EUROPEAN COMMISSION

Brussels, 14.11.2025

COM(2025) 685 final

2025/0348(CNS)

Proposal for a

COUNCIL REGULATION

amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level

EXPLANATORY MEMORANDUM

1.CONTEXT OF THE PROPOSAL

•Reasons for and objectives of the proposal

This proposal is addressing the urgent problem of combating intra-Community VAT fraud. In fact, the VAT loss due to the Missing trader intra-Community (MTIC) fraud 4 in 2023 was estimated between an amount of EUR 12.5 and EUR 32.8 billion annually 5 . In 2023, Eurofisc detected MTIC fraudulent transactions for an amount of EUR 12.7 billion, which roughly translates into EUR 2.5 billion in VAT loss (applying a VAT rate of 20%). Considering the prudent estimate of EUR 12.5 billion of VAT loss due to MTIC fraud, compared to the EUR 2.5 billion uncovered by Eurofisc, suggests that the actors involved in the fight against VAT fraud at EU level, such as Eurofisc, the EPPO and OLAF, can be more effective to close that gap. Cross-border VAT fraud is largely driven by organised crime, with a small number of networks responsible for the vast majority of cases. According to Europol and the European Court of Auditors 6 , around 2% of organised crime groups are behind up to 80% of missing trader intra-Community (MTIC) fraud, generating annual VAT revenue losses estimated at EUR 40–60 billion. The European Court of Auditors therefore calls in its report for a common and multidisciplinary approach to effectively tackle intra-Community VAT fraud 7 .

The EPPO may access information stored in databases of law enforcement authorities and registers of other national public authorities under the same conditions as those that apply under national law (Article 43(1)), and of the institutions, bodies, offices and agencies of the Union (Article 43(2)). However, Regulation (EU) No 904/2010 does not include an explicit reference to the EPPO. Furthermore, Regulation (EU) No 904/2010 sets up IT systems for the automated access of relevant information that is “pulled” from national databases but that is not stored at EU level (e.g. the VAT Information Exchange System – VIES), or that is stored at EU level but still accessible only and transmitted by national authorities (e.g. Central Electronic System of Payment data – CESOP). That information is only available to national authorities and not to the Commission. Finally, given that VAT data contains personal data, processing and accessing VAT data must be provided for by law in a clear and foreseeable manner. In consequence, currently access is provided to the EPPO in a decentralised manner, through the competent authorities of the Member States (Article 43(1) of the EPPO Regulation). This modality of access may not allow the EPPO to conduct its investigations with the required degree of speed and effectiveness.

Pursuant to the OLAF Regulation, OLAF is competent to fight against fraud, corruption and any other illegal activity affecting the financial interests of the European Union, including revenues, expenditures and assets covered by the budget of the European Union. The ECJ (C-105/14 9 ) held that the financial interests of the Union also include the Union’s revenue derived from applying a uniform rate to the harmonised VAT assessment bases determined according to EU rules.

The OLAF Regulation provides that OLAF may have access to any relevant information and data, irrespective of the medium on which it is stored, held by the institutions, bodies, offices and agencies, connected with the matter under investigation, where necessary in order to establish whether there has been fraud, corruption or any other illegal activity affecting the financial interests of the Union. Pursuant to the same Regulation, prior to the opening of an investigation, OLAF shall have the right of access to any relevant information in databases held by the institutions, bodies, offices or agencies when this is indispensable in order to assess the basis in fact of allegations. Finally, the competent authorities of Member States shall transmit without delay to OLAF, at its request or on their own initiative, any other information, documents or data considered pertinent which they hold, relating to the fight against fraud, corruption and any other illegal activity affecting the financial interests of the Union.

•Consistency with existing policy provisions in the policy area

•Consistency with other Union policies

This proposal is consistent with Council Regulation (EU) 2017/1939 establishing the EPPO and defining its competence in respect of the criminal offences affecting the financial interests of the Union, as provided for by the PIF Directive, including cross-border VAT fraud involving a total damage of at least EUR 10 million.

This proposal is consistent with the Commission Decision 1999/352/EC 14 establishing OLAF and defining its competence in respect of administrative investigations for the purpose of strengthening the fight against fraud, corruption and any other illegal activity adversely affecting the Community's financial interests, as well as any other act or activity by operators in breach of Community provisions.

This proposal is also consistent with ProtectEU, a European Internal Security Strategy, 15 in so far as it allows better use of both criminal and administrative means, interoperability of IT systems and improved cooperation in the fight against fraud and organised crime. It is coherent with the possibility of a future enhancement of cooperation between Europol and Eurofisc in the framework of the comprehensive assessment of Council Regulation (EU) No 904/2010 and in the framework of the overhaul of Europol’s mandate, as envisaged under ProtectEU.

The proposal respects the current personal data protection legislation, the GDPR 16 , as well as the Regulation (EU) 2018/1725, which applies to Union institutions, bodies, offices and agencies, as well as the standalone data protection regime of Chapter VIII of the EPPO Regulation 17

2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

•Legal basis

•Subsidiarity (for non-exclusive competence)

Providing for the modalities in which the EPPO and OLAF should obtain VAT data that is exchanged under Council Regulation (EU) No 904/2010 (i.e. at Union level) cannot be achieved solely at Member State level or using non-legislative instruments. It can only be achieved by clarifying the relevant legal basis at Union level. Therefore, it is necessary for the Commission to propose action to amend Council Regulation (EU) No 904/2010.

•Proportionality

In respect to the EPPO, the new provisions do not go beyond what is strictly necessary to make VAT data exchanged under administrative cooperation instruments available to the EPPO to make it more efficient in investigating and prosecuting cross-border VAT fraud and enhancing the fight against criminal organisations. Regulating how the EPPO can obtain the information on VAT fraud at Union level, instead of obtaining data from each competent authority of the Member States separately, is necessary for the EPPO to efficiently investigate and prosecute criminal offences affecting the Union’s financial interests provided for in Directive (EU) 2017/1371 18 , and in particular serious cross-border VAT fraud. 

•Choice of the instrument

3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS

•Ex-post evaluations/fitness checks of existing legislation

•Stakeholder consultations

Extensive stakeholder consultations took place during the evaluation and prior to this proposal. In the context of the evaluation, the Commission surveyed the national authorities competent in the field of VAT cooperation and other stakeholders. A questionnaire was made available to Member States in 2023, and all Member States provided their replies in two months. Member States were asked among others about the EPPO-Eurofisc cooperation and EPPO’s access to VAT data. Member States were generally positive in amending the legal framework in respect to the EPPO, while noting the challenge of not all Member States participating in the EPPO and the need for EPPO to access VAT data in the frame of ongoing EPPO investigations. The stakeholders’ views were taken into account while drafting this proposal.

•Collection and use of expertise

•Impact assessment

•Regulatory fitness and simplification

Under the one-in-one-out (OIOO) principle, the Commission committed to offsetting new burdens from legislative proposals by reducing existing burdens in the same policy area, so that negative impacts for businesses and citizens are limited. The offset concerns administrative burdens and not necessarily adjustment costs (e.g. the investment needed for upgrades). This proposal does not have any impact on businesses or citizens and therefore the OIOO principle is fulfilled.

