I. Introduction

EU funding in shared management with the Member States so far constitutes the largest part of the EU budget, with a proposed volume of more than € 373 billion over the multi-annual financial framework period 2021–2027 for cohesion policy alone.¹ It provides important financial support to innovation, economic development and employment and is designed to diminish regional disparities, achieve territorial cohesion throughout the EU and support the economy. The programmes drawn up in accordance with specific EU-thematic priorities² are implemented through projects at the national, regional and local level. The Commission’s responsibility to execute the cohesion budget includes approval, monitoring and supervision of the operational programmes as well as their implementation. National and regional management authorities, as well as certifying authorities provide and validate expenditure to the beneficiaries.

A strengthened shared management assurance framework³ protects the legality and regularity of the expenditure. It includes management verifications and audit controls of the compliance of EU cohesion expenditure in accordance with the legality and regularity requirements. Financed contracts are typically implemented through procurement procedures by applying horizontal and sectorial EU legal requirements to respect transparency of public spending, non-discrimination and equal treatment of beneficiaries,⁴ as complemented by national law. The existence of effective anti-fraud safeguards is part of these management and system requirements as well as of sound financial management. Serious irregularities, fraud and the misuse of funds affecting the interests of the EU tax payer need to be detected and addressed already at the management level instead of concentrating on criminal law measures exclusively. Specific regulatory reform steps have therefore been taken by the EU legislator for the 2014–2020 programmes so as to strengthen the assurance model, notably by introducing annual accounts and clarifying sound financial management requirements of national authorities⁵ to achieve upfront protection against risks which may cause reputational and financial harm. While compliance and preventive anti-fraud measures need to be effective, they must take into account the objective of simplification at the same time, thus avoiding unnecessary administrative workloads and burdens for the beneficiaries. A risk-proportionate approach must address the particular system deficiencies through administrative capacity-building, including financial governance and transparency.

Zero tolerance applies to fraud. This objective requires preventive initiatives to preserve EU credibility and impartiality in programme spending already in presence of risks of conflict of interests. The objective can also be reached, for instance, through the systematic occurrence of red flags like “single bidding” in procurement procedures even if they do not establish evidence of criminal and corrupt conduct. Both, the European Parliament and the European Council, emphasise the need for data collection and transparent beneficial owner control of all final Fund recipients,⁶ in particular to monitor whether they are unjustly drained off into the pockets of a few big beneficiaries and oligarch structures.⁷ More generally, effective anti-fraud procedures are seen as a component of the discussion on EU values in public administration. Under the next multi-annual financial framework, rule of law conditionalities might even apply to Member States when receiving credits if generalised deficiencies in the administrative and judicial systems are found. Protection of financial interests as well as an effective, independent administration and judiciary are related objectives.

Protecting EU interests requires implementing and further developing structured multi-disciplinary preparedness measures. Their extent must take into account a diversity of administrative risk records of the respective EU programmes under shared management, but also the commitment for further increased financial solidarity in the follow-up of the COVID-19 crisis, going along with the COVID-19 recovery and resilience facility under the next-generation EU plan⁸ far beyond the existing EU funds. Necessary action includes fraud prevention, risk analysis, control and detection (chapter II) as well as a consistent response in cases of irregularities, including consistent financial corrections. Effective measures would further include exclusion from funding of unreliable beneficiaries as well as judicial prosecution in cooperation with the European Public Prosecutor’s Office (EPPO) in cases of criminal offences perpetrated against the EU’s financial interests (chapter III).

II. Increased Preparedness against Fraud and Illegal Activities

Programme management and control systems must ensure compliance with legality and regularity requirements. This includes fraud prevention based on risk analysis and assessment (section 1), but also verifications and controls to detect irregularities and fraud, transmitting relevant information and taking action to allow for investigations (section 2).

1. Fraud risk assessment

Fraud prevention comprises consistent risk analysis by the managing authorities (a), the consistent exploitation of audit and investigation results (b) as well as capacity-building through technical assistance, the systematic use of dedicated tools and cooperation with other competent bodies (c).

a) Reinforced management responsibilities

Since 2015, the managing authorities have been provided by the Commission with structured guidance on how to conduct a fraud risk assessment.⁹ It comprises a tool for self-assessment, quantifying the likelihood and impact of fraud, and the control of effectiveness in the conduct of risk-orientated administrative verifications. The Commission has subsequently monitored its implementation and has checked whether (based on concrete risk assessment) effective measures have been put in place. In addition to a performance audit of the effectiveness of anti-fraud measures in seven Member States, a stocktaking study was carried out for 50 operational programmes covering all EU Member States. It grasped the impact of the regulatory anti-fraud requirements, identified to what extent managing authorities comply with the legal provisions on the effectiveness of anti-fraud measures put in place and researched in particular whether an effective risk analysis was conducted and what still had to be improved.¹⁰ It concluded that proportionate measures had been taken in general, but it also found that some risks like double-financing, non-compliance with public procurement rules and the occurrence of conflicts of interests had not yet been addressed in every case with sufficient measures that were fully effective and proportionate to the risks.

