COMMISSION IMPLEMENTING DECISION (EU) 2025/1992

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2025/1992 | 6.10.2025 ---|---|--- COMMISSION IMPLEMENTING DECISION (EU) 2025/1992 of 2 October 2025 on the adequacy of the competent authority of the United Kingdom pursuant to Directive 2006/43/EC of the European Parliament and of the Council (notified under document C(2025) 6589) (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (1), and in particular Article 47(3), first subparagraph, thereof, Whereas: (1) | Under Article 47(1) of Directive 2006/43/EC, Member States may allow the transfer of audit working papers or other documents held by statutory auditors or audit firms approved by them, and of inspection or investigation reports relating to the audits in question, to the competent authorities of a third country only if the conditions set out therein are fulfilled. Among those conditions, Article 47(1), points (c) and (d) of that Directive require that those authorities meet requirements that have been declared adequate by the Commission and that there are working arrangements on the basis of reciprocity between those third country competent authorities and the competent authorities of the Member States concerned. The same requirement exists in the United Kingdom of Great Britain and Northern Ireland (‘United Kingdom’). It follows that the transfer of such audit working papers or other documents requires the adoption of adequacy decisions and of working arrangements on both sides. The United Kingdom has already granted adequacy decisions to each of the Member States. In that context, it should be determined whether the competent authority of the United Kingdom meets the requirements that are adequate for those purposes. ---|--- (2) | A decision on adequacy under Article 47(3) of Directive 2006/43/EC does not address other specific requirements for the transfer of audit working papers and other documents held by statutory auditors or audit firms and of inspection or investigation reports, such as the agreement on working arrangements on the basis of reciprocity between the competent authorities set out in Article 47(1), point (d) of Directive 2006/43/EC, or the requirements for the transfer of personal data set out in Article 47(1), point (e) of that Directive. ---|--- (3) | Cooperation on the transfer of audit working papers or other documents held by statutory auditors or audit firms and of inspection or investigation reports to the competent authority of a third country reflects the substantial public interest in carrying out independent public oversight. Accordingly, the competent authorities of Member States should, in the framework of the working arrangements referred to in Article 47(2) of Directive 2006/43/EC, ensure that the competent authority of the United Kingdom use any documents transferred to them in accordance with Article 47(1) of that Directive only to exercise their functions of public oversight, external quality assurance and investigations of auditors and audit firms. ---|--- (4) | When inspections or investigations are carried out, statutory auditors and audit firms should not be allowed to grant access to or to transmit their audit working papers or other documents to the competent authority of the United Kingdom under any other conditions than those set out in Article 47 of Directive 2006/43/EC. ---|--- (5) | Member States are to ensure that the working arrangements required by Article 47(1), point (d), of Directive 2006/43/EC to transfer audit working papers or other documents held by statutory auditors or audit firms and of inspection or investigation reports between their competent authorities and the competent authority of the United Kingdom are agreed on the basis of reciprocity and include protection of any professional secrets and sensitive commercial information contained in such papers relating to the entities audited, including their industrial and intellectual property, or to the statutory auditors and audit firms that audited those entities. ---|--- (6) | Where a transfer of audit working papers or other documents held by statutory auditors or audit firms and of inspection or investigation reports to the competent authority of the United Kingdom involves the transfer of personal data, such a transfer is lawful only if it also complies with the requirements for international data transfers laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council (2). Article 47(1), point (e), of Directive 2006/43/EC therefore requires Member States to ensure that the transfer of personal data between their competent authorities and the competent authority of the United Kingdom complies with any applicable data protection principles and rules and, in particular, with the provisions of Chapter V of Regulation (EU) 2016/679. Member States should ensure that appropriate safeguards for the transfer of personal data are provided for, in accordance with Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 (‘United Kingdom data protection adequacy decision’) (3). In addition, Member States should ensure that the competent authority of United Kingdom will not further disclose personal data contained in the documents transferred without the