The proposal is ready for the digital environment and relies on existing IT communication tools (Digital Check).

•Fundamental rights

The EPPO Regulation contains a standalone data protection regime for processing of operational personal data, and the OLAF Regulation includes specific provisions to ensure the protection of personal data in accordance with EU data protection standards, particularly Regulation (EU) 2018/1725. Personal data processed by the EPPO – especially data related to criminal investigations – has to be lawful, fair, and only for specified, legitimate purposes. The EPPO Regulation sets limits on data retention, mandates appropriate security measures, and guarantees data subjects' rights such as access, rectification, erasure, and restriction of processing, subject to certain limitations due to the nature of the EPPO's work. It also provides for independent supervision by the European Data Protection Supervisor (EDPS) to ensure compliance. Similarly, as a service of the European Commission, OLAF is subject to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 and is thus under the supervisory powers of the EDPS.

4.BUDGETARY IMPLICATIONS

5.OTHER ELEMENTS

•Implementation plans and monitoring, evaluation and reporting arrangements

•Explanatory documents (for directives)

•Detailed explanation of the specific provisions of the proposal

(a)Under Article 36 (2a),  Eurofisc working field coordinators must communicate spontaneously to the EPPO any indication of suspected fraud based on the information exchanged between Member States on cross-border VAT fraud, in respect of which the EPPO could exercise its competence. Under Article 36 (2b) Eurofisc working field coordinators must communicate to the EPPO upon request any information relevant during the EPPO investigations into VAT fraud.

(b)Under Article 36 (2c) Eurofisc working field coordinators must communicate to OLAF any indication of suspected fraud based on the information exchanged between Member States on cross-border VAT fraud, in accordance with OLAF mandate unless prevented by national law. Under Article 36(2d) Eurofisc working field coordinators must communicate to OLAF upon request any information relevant for OLAF mandate, unless prevented by national law.

(c)Article 36 paragraphs (2a)-(2d) provide access to data collected from Member States but not to any data received by Eurofisc from Europol pursuant to Article 36(3).

(d)In Chapter XIII “RELATIONS WITH THE COMMISSION AND OTHER INSTITUTIONS, BODIES, OFFICES AND AGENCIES OF THE UNION”, under Article 49a, the competent authorities of the Member States must grant the EPPO centralised access for targeted searches to VAT relevant information through the EU IT systems for the purpose of investigating specific criminal offences as defined in Article 4 of the EPPO Regulation. Access will be granted to European Prosecutors, European Delegated Prosecutors and selected staff of the EPPO who hold a personal user identification. This access refers to the information referred to in Article 49a, and does not include access to risk indicators and processes applied by the Eurofisc Liaison officials. The access is limited to targeted searches based on specific data categories, which will be defined in an implementing act and for the purpose of investigating or prosecuting specific suspected criminal offences as referred to in Article 4 of Regulation (EU) 2017/1939, e.g. not for random searches.

(e)In the same Chapter, under Article 49b, the competent authorities of the Member States must grant OLAF centralised access for targeted searches to VAT relevant information through the EU IT systems for the purposes of opening and carrying out investigations in accordance with OLAF tasks. Access will be granted to authorised staff by OLAF who hold a personal user identification. This access refers to the information referred to in Article 49a, and does not include access to risk indicators and process applied by the Eurofisc Liaison officials. The access is limited to targeted searches based on specific data categories, which will be defined in an implementing act and for the purposes of opening and carrying out investigations in accordance with OLAF tasks as referred to in Article 1(1) of Regulation (EU, Euratom) No 883/2013, e.g. not for random searches.

The legal provisions in Article 49a and 49b cover the EPPO’s and OLAF’s access:

(a)Through the VAT Information Exchange System (VIES) to information on VAT identification numbers and intra-Community transactions (Article 17(1) points (a)-(c)),

(b)Through the SURVEILLANCE system to relevant information on VAT exempt importations (Article 17(1) points (e) and (f) related to I/OSS and Customs procedure 42/63 importations),

(c)Through the CESOP system to payment information (Article 24b(3)) .

References to EPPO’s and OLAF’s access according to Articles 49a and 49b are added to Articles 21 and 24d for coherence.

The EPPO and OLAF will be able to obtain information related to the VAT One-Stop-Shop and the SME special scheme (Article 17(1) points (d), (g) respectively) through Eurofisc pursuant the amended Article 36, given the specificities of the relevant IT systems, which do not include central components at EU level and their adaptation would have IT impact to national authorities.

Legal provisions are adapted as of 1 July 2030 to accommodate for the central VIES, which will start operations at that moment and will replace the legacy VIES. A reference to EPPO’s and OLAF’s access to central VIES according to Articles 49a and 49b is added to Article 24k for coherence.

2025/0348 (CNS)

Proposal for a

COUNCIL REGULATION

amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 113 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Parliament 23 ,

Having regard to the opinion of the European Economic and Social Committee 24 ,

Acting in accordance with a special legislative procedure,

Whereas:

(1)Council Regulation (EU) No 904/2010 25 lays down rules on the storage and exchange through electronic means of specific information in the field of value added tax (VAT) that may help to effectuate a correct assessment of VAT, monitor the correct application of VAT, particularly on intra-Community transactions, and combat VAT fraud. However, it does not set out how the European Public Prosecutor’s Office (EPPO) can obtain that information for the exercise of its tasks pursuant to Article 4 of Council Regulation (EU) 2017/1939 26 , or the European Anti-Fraud Office (OLAF) can obtain that information for the exercise of its tasks in accordance with Article 1 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council 27 .

(2)Pursuant to Article 24(1) of Regulation (EU) 2017/1939, the institutions, bodies, offices and agencies of the Union and the authorities of the Member States competent under applicable national law are to report to the EPPO, without undue delay, any criminal conduct, including cross-border  VAT fraud, in respect of which it could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation. Cross-border VAT fraud is by definition involving several Member States, and the flow of information from individual Member States to the EPPO does not fit the purpose of combating VAT fraud at EU level. Therefore, in order for the EPPO to be informed of VAT fraud risks at EU level and to perform its regulatory mandate, it is necessary to set out in more detail the modalities under which the Member States, within the Eurofisc network referred to in Article 33 of Regulation (EU) No 904/2010, should report to the EPPO any suspicious indication and eventually precise information on VAT fraud. Furthermore, pursuant to Article 24(9) of Regulation (EU) 2017/1939, in specific cases, the EPPO may request further relevant information available to the institutions, bodies, offices and agencies of the Union and the authorities of the Member States. Therefore, it is appropriate to set out the rules under which Member States within Eurofisc should communicate to the EPPO information on cross-border VAT fraud following an EPPO request.

