From compliance programme to criminal liability: the new EU Anti-Corruption Directive

November 2026 | SPOTLIGHT | FRAUD & CORRUPTION

Financier Worldwide Magazine

November 2026 Issue

Directive (EU) 2026/1021 on combating corruption establishes a basis for corporate criminal liability that does not depend on a company having expressly authorised the underlying bribery.

Under article 13(2) of the Directive, a legal person may be held liable where a failure of supervision or control by a person in a leading position enabled an individual under that person’s authority to commit a corruption offence for the benefit of the legal person.

The provision does not require the immediate offender to be a director, nor does it require that a director had actual knowledge of the offence. Liability may instead arise from the company’s failure to exercise adequate supervision over the relevant conduct.

The Directive entered into force on 31 May 2026 and member states must transpose its provisions by 1 June 2028. It replaces the 2003 Framework Decision on private sector corruption and the 1997 Convention on corruption involving officials of the European Economic Community and officials of European Union (EU) member states. It also establishes, for the first time, common minimum definitions of corruption offences across the EU.

For companies, however, the significance of the Directive lies less in the harmonisation of the underlying offences than in the introduction of this additional basis of corporate liability. By making inadequate supervision a potential ground for liability, article 13(2) places the company’s compliance framework at the centre of the legal assessment.

Two routes to corporate liability

Article 13 establishes two distinct bases of corporate criminal liability. Under the first, a legal person may be held liable for an offence committed for its benefit by a person in a leading position, defined by reference to powers of representation, decision making or control. This approach broadly reflects the attribution models already found in many European legal systems.

The second basis, set out in article 13(2), extends corporate liability to offences committed by persons subject to the authority of a leading person, where a failure of supervision or control by that leading person made the offence possible.

This provision consequently broadens the circumstances in which a company may incur liability beyond the conduct of its senior management. Neither basis of liability displaces the criminal responsibility of the natural persons who commit, incite or assist in the offence. Corporate and individual liability may therefore arise concurrently.

By allowing corporate liability to be established independently of the direct involvement of senior management, the second limb materially expands the scope of potential exposure. Liability may arise from the conduct of a junior employee, local agent or third-party intermediary, provided that the offence was committed for the benefit of the company and was facilitated by inadequate supervision or control at a higher level.

This basis of liability potentially applies across most of the Directive’s catalogue of corruption offences, including public and private sector bribery, misappropriation, trading in influence, obstruction of justice and illicit enrichment. The principal exception is the unlawful exercise of public functions, which, by its nature, can only be committed by a natural person.

Sanctions calibrated to turnover

The Directive provides for substantial financial penalties against legal persons. For bribery and misappropriation offences, member states must ensure that the maximum fine is not less than 5 percent of the legal person's total worldwide turnover in the business year preceding the year in which the offence was committed, or €40m, whichever is higher. For offences including trading in influence, obstruction of justice and illicit enrichment, the corresponding minimum fine is not less than 3 percent of worldwide turnover or €24m, whichever is higher.

These amounts constitute minimum harmonisation requirements, and member states remain free to adopt more stringent sanctions.

The Directive also contemplates a range of non-financial penalties, including exclusion from public procurement, withdrawal of permits and authorisations, judicial supervision and publication of the decision. Taken together, these measures bring the potential consequences of corporate corruption closer to the scale of exposure already associated with the US Foreign Corrupt Practices Act and the UK Bribery Act.

The turnover-based approach is particularly significant for corporate groups, since the relevant calculation may depend on worldwide turnover rather than the revenues of the specific legal entity involved in the offence.

No size threshold and an extensive territorial reach

Two features of the Directive’s scope make its application difficult to confine. First, it establishes no minimum size threshold for legal persons. The regime therefore applies to companies of all sizes, including medium-sized enterprises that may not have previously regarded anti-corruption compliance as a central governance priority.

Second, the Directive requires member states to establish jurisdiction over offences committed within their territory or by their nationals, while permitting them to adopt broader jurisdictional rules, including in respect of offences committed for the benefit of a legal person established within their territory.

The resulting framework may expose non-EU parent companies with operations or other sufficient connections in a member state to scrutiny of their supervision over EU subsidiaries and intermediaries under national implementing legislation. Corporate compliance programmes can no longer be designed solely around the enforcement priorities of the jurisdiction in which the group is headquartered.

Compliance before mitigation

Article 16 recognises the existence of a genuine and effective compliance programme as a mitigating circumstance in the imposition of sanctions on legal persons, alongside prompt voluntary disclosure and remedial action following the discovery of an offence.

The provision also permits consideration of a compliance programme adopted after the commission of the offence, thereby extending its relevance beyond pre-existing compliance arrangements. Unlike section 7 of the UK Bribery Act, however, the Directive does not establish compliance as a defence capable of excluding corporate liability altogether.

Compliance nevertheless bears on the determination of liability at an earlier stage. Under article 13(2), second-limb liability is contingent upon a failure of supervision or control. An effective compliance programme may constitute evidence that the company exercised the supervision and control required by that provision.

Whether such evidence is sufficient to preclude liability will depend on the programme’s actual operation in the circumstances surrounding the offence in question. A company may, for example, have adopted a well-designed compliance framework while nevertheless failing to supervise adequately the particular employee or intermediary who committed the bribery offence.

Compliance thus performs two distinct legal functions. Prior to the determination of liability, it constitutes evidence relevant to an element of the offence and, where it demonstrates effective supervision, may prevent the offence from being attributed to the company altogether.

