Short answer
EU criminal-law directives increasingly require Member States to make legal persons liable through two attribution routes. First, an offence must be committed for the legal person's benefit by someone in a leading position, based on authority to represent it, decide for it or exercise control within it. Second, a leading person's lack of supervision or control may make the legal person liable when that failure enabled a subordinate to commit the offence for its benefit.
This pattern applies, with instrument-specific differences, to bribery and other corruption, fraud affecting the Union's financial interests, criminal money laundering, violations of EU restrictive measures and environmental crime. EU directives set minimum outcomes; the domestic law implementing the relevant directive determines whether liability is criminal or non-criminal, how corporate fault is proved, which court has jurisdiction, the available defences and the sentence in a particular case.
Liability is therefore not automatic merely because an employee offended. Prosecutors normally must connect the offence to the legal person's benefit and to either a qualifying leader or a qualifying supervision failure. Proceedings against the company do not prevent proceedings against the individuals involved. The company must also be able to contest the alleged predicate offence and exercise Charter defence rights.
The recurring two-route model
The first route concerns a leader acting alone or through a corporate organ, based on representation, decision-making authority or control rather than job title.
The offence must be “for the benefit” of the legal person. National law may cover intended business, cost or other advantages, but not a purely personal offence merely because it occurred at work.
The second route requires a leader's supervision or control failure to have enabled a subordinate's offence for the entity's benefit. It is not a free-standing EU offence of imperfect compliance.
A company can face liability for a leader's offence and for a leader's supervision failure that enabled a subordinate's offence. —
The directives generally exclude States or public bodies exercising State authority and public international organisations. Treatment of other entities and successors depends on the instrument and national law.
Bribery and corruption
Directive (EU) 2026/1021 is now the central EU criminal-law instrument on corruption. It entered into force on 31 May 2026 after publication on 11 May and replaces Framework Decision 2003/568/JHA and the 1997 EU officials convention for Member States bound by the Directive. Denmark is not bound by it; the Framework Decision continues to apply there. Member States generally have until 1 June 2028 to transpose the new rules.
The Directive covers public- and private-sector bribery, misappropriation, trading in influence, abuse of functions, obstruction of justice and concealment connected with corruption. Article 13 uses both attribution routes. Article 14 requires effective, proportionate and dissuasive criminal or non-criminal penalties and fines. For specified offences attributed through the leader route, national maximum fines must reach at least 5% of worldwide turnover or EUR 40 million; for another group, at least 3% or EUR 24 million. Those are minimum levels for national maximums, not automatic fines.
Compliance now has an express but carefully limited role. Article 16 requires national law to allow effective internal controls, ethics awareness and compliance programmes, implemented before or after the offence, to be regarded as a mitigating circumstance unless they exclude liability. Rapid voluntary disclosure and remediation can also mitigate. The Directive does not create a universal compliance-program safe harbour.
During transposition, existing national rules remain operational. A business must check present domestic law while preparing for the 2026 Directive.
Fraud affecting the EU budget
Directive (EU) 2017/1371, the PIF Directive, addresses fraud, corruption, misappropriation and money laundering affecting the Union's financial interests. Article 6 requires liability where a covered offence is committed for a legal person's benefit by a qualifying leader, or where that leader's lack of supervision or control enabled a subordinate's offence. Article 9, as amended by Directive 2026/1021, requires effective, proportionate and dissuasive sanctions, including criminal or non-criminal fines, and permits exclusion from public benefits and tenders, business disqualification, judicial supervision, winding-up and closure.
This regime matters to recipients, contractors and intermediaries handling EU revenue or expenditure. Incorrect accounting alone is insufficient: investigators must establish a PIF offence, the benefit connection and the national attribution rule.
Criminal money laundering
Directive (EU) 2018/1673 harmonises aspects of money laundering by criminal law. Articles