(3)Pursuant to Article 43(1) of Regulation (EU) 2017/1939, European Delegated Prosecutors are to be able to obtain any relevant information stored in national databases, as well as relevant registers of public authorities, under the same conditions as those that apply under national law in similar cases. Pursuant to Article 43(2) of that Regulation, the EPPO is also to be able to obtain any relevant information falling within its competence that is stored in databases and registers of the institutions, bodies, offices and agencies of the Union. Cross-border VAT fraud is by definition involving several Member States, and the access at Member State level to relevant information stored in national database is not sufficient for the EPPO for combating VAT fraud at EU level. Therefore, without prejudice to Article 43 of Regulation (EU) 2017/1939,  in order for the EPPO to have access to information at EU level and to perform its regulatory mandate and fight against fraud at EU level, it is important to define the rules under which the EPPO should obtain relevant VAT information at Union level from databases and registers of competent authorities as referred to in Article 1(1) of Council Regulation (EU) No 904/2010. For the same reason, it is important to give the EPPO a centralised access, for targeted searches, to all the information concerning an investigation through a single-entry point, even if that information concerns several Member States.

(4)The Member States not participating in the EPPO are obliged, under the principle of sincere cooperation enshrined in Article 4(3) of the Treaty on European Union, to support the activities of the EPPO and to refrain from any action that could jeopardise the attainment of its objectives. Eurofisc is composed of both Member States participating and not participating in the EPPO. Therefore, it is important to have a clear legal basis for the EPPO access to information processed by Eurofisc.

(5)The European Court of Auditors has recommended that the Commission and the Member States remove legal obstacles preventing the exchange of information between administrative, judicial and law enforcement authorities at national and Union level and in particular that OLAF has access to the VAT information exchange system (VIES) and Eurofisc data 28 . In that respect it is important that a central access to EU IT systems is set out in a clear legal basis.

(6)Pursuant to Article 8(3) of Regulation (EU, Euratom) No 883/2013, the competent authorities of Member States are to transmit without delay to OLAF, at its request or on their own initiative, any other information, documents or data considered pertinent which they hold, relating to the fight against fraud, corruption and any other illegal activity affecting the financial interests of the Union. Cross-border VAT fraud is by definition involving several Member States, and the flow of information to OLAF does not fit the purpose of combating VAT fraud at EU level. Therefore, in order for OLAF to be informed on VAT fraud at EU level and to perform its regulatory mandate it is necessary to set out the detailed rules under which the Member States, within the Eurofisc network referred to in Article 33 of Regulation (EU) No 904/2010, should report to OLAF any suspicious indication and eventually precise information on cross-border VAT fraud, either on their own initiative or at the request of OLAF.

(7) Pursuant to Article 3(11) of Regulation (EU, Euratom) No 883/2013, OLAF may have access to any relevant information and data, irrespective of the medium on which it is stored, held by the  institutions, bodies, offices and agencies, connected with the matter under investigation, where necessary in order to establish whether there has been fraud, corruption or any other illegal activity affecting the financial interests of the Union. Pursuant to Article 6(1) of Regulation (EU, Euratom) No 883/2013, prior to the opening of an investigation, OLAF is to have the right of access to any relevant information in databases held by the institutions, bodies, offices or agencies when this is indispensable in order to assess the basis in fact of allegations while respecting the principles of necessity and proportionality. That right of access is to be exercised under the conditions set out in Regulation (EU, Euratom) No 883/2013 . Cross-border VAT fraud is by definition involving several Member States, but Regulation (EU) No 904/2010 does not give OLAF access to information exchanged or stored in the EU IT systems, thus jeopardising OLAF capacity for combating VAT fraud at EU level. Therefore, in order for OLAF to access VAT information at EU level and to perform its regulatory mandate and fight against fraud at EU level it is important to define the rules under which OLAF should access relevant VAT information at Union level from databases and registers of competent authorities referred to Article 1(1) of Regulation (EU) No 904/2010. For the same reason, it is important to give OLAF a centralised access, for targeted searches, to all the information concerning an investigation through a single-entry point, even if that information concerns several Member States.

(8)Information on intra-Community transactions, cross-border payments and VAT exempt importations is important for the fight against fraud. That information is stored by national competent authorities.  With regard to the protection of personal data, the Commission is facilitating the exchange of that information as data processor and the competent authorities in the Member States act as data controllers, under Regulation (EU) 2018/1725 of the European Parliament and of the Council 29  and Regulation (EU) 2016/679 of the European Parliament and of the Council 30 respectively. The EPPO and OLAF’s centralised access to VAT information at Union level should be granted without prejudice to the roles and responsibilities of the competent authorities in the Member States as referred to Article 1(1) of Regulation (EU) No 904/2010 in respect of the protection of personal data under Regulation (EU) 2016/679.

(9)In order to protect the access to personal data, only the European Prosecutors, the European Delegated Prosecutors, as well as selected staff of the EPPO and OLAF, previously authorised respectively by the EPPO and OLAF, should access VAT information to execute their tasks, under the oversight of the Eurofisc Liaison officials. To ensure uniform conditions for that access, implementing powers should be conferred on the Commission in respect of the technical details and practical arrangements, including on access control mechanism and users’ profile and identification. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council 31 . 

(10)This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, particularly the right of protection of personal data.

(11)As the systems, infrastructure and technical means facilitating the exchange of VAT information at Union level need to be adapted to allow secure access of EPPO and OLAF, it is necessary to defer the application of the relevant provisions in order to allow the Member States, the Commission, the EPPO and OLAF to carry out the necessary adaptations. This should consider the dates when the central VIES will become operational and the legacy VIES will be phased out. The EPPO and OLAF should be responsible for the costs of establishing and maintaining the relevant infrastructure and technical means for secure access to VAT information.

(12)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on […].

(13)Regulation (EU) No 904/2010 should therefore be amended accordingly,

HAS ADOPTED THIS REGULATION:

Article 1

Amendments to Regulation (EU) No 904/2010

Regulation (EU) No 904/2010 is amended as follows:

(1)In Article 21, the following paragraph 2c is inserted:

‘2c.    Every Member State shall grant to the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) access to the information referred to, and in compliance with the limits and rules set out in, Article 49a and 49b.’;

(2)Article 24d is replaced by the following:

‘Article 24d

1. Access to CESOP shall be granted to Eurofisc liaison officials, as referred to in Article 36(1), who hold a personal user identification for CESOP and where that access is in connection with an investigation into suspected VAT fraud or is to detect VAT fraud.

2. The EPPO and OLAF shall access CESOP information in compliance with the limits and rules set in Article 49a and 49b.’;

(3)In Article 24k, the following paragraph 1a is inserted:

‘1a.    The EPPO and OLAF shall access the central VIES information in compliance with the limits and rules set in Article 49a and 49b’;

(4)In Article 36, the following paragraphs 2a, 2b, 2c and 2d are inserted:

‘2a.    Eurofisc working field coordinators shall communicate to the EPPO, in accordance with Article 24(1) of Council Regulation (EU) 2017/1939* as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, without undue delay any indication of suspected cross-border VAT fraud based on information communicated or collected pursuant to this Regulation in respect of which the EPPO could exercise its competence.

2b    In the course of an investigation or a prosecution by, and at the request of the EPPO, in accordance with Article 24(9) of Council Regulation (EU) 2017/1939 as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, Eurofisc working field coordinators shall communicate to the EPPO, any information from Member States on cross-border VAT fraud communicated or collected under this Regulation.