Once liability has been established, compliance may operate as a mitigating factor in the determination of the sanction under article 16. Restricting the invocation of an effective compliance programme to the mitigation stage therefore risks forgoing the more consequential argument that the programme may preclude corporate liability in the first place.

Genuine compliance and the evidential burden

The distinction between substantive and merely formal compliance is drawn by the Directive itself: a compliance programme that is genuine and effective may constitute a mitigating circumstance under article 16.

Conversely, a programme maintained merely for appearances does not warrant equivalent treatment and, insofar as the Directive permits member states to recognise aggravating circumstances, a purely cosmetic programme may contribute to an increase rather than a reduction in the applicable sanction. Formal compliance is therefore not a neutral position; it may itself constitute evidence of a failure to exercise adequate supervision.

The basis of second-limb liability is the absence of adequate supervision or control, and the company will ordinarily possess the documentary record necessary to demonstrate whether such supervision existed and operated effectively.

A procedure that was documented but never enforced, an audit finding that was recorded but not remedied, a whistleblower report that was received but not acted upon or a due diligence red flag that was identified but subsequently disregarded cannot be characterised simply as an absence of evidence. Each may instead constitute affirmative evidence of the supervisory deficiency underpinning liability under article 13(2), while also revealing the merely cosmetic nature of the compliance framework.

The evidentiary value of a compliance programme lies in the operational record it generates. Relevant indicators include risk assessments revised in response to changes in the business, monitoring and testing activities that are actually conducted and documented, breaches followed by demonstrable consequences, and decisions taken and formally recorded at board level.

A company unable to produce such evidence may find it difficult to establish that it exercised effective supervision over its employees or intermediaries, irrespective of the assurances contained in its compliance manual.

France and Luxembourg: unequal starting points

The Directive establishes a minimum level of harmonisation, which must be integrated into national legal systems that differ in their existing approaches to corporate criminal liability and compliance. France and Luxembourg consequently begin from distinct legal positions.

Luxembourg has operated under a comparable two-limb model of corporate criminal liability for several years. Following the reform of 12 March 2020, article 34 of its Criminal Code provides for corporate liability where an offence is committed in the name and interest of a legal person by a legal organ, a de jure or de facto manager, or any person exercising powers of representation, decision making or control within the organisation.

The same provision establishes liability where a failure of supervision or control by such a person made the offence possible, while preserving the concurrent liability of the individual concerned. This closely mirrors the Directive’s two-limb structure, which is already substantially reflected in Luxembourg law.

For Luxembourg, therefore, the Directive is unlikely to materially alter the conditions triggering corporate liability. Its principal impact lies instead in the consequences of that liability. Article 36 currently limits the criminal fine applicable to a legal person to €750,000, subject to a fivefold increase for certain offences.

That ceiling, expressed at most in millions of euros, will have to accommodate sanctions potentially reaching tens of millions or a specified proportion of worldwide turnover. Luxembourg must also incorporate the Directive’s differentiated treatment of compliance, which is not presently codified in its Criminal Code.

France approaches the Directive from a different starting point. Article 121-2 of the Criminal Code attributes liability to a legal person for offences committed on its behalf by its organs or representatives, but does not establish a general limb based on supervision failures.

An offence committed by an employee who is neither an organ nor a representative, and which was facilitated solely by a manager’s failure to supervise, does not fall unambiguously within the provision’s current scope.

France will therefore need to determine whether article 121-2 can be interpreted to encompass such conduct by treating the supervisory failure as an offence committed by the representative on behalf of the company, or whether specific wording addressing corruption offences will be required.

France nevertheless possesses a more developed institutional framework for assessing compliance. The Sapin II legislation already requires larger companies to implement anti-corruption compliance programmes. The Agence française anticorruption has published detailed guidance concerning their expected content, while the convention judiciaire d’intérêt public permits prosecutors to incorporate cooperation and remediation into negotiated resolutions.

These existing benchmarks provide an obvious reference point for assessing whether a programme is genuine and effective for the purposes of article 16. Luxembourg, by contrast, will approach the same question with a less developed domestic framework.

Groups operating in both jurisdictions should therefore avoid assuming that a single compliance programme will satisfy the requirements of each legal system. The conditions triggering corporate liability are already familiar in Luxembourg but remain less settled in France. Moreover, potential financial exposure is set to increase substantially in Luxembourg and the criteria for an effective compliance programme are more clearly articulated in France than in Luxembourg.

On each of these dimensions, compliance frameworks should be designed and implemented in accordance with the more demanding interpretation.

Before transposition

There is little justification for companies to defer action until national implementing legislation is adopted. The Directive has already established the relevant offences, the model of corporate criminal liability and the minimum level of fines that member states must provide for in their domestic law.

Although the precise modalities of transposition remain to be determined, the principal elements of the new framework are sufficiently clear to inform immediate compliance measures.

Companies should therefore begin by identifying deficiencies in their supervision of employees, agents and intermediaries, addressing those deficiencies and maintaining contemporaneous records capable of demonstrating the nature and effectiveness of the supervision exercised.

Such documentation cannot, in itself, guarantee acquittal. It may nevertheless strengthen a company’s ability to contest attribution under article 13(2) by demonstrating that adequate supervision and control were exercised. If liability is ultimately established, evidence of a genuine and effective compliance programme may also support a claim for mitigation under article 16.

Gwennhaëlle Barral is an attorney at law at Temime. She can be contacted on +33 (0)1 4927 0055 or by email: gwennhaelle.barral@temime.fr.

Gwennhaëlle Barral

Temime