Against the background of implementation practices developed so far, the shared management services of the Commission, the Directorates-General for Regional and Urban Policy (DG REGIO), Employment and Social Affairs (EMPL), and Maritime Affairs and Fisheries (MARE), have therefore recently revised their multi-annual Joint Anti-Fraud Strategy (JAFS) for European Structural and Investment Funds (ESIF). Based on experiences with the implementation of the new regulatory framework, the Commission services have identified concrete actions to further improve fraud prevention and assistance, providing a tool box for training with an e-learning platform, raising awareness and other supporting initiatives, and tools to remedy continuous weaknesses in the management and control systems, as well as addressing new fraud-risk tendencies identified in ESIFs.¹¹ A joint typology of irregularities and identified fraud is used for an analysis of irregularities by management authorities, together with audit authorities and the European Anti-Fraud Office (OLAF). It enables coordinated feedback to managing authorities so as to better target their verifications. Implemented for the 2014–2020 programmes, this joint typology helps improve their risk assessment, identify the most important sources of errors as well as fraudulent irregularities (both in terms of frequency and amounts) and learn in which types of programmes they occur.¹²

b) Practical role of audits and OLAF investigations in the analysis of fraud risks

Beyond the results of their own verifications,¹³ managing authorities use the results of audit controls (1) and OLAF investigations (2) to assess risks for the relevant types of programmes and expenditure.

(1) Different layers of system and operations audits by the authorities, further reviewed on a risk basis through audit controls by the Commission, are in place to provide robust assurance for payments. Complementary to Member States’ audit activities, the Commission has shared management audit services in DG REGIO, EMPL and MARE to conduct their own fraud risk assessment. Their audits are not suspicion-run but risk-based, targeting tendencies and weaknesses identified in the checked management and control systems that reveal risks of misuse and illegal spending. The single audit strategy aims at ensuring that reliable audit opinions and error rates are reported to the Commission by audit authorities as a result of their approximately 500 national system audits per year for the European Regional Development Fund (ERDF) and Cohesion Fund (CF). Based on whether effective controls are in place and function reliably, the Commission services regularly update their bi-annual audit plan. Audit resources are targeted at high risk areas. About 100 risk-based audits are carried out each year for the Regional Development as well as for cohesion and social funds. Commission auditors perform controls under complementary shared management compliance, taking into account past legality compliance of each operational programme or thematic controls of specific types of expenditure, e.g. financial instruments, specific risk patterns (like conflicts of interests) and error-prone types of grants (such as public procurement procedures).¹⁴

Even if auditors are not primarily responsible for investigating fraud, they may identify and assess systemic fraud risks in the performance of these audits. They take into account the particularities of the funds under shared management in their common single audit strategy.¹⁵ For the 2014–2020 programmes, audit findings from DG REGIO and EMPL are recorded in the specific IT tool “MAPAR” for audit procedures. Findings that are specific to fraud and irregularities primarily identify shortcomings in the fraud-specific system requirements. Key Requirement (KR) No7 concerns the anti-fraud environment as well as effective and proportionate anti-fraud measures. A specific checklist is applied by auditors. Individual fraud findings are registered and give rise to systematic transmission in the OLAF – even if they are not very frequent.¹⁶

(2) A periodic analysis of OLAF findings is carried out in DG REGIO. It currently covers the complete case data affecting ERDF/CF projects in the 2007–2013 programmes, for which the final OLAF report was accompanied by a financial recommendation. The recent assessment is based on the analysis of about 140 such cases. The OLAF itself identifies in its investigations recurrent risk scenarios and a modus operandi in cohesion policy fraud.¹⁷ Examples include false or falsified supporting documents, various types of public procurement fraud, intentionally claimed ineligible expenditure and undisclosed conflicts of interests in the implementation of the funds. The OLAF cases and financial recommendations have been analysed by domain and type of irregularity, as well as for the public procurement findings by concerned procedures and tendering phases. Financial recommendations may sometimes also be based on findings of administrative irregularities without evidence of a fraudulent intention. These results are fed back into the risk approach for management verifications and audits. Based on OLAF investigations concluded in cases affecting cohesion-funded projects within the responsibility of DG REGIO, the highest fraud risk concerns the domain of EU financial support to infrastructure (43 %), followed by research and development projects as well as funding of investment into information technology.¹⁸ Half of the cases concern irregularities affecting public procurement procedures.

c) Increased administrative capacity-building and perspectives for EPPO cooperation

Capacity-building measures address integrity weaknesses in compliance and financial good governance. Risks can be mitigated by increasing transparency, professionalism in public procurement and anti-fraud commitment through sufficiently qualified, professional and skilled personnel on the part of the programme authorities. Specific Commission guidance to support administrative capacities is offered, in particular by a periodically updated¹⁹ public procurement action plan or, for instance, by a compendium of anti-fraud practices²⁰ and a dedicated e-learning module.