2c.    In accordance with Article 8, (2) and (3), of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council** Eurofisc working field coordinators shall communicate to OLAF without delay any indication of suspected cross-border VAT fraud based on information from Member States communicated or collected pursuant to this Regulation to enable OLAF to consider appropriate action in accordance with its mandate.

2d. In accordance with Article 8 (2) and (3) of Regulation (EU, Euratom) No 883/2013 and at the request of OLAF, Eurofisc working field coordinators shall communicate to OLAF any information from Member States on cross-border VAT fraud communicated or collected pursuant to this Regulation to enable OLAF to consider appropriate action in accordance with its mandate.

* Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj).

** Regulation (EU, EURATOM) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248 18.9.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/883/oj).’;

(5)in Chapter XIII, the following Articles 49a and 49b are added:

‘Article 49a

1.Without prejudice to Article 43 of Regulation (EU) 2017/1939, the competent authorities of the Member States shall grant to EPPO centralised access, for targeted searches the following information:

(a)From 1 September 2026 until 30 June 2032, the information referred to in Article 17(1), points (a), (b) and (c), of this Regulation;

(b)From 1 September 2026, the information referred to in Article 17(1), points (e) and (f), of this Regulation;

(c)From 1 September 2026, the information referred to in Article 24b(3) of this Regulation;

(d)From 1 July 2030, the information referred to in Article 24g(2) of this Regulation.

2.The centralised access referred to in paragraph 1 shall be granted under all of the following conditions: 

(a)to European Prosecutors, European Delegated Prosecutors, and staff authorised by the EPPO’s Central Office who hold a personal user identification for the electronic systems allowing centralised access to the information referred to in paragraph 1 of this Article;

(b)for the purpose of investigating or prosecuting specific suspected criminal offences as referred to in Article 4 of Regulation (EU) 2017/1939;

(c)under the oversight of the Eurofisc Liaison officials.

3.That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States.

4.The Commission shall determine, by means of implementing acts, the following:

(a)the technical details concerning the centralised access to the information referred to in paragraph 1of this Article including the list of data categories, with which the targeted searches can be carried out;

(b)the practical arrangements, including access control mechanism and users profile, to identify the users referred to in paragraph 2, point (a) and (c), of this Article;

(c)the practical arrangements for the oversight of the Eurofisc Liaison officials.

The implementing acts referred to in the first subparagraph shall be adopted in accordance with the examination procedure referred to in Article 58(2) of this Regulation.

5.The costs of establishing, operating and maintaining the infrastructure and technical means allowing the secure access to the information referred to in paragraph 1 of this Article shall be borne by the EPPO.

Article 49b

1.    The competent authorities of the Member States shall grant to OLAF centralised access for targeted searches to the following information:

(a)From 1 September 2026 until 30 June 2032, the information referred to in Article 17(1), points (a), (b) and (c), of this Regulation;

(b)From 1 September 2026, the information referred to in Article 17(1), points (e) and (f), of this Regulation;

(c)From 1 September 2026, the information referred to in Article 24b(3) of this Regulation;

(d)From 1 July 2030, the information referred to in Article 24g(2) of this Regulation.

2.    The centralised access referred to in paragraph 1 shall be granted under all of the following conditions:

(a)    to staff authorised by OLAF who hold a personal user identification for the electronic systems allowing the centralised access to the information referred to in paragraph 1 of this Article;

(b)    for the purposes of opening and carrying out investigations in accordance with OLAF tasks as referred to in Article 1(1) of Regulation (EU, Euratom) No 883/2013;

(c)    under the oversight of the Eurofisc Liaison officials.

3.    That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States.

4.    The Commission shall determine by means of implementing acts the following:

(a)the technical details concerning the centralised access to the information referred to in paragraph 1 of this Article including the list of data categories, with which the targeted searches can be carried out;

(b)the practical arrangements, including access control mechanism and users profile, to identify the users referred to in paragraph 2, point (a) and (c), of this Article;

(c)the practical arrangements for the oversight of the Eurofisc Liaison officials.

   The implementing acts referred to in the first subparagraph shall be adopted in accordance with the examination procedure referred to in Article 58(2), of this Regulation.

5.    The costs of establishing, operating and maintaining the infrastructure and technical means allowing the secure access to the information referred to in paragraph 1 of this Article shall be borne by OLAF.’.

Article 2

Entry into force and date of application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 1, points (1), (2), (4) and (5) shall apply from 1 September 2026.

Article 1, point (3), shall apply from 1 July 2030.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,

LEGISLATIVE FINANCIAL AND DIGITAL STATEMENT

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE3

1.1.Title of the proposal/initiative3

1.2.Policy area(s) concerned3

1.3.Objective(s)3

1.3.1.General objective(s)3

1.3.2.Specific objective(s)3

1.3.3.Expected result(s) and impact3

1.3.4.Indicators of performance3

1.4.The proposal/initiative relates to:4

1.5.Grounds for the proposal/initiative4

1.5.1.Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative4

1.5.2.Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value resulting from EU action, that is additional to the value that would have been otherwise created by Member States alone.4

1.5.3.Lessons learned from similar experiences in the past4

1.5.4.Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments5

1.5.5.Assessment of the different available financing options, including scope for redeployment5

1.6.Duration of the proposal/initiative and of its financial impact6

1.7.Method(s) of budget implementation planned6

2.MANAGEMENT MEASURES8

2.1.Monitoring and reporting rules8

2.2.Management and control system(s)8

2.2.1.Justification of the budget implementation method(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed8

2.2.2.Information concerning the risks identified and the internal control system(s) set up to mitigate them8

2.2.3.Estimation and justification of the cost-effectiveness of the controls (ratio between the control costs and the value of the related funds managed), and assessment of the expected levels of risk of error (at payment & at closure)8

2.3.Measures to prevent fraud and irregularities9

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE10

3.1.Heading(s) of the multiannual financial framework and expenditure budget line(s) affected10

3.2.Estimated financial impact of the proposal on appropriations12

3.2.1.Summary of estimated impact on operational appropriations12

3.2.1.1.Appropriations from voted budget12

3.2.1.2.Appropriations from external assigned revenues17

3.2.2.Estimated output funded from operational appropriations22

3.2.3.Summary of estimated impact on administrative appropriations24

3.2.3.1. Appropriations from voted budget24

3.2.3.2.Appropriations from external assigned revenues24

3.2.3.3.Total appropriations24

3.2.4.Estimated requirements of human resources25

3.2.4.1.Financed from voted budget25

3.2.4.2.Financed from external assigned revenues26

3.2.4.3.Total requirements of human resources26

3.2.5.Overview of estimated impact on digital technology-related investments28

3.2.6.Compatibility with the current multiannual financial framework28

3.2.7.Third-party contributions28

3.3.Estimated impact on revenue29

4.Digital dimensions29

4.1.Requirements of digital relevance30

4.2.Data30

4.3.Digital solutions31

4.4.Interoperability assessment31

4.5.Measures to support digital implementation32

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE 

1.1.Title of the proposal/initiative

1.2.    Policy area(s) concerned 

1.3.Objective(s)

1.3.1.General objective(s)

1.3.2.Specific objective(s)

1.3.3.Expected result(s) and impact

Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted.

