Statutes of Database of Financial Intelligence Unit

This Regulation establishes the statutes of the database of the Financial Intelligence Unit (hereinafter database). The official abbreviation of the database is RABIS.

(1) The data related to the operations and proceedings deriving from the duties of the Financial Intelligence Unit are processed in the database.

(2) The data of the database are used for performance of the duties of the Financial Intelligence Unit provided in § 54 of the Money Laundering and Terrorist Financing Prevention Act.

The database is maintained as an information technology database and as files on paper (hereinafter file).

A file consists of the documents specified in § 20 of this Regulation and of other documents and evidence collected in the course of proceedings and serving as grounds for operations.

(1) Relevant organisational, physical and information technology security measures are applied in order to ensure the availability, integrity and confidentiality of the data processed in the database.

(2) The security class of the data processed in the database is K2T2S3. The security level of the data processed in the database is high (H).

(1) The Financial Intelligence Unit is the controller of the database (hereinafter controller).

(2) The IT and Development Centre of the Ministry of the Interior is the processor of the database (hereinafter processor).

(1) The controller

1) is responsible for the lawfulness of the operations of the database;

2) ensures that the database is maintained in compliance with the requirements provided by legislation;

3) ensures access of entitled persons to the database;

4) ensures the integrity of the data, and protection and preservation of the data in the database together with the processor by means of organisational and technical measures;

5) is responsible for compliance with the requirements for processing of personal data;

6) is responsible for issue of data from the database in compliance with the requirements;

7) organises the development of the database together with the processor.

(2) The processor

1) develops the database in accordance with the proposals received from the controller;

2) ensures the informational technology environment necessary for hosting the database and its technical readiness in the extent and in accordance with the procedures agreed upon in a service agreement.

The following data are entered in the database

1) data on the person preparing the report;

2) data on the reporter;

3) data on the report;

4) data on the parties to the transaction;

5) data on the transaction;

6) data on the person with regard to whom the report has been submitted;

7) data on authorisation;

8) documents.

The following data on the person preparing a report are entered in the database

1) given name and surname;

2) personal identification code;

3) details of telecommunications (type of telecommunications, data of the website, telephone number, e-mail address).

The following data on the reporter are entered in the database

1) type of the entity of the reporter;

2) name;

3) registry code;

4) type of the obliged entity;

5) principal activity;

6) activity related to the report;

7) contact details, including the contact address in Estonia; in case of a non-resident, their place of business, country of origin, tax residency (country), or in case of a resident with a non-resident shareholder, the data on the owner company;

8) information on whether the person submitting the report is a party to the transaction.

The following data on the report are entered in the database

1) type of the report;

2) number of the report if any;

3) main indication;

4) additional indications;

5) notation “Kiire” [“Urgent”] if it is added to the report and reasons therefor;

6) number of the latest report sent by the reporter, including the date;

The following data on the parties to the transaction are entered in the database

1) type of the person;

2) name or given name and surname of the person;

3) registry code or personal identification code of the person;

4) data on the identification document (number, type, date of issue of the document, name of the country and authority which has issued the document);

5) role of the person;

6) date of foundation;

7) date of dissolution;

8) contact details, including the contact address in Estonia; in case of a non-resident, their place of business, country of origin, tax residency (country), or in case of a resident with a non-resident shareholder, the data on the owner company;

9) details of telecommunications (type of telecommunications, data of the website, telephone number, e-mail address);

10) bank account details (account number, bank, registered office of the bank).

The following data on the transaction are entered in the database

1) type of the transaction;

2) object of the transaction;

3) subtype of the transaction;

4) description of the transaction;

5) amount and currency of the transaction;

6) manner of payment for the transaction;

7) data on the persons making the transaction (data on the payer and beneficiary);

8) details of the bank account of the payer and beneficiary (account number, bank, registered office of the bank);

9) information on whether information on the origin of the assets was requested;

10) information on the assets (description, value, date of assessment of the value, country of location);

11) information on the origin of the assets;

12) information on whether a claim for refund was received;

13) information on the claim for refund (date, number, contents, copy of the SWIFT-item of the claim for refund, account owner, account number).

(1) The following data on a natural person with regard to whom the report has been submitted are entered in the database

1) given name and surname;

2) personal identification code and date of birth;

3) place of birth, specifying the country;

4) citizenship;

5) country of residence;

6) data of the identification document (number, type, date of issue of the document, name of the country and authority which has issued the document);

7) data on the sanctions imposed on the person (type and duration of the sanction, date of imposing the sanction, date of authorising the enforcement of the sanction and end date of enforcement, person who made the decision, criminal case number, court case number);

8) contact details, including contact address, e-mail address and telephone number.

(2) The following data on a legal person with regard to whom the report has been submitted are entered in the database

1) name;

2) registry code;

3) data on registration;

4) principal activity;

5) contact details, including contact address, e-mail address, telephone number, website address;

6) data on the place of business, including address;

7) location of the bank account and name of the bank;

8) personal data of the executive officer (for example, manager, director) (given name and surname, personal identification code, date of birth);

9) data on the sanctions imposed on the person (type and duration of the sanction, date of imposing the sanction, date of authorising the enforcement of the sanction and end date of enforcement, person who made the decision, criminal case number, court case number).

