What changed between the draft committee report and the plenary report

Removed:Recital 4: (4) The Member States not participating in the EPPO are obliged, under the principle of sincere cooperation enshrined in Article 4(3) of the Treaty on European Union, to support the activities of the EPPO and to refrain from any action that could jeopardise the attainment of its objectives. Eurofisc is composed of both Member States participating and not participating in the EPPO. Therefore, it is important to have a clear legal basis for the EPPO access to information processed by Eurofisc. Moreover, the EPPO should be allowed to access such information for criminal law enforcement purposes only.

Added:Recital 2: (2) Pursuant to Article 24(1) of Regulation (EU) 2017/1939, the institutions, bodies, offices and agencies of the Union and the authorities of the Member States competent under applicable national law are to report to the EPPO, without undue delay, any criminal conduct, including cross-border VAT fraud, in respect of which it could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation, in a timely manner to allow analysis or investigation of such criminal conduct. Cross-border VAT fraud is by definition involving several Member States, and the flow of information from individual Member States to the EPPO does not fit the purpose of combating VAT fraud at EU level. Therefore, in order for the EPPO to be informed of VAT fraud risks at EU level and to perform its regulatory mandate, it is necessary to set out in more detail the modalities under which the Member States, within the Eurofisc network referred to in Article 33 of Regulation (EU) No 904/2010, should report to the EPPO the results of the Eurofisc processing of and analysis on cases of suspected cross-border fraude and any suspicious indication and eventually the precise information the EPPO needs in order to assess whether to exercise its competence. Furthermore, pursuant to Article 24(9) of Regulation (EU) 2017/1939, in specific cases, the EPPO may request further relevant information available to the institutions, bodies, offices and agencies of the Union and the authoriti…

Removed:Recital 5: (5) The European Court of Auditors has recommended that the Commission and the Member States remove legal obstacles preventing the exchange of information between administrative, judicial and law enforcement authorities at national and Union level and in particular that OLAF has access to the VAT information exchange system (VIES) and Eurofisc data6. In that respect it is important that a central access to EU IT systems, which respects the principles of necessity and proportionality, is set out in a clear legal basis.

Added:Recital 4: (4) The Member States not participating in the EPPO are obliged, under the principle of sincere cooperation enshrined in Article 4(3) of the Treaty on European Union, to support the activities of the EPPO and to refrain from any action that could jeopardise the attainment of its objectives. Eurofisc is composed of both Member States participating and not participating in the EPPO. Therefore, it is important to have a clear legal basis for the EPPO access to information processed by Eurofisc, for criminal law enforcement purposes, in order to successfully deliver on its mandate as set out in Article 4 of Council Regulation (EU) 2017/1939, namely to investigate and prosecute criminal offences affecting the financial interests of the Union.

Removed:Recital 10 a (new): (10a) The EPPO’s and OLAF’s access to the VIES, the Surveillance System and the CESOP as well as to any other systems and databases should be limited to the following main data categories: information on VAT identification numbers and VAT intra-Community transactions, relevant information on VAT-exempt importations related to the Import One-Stop-Shop (IOSS) and customs procedure 42/63 importations and aggregated payment information. Such access should only be granted to EPPO and OLAF for the purpose of carrying out their duties under Article 4 of Regulation (EU) 2017/1939 and Article 1(1) of Regulation (EU, Euratom) No 883/2013. Powers should be conferred on the Commission to adopt implementing acts specifying the exact data categories available to the EPPO and OLAF for the purposes of exercising their duties under those articles.

Added:Recital 4 a (new): (4a) The European Court of Auditors has repeatedly identified weaknesses regarding the accessibility and interoperability of VAT-related information systems across Member States and Union bodies, as a significant obstacle to effective cross-border VAT fraud investigations, most recently in its Special Report 8/2025 on VAT fraud on imports. That report identified, in addition, significant disparities in the levels of administrative sanctions applied by Member States in respect of VAT fraud with imports, which create conditions enabling operators to exploit the jurisdiction with the lowest penalties. The access to VAT data granted by this Regulation to the EPPO and OLAF enhances the detection and prosecution capacity but does not constitute a deterrent remedy for penalty divergence. In this context, and in line with the Commission’s commitment to revise the anti-fraud architecture as part of the measures included in the post-2027 MFF, the possibility of further action to address these disparities may be considered, such as a legislative proposal based on the appropriate legal basis, aimed at achieving a minimum level of harmonisation or consistency of administrative penalties applicable to the most serious VAT and customs-related infringements, taking into account the need to effectively protect the Union’s financial interests. Any such proposal should be accompanied by a comprehensive impact assessment and should demonstrate compliance with the principles of subsidiarity and p…