1.3.4.Indicators of performance

Specify the indicators for monitoring progress and achievements.

1.4.The proposal/initiative relates to: 

 a new action 

 a new action following a pilot project / preparatory action 32  

 the extension of an existing action 

 a merger or redirection of one or more actions towards another/a new action

1.5.Grounds for the proposal/initiative 

1.5.1.Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative

1.5.2.Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value resulting from EU action, that is additional to the value that would have been otherwise created by Member States alone.

1.5.3.Lessons learned from similar experiences in the past

1.5.4.Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments

1.5.5.Assessment of the different available financing options, including scope for redeployment

1.6.Duration of the proposal/initiative and of its financial impact

 limited duration

–    in effect from [DD/MM]YYYY to [DD/MM]YYYY

–    financial impact from YYYY to YYYY for commitment appropriations and from YYYY to YYYY for payment appropriations.

 unlimited duration

–Implementation with a start-up period from 2025 to 2030,

–followed by full-scale operation.

1.7.Method(s) of budget implementation planned

Direct management by the Commission

– by its departments, including by its staff in the Union delegations;

–    by the executive agencies

 Shared management with the Member States

 Indirect management by entrusting budget implementation tasks to:

– third countries or the bodies they have designated

– international organisations and their agencies (to be specified)

– the European Investment Bank and the European Investment Fund

– bodies referred to in Articles 70 and 71 of the Financial Regulation

– public law bodies

– bodies governed by private law with a public service mission to the extent that they are provided with adequate financial guarantees

– bodies governed by the private law of a Member State that are entrusted with the implementation of a public-private partnership and that are provided with adequate financial guarantees

– bodies or persons entrusted with the implementation of specific actions in the common foreign and security policy pursuant to Title V of the Treaty on European Union, and identified in the relevant basic act

–bodies established in a Member State, governed by the private law of a Member State or Union law and eligible to be entrusted, in accordance with sector-specific rules, with the implementation of Union funds or budgetary guarantees, to the extent that such bodies are controlled by public law bodies or by bodies governed by private law with a public service mission, and are provided with adequate financial guarantees in the form of joint and several liability by the controlling bodies or equivalent financial guarantees and which may be, for each action, limited to the maximum amount of the Union support.

2.MANAGEMENT MEASURES 

2.1.Monitoring and reporting rules 

2.2.Management and control system(s) 

2.2.1.Justification of the budget implementation method(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed

2.2.2.Information concerning the risks identified and the internal control system(s) set up to mitigate them

2.2.3.Estimation and justification of the cost-effectiveness of the controls (ratio between the control costs and the value of the related funds managed), and assessment of the expected levels of risk of error (at payment & at closure) 

2.3.Measures to prevent fraud and irregularities 

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE

The digital solution, consists in:

·establishing the network connectivity between TAXUD and the EPPO on the other side, as depicted on the above diagram;

·granting access to OLAF and EPPO users;

·Providing the EPPO and OLAF with a VIES and OSS / IOSS web interface to query these two systems;

·Provide the EPPO and OLAF access to Surv.3 data.

The following assumptions / considerations have been made:

·The assessment includes all types of costs from development to infrastructure to service delivery;

·User to System access to the different types of data sources is implemented implying moderate volume of data exchanges;

·All cost elements are split by 50% ratio to the EPPO and OLAF with the exception of network connectivity which is 2/3 for the EPPO and 1/3 for OLAF due to the complexity of the EPPO connectivity (outside of Commission security perimeter).

3.1.Heading(s) of the multiannual financial framework and expenditure budget line(s) affected 

·Existing budget lines

In order of multiannual financial framework headings and budget lines.

Heading of multiannual financial framework	Budget line	Type of expenditure	Contribution
	Number	Diff./Non-diff. 33	from EFTA countries 34	from candidate countries and potential candidates 35	From other third countries	other assigned revenue
Heading 1	E.03040100 – EPPO	Diff.	NO	NO	NO	NO
Heading 1	E.03040100 -- OLAF	Diff.	NO	NO	NO	NO

3.2.Estimated financial impact of the proposal on appropriations 

3.2.1.Summary of estimated impact on operational appropriations 

–    The proposal/initiative does not require the use of operational appropriations

–The proposal/initiative requires the use of operational appropriations, as explained below

3.2.1.1.Appropriations from voted budget

EUR million (to three decimal places)

Heading of multiannual financial framework

Number

DG: TAXUD												Year			Year			Year	Year			TOTAL MFF 2021-2027
												2024			2025			2026	2027
Operational appropriations
E.03040100 (Fiscalis) - EPPO							Commitments			(1a)					0.950			0.475	0.380			1.805
							Payments			(2a)								0.950	0.475			1.425
E.03040100 (Fiscalis) - OLAF								Commitments			(1b)					0.850			0.425	0.340			1.615
							Payments			(2b)								0.850	0.425			1.275
Appropriations of an administrative nature financed from the envelope of specific programmes
Budget line										(3)												0.000
TOTAL appropriations for DG TAXUD							Commitments			=1a+1b+3		0.000			1.800			0.900	0.720			3.420
							Payments			=2a+2b+3		0.000			0.000			1.800	0.900			2.700
								Year			Year				Year			Year				TOTAL MFF 2021-2027
								2024			2025				2026			2027
TOTAL operational appropriations			Commitments		(4)			0.000			1.800				0.900			0.720				3.420
			Payments		(5)			0.000			0.000				1.800			0.900				2.700
TOTAL appropriations of an administrative nature financed from the envelope for specific programmes					(6)			0.000			0.000				0.000			0.000				0.000
TOTAL appropriations under HEADING 1			Commitments		=4+6			0.000			1.800				0.900			0.720				3.420
of the multiannual financial framework			Payments		=5+6			0.000			0.000				1.800			0.900				2.700
										Year			Year			Year			Year				TOTAL MFF 2021-2027
										2024			2025			2026			2027
• TOTAL operational appropriations (all operational headings)				Commitments		(4)				0.000			1.800			0.900			0.720				3.420
				Payments		(5)				0.000			0.000			1.800			0.900				2.700
• TOTAL appropriations of an administrative nature financed from the envelope for specific programmes (all operational headings)						(6)				0.000			0.000			0.000			0.000				0.000
TOTAL appropriations Under Heading 1 to 6				Commitments		=4+6				0.000			1.800			0.900			0.720				3.420
of the multiannual financial framework (Reference amount)				Payments		=5+6				0.000			0.000			1.800			0.900				2.700

Heading of multiannual financial framework		7	‘Administrative expenditure’
DG: TAXUD						Year	Year	Year	Year	TOTAL MFF 2021-2027
						2024	2025	2026	2027
 Human resources						0.000	0.188	0.094	0.094	0.376
 Other administrative expenditure						0.000	0.000	0.000	0.000	0.000
TOTAL DG TAXUD	Appropriations					0.000	0.188	0.094	0.094	0.376
TOTAL appropriations under HEADING 7 of the multiannual financial framework				(Total commitments = Total payments)		0.000	0.188	0.094	0.094	0.376

EUR million (to three decimal places)

