Directive (EU) 2024/1654 of the European Parliament and of the Council of 31 May 2024 amending Directive (EU) 2019/1153 as regards access by competent authorities to centralised bank account registries through the interconnection system and technical measures to facilitate the use of transaction records

‘1 This Directive lays down: (a) measures to facilitate access to and the use of financial information and bank account information by competent authorities for the prevention, detection, investigation or prosecution of serious criminal offences; (b) measures to facilitate access to law enforcement information by Financial Intelligence Units (FIUs) for the prevention and combating of money laundering, associate predicate offences and terrorist financing and measures to facilitate cooperation between FIUs; and (c) technical measures to facilitate the use of transaction records by competent authorities for the prevention, detection, investigation or prosecution of serious criminal offences.’

‘1a Member States shall ensure that the competent national authorities designated pursuant to Article 3(1) of this Directive have the power to access and search, directly and immediately, bank account information in other Member States available through the bank account registers interconnection system (BARIS) put in place pursuant to Article 16(6) of Directive (EU) 2024/1640 where necessary for the performance of their tasks for the purpose of preventing, detecting, investigating or prosecuting a serious criminal offence or supporting a criminal investigation concerning a serious criminal offence, including the identification, tracing and freezing of the assets related to such investigation. A Member State may limit the power to access and search bank account information through the BARIS to situations in which its competent national authorities designated pursuant to Article 3(1) have justified reasons to believe that there might be relevant bank account information in other Member States. Without prejudice to Article 4(2) of Directive (EU) 2016/680, bank account information obtained by means of accessing and searching the BARIS shall be processed only for the purpose for which it was collected. Access and searches pursuant to this paragraph shall be considered to be direct and immediate, inter alia, where the national authorities operating the central bank account registries transmit the bank account information expeditiously by an automated mechanism to competent authorities, provided that no intermediary institution is able to interfere with the requested data or the information to be provided.

1b Access and searches pursuant to this Article shall be without prejudice to national procedural safeguards and Union and national rules on the protection of personal data.’

‘1 Access to and searches of bank account information in accordance with Article 4(1) and (1a) shall be performed only on a case-by-case basis by the staff of each competent authority that have been specifically designated and authorised to perform those tasks.’

‘3 Member States shall ensure that technical and organisational measures are in place to ensure the security of the data to high technological standards for the purposes of the exercise by competent authorities of the power to access and search bank account information in accordance with Article 4(1) and (1a).’

‘1 Member States shall provide that the authorities operating the centralised bank account registries ensure that logs are kept each time designated competent authorities access and search bank account information in accordance with Article 4(1) and (1a).’

1 Member States shall ensure that financial institutions and credit institutions, including crypto-asset service providers, comply with the technical specifications established in accordance with paragraph 2 when replying, in accordance with national law, to requests for transaction records issued by competent authorities as part of a criminal investigation, including the identification, tracing and freezing of assets related to such investigation.

2 The Commission is empowered to adopt, by means of implementing acts, technical specifications in order to establish the electronic structured format and technical means to be used for providing transaction records. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 22(3). When adopting such implementing acts, the Commission shall consider developments in relevant financial services messaging standards.’

1 Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 10 July 2027. By way of derogation from the first subparagraph of this paragraph, Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with Article 1, points (4) and (5), of this Directive by 10 July 2029. They shall immediately inform the Commission thereof. When Member States adopt those measures, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.

2 Member States shall communicate to the Commission the text of the main measures of national law which they adopt in the field covered by this Directive.

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Directive is addressed to the Member States in accordance with the Treaties.