Covenant on administrative fines and criminal-law sanctions

No. 12934 1 June 2023 Covenant on the prevention of unlawful overlap of administrative and criminal-law sanctions

Parties The parties financially contributing to the National Weighing Team are: The Foundation for the Financial Market Authority (hereinafter: AFM) De Nederlandsche Bank N.V. (hereinafter: DNB) The Fiscal Intelligence and Investigation Service (hereinafter: FIOD) The Public Prosecution Service, Functional Unit (hereinafter: OM) hereinafter referred to individually as 'party' and collectively as 'parties',

Considerations Taking into account that:

• No one may be punished twice for the same act;
• The supervisor does not impose an administrative fine if criminal prosecution has been instituted against the offender for the same conduct and the trial has begun, or if a criminal penalty order has been issued;
• If an administrative fine has been imposed on the suspect, or a notification as referred to in Article 5:50, second paragraph, item a, of the General Administrative Law Act (hereinafter: Awb) has been sent, this has the same legal consequences as a notification of no further prosecution;
• It is therefore necessary to coordinate decisions regarding the settlement of violations in advance and to consult in good time for this purpose;
• The information exchange agreed upon in this covenant is carried out, unless legal limitations have been placed on this;
• The parties do not maintain a joint information system; the received personal data are processed in the data files of the parties, in accordance with the legislation and regulations applicable to the parties;
• Each party is solely responsible for the processing in its own data files and the provision from its own data files to each other, to the data subject(s), and to third parties.

Based on:

• The statutory task of the FIOD as mentioned in Article 3 of the Act on Special Investigation Services (hereinafter: Wbo);
• The task of the OM as laid down in Article 124 of the Judiciary Organization Act (hereinafter: Wet RO);
• The tasks of the AFM and DNB as included in the financial supervision legislation and regulations.

The following agreement is reached:

1. Definitions In this covenant, the following terms are understood as: 1.1 Data subject: data subject, as referred to in Article 4, first paragraph, of the General Data Protection Regulation (hereinafter: AVG) or Article 1, item g, of the Police Data Act (hereinafter: Wpg), or Article 1, item g, of the Judicial and Criminal Procedure Data Act (hereinafter: Wjsg); 1.2 Personal data: all information concerning an identified or identifiable natural person ('the data subject'), as referred to in Article 4, first paragraph, of the AVG; 1.3 Police data: any personal data processed in the context of the execution of the statutory task of the FIOD, as referred to in Article 3 of the Wbo; 1.4 Controller: the controller, as referred to in Article 4, seventh paragraph, of the AVG, or Article 1, item f, of the Wpg, or Article 1, item c, item 1°, of the Decision on Police Data Special Investigation Services (Bpbo), or Article 1, item k, of the Wjsg; 1.5 Processing: processing of personal data, as referred to in Article 4, second paragraph, of the AVG; 1.6 Administrative fine: an administrative sanction, as referred to in Article 5:40, first paragraph, of the Awb; 1.7 Financial supervision legislation and regulations: all legislation and regulations, including regulations, containing norms that can be enforced by DNB and the AFM with an administrative fine; 1.8 Violation: a breach of financial supervision legislation and regulations for which an administrative fine can be imposed and criminal-law settlement is possible; 1.9 Prohibition rule: a prohibition rule included in the financial supervision legislation and regulations; 1.10 Supervisor: the AFM and DNB; 1.11 Criminal procedure data: personal data or data concerning a legal entity obtained in the context of a criminal investigation and processed by the OM in a criminal file or via automated means in a data file (Article 1, item b, of the Wjsg); 1.12 Recidivism: the circumstance that less than five years have elapsed since the imposition of an administrative fine on the offender for the same violation at the time the violation was committed; 1.13 Weighing Team: the weighing team, as referred to in Article 6, first paragraph, of this covenant.

2. Purposes The purposes of the cooperation are: to prevent unwanted overlap of administrative and criminal-law sanctions and to coordinate the manner of settlement.

3. Information provision by the OM and the FIOD If and as soon as the OM or the FIOD becomes aware of facts, circumstances, or conduct indicating a violation of financial supervision legislation and regulations, it informs the relevant supervisor thereof for the purpose of coordinating the manner of settlement, unless compelling criminal procedural or privacy interests oppose the provision.

