title: Directive (EU) 2019/692 of the European Parliament and of the Council of 17 April 2019 amending Directive 2009/73/EC concerning common rules for the internal market in natural gas (Text with EEA relevance.)

text:
                  3.5.2019

                  EN

                  Official Journal of the European Union

                  L 117/1

         DIRECTIVE (EU) 2019/692 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
         of 17 April 2019
         amending Directive 2009/73/EC concerning common rules for the internal market in natural gas
         (Text with EEA relevance)
         THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
         Having regard to the Treaty on the Functioning of the European Union, and in particular Article 194(2) thereof,
         Having regard to the proposal from the European Commission,
         After transmission of the draft legislative act to the national parliaments,
         Having regard to the opinion of the European Economic and Social Committee (1),
         Having regard to the opinion of the Committee of the Regions (2),
         Acting in accordance with the ordinary legislative procedure (3),
         Whereas:

                     (1)

                     The internal market in natural gas, which has been progressively implemented throughout the Union since 1999, aims to deliver real choice for all final customers in the Union, be they citizens or businesses, new business opportunities, fair conditions of competition, competitive prices, efficient investment signals and a higher standard of service, and to contribute to security of supply and sustainability.

                     (2)

                     Directives 2003/55/EC (4) and 2009/73/EC (5) of the European Parliament and of the Council have made a significant contribution towards the creation of the internal market in natural gas.

                     (3)

                     This Directive seeks to address obstacles to the completion of the internal market in natural gas which result from the non-application of Union market rules to gas transmission lines to and from third countries. The amendments introduced by this Directive are intended to ensure that the rules applicable to gas transmission lines connecting two or more Member States are also applicable, within the Union, to gas transmission lines to and from third countries. This will establish consistency of the legal framework within the Union while avoiding distortion of competition in the internal energy market in the Union and negative impacts on the security of supply. It will also enhance transparency and provide legal certainty to market participants, in particular investors in gas infrastructure and system users, as regards the applicable legal regime.

                     (4)

                     To take account of the lack of specific Union rules applicable to gas transmission lines to and from third countries before the date of entry into force of this Directive, Member States should be able to grant derogations from certain provisions of Directive 2009/73/EC to such gas transmission lines which are completed before the date of entry into force of this Directive. The relevant date for the application of unbundling models other than ownership unbundling should be adapted for gas transmission lines to and from third countries.

                     (5)

                     Pipelines connecting a third-country oil or gas production project to a processing plant or to a final coastal landing terminal within a Member State should be considered to be upstream pipeline networks. Pipelines connecting an oil or gas production project in a Member State to a processing plant or to a final coastal landing terminal within a third country should not be considered to be upstream pipeline networks for the purpose of this Directive, since such pipelines are unlikely to have a significant impact on the internal energy market.

                     (6)

                     Transmission system operators should be free to conclude technical agreements with transmission system operators or other entities in third countries on issues concerning the operation and interconnection of transmission systems, provided that the content of such agreements is compatible with Union law.

                     (7)

                     Technical agreements regarding the operation of transmission lines between transmission system operators or other entities should remain in force provided that they comply with Union law and the relevant decisions of the national regulatory authority.

                     (8)

                     When such technical agreements are in place, the conclusion of an international agreement between a Member State and a third country or of an agreement between the Union and a third country regarding the operation of the gas transmission line concerned is not required by this Directive.

                     (9)

                     The applicability of Directive 2009/73/EC to gas transmission lines to and from third countries remains confined to the territory of the Member States. As regards offshore gas transmission lines, Directive 2009/73/EC should be applicable in the territorial sea of the Member State where the first interconnection point with the Member States' network is located.

                     (10)

                     It should be possible for existing agreements concluded between a Member State and a third country on the operation of transmission lines to remain in force, in accordance with this Directive.

                     (11)

                     With regard to agreements or parts of agreements with third countries which may affect common rules of the Union, a coherent and transparent procedure should be established by which to authorise a Member State, upon its request, to amend, extend, adapt, renew or conclude an agreement with a third country on the operation of a transmission line or an upstream pipeline network between the Member State and a third country. The procedure should not delay the implementation of this Directive, should be without prejudice to the allocation of competence between the Union and the Member States, and should apply to existing and new agreements.

                     (12)

                     Where it is apparent that the subject matter of an agreement falls partly within the competence of the Union and partly within that of a Member State, it is essential to ensure close cooperation between that Member State and the Union institutions.

                     (13)

                     Commission Regulation (EU) 2015/703 (6), Commission Regulation (EU) 2017/459 (7), Commission Decision 2012/490/EU (8), as well as Chapters III, V, VI and IX, and Article 28 of Commission Regulation (EU) 2017/460 (9) apply to entry points from and exit points to third countries, subject to the relevant decisions of the relevant national regulatory authority, whereas Commission Regulation (EU) No 312/2014 (10) applies exclusively to balancing zones within the borders of the Union.

                     (14)

                     In order to adopt decisions authorising or refusing to authorise a Member State to amend, extend, adapt, renew or conclude an agreement with a third country, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (11).

                     (15)

                     Since the objective of this Directive, namely to establish consistency of the legal framework within the Union while avoiding distortion of competition in the internal energy market in the Union, cannot be sufficiently achieved by the Member States, but can rather, by reasons of its scale and effects, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary to achieve that objective.

                     (16)

                     In accordance with the Joint Political Declaration of 28 September 2011 of Member States and the Commission on explanatory documents (12), Member States have undertaken to accompany, in justified cases, the notification of their transposition measures with one or more documents explaining the relationship between the components of a Directive and the corresponding parts of national transposition instruments. With regard to this Directive, the legislator considers the transmission of such documents to be justified.

                     (17)

                     Directive 2009/73/EC should therefore be amended accordingly,

               HAVE ADOPTED THIS DIRECTIVE:

            Article 1
            Amendments to Directive 2009/73/EC
            Directive 2009/73/EC is amended as follows:

                        (1)

                        in Article 2, point (17) is replaced by the following:

                                    ‘(17)

                                    “interconnector” means a transmission line which crosses or spans a border between Member States for the purpose of connecting the national transmission system of those Member States or a transmission line between a Member State and a third country up to the territory of the Member States or the territorial sea of that Member State;’;

                        (2)

                        Article 9 is amended as follows:

                                    (a)

                                    in paragraph 8, the first subparagraph is replaced by the following:

                                       ‘8.   Where on 3 September 2009 the transmission system belonged to a vertically integrated undertaking, a Member State may decide not to apply paragraph 1. As regards the part of the transmission system connecting a Member State with a third country between the border of that Member State and the first connection point with that Member State's network, where on 23 May 2019 the transmission system belongs to a vertically integrated undertaking, a Member State may decide not to apply paragraph 1.’;

                                    (b)

                                    paragraph 9 is replaced by the following:

