What changed between the plenary report and the adopted text

Changed:Recital 10 a (new): (10a) The EPPO’s and OLAF’s access to the VIES, the Surveillance System and the CESOP as well as to any other systems and databases should concern the following main data categories: information on VAT identification numbers and VAT intra-Community transactions, relevant information on VAT-exempt importations related to the Import One-Stop-Shop (IOSS) and customs procedure 42/63 importations and aggregated payment information. Such access should only be granted to the EPPO and OLAF for the purpose of carrying out their duties under Article 4 of Regulation (EU) 2017/1939 and Article 1(1) of Regulation (EU, Euratom) No 883/2013. Powers should be conferred on the Commission to adopt implementing acts specifying the exact data categories available to the EPPO and OLAF for the purposes of exercising their duties under those articles. The drafts of those implementing acts should be submitted to the European Parliament for information, in order to enable the exercise of its rights.

Changed:Article 1 – paragraph 1 – point -1 (new), Article 2 a (new): (-1) the following Articlearticle is inserted: / ‘Article 2a / Follow-up proposal on minimum harmonisation of penalties / By … [18 months afterfrom the date of entry into force of this amending Regulation] and in line with the objectives of the revision of the anti-fraud architecture as a complementary set of measures included in the post-2027 MFF package and for the purpose of enhancing the protection of the Union’s financial interests, the Commission shall submit to the European Parliament and to the Council a legislative proposal for the minimum harmonisation of administrative penalties applicable to the most serious infringements in the field of VAT and related customs duties, in particular as regards Missing Trader Intra-Community fraud and the abuse of simplified import procedures under Customs Procedure 42 and the Import One-Stop Shop. The proposal shall be without prejudice to the substantive customs procedures established under Regulation (EU) No 952/2013.’

Changed:Article 1 – paragraph 1 – point -1 a (new), Article 13 a (new): (-1a) the following Articlearticle is inserted: / ‘Article 13a / Spontaneous transmission of customs data indicating VAT fraud / 1. The competent authorities of the Member States shall spontaneously communicate to the Eurofisc working field coordinators referred to in Article 36(1), and, within their respective mandates, to the EPPO and OLAF, any information stored pursuant to Article 17(1), point (f), that indicates patterns consistent with VAT fraud, in particular: / (a) systematic discrepancies between the declared destination Member State in an import declaration and the Member State in which VAT was subsequently declared or paid; / (b) systematic discrepancies between the consignee identified in an import declaration under the IOSS scheme and the taxable person that declared the corresponding VAT in the Member State of destination; / (c) declared customs values that diverge significantly from market value where that divergence is consistent with undervaluation for VAT purposes; and / (d) any other indicator specified by the Commission’s implementing act as a customs-based VAT fraud risk indicator. / 2. The communication referred to in paragraph 1 shall be made without delay and shall include at least the data elements listed in Article 17(1), point (f), for the importation or series of importations concerned. / 3. Member States shall ensure that their competent customs authorities and competent VAT authorities coordinate onas regards the identification of discrepancies referred tothe indiscrepancies par…referr…

Changed:Article 1 – paragraph 1 – point 5 a (new), Article 59 – paragraph 1: (5a) in Article 59, paragraph 1 is replaced by the following: / ‘1. Every three years starting from … [entry[date of entry into force of this amending Regulation], the Commission shall, on the basis of reports provided by EPPO, OLAF and Eurofisc, submit a report to the European Parliament, the Council and the European Court of Auditors on the application of this Regulation. The report shall assess in particular: / (a) the operational effectiveness of direct EPPO and OLAF access to VIES, the SURVEILLANCE system and CESOP, including average time-to-access, the number of investigations materially advanced, and the outcomes of prosecutions or administrative actions; / (b) the coherence of the access and transmission framework with other instruments adopted as part of the revised anti-fraud architecture, including measures relating to Eurofisc’s capacity, CESOP governance, fiscal representative harmonisation and penalty convergence; / (c) the functioning and timeliness of the spontaneous transmission mechanism under Article 13a, including national coordination arrangements between customs and VAT authorities; / (d) the enforcement outcomes achieved in Member States not participating in the EPPO and whether equivalent mechanisms have been established pursuant to the anti-fraud architecture revision; / (e) the estimated amounts of Union VAT and related customs revenue recovered or preserved as a direct result of the data exchanges and access rights established by this Regulation, and; / (f) the c…(…

Changed:Recital 2: (2) Pursuant to Article 24(1) of Regulation (EU) 2017/1939, the institutions, bodies, offices and agencies of the Union and the authorities of the Member States competent under applicable national law are to report to the EPPO, without undue delay, any criminal conduct, including cross-border VAT fraud, in respect of which it could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation, in a timely manner to allow analysis or investigation of such criminal conduct. Cross-border VAT fraud is by definition involving several Member States, and the flow of information from individual Member States to the EPPO does not fit the purpose of combating VAT fraud at EU level. Therefore, in order for the EPPO to be informed of VAT fraud risks at EU level and to perform its regulatory mandate, it is necessary to set out in more detail the modalities under which the Member States, within the Eurofisc network referred to in Article 33 of Regulation (EU) No 904/2010, should report to the EPPO the results of the Eurofisc processing of and analysis onof cases of suspected cross-border fraudefraud and any suspicious indication and eventually the precise information the EPPO needs in order to assess whether to exercise its competence. Furthermore, pursuant to Article 24(9) of Regulation (EU) 2017/1939, in specific cases, the EPPO may request further relevant information available to the institutions, bodies, offices and agencies of the Union and the authoriti…authorities o…

Changed:Recital 4: (4) The Member States not participating in the EPPO are obliged, under the principle of sincere cooperation enshrined in Article 4(3) of the Treaty on European Union, to support the activities of the EPPO and to refrain from any action that could jeopardise the attainment of its objectives. Eurofisc is composed of both Member States participating and not participating in the EPPO. Therefore, it is important to have a clear legal basis for the EPPO access to information processed by Eurofisc, for criminal law enforcement purposes, in order to successfully deliver on its mandate as set out in Article 4 of Council Regulation (EU) 2017/1939, namelynamely, to investigate and prosecute criminal offences affecting the financial interests of the Union.