		Year	Year	Year	Year	TOTAL MFF 2021-2027
		2024	2025	2026	2027
TOTAL appropriations under HEADINGS 1 to 7	Commitments	0.000	1.988	0.994	0.814	3.796
of the multiannual financial framework	Payments	0.000	0.188	1.894	0.994	3.076

   

3.2.3.Summary of estimated impact on administrative appropriations 

–    The proposal/initiative does not require the use of appropriations of an administrative nature

–The proposal/initiative requires the use of appropriations of an administrative nature, as explained below

3.2.3.1. Appropriations from voted budget

VOTED APPROPRIATIONS	Year	Year	Year	Year	TOTAL 2021 - 2027
	2024	2025	2026	2027
HEADING 7
Human resources	0.000	0.188	0.094	0.094	0.376
Other administrative expenditure	0.000	0.000	0.000	0.000	0.000
Subtotal HEADING 7	0.000	0.188	0.094	0.094	0.376
Outside HEADING 7
Human resources	0.000	0.000	0.000	0.000	0.000
Other expenditure of an administrative nature	0.000	0.000	0.000	0.000	0.000
Subtotal outside HEADING 7	0.000	0.000	0.000	0.000	0.000
TOTAL	0.000	0.188	0.094	0.094	0.376

3.2.3.3.Total appropriations

TOTAL VOTED APPROPRIATIONS + EXTERNAL ASSIGNED REVENUES	Year	Year	Year	Year	TOTAL 2021 - 2027
	2024	2025	2026	2027
HEADING 7
Human resources	0.000	0.188	0.094	0.094	0.376
Other administrative expenditure	0.000	0.000	0.000	0.000	0.000
Subtotal HEADING 7	0.000	0.188	0.094	0.094	0.376
Outside HEADING 7
Human resources	0.000	0.000	0.000	0.000	0.000
Other expenditure of an administrative nature	0.000	0.000	0.000	0.000	0.000
Subtotal outside HEADING 7	0.000	0.000	0.000	0.000	0.000
TOTAL	0.000	0.188	0.094	0.094	0.376

The appropriations required for human resources and other expenditure of an administrative nature will be met by appropriations from the DG that are already assigned to management of the action and/or have been redeployed within the DG, together, if necessary, with any additional allocation which may be granted to the managing DG under the annual allocation procedure and in the light of budgetary constraints.

3.2.4.Estimated requirements of human resources 

–    The proposal/initiative does not require the use of human resources

–    The proposal/initiative requires the use of human resources, as explained below

3.2.4.1.Financed from voted budget

Estimate to be expressed in full-time equivalent units (FTEs)

VOTED APPROPRIATIONS		Year	Year	Year	Year
		2024	2025	2026	2027
 Establishment plan posts (officials and temporary staff)
20 01 02 01 (Headquarters and Commission’s Representation Offices)		0	1	0.5	0.5
20 01 02 03 (EU Delegations)		0	0	0	0
01 01 01 01 (Indirect research)		0	0	0	0
01 01 01 11 (Direct research)		0	0	0	0
Other budget lines (specify)		0	0	0	0
• External staff (in FTEs)
20 02 01 (AC, END from the ‘global envelope’)		0	0	0	0
20 02 03 (AC, AL, END and JPD in the EU Delegations)		0	0	0	0
Admin. Support line [XX.01.YY.YY]	- at Headquarters	0	0	0	0
	- in EU Delegations	0	0	0	0
01 01 01 02 (AC, END - Indirect research)		0	0	0	0
01 01 01 12 (AC, END - Direct research)		0	0	0	0
Other budget lines (specify) - Heading 7		0	0	0	0
Other budget lines (specify) - Outside Heading 7		0	0	0	0
TOTAL		0	1	0.5	0.5

Considering the overall strained situation in Heading 7, in terms of both staffing and the level of appropriations, the human resources required will be met by staff from the DG who are already assigned to the management of the action and/or have been redeployed within the DG or other Commission services.

The staff required to implement the proposal (in FTEs):

	To be covered by current staff available in the Commission services	Exceptional additional staff*
		To be financed under Heading 7 or Research	To be financed from BA line	To be financed from fees
Establishment plan posts	1	0	N/A	0
External staff (CA, SNEs, INT)	0	0	0	0

Description of tasks to be carried out by:

Officials and temporary staff	The person will have the role of project manager. The person will be responsible for scoping, planning, and overall coordination with the various stakeholders, as well as assessing risks and identifying mitigation measures. The person will hold overall responsibility for the execution of the project.
External staff	NA

3.2.5.Overview of estimated impact on digital technology-related investments

Compulsory: the best estimate of the digital technology-related investments entailed by the proposal/initiative should be included in the table below.

Exceptionally, when required for the implementation of the proposal/initiative, the appropriations under Heading 7 should be presented in the designated line.

The appropriations under Headings 1-6 should be reflected as “Policy IT expenditure on operational programmes”. This expenditure refers to the operational budget to be used to re-use/ buy/ develop IT platforms/ tools directly linked to the implementation of the initiative and their associated investments (e.g. licences, studies, data storage etc). The information provided in this table should be consistent with details presented under Section 4 “Digital dimensions”.

TOTAL Digital and IT appropriations 36	Year	Year	Year	Year	TOTAL MFF 2021 - 2027
	2024	2025	2026	2027
HEADING 7
IT expenditure (corporate)	0.000	0.000	0.000	0.000	0.000
Subtotal HEADING 7	0.000	0.000	0.000	0.000	0.000
Outside HEADING 7
Policy IT expenditure on operational programmes	0.000	1.800	0.900	0.720	3.420
Subtotal outside HEADING 7	0.000	1.800	0.900	0.720	3.420
TOTAL	0.000	1.800	0.900	0.720	3.420

3.2.6.Compatibility with the current multiannual financial framework 

The proposal/initiative:

–can be fully financed through redeployment within the relevant heading of the multiannual financial framework (MFF)

–    requires use of the unallocated margin under the relevant heading of the MFF and/or use of the special instruments as defined in the MFF Regulation

–    requires a revision of the MFF

3.2.7.Third-party contributions 

The proposal/initiative:

–does not provide for co-financing by third parties

–    provides for the co-financing by third parties estimated below:

Appropriations in EUR million (to three decimal places)

	Year 2024	Year 2025	Year 2026	Year 2027	Total
Specify the co-financing body
TOTAL appropriations co-financed

3.3.    Estimated impact on revenue 

–The proposal/initiative has no financial impact on revenue.

–    The proposal/initiative has the following financial impact:

–    on own resources

–    on other revenue

–    please indicate, if the revenue is assigned to expenditure lines

EUR million (to three decimal places)

Budget revenue line:	Appropriations available for the current financial year	Impact of the proposal/initiative 37
		Year 2024	Year 2025	Year 2026	Year 2027
Article ………….

For assigned revenue, specify the budget expenditure line(s) affected.

Other remarks (e.g. method/formula used for calculating the impact on revenue or any other information).

