The present proposal concerns the signature of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino (San Marino) on the automatic exchange of financial account information to improve international tax compliance 1 (the Agreement).

The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and San Marino, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Co-operation and Development (OECD). The same standard is implemented within the European Union under Council Directive 2014/107/EU 2 (DAC 2 – the first amendment to Directive 2011/16/EU 3 on administrative cooperation in the field of taxation – DAC).

Important changes to the CRS were approved at international level on 26 August 2022 4 and will apply from 1 January 2026. Council Directive (EU) 2023/2226 5  (DAC8) already implemented these changes within the European Union and will also apply from 1 January 2026.

The changes extend the scope of the CRS to ensure the coverage of electronic money products and central bank digital currencies. They also further improve the due diligence procedures and reporting outcomes, with a view to increasing the usability of CRS information for tax administrations and limiting burdens on financial institutions, where possible.

To ensure that the automatic exchange of financial account information between EU Member States and San Marino is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026, it was necessary to negotiate and agree corresponding amendments to the Agreement.

In May 2018, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”) 6 started to apply.

To ensure that the Agreement reflects these updates, it was necessary to remove the references to the repealed Directive 95/46/EC and replace these references with references to Regulation (EU) 2016/679. Simultaneously, the references to the San Marino national data protection legislation were also updated. Finally, Article 6 of the Agreement as well as the additional data protection safeguards regarding the treatment of data processed under this agreement (Annex III) have been slightly adjusted to fully align the wording and ensure continued compliance with the GDPR. A Council decision authorising the opening of negotiations for the amendment of the Agreement concerning the automatic exchange of financial account information to improve international tax compliance between the European Union and the Republic of San Marino was adopted on 21 May 2024 7 .

Several rounds of negotiations were held and a provisional agreement was reached in March 2025. Subsequently, the draft text of the Amending Protocol was initialled by the chief negotiators on 15 May 2025.

The Council has consistently been informed about the progress in the negotiations in the Working Party on Tax Questions and in the High Level Working Party. In particular, the text of the draft Amending Protocol was shared and discussed with the Member States ahead of its initialling.

The Commission considers that the objectives set out by the Council in its negotiating directive have been attained and that the negotiated text is acceptable to the Union.

The amendment of the Agreement was negotiated in line with the comprehensive negotiating directive adopted by the Council on 21 May 2024.

The negotiated Amending Protocol ensures that the existing agreement between the European Union and San Marino remains aligned with Union legislation in the same field, notably the DAC as amended by DAC8.

DAC8 includes, among other amendments, the latest changes to the OECD CRS. In the light of the close relationship in this field between the European Union and San Marino, it is important to strengthen along the same lines the administrative cooperation with their tax authorities in the field of automatic exchange of financial account information. The timely update of the Agreement ensures the smooth and effective continuation of this administrative cooperation beyond 1 January 2026.

The amendments to the Agreement also take account of the Union policies in the field of the fight against money laundering and terrorist financing, because the Customer Due Diligence activities to be performed by Financial Institutions, in view of collecting the financial account information to be exchanged under the Agreement, will be substantially aligned with those that the same Financial Institutions have to apply as obliged entities under the European Union legal framework in the fight against money laundering and terrorist financing.

The Amending Protocol also takes account of the Union policies in the field of respect of fundamental rights, notably on protection of personal data in the case of the outflow of this data to non-EU and non-EEA countries.

As far as the parts concerning the CRS are concerned, the Agreement itself includes, in Article 8, a provision requiring the Contracting Parties to consult each other on each occasion when an important change is adopted at OECD level to any of the elements of the CRS. The Article also provides that following these consultations, the Agreement may be amended by means of a protocol between the Contracting Parties. As important changes to the CRS were approved within the OECD on 26 August 2022, and in accordance with the Union’s exclusive competence stemming from the existing Agreement, the Amending Protocol implements all changes that are necessary to reflect the corresponding changes to the CRS. The implementation of those changes within the Union has been provided for by means Council Directive (EU) 2023/2226.

Given the main objective and components of the Agreement, the substantive legal basis of the present proposal to the Council is Article 115 of the Treaty on the functioning of the European Union (TFEU). As Article 115 TFEU requires unanimity for a Union act, the procedural legal basis for the signature of the Amending Protocol is Article 218(5) TFEU, in conjunction with the second subparagraph of Article 218(8) TFEU.

•    Union competence

Under the case law of the Court of Justice, the Union has exclusive competence where an agreement may affect common rules or alter their scope. 8 This jurisprudence has been enshrined in Article 3(2) TFEU.

Article 3(2) TFEU provides that, in addition to the areas of exclusive Union competence listed in Article 3(1) TFEU, the Union shall “also have exclusive competence for the conclusion of an international agreement when its conclusion is provided for in a legislative act of the Union or is necessary to enable the Union to exercise its internal competence, or in so far as its conclusion may affect common rules or alter their scope”.

The amending protocol respects the principle of proportionality and does not go beyond what is necessary to meet the objective of updating the Agreement to incorporate the changes to the Common Reporting Standard that shall take effect from 1 January 2026. These amendments will enable the Member States to continue the automatic exchange of financial account information with San Marino in an uninterrupted manner, and in a manner that aligns with the new requirements of the CRS, as already incorporated in the DAC8.

Article 218(5) TFEU provides that the Commission or the High Representative of the Union for Foreign Affairs and Security Policy shall submit proposals to the Council, which shall adopt a decision authorising the signing of an international agreement. Given the subject matter of the envisaged agreement, it is appropriate for the Commission to submit a proposal to that effect.

According to tool 7 of the Better Regulation 9 , an impact assessment is not needed, inter alia, when the Commission has little or no choice in the matter.

This condition is satisfied in the present case as the amendments to the existing Agreements with respect to the automatic exchange of financial account information fully align with the changes to the CRS that were agreed at the OECD level and already incorporated into EU law by means of the DAC8. Finally, the changes on data protection, are merely aimed at updating references to the EU and San Marino data protection legislation and slightly adjusting Article 6 as well as the additional data protection safeguards included in Annex III of the Agreement to fully align the wording and ensure continued compliance with the GDPR.

The envisaged amending protocol to the Agreement will respect the key values of the European Union as established in Article 2 of the TFEU and the Charter of Fundamental Rights of the European Union.

The proposal has no implication for the EU budget.

The envisaged amendments cover the following points:

The foreseen amendments expand the scope of reporting to include new digital financial products, such as Specified Electronic Money Products and Central Bank Digital Currencies. Simultaneously and with the aim of improving the reliability and use of the exchanged information, the amendments introduce more detailed reporting requirements and strengthened due diligence procedures.

The amendments also contain provisions to ensure an efficient interaction between the CRS and the separate Crypto-Asset Reporting Framework (CARF) developed by the OECD 10 . These provisions allow to limit instances of duplicative reporting, while maintaining a maximum amount of operational flexibility of Reporting Financial Institutions that are also subject to obligations under the CARF.

These amended reporting and automatic exchange of information requirements are provided for within Articles 1-3 and Annex I. They will apply from 1 January 2026.

All references to Directive 95/46/EC have been replaced with references to the GDPR.

Simultaneously, the legal reference to the national data protection legislation of San Marino has been updated to Law No. 171 of 21 December 2018. Finally, Article 6 and the additional data protection safeguards included in Annex III have been slightly adjusted to align the wording and ensure continued compliance with the GDPR.