                                       ‘9.   Where on 3 September 2009 the transmission system belonged to a vertically integrated undertaking and arrangements are in place which guarantee more effective independence of the transmission system operator than the provisions of Chapter IV, a Member State may decide not to apply paragraph 1 of this Article.
                                       As regards the part of the transmission system connecting a Member State with a third country between the border of that Member State and the first connection point with that Member State's network, where on 23 May 2019 the transmission system belongs to a vertically integrated undertaking and arrangements are in place which guarantee more effective independence of the transmission system operator than the provisions of Chapter IV, that Member State may decide not to apply paragraph 1 of this Article.’;

                        (3)

                        in Article 14, paragraph 1 is replaced by the following:

                           ‘1.   Where on 3 September 2009 the transmission system belonged to a vertically integrated undertaking, a Member State may decide not to apply Article 9(1) and to designate an independent system operator upon a proposal from the transmission system owner.
                           As regards the part of the transmission system connecting a Member State with a third country between the border of that Member State and the first connection point with that Member State's network, where on 23 May 2019 the transmission system belongs to a vertically integrated undertaking, that Member State may decide not to apply Article 9(1) and to designate an independent system operator upon a proposal from the transmission system owner.
                           The designation of an independent system operator shall be subject to approval by the Commission.’;

                        (4)

                        in Article 34, paragraph 4 is replaced by the following:

                           ‘4.   In the event of cross-border disputes, the dispute-settlement arrangements for the Member State having jurisdiction over the upstream pipeline network which refuses access shall be applied. Where, in cross-border disputes, more than one Member State covers the network concerned, the Member States concerned shall consult each other with a view to ensuring that the provisions of this Directive are applied consistently. Where the upstream pipeline network originates from a third country and connects to at least one Member State, the Member States concerned shall consult each other and the Member State where the first entry point to the Member States' network is located shall consult the third country concerned where the upstream pipeline network originates, with a view to ensuring, as regards the network concerned, that this Directive is applied consistently in the territory of the Member States.’;

                        (5)

                        Article 36 is amended as follows:

                                    (a)

                                    in paragraph 1, point (e) is replaced by the following:

                                                ‘(e)

                                                the exemption must not be detrimental to competition in the relevant markets which are likely to be affected by the investment, to the effective functioning of the internal market in natural gas, the efficient functioning of the regulated systems concerned, or to security of supply of natural gas in the Union.’;

                                    (b)

                                    paragraph 3 is replaced by the following:

                                       ‘3.   The regulatory authority referred to in Chapter VIII may, on a case-by-case basis, decide on the exemption referred to in paragraphs 1 and 2.
                                       Before the adoption of the decision on the exemption, the national regulatory authority, or where appropriate another competent authority of that Member State, shall consult:

                                                   (a)

                                                   the national regulatory authorities of the Member States the markets of which are likely to be affected by the new infrastructure; and

                                                   (b)

                                                   the relevant authorities of the third countries, where the infrastructure in question is connected with the Union network under the jurisdiction of a Member State, and originates from or ends in one or more third countries.

                                             Where the third-country authorities consulted do not respond to the consultation within a reasonable time frame or within a set deadline not exceeding three months, the national regulatory authority concerned may adopt the necessary decision.’;

                                    (c)

                                    in paragraph 4, the second subparagraph is replaced by the following:
                                    ‘Where all the regulatory authorities concerned agree on the request for exemption within six months of the date on which it was received by the last of the regulatory authorities, they shall inform the Agency of their decision. Where the infrastructure concerned is a transmission line between a Member State and a third country, before the adoption of the decision on the exemption, the national regulatory authority, or where appropriate another competent authority of the Member State where the first interconnection point with the Member States' network is located, may consult the relevant authority of that third country with a view to ensuring, as regards the infrastructure concerned, that this Directive is applied consistently in the territory and, where applicable, in the territorial sea of that Member State. Where the third country authority consulted does not respond to the consultation within a reasonable time or within a set deadline not exceeding three months, the national regulatory authority concerned may adopt the necessary decision.’;

                        (6)

                        in Article 41(1), point (c) is replaced by the following:

                                    ‘(c)

                                    cooperating with regard to cross-border issues with the regulatory authority or authorities of the Member States concerned and with the Agency. In respect of infrastructure to and from a third country, the regulatory authority of the Member State where the first interconnection point with the Member States' network is located may cooperate with the relevant authorities of the third country, after consulting the regulatory authorities of other Member States concerned, aiming at, as regards this infrastructure, consistent application of this Directive in the territory of the Member States;’;

                        (7)

                        in Article 42, the following paragraph is added:

                           ‘6.   Regulatory authorities, or where appropriate other competent authorities, may consult and cooperate with the relevant authorities of third countries in relation to the operation of gas infrastructure to and from third countries with a view to ensuring, as regards the infrastructure concerned, that this Directive is applied consistently in the territory and territorial sea of a Member State.’;

                        (8)

                        the following Article is inserted:

                           ‘Article 48a
                           Technical agreements regarding the operation of transmission lines
                           This Directive does not affect the freedom of transmission system operators or other economic operators to maintain in force or to conclude technical agreements on issues concerning the operation of transmission lines between a Member State and a third country, insofar as those agreements are compatible with Union law and relevant decisions of the national regulatory authorities of the Member States concerned. Such agreements shall be notified to the regulatory authorities of the Member States concerned.’;

                        (9)

                        the following articles are inserted:

                           ‘Article 49a
                           Derogations in relation to transmission lines to and from third countries

                              1.   In respect of gas transmission lines between a Member State and a third country completed before 23 May 2019, the Member State where the first connection point of such a transmission line with a Member State's network is located may decide to derogate from Articles 9, 10, 11 and 32 and Article 41(6), (8) and (10) for the sections of such gas transmission line located in its territory and territorial sea, for objective reasons such as to enable the recovery of the investment made or for reasons of security of supply, provided that the derogation would not be detrimental to competition on or the effective functioning of the internal market in natural gas, or to security of supply in the Union.
                              The derogation shall be limited in time up to 20 years based on objective justification, renewable if justified and may be subject to conditions which contribute to the achievement of the above conditions.
                              Such derogations shall not apply to transmission lines between a Member State and a third country which has the obligation to transpose this Directive and which effectively implements this Directive in its legal order under an agreement concluded with the Union.

                              2.   Where the transmission line concerned is located in the territory of more than one Member State, the Member State in the territory of which the first connection point with the Member States' network is located shall decide whether to grant a derogation for that transmission line after consulting all the Member States concerned.
                              Upon request by the Member States concerned, the Commission may decide to act as an observer in the consultation between the Member State in the territory of which the first connection point is located and the third country concerning the consistent application of this Directive in the territory and territorial sea of the Member State where the first interconnection point is located, including the granting of derogations for such transmission lines.