4.Digital dimensions

The effectiveness of this initiative relies on a strong digital foundation, enabling timely, secure, and structured access to VAT-related data across the EU. Key digital enablers include: •    Use of existing EU infrastructures Data exchange should be built on established secure channels such as the Common Communication Network (CCN), ensuring reliability and confidentiality. •Interoperable and structured access OLAF and EPPO should benefit from a harmonised, role-based digital access point covering VIES, IOSS, CESOP, CP42 surveillance reports, and TNA, in line with EU interoperability standards.

4.1.Requirements of digital relevance

To strengthen the EU's capacity to combat fraud effectively, it is essential to ensure that both the European Public Prosecutor's Office (EPPO) and the European Anti-Fraud Office (OLAF) have timely and secure access to key datasets related to VAT operations and compliance. The following access requirements should be implemented: ·VIES (VAT Information Exchange System), Enable the EPPO and OLAF to retrieve intra-EU VAT registration and transaction information ·IOSS (Import One Stop Shop Data), grant visibility into IOSS trader registration details · Surveillance Reports on IOSS and Customs Procedure 42 (CP42), provide analytical and transactional reports on the use of IOSS and CP42 ·CESOP (Central Electronic System of Payment Information), facilitate access to cross-border payment data ·TNA (Transaction Network Analysis) Data, allow Eurofisc to share specific information stored in the TNA system with direct consultation These data access measures should be governed by strict confidentiality protocols, limited to cases of legitimate investigative interest, and integrated into existing EU-level antifraud frameworks.

Reference to the requirement	Requirement description	Actor affected or concerned by the requirement	High-level Processes	Category
Article 36	Eurofisc working field coordinators shall communicate any information on cross-border VAT fraud to the EPPO and OLAF	EPPO, OLAF, Eurofisc	Report	Data
Article 49a, 49b	Member States shall grant the EPPO and OLAF access to the information points referred to in (a)-(c) of Article 17(1) (intra-Community transactions - VIES)	EPPO, OLAF Member States, Eurofisc	Access registry; Monitor;	Digital Solution(s);
Article 49a, 49b	Member States shall grant the EPPO and OLAF access the information points referred to in (e), (f) of Article 17(1), (customs information relevant for VAT controls at import, VAT exempt imports, IOSS imports)	EPPO, OLAF, Member States, Eurofisc	Access registry; Monitor;	Digital Solution(s);
Article 49a, 49b	Member States shall grant the EPPO and OLAF access to the information points referred to in Article 24b(3) (payment information – CESOP)	EPPO, OLAF, Member States, Eurofisc	Access registry; Monitor;	Digital Solution(s);

4.2.Data

EPPO and OLAF should be granted controlled, centralised access to specific datasets from: ·VIES (VAT Information Exchange System) Provides information on the validity of VAT numbers and intra-EU transactions. ·IOSS (Import One Stop Shop) Contains details on IOSS-registered traders and import declarations ·Surveillance Reports on IOSS and CP42 These contain information on importations under IOSS and CP42 (import with VAT exemption followed by intra-EU supply). ·CESOP (Central Electronic System of Payment Information) Aggregates payment data from payment service providers (PSPs) on cross-border transactions. ·TNA (Transaction Network Analysis) Contains Eurofisc information on VAT fraud Data Flow and Access Mechanism ·Data is primarily collected at national level by tax and customs authorities and transmitted to EU-level platforms (e.g. CESOP, VIES, TNA). ·OLAF and EPPO would access this data through secure, role-based interfaces, without altering the existing reporting flows. ·Access is limited and subject to strict confidentiality and audit protocols.

Type of data	Reference(s) to the requirement	Standard and/or specification (if applicable)
any information on VAT fraud	Article 36	When relevant, according to the commonly agreed formats used in Eurofisc exchanged over existing secure communication channels.
information points referred to in (a)-(c) of Article 17(1) (intra-Community transactions - VIES)	Article 49a(1), Article 49b(1)	In accordance with the common standardised format set out in VIES functional specifications
information points referred to in (e), (f) of Article 17(1), (customs information relevant for VAT controls at import, VAT exempt imports, IOSS imports)	Article 49a(1), Article 49b(1)	In accordance with the common standardised format set out in Commission Implementing Regulation (EU) No 79/2012 38
information points referred to in Article 24b(3) (payment information – CESOP)	Article 49a(1), Article 49b(1)	In accordance with the common standardised format set out in Commission Implementing Regulation (EU) 2022/1504 39

Data flows

Type of data	Reference(s) to the requirement(s)	Actor who provides the data	Actor who receives the data	Trigger for the data exchange	Frequency (if applicable)
any information on cross-border VAT fraud	Article 36	Eurofisc	EPPO, OLAF	Spontaneous or upon request	N/A
information points referred to in (a)-(c) of Article 17(1) (intra-Community transactions - VIES)	Article 49a, 49b	Member States	EPPO, OLAF	Spontaneous	N/A
information points referred to in (e), (f) of Article 17(1), (customs information relevant for VAT controls at import, VAT exempt imports, IOSS imports)	Article 49a, 49b	Member States	EPPO, OLAF	Spontaneous	N/A
information points referred to in Article 24b(3) (payment information – CESOP)	Article 49a, 49b	Member States	EPPO, OLAF	Spontaneous	N/A

4.3.Digital solutions

The digital solution consists in extending access to existing VAT-related EU systems for OLAF and the EPPO, without creating new ones. It includes three core components: ·Ensuring secure network connectivity between OLAF/EPPO and the relevant EU-level systems (VIES, IOSS, CESOP, TNA, CP42 surveillance reports); ·Adapting existing software modules, notably for access rights management, user provisioning, and audit logging; ·Developing dedicated reports and views in CESOP and TNA, tailored to OLAF and EPPO, while respecting data protection and access limitation principles. This targeted solution builds on the current infrastructure and governance model, minimising complexity while ensuring operational effectiveness.

Digital solution	Reference(s) to the requirement(s)	Main mandated functionalities	Responsible body	How is accessibility catered for?	How is reusability considered?	Use of AI technologies (if applicable)
Existing IT tools used by Eurofisc	Article 36	Information exchange (spontaneous or upon request)	Eurofisc	Reuse of Eurofisc practices	Existing tools will be reused	NO
VIES	Article 49a(1) Article 49b(1)	Information access	Member States / Commission	The Commission adopts an implementing act	Existing tools will be reused	NO
SURVEILLANCE	Article 49a(1) Article 49b(1)	Information access	Member States / Commission	The Commission adopts an implementing act	Existing tools will be reused	NO
CESOP	Article 49a(1) Article 49b(1)	Information access	Member States / Commission	The Commission adopts an implementing act	Existing tools will be reused	NO

Digital and/or sectorial policy (when these are applicable)	Explanation on how it aligns
AI Act	Not applicable
EU Cybersecurity framework	Without prejudice to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, Member States, OLAF and the EPPO shall ensure the security, integrity, authenticity and confidentiality of the data exchanged.  Security aspects to be further detailed in the implementing acts and specifications.
eIDAS	Not applicable
Single Digital Gateway and IMI	Not applicable
Others	//

4.4.Interoperability assessment

While interoperability is a key principle in EU digital policy, its application in this project is limited. The initiative does not involve building new systems or developing new data exchange formats. Instead, it consists in granting access to existing datasets (VIES, IOSS, CESOP, CP42, TNA) to additional entities—namely OLAF and the EPPO—within the current technical frameworks. As such, no interoperability gaps are expected, provided that these entities are integrated into the existing access management and security protocols of the respective platforms. The focus should therefore be on secure access provisioning, logging, and authorisation, rather than on inter-system communication or data standardisation.

