Association for Financial Markets in Europe

Association for Financial Markets in Europe AFME feedback in response to the proposed EU Council Directive to amend Directive 2011/16/EU on administrative cooperation in the field of taxation 28 March 2023 The Association for Financial Markets in Europe (“AFME”) welcomes the opportunity to respond to the EU proposal to amend the Directive on administrative cooperation in the field of taxation (‘DAC’) to include crypto assets and amend the Common Reporting Standard (‘CRS’) to include electronic money products and central bank digital currencies (the “Proposal”). AFME represents a broad array of European and global participants in the wholesale financial markets. Its members comprise pan-EU and global banks as well as key regional banks, brokers, law firms, investors and other financial market participants. We advocate stable, competitive, sustainable European financial markets that…

…on the EU Transparency Register, registration number 65110063986-76. AFME’s response covers the following themes: 1. Extraterritoriality 2. Alignment with the existing CRS and Foreign Account Tax Compliance Act (‘FATCA’) requirements 3. Practical issues with regards to taxpayer identification numbers (‘TINs’) 4. Specific compliance issues. Each of these themes will need to be analysed in detail to assist in implementing DAC8 in a fair and efficient manner. 1. Extraterritoriality The proposed DAC8 regulations state that where a reporting crypto-asset service provider (‘RCASP’) is not registered under a market in crypto assets (‘MiCA’) or otherwise operating in the EU it will be required to register under DAC8 in a Member State in order to report EU clients.

…operating in the EU it will be required to register under DAC8 in a Member State in order to report EU clients. This proposal deviates from the Crypto-Asset Reporting Framework (‘CARF’) and Common Reporting Standard (‘CRS’) and de facto introduces an extra- territorial impact of DAC8, which would create conflicts with local data protection laws. Accordingly, we ask that you consider the following: 1.1 Extraterritorial reporting obligation – DAC8 requires non-EU RCASPs providing a crypto service to the EU to register with an EU member state and adhere to the due diligence and reporting requirements of the member state with whom it registered. While RCASPs resident in jurisdictions that have adopted rules equivalent to DAC8 are excused from this obligation, fundamentally this creates an extraterritorial reporting obligation for entities located outside of the EU to an EU member state.

…this creates an extraterritorial reporting obligation for entities located outside of the EU to an EU member state. This creates potential privacy and secrecy issues, including a conflict of law if local laws in the jurisdiction where an entity is established place restrictions on the collection of personal information without valid, local legal obligations to do so and/or reporting of personal information to other countries. It is noted that the EU’s own General Data Protection Regulation is one example of such data privacy legislation. In February 2012, when the U.S. Treasury Department and Internal Revenue Service (‘IRS’) issued the “Proposed Regulations to implement FATCA” the EC and EU Member States stated that those regulations could not be applied directly in the EU due to constraints posed by local national laws (i.e., Ref.

…those regulations could not be applied directly in the EU due to constraints posed by local national laws (i.e., Ref. Ares(2023)2229345 - 28/03/2023 2 no legal bases and data protections issues), so the US Treasury Department developed intergovernmental agreements to alleviate this situation. Therefore, it is recommended that the EU Council reconsiders the extraterritorial scope of its DAC8 rules – particularly bearing in mind both that CRS and FATCA are deliberately predicated on cross-border exchange of information between participating countries based on mutual agreement. 1.2 Tax Nexus Through Branch - Section I(A)(5) of Annex III of the Proposal defines a tax nexus as “an Entity or individual that has a regular place of business in a Member State and is not a Qualified Non- Union Reporting Crypto-Assets Service Provider”.

…place of business in a Member State and is not a Qualified Non- Union Reporting Crypto-Assets Service Provider”. CARF clarifies that any Branch is to be considered a regular place of business and RCASPs are not required to complete the reporting and due diligence requirements with respect to Relevant Transactions it effectuates through a Branch in a Partner Jurisdiction, if such requirements are completed by such Branch. This would mean that an entity located in a jurisdiction with no regime equivalent to DAC8 with a branch in an EU country would have due diligence and reporting requirements in the branch location on all its relevant transactions, except transactions effectuated through the Branch. (For example, an RCASP has its head office located in Singapore and has a branch in Germany.