                              3.   Decisions pursuant to paragraphs 1 and 2 shall be adopted by 24 May 2020. Member States shall notify any such decisions to the Commission and shall publish them.

                           Article 49b
                           Empowerment procedure

                              1.   Without prejudice to other obligations under Union law, and to the allocation of competence between the Union and the Member States, existing agreements between a Member State and a third country on the operation of a transmission line or an upstream pipeline network may be maintained in force until the entry into force of a subsequent agreement between the Union and the same third country or until the procedure under paragraphs 2 to 15 of this Article applies.

                              2.   Without prejudice to the allocation of competence between the Union and the Member States, where a Member State intends to enter into negotiations with a third country in order to amend, extend, adapt, renew or conclude an agreement on the operation of a transmission line with a third country concerning matters falling, entirely or partly, within the scope of this Directive, it shall notify the Commission of its intention in writing.
                              Such a notification shall include the relevant documentation and an indication of the provisions to be addressed in the negotiations or to be renegotiated, the objectives of the negotiations and any other relevant information, and shall be transmitted to the Commission at least five months before the intended start of the negotiations.

                              3.   Further to any notification pursuant to paragraph 2, the Commission shall authorise the Member State concerned to enter into formal negotiations with a third country for the part which may affect Union common rules unless it considers that the opening of such negotiations would:

                                          (a)

                                          be in conflict with Union law other than the incompatibilities arising from the allocation of competence between the Union and the Member States;

                                          (b)

                                          be detrimental to the functioning of the internal market in natural gas, competition or security of supply in a Member State or in the Union;

                                          (c)

                                          undermine the objectives of pending negotiations of intergovernmental agreements by the Union with a third country;

                                          (d)

                                          be discriminatory.

                              4.   When carrying out the assessment under paragraph 3, the Commission shall take into account whether the intended agreement concerns a transmission line or an upstream pipeline that contributes to the diversification of natural gas supplies and suppliers by means of new natural gas sources.

                              5.   Within 90 days of receipt of the notification referred to in paragraph 2, the Commission shall adopt a decision authorising or refusing to authorise a Member State to enter into negotiations in order to amend, extend, adapt, renew or conclude an agreement with a third country. Where additional information is needed to adopt a decision, the 90-day period shall run from the date of receipt of such additional information.

                              6.   In the event that the Commission adopts a decision refusing to authorise a Member State to enter into negotiations in order to amend, extend, adapt, renew or conclude an agreement with a third country, it shall inform the Member State concerned accordingly and shall give the reasons therefor.

                              7.   Decisions authorising or refusing to authorise a Member State to enter into negotiations in order to amend, extend, adapt, renew or conclude an agreement with a third country shall be adopted, by means of implementing acts, in accordance with the procedure referred to in Article 51(2).

                              8.   The Commission may provide guidance and may request the inclusion of particular clauses in the agreement envisaged, in order to ensure compatibility with Union law in accordance with Decision (EU) 2017/684 of the European Parliament and of the Council (*1).

                              9.   The Commission shall be kept informed of the progress and results of the negotiations to amend, extend, adapt, renew or to conclude an agreement throughout the different stages of such negotiations and may request to participate in such negotiations between the Member State and the third country in accordance with Decision (EU) 2017/684.

                              10.   The Commission shall inform the European Parliament and the Council of the decisions adopted pursuant to paragraph 5.

                              11.   Before signing an agreement with a third country, the Member State concerned shall notify the Commission of the outcome of negotiations and shall transmit the text of the negotiated agreement to the Commission.

                              12.   Upon notification pursuant to paragraph 11, the Commission shall assess the negotiated agreement pursuant to paragraph 3. Where the Commission finds that the negotiations have resulted in an agreement which complies with paragraph 3, it shall authorise the Member State to sign and conclude the agreement.

                              13.   Within 90 days of receipt of the notification referred to in paragraph 11, the Commission shall adopt a decision authorising or refusing to authorise a Member State to sign and conclude the agreement with a third country. Where additional information is needed to adopt a decision, the 90-day period shall run from the date of receipt of such additional information.

                              14.   Where the Commission adopts a decision pursuant to paragraph 13, authorising a Member State to sign and conclude the agreement with a third country, the Member State concerned shall notify the Commission of the conclusion and entry into force of the agreement, and of any subsequent changes to the status of that agreement.

                              15.   In the event that the Commission adopts a decision refusing to authorise a Member State to sign and conclude the agreement with a third country pursuant to paragraph 13, it shall inform the Member State concerned accordingly and shall give the reasons therefor.

                           (*1)  Decision (EU) 2017/684 of the European Parliament and of the Council of 5 April 2017 on establishing an information exchange mechanism with regard to intergovernmental agreements and non-binding instruments between Member States and third countries in the field of energy, and repealing Decision No 994/2012/EU (OJ L 99, 12.4.2017, p. 1).’."

            Article 2
            Transposition

               1.   Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 24 February 2020, without prejudice to any derogation pursuant to Article 49a of Directive 2009/73/EC. They shall communicate to the Commission the text of those provisions forthwith.
               When Member States adopt those measures, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.
               By way of derogation from the first subparagraph, landlocked Member States which have no geographical borders with third countries and no transmission lines with third countries, shall not be obliged to bring into force measures which are necessary to comply with this Directive.
               By way of derogation from the first subparagraph, Cyprus and Malta, as a result of their geographical situation, shall not be obliged to bring into force measures which are necessary to comply with this Directive for as long as they do not have any infrastructures connecting them with third countries, including upstream pipeline networks.

               2.   Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.

            Article 3
            Entry into force
            This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

            Article 4
            Addressees
            This Directive is addressed to the Member States.

            Done at Strasbourg, 17 April 2019.

                  For the European Parliament

                  The President

               A. TAJANI

                  For the Council

                  The President

               G. CIAMBA

            (1)  OJ C 262, 25.7.2018, p. 64.

            (2)  OJ C 361, 5.10.2018, p. 72.

            (3)  Position of the European Parliament of 4 April 2019 (not yet published in the Official Journal) and decision of the Council of 15 April 2019.

            (4)  Directive 2003/55/EC of the European Parliament and of the Council of 26 June 2003 concerning common rules for the internal market in natural gas (OJ L 176, 15.7.2003, p. 57).

            (5)  Directive 2009/73/EC of the European Parliament and of the Council of 13 July 2009 concerning common rules for the internal market in natural gas and repealing Directive 2003/55/EC (OJ L 211, 14.8.2009, p. 94).

            (6)  Commission Regulation (EU) 2015/703 of 30 April 2015 establishing a Network Code on interoperability and data exchange rules (OJ L 113, 1.5.2015, p. 13).

            (7)  Commission Regulation (EU) 2017/459 of 16 March 2017 establishing a network code on capacity allocation mechanisms in gas transmission systems and repealing Regulation (EU) No 984/2013 (OJ L 72, 17.3.2017, p. 1).

