026 (the ‘2026 GIPs’), available at: https://anti-fraud.ec.europa.eu/document/download/e1994c22-7d58-4e61-8d34-0937a0be8f98_en?filename=gips-2026_en.pdf. In order to adopt a forward-looking approach and facilitate the reader’s understanding of the legal framework currently applicable to OLAF investigations and the Controller’s interpretation thereof, references to the 2021 GIPs originally contained in the Controller’s decisions have been adapted in this Annual Report to refer instead to the corresponding provisions of the 2026 GIPs. In the present case, the Controller referenced the relevant provisions of the 2021 GIPs in the decision, but the statements and conclusions drawn by the Controller are equally applicable to the relevant provisions of the 2026 GIPs. Article 9(2) of the 2021 GIPs provided, with a similar wording, that ‘[t]he investigation unit shall inform Members, officials or other servants of the EU institutions, bodies, offices and agencies at the earliest opportunity of their possible implication in an open investigation’.

(31)  See the judgment of 29 June 2022, LA International Cooperation Srl v Commission, T-609/20, ECLI:EU:T:2022:407, paragraphs 22 and 23.

(32)  See the judgment of 20 July 2016, Oikonomopoulos v Commission, T-483/13, ECLI:EU:T:2016:421, paragraphs 229 and 230.

(33)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit., proposal 3.

(34)  As explained in footnote 29, the Controller referenced the relevant provisions of the 2021 GIPs in the decision, but the statements and conclusions drawn by the Controller are equally applicable to the relevant provisions of the 2026 GIPs. In the present case, the Controller notes that Article 17(1) and (4) of the 2021 GIPs correspond, in essence, to Article 47 of the 2026 GIPs.

(35)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit., proposal 4.

(36)  
            Ibid., proposal 5.

(37)  See the judgment of 19 October 2022, Sistem Ecologica v Commission, T-81/21, ECLI:EU:T:2022:641, paragraph 103; and the judgment of 14 June 2016, Marchiani v Parliament, C-566/14, ECLI:EU:C:2016:437, paragraph 51 and the case law cited.

(38)  See the judgment of 4 June 2020, EEAS v De Loecker, C-187/19 P, ECLI EU:C:2020:444, paragraph 68.

(39)  See the judgment of 4 June 2020, EEAS v De Loecker, C-187/19 P, paragraph 69; the judgment of 3 July 2014, Kamino International Logistics and Datema Hellmann Worldwide Logistics, C-129/13 and C-130/13, paragraph 38; and the judgment of 11 December 2014, Boudjlida, C-249/13, paragraphs 37 and 59.

(40)  Article 12c(5) of the OLAF Regulation provides that, under these circumstances, ‘the Office shall not continue its investigation into the same facts other than in accordance with Article 12e or 12f’. This final clarification is due to the fact that, as part of the cooperation between OLAF and the EPPO, the applicable legal framework provides for the possibility of OLAF conducting both support activities and complementary investigations while an EPPO investigation is ongoing. First, OLAF may provide support or complement the EPPO’s activity (in particular by: (i) providing information, analyses – including forensic analyses, expertise and operational support; (ii) facilitating coordination of specific actions of the competent national administrative authorities and bodies of the Union; and (iii) conducting administrative investigations), under the terms laid down in Article 12e of the OLAF Regulation. Second, while EPPO conducts its criminal investigation, OLAF may also initiate a complementary investigation, with a view to facilitating the adoption of precautionary measures or of financial, disciplinary or administrative action, in accordance with the provisions set out in Article 12f of the OLAF Regulation.

(41)  Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (the EPPO) (OJ L 283, 31.10.2017, p. 1).

(42)  See the judgment of 20 July 2016, Oikonomopoulos v Commission, T-483/13, ECLI:EU:T:2016:421, paragraphs 238 to 240 and the case law cited.

(43)  
            Ibid.

(44)  See the judgment of 6 June 2019, Dalli v Commission, T-399/17, ECLI:EU:T:2019:384, paragraphs 143 to 144.