prior agreement of the competent authorities of the Member States concerned. ---|--- (7) | The Financial Reporting Council is the competent authority for audit oversight in the United Kingdom. It is an independent regulator that oversees auditors, accountants, and actuaries. ---|--- (8) | The Committee of European Auditing Oversight Bodies has reassessed the legal framework of the United Kingdom. Taking into account the technical assessment, referred to in Article 30(7), point (c), of Regulation (EU) No 537/2014 of the European Parliament and of the Council (4), of the Committee of European Audit Oversight Bodies, the Financial Reporting Council meets requirements that should be declared adequate for the purposes of Article 47 of Directive 2006/43/EC. ---|--- (9) | This Decision should not affect the cooperation arrangements referred to in Article 25(4) of Directive 2004/109/EC of the European Parliament and of the Council (5). ---|--- (10) | Any conclusion on the adequacy of the requirements met by the competent authorities of a third country pursuant to Article 47(3), first subparagraph of Directive 2006/43/EC does not pre-empt any decision that the Commission may adopt on the equivalence of the public oversight, quality assurance, investigation and penalty systems for auditors and audit entities of that third country pursuant to Article 46(2) of that Directive. ---|--- (11) | This Decision aims to facilitate effective cooperation between the competent authorities of the Member States and that of the United Kingdom. Its purpose is to enable those authorities to exercise their functions of public oversight, external quality assurance and investigations and, at the same time, to protect the rights of the parties concerned. Where a competent authority of a Member State decides to enter into working arrangements on the basis of reciprocity with the competent authority of the United Kingdom to enable the transfer of audit working papers and other documents held by statutory auditors or audit firms and of inspection or investigation reports, the Member State concerned is obliged to communicate to the Commission the reciprocal working arrangements concluded between those authorities to enable the Commission to assess whether such cooperation complies with Article 47 of Directive 2006/43/EC. ---|--- (12) | The Commission, assisted by the Committee of European Audit Oversight Bodies, will monitor on a regular basis the market developments, evolution of the supervisory and regulatory frameworks and the effectiveness and experience of supervisory cooperation. In particular, the Commission may undertake a specific review of this Decision at any time before the end of its period of application where relevant developments make it necessary to re-assess the declaration of adequacy granted by this Decision. Such re-assessment may lead to the repeal of this Decision. ---|--- (13) | The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (6) and delivered an opinion on 28 April 2025. ---|--- (14) | The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 48(1) of Directive 2006/43/EC, ---|--- HAS ADOPTED THIS DECISION: Article 1 The Financial Reporting Council of the United Kingdom of Great Britain and Northern Ireland meets requirements which shall be considered adequate within the meaning of Article 47(1), point (c), of Directive 2006/43/EC for the purpose of transfers of audit working papers or other documents held by statutory auditors or audit firms and of inspection and investigation reports under Article 47(1) of that Directive. Article 2 1\. Where audit working papers or other documents held by statutory auditors or audit firms are exclusively held by a statutory auditor or audit firm registered in a Member State other than the Member State where the group auditor is registered and whose competent authority has received a request from the authority referred to in Article 1, such papers or documents shall be transferred to the requesting competent authority only where the competent authority of the first Member State has given its express agreement to the transfer. 2\. Any bilateral working arrangements between the competent authorities of the Member States and the competent authority of the United Kingdom of Great Britain and Northern Ireland shall comply with the conditions laid down in Article 47 of Directive 2006/43/EC. Article 3 This Decision is addressed to the Member States. Done at Brussels, 2 October 2025. For the Commission Maria Luís ALBUQUERQUE Member of the Commission * * * (1) OJ L 157, 9.6.2006, p. 87. (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ L 119, 4.5.2016, p. 1). (3) Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (OJ L 360, 11.10.2021, p. 1). (4) Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public- interest entities and repealing Commission Decision 2005/909/EC ( OJ L 158, 27.5.2014, p. 77). (5) Directive 2004/109/EC of the European Parliament and of the Council of 15 December 2004 on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC ( OJ L 390, 31.12.2004, p. 38). (6) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). * * * ELI: http://data.europa.eu/eli/dec_impl/2025/1992/oj ISSN 1977-0677 (electronic edition) * * *