            (8)  Commission Decision 2012/490/EU of 24 August 2012 on amending Annex I to Regulation (EC) No 715/2009 of the European Parliament and of the Council on conditions for access to the natural gas transmission networks (OJ L 231, 28.8.2012, p. 16).

            (9)  Commission Regulation (EU) 2017/460 of 16 March 2017 establishing a network code on harmonised transmission tariff structures for gas (OJ L 72, 17.3.2017, p. 29).

            (10)  Commission Regulation (EU) No 312/2014 of 26 March 2014 establishing a Network Code on Gas Balancing of Transmission Networks (OJ L 91, 27.3.2014, p. 15).

            (11)  Regulation (EU) No 182/2011 of the European Parliament and the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

            (12)  OJ C 369, 17.12.2011, p. 14.


title: Directive (EU) 2019/713 of the European Parliament and of the Council of 17 April 2019 on combating fraud and counterfeiting of non-cash means of payment and replacing Council Framework Decision 2001/413/JHA

text:
                  10.5.2019

                  EN

                  Official Journal of the European Union

                  L 123/18

         DIRECTIVE (EU) 2019/713 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
         of 17 April 2019
         on combating fraud and counterfeiting of non-cash means of payment and replacing Council Framework Decision 2001/413/JHA
         THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
         Having regard to the Treaty on the Functioning of the European Union, and in particular Article 83(1) thereof,
         Having regard to the proposal from the European Commission,
         After transmission of the draft legislative act to the national parliaments,
         Having regard to the opinion of the European Economic and Social Committee (1),
         Acting in accordance with the ordinary legislative procedure (2),
         Whereas:

                     (1)

                     Fraud and counterfeiting of non-cash means of payment are threats to security, as they represent a source of income for organised crime and are therefore enablers for other criminal activities such as terrorism, drug trafficking and trafficking in human beings.

                     (2)

                     Fraud and counterfeiting of non-cash means of payment also represent obstacles to the digital single market, as they erode consumers' trust and cause direct economic loss.

                     (3)

                     Council Framework Decision 2001/413/JHA (3) needs to be updated and complemented in order to include further provisions on offences in particular with regard to computer-related fraud, and on penalties, prevention, assistance to victims and cross-border cooperation.

                     (4)

                     Significant gaps and differences in Member States' laws in the areas of fraud and of counterfeiting of non-cash means of payment can obstruct the prevention, detection and sanctioning of those types of crime and other serious and organised crimes related to and enabled by them, and make police and judicial cooperation more complicated and therefore less effective, with negative consequences for security.

                     (5)

                     Fraud and counterfeiting of non-cash means of payment have a significant cross-border dimension, accentuated by an increasing digital component, which underlines the need for further action to approximate criminal legislation in the areas of fraud and of counterfeiting of non-cash means of payment.

                     (6)

                     Recent years have brought not only an exponential increase in the digital economy, but also a proliferation of innovation in many areas, including payment technologies. New payment technologies involve the use of new types of payment instruments, which, while creating new opportunities for consumers and businesses, also increase opportunities for fraud. Consequently, the legal framework must remain relevant and up-to-date against the background of those technological developments, on the basis of a technology-neutral approach.

                     (7)

                     Fraud is not only used to fund criminal groups, but also limits the development of the digital single market and makes citizens more reluctant to make online purchases.

                     (8)

                     Common definitions in the areas of fraud and of counterfeiting of non-cash means of payment are important to ensure a consistent approach in Member States' application of this Directive and to facilitate information exchange and cooperation between competent authorities. The definitions should cover new types of non-cash payment instruments which allow for transfers of electronic money and virtual currencies. The definition of non-cash payment instruments should acknowledge that a non-cash payment instrument may consist of different elements acting together, for example a mobile payment application and a corresponding authorisation (e.g. a password). Where this Directive uses the concept of a non-cash payment instrument, it should be understood that the instrument puts the holder or user of the instrument in a position to actually enable a transfer of money or monetary value or to initiate a payment order. For example, unlawfully obtaining a mobile payment application without the necessary authorisation should not be considered as an unlawful obtainment of a non-cash payment instrument as it does not actually enable the user to transfer money or monetary value.

                     (9)

                     This Directive should apply to non-cash payment instruments only insofar as the instrument's payment function is concerned.

                     (10)

                     This Directive should cover virtual currencies only insofar as they can be commonly used for making payments. The Member States should be encouraged to ensure in their national law that future currencies of a virtual nature issued by their central banks or other public authorities will enjoy the same level of protection against fraudulent offences as non-cash means of payment in general. Digital wallets that allow the transfer of virtual currencies should be covered by this Directive to the same extent as non-cash payment instruments. The definition of the term ‘digital means of exchange’ should acknowledge that digital wallets for transferring virtual currencies may provide, but do not necessarily provide, the features of a payment instrument and should not extend the definition of a payment instrument.

                     (11)

                     Sending fake invoices to obtain payment credentials should be considered as an attempt at unlawful appropriation within the scope of this Directive.

                     (12)

                     By using criminal law to give legal protection primarily to payment instruments that make use of special forms of protection against imitation or abuse, the intention is to encourage operators to provide such special forms of protection to payment instruments issued by them.

                     (13)

                     Effective and efficient criminal law measures are essential to protect non-cash means of payment against fraud and counterfeiting. In particular, a common criminal law approach is needed as regards the constituent elements of criminal conduct that contribute to or prepare the way for the actual fraudulent use of a non-cash means of payment. Conduct such as the collection and possession of payment instruments with the intention to commit fraud, through, for instance, phishing, skimming or directing or redirecting payment service users to imitation websites, and their distribution, for example by selling credit card information on the internet, should thus be made a criminal offence in its own right without requiring the actual fraudulent use of a non-cash means of payment. Such criminal conduct should therefore cover circumstances where possession, procurement or distribution does not necessarily lead to fraudulent use of such payment instruments. However, where this Directive criminalises possession or holding, it should not criminalise mere omission. This Directive should not sanction the legitimate use of a payment instrument, including and in relation to the provision of innovative payment services, such as services commonly developed by fintech companies.

                     (14)

                     With regard to the criminal offences referred to in this Directive, the concept of intent applies to all elements constituting those criminal offences in accordance with national law. It is possible for the intentional nature of an act, as well as any knowledge or purpose required as an element of an offence, to be inferred from objective, factual circumstances. Criminal offences which do not require intent should not be covered by this Directive.