(45)  Under Article 47(2)of the GIPs, these activities can only be conducted following authorisation from the Director-General of OLAF. When the investigative unit plans an investigation activity that requires authorisation from the Director-General, it drafts a request for authorisation and submits it to a specialised OLAF unit, the ‘Review Team’ (see Article 36(2) of the GIPs). The Review Team verifies the legality, necessity and proportionality of the proposed investigative activity and provides an opinion to the Director-General, on the basis of which the Director-General takes a decision (see Article 36(4) of the GIPs). These procedural safeguards are consistent with the EU Courts’ interpretation of the of the principle of proportionality. As a general principle of EU law, that principle requires that acts of EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is necessary in order to achieve those objectives. See, to that effect, the judgment of 16 February 2022, Hungary v Parliament and Council, C-156/21, ECLI:EU:C:2022:97, paragraph 340 and the case law cited.

(46)  See Guidelines on Digital Forensic Procedures for OLAF Staff, available at: https://anti-fraud.ec.europa.eu/investigations/digital-forensics_en.

(47)  See Article 1(7) of the DFPs.

(48)  See Article 1(8) of the DFPs.

(49)  See Article 4(4) of the DFPs.

(50)  See Article 5(4), (5) and (6) of the DFPs.

(51)  See Article 8 of the DFPs.

(52)  As explained in footnote 29, the Controller referenced the relevant provisions of the 2021 GIPs in the decision, but the statements and conclusions drawn by the Controller on the conduct of forensic operations are equally applicable to the relevant provisions of the 2026 GIPs.

(53)  See the judgment of the General Court of 26 June 2019, Vialto Consulting v Commission, T-617/17, ECLI:EU:T:2019:446, paragraph 67 (not published). In the original French: ‘En outre, ainsi que le fait valoir la Commission à juste titre, l’article 7, paragraphe 1, du règlement no 2185/96 ne saurait être interprété d’une manière telle qu’il autorise la personne ou l’entité contrôlée à déterminer elle-même les données pertinentes aux fins d’une enquête de l’OLAF’.

(54)  EU staff includes EU officials and other servants employed under contract by the EU (such as temporary staff, contract staff, local staff, special advisers and accredited parliamentary assistants).

(55)  See Activity Report of the Controller of Procedural Guarantees for 2023, op. cit., subsection 4.4.5.

(56)  See the judgment of 21 October 2009, V v Commission, Case F-33/08, ECLI:EU:F:2009:141, paragraphs 170-171.

(57)  See footnote 10.

(58)  See Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).

(59)  See Commission Decision (EU) 2024/3080 of 4 December 2024 establishing the Rules of Procedure of the Commission and amending Decision C(2000) 3614 (OJ L, 2024/3080, 5.12.2024).

(60)  By the end of 2025, the Controller had handled a total of 73 complaints since the start of her mandate.

(61)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit.


(62)  Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ L 305, 26.11.2019, p. 17).

(63)  Regulation (EU, Euratom) No 1023/2013 of the European Parliament and of the Council of 22 October 2013 amending the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union (OJ L 287, 29.10.2013, p. 15).

(64)  See the judgment of 6 June 2019, Dalli v Commission, T-399/17, ECLI:EU:T:2019:384, upheld by the judgment of 25 February 2021, Dalli v Commission, C-615/19P, ECLI:EU:C:2021:133.

(65)  See redacted version of the Controller’s Opinion on the draft Guidelines on Investigation Procedures (GIPs), available at: https://supervisory-committee-olaf.europa.eu/document/download/4f655d63-4b02-40df-8b93-038c44f1bb2e_en?filename=Opinion%20of%20the%20Controller%20on%20draft%20GIPs_redacted%20final.pdf.

(66)  See Redacted version of the Controller’s Opinion on the draft Guidelines on Investigation Procedures (GIPs), op. cit., third remark.

(67)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit.


(68)  See Activity Report of the Controller of procedural guarantees for 2022, op. cit., subsection 3.5.2. See also Activity Report of the Controller of procedural guarantees for 2024, op. cit., Section. 5.5.

(69)  See Redacted version of the Controller’s Opinion on the draft Guidelines on Investigation Procedures (GIPs), op. cit., second remark.

(70)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit., proposals 9 and 16. See also Activity Report of the Controller of Procedural Guarantees for 2022, op. cit., subsection 3.3.1.; Activity Report of the Controller of Procedural Guarantees for 2023, op. cit., Section 4.1; and Activity Report of the Controller of Procedural Guarantees for 2024, op. cit., Section 4.1.