Removed:Recital 11: (11) As the systems, infrastructure and technical means facilitating the exchange of VAT information at Union level need to be adapted to allow secure access of EPPO and OLAF, it is necessary to defer the application of the relevant provisions in order to allow the Member States, the Commission, the EPPO and OLAF to carry out the necessary adaptations. This should consider the dates when the central VIES will become operational and the legacy VIES will be phased out. In order to ensure the effective implementation of this Regulation, adequate financial resources should be made available to the EPPO and OLAF, in particular for maintaining the relevant infrastructure and technical means for secure access to VAT information.

Added:Recital 4 b (new): (4b) The White Paper of the Commission of July 2025 on the review of the EU anti-fraud architecture identified the fragmentation of information flows between Eurofisc, the EPPO, OLAF, Europol and Eurojust as a systemic structural weakness undermining the effectiveness of the Union’s response to cross-border VAT fraud. This amending Regulation constitutes the legislative implementation of the data-sharing pillar of a revised anti-fraud architecture and is to be read in conjunction with the further measures announced in that White Paper, including the strengthening of Eurofisc’s operational capacity, the harmonisation of the conditions and liability rules for fiscal representatives appointed by non-Union taxable persons under the IOSS and other import VAT schemes, and the extension of the data governance framework of CESOP to ensure coherence with the customs data access established by this Regulation.

Added:Recital 4 c (new): (4c) The information stored by customs authorities in relation to import procedures under which VAT obligations are deferred or there is a VAT exemption, is intrinsically VAT-related information for the purposes of Article 113 TFEU. Extending the scope of Article 17(1), point (f), of Regulation (EU) No 904/2010 to cover all import procedures involving VAT exemptions or deferrals, including under the Import One-Stop Shop scheme established by Directive 2006/112/EC, and adding the declared customs value and country of origin as mandatory data elements, is necessary to enable competent authorities, including the EPPO and OLAF, to cross-reference import declarations with VAT declarations and detect discrepancies indicative of fraud. Such extension should be without prejudice to the substantive customs rules governing those import procedures, which remain subject to Regulation (EU) No 952/2013.

Added:Recital 4 d (new): (4d) In order to ensure that the enforcement capacity created by this Regulation extends effectively to all Member States, to avoid persistent asymmetries within the single market and in the Union’s anti-fraud landscape, and as part of the Commission’s commitment to revise the anti-fraud architecture, Member States not participating in the EPPO should be required to designate a competent national authority responsible for fulfilling equivalent functions for the purpose of cooperation with Eurofisc and OLAF regarding cross-border VAT fraud. Those Member States should notify the Commission of the designated authority within six months of the entry into force of this Regulation and should report annually to the Commission on the use made of the information received, including the number of investigations opened and their outcomes.

Added:Recital 5: (5) The European Court of Auditors has recommended that the Commission and the Member States remove legal obstacles preventing the exchange of information between administrative, judicial and law enforcement authorities at national and Union level and in particular that OLAF has access to the VAT information exchange system (VIES) and Eurofisc data6. In that respect it is important that a central access to EU IT systems, which respects the principles of necessity and proportionality, is set out in a clear legal basis to enable OLAF to successfully deliver on its mandate as set out in Article 4 of Regulation (EU, Euratom) No 883/2013.

Added:Recital 5 a (new): (5a) Persistent obstacles to effective cooperation between Union bodies include incompatibilities between IT systems, fragmentation of communication channels and limited interoperability of case management systems, resulting in inefficiencies, delays and increased administrative burdens. It is therefore necessary to enhance interoperability and develop common digital infrastructures to ensure seamless and secure information exchange.