                     (15)

                     This Directive refers to classical forms of conduct, like fraud, forgery, theft and unlawful appropriation that had already been shaped by national law before the era of digitalisation. The extended scope of this Directive with regard to non-corporeal payment instruments therefore requires the definition of equivalent forms of conduct in the digital sphere, complementing and reinforcing Directive 2013/40/EU of the European Parliament and of the Council (4). The unlawful obtainment of a non-corporeal non-cash payment instrument should be a criminal offence, at least when it involves the commission of one of the offences referred to in Articles 3 to 6 of Directive 2013/40/EU or the misappropriation of a non-corporeal non-cash payment instrument. ‘Misappropriation’ should be understood to mean the action of a person entrusted with a non-corporeal non-cash payment instrument, to knowingly use the instrument without the right to do so, to his own benefit or to the benefit of another. The procurement for fraudulent use of such an unlawfully obtained instrument should be punishable without it being necessary to establish all the factual elements of the unlawful obtainment and without requiring a prior or simultaneous conviction for the predicate offence which led to the unlawful obtainment.

                     (16)

                     This Directive also refers to tools which can be used in order to commit the offences referred to in it. Given the need to avoid criminalisation where such tools are produced and placed on the market for legitimate purposes and, though they could be used to commit criminal offences, are therefore not in themselves a threat, criminalisation should be limited to those tools which are primarily designed or specifically adapted for the purpose of committing the offences referred to in this Directive.

                     (17)

                     The sanctions and penalties for fraud and counterfeiting of non-cash means of payment should be effective, proportionate and dissuasive throughout the Union. This Directive is without prejudice to the individualisation and application of penalties and execution of sentences in accordance with the circumstances of the case and the general rules of national criminal law.

                     (18)

                     As this Directive provides for minimum rules, Member States are free to adopt or maintain more stringent criminal law rules with regard to fraud and counterfeiting of non-cash means of payment, including a broader definition of offences.

                     (19)

                     It is appropriate to provide for more severe penalties where a crime is committed in the framework of a criminal organisation, as defined in Council Framework Decision 2008/841/JHA (5). Member States should not be obliged to provide for specific aggravating circumstances where national law provides for separate criminal offences and this may lead to more severe sanctions. When an offence referred to in this Directive has been committed in conjunction with another offence referred to in this Directive by the same person, and one of those offences de facto constitutes a necessary element of the other, a Member State may, in accordance with general principles of national law, provide that such conduct is regarded as an aggravating circumstance to the main offence.

                     (20)

                     Jurisdictional rules should ensure that the offences referred to in this Directive are prosecuted effectively. In general, offences are best dealt with by the criminal justice system of the country in which they occur. Each Member State should therefore establish jurisdiction over offences committed on its territory and over offences committed by its nationals. Member States may also establish jurisdiction over offences that cause damage in their territory. They are strongly encouraged to do so.

                     (21)

                     Recalling the obligations under Council Framework Decision 2009/948/JHA (6) and Council Decision 2002/187/JHA (7), competent authorities are encouraged in cases of conflicts of jurisdiction to use the possibility of conducting direct consultations with the assistance of the European Union Agency for Criminal Justice Cooperation (Eurojust).

                     (22)

                     Given the need for special tools to effectively investigate fraud and counterfeiting of non-cash means of payment, and their relevance to effective international cooperation between national authorities, investigative tools that are typically used for cases involving organised crime or other serious crime should be available to competent authorities in all Member States, if and to the extent that the use of those tools is appropriate and commensurate with the nature and gravity of the offences as defined in national law. In addition, law enforcement authorities and other competent authorities should have timely access to relevant information in order to investigate and prosecute the offences referred to in this Directive. Member States are encouraged to allocate adequate human and financial resources to the competent authorities in order to properly investigate and prosecute the offences referred to in this Directive.

                     (23)

                     National authorities investigating or prosecuting offences referred to in this Directive should be empowered to cooperate with other national authorities within the same Member State and their counterparts in other Member States.

                     (24)

                     In many cases, criminal activities are behind incidents that should be notified to the relevant national competent authorities under Directive (EU) 2016/1148 of the European Parliament and of the Council (8). Such incidents may be suspected to be of a criminal nature even if there is insufficient evidence of a criminal offence at that stage. In such a context, relevant operators of essential services and digital service providers should be encouraged to share the reports required under Directive (EU) 2016/1148 with law enforcement authorities so as to form an effective and comprehensive response and to facilitate attribution and accountability by the perpetrators for their actions. In particular, promoting a safe, secure and more resilient environment requires systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities. Moreover, when relevant, computer security incident response teams designated under Directive (EU) 2016/1148 should be involved in law enforcement investigations with a view to providing information, as considered appropriate at national level, and also to providing specialist expertise on information systems.

                     (25)

                     Major security incidents as referred to in Directive (EU) 2015/2366 of the European Parliament and of the Council (9) may be of criminal origin. Where relevant, payment service providers should be encouraged to share with law enforcement authorities the reports they are required to submit to the competent authority in their home Member State under Directive (EU) 2015/2366.

                     (26)

                     A number of instruments and mechanisms exist at Union level to enable the exchange of information among national law enforcement authorities for the purposes of investigating and prosecuting crimes. To facilitate and speed up cooperation among national law enforcement authorities and make sure that those instruments and mechanisms are used to the fullest extent, this Directive should strengthen the importance of the operational points of contact introduced by Framework Decision 2001/413/JHA. It should be possible for Member States to decide to make use of the existing networks of operational points of contact, such as the one set up in Directive 2013/40/EU. The points of contact should provide effective assistance, for example by facilitating the exchange of relevant information and the provision of technical advice or legal information. To ensure the network runs smoothly, each point of contact should be able to communicate quickly with the point of contact in another Member State. Given the significant trans-border dimension of crimes covered by this Directive and in particular the volatile nature of electronic evidence, Member States should be able to deal promptly with urgent requests from the network and provide feedback within eight hours. In very urgent and serious cases, Member States should inform the European Union Agency for Law Enforcement Cooperation (Europol).

                     (27)

                     Reporting crime to public authorities without undue delay is of great importance in combating fraud and counterfeiting of non-cash means of payment, as it is often the starting point of criminal investigations. Measures should be taken to encourage reporting by natural and legal persons, in particular financial institutions, to law enforcement and judicial authorities. Those measures can be based on various types of action, including legislative acts containing obligations to report suspected fraud, or non-legislative actions, such as setting up or supporting organisations or mechanisms favouring the exchange of information, or awareness raising. Any such measure that involves processing of the personal data of natural persons should be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (10). In particular, any transmission of information for the purposes of preventing and combating offences relating to fraud and counterfeiting of non-cash means of payment should comply with the requirements laid down in that Regulation, notably the lawful grounds for processing.

                     (28)

                     In order to facilitate the prompt and direct reporting of crime, the Commission should carefully assess the establishment of effective online fraud-reporting systems by Member States and standardised reporting templates at Union level. Such systems could facilitate the reporting of non-cash fraud which often takes place online, thereby strengthening support for victims, the identification and analysis of cybercrime threats and the work and cross-border cooperation of national competent authorities.