The managing authorities are trained to look more consciously at specific red flags in their decision-making on funding. With a view to analysing the possible implications of “single bidding” for cohesion funding, DG REGIO, for instance, commissioned a targeted study²¹ on the reasons for recurrence in ten selected Member States. Widespread single bidding and non-competitive tendering may be a multi-faceted phenomenon with a variety of possible explanations, including state of the market, availability of contractors, proportion of EU funds in public spending etc. But they also constitute an indication of possible anti-competitive practices and arrangements which may distort the bidding environment and might be designed or at least be of a nature to harm the Union’s financial interests, in particular if identified frequently in a specific region or state. Single bidding raises doubts about the effective organisation of the procurement process and calls upon improving the administrative capacity of procurement entities in order to address the risk of corruption and bid-rigging. This risk may actually affect many EU regions.²²

Capacity-building is supported by the Commission via technical assistance to develop cooperation with other stakeholders and actors, including civil society organisations, in particular by using “integrity pacts” as well as “peer-to-peer” cooperation and exchange. Effective and proportionate risk prevention efforts need to be tailored to the specific features of each programme and project. Used in certain high-volume procurement procedures, “integrity pacts” are agreements between a contracting authority and the companies bidding for public contracts; they provide for a commitment to abide by standards of integrity, transparency and efficiency as well as by abstaining from corrupt practices in the procurement process.²³ For purposes of accountability, the parties accept the monitoring by a civil society organisation, thereby ensuring credibility and legitimacy in contracting and the execution phases of the projects. So far, the launch of 18 “integrity pacts” has been overall successful and has already shown some important results, like identifying risk scenarios (thereby avoiding potential irregularities), helping contract authorities in handling public contracts in accordance with the regulatory framework and, last but not least, identifying and signalling concrete and tangible risks of harmful and illegal practices before the procurement is concluded.

In the future, multidisciplinary capacity-building efforts may also be further supported by cooperation with the EPPO. Once the EPPO has taken up its activities, it may be an important contribution to prevention based on its knowledge about fraud cases and action across Member States as well as its EU-wide professional criminal case expertise. Its case management system documents information from all participating Member States and allows for collecting a record and register of experiences. The EPPO Regulation foresees the development of a cooperation relationship between the EPPO and the Commission.²⁴ In particular, this should include concrete terms on increased capacity-building and for “taking precautionary measures, in particular to prevent any continuous wrongdoing or to protect the Union from reputational damage”.²⁵

2. Detection and control

An effective detection of instances of fraud and serious irregularities is the basis for any successful investigative and prosecutorial action. Detection and reporting are a management responsibility (a), which can be exercised more effectively with the support of improved technical IT tools, data enrichment, comparability and inter-operability (b). Cooperation on detected cases includes the OLAF and, in the future, the EPPO (c).

a) Management controls: irregularities detection and reporting

In the first place, managing authorities are responsible to detect fraud. The frequency and volume of reported fraud, however, is statistically low (1).²⁶ Detection responsibilities extend to instances of conflict of interests. This includes the stage of the project selection, the evaluation of the tenders, the choice of the beneficiaries and the stage of project implementation, even if it is not part of their function to investigate concrete suspicions (2).

(1) The detection effort is mainly reflected by reporting via the Irregularities Management System (IMS) to the Commission. The IMS is a specific electronic monitoring instrument for periodic reporting of both non-fraudulent and fraudulent irregularities by competent Member States authorities. Detected cases must be declared and entered into the IMS by competent authorities from the first stage of the primary administrative finding.²⁷ At least as much as they may indicate an objective fraud risk affecting the respective programmes and spending priorities, the reporting statistics therefore also reflect the efficiency in detecting fraud at the managing level. Fraud reporting in the IMS translates increased detection capacities by managing authorities responsible for cohesion. But huge discrepancies between different authorities remain, which explains the assumption of underreporting.²⁸

Based on their verifications, the reporting practice by Member States demonstrates the presence of continued risks, such as double invoicing or costs overstatement, and of situations with a conflict of interests. The Commission report on the protection of the EU’s financial interests analyses the domains in which most fraudulent irregularities are detected and reported (by amounts for 2007–2013).²⁹ There are significant increases in the number of cases related to incorrect, missing or false documents and the infringement of public procurement rules. The most-concerned spending priorities are research and technological development (RTD), increasing the adaptability of workers and firms, enterprises and entrepreneurs as well as improving access to employment and sustainability³⁰ – domains into which continued efforts will need to be invested. This investment is also crucial for the future with respect to the proposed COVID-19 crisis REACT measures,³¹ as well as the specific recovery effort under Next Generation EU: the size of EU expenditure combined in a package with the future multiannual financial framework increases and the current state of emergency requires fast action, which exposes the Union to more risks.

Whereas the tendency of the Member States to focus on fraudulent rather than non-fraudulent irregularities is higher for the programming period 2014–2020, the detected irregular financial amounts seem to have decreased. This may be due to the implementation of a more performant assurance framework that is reinforced by the obligation to present annual accounts about expenditure that are declared to the Commission for accpetance every year. However, Member States showed different reporting patterns in their tendency to detect fraudulent irregularities with high financial amounts involved. For the ERDF, Italy, Portugal and Slovakia showed a more consistent practice to detect and report fraudulent cases with large financial amounts. Italy allows its authorities to systematically draw information from the IMS for detection purposes, interlinking it directly with national data systems.

(2) Specific and extended detection responsibilities result from the now very explicit provisions for national authorities managing EU funds, so as to avoid or identify conflicts of interests. These situations arise if a public officer cannot sufficiently clearly separate the exercise of his/her functions in the management of the funds from his/her personal interests. The need to detect and make transparent a possible conflict of interests applies whenever objective indications generate this perception.³² Effective disclosure and detection are instrumental to avoid putting at jeopardy trust in the impartial decision-making by public authorities. In order to assist the Member States authorities in further strengthening procedures to detect situations of conflicts of interests, the Commission has committed to submit guidance on implementing Art. 61 of the Financial Regulation.³³ It also conducted a survey of legal and administrative measures already implemented in the Member States with the aim to undertake an updated risk assessment based on a comprehensive mapping. According to the objective to protect public trust in the impartiality of fund management, Member States authorities, when executing the EU budget, must respect these obligations at all stages of budget implementation, including preparatory acts, and at all levels of authority, including the political office level.

