PCC / CAP — Belgium’s central register of accounts

Belgium’s account register does not ask whether you are a bank. The Point de contact central des comptes et contrats financiers — PCC in French, CAP in Dutch — is held by the National Bank of Belgium and names payment institutions and electronic money institutions as reporting entities in the same breath as credit institutions. Openings and closings run on a five-working-day clock, balances are struck twice a year, and from 1 December 2026 the register extends to securities and crypto-asset accounts and to CASPs. Here is who reports, what, when, and the two definitional traps that decide whether a passporting firm is in scope at all.

1. What the PCC/CAP is

The register is organised by the Law of 8 July 2018 establishing a central point of contact for accounts and financial contracts (Moniteur belge, 16 July 2018), with the detail in the Royal Decree of 7 April 2019 on its functioning. It is held by the National Bank of Belgium — the technical operator, not the supervisor of the obligation, which is policed by the Administration générale de la Trésorerie of the Federal Public Service Finance.

It is not an AML database and not a tax file, but it feeds both. Access goes only to persons “explicitly empowered by the legislator” to request the information for public-interest tasks, after an opinion of the Data Protection Authority, and requests reach the Bank through a centralising organisation. The purposes the law names include tax investigation, detection of criminal offences and AML/CFT. Data are kept ten years, communication can only be electronic, and since 30 June 2020 the platform is what the Decree calls PCC2.

2. Who is a reporting entity

Article 3 of the Law lists the redevables d’information, and the list is broader than a payments team usually expects:

• credit institutions under the Law of 25 April 2014, and investment firms (sociétés de bourse) under the Law of 20 July 2022;
• payment institutions under Book II, Titles II and III of the Law of 11 March 2018, and electronic money institutions under Book IV, Titles II and III of the same Law;
• bureaux de change established in Belgium; insurance undertakings, including foreign insurers operating through a branch or without establishment; finance-leasing undertakings under Royal Decree No. 55 of 10 November 1967; lenders within Article I/9, 34° of the Code of Economic Law; and bpost, for postal financial services and e-money issuance.

Those Titles matter because they cover both Belgian-law institutions and the Belgian activity of foreign ones. The Crown may extend the list by decree, after opinions from the FIU, the Data Protection Authority and the Bank.

3. The two definitional traps for a passporting firm

Whether a cross-border firm reports turns on two definitions in Article 2, and they point in opposite directions.

Payment accounts are territorial. A reportable “bank or payment account” includes a payment account including an electronic money account as defined in Article 2, 18° of the Law of 11 March 2018 — but only “lorsque ce compte de paiement est tenu en Belgique“, when the account is held in Belgium. An institution serving Belgian residents on accounts held elsewhere in the EEA is not, on that limb, reporting them.

Financial contracts are not. A “financial contract” is one concluded in Belgium by a reporting entity — but where it is concluded at a distance by an entity established abroad and active in Belgium under the freedom to provide services, it is irrebuttably deemed concluded in Belgium when the client has its registered office, is domiciled or habitually resides in Belgium. No evidence displaces that presumption.

So scoping cannot be answered once, at entity level: accounts on one test, each contract category on another.

4. What has to be reported

Article 4 requires the entity to communicate, without delay, three families of information per client.

Accounts. The opening or closing of every bank or payment account the client holds or co-holds; the grant or revocation of a power of attorney and each attorney’s identity; and the account’s periodic balance with its date and number.

Cash transactions. Transactions involving cash carried out through the entity where cash was paid in or withdrawn by or for the client — and in the latter case who actually handed over or received it. Crucially, a deposit to or withdrawal from the client’s own account held with that same entity, by the holder or co-holder in person or through an attorney, is not reportable. What remains includes cash-against-cash exchange, purchase or sale of monetary precious-metal assets against cash, and payment operations and funds transfers against cash.

Financial contracts. The start or end of a relationship in each listed category — safe-deposit box rental, branch 21 and unit-linked branch 23/25/26 life insurance, investment-services agreements, mortgage credit, instalment sale and loan, finance leasing and credit opening — plus, for the insurance and investment-services categories, the periodic aggregated amount in euro across all such contracts with that client.

5. Deadlines, reference dates and thresholds

Article 4 of the Royal Decree sets three clocks; its §2 fixes the balance dates.

A “working day” is Monday to Friday excluding public holidays. Reference dates are fixed, not firm-chosen: account balances at 30 June and 31 December, investment-services aggregated amounts on the same dates, life-insurance amounts on the last day of each calendar year.

Two exemptions cut volume. Cash exchange and precious-metal transactions need not be reported unless they exceed €3,000 per operation, or €3,000 aggregated across several such operations on the same day by the same person, as client or as attorney. And certain consumer-credit relationships within Article VII.3, §3, 1° of the Code of Economic Law fall outside the contract duty.

6. Identifiers — and what the NBB does not check

Identification is prescribed, and it is where an e-money issuer’s data model needs work. The entity identifies itself by its Banque-Carrefour des Entreprises (CBE/KBO) number or, failing that, its Legal Entity Identifier under Article 26(6) of Regulation (EU) No 600/2014. Natural persons are identified by their National Register number or the social-security cross-roads bank number; only where neither exists may name, forename, date or year and place and country of birth be used. Legal persons: CBE number, or failing that, name, legal form and country of establishment.