                     (29)

                     The offences referred to in this Directive often have a cross-border nature. Therefore, combating these offences relies on close cooperation between the Member States. Member States are encouraged to ensure, to the extent appropriate, effective application of mutual recognition and legal assistance instruments in relation to the offences covered by this Directive.

                     (30)

                     Investigation and prosecution of all types of fraud and counterfeiting of non-cash means of payment, including those involving small amounts of money, are particularly important in order to combat them effectively. Reporting obligations, information exchange and statistical reports are efficient ways to detect fraudulent activities, especially similar activities that involve small amounts of money when considered separately.

                     (31)

                     Fraud and counterfeiting of non-cash means of payment can result in serious economic and non-economic consequences for its victims. Where such fraud involves, for example, identity theft, its consequences are often aggravated because of reputational and professional damage, damage to an individual's credit rating and serious emotional harm. Member States should adopt assistance, support and protection measures aimed to mitigate those consequences.

                     (32)

                     Often a considerable amount of time can pass before victims find out that they have suffered a loss from fraud and counterfeiting offences. During that time a spiral of interlinked crimes might develop, thereby aggravating the negative consequences for the victims.

                     (33)

                     Natural persons who are victims of fraud related to non-cash means of payment have rights conferred under Directive 2012/29/EU of the European Parliament and of the Council (11). Member States should adopt measures of assistance and support to such victims which build on the measures required by that Directive but respond more directly to the specific needs of victims of fraud related to identity theft. Such measures should include, in particular, the provision of a list of dedicated institutions covering different aspects of identity-related crime and victim support, specialised psychological support and advice on financial, practical and legal matters, as well as assistance in receiving available compensation. Member States should be encouraged to set up a single national online information tool to facilitate access to assistance and support for victims. Specific information and advice on protection against the negative consequences of such crime should be offered to legal persons as well.

                     (34)

                     This Directive should provide for the right for legal persons to access information in accordance with national law about the procedures for making complaints. This right is necessary in particular for small and medium-sized enterprises and should contribute to creating a friendlier business environment for small and medium-sized enterprises. Natural persons already benefit from this right under Directive 2012/29/EU.

                     (35)

                     Member States should, with the assistance of the Commission, establish or strengthen policies to prevent fraud and counterfeiting of non-cash means of payment and measures to reduce the risk of such offences occurring by means of information and awareness-raising campaigns. In this context, Member States could develop and keep up to date a permanent online awareness-raising tool with practical examples of fraudulent practices, in a format that is easy to understand. That tool could be linked to or be part of the single national online information tool for victims. Member States could also put in place research and education programmes. Special attention should be paid to the needs and interests of vulnerable persons. Member States are encouraged to ensure that sufficient funding is made available for such campaigns.

                     (36)

                     It is necessary to collect statistical data on fraud and counterfeiting of non-cash payment instruments. Member States should therefore be obliged to ensure that an adequate system is in place for the recording, production and provision of existing statistical data on the offences referred to in this Directive.

                     (37)

                     This Directive aims to amend and expand the provisions of Framework Decision 2001/413/JHA. Since the amendments to be made are substantial in number and nature, Framework Decision 2001/413/JHA should, in the interests of clarity, be replaced in its entirety for the Member States bound by this Directive.

                     (38)

                     In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union (TEU) and to the Treaty on the Functioning of the European Union (TFEU), and without prejudice to Article 4 of that Protocol, those Member States are not taking part in the adoption of this Directive and are not bound by it or subject to its application.

                     (39)

                     In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark annexed to TEU and to TFEU, Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

                     (40)

                     Since the objectives of this Directive, namely to subject fraud and counterfeiting of non-cash means of payment to effective, proportionate and dissuasive criminal penalties and to improve and encourage cross-border cooperation both between competent authorities and between natural and legal persons and competent authorities, cannot be sufficiently achieved by the Member States, but can rather, by reason of their scale or effects, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.

                     (41)

                     This Directive respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, including the right to liberty and security, the respect for private and family life, the protection of personal data, the freedom to conduct a business, the right to property, the right to an effective remedy and to a fair trial, the presumption of innocence and right of defence, the principles of the legality and proportionality of criminal offences and penalties, as well as the right not to be tried or punished twice in criminal proceedings for the same criminal offence. This Directive seeks to ensure full respect for those rights and principles and should be implemented accordingly,

               HAVE ADOPTED THIS DIRECTIVE:
         TITLE I

            SUBJECT MATTER AND DEFINITIONS

            Article 1
            Subject matter
            This Directive establishes minimum rules concerning the definition of criminal offences and sanctions in the areas of fraud and counterfeiting of non-cash means of payment. It facilitates the prevention of such offences, and the provision of assistance to and support for victims.

            Article 2
            Definitions
            For the purpose of this Directive, the following definitions apply:

                        (a)

                        ‘non-cash payment instrument’ means a non-corporeal or corporeal protected device, object or record, or a combination thereof, other than legal tender, and which, alone or in conjunction with a procedure or a set of procedures, enables the holder or user to transfer money or monetary value, including through digital means of exchange;

                        (b)

                        ‘protected device, object or record’ means a device, object or record safeguarded against imitation or fraudulent use, for example through design, coding or signature;

                        (c)

                        ‘digital means of exchange’ means any electronic money as defined in point (2) of Article 2 of Directive 2009/110/EC of the European Parliament and of the Council (12) or virtual currency;

                        (d)

                        ‘virtual currency’ means a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of a currency or money, but is accepted by natural or legal persons as a means of exchange, and which can be transferred, stored and traded electronically;

                        (e)

                        ‘information system’ means information system as defined in point (a) of Article 2 of Directive 2013/40/EU;

                        (f)

                        ‘computer data’ means computer data as defined in point (b) of Article 2 of Directive 2013/40/EU;

                        (g)

                        ‘legal person’ means an entity having legal personality under the applicable law, except for states or public bodies in the exercise of state authority and for public international organisations.

         TITLE II

            OFFENCES

            Article 3
            Fraudulent use of non-cash payment instruments
            Member States shall take the necessary measures to ensure that, when committed intentionally, the following conduct is punishable as a criminal offence:

                        (a)

                        the fraudulent use of a stolen or otherwise unlawfully appropriated or obtained non-cash payment instrument;

                        (b)

                        the fraudulent use of a counterfeit or falsified non-cash payment instrument.

            Article 4
            Offences related to the fraudulent use of corporeal non-cash payment instruments
            Member States shall take the necessary measures to ensure that, when committed intentionally, the following conduct is punishable as a criminal offence:

                        (a)

                        the theft or other unlawful appropriation of a corporeal non-cash payment instrument;

                        (b)

                        the fraudulent counterfeiting or falsification of a corporeal non-cash payment instrument;

                        (c)

                        the possession of a stolen or otherwise unlawfully appropriated, or of a counterfeit or falsified corporeal non-cash payment instrument for fraudulent use;

                        (d)

                        the procurement for oneself or another, including the receipt, appropriation, purchase, transfer, import, export, sale, transport or distribution of a stolen, counterfeit or falsified corporeal non-cash payment instrument for fraudulent use.