(71)  See Redacted version of the Controller’s Opinion on the draft Guidelines on Investigation Procedures (GIPs), op. cit., third remark.

(72)  See Controller’s Opinion on the evaluation of the application and impact of Regulation 883/2013, op. cit., proposal 9.

(73)  See Controller’s Opinion on the evaluation of the application and impact of Regulation No 883/2013, op. cit., proposal 24.

(74)  See Article 15(8) of the OLAF Regulation.

(75)  See Controller’s Opinion on the evaluation of the application and impact of Regulation No 883/2013, op. cit., proposal 22.




ANNEX
References

Legal framework

Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).
Regulation (EU, Euratom) 2020/2223 of the European Parliament and of the Council of 23 December 2020 amending Regulation (EU, Euratom) No 883/2013, as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations (OJ L 437, 28.12.2020, p. 49).
Guidelines on investigation procedures for OLAF staff, 11 October 2021, Ref. Ares (2021)6071905 – 06/10/2021, available at: https://anti-fraud.ec.europa.eu/document/download/3dc10699-df07-4782-ae0d-232cd698286c_en?filename=gip_2021_en.pdf.
Guidelines on investigation procedures for OLAF staff, 1 January 2026, Ref. Ares(2025)9710596 – 11/11/2025, available at: https://anti-fraud.ec.europa.eu/document/download/e1994c22-7d58-4e61-8d34-0937a0be8f98_en?filename=gips-2026_en.pdf.
Guidelines on digital forensic procedures for OLAF staff, 15 February 2016, available at: https://anti-fraud.ec.europa.eu/document/download/87e5deb1-8a64-42ca-8e08-234355dbe544_en.
Working Arrangements between the European Anti-Fraud Office and the Controller of Procedural Guarantees, 18 July 2025, Ref. Ares(2025)6027144 – 24/07/2025, available at: https://supervisory-committee-olaf.europa.eu/document/download/ea81e700-4540-4ae6-b7ab-e56fb9a2d075_en?filename=SIGNED_WA_OLAF-Controller.pdf

Decision of the Controller of procedural guarantees adopting implementing provisions for the handling of complaints, 2022/C 494/07 (OJ C 494, 28.12.2022, pp. 17-23), also available at: https://supervisory-committee-olaf.europa.eu/controller-procedural-guarantees/about-controller/legal-framework_en.

Annual activity reports and opinions

Activity Report of the Controller of Procedural Guarantees for 2022 (OJ C 248, 13.7.2023, p. 1), also available at: https://supervisory-committee-olaf.europa.eu/document/download/fdcb45a3-1934-423d-8198-689d2a96bc1c_en?filename=Controller%20-%20Annual%20Report%202022%20.pdf.
Activity Report of the Controller of Procedural Guarantees for 2023 (OJ C, C/2024/5673, 23.9.2024), also available at: https://supervisory-committee-olaf.europa.eu/document/download/5add81b3-44e1-41a4-bdf1-806c1186b9dd_en?filename=Controller-Annual%20Report%202023%20.pdf.
Activity Report of the Controller of Procedural Guarantees for 2024 (OJ C, C/2025/4511, 7.8.2025), also available at: https://supervisory-committee-olaf.europa.eu/document/download/8a8d23c3-9e4c-4f0f-8020-a555e317aa87_en?filename=COAR%202024.pdf.
Controller’s Opinion on the draft Guidelines on Investigation Procedures (GIPs), available at: https://supervisory-committee-olaf.europa.eu/document/download/4f655d63-4b02-40df-8b93-038c44f1bb2e_en?filename=Opinion%20of%20the%20Controller%20on%20draft%20GIPs_redacted%20final.pdf.
Controller’s Opinion on the evaluation of the application and impact of Regulation No 883/2013, Ref. Ares(2026)2209882 – 27/02/2026, available at https://supervisory-committee-olaf.europa.eu/document/download/3c7a4446-920f-4cdb-92a3-f465e766a30e_en?filename=Annex%20-%CTR 20%20Opinion%20on%20evaluation.pdf.



ELI: http://data.europa.eu/eli/C/2026/4270/oj
ISSN 1977-091X (electronic edition)