Commission Implementing Regulation (EU) 2022/1504 of 6 April 2022 laying down detailed rules for the application of Council Regulation (EU) No 904/2010 as regards the creation of a central electronic system of payment information (CESOP) to combat VAT fraud

1 The Commission shall develop technical measures for the establishment of CESOP with the following functionalities: (a) receiving payment data transmitted by Member States; (b) storing the payment data securely for a maximum period of 5 years from the end of the calendar year in which the Member States transmitted the information to it; (c) cleansing the payment data of anomalies and mistakes, including duplications of the same payment; (d) aggregating the payment data in relation to each payee; (e) allowing searches and visualisation of the payment data in CESOP; (f) analysing and performing crosschecks of the payment data with the data stored and exchanged in accordance with Article 17(1), points (a), (b), (d), (e) and (f), and Article 33(2), point (b), of Regulation (EU) No 904/2010: (g) performing automatic analytics and flag suspicious payees; (h) allowing Eurofisc liaison officials to perform non-automatic controls and analysis; (i) generating reports on the results of the analysis and controls performed by CESOP and the Eurofisc liaison officials; (j) providing user access control management infrastructure for the Eurofisc liaison officials; (k) allowing Eurofisc liaison officials to exchange information relating to cross-border VAT fraud investigation and detection directly in CESOP; (l) providing the technical infrastructure for Member States to manage access rights for their Eurofisc liaison officials.

2 The Commission shall perform the following tasks for maintaining CESOP: (a) ensuring that CESOP and its functionalities are operational; (b) performing maintenance outside working hours; (c) providing the necessary technical updates for the proper functioning and improvement of CESOP; (d) handling technical problems.

The Commission shall perform the following tasks to technically manage CESOP: (a) retaining and updating the list of Eurofisc liaison officials who have access to CESOP and their unique personal user identification in accordance with Article 5; (b) implementing the organisational and technical security measures referred to in Article 6; (c) establishing, keeping and maintaining a list of payment service providers who reported data pursuant to Article 24b(1) of Regulation (EU) No 904/2010, according to the data provided by Member States; (d) giving Eurofisc liaison officials who have access to CESOP automated access to the list maintained pursuant to point (c); (e) providing technical assistance to Eurofisc liaison officials when using CESOP; (f) providing training to Eurofisc liaison officials regarding the use of CESOP.

1 Member States shall take all the necessary measures to ensure that the national electronic systems for the collection of payment information set up pursuant to Article 24b(2) of Regulation (EU) No 904/2010 are functional and able to collect the payment information pursuant to Article 24b(1) of that Regulation.

2 Member States shall transmit to CESOP only the payment information that is complete with all the mandatory fields pursuant to Article 243d of Directive 2006/112/EC and is in line with the requirements laid down in the Annex to this Regulation.

3 The Commission shall ensure the interoperability between CESOP and the national electronic systems referred to in paragraph 1.

The electronic standard form referred to in Article 24b(1), point (b), of Regulation (EU) No 904/2010, shall be submitted in a standardised XML format in accordance with the data table in the Annex to this Regulation.

1 Member States shall designate the Eurofisc liaison officials who will have access to CESOP and communicate their names and email addresses to the Commission.

2 Member States shall inform the Commission of any changes in the information provided under paragraph 1, including changes in the designated Eurofisc liaison officials, in a timely manner and no later than 30 calendar days after the change occurred.

3 The Commission shall immediately provide the Eurofisc liaison officials referred to in paragraph 1 with a unique personal user identification to access CESOP.

1 The Member States shall provide the Commission with information on the application and every update of their own security measures at national level. That information shall include details on the measures adopted to ensure only Eurofisc liaison officials referred to in Article 5 have access to CESOP and details on the measures adopted to ensure the encryption of the data transmitted by the Member States.

2 The Commission shall, by 30 April each year from the year following the date of application of this Regulation, inform the Member States of the measures taken for the security of CESOP. That information shall at least indicate the following: (a) the security incidents that occurred during the previous year and how they have been resolved; (b) details on security measures adopted or changes to the existing security measures; (c) an assessment of the existing security measures and whether the Commission considers any changes to those measures is needed.

1 Member States shall jointly be controllers, as defined in Article 4, point (7), of Regulation (EU) 2016/679, of CESOP. The responsibilities of the controllers of CESOP shall be determined in an agreement between the controllers, which shall set out the rules for the exercise of rights of the data subject and their duties in relation to the provision of the information referred to in Article 13 and 14 of Regulation (EU) 2016/679. Member States shall be responsible for the following: (a) drawing up the technical specifications of CESOP, and where necessary adapting them, for the Commission to be able to: (a) establish and maintain CESOP pursuant to Article 1 of this Regulation; (b) technically manage CESOP pursuant to Article 2 of this Regulation; (c) ensure the interoperability of the national electronic systems referred to in Article 24b of Regulation (EU) No 904/2010 and CESOP pursuant to Article 3(3) of this Regulation; (d) take the security measures pursuant to Article 6(2), first subparagraph, of this Regulation; (b) setting out the rules and procedures for the selection of Eurofisc liaison officials who will have access to CESOP; (c) answering requests from data subjects regarding the exercise of the rights laid down in Chapter III of Regulation (EU) 2016/679.

2 The Commission shall be processor, as defined in Article 3, point (12), of Regulation (EU) 2018/1725, of CESOP. The Commission shall: (a) process the personal data on behalf of the Member States on their instructions and keep documentation for those instructions; (b) ensure the confidentiality of personal data when processed under this Regulation; (c) provide the necessary technical infrastructure for Member States to respond to the requests referred to in paragraph 1, point (c); (d) assist the Member States to comply with the obligations laid down in Articles 33 to 41 of Regulation (EU) 2016/679; (e) ensure the deletion of all personal data stored in CESOP in accordance with Article 24c(2), of Regulation (EU) No 904/2010; (f) make available to Member States all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by Member States or another auditor mandated by Member States, in full respect of Protocol (No 7) to the Treaty on the Functioning of the European Union on the Privileges and Immunities of the European Union.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 1 January 2024.