Situations of a conflict of interests cannot be assimilated to fraud and criminal conduct themselves. But their consequent detection and disclosure are paramount to identifying possible risks of misuse, bias, fraud and corruption in fund management, as well as to preventing reputational harm. For the European Union as a community of law, effective procedures to detect conflicts of interests at all governance levels, are also part of the broader challenge to enforce the rule of law. Transparency at all levels is crucial to conclude on appropriate Member States’ administrative capacities and financial governance.

In the recent implementation practice of the programmes under shared management, the Commission services have therefore attributed specific attention to the systems in place in order to prevent and detect conflicts of interests by Member States authorities. A high-level precedent in the Czech Republic has led to targeted compliance audits so as to control the implementation of measures to avoid conflicts of interests in its national control systems under shared management.³⁴ The recent Commission audit practice overall confirms that self-declarations of the absence of conflicts of interests during either the selection of operations or public procurement procedures are not a sufficient single means of protection and detection. Only if effectively checked by Member States authorities, they can lead to effective detection. Criminal sanctions in place for false self-declarations are not a guarantee that no further audit evidence of their validity is needed.

b) Improved detection tools, data enrichment and inter-operability

Under shared European Structure and Investment (ESI) funds management, detection is supported by the obligation to monitor and publish data on the beneficiaries.³⁵ These transparency duties for managing authorities play a central role in risk mitigation and the detection of irregularities. Private-source information may help further enrich and process this information. In the context of decentralized Member States’ administrative responsibilities for the implementation of cohesion policies, the Commission services offer support for the effective detection of illegal practices. They stimulate and encourage a more systematic enrichment of stored and recorded technical data by using data-mining and risk-scoring tools (1), as well as supporting data access through the enhanced inter-operability of Member States’ data bases (2).

(1) Managing authorities gain from making more systematic use of artificial intelligence tools during project selection and implementation.³⁶ For this purpose, they can use a specific data-mining tool called Arachne, which allows for further enrichment of information provided by the Member States authorities in accordance with Commission Delegated Regulation 480/2014.³⁷ Member State data are combined with external information from private data service providers; the system also collects company, fiscal and accounting data of more than 200 million entities worldwide. Risks affecting operations and beneficiaries can be checked along specific categories of information, e.g. “public procurement”, “conflict of interests” or “fraud”, in order to verify the presence of specific indicators, e.g. the level of compliance with fiscal, accounting and insolvency laws. This may lead to identifying red flags on the basis of which the system provides a “risk-scoring”. The managing authority entirely preserves its discretion in decision-making but benefits from the warnings provided to detect areas at risk and target verifications on the spot.

The analytical device Arachne (developed by the Commission) is currently a voluntary preventive detection tool. Based on a private service contract, it is provided free of charge to managing authorities³⁸ and can identify a project exposure to risks of fraud, conflicts of interests, double financing, corruption or other irregularities. As not all Member States currently use artificial intelligence tools, the question is whether and on which terms the EU legislator should provide a requirement to make compulsory use of the data-mining system. This could help with a more effective uptake of Arachne for all programmes and Member States, lead to more complete information being inserted and thereby further increase its quality. A reference in an EU legal instrument would overcome the opposition of some Member States which do not yet use it.³⁹

(2) Relevant information on the state of implementation of financed operations and on payments to beneficiaries is already included and publicly accessible in the cohesion open-data platform.⁴⁰ However, this information is currently not fully interoperable and entered in accordance with different data quality standards. Not all Member States authorities insert their information using comparable categories and parameters of information, such as an official identifier code for beneficiaries. This still makes it difficult to trace and detect contractors, beneficial owners and final recipients of the beneficiary company or trust. In order to further increase data interoperability and transparency for fund management, the Commission has therefore tested smart processing of open data by using an advanced knowledge tool for a limited number of Member States in a pilot project. It will insert content from relevant Member States’ data bases on an interoperable platform, processing the data with linguistic, data-mining and search functions. If successful, this pilot could ultimately become a smart processing tool for all Member States and might technically be used for risk analysis and detection.

Improved data interoperability could help track and detect more effectively beneficial owner control in shared management and cohesion policies. This is currently required for EU funds participation in financial instruments and budgetary guarantees under an indirect spending mode by European banks.⁴¹ But the use of the data needs to respect the purpose of the legal basis under which it is collected. As a concrete example, for cohesion and agriculture policies, the European Parliament requests to obtain from the Commission the lists per Member State and, within the EU, of the 50 largest individual recipients (natural persons or beneficial owners of a company).⁴² The purpose and the need to know for protecting the EU’s financial interests is presented in broad terms. The data protection challenges will need to be addressed in compliance with the GDPR⁴³ and the other EU data protection regulations⁴⁴. The proposal for a regulation on common provisions for cohesion programmes in 2021–2027 provides, for monitoring purposes, a more harmonised input, but does not include the systematic disclosure of beneficial owner data and on contractors in procurement. The regulatory templates would need to be completed with updates, but without disproportionately increasing the administrative burden for managing authorities. According to its recent anti-money-laundering action plan, the Commission also intends to submit, within the next year, a rule book on whether the Anti-Money Laundering Directive needs to be further harmonised.⁴⁵

