Following the money: the Commission maps the next phase of EU financial-intelligence access

RegCORE Client Alert | AML/CTF & AMLA

QuickTake

On 29 July 2026, the European Commission published its first report on Directive (EU) 2019/1153, which facilitates law-enforcement access to bank-account information and financial intelligence. The Council circulated the Report and its annex identifying Member State designated authorities on 26 August 2026.Available here along with its annex here. NB: The Commission adopted the Report and accompanying Annex on 29 July 2026. The Council Secretariat subsequently circulated them to Member State delegations on 26 August 2026 as documents ST 12326/26 and ST 12326/26 ADD 1. The 26 August date does not indicate a second adoption or substantive amendment and does not make the Report another four weeks late.Show Footnote

The Report arrived 726 days after the statutory deadline of 2 August 2024. It does not propose materially wider access to information held by banks, crypto-asset service providers (CASPs) or other obliged entities. Instead, the Commission concludes that it is too early to determine whether extending the definition of financial information would be necessary and proportionate. This is a deferral, not a rejection.

What this means for firms. Firms should expect requests to move more quickly through a broader range of cross-border channels as the EU connects account registers and standardises covered transaction records. Once Article 6a has been implemented nationally, covered records will have to be supplied in the prescribed electronic structured format. The same data may be requested on different legal bases and will need to reconcile across FIU, supervisory, criminal, sanctions and judicial proceedings. The principal challenge is therefore one of data, governance and process rather than a new reporting policy.

Why it matters if you get it wrong. Late, incomplete or inconsistent production can prompt scrutiny of systems and controls, senior-management governance and the institution's ability to identify its own customers and accounts. A fast, coherent and legally controlled response is more likely to narrow an inquiry than to expand it.

The Commission’s caution reflects reforms that are still being implemented. The emerging architecture connects record creation and retention, FIU analysis, national registers and the future Bank Account Registers Interconnection System (BARIS), structured transaction production, Europol and AMLA cooperation, and asset tracing and recovery.BARIS is the EU-level system, provided for in Article 16 of Regulation (EU) 2024/1624 and Article 14 et seq. of Directive (EU) 2024/1640, that is to interconnect the national centralised automated mechanisms (bank account registers and data retrieval systems) that Member States must maintain, so as to enable competent authorities to identify in which Member State a natural or legal person holds bank, payment, securities or crypto-asset accounts, without giving direct access to the underlying transaction data.Show Footnote

Two distinctions matter. Directive 2019/1153 connects the AML system with criminal enforcement, but the developing regime separates account identification, production format and the legal power to compel records.

1. BARIS and Article 6a perform different functions. BARIS will help authorised authorities identify bank, payment, securities and crypto-asset accounts and safe-deposit boxes across the EU. Article 6a concerns the structured format for specified payment-account and IBAN-based bank-account operations and crypto-asset transfers requested during a criminal investigation; it does not presently cover securities or custody transactions generally.
2. Article 6a standardises how covered records are produced; it does not create an EU-wide power to demand them. National law continues to determine the requesting authority, threshold, authorisation, deadline, grounds of challenge and evidential use.

The Report itself imposes no new production obligation. It nevertheless points towards faster, more consistent and machine-readable production, subject to national procedural law, privilege, proportionality and data-protection safeguards.

Who is affected? Article 6a is directly relevant to credit institutions and financial institutions, expressly including payment and electronic money institutions and CASPs. The wider account-identification architecture also reaches securities accounts, while technology, cloud, payment-processing and data providers may hold records needed by regulated firms.

What should firms do now?

• Map which authorities may request which information from each relevant legal entity and jurisdiction.
• Test whether covered account and transaction records can be produced completely, accurately and within realistic investigative deadlines.
• Establish a central protocol for parallel FIU, supervisory, law-enforcement, sanctions, tax and judicial requests.
• Review privilege, confidentiality, tipping-off, data-protection and cross-border production controls.
• Ensure third-party and legacy-system arrangements support timely, structured and auditable production.

Bottom line: the data architecture is becoming more integrated while the governing law remains fragmented across instruments, authorities and national procedures. Firms need interoperable data without assuming that the legal bases for obtaining and using it are equally harmonised.