Preliminary assessment of the second payment request of Romania

ania, Special Telecommunication Services and Romanian Intelligence Service. This demonstrates that the institutions responsible for the implementation of the investment are the STS and ADR, as required by the CID. The implementation of the Government Cloud shall involve at least the following stages: - construction of Tier IV by design data centres for the two main centres and Tier III by design for the secondary ones; Point 1.3 of the feasibility study prepared by the Authority for the Digitalisation of Romania, the Special Telecommunications Service and Romanian Intelligence Service at the request of the Ministry of Research, Innovation and Digitisation for government cloud infrastructure deployment submitted on 10 December 2022 states that four data centres will be set up, which implies its design and construction: two primary data centres in Bucharest and Timisoara (Tier IV) and two secondary data centres in Brasov and Sibiu (Tier III). The implementation of the two secondary data centres, interoperable with the two primary data centres, is necessary to ensure the technical and legal requirements for business continuity / disaster recovery. - providing specific communications infrastructure and information technology (optic fibre cables and high-capacity communications equipment); Chapter 3.1.5 of the technical project on communication resources, prepared by the Authority for the Digitalisation of Romania, the Special Telecommunications Service (STS), and Romanian Intelligence Service at the request of the Ministry of Research, Innovation and Digitisation for government cloud infrastructure deployment dated 17 October 2022 specifies the communication infrastructure and information technology to be provided, including optic fibre cables and high- capacity communications equipment. - development / expansion of the electricity supply network for each data centre in order to ensure redundancy and electricity demand; Chapter 3.1.1. of the technical project stipulates that energy-efficient systems based on electricity produced by photovoltaic panels will be used to secure part of the power supply of data centres. To ensure redundancy and sufficient electricity demand, each data centre will have dedicated spaces for the power supply infrastructure and will be partitioned to form two completely separate power 26 supply branches. - achieving a scalable and redundant air conditioning infrastructure, energy efficient for each data centre; Chapter 3.1.1 of the technical project specifies that for each data centre, the air-conditioning system consists of high-precision indoor air-conditioning units using a water-glycol mixture as cooling agent, supplied by chiller-type air-conditioning equipment, with the number of units and location configured for independent operation, ensuring redundancy. These conditions ensure energy efficient conditions for each data centre. - installation of the inert gas fire detection and extinguishing system to ensure the protection for the entire infrastructure of each data centre; Chapter 3.1.1 of the technical project specifies that each of the four data centres will be equipped with inert gas fire detection and extinguishing systems. This ensures the protection of the entire infrastructure of each data centre since it will allow for an early detection of gas and in the event of fire, an extinguishing system will ensure the protection of the entire infrastructure of each data centre. - implementation of the physical security system (access control, video monitoring, antiburglary) for the developed infrastructure; Chapter 3.1.1 of the technical project specifies how the physical security system will be implemented, including elements of access control, video monitoring and antitheft systems. This element proves the implementation the physical security system with standard high level security level and security perimeters as detailed in the chapter 3.1.1. of the technical project. - implementation of the infrastructure monitoring and management network within the realized facility; Chapter 1.11.2 of the technical project establishes that a monitoring system will be implemented to monitor all hardware and software resources related to the core ICT infrastructure. In addition, Chapter 3.1.1 of the technical project establishes that all precision air conditioning equipment will be equipped with a microprocessor controller that will be capable of interfacing with a monitoring system using a remote monitoring interface. Both elements prove the implementation of a management network within the realized facility. - realization of scalable and high availability IT&C infrastructure (processing equipment, storage, communications, virtualization software) within each data centre; Chapter 1.2 of the technical project states that “the implementation of the governmental cloud will involve "achieving scalable and high-availability ICT (that is, IT&C) infrastructure (processing, storage, communications, virtualization software) within each data centre.” Thus, the recipients, the partnership between the Authority for the Digitization of Romania, Special Telecommunication Services and Romanian Intelligence Service have committed through the financing contract to comply with this criterion in the implementation of the cloud infrastructure. The implementation of this commitment is reflected in the technical project. - acquisition of the necessary licenses and specialized equipment for the perimeter cyber security. Chapter 3.1.2 of the technical project establishes that licences of the necessary hardware and software components will be unlimited, both in terms of time and number. Chapter 3.1.1 of the technical project