4.5.Measures to support digital implementation

While the project does not require the creation of new IT systems, certain technical and operational measures are necessary to enable secure and effective access for OLAF and the EPPO. These include ensuring network connectivity to the relevant EU platforms, adapting existing software components (e.g. access control modules or user interfaces), and onboarding authorised users. In addition, support and training may be required to ensure appropriate use of the tools. These measures should remain limited in scope and leverage the existing infrastructure and security frameworks already in place.

Description of the measure	Reference(s) to the requirement(s)	Commission role (if applicable)	Actors to be involved (if applicable)	Expected timeline (if applicable)
The Commission shall adopt implementing acts establishing technical details and the practical arrangements to identify persons with access to the information	Articles 49a, 49b	The Commission shall adopt such acts	Member States; EPPO, OLAF	//
Committee procedure	Article 58	The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.	SCAC committee	//

(1)     Council Regulation (EU) No 904/2010 of 7 October 2010 on administrative cooperation and combating fraud in the field of value added tax (OJ L 268, 12.10.2010, p. 1-18)

(2)    Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1–71)

(3)    Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of  11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1)

(4)    This type of fraud takes advantage of the VAT exemption on intra-Community supplies. The so-called Missing Traders acquire goods without accounting right away for the VAT. Any VAT charged on the subsequent domestic sales should be declared and paid to the Member State’s revenue authority. However, the Missing Traders charge VAT to buyers without remitting the value to the tax authorities. In more complex cases of MTIC fraud, known as carousel frauds, goods are acquired and sold through a series of companies before being sold again in another Member State. The first seller in the domestic chain is the missing trader. The last seller that sells these goods to another taxable person in another Member State, claims and receives the reimbursement of VAT payments that never occurred.

(5)     VAT Gap - European Commission

(6)    Paragraph 93 Tackling intra-Community VAT fraud: More action needed

(7)    European Court of Auditors Special Report 08/2025 ‘Value Added Tax fraud on imports – The EU’s financial interests are insufficiently protected under simplified import customs procedures’, and Special report no 24/2015 Recommendation N. 12.

(8)    Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union's financial interests by means of criminal law (OJ L 198, 28.7.2017, p. 29–41)

(9)    Judgment of the Court (Grand Chamber) of 8 September 2015. Criminal proceedings against Ivo Taricco and Others. Request for a preliminary ruling from the Tribunale di Cuneo. Reference for a preliminary ruling — Criminal proceedings concerning offences in relation to value added tax (VAT) — Article 325 TFEU — National legislation laying down absolute limitation periods which may give rise to impunity in respect of offences — Potential prejudice to the financial interest of the European Union — Obligation, for the national court, to disapply any provision of national law liable to affect fulfilment of the Member States’ obligations under EU law. Case C-105/14

(10)    European Court of Auditors Special Report 08/2025 ‘Value Added Tax fraud on imports – The EU’s financial interests are insufficiently protected under simplified import customs procedures’, and Special report no 24/2015 Recommendation N. 12.

(11)    The EPPO investigation cluster Midas, a large-scale VAT fraud case spanning 17 countries and involving an estimated damage of €195 million. ( Germany: Fourth person convicted in large-scale VAT fraud investigation Midas | European Public Prosecutor’s Office ). The investigation carried out by the EPPO, code-named ‘Calypso’, has dealt a significant blow to criminal networks flooding the EU market with goods fraudulently imported from China, while evading custom duties and VAT. It spans 14 countries. The total damage of the criminal activities under investigation is currently estimated at approximately €700 million: over €250 million come from evaded customs duties (which revert entirely to the EU budget), and close to €450 million from unpaid VAT which damages both the EU budget and the national budgets of Member States ( Investigation ‘Calypso’: EPPO strikes criminal networks flooding EU with fraudulent Chinese imports | European Public Prosecutor’s Office ).

(12)    Council Regulation (EU) 2025/517 of 11 March 2025 amending Regulation (EU) No 904/2010 as regards the VAT administrative cooperation arrangements needed for the digital age (OJ L, 2025/517, 25.3.2025)

(13)    COM(2025) 546 final

(14)    Commission Decision of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (notified under document number SEC(1999) 802) (OJ L 136, 31.5.1999, p. 20–22)

(15)    Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on ProtectEU: a European Internal Security Strategy (COM/2025/148 final)

(16)    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1–88 )

(17)    Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (OJ L 295, 21.11.2018, p. 39–98 )

(18)    Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union's financial interests by means of criminal law (OJ L 198, 28.7.2017, p. 29–41)

(19)     2024 Annual Report : : EPPO leading the charge against EU fraud,  3 March 2025.

(20)    Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1)

(21)    Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012, p. 391)

(22)    Article 23(1)(e) of the General Data Protection Regulation and Article 25(1)(c) of Regulation (EU) 2018/1725

(23)    OJ C , , p. .

(24)    OJ C , , p. .

(25)    Council Regulation (EU) No 904/2010 of 7 October 2010 on administrative cooperation and combating fraud in the field of value added tax (OJ L 268, 12.10.2010, p. 1).1, ELI:  http://data.europa.eu/eli/reg/2010/904/oj ). 

(26)    Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1, ELI:  http://data.europa.eu/eli/reg/2017/1939/oj ).

(27)    Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/883/oj).

(28)    European Court of Auditors Special Report No 24/2015, Tackling intra-Community VAT fraud: More action needed (https://www.eca.europa.eu/en/publications/SR15_24).

(29)    Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI:  http://data.europa.eu/eli/reg/2018/1725/oj ).

(30)    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

(31)    Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).13, ELI: http://data.europa.eu/eli/reg/2011/182/oj

(32)    As referred to in Article 58(2), point (a) or (b) of the Financial Regulation.

(33)    Diff. = Differentiated appropriations / Non-diff. = Non-differentiated appropriations.

(34)    EFTA: European Free Trade Association.

(35)    Candidate countries and, where applicable, potential candidates from the Western Balkans.

(36)    IT development and procurement strategy choices will be subject to pre-approval by the European Commission Information Technology and Cybersecurity Board.

(37)    As regards traditional own resources (customs duties, sugar levies), the amounts indicated must be net amounts, i.e. gross amounts after deduction of 20% for collection costs.

(38)    Commission Implementing Regulation (EU) No 79/2012 of 31 January 2012 laying down detailed rules for implementing certain provisions of Council Regulation (EU) No 904/2010 concerning administrative cooperation and combating fraud in the field of value added tax (OJ L 29, 1.2.2012, p. 13–32)

(39)    Commission Implementing Regulation (EU) 2022/1504 of 6 April 2022 laying down detailed rules for the application of Council Regulation (EU) No 904/2010 as regards the creation of a central electronic system of payment information (CESOP) to combat VAT fraud (OJ L 235, 12.9.2022, p. 19–27)