What is EuReCA?
EuReCa is a central database developed by the European Banking Authority (hereafter “EBA”) designed to strengthen the framework for combating money laundering and terrorist financing (hereafter “AML/CFT”).
EuReCa contains information on “material weaknesses”, i.e. serious deficiencies by financial sector operators to comply with AML/CFT requirements that expose them to money laundering and terrorist financing risks. It also contains information on the measures supervisors imposed to remedy those material weaknesses.
EuReCa was established pursuant to Article 9a, (1) and (3), of Regulation (EU) No 1093/2010 of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority). Article 11 of Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (hereafter “AMLA”) now grants AMLA the power to establish a central AML/CFT database and keep it up to date.
Consequently, AMLA assumes the responsibilities previously carried out by the EBA regarding EuReCa. However, Article 106 of the AMLA Regulation provides for a transition period, which may be extended until 30 June 2027, during which AMLA will manage EuReCa jointly with the EBA (hereafter “transition period”).
AMLA (or the EBA on behalf of AMLA) cooperates with the national authorities within the EU, among which the Financial Services and Markets Authority (hereafter “FSMA”), for the purpose of managing EuReCa.
What are the respective data protection responsibilities of AMLA and of the FSMA in relation to EuReCa?
As far as data protection is concerned, the respective obligations of AMLA and of the FSMA are as follows:
- AMLA is responsible for compliance with its data protection obligations when it processes personal data to analyse the information provided by the reporting authorities (including the FSMA) via EuReCa and to operate, store and maintain this database, including its supporting infrastructure. For further information on EuReCa, please consult the applicable privacy policy of AMLA (available on its website).
- as a reporting authority (as defined in Commission Delegated Regulation (EU) 2024/595 of 9 November 2023), the FSMA has the legal obligation and responsibility to provide AMLA, via EuReCa, with certain information regarding AML/CFT material weaknesses and the measures taken to address them (including registering data in the database, responding to AMLA’s requests, updating data, etc.). Moreover, the FSMA may receive certain information contained in EuReCa and supplied by other reporting authorities, as provided to the FSMA at its own request or shared by AMLA on its own initiative.
In this context, and as part of its public-interest tasks, the FSMA may, as data controller, where applicable, have to process a limited amount of personal data (hereafter “data”) about individuals under its supervision (persons carrying out their activity as natural persons, members of the management body or key function holders at a financial sector operator), as well as about customers and beneficial owners. In particular, the processed data contains identification data (surname, first name, date of birth, nationality, Crossroads Bank for Enterprises number, country of residence), professional data, financial data and judicial data in relation to material weaknesses and AML/CFT measures. For more information on how the FSMA processes data in the exercise of its public-interest tasks, please consult the FSMA's Privacy Policy (including the sections “What are your rights and how can you exercise them?” and “How can you contact us?”).
What does the Joint Controllership Arrangement between AMLA and the FSMA stipulate?
The FSMA and AMLA have further formalized their respective obligations with regard to the use of the EuReCa central database during the transition period by entering into a Joint Controllership Arrangement (hereafter “JCA”) setting out their respective data protection responsibilities when transferring data between them, to or from the EuReCa database.
The main terms of that arrangement are the following:
- Mutual assistance. The FSMA and AMLA must provide each other with reasonable assistance in complying with their respective obligations pursuant to the applicable data protection legislation, notably with regard to requests from data subjects exercising their rights under the GDPR and to personal data breaches.
- Data subject requests. In particular, any data subject request relating to data contained in the EuReCa database and filed with the FSMA will be systematically forwarded by the FSMA to AMLA. In such a case, AMLA (or the EBA on behalf of AMLA) will (where necessary) process that request with the assistance of the FSMA (insofar as the FSMA has reported to AMLA the personal data to which the request refers) and with that of any other authority that has received some or all of that personal data from the EuReCa database. In any event, the party which initially received the data subject request is responsible for replying to the data subject (on the basis of the analysis and the information communicated by AMLA).
- Data quality. Furthermore, AMLA (or the EBA on behalf of AMLA) will ask all reporting authorities, among which the FSMA, to review on an annual basis all personal data they have registered in EuReCa, in order to ensure that these data remain relevant, accurate and up-to-date, and to consider whether they should be deleted.
- Data breaches. Finally, the FSMA and AMLA must also cooperate in the event of a data breach affecting the EuReCa database: the FSMA must notify AMLA and (where required) the relevant data protection authorities and data subjects of any personal data breach it has become aware of.
Finally, the EuReCa database is stored and managed by AMLA within the European Economic Area.
Questions?
For any questions regarding the JCA, please consult the AMLA website or send an email to the DPO of the FSMA via the DPO contact form.
This statement was last updated on 21 August 2026.