…through the Branch. (For example, an RCASP has its head office located in Singapore and has a branch in Germany. It seems that based on Section I (A) (5) the head office in Singapore is regarded as a tax resident in Germany and needs to report on all its relevant transactions, except transactions effectuated through the Branch). We ask that the Council clarify this requirement. 2. Alignment with the existing CRS and FATCA requirements. From an operational perspective it is essential that DAC8 be harmonised as closely as possible with the CRS and FATCA requirements to reduce duplication of effort and an unnecessary burden on financial institutions (FI’s) and RCASP’s operational teams. Therefore, we ask that the EU Council harmonise the following with CRS and FATCA.

(FI’s) and RCASP’s operational teams. Therefore, we ask that the EU Council harmonise the following with CRS and FATCA. 2.1 Reporting - The reporting deadline of January 31st following the relevant calendar year is a very short timeframe for a large financial institution. We believe this deadline would create repetition and a strain on the ability to report, as well as creating inefficiencies by not allowing FIs/RCASPs to align the reporting with CRS and FATCA reporting obligations. We would anticipate more efficient compliance and higher data quality reported if this was harmonised with the CRS and FATCA deadlines of May/June as FI’s already have processes in place to satisfy those later dates. 2.2 Penalties - We would appreciate if there was more harmonisation with CRS and FATCA penalties to provide clarity and consistency of penalties across the regimes.

…was more harmonisation with CRS and FATCA penalties to provide clarity and consistency of penalties across the regimes. 2.3 Branch reporting - We would ask that the EU Council align the branch reporting requirements to that of CRS and FATCA. 2.4 In addition, we would ask that the EU Council aligns the start date for the inclusion of e-money product and Crypto assets into CRS with that of the rest of DAC8 (January 1st 2026). 3. Practical issues with regards to TINs. Obtaining and reporting TINs has created significant operational issues for FIs due to the different approach member states have regarding their issuance. We highlight below some of those issues: 3.1 Mandatory TIN collection and reporting - Previously the requirement for TINs to be mandatory for all new accounts was removed after consultation.

…reporting - Previously the requirement for TINs to be mandatory for all new accounts was removed after consultation. However, under the Proposal, TINs are mandatory for all new and existing accounts for reporting from 1 January 2026. TIN collection still poses significant difficulties for FIs and RCASPs as consistently getting TINs from clients has proven extremely difficult and will require significant system/process configuration/alignment in order to comply with the proposed directive. This is because, among other things, some countries do not produce TINs and others do not produce them for certain entity types. The AFME group does not see merits in reintroducing this requirement after it was removed after consultation.

…types. The AFME group does not see merits in reintroducing this requirement after it was removed after consultation. Also, if TINs are to remain a 3 mandatory requirement, then additional clarification as to what is required if a TIN cannot be obtained from a client who has provided all other information points would be needed. 3.2 TIN Verification tool - Clarification is required regarding the tool the Commission will develop for Member States allowing them to verify the correctness of TINs. There are concerns that this could create some data protection concerns with regards to the cross-border travel of client data that may need to be addressed, and that the file format of the website may not be easy to use for the market participants. We suggest using a format that is readable and possible to download to use in internal systems by the industry.

We suggest using a format that is readable and possible to download to use in internal systems by the industry. 3.3 Differentiation of missing TINs - There are many situations where TINs are either not issued/required, or they are not able to be obtained due to other valid reasons. We would ask that the EU Council consider some kind of marker or coding system that FIs/RCASPs can use to differentiate these situations vs ones where the client presumably has a TIN but has not provided it. 4. Specific compliance issues 4.1 A de minimus transaction exception - Is it necessary to report all relevant crypto asset transactions? We feel that a de minimus exception for all transactions would reduce the burden of reporting on RCASPs and increase the usefulness of the data provided to the tax authorities.