establishes that volumetric motion detectors with dual 27 detection technology and antimasking function will be installed for detection of intrusion into the inner perimeter. Chapter 3.1.6 of the technical project moreover establishes that a specific security hardware solution shall be configured. The acquisition of the necessary licenses and specialized equipment for the perimeter cyber security by the recipients of the contract is established in the above-mentioned chapters. - Security shall be provided by the government cloud infrastructure administrator. Chapter 1.7 of the technical project establishes that the Special Telecommunications Service, as cloud infrastructure administrator, ensures cybersecurity of the government cloud infrastructures and services used by public authorities and institutions. Chapter 3.1.1.1, 3.1.1.2. and 3.1.1.3 (Bucharest and Timisoara Data Centers (Tier IV); Brasov Data Centre TIER III; Sibiu Tier III Data Centre, respectively) will require that the aforementioned data centres are provided with infrastructure security (such as integrated security system with a software platform; video surveillance system; controlled access system and burglar detection system)., as required by the CID. Commission Preliminary Assessment: Satisfactorily fulfilled Related Measure: Reform of the National Agency for Fiscal Administration (ANAF) Number: 191 through digitalisation Name of the Milestone: Entry into force of the legal framework for the compulsory enrolment of legal person taxpayers in SPV (Virtual Private Space) Qualitative Indicator: Provision in the law indicating the entry into force of Time: Q1 2022 the compulsory enrolment of legal person taxpayers in SPV Context: Milestone #191 is part of Reform C8.R1, which aims at modernising and digitalising the National Agency for Fiscal Administration (ANAF) to make tax collection more efficient, increasing the revenue-to-GDP ratio, reducing the VAT gap and allowing the tax administration to use an integrated risk management system. Milestone #191 requires the entry into force of the legal framework for the compulsory enrolment of legal person taxpayers in SPV (Virtual Private Space). Milestone #191 is the first step in the implementation of the reform, together with milestone #195, related to the operationalisation of the Joint Action Plan between ANAF and the Labour Inspection. Milestone #191 will be followed by milestones #193 and #194, related to the entry into force of the legal framework defining the risk criteria for the classification of taxpayers and the amended legal framework in the field of activity of tax inspections bodies respectively. Milestone #191 will also be followed by targets #192, #196 and #197, related to additional legal person taxpayers enrolled in SPV, the increase in the share of revenues collected by the tax administration by at least 2,5 percentage points of GDP, and the reduction of the VAT gap by 5 percentage points respectively. The reform has a final expected date for implementation on 30 June 2026. Evidence provided: 28 In line with the verification mechanism set out in the Operational Arrangements, the following evidence was provided: i) Cover note justifying how the milestone (including all the constitutive elements) was satisfactorily fulfilled; ii) Copy of the Government Ordinance No. 11/2021 of 30 August 2021, amending Law No. 207/2015 on the Code of Fiscal Procedure and regulating tax measures published in the Official Journal No. 832 on 31 August 2021. The authorities also provided: iii) Copy of Ministerial Order No. 660/2017 published in the Official Journal No. 368 on 17 May 2017; iv) Copy of National Agency for Fiscal Administration (ANAF) Order No. 1090/2022 published in the Official Journal No. 585 on 16 June 2022; v) Background Note to Government Emergency Ordinance No. 188/2022. Analysis: The justification and substantiating evidence provided by the Romanian authorities covers all constitutive elements of the milestone. Specifically: Entry into force of the legal framework for making registration in the Virtual Private Space (SPV) compulsory for all legal persons taxpayers. This act shall amend the Fiscal Procedure Code and shall introduce the obligation for legal person to enrol in the SPV. Art. I(10) of Government Ordinance No. 11/2021 of 30 August 2021, amending Law No. 207/2015 on the Code of Fiscal Procedure and regulating tax measures (hereinafter referred to as “the Government Ordinance”), published in the Official Journal No. 832 on 31 August 2021, makes registration in the electronic system developed by ANAF and the Ministry of Finance (that is, the Virtual Private Space (SPV), as defined in the cover note) compulsory for all legal persons taxpayers. It specifies that taxpayers, payers that are legal persons, associations and other entities without legal personality, as well as natural persons pursuing a liberal profession or carrying out an economic activity independently are required to transmit to the central tax body documents by electronic means of remote transmission, by enrolling in the electronic communication system developed by the Ministry of Finance/ANAF. Ministerial Order No. 660/2017 published in the Official Journal No. 368 on 17 May 2017, National Agency for Fiscal Administration (ANAF) Order No. 1090/2022 published in the Official Journal No. 585 on 16 June 2022, and the Background Note to Government Emergency Ordinance No. 188/2022 specify that “communication by electronic means of remote transmission” is carried out via the Virtual Private Space (SPV). Art. VI of the Government Ordinance states that “(1) the provisions of Article I (1), (4), (5) to (7), (14) and (29) shall apply from 1 January 2022. (2) The provisions of Article I (8) and (10) shall