Added:Recital 8 a (new): (8a) While Article 13 of Regulation (EU) No 904/2010 already requires the competent VAT authorities of Member States to spontaneously exchange information likely to be useful for combating VAT fraud, that obligation applies to VAT authorities and does not extend to the competent customs authorities of Member States, which are not VAT competent authorities within the meaning of that Regulation. Furthermore, neither the existing mechanism set out in Article 13 of Regulation (EU) No 904/2010 nor the Eurofisc network provides for the direct spontaneous communication of customs-derived fraud intelligence to the EPPO and OLAF. VAT-fraud schemes linked to import procedures are characterised by systematic discrepancies between the information declared to customs authorities at the point of importation and the VAT declarations subsequently filed in the Member State of destination. Customs authorities are often the first to detect such anomalies through their risk management analysis. In order to close this gap and to ensure that upstream customs intelligence identified by customs authorities is transmitted without delay to the bodies responsible for investigating and prosecuting cross-border VAT fraud, and given that the effective exercise of the access rights provided for in Articles 49a and 49b of Regulation (EU) No 904/2010 depends on EPPO and OLAF being informed of the existence of potential cases of fraud, it is necessary to require competent customs authorities to transmit spont…

Added:Recital 8 b (new): (8b) The effectiveness of the spontaneous transmission mechanism provided for in this amending Regulation depends on adequate coordination at national level between the competent customs authorities and the competent VAT authorities of Member States. Those bodies are in many Member States separate administrative entities with distinct supervisory chains and information systems. Member States should therefore ensure that their competent customs and VAT authorities establish regular coordination mechanisms, including through the Eurofisc framework, to facilitate the identification of discrepancies indicative of VAT fraud and the timely transmission of relevant customs data to Eurofisc, the EPPO and OLAF. Such coordination is a procedural and organisational measure and does not entail additional information technology obligations for national authorities.

Added:Recital 9: (9) In order to protect the access to personal data, only the European Prosecutors, the European Delegated Prosecutors, as well as selected staff of the EPPO and OLAF, previously authorised respectively by the EPPO and OLAF, should access VAT information to execute their tasks, under the oversight of the Eurofisc Liaison officials. To ensure uniform conditions for that access, implementing powers should be conferred on the Commission in respect of the technical details and practical arrangements, including on access control mechanism and users’ profile and identification, ensuring a design that respects high levels of data protection while enhancing operational efficiency through automated processes without undue administrative delay. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council9. This measure should be understood as an immediate step, while the forthcoming review of the anti-fraud architecture will provide an opportunity to ensure greater coherence and consistency.

Added:Recital 10: (10) This Regulation respects fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, particularly the right of protection of personal data.

Added:Recital 10 a (new): (10a) The EPPO’s and OLAF’s access to the VIES, the Surveillance System and the CESOP as well as to any other systems and databases should concern the following main data categories: information on VAT identification numbers and VAT intra-Community transactions, relevant information on VAT-exempt importations related to the Import One-Stop-Shop (IOSS) and customs procedure 42/63 importations and aggregated payment information. Such access should only be granted to EPPO and OLAF for the purpose of carrying out their duties under Article 4 of Regulation (EU) 2017/1939 and Article 1(1) of Regulation (EU, Euratom) No 883/2013. Powers should be conferred on the Commission to adopt implementing acts specifying the exact data categories available to the EPPO and OLAF for the purposes of exercising their duties under those articles. The drafts of those implementing acts should be submitted to the European Parliament for information, in order to enable the exercise of its rights.

Added:Recital 11: (11) As the systems, infrastructure and technical means facilitating the exchange of VAT information at Union level need to be adapted to allow secure access of EPPO and OLAF, it is necessary to defer the application of the relevant provisions in order to allow the Member States, the Commission, the EPPO and OLAF to carry out the necessary adaptations. This should consider the dates when the central VIES will become operational and the legacy VIES will be phased out. In order to ensure the effective implementation of this Regulation the EPPO and OLAF should have access, in line with the principles of budgetary neutrality, to adequate and stable financial and human resources, including specialised expertise in financial investigations, digital forensics and data analysis and also including, where appropriate, a separate gateway or interface, in order to ensure compliance with the principle of data minimisation. Union funding should further support interoperable IT systems and secure communication tools to enable efficient cooperation. Organisational measures, internal authorisation processes, oversight mechanisms and safeguards should be in place to prevent misuse.

Added:Recital 12: (12) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 7 January 2026.

Removed:Article 1 – paragraph 1 – point 4, Article 36 – paragraph 2 a: 2a. Eurofisc working field coordinators shall communicate to the EPPO, in accordance with Article 24(1) of Council Regulation (EU) 2017/1939* as regards the Member States participating in the EPPO and in accordance with this Article as regards the other Member States, without undue delay any indication of suspected cross-border VAT fraud based on information communicated or collected pursuant to this Regulation in respect of which the EPPO could exercise its competence. Eurofisc working field coordinators shall communicate to the EPPO only the information strictly necessary to enable the EPPO to assess whether or not to exercise its competence.