16 → 12

originalus šaltinis (PDF) ↗

Association for Financial Markets in Europe London Office: Level 10, 20 Churchill Place, London E14 5HJ, United Kingdom T: +44 (0)20 3828 2700 Brussels Office: Rue de la Loi 82, 1040 Brussels, Belgium T: +32 (0)2 883 5540 Frankfurt Office: c/o SPACES – Regus, First Floor Reception, Große Gallusstraße 16-18, 60312, Frankfurt am Main, Germany T:+ 49 (0)69 710 456 660 www.afme.eu Company Registration No: 6996678 Registered Office: Level 10, 20 Churchill Place, London E14 5HJ AFME is registered on the EU Transparency Register, registration number 65110063986-76 Call for evidence EU Directive on Administrative Cooperation in the Field of Direct Taxation 9 February 2026 The Association for Financial Markets in Europe (AFME) welcomes the opportunity to to respond to the Commission’s call for evidence for an impact assessment of the EU Directive on Administrative Cooperation in the Field of…

…for an impact assessment of the EU Directive on Administrative Cooperation in the Field of Direct Taxation (‘DAC’). AFME represents a broad array of European and global participants in the wholesale financial markets. Its members comprise pan-EU and global banks as well as key regional banks, brokers, law firms, investors and other financial market participants. We advocate stable, competitive, sustainable European financial markets that support economic growth and benefit society. AFME is the European member of the Global Financial Markets Association (GFMA) a global alliance with the Securities Industry and Financial Markets Association (SIFMA) in the US, and the Asia Securities Industry and Financial Markets Association (ASIFMA) in Asia. AFME is registered on the EU Transparency Register, registration number 65110063986-76.

Association (ASIFMA) in Asia. AFME is registered on the EU Transparency Register, registration number 65110063986-76. We welcome the initiative to simplify and clarify reporting obligations under the Directive on Adminis- trative Cooperation (DAC) and to potentially consolidate various provisions into a single Directive for greater clarity. We support initiatives to improve the efficient collection of data required for compliance with tax law and the exchange of information between Tax Administrations within the EU. In our view, there is room for simplification and greater harmonisation in order to reduce compliance costs for busi- nesses and deliver better targeted information for tax authorities. We note that the Commission’s evaluation indicates that vast majority of the costs of DAC are borne by business (€604m compared to €42m for tax authorities).

…indicates that vast majority of the costs of DAC are borne by business (€604m compared to €42m for tax authorities). These costs are substantial and should be minimised. We welcome the Commission’s focus on DAC6, where we think there is potential to simplify the rules and to minimise compliance costs. We believe that DAC6 should be reviewed to ensure it is appropri- ately targeted at abusive arrangements. To ensure better targeted The Commission should publish a regularly updated ‘whitelist’ of arrangements that are considered non-abusive and do not require re- porting.

…publish a regularly updated ‘whitelist’ of arrangements that are considered non-abusive and do not require re- porting. Consideration should also be given to the introduction of a de-minimis threshold to remove reporting requirements for immaterial arrangements DAC 6 needs to be considered in conjunction with other transparency initiatives, such as the OECD’s Pillar II rules and the new EU public country-by-country reporting requirements, to minimise costs and avoid duplication. Transactions reported under other regimes (e.g. DAC 3) should not also be reported under DAC 6. The DAC has led to the routine exchange of substantial amounts of information between tax authorities, but there is little public information as to how this information is used. In particular, it appears that MS tax authorities rarely amend tax laws in response to information received under DAC 6.

…particular, it appears that MS tax authorities rarely amend tax laws in response to information received under DAC 6. It would be helpful to have greater transparency around the use of this data, so that the effectiveness of the DAC can be better assessed. There is no consistent approach to DAC among Member States, leading to additional costs as compa- nies have to interpret the rules and establish procedures and controls in each MS. It would be helpful if the Commission could provide guidance to promote consistent interpretation and application, and es- tablish a coherent framework for penalties to maintain a level playing field across Member States, to ensure consistency, proportionality and certainty in enforcement. Ref. Ares(2026)1508132 - 10/02/2026 / 2 We would welcome the opportunity to discuss these issues further with the Commission.