Changed:Recital 5: (5) The European Court of Auditors has recommended that the Commission and the Member States remove legal obstacles preventing the exchange of information between administrative, judicial and law enforcement authorities at national and Union level and in particular that OLAF has access to the VAT information exchange system (VIES) and Eurofisc data6. In that respect it is important that a central access to EU IT systems, which respects the principles of necessity and proportionality, is set out in a clear legal basis to enable OLAF to successfully deliver on its mandate as set out in Article 4 of Regulation (EU, Euratom) No 883/2013.

Changed:Recital 5 a (new): (5a) Persistent obstacles to effective cooperation between Union bodies include incompatibilities between IT systems, fragmentation of communication channelschannels, and limited interoperability of case management systems, resulting in inefficiencies, delays and increased administrative burdens. It is therefore necessary to enhance interoperability and develop common digital infrastructures to ensure seamless and secure information exchange.

Changed:Recital 9: (9) In order to protect the access to personal data, only the European Prosecutors, the European Delegated Prosecutors, as well as selected staff of the EPPO and OLAF, previously authorised respectively by the EPPO and OLAF, should access VAT information to execute their tasks, under the oversight of the Eurofisc Liaison officials. To ensure uniform conditions for that access, implementing powers should be conferred on the Commission in respect of the technical details and practical arrangements, including on access control mechanism and users’ profile and identification, ensuring a design that respects high levels of data protection while enhancing operational efficiency through automated processes without undue administrative delay. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council9. ThisThat measure should be understood as an immediate step, while the forthcoming review of the anti-fraud architecture will provide an opportunity to ensure greater coherence and consistency.

Changed:Recital 11: (11) As the systems, infrastructure and technical means facilitating the exchange of VAT information at Union level need to be adapted to allow secure access of EPPO and OLAF, it is necessary to defer the application of the relevant provisions in order to allow the Member States, the Commission, the EPPO and OLAF to carry out the necessary adaptations. This should consider the dates when the central VIES will become operational and the legacy VIES will be phased out. In order to ensure the effective implementation of this RegulationRegulation, the EPPO and OLAF should have access, in line with the principles of budgetary neutrality, to adequate and stable financial and human resources, including specialised expertise in financial investigations, digital forensics and data analysis and also including, where appropriate, a separate gateway or interface, in order to ensure compliance with the principle of data minimisation. Union funding should further support interoperable IT systems and secure communication tools to enable efficient cooperation. Organisational measures, internal authorisation processes, oversight mechanisms and safeguards should be in place to prevent misuse.

Changed:Article 1 – paragraph 1 – point 4, Article 36 – paragraph 2a: 2a. Eurofisc working field coordinators shall communicate to the EPPO, in accordance with Article 24(1) of Council Regulation (EU) 2017/1939* as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, without undue delay any indication of suspected cross-border VAT fraud based on information communicated or collected pursuant to this Regulation in respect of which the EPPO could exercise its competence. Eurofisc working field coordinators shall communicate the information necessary for the EPPO to assess whether to exercise its competence, provided that such communication is necessary and proportionate, is in line with the purposes of the EPPO’s mandate, and fully complies with the Union law on data protection.

Changed:Article 1 – paragraph 1 – point 5, Article 49a – paragraph 1 – point b: (b) From 1 September 2026, the information referred to in Article 17(1), points (e) and (f), of this Regulation, including any additional data elements stored pursuant to Article 17(1), point (f), of this Regulation as amended;Regulation;

Changed:Article 1 – paragraph 1 – point 5, Article 49a – paragraph 1 b (new): 1b. The centralised access referred to in paragraph 1 shall be subject to appropriate technical and organisational measures to ensure that each access is attributable to a specific investigation or prosecution and to an identified authorised user. Such access shall be logged in a manner allowing effective ex-postex post verification.

Changed:Article 1 – paragraph 1 – point 5, Article 49a – paragraph 3: 3. That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States. The system concerned shall ensure full traceability and logging of all searches, and shall be supported by secure communication channels and comprehensive records enabling effective ex-postex post verification mechanisms.

Changed:Article 1 – paragraph 1 – point 5, Article 49b – paragraph 2 b (new): 2b. The centralised access referred to in paragraph 1 shall be subject to appropriate technical and organisational measures ensuring that each access is attributable to a specific investigation and to an identified authorised user. Such access shall be logged in a manner allowing effective ex-postex post verification.

Changed:Article 1 – paragraph 1 – point 5, Article 49b – paragraph 3: 3. That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States. The system concerned shall ensure full traceability and logging of all searches, and shall be supported by comprehensive records enabling effective ex-postex post verification mechanisms.

Changed:Article 1 – paragraph 1 – point 5, Article 49b – paragraph 4 – subparagraph 1 – point a: (a) the technical details concerning the centralised access to the information referred to in paragraph 1 of this Article including the list of data categories, with which the targeted searches can be carried out, and including a preventive mechanism against untargeted searches;

Changed:Article 1 – paragraph 1 – point 5, Article 49b – paragraph 5 b (new): 5b. The systems enabling the centralised access referred to in paragraph 1 shall be designed to ensure full interoperability with the systems used by relevant Union bodies, in order to facilitate efficient and secure information exchanges and to reduce administrative burdens.burden.