4. Information provision by supervisors 4.1 If and as soon as a supervisor intends to impose an administrative fine for a violation, it informs the OM thereof for the purpose of coordinating the manner of settlement, if: a. it concerns a violation of a prohibition rule; or b. it concerns a violation of Article 17 of Regulation (EU) No 596/2014 (Market Abuse Regulation). After the decision in the Weighing Team, an investigation follows. Exchange in that process falls under bilateral exchange outside the Weighing Team. 4.2 If and as soon as a supervisor intends to impose an administrative fine for violations other than those referred to in the first paragraph, it informs the OM thereof for the purpose of coordinating the manner of settlement, when: a. there is an overlap of a violation with one or more separate acts for which only criminal-law settlement is available; b. there is recidivism; or c. this is deemed necessary by the supervisor given the specific circumstances of the case – assessed in light of the seriousness of the violation, the degree of intent and culpability, the extent of the damage, and in relation to the protection of the public.

5. Coordination on the manner of settlement 5.1 To achieve the purposes of this covenant, the parties commit to certain contributions. These contributions are jointly coordinated by the parties. The parties commit to coordinating administrative and criminal-law measures with each other and to jointly deciding on them. The OM can always decide to conduct a criminal investigation, even if other parties within this covenant disagree with this. 5.2 If the supervisor has been informed in accordance with Article 3, it does not decide to impose an administrative fine for the relevant violation, except after coordination with the OM. 5.3 When the OM has been informed in accordance with Article 4, it does not decide to proceed with investigation or prosecution for the relevant violation, except after coordination with the supervisor. 5.4 The coordination referred to in the first and second paragraphs takes place as much as possible within six weeks after the information provision, as referred to in Articles 3 and 4, has taken place. 5.5 It may be chosen to split a case, where separate violations are at issue, into an administrative part and a criminal part.

6. Weighing Teams 6.1 There is a Weighing Team DNB and there is a Weighing Team AFM. The Weighing Team consists of the OM, the relevant supervisor, and the FIOD. If a violation occurs for which both supervisors are authorized to impose an administrative fine, both supervisors participate in the Weighing Team. 6.2 The coordination pursuant to Articles 3 and 4 takes place in the Weighing Team. When the situation, in the opinion of the parties, requires it, ad hoc coordination takes place outside the relevant Weighing Team between the involved parties. 6.3 After the information provision and coordination, as referred to in Articles 3 and 4, have taken place, the party responsible for the settlement informs the other party about the progress of the investigation and prosecution and the decisions taken therein, respectively, the progress of the imposition of the administrative fine and the decisions taken therein.

7. Foundations for data processing 7.1 The FIOD processes police data to the extent that such processing is necessary for the fulfillment of the statutory task as laid down in Article 3 of the Wbo. The basis for the provision of police data, as referred to in Article 8 and Article 9 of the Wpg, to DNB and the AFM takes place on the basis of Article 6, first paragraph, of the Bpbo. Provision of police data to the OM takes place on the basis of Article 16, first paragraph, of the Wpg. 7.2 The OM processes criminal procedure data to the extent that such processing is necessary for the fulfillment of Article 124 of the Wet RO. The legal bases for data processing are for the OM located in the Wjsg. The basis for the provision of criminal procedure data by the OM to all parties in the cooperation is located in Article 39f of the Wjsg, respectively:

• for party FIOD Article 39f, first paragraph, item a, of the Wjsg
• for party AFM Article 39f, first paragraph, item c, of the Wjsg
• for party DNB Article 39f, first paragraph, item c, of the Wjsg 7.3 The AFM provides personal data to the extent this is necessary on the basis of Article 6, first paragraph, item e, of the AVG. The AFM processes the received data on the basis of Article 6, first paragraph, item e, of the AVG. 7.4 DNB provides personal data to the extent this is necessary on the basis of Article 6, first paragraph, item e, of the AVG. DNB processes the received data on the basis of Article 6, first paragraph, item e, of the AVG.

8. Categories of data subjects and categories of personal data 8.1 In the context of the cooperation, the parties provide the following categories of personal data concerning the following categories of data subjects, if available and necessary. 8.2 Category of data subjects 1, persons of interest (legal entity and/or natural person). Persons of interest are persons on whom a suspicion may rest and/or suspects: a. NAW data (Name, Address, Place of residence); b. Place and date of birth; c. Telephone and e-mail data; d. In addition to this, the FIOD may provide the following police data: • Police data, as referred to in Article 8 of the Wpg • Police data, as referred to in Article 9 of the Wpg 8.3 Category of data subjects 2, involved employees of the parties: a. Name of providing or handling official or employee; b. Job title of providing official or employee; c. Business telephone and e-mail data of providing official or employee.