- 10/02/2026 / 2 We would welcome the opportunity to discuss these issues further with the Commission. Ian Sandles Carolina Cazzarolli Louise Rodger Director, Tax and Accounting Manager, Advocacy Managing Director, Compliance [email protected] [email protected] [email protected] Tel: +44 20 3828 2708 Tel: + 32 2883 5543 Tel: + 44 20 3828 2742

originalus šaltinis (PDF) ↗

Association for Financial Markets in Europe Association for Financial Markets in Europe London Office: 39th Floor, 25 Canada Square, London E14 5LQ, United Kingdom T: +44 (0)20 3828 2700 Brussels Office: Rue de la Loi 82, 1040 Brussels, Belgium T: +32 (0)2 788 3971 Frankfurt Office: Bürohaus an der Alten Oper, Neue Mainzer Straße 75, 60311 Frankfurt am Main, Germany T: +49 (0)69 153 258 967 www.afme.eu AFME feedback on the European Commission’s Roadmap on the report on the application of the General Data Protection Regulation 29th April 2020 The Association for Financial Markets in Europe (AFME)1 is pleased to provide feedback to the European Commission’s roadmap on the upcoming report on the application of the General Data Protection Regulation (‘GDPR’)2. AFME represents a broad array of European and global participants in the wholesale financial markets.

AFME represents a broad array of European and global participants in the wholesale financial markets. Its members comprise pan-EU and global banks as well as key regional banks, brokers, law firms, investors and other financial market participants. We advocate stable, competitive, sustainable European financial markets that support economic growth and benefit society. The GDPR is intended to give individuals more control over their personal data, to provide a greater level of transparency as to what is being processed and why, and to ensure that data controllers can demonstrate that their companies comply with the requirements. It also aims to improve business opportunities by facilitating the free flow of personal data in the European Digital Single Market.

…to improve business opportunities by facilitating the free flow of personal data in the European Digital Single Market. AFME believes that the GDPR has been an important milestone and we set out below some brief comments we hope the European Commission finds useful in the drafting of its report on the application of the GDPR. Scope of the review: Article 97 GDPR requires the European Commission to submit a report on the evaluation and review of the GDPR. Article 97(2) requires the Commission to examine, in particular, the application and functioning of Chapter V on the transfer of personal data to third countries, and Chapter VII on cooperation and consistency. The Commission may choose also to consider other aspects of the GDPR in its review.

VII on cooperation and consistency. The Commission may choose also to consider other aspects of the GDPR in its review. We note that the European Council in its position and findings on the application of the General Data Protection Regulation “encourages the Commission to evaluate and review in its upcoming report the application and functioning of the GDPR beyond what is specifically mentioned in that article”3. Given the importance and the impact of the GDPR, AFME is of the opinion that the European Commission should not limit its review to the issue of international transfer of personal data to third countries and the cooperation and consistency mechanism between national data protection authorities.

…data to third countries and the cooperation and consistency mechanism between national data protection authorities. In this note, we set out our comments on the following aspects of the GDPR ▪ Firms in the financial sector, in particular with regard to data sharing for the purposes of AML/CFT; ▪ International transfers (in particular Standard Contractual Clauses); ▪ Geographic scope (Article 3 GDPR); ▪ Cooperation and consistency. 1 AFME is the European member of the Global Financial Markets Association (GFMA) a global alliance with the Securities Industry and Financial Markets Association (SIFMA) in the US, and the Asia Securities Industry and Financial Markets Association (ASIFMA) in Asia. AFME is registered on the EU Transparency Register, registration number 65110063986- 76. 2 Report on the application of the General Data Protection Regulation - Roadmap.