            Article 5
            Offences related to the fraudulent use of non-corporeal non-cash payment instruments
            Member States shall take the necessary measures to ensure that, when committed intentionally, the following conduct is punishable as a criminal offence:

                        (a)

                        the unlawful obtainment of a non-corporeal non-cash payment instrument, at least when this obtainment has involved the commission of one of the offences referred to in Articles 3 to 6 of Directive 2013/40/EU, or misappropriation of a non-corporeal non-cash payment instrument;

                        (b)

                        the fraudulent counterfeiting or falsification of a non-corporeal non-cash payment instrument;

                        (c)

                        the holding of an unlawfully obtained, counterfeit or falsified non-corporeal non-cash payment instrument for fraudulent use, at least if the unlawful origin is known at the time of the holding of the instrument;

                        (d)

                        the procurement for oneself or another, including the sale, transfer or distribution, or the making available, of an unlawfully obtained, counterfeit or falsified non-corporeal non-cash payment instrument for fraudulent use.

            Article 6
            Fraud related to information systems
            Member States shall take the necessary measures to ensure that performing or causing a transfer of money, monetary value or virtual currency and thereby causing an unlawful loss of property for another person in order to make an unlawful gain for the perpetrator or a third party is punishable as a criminal offence, when committed intentionally by:

                        (a)

                        without right, hindering or interfering with the functioning of an information system;

                        (b)

                        without right, introducing, altering, deleting, transmitting or suppressing computer data.

            Article 7
            Tools used for committing offences
            Member States shall take the necessary measures to ensure that producing, procurement for oneself or another, including the import, export, sale, transport or distribution, or making available a device or an instrument, computer data or any other means primarily designed or specifically adapted for the purpose of committing any of the offences referred to in points (a) and (b) of Article 4, in points (a) and (b) of Article 5 or in Article 6, at least when committed with the intention that these means be used, is punishable as a criminal offence.

            Article 8
            Incitement, aiding and abetting and attempt

               1.   Member States shall take the necessary measures to ensure that inciting or aiding and abetting an offence referred to in Articles 3 to 7 is punishable as a criminal offence.

               2.   Member States shall take the necessary measures to ensure that an attempt to commit an offence referred to in Article 3, in point (a), (b) or (d) of Article 4, in point (a) or (b) of Article 5 or in Article 6 is punishable as a criminal offence. With regard to point (d) of Article 5, Member States shall take the necessary measures to ensure that at least the attempted fraudulent procurement of an unlawfully obtained, counterfeit or falsified non-corporeal non-cash payment instrument for oneself or another is punishable as a criminal offence.

            Article 9
            Penalties for natural persons

               1.   Member States shall take the necessary measures to ensure that the offences referred to in Articles 3 to 8 are punishable by effective, proportionate and dissuasive criminal penalties.

               2.   Member States shall take the necessary measures to ensure that the offences referred to in Article 3, in points (a) and (b) of Article 4 and in points(a) and (b) of Article 5 are punishable by a maximum term of imprisonment of at least two years.

               3.   Member States shall take the necessary measures to ensure that the offences referred to in points (c) and (d) of Article 4 and in points (c) and (d) of Article 5 are punishable by a maximum term of imprisonment of at least one year.

               4.   Member States shall take the necessary measures to ensure that the offence referred to in Article 6 is punishable by a maximum term of imprisonment of at least three years.

               5.   Member States shall take the necessary measures to ensure that the offence referred to in Article 7 is punishable by a maximum term of imprisonment of at least two years.

               6.   Member States shall take the necessary measures to ensure that the offences referred to in Articles 3 to 6 are punishable by a maximum term of imprisonment of at least five years if they are committed within the framework of a criminal organisation, as defined in Framework Decision 2008/841/JHA, irrespective of the penalty provided for in that Decision.

            Article 10
            Liability of legal persons

               1.   Member States shall take the necessary measures to ensure that legal persons can be held liable for offences referred to in Articles 3 to 8 committed for their benefit by any person, acting either individually or as part of an organ of the legal person, and having a leading position within the legal person, based on one of the following:

                           (a)

                           a power of representation of the legal person;

                           (b)

                           an authority to take decisions on behalf of the legal person;

                           (c)

                           an authority to exercise control within the legal person.

               2.   Member States shall take the necessary measures to ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 1 has made possible the commission of any of the offences referred to in Articles 3 to 8 for the benefit of the legal person by a person under its authority.

               3.   Liability of legal persons pursuant to paragraphs 1 and 2 shall not exclude criminal proceedings against natural persons who are perpetrators or inciters of, or accessories to, any of the offences referred to in Articles 3 to 8.

            Article 11
            Sanctions for legal persons
            Member States shall take the necessary measures to ensure that a legal person held liable pursuant to Article 10(1) or (2) is subject to effective, proportionate and dissuasive sanctions, which shall include criminal or non-criminal fines and which may include other sanctions, such as:

                        (a)

                        exclusion from entitlement to public benefits or aid;

                        (b)

                        temporary exclusion from access to public funding, including tender procedures, grants and concessions;

                        (c)

                        temporary or permanent disqualification from the practice of commercial activities;

                        (d)

                        placing under judicial supervision;

                        (e)

                        judicial winding-up;

                        (f)

                        temporary or permanent closure of establishments which have been used for committing the offence.

         TITLE III

            JURISDICTION AND INVESTIGATION

            Article 12
            Jurisdiction

               1.   Each Member State shall take the necessary measures to establish its jurisdiction over the offences referred to in Articles 3 to 8 where one or more of the following apply:

                           (a)

                           the offence is committed in whole or in part on its territory;

                           (b)

                           the offender is one of its nationals.

               2.   For the purposes of point (a) of paragraph 1, an offence shall be considered to have been committed in whole or in part on the territory of a Member State where the offender commits the offence when physically present on that territory and irrespective of whether the offence is committed using an information system on that territory.

               3.   A Member State shall inform the Commission where it decides to establish jurisdiction over an offence referred to in Articles 3 to 8 committed outside its territory, including where:

                           (a)

                           the offender has his or her habitual residence in its territory;

                           (b)

                           the offence is committed for the benefit of a legal person established in its territory;

                           (c)

                           the offence is committed against one of its nationals or a person who is a habitual resident in its territory.

            Article 13
            Effective investigations and cooperation

               1.   Member States shall take the necessary measures to ensure that investigative tools, such as those which are used in countering organised crime or in other serious crime cases, are effective, proportionate to the crime committed and available to the persons, units or services responsible for investigating or prosecuting the offences referred to in Articles 3 to 8.