The following data on the principal and authorisation are entered in the database

1) type of the authorised person;

2) type of the principal;

3) given name and surname of the principal;

4) personal identification code and date of birth of the principal;

5) place of birth of the principal, specifying the country;

6) nationality of the principal;

7) country of residence of the principal;

8) contact details of the principal, including the contact address, e-mail address and telephone number;

9) form of authorisation;

10) date of issue of the authorisation;

11) date of expiry of the authorisation;

12) country of issue of the authorisation;

13) contents of the authorisation.

(1) The documents accompanying the report are entered in the database, including

1) documents on opening of accounts and account extracts regarding the period during which suspicious transactions were made, or during which the subject of international sanctions was a client of the credit institution;

2) copy of the page with the personal data and photo of the identification document of the identified non-resident natural person;

3) copy of the registration certificate or equivalent document of the identified non-resident legal person;

4) copy of the document certifying the right of representation of the authorised person participating in the transaction;

5) copy of the written agreement or order constituting the grounds for the transaction, and of any annexes thereto;

6) other documents characterising the transaction.

(2) Other documents collected or prepared in the course of countering, identifying or pre-trial investigation of money laundering, related criminal offences and terrorist financing are entered in the database.

(3) Information on the type and date of the documents, and where necessary, also a description of the contents of the documents are entered in the database.

In addition to the data specified in §§ 8–16, the following data are entered in the database

1) information on the transactions, parties thereto and other circumstances related to transactions obtained as a result of the analysis of the controller of the database;

2) information on suspicious and unusual transactions and operations which has become known in any other manner;

3) data collected in the course of the supervision provided in Chapters 7 and 8 of the Money Laundering and Terrorist Financing Prevention Act;

4) data on the notices of implementation of financial sanctions.

Data are submitted to the database by the persons provided in § 2 of the Money Laundering and Terrorist Financing Prevention Act (hereinafter obliged entities), the persons obliged to implement a sanction as provided in the International Sanctions Act, persons submitting information on suspicious and unusual transactions or operations, and the controller of the database.

(1) The controller of the database has the right, in order to perform the duties assigned to it by law or by legislation established pursuant to law, to submit queries to other databases of the state or local governments and obtain data therefrom. The data exchange with databases takes place via the data exchange layer of information systems.

(2) The controller of the database submits queries, including automatically, and obtains data from the following databases or information channels

1) commercial register;

2) population register;

3) criminal records database;

4) register of taxable persons;

5) e-file system;

6) electronic system of information inquiries and arrest mediation.

(3) The controller of the database submits queries, including automatically, and obtains data from the information systems of the European Union and international information systems in compliance with the provisions of the EU and international legislation.

The source documents for entry of data in the database are the documents submitted, prepared and collected in the course of the operations and proceedings deriving from the duties of the Financial Intelligence Unit on the basis of the Money Laundering and Terrorist Financing Prevention Act.

(1) The competence to enter data in the database lies with the official or employee designated by the controller, in the extent assigned to them for the performance of their service duties.

(2) The obliged entity forwards the data via a secure electronic channel created for this purpose.

(3) The following data are retained regarding an entry

1) given name(s) and surname(s) of the person making the entry;

2) date and time of making the entry.

(1) The person submitting data is responsible for the correctness of the data submitted by them and the data in the source documents at the time of submission of the source document.

(2) The controller of the database is responsible for the conformity of the data entered in the database with the data submitted by the person submitting the data.

If the controller detects incorrect data in the database or is informed about incorrect data, the controller organises the rectification of the data immediately after having become aware of the incorrect data, and adds the document evidencing the correct data or a copy thereof to the database, and enters the document constituting the grounds for rectification, the time of rectification and the given name and surname of the official making the rectification in the database.

(1) The access to the data entered in the database is granted to the officials or employees designated by the controller, in the extent and in the manner assigned to them for the performance of their service and employment duties.

(2) The access to the database is granted to the employees designated by the processor, in the extent assigned to them for the performance of their service duties.

(3) The access to the database is granted with the permission of the head of the Financial Intelligence Unit to persons who perform information technology development and maintenance work, on the terms, in the extent and in accordance with the procedure agreed upon with the controller.

(1) The controller of the database issues data entered in the database to third persons if there are grounds for the issue of data provided by law.

(2) The controller of the database keeps record of the persons to whom, for which purpose, when, how and which data are issued.

(3) At least the following data are retained for every query or entry made in the database

1) given name and surname of the person making the query or entry;

2) date and time of making the query or entry.

(4) The data specified in subsection 3 are retained for ten years after a query or entry is made, and thereafter the data are deleted.

(1) The data of the database and documents entered in the database concerning a person are retained in the database for 15 years after the closure of the respective report or file. The data on a person, the links of the person with other data and the documents related to the person are deleted from the database in such manner as to ensure the integrity of the data on persons, reports and files.

(2) As an exception to subsection 1, the documents and archival records to be transferred to the National Archives pursuant to subsection 9 of § 60 of the Money Laundering and Terrorist Financing Prevention Act are retained in the Financial Intelligence Unit for 30 years. The respective documents are deleted after the transfer.

Supervision over the maintenance of the database is exercised by the Information System Authority and Data Protection Inspectorate in accordance with the competence provided by legislation.

The maintenance and development work and the maintenance of the database are financed from the state budget from the funds allocated for this purpose to the controller and processor.

(1) The liquidation of the database is decided by the minister in charge of the policy sector.

(2) The database is liquidated in compliance with the requirements provided in the Archives Act and Public Information Act.

(1) This Regulation enters into force on 1 January 2021.

(2) Subsection 1 of § 26 enters into force on 1 January 2024.