…registration number 65110063986- 76. 2 Report on the application of the General Data Protection Regulation - Roadmap. 3 Council position and findings on the application of the General Data Protection Regulation (GDPR), paragraph (6). Ref. Ares(2020)2298286 - 29/04/2020 2 Firms in the financial sector: The GDPR is intended to give individuals more control over their personal data, to provide a greater level of transparency as to what is being processed and why, and to ensure that data controllers can demonstrate that their companies comply with the requirements. Firms are however required to obtain, analyse, and retain large amounts of personal data in order to meet their wider regulatory obligations, including responding to requests from financial regulators and from law enforcement.

…wider regulatory obligations, including responding to requests from financial regulators and from law enforcement. So, on the face of it, there could be a conflict between the GDPR and the financial regulatory framework, unless there is a clear lawful basis for processing. Firms may need to process personal data for the following purposes: (1) Compliance with a legal obligation under EU or Member State law (2) Compliance with guidance from regulatory authorities (3) Compliance with a non-EU legal obligation (4) Regulatory cooperation with financial conduct regulators and law enforcement (where not mandated by EU law) (5) Protection, e.g.

…cooperation with financial conduct regulators and law enforcement (where not mandated by EU law) (5) Protection, e.g. protecting the firm against legal claims, or protecting the firm, customers and others against fraud and other crimes The key point in each situation is for firms to establish a lawful basis for processing, and to be able to demonstrate that they have done so. There are specific rules for certain cases, such as processing of special categories of personal data (Article 9 GDPR), processing of personal data relating to criminal convictions and offences (Article 10 GDPR), and international transfers (Chapter V GDPR). In these cases, in addition to establishing a lawful basis for processing as described above, it is necessary to meet further conditions.

…addition to establishing a lawful basis for processing as described above, it is necessary to meet further conditions. While there is a potential conflict in certain cases between the GDPR and the financial regulatory framework, our analysis is that the GDPR has anticipated most of the problems, and that firms should generally be able to continue processing data to meet their wider obligations to regulators. We would nevertheless encourage the European Commission to ask, as part of its review, whether there are any areas of potential conflict, and we would be pleased to seek input from the industry in this regard. For instance, in the context of financial crime and the fight against money laundering, it is important to ensure that obliged entities are able to access information which may be relevant to carry out customer due diligence.

…ensure that obliged entities are able to access information which may be relevant to carry out customer due diligence. National competent authorities have also expressed some questions about their abilities to exchange information between them, including outside of the EU. International transfers: AFME would welcome further legal certainty as regards international data transfers, notably considering the current legal challenges to the European Commission Standard Contractual Clauses (SCCs)4, the EU-US Privacy Shield5, as well as the uncertainty surrounding Brexit. Guidance on how best to deal with international transfers involving EEA-based processors acting on the instructions of a non-EEA entity would for instance be particularly helpful. 4 Case C-311/18. 5 Case T-738/16.

…on the instructions of a non-EEA entity would for instance be particularly helpful. 4 Case C-311/18. 5 Case T-738/16. 3 Furthermore, with regards to SCCs, we would encourage the Commission to focus on specific improvements needed to the SCCs, namely as it relates to a data processor in the EU transferring personal data to its sub- processors outside of the EU, in order to provide services to the data controller with whom a service agreement is in force. In these cases, the SCCs provided in Decision 2010/876 cannot be used. The Commission could, for instance, make reference to or take into account the former WP29 working document on “Draft Ad hoc contractual clauses EU data processor to non-EU sub-processor” (WP214 of 21 March 2014)7 which provide different options to regulate the transfers to third countries.

…sub-processor” (WP214 of 21 March 2014)7 which provide different options to regulate the transfers to third countries. Moreover, we believe that the European Commission, in order to ensure that data subjects have an effective protection vis-à-vis a cross border transfer, should make reference to, and take into consideration, the application of article 50 GDPR. It would be advisable that the European Data Protection Authorities (DPAs), the EDPB and the European Commission actively work to implement an effective international cooperation system, in compliance with article 50 GDPR.

16 → 12

originalus šaltinis (PDF) ↗