Added:Article 1 – paragraph 1 – point -1 (new), Article 2 a (new): (-1) the following Article is inserted: / ‘Article 2a / Follow-up proposal on minimum harmonisation of penalties / By … [18 months after the entry into force of this amending Regulation] and in line with the objectives of the revision of the anti-fraud architecture as a complementary set of measures included in the post-2027 MFF package and for the purpose of enhancing the protection of the Union’s financial interests, the Commission shall submit to the European Parliament and to the Council a legislative proposal for the minimum harmonisation of administrative penalties applicable to the most serious infringements in the field of VAT and related customs duties, in particular as regards Missing Trader Intra-Community fraud and the abuse of simplified import procedures under Customs Procedure 42 and the Import One-Stop Shop. The proposal shall be without prejudice to the substantive customs procedures established under Regulation (EU) No 952/2013.’

Removed:Article 1 – paragraph 1 – point 4, Article 36 – paragraph 2 c: 2c. In accordance with Article 8, (2) and (3), of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council** Eurofisc working field coordinators shall communicate to OLAF without delay any indication of suspected cross-border VAT fraud based on information from Member States communicated or collected pursuant to this Regulation to enable OLAF to consider appropriate action in accordance with its mandate. Eurofisc working field coordinators shall communicate to OLAF only the information strictly necessary to enable OLAF to assess whether or not to exercise its mandate.

Added:Article 1 – paragraph 1 – point -1 a (new), Article 13 a (new): (-1a) the following Article is inserted: / ‘Article 13a / Spontaneous transmission of customs data indicating VAT fraud / 1. The competent authorities of the Member States shall spontaneously communicate to the Eurofisc working field coordinators referred to in Article 36(1), and, within their respective mandates, to the EPPO and OLAF, any information stored pursuant to Article 17(1), point (f), that indicates patterns consistent with VAT fraud, in particular: / (a) systematic discrepancies between the declared destination Member State in an import declaration and the Member State in which VAT was subsequently declared or paid; / (b) systematic discrepancies between the consignee identified in an import declaration under the IOSS scheme and the taxable person that declared the corresponding VAT in the Member State of destination; / (c) declared customs values that diverge significantly from market value where that divergence is consistent with undervaluation for VAT purposes; and / (d) any other indicator specified by the Commission’s implementing act as a customs-based VAT fraud risk indicator. / 2. The communication referred to in paragraph 1 shall be made without delay and shall include at least the data elements listed in Article 17(1), point (f), for the importation or series of importations concerned. / 3. Member States shall ensure that their competent customs authorities and competent VAT authorities coordinate on the identification of discrepancies referred to in par…

Removed:Article 1 – paragraph 1 – point 5, Article 49a – paragraph 2 a (new): 2a. The centralised access referred to in paragraph 1 shall be limited to what is strictly necessary for the purpose of investigating suspected criminal offences or prosecuting perpetrators of such criminal offences, as referred to in Article 4 of Regulation (EU) 2017/1939, and shall be designed and used in such a way as to prevent untargeted searches or access not linked to a concrete case.

Added:Article 1 – paragraph 1 – point -1 b (new), Article 17 – paragraph 1 – point f: (-1b) in Article 17(1), point (f) is replaced by the following: / ‘(f) the information collated by customs authorities of the Member States relating to all importations of goods in respect of which a VAT exemption, deferral or special accounting scheme is claimed at importation, including under Article 143(1), point (d), of Directive 2006/112/EC (Customs Procedure 42/63), under the Import One-Stop Shop scheme established by Articles 369l to 369x of that Directive, and any other import procedure under which the obligation to account for VAT is deferred to the Member State of destination, limited to the following data elements: / (i) the import declaration identifier; / (ii) the VAT identification number of the importer or, where applicable, the IOSS identification number declared to customs; / (iii) the VAT identification number of the customer in the Member State of destination, where available; / (iv) the declared customs value of the goods; / (v) the declared country of origin of the goods; and / (vi) the customs procedure code, including in cases where the goods are subject to a simplified import procedure under Article 166 of Regulation (EU) No 952/2013;’