c) Cooperation on detected cases with the OLAF – and with the EPPO in the future

Detected cases with a suspicion of fraud are systematically communicated to the OLAF by Commission services. This is done based on information received from all sources: from the managing and audit authorities at the national level and in the regions and, in particular, based on Commission audits. In practice, Commission services report the majority of public-sources information to the OLAF. Even though the transmitted information does not always lead to the opening of investigations, about one third of cases are accepted for investigation by the OLAF. Transmission of information by Member States authorities to the OLAF for investigation is comparatively less frequent. The managing authorities currently transmit detected cases to national investigation services, or in case of criminal suspicion directly to judicial authorities for purposes of investigation and prosecution.⁴⁶

The future relationship between the EPPO and the Commission will explore ways for operational cooperation and assistance on detection. In the future, a structured and periodical exchange of information and experiences could lead to cross-reference information, which would allow for extracting data for operational analysis⁴⁷ and for detecting fraud. The interest of the Commission services will notably include the development of available knowledge for precautionary measures in case of a detection of potential irregularities and fraud. Information collected by the EPPO – as a specialised investigation and prosecution body – with a European decentralised structure and a case management system covering cohesion fraud cases could support detection results. Considering the respective prerogatives and priorities, however, this assistance to detection is not evident, at least not in pending investigation cases, where it needs to be reconciled with judicial secrecy. The transmission of sufficient information by the EPPO to Commission services is “without prejudice to the proper conduct and confidentiality of its investigations”.⁴⁸ But it should not be excluded in principle. It could contribute to effective protection.

III. A Consistent Response in Reaction to Fraudulent Irregularities

Compliance of the management and control systems predominantly depends on the protective capacities of financial correction and recovery, which should be exercised effectively without undue delay under the responsibility of the Member States authorities (1). In addition to paying back unlawfully obtained monies, administrative sanction procedures for the exclusion and blacklisting of unreliable beneficiaries under the European Detection and Exclusion System (EDES) could complement future judicial prosecution of criminal offences by the EPPO (2).

1. Financial correction and recovery

Irregular expenditure is corrected and recovered (a), but procedures must become swifter (b).

a) Administrative financial correction and recovery procedures in cases of irregularities and fraud

If irregularities or fraud are detected and established, Member States authorities are responsible for applying financial corrections and recovering expenditure from the beneficiaries. If related serious system deficiencies are not corrected, the Commission itself interrupts interim payments, suspends programme implementation and applies financial corrections against the respective Member State (1). The amount is determined by flatrate corrections if the financial prejudice cannot be clearly quantified (2). Corrections may in particular need to be adopted as a consequence of OLAF financial recommendations (3).

(1) Under shared management, financial corrections and recovery are implemented in different layers. With respect to EU cohesion expenditure, financial corrections by Member States authorities⁴⁹ are implemented either by cancelling all or part of the EU contributions to an operation, through de-certifications of declared amounts from the annual accounts or through withdrawals in case of “pending recoveries”. Under Art. 325 TFEU, it is the Member States’ responsibility to issue a recovery order and to ensure that beneficiaries pay back the obtained monies to the managing authorities if irregularities due to fraud and illegal activities are established. This duty applies in accordance with the rules under the applicable legal, administrative and contractual framework, independent from a criminal conviction. The Commission imposes financial corrections on the Member State⁵⁰ if – based on audit results reported by the Member States or on own audits – material risks remain in the functioning of the management and control systems. The Commission is required to launch financial correction procedures each time once the national control cycle (including corrections) is completed if it concludes that the residual total error rate for a programme is still above 2%. As precautionary measures, this comprises the swift interruption of interim payments. If an application for interim payments comprises irregular and, in particular, fraudulent expenditure, the payment scheme may be suspended by the Commission.⁵¹

The progamme authorities can reuse the monies in a subsequent accounting year for another operation within the same programme.⁵² However, the Commission shall apply net financial corrections should serious deficiencies be identified by its audit directorates (or the European Court of Auditors), provided that they were not identified, reported and corrected by the Member State authorities when submitting the corresponding accounts.⁵³ In this case, the amounts subject to financial correction are deducted as net corrections from its Member State credits. In practice, this possibility is rarely used, but it has a disciplinary effect and ensures Member States’ compliance when submitting the accounts. This can be illustrated by the high amount of deductions in the declared expenditure of the annual accounts from final annual interim payment requests.⁵⁴ However, once financial corrections are made by the programme authorities, the Commission itself has, under shared management responsibilities, no further means to insist that the illegally received monies are paid back to the authorities by the beneficiary. Of course, this is without prejudice to Member State obligations under Art. 325 TFEU to take effective measures so as to recover fraudulently obtained amounts.

