Portugal's Spy Agencies Stop Filing Certified Accounts on Tuesday, and the Report That Replaces Them Must Be Printed on Paper

Portugal's two intelligence services will no longer file legally certified accounts. From Tuesday they produce a single classified management report instead, and the law requires that report to exist on paper.

The change was published in the Diário da República (Official Gazette) on Monday as Decreto-Lei n.º 172/2026, the third amendment to the 2015 decree establishing the Sistema de Normalização Contabilística para as Administrações Públicas (Accounting Standardisation System for Public Administrations, or SNC-AP). It takes effect the day after publication.

Who is covered, and what replaces the audit

The exemption applies to every body inside the Sistema de Informações da República Portuguesa (Intelligence System of the Portuguese Republic, or SIRP): the Secretário-Geral (Secretary-General), the Serviço de Informações Estratégicas de Defesa (Strategic Defence Intelligence Service, or SIED), the Serviço de Informações de Segurança (Security Intelligence Service, or SIS), and their data centres and shared structures. Until now the general rule caught them alongside the rest of central government, which meant an external auditor signed off their accounts.

The new article 5-A replaces that with a relatório de gestão (management report) carrying both financial and non-financial disclosure, due by the end of the first half of the year following the period it covers. It is classified. It is signed by the head of the entity, and if that person refuses to sign, the refusal must be justified inside the document. The obligation survives a change of leadership: the outgoing head signs even after leaving the post. The report then goes annually, on paper, to the Conselho de Fiscalização do SIRP (SIRP Oversight Council), the body elected by parliament to scrutinise the services.

What the report has to contain

Annex IV sets out the contents in some detail, which is what distinguishes this from a plain exemption. The report must identify everyone who led the entity during the period, describe the activity carried out, set out the internal control models used to prevent irregularities, and state the objectives set against the levels of execution achieved.

On money and people it requires the evolution of human and operational resources, training, the budget allocation with the amount executed, and the structure of spending by economic or functional category. It must assess financial and operational risks, record corrections made to figures reported in earlier years, and list the Oversight Council's previous recommendations alongside what was done about them. It closes with a declaration by the agency head attesting to the truth of its contents.

The reasoning, and a recurring argument

The government's stated rationale is narrow: statutory certification requires an auditor to access classified expenditure capable of revealing the nature and means of intelligence activity, which could compromise the state-secret regime under Lei Orgânica n.º 2/2014 and Lei n.º 30/84. The Oversight Council, the preamble concludes, already has the conditions to carry out the necessary scrutiny while preserving secrecy. It was formally consulted before approval.

The decree cleared the Conselho de Ministros (Council of Ministers) on 9 July and was promulgated by President António José Martins Seguro on 21 August, who noted that it does not exempt the services from Tribunal de Contas (Court of Auditors) analysis. What was unknown until Monday was the shape of the substitute regime.

The wider question of which state bodies escape ordinary financial scrutiny has run through the year. In July we reported that Portugal's 5.8 billion euros in EU defence loans falls outside binding Court of Auditors review, and in May the government moved to narrow the Court's visto prévio regime. The SIRP has meanwhile been pushing to widen its own powers, with its Secretary-General petitioning in June for a constitutional revision to open phone metadata to the services.

What this means for expats

• Nothing changes for residents day to day: this is an internal accounting rule. It does not alter what the services may collect, from whom, or under what authorisation.
• Oversight moves rather than disappears: scrutiny shifts from an external auditor to the parliamentary Oversight Council, with the President stating that Court of Auditors analysis still applies. Whether that is equivalent is what critics will press.
• The paper requirement is deliberate: keeping the report off networked systems is a security measure. It also means the document cannot be circulated electronically, which limits who can ever read it.
• The first report is due by 30 June 2027: covering the 2026 financial year, and that is the earliest the new regime can be judged on output rather than design.
• Budget totals stay public: the SIRP allocation continues to appear in the state budget. What changes is the assurance attached to how it was spent.

The substantive test comes when the Oversight Council reports on the first classified file it receives. The decree obliges the services to list the Council's earlier recommendations and their response, giving it a documented trail it did not previously have.