Then Article 8 of the Royal Decree draws the line that matters: a bank account must be identified by a Belgian IBAN; a payment account unambiguously by a unique reference. An e-money account is a payment account, so it needs no Belgian IBAN — but the reference must be genuinely unique and stable, because it is the key on which authorities query the register. A jointly held account must be reported against each co-holder, and against each attorney where there are several.

The Bank’s control is narrow: only its technical requirements and the check digits inside the Belgian IBAN, National Register, social-security and CBE numbers. It never corrects data. Records failing those checks are deemed not communicated, and the obligation is discharged only when conforming data arrive.

7. The customer-information duty, and what non-compliance costs

Article 5 §2 makes the reporting entity the controller for its own PCC processing and imposes an information duty easy to miss because it sits in a register statute, not a privacy policy. On a durable medium, at the latest when an account is opened, a cash transaction executed or a listed contract concluded, the firm must tell clients, their attorneys and the persons paying in or receiving cash about the reporting obligation, the PCC’s name and address, the purposes, the right to consult data held in their name at the National Bank, the right to rectification and erasure — preferably exercised directly with the entity — and the retention periods. Rectification is shared: the entity corrects its own files and passes it to the PCC without delay.

Enforcement sits with the Treasury, which may ask the Bank which entities filed in a period. The base fine under Article 13 is €50,000 to €1,000,000, proportionate to gravity and duration, financial standing, earlier breaches and cooperation — doubled on repetition within two years. Directors, managers and those charged with day-to-day management are jointly and severally liable. The formal finding must be notified within 30 days, the entity has 30 days to defend in writing, appeal lies to the Conseil d’État, and no fine may be imposed over a year after the facts were established.

8. The 1 December 2026 extension

The Law of 18 December 2025 containing various provisions (Moniteur belge, 30 December 2025) amends the PCC Law at Articles 106 to 108, in force 1 December 2026. Three things change.

First, two new account types are defined: a securities account, on which financial instruments within the meaning of Article 4(1)(15) of Directive 2014/65/EU may be credited or debited, and a crypto-asset account, for crypto-assets within the meaning of Article 2(1)(7) of Regulation (EU) 2024/1624.

Second, the reporting-entity list gains crypto-asset service providers under Article 3(1)(15) of Regulation (EU) 2023/1114 (MiCA) — Belgian CASPs and foreign ones operating in Belgium through a branch. Note the limitation: branch, not freedom of services.

Third, Article 4 gains the matching duties — opening and closing of each such account, powers of attorney over it, and its periodic balance, date and number — with “client” and “attorney” expanded accordingly. The Crown will set the periodicity for the new balances.

9. Three worked examples

The definitions decide real cases, not always in the direction the entity list suggests.

Example one: an EMI passporting in with Luxembourg IBANs. Facts: a Luxembourg-authorised EMI serves Belgian residents on e-money accounts held in Luxembourg, under freedom of services, no Belgian establishment. Rule: the payment-account limb requires the account to be held in Belgium, so those accounts are not reportable on that limb; but a listed contract concluded at a distance with a Belgian-resident client is irrebuttably deemed concluded in Belgium. Action: map every product against the Article 4 contract categories rather than stopping at the account answer, and re-run the test the day a Belgian branch opens. Outcome: a per-product conclusion instead of an entity-level assumption wrong in one direction or the other.

Example two: the cash-in that is not a cash transaction. Facts: customers load their own accounts with cash at partner terminals; separately a walk-in exchanges €2,400 and then €900 of foreign notes the same afternoon. Rule: a deposit by the holder to their own account with the same entity is excluded; exchange is reportable above €3,000 per operation or aggregated across same-day operations by the same person. Action: exclude own-account loads, but build same-day aggregation by person into exchange monitoring — neither exchange breaches the threshold, the €3,300 total does. Outcome: one reportable event a per-transaction rule would have missed.

Example three: the unique reference that was not unique. Facts: an EMI identifies e-money accounts by an internal reference recycled when one closes and another opens for the same customer; several opening messages are rejected. Rule: a payment account must be identified unambiguously, and non-conforming records are deemed not communicated. Action: move to a non-recycled identifier and reconcile against the Bank’s receipt acknowledgements. Outcome: the backlog closes before the Treasury’s list makes it visible.

10. What to do, today

• Answer scoping twice, and record both: once for accounts (held in Belgium?) and once per financial-contract category (distance contract with a Belgian-resident client?).
• Check your account identifier is unique and never recycled, and that a transfer is modelled as a closure plus an opening.
• Split the clocks into separate controls: five working days for events, one month for the half-yearly balances.
• Exclude own-account cash deposits and withdrawals, but add same-day, same-person aggregation against the €3,000 exchange threshold.
• Reconcile against the Bank’s receipt acknowledgements — a record failing technical validation is deemed never communicated.
• Put the Article 5 §2 wording on a durable medium at account opening, not only in the privacy policy.
• Diarise 1 December 2026 if the group holds securities or crypto-asset accounts, or has a Belgian CASP branch in prospect.

Related: Account registers compared · Kontenabrufverfahren and § 24c KWG · FICOBA · CTIF-CFI and goAML in Belgium · OneGate — the NBB PI and ELMI reports · Branch versus freedom of services