(2) Financial corrections correspond with the value of the wrongly charged expenditure. But if a prejudice cannot be specifically and precisely quantified for individual irregularities, flatrate corrections are applied.⁵⁵ These may need to be imposed on beneficiaries by programme authorities, particularly for cases of fraud, conflict of interests and bid-rigging in public procurement. The specific rates depend on the seriousness of the breach and the systemic nature of the identified irregularities, which may range from 5% to 100% of the affected expenditure.⁵⁶ If fraud is uncovered, the complete failure of compliance may justify a maximum flatrate correction of 100% of the affected expenditure.⁵⁷ Standard correction rates are, in particular, foreseen in the recently revised Commission guidelines on financial corrections in public procurement.⁵⁸ These are addressed to Commission services and not directly legally binding for the Member States, but for reasons of equal treatment, they are relevant for the exercise of their discretion. The guidelines thereby clarify the obligations of programme authorities to correct any prejudice to the EU’s financial interests, in particular in cases of fraud affecting public procurement expenditure. The rates set a generally applicable proportionate standard rate of correction, but the specific decision must take into account all circumstances of the individual irregularity. The flatrate depends on the nature and gravity of the irregularities, which may be opposed to the Member States authorities and the resulting financial implications for the funds.⁵⁹ The gravity may need to be clarified in cases of bid-rigging, cartel and anti-competitive agreements between tenderers, in particular if the administration itself is a victim. The full flatrate of 100 % financial correction is, however, foreseen in cases of involvement of public administration officials.⁶⁰

(3) Recovery of illegally obtained monies may in particular be a consequence of OLAF investigations with fraud findings. The Commission’s shared management services systematically follow up on financial recommendations accompanying OLAF final case reports. It is the Commission with its competent fund managing Directorates General (REGIO or EMPL) which is the direct addressee of relevant financial recommendations accompanying the findings in a final OLAF case report. But the financial recommendations need to be transmitted for implementation by the Commission services to the national managing authorities. As the OLAF recommendations themselves are not a binding decision for the national authorities, a contradictory process is organised. If the managing authorities do not agree to applying financial corrections without a valid reason – or not for the recommended full amount –, the Commission may need to launch administrative procedures for financial corrections. The implementation of all transmitted OLAF recommendations is comprehensively monitored by DG REGIO, which closely checks progress. The average ratio of implementation of OLAF financial recommendations by DG REGIO reached about 86 % of the volume of recommendations made by the OLAF in 2019.⁶¹ This result is due to upfront informal coordination between the different Commission services about anticipated findings, their legal presentation in the OLAF final report and the amount of recommended financial recovery – without prejudice, but to the OLAF’s investigative independence. Nonetheless, the follow-up process is currently still quite long, requiring a period of about 18 months on average. This is due to the need in many cases to await the outcome of pending lengthy national administrative and criminal proceedings.

b) Perspectives for accelerated recovery with the assistance of the EPPO?

The question is whether further progress on recovery can in the future be expected from cooperation with the EPPO. The Regulation is rather silent on recovery cooperation between the EPPO and the Commission. In addition, the EPPO Regulation regrettably does not draw up concrete procedural approaches on how to reconcile the exercise of concrete managing tasks in order to safeguard the precautionary financial measures with actions by the specialised prosecution service. This includes, for instance, the provision of a reinsurance that interference between criminal and administrative procedures will be avoided more effectively. If fraud is identified, the performance of contracts may need to be interrupted and programmes suspended quickly, payments have to be refused and unduly paid amounts recovered. The need to accelerate recovery procedures is reflected insufficiently in the EPPO Regulation, which argues that “to the extent that recovery procedures are deferred as a result of decisions taken by the EPPO in connection with investigations or prosecutions under the EPPO Regulation, Member States should not be considered at fault or negligent for the purposes of recovery procedures”.⁶² This is the wrong signal: the EPPO has been established to become a factor of acceleration and not of delay in the response to fraud. It should contribute to safeguarding a quick recovery of monies.

The EPPO may need to protect the EU’s financial interests through fast precautionary and conservative measures in its investigation procedures, in particular to stop payments and avoid putting at risk EU monies.

On the one hand, the EPPO Regulation does not comprise many specific provisions describing how the EPPO will advise on administrative measures. Precautionary measures by programme authorities to protect financial interests could comprise suspensions and interruptions of payments, as specified for ongoing OLAF investigations.⁶³ The EPPO Regulation indicates in general terms that the EPPO may “recommend specific measures”.⁶⁴ But in concrete terms, the EPPO Regulation only covers cooperation with the Commission on the correction of illegal expenditure for two scenarios – which occur at the very end of investigative procedures – and specifies the EPPO’s mandate to help recover the defrauded sums. First, in case of prosecution, the EPPO will notify the Commission of the decision “where necessary for the purposes of recovery”.⁶⁵ This information flow is indeed necessary both to protect the secrecy of criminal proceedings or investigative measures and to avoid further putting at risk the EU’s financial interests. Second, the EPPO Regulation mentions the referral of the file in case of dismissal, for the recovery and administrative follow-up to the OLAF or other competent authorities.⁶⁶

On the other hand, the EPPO Regulation does not in itself provide a legal basis for specific judicial powers to take conservative or other precautionary judicial measures. This matter continues to be subject to national criminal procedural law. According to the Regulation, national law may specify the relevant investigative and precautionary powers of freezing instrumentalities, proceeds and assets,⁶⁷ depending on concrete conditions, so as to avoid “that the owner, possessor or controller of those instrumentalities or proceeds will seek to frustrate the judgement ordering confiscation”. But the Regulation does not clarify, for instance, the cooperation with offices responsible for freezing and confiscating proceeds of fraud.⁶⁸

