Commission Implementing Decision (EU) 2025/2281 of 13 November 2025 amending Implementing Decision (EU) 2022/2470 as regards technical specifications for the quality, resolution and processing of facial images, necessary for the technical development and implementation of the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN)

Official Journal EN of the European Union L series 2025/2281 14.11.2025 COMMISSION IMPLEMENTING DECISION(EU) 2025/2281 of 13 November 2025 amending Implementing Decision (EU) 2022/2470 as regards technical specifications for the quality, resolution and processing of facial images, necessary for the technical development and implementation of the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726(1), and in particular Article 10(1) thereof, Whereas: (1) Regulation (EU) 2019/816 established the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN). That system allows the central authority of a Member State or other competent authority to find out promptly and efficiently which Member States hold criminal records information on a third-country national. (2) Commission Implementing Decision (EU) 2022/2470(2) lays down measures necessary for the technical development and implementation of ECRIS-TCN, including the technical specifications concerning alphanumeric and fingerprint data. (3) The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council(3)is responsible for the development of ECRIS-TCN, including the development and implementation of the relevant technical specifications and testing, as well as for the operational management of the system. (4) In order to ensure the interoperability of public services at Union level, the ECRIS-TCN architecture should conform to the European interoperability framework set out in Regulations (EU) 2019/817(4) and (EU) 2019/818(5) of the European Parliament and of the Council. That framework includes a shared biometric matching service which, pursuant to Article 13(1), point (b), of Regulation (EU) 2019/818, stores facial images templates, including templates of facial images entered into ECRIS-TCN, which enables querying with biometric data across various Union information systems. (1) OJ L 135, 22.5.2019, p. 85, ELI: http://data.europa.eu/eli/reg/2019/816/oj. (2) Commission Implementing Decision (EU) 2022/2470 of 14 December 2022 laying down measures necessary for the technical development and implementation of the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) (OJ L 322, 16.12.2022, p. 107, ELI: http://data.europa.eu/eli/dec_impl/ 2022/2470/oj). (3) Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99, ELI: http://data.europa.eu/eli/reg/2018/1726/oj). (4) Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27, ELI: http://data.europa.eu/eli/reg/2019/ 817/oj). (5) Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85, ELI: http://data.europa.eu/eli/reg/ 2019/818/oj). ELI: http://data.europa.eu/eli/dec_impl/2025/2281/oj 1/6EN OJ L, 14.11.2025 (5) To enable central authorities to enter facial images into ECRIS-TCN, it is necessary to lay down technical specifications for the quality, resolution and processing of the facial images. (6) Until the entry into force of the delegated act provided for in Article 6(2) of Regulation (EU) 2019/816, facial images should not be used for the purpose of querying the system. Their use should be currently limited to confirming the identity of a third-country national who has been identified as a result of an alphanumeric search or a search using fingerprint data, in accordance with Article 6(1) of Regulation (EU) 2019/816, and to enabling detection of multiple identities across the interoperable IT systems in accordance with Article 13(1), point (b), and Article 27(2) of Regulation (EU) 2019/818. (7) Data quality is a key element to obtain accuracy, which is one of the basic data protection principles laid down in Article 5(1), point (d), of Regulation (EU) 2016/679 of the European Parliament and of the Council(6) and Article 4(1), point (d), of Regulation (EU) 2018/1725 of the European Parliament and of the Council(7). The quality of the facial images stored impacts on the proper functioning of any automated matching processes derived from them, as well as on the visual inspection in the process of confirming an identity, in accordance with Article 6(1) of Regulation (EU) 2019/816. Therefore, the quality of the facial images in ECRIS-TCN should satisfy the data quality requirements set for the shared biometric matching service and the other systems feeding it to guarantee a reliable match. (8) Facial images should be entered into ECRIS-TCN only where the national law of the convicting Member State allows the collection and storage of facial images of convicted persons pursuant to Article 5(3) of Regulation (EU) 2019/816. (9) As Implementing Decision (EU) 2022/2470 focuses on the technical specifications concerning alphanumeric and fingerprint data, this Decision introduces the relevant technical specifications regarding facial images. (10) The production of separate statistics on the number of records containing flags established in accordance with Article 5(1), point (c), of Regulation (EU) 2019/816, for the convictions of a terrorist offence and for any other criminal offence listed in the Annex to Regulation (EU) 2018/1240 of the European Parliament and of the Council(8)proved to be technically impossible. Therefore, it should not be necessary any longer to produce such separate statistics. (11) Implementing Decision (EU) 2022/2470 should therefore be amended accordingly. (12) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark did not take part in the adoption of Regulation (EU) 2019/816 and is not bound by it or subject to its application. Denmark is therefore not bound to implement this Decision. (13) In accordance with Article 1 and 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect to area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland did not take part in the adoption of Regulation (EU) 2019/816 and is not bound by it or subject to its application. Ireland is therefore not bound to implement this Decision. (6) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj). (7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data. europa.eu/eli/reg/2018/1725/oj). (8) Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1, ELI: http://data.europa.eu/eli/reg/2018/1240/oj). 