9. Manner of provision 9.1 Personal data are only provided by and to those employees of the parties who have been designated and authorized by those parties to process this data to the extent necessary for their task in achieving the objectives of the covenant. 9.2 Police data can be provided orally and/or in writing by the FIOD via secure e-mail or orally in the consultation of the relevant Weighing Team. 9.3 Criminal procedure and/or judicial data and/or enforcement data can be provided orally and/or in writing by the OM via secure e-mail or orally in the consultation of the relevant Weighing Team. 9.4 Personal data can be provided by the parties in the following manner: via secure e-mail or orally in the consultation of the relevant Weighing Team. 9.5 Any party that finds that the provided personal data are not correct or incomplete, informs the other parties of corrections of and/or additions to the personal data.

10. Duty of confidentiality 10.1 The parties ensure that those who process personal data, for whom a duty of confidentiality does not already exist by virtue of office, profession, or legal regulation, declare themselves bound to confidentiality regarding personal data and other data of which they know or reasonably suspect the confidential nature, except insofar as any legal regulation obligates them to disclosure or this follows from their task. 10.2 The parties commit to informing other parties of the duty of confidentiality applicable to them. 10.3 The party that further processes the received (personal) data for purposes other than the purposes of the cooperation ensures that all relevant legislation and regulations are complied with, including the requirements of the AVG and the Wpg.

11. Retention periods and destruction Parties are bound by the AVG and the other legislation and regulations relevant to them (including Archive Act legislation and regulations) regarding the processing of personal data. The data (including all copies and backups) are irreversibly deleted in case of destruction in accordance with the data retention policy of the own organization or are anonymized.

12. Security 12.1 The parties secure the personal data of the data subjects against loss or any form of unlawful processing and take the necessary appropriate technical and organizational measures for this purpose. 12.2 The parties have procedures to establish the reliability of employees. Part of this is in any case having a confidentiality declaration signed and screening of employees. 12.3 The parties are aware that, despite all agreements, incidents may occur regarding the data processed in the Weighing Team. Every incident concerning a (possible) breach of the security of data shared in the Weighing Team is reported without delay to the party(ies) from whom the data were previously received.

13. Information obligation In order to ensure that persons and organizations become aware of the data exchange in the context of the cooperation, this covenant is published by the participating parties on their website and/or made public in other ways.

14. Rights of the data subject 14.1 The data subject can submit a request to a party or to parties to exercise his/her rights based on the AVG. 14.2 Regarding parties that process personal data on the basis of Article 6, first paragraph, item e or f, of the AVG, the data subject can at any time object to such processing by those parties that process data on the basis of that specific ground, due to his/her particular circumstances. 14.3 If the data subject directs a request to one of the parties, this party informs him/her in the response also about the identity of the other involved parties to whom data were previously provided for the purposes of the cooperation.

15. Damage and costs 15.1 Anyone who has suffered material or immaterial damage as a result of a breach of the legislation and regulations applicable to the parties, has the right pursuant to Article 82 of the AVG to receive compensation from the controller for the damage suffered. 15.2 The parties are liable for themselves in case of attributable deficiency for damage resulting from their own data processing or their provision to involved parties or third parties. 15.3 The parties do not calculate or settle costs among themselves for work and means of any kind resulting from this covenant, to a party mentioned in this covenant.

16. Evaluation and amendments 16.1 The parties commit to evaluating the cooperation at least once every three years, unless there is a concrete reason to evaluate earlier. The OM takes the initiative for this. 16.2 If the evaluation shows that the covenant requires adjustment, the covenant will consequently be amended in accordance. 16.3 Amendments and additions to this covenant require the approval, signature, and dating by all parties. 16.4 Each party can terminate this covenant by means of a written notification to all parties, observing a notice period of one month. 16.5 When a party terminates the covenant, the covenant remains in effect for the remaining parties insofar as the content and purport do not oppose this.

17. Admission 17.1 Parties are informed in advance of the intended admission of a new party, and unanimous consent must be given regarding the admission. 17.2 The admitting party conforms to the agreements set forth in this covenant. 17.3 Admission takes place by means of signing the addendum by the admitting party and signing by the already participating parties.

18. Entry into force This covenant enters into force the day after publication in the Staatscourant.

19. Revocation of Covenant on the prevention of unlawful overlap of administrative and criminal-law sanctions The Covenant on the prevention of unlawful overlap of administrative and criminal-law sanctions of 1 December 2008 (Stcrt. 15 January 2009, no. 9) is revoked.

Thus agreed upon and signed. The General Director of the FIOD, N.S.T. Obbink The Public Prosecution Service, the College of Procurators-General, represented here by the Chief Public Prosecutor of the Functional Unit, M. Zwinkels The Foundation for the Financial Market Authority, on behalf of: H. van Beusekom De Nederlandsche Bank N.V., on behalf of: E.F. Bos