2. Future use of administrative sanctions and prosecution

EU anti-fraud legal instruments emphasise the objective of a deterrent fight against fraud, in particular the directive on criminal law protection, which provides harmonised criminal offences, including fraud and corruption,⁶⁹ as well as the EPPO Regulation, whose criminal investigation and prosecution powers will extend to fraud affecting cohesion funds. But the exclusion of unreliable beneficiaries from EU projects and blacklisting by managing authorities could also be a relevant type of sanction, which would be necessary for the protection systems in cohesion (a) and complementary to anti-fraud deterrence through effective prosecution by the EPPO (b).

a) Legal framework for administrative EU sanctions and the EDES

Companies and persons who have committed serious illegal activities and fraud should possibly be blacklisted⁷⁰ and banned from participation in EU-financed tenders. Beyond corrections, the EU Financial Regulation provides for the application of financial penalties as well as the exclusion and blacklisting of unreliable beneficiaries in cases of serious irregularities (1). These administrative sanctions might also be introduced in cohesion policies to swiftly apply, without prejudice to criminal law responsibility and the assessment of guilt by the competent judiciary (2).

(1) European administrative sanctions are, however, currently not yet applicable in cohesion policies against beneficiaries who have committed serious irregularities, as the implementation mechanism – which the EU Financial Regulation provides under the EDES – and the registration of beneficiaries in the EDES have not yet been extended to areas of shared management.⁷¹ So far, it only applies to direct (by Commission) and indirect (by EU-agencies, e.g. EU-public banks) spending. Two types of registration need to be distinguished:

First, the EDES provides to apply measures of reinforced control so as to protect the Union’s financial interests against risks through unreliable beneficiaries and entities. In order to warn authorising officers, registration in the system ensures the early detection of beneficiary entities and persons of interest representing risks that threaten the Union’s financial interests.⁷² This is not a decision on sanctions. The registration does not in itself constitute a final measure that brings about a binding effect and a change in the legal position of the entities concerned. But in the future, the EPPO may request the deferral of an EDES detection and early warning notification,⁷³ as long as there are compelling legitimate grounds to preserve confidentiality in its investigations.⁷⁴

Second, administrative sanctions, such as the exclusion of persons and entities from receiving Union funds, are foreseen in cases of findings of serious misconduct.⁷⁵ The regulatory sanctions include the imposition of a financial penalty on an economic operator⁷⁶ and, in the most severe cases, the publication of the exclusion on the Commission’s internet site, in order to reinforce the deterrent effect.⁷⁷ The Commission and the other EU authorising officers feed information of serious irregularities about unreliable beneficiaries into the EDES. The procedure strives for swift decision-making while respecting defence rights and the contradictory procedure .⁷⁸ The information that triggers exclusion may be based on both a final or non-final judgement or administrative decision, but could also (and in particular) rely on facts and findings by the OLAF, audits or any other check, as well as audits or controls performed under the responsibility of the competent authorising officer. In the future, the exclusion can also be based on information transmitted after investigations by the EPPO. In the absence of a final judgement, the responsible authorising officers make their decisions on the basis of a preliminary classification in criminal law, with due regard to the recommendations of the high-level EDES panel.⁷⁹

(2) Cases of fraud under shared management could equally be inserted in the future, if provided by sectorial regulations. This could complement the current Irregularities Management System (IMS), in which shared management authorities periodically report irregularities and fraud in accordance with regulatory monitoring duties – but it is simply a reporting and monitoring tool for risk analysis and statistics.⁸⁰ The full extension of the EDES to compulsory use by shared management beneficiaries, bodies implementing financial instruments and final recipients, however, would require a significant legislative and administrative effort. Currently, Member States are only encouraged to use the EDES when selecting beneficiaries of their programmes on a voluntary basis. Access to EDES information on exclusions from expenditure under direct and indirect management needs to be granted ad hoc to national authorities by the Commission if this information is necessary for assessing a fraud risk and the possible ineligibility of a registered beneficiary. So far, only Malta and Slovenia have requested access. Legislative changes with respect to the exclusion from all EU funds across different spending modes of beneficiaries who are also registered under shared management would additionally entail the need to provide that Member States can directly access the Commission-owned system and insert information about beneficiaries under their own responsibility. Hence, the EDES structure would need to be changed as well.

b) The relevance of future cooperation with the EPPO

The EPPO might take up its activities at the end of 2020.⁸¹ Effective EU-wide, equivalent and more expedient procedures for prosecution and criminal sanctions in cases of fraud in cohesion funds are expected outcomes of this important reform.⁸² Investigations currently often take too much time and need to be enforced by applying different criminal procedural standards. On the one hand, the different modalities for cooperation between the Commission – including the OLAF – and the EPPO in individual investigations still need to be clarified, even if they have to build on practices that are already in place (1). On the other hand, in accordance with existing anti-fraud policies, management authorities themselves need to systematically submit fraud suspicions for dissuasive action of the prosecution. Cooperation with the EPPO by Member States must therefore necessarily be taken into account when assessing the proper functioning of the management and control systems for purposes of audit arrangements – and possibly also in the future when assessing the enabling conditions, which may lead to the suspension of funds in accordance with rule-of-law criteria (b).