2/6 ELI: http://data.europa.eu/eli/dec_impl/2025/2281/ojEN OJ L, 14.11.2025 (14) The European Data Protection Supervisor has been consulted pursuant to Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 5 June 2025. (15) This Decision introduces binding requirements for trans-European digital public services within the meaning of Regulation (EU) 2024/903 of the European Parliament and of the Council(9). Accordingly, an interoperability assessment has been carried out and the resulting report has been published on the Interoperable Europe Portal. (16) The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 38 of Regulation (EU) 2019/816, HAS ADOPTED THIS DECISION: Article 1 Amendments to Implementing Decision (EU) 2022/2470 Implementing Decision (EU) 2022/2470 is amended as follows: (1) Article 2 is amended as follows: (a) paragraph 1 is replaced by the following: ‘1. Where alphanumeric data together with either fingerprint data or the facial image of a person, or with both, are included in a data record created in ECRIS-TCN in accordance with Article 5 of Regulation (EU) 2019/816, the alphanumeric data shall be linked to their corresponding fingerprint data and facial image.’; (b) the following paragraph 4 is added: ‘4. The facial images compression algorithm used shall follow the recommendations of the National Institute of Standards and Technology (“NIST”). Facial images shall be compressed only once with the following compression conditions: (a) compressed with JPG (ISO/IEC 10918) or JPEG 2000 (ISO/IEC 15444) image compression standard and coding system; (b) a 20:1 maximum allowed image compression ratio.’; (2) the following Article 2a is inserted: ‘Article 2a Data quality verification mechanism 1. When entering or modifying alphanumeric data, fingerprint data or facial images in ECRIS-TCN the central authority of the convicting Member State shall use a data quality verification mechanism or its equivalent in their national ECRIS implementation software referred to in Article 4(4) to (7) of Regulation (EU) 2019/816. 2. The data quality verification mechanism referred to in paragraph 1 shall be integrated into the ECRIS reference implementation, developed as a software application and established in the ECRIS-TCN central system. 3. eu-LISA shall be responsible for the development, maintenance and updating of the data quality verification mechanism, pursuant to Article 11(2) of Regulation (EU) 2019/816. 4. Where Member States do not make use of the data quality verification mechanism referred to in paragraph 1 and use instead its equivalent in their national ECRIS implementation software, they shall ensure that it guarantees the same alphanumeric data, fingerprints data and facial images quality verification as that data quality verification mechanism.’; (9) Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/ reg/2024/903/oj). ELI: http://data.europa.eu/eli/dec_impl/2025/2281/oj 3/6EN OJ L, 14.11.2025 (3) in Article 3, paragraphs 1 and 2 are deleted; (4) Article 4 is amended as follows: (a) paragraphs 1, 2 and 3 are deleted; (b) paragraph 4 is amended as follows: ‘4. For the purpose of the data quality verification process, Member States shall use at least version 2.0 of the Fingerprint Image Quality (NFIQ) metric, defined by NIST.’; (5) the following Article 4a is inserted: ‘Article 4a Facial images quality 1. The data quality verification process shall apply to all facial images entered into or modified in ECRIS-TCN, and shall ensure that at least the following conditions are met: (a) only one facial image is provided in the NIST file and is submitted in accordance with the ANSI/NIST-ITL 1-2011 Update 2015 standard, or any newer version available; (b) the facial images are either grayscale, colour or near infrared; (c) the quality of the facial images is based on the image requirements of ISO/IEC 19794-5:2011 Frontal image type, or any newer version available; (d) the NIST file allows the inclusion of complementary information, including the date when the image was taken; (e) the facial images, in portrait mode, are at a minimum resolution of 600 pixels by 800 pixels and a maximum resolution of 1 200 pixels by 1 600 pixels; (f) the face occupies a space within the image which ensures a minimum of 120 pixels between the centre of each eye. 2. Facial images, entered into or modified in ECRIS-TCN, which do not comply with the conditions set out in paragraph 1, shall be rejected by ECRIS-TCN and shall neither be stored nor processed.’; (6) in Article 7(2), point (b), is amended as follows: (a) point (iii) is replaced by the following: ‘(iii) number of records containing flags established in accordance with Article 5(1), point (c), of Regulation (EU) 2019/816 for the convictions of a terrorist offence or of any other criminal offence listed in the Annex to Regulation (EU) 2018/1240’; (b) the following points are added: ‘(viii) number of records containing facial image; (ix) number of records containing facial image not accepted for inclusion pursuant to Article 4a(2) of this Decision;’; 4/6 ELI: http://data.europa.eu/eli/dec_impl/2025/2281/ojEN OJ L, 14.11.2025 (7) the Annex is amended in accordance with the Annex to this Decision. Article 2 Entry into force This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. Done at Brussels, 13 November 2025. For the Commission The President Ursula VON DER LEYEN ELI: http://data.europa.eu/eli/dec_impl/2025/2281/oj 5/6EN OJ L, 14.11.2025 ANNEX The Annex to Implementing Decision (EU) 2022/2470 is amended as follows: (1) in the table of Section I, the following lines are added: ‘Facial image (the NIST file) Optional No Reference number of facial image Mandatory if the facial image is provided No’ (2) in the table of Section III, the following line is added: ‘Create/Modify TCN data record (with facial Acknowledgement: 30 sec Acknowledgement: 60 sec image) Completion: 5 min Completion: 10 min’ 6/6 ELI: http://data.europa.eu/eli/dec_impl/2025/2281/oj