               2.   Member States shall take the necessary measures to ensure that, where national law obliges natural and legal persons to submit information regarding offences referred to in Articles 3 to 8, such information reaches the authorities investigating or prosecuting those offences without undue delay.

         TITLE IV

            EXCHANGE OF INFORMATION AND REPORTING OF CRIME

            Article 14
            Exchange of information

               1.   For the purpose of exchanging information relating to the offences referred to in Articles 3 to 8, Member States shall ensure that they have an operational national point of contact available 24 hours a day, seven days a week. Member States shall also ensure that they have procedures in place so that urgent requests for assistance are promptly dealt with and the competent authority replies within eight hours of receipt, by at least indicating whether the request will be answered and the form of such an answer and the estimated time within which it will be sent. Member States may decide to make use of the existing networks of operational points of contact.

               2.   Member States shall inform the Commission, Europol and Eurojust of their appointed point of contact referred to in paragraph 1. They shall update that information as necessary. The Commission shall forward that information to the other Member States.

            Article 15
            Reporting of crime

               1.   Member States shall take the necessary measures to ensure that appropriate reporting channels are made available in order to facilitate reporting of the offences referred to in Articles 3 to 8 to law enforcement authorities and other competent national authorities without undue delay.

               2.   Member States shall take the necessary measures to encourage financial institutions and other legal persons operating in their territory to report suspected fraud to law enforcement authorities and other competent authorities without undue delay, for the purpose of detecting, preventing, investigating or prosecuting offences referred to in Articles 3 to 8.

            Article 16
            Assistance and support to victims

               1.   Member States shall ensure that natural and legal persons who have suffered harm as a result of any of the offences referred to in Articles 3 to 8 being committed by misusing personal data, are:

                           (a)

                           offered specific information and advice on how to protect themselves against the negative consequences of the offences, such as reputational damage; and

                           (b)

                           provided with a list of dedicated institutions that deal with different aspects of identity-related crime and victim support.

               2.   Member States are encouraged to set up single national online information tools to facilitate access to assistance and support for natural or legal persons who have suffered harm as a result of the offences referred to in Articles 3 to 8 being committed by misusing personal data.

               3.   Member States shall ensure that legal persons that are victims of the offences referred to in Articles 3 to 8 of this Directive are offered the following information without undue delay after their first contact with a competent authority:

                           (a)

                           the procedures for making complaints with regard to the offence and the victim's role in such procedures;

                           (b)

                           the right to receive information about the case in accordance with national law;

                           (c)

                           the available procedures for making complaints if the competent authority does not respect the victim's rights in the course of criminal proceedings;

                           (d)

                           the contact details for communications about their case.

            Article 17
            Prevention
            Member States shall take appropriate action, including through the internet, such as information and awareness-raising campaigns and research and education programmes, aimed to reduce overall fraud, raise awareness and reduce the risk of becoming a victim of fraud. Where appropriate, Member States shall act in cooperation with stakeholders.

            Article 18
            Monitoring and statistics

               1.   By 31 August 2019, the Commission shall establish a detailed programme for monitoring the outputs, results and impacts of this Directive. The monitoring programme shall set out the means by which and the intervals at which the necessary data and other evidence will be collected. It shall specify the action to be taken by the Commission and by the Member States in collecting, sharing and analysing the data and other evidence.

               2.   Member States shall ensure that a system is in place for the recording, production and provision of anonymised statistical data measuring the reporting, investigative and judicial phases involving the offences referred to in Articles 3 to 8.

               3.   The statistical data referred to in paragraph 2 shall, as a minimum, cover existing data on the number of offences referred to in Articles 3 to 8 registered by the Member States and on the number of persons prosecuted for and convicted of the offences referred to in Articles 3 to 7.

               4.   Member States shall transmit the data collected pursuant to paragraphs 1, 2 and 3 to the Commission on an annual basis. The Commission shall ensure that a consolidated review of the statistical reports is published each year and submitted to the competent specialised Union agencies and bodies.

            Article 19
            Replacement of Framework Decision 2001/413/JHA
            Framework Decision 2001/413/JHA is replaced with regard to the Member States bound by this Directive, without prejudice to the obligations of those Member States with regard to the date for transposition of that Framework Decision into national law.
            With regard to Member States bound by this Directive, references to Framework Decision 2001/413/JHA shall be construed as references to this Directive.

            Article 20
            Transposition

               1.   Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 31 May 2021. They shall immediately inform the Commission thereof.
               When Member States adopt those measures, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.

               2.   Member States shall communicate to the Commission the text of the measures of national law which they adopt in the field covered by this Directive.

            Article 21
            Evaluation and reporting

               1.   The Commission shall, by 31 May 2023, submit a report to the European Parliament and to the Council, assessing the extent to which the Member States have taken the necessary measures to comply with this Directive. Member States shall provide the Commission with the necessary information for the preparation of that report.

               2.   The Commission shall, by 31 May 2026, carry out an evaluation of the impact of this Directive on combating fraud and counterfeiting of non-cash means of payment, as well as on fundamental rights, and submit a report to the European Parliament and to the Council. Member States shall provide the Commission with necessary information for the preparation of that report.

               3.   In the context of the evaluation referred to in paragraph 2 of this Article, the Commission shall also report on the necessity, feasibility and effectiveness of creating national secure online systems to allow victims to report any of the offences referred to in Articles 3 to 8, as well as of establishing a standardised Union reporting template to serve as a basis for Member States.

            Article 22
            Entry into force
            This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
            This Directive is addressed to the Member States in accordance with the Treaties.

            Done at Strasbourg, 17 April 2019.

                  For the European Parliament

                  The President

               A. TAJANI

                  For the Council

                  The President

               G. CIAMBA

            (1)  OJ C 197, 8.6.2018, p. 24.

            (2)  Position of the European Parliament of 13 March 2019 (not yet published in the Official Journal) and decision of the Council of 9 April 2019.

            (3)  Council Framework Decision 2001/413/JHA of 28 May 2001 combating fraud and counterfeiting of non-cash means of payment (OJ L 149, 2.6.2001, p. 1).

            (4)  Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA (OJ L 218, 14.8.2013, p. 8).

            (5)  Council Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime (OJ L 300, 11.11.2008, p. 42).

            (6)  Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings (OJ L 328, 15.12.2009, p. 42).

            (7)  Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime (OJ L 63, 6.3.2002, p. 1).

            (8)  Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

            (9)  Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

            (10)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

            (11)  Directive 2012/29/EU of the European Parliament and of the Council of 25 October 2012 establishing minimum standards on the rights, support and protection of victims of crime, and replacing Council Framework Decision 2001/220/JHA (OJ L 315, 14.11.2012, p. 57).

            (12)  Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).