(1) Spontaneous fraud reporting by Commission services will be the main source of information for the EPPO. For practical reasons and with a view to reporting fraud suspicions without undue delay,⁸³ DG REGIO may follow existing reporting mechanisms within the Commission and make use of its OLAF arrangements.⁸⁴ In practice, this may be advisable so as to assess whether there are sufficient suspicions as well as to find the appropriate moment and extent of information exchange to start criminal investigations with the EPPO. This may be preferable with a view to checking whether the facts are within the material scope of competence of the EPPO for criminal conduct.⁸⁵ In practice, the criminal dimension is an aspect with which the programme authorities and DG REGIO have little experience, notwithstanding a possible preliminary evaluation of the allegations to be reported and their first classification in criminal law.⁸⁶ With a view to properly assessing who is competent to prosecute, it also seems important to determine whether the level of maximum sanctions is equal or less severe in the presence of non-harmonised offences.⁸⁷ Finally, the OLAF may be better placed than DG REGIO for assessing the question whether the threshold of sanction and damage criteria are met in de minimis cases, so as to confirm the EPPO’s competence.⁸⁸

Information exchange will also become necessary on request by the EPPO in pending fraud investigations. The EPPO may in particular request “further relevant information” available to the Commission.⁸⁹ It may also want to obtain any relevant information stored in data bases and registers of the Commission.⁹⁰ In this context, the question arises of the modalities and the extent of such access, in particular whether the EPPO should be given direct access to certain Commission data bases, or whether information shall be extracted by Commission services from the data bases. DG REGIO will need to collect further information on a request by the EPPO within the limits of the obligation for loyal cooperation. But the role of the Commission auditors differs from the one of fraud investigators, and does not equal that of an auxiliary of justice. For these reasons, it would make sense that a possible liaison with the EPPO in ongoing investigations should be established via or in close consultation with the OLAF.

(2) As mentioned above, the EPPO should contribute to more expedient, effective and equivalent criminal law action in cases of fraud. However, not all EU Member States participate in the EPPO scheme. In line with the anti-fraud criminal law policies for national authorities, the cohesion common provisions proposal for 2021–2027⁹¹ therefore links the use of certain simplifications in national assurance systems (such as the use of single audit procedures and the application of enhanced proportionate audit arrangements) to the participation of the concerned Member State in prosecution cooperation with the EPPO.⁹² This link is formulated in flexible terms but illustrates the understandable expectation that this cooperation with the EPPO will be key to strengthening and enforcing sound financial management. Member States are invited to avail themselves of the EPPO investigation and prosecution functions with regard to achieving effective protection of the EU budget before enjoying simplified assurance conditions. However, it will be important to confirm the actual relevance of participation by Member States in the enhanced cooperation with the EPPO on the basis of practical results. It must also be confirmed whether the new system achieves effective operational protection of the EU’s financial interests through dissuasive criminal law measures against fraud. This test will only prove successful if the EPPO can confirm – in concrete cases – its efficiency in simplifying and accelerating prosecution, which can lead to dissuasive sanction procedures.

Some Member States, including Poland and Hungary, which both finance an important part of their public investment budgets through cohesion funding, do not intend to participate in the enhanced cooperation. Should this ultimately lead to an operationally less effective prosecution function by these non-participating States, this would be a deficiency in their management and control systems. In the future – and under conditions which still need to be clarified –, this could – even justify a requirement for EU cohesion funding under the rule-of-law principle if the lack of participation with the EPPO indicates a generalised deficiency of the judicial system.

IV. Conclusions

Anti-fraud measures in cohesion policies are more structured today than in the past, but the need for tailor-made and proportionate, risk-based approaches remains topical. In the years to come, following the COVID-19 crisis, the need for a robust overall protection of EU finances will even increase. Even for the 2014–2020 period, the COVID-19 pandemic regulatory initiatives already provide increased funding that is available under flexible conditions and offers the possibility of 100 % EU financing. In many Member States, this is combined with high time pressure on implementing the funding measures foreseen and proposed in May 2020,⁹³ which complete the earlier measures of the immediate response to the impact of the pandemic.⁹⁴ For the new multi-annual financial framework, the important volume of EU support foreseen under the EU recovery package put forward in May 2020 in the Commission proposal for the 2021–2027 period even more evidently illustrates the need to further strengthen measures to address risks of fraud.⁹⁵ The challenges ahead require full synergies between all actors involved, updated risk assessments for the programmes, an attentive detection of any possible irregularities as well as investigations into and the prosecution of suspicions of fraud.

The existence of functioning management and control systems as well as the availability of effective prosecution and independent criminal law protection in cases of criminal activities affecting EU cohesion expenditure are intertwined. In this context, the EPPO, which will work together with the other competent authorities and stakeholders and resist temptations of empire building, will become an indispensable key player for an effective operational system of anti-fraud measures under the next multi-annual financial framework. It will provide a criminal law safeguard, which is necessary for and complementary to the administrative assurance systems, as well as being relevant for achieving the objectives of EU policies on cohesion and values. As can be seen from most recent European Council conclusions⁹⁶, in the negotiations on the multi-annual financial framework, however, Member States might remain divided on rule-of-law conditionalities. Whereas the European Parliament has endorsed the main thrust of the Commission proposal⁹⁷ about respect for the rule of law for the 2021–2027 programmes,⁹⁸ the European Council has not yet been able to fully endorse the “rule-of-law conditionality” as an integral part of the future multi-annual financial framework funding schemes.