apply from 1 March 2022. (3) The provisions of Article I (16) and (24) shall apply from 1 October 2021. (4) The provisions of point 19 of Article I shall apply from 1 February 2022”, therefore certifying the entry into force of the provisions of Art. I (10), which fulfil the requirement of the milestone, on 1 March 2022. Commission Preliminary Assessment: Satisfactorily fulfilled 29  Related Measure: Reform of the National Agency for Fiscal Administration (ANAF) Number: 195 through digitalisation Name of the Milestone: Operationalization/approval of the Joint Action Plan between the National Agency for Fiscal Administration and Labour Inspection to prevent and limit the phenomenon of grey/black work evasion Qualitative Indicator: Adoption of the Joint Action Plan between the National Agency for Fiscal Administration and Labour Inspection of actions to be taken Time: Q1 2022 to prevent and limit the phenomenon of grey/black work evasion Context: Milestone #195 is part of reform C8.R1, which aims at modernising and digitalising the National Agency for Fiscal Administration (ANAF) to make tax collection more efficient, increasing the revenue-to-GDP ratio, reducing the VAT gap and allowing the tax administration to use an integrated risk management system. Milestone #195 requires the National Agency for Fiscal Administration (ANAF) and Labour Inspection to agree and implement a Joint Action Plan to fight the black/grey work evasion. Milestone #195 is the first step in the implementation of the reform, together with milestone #191, related to the entry into force of the legal framework for the compulsory enrolment of legal person taxpayers in the SPV (Virtual Private Space). Milestone #195 will be followed by milestones #193 and #194, related to the entry into force of the legal framework defining the risk criteria for the classification of taxpayers and the amended legal framework in the field of activity of tax inspections bodies respectively. Milestone #195 will also be followed by targets #192, #196 and #197, requiring additional legal person taxpayers enrolled in SPV, the increase in the share of revenues collected by the tax administration by at least 2,5 percentage points of GDP, and the reduction of the VAT gap by 5 percentage points respectively. The reform has a final expected date for implementation on 30 June 2026. Evidence provided: In line with the verification mechanism set out in the Operational Arrangements, the following evidence was provided: i) Cover note justifying how the milestone (including all the constitutive elements) was satisfactorily fulfilled; ii) Copy of the adopted Joint Action Plan on the organisation of fiscal supervision in cooperation with the Labour Inspection, registered under No. 891/17.02.2022 with ANAF and under No. 46/17.02.2022 with the Labour Inspection; iii) Copy of the collaboration protocol between ANAF and the Labour Inspection, registered with ANAF under No. A_PRS 5022/02.11.2021 and the Labour Inspection under No. 445/03.11.2021. Analysis: The justification and substantiating evidence provided by Romanian authorities covers all constitutive elements of the milestone. Operationalization/approval of the Joint Action Plan between the National Agency for Fiscal Administration and Labour Inspection to prevent and limit the phenomenon of grey/black work 30 evasion The Joint Action Plan between the National Agency for Fiscal Administration (ANAF) and the Labour Inspection, titled “Joint Action Plan on the organisation of fiscal supervision in cooperation with the Labour Inspectorate” (hereinafter referred to as “the Joint Action Plan”) was signed on 17 February 2022. The signature of the Joint Action Plan certifies its adoption. As stated on page 3 of the Joint Action Plan, it aims to prevent and limit undeclared and under-declared work (that is, it addresses grey/black work evasion) and set up appropriate organisational arrangements through joint control actions and operational exchanges of information and findings. Subsequent to the cooperation protocol with the Labour Inspection, a joint action plan shall be drawn up to include economic operators with high fiscal risk and also risk from the perspective of using under declared / unreported work The Joint Action Plan was signed on 17 February 2022, thus subsequent to the cooperation protocol with the Labour Inspection (hereinafter referred to as “the cooperation protocol”), which was signed in November 2021. As explained above, the signature of the Joint Action Plan certifies its adoption. Section 3.1 of the Joint Action Plan includes economic operators with high fiscal risk and also risk from the perspective of using under declared / unreported work. It requires the establishment of a representative sample of taxpayers from a compliance risk perspective, based on risk analyses carried out on available information and data. It also lists criteria for the selection of taxpayers into account. These include, among others, the average number of employees, the number of part-time employees, and the number of employees with minimum wage, which are suitable indicators for under declared/unreported work (that is, a low average number of employees can signal unreported work, while a high number of part-time or minimum wage employees can signal under declared work). Selection criteria also include relevant non-compliance found during previous checks, which can point to a high fiscal risk. Therefore, these criteria constitute indicators for identifying under declared/unreported work. It shall be broken down by types of seasonal activities, where the incidence of the mentioned risks is known to be high Section 3.1 of the Joint Action Plan lists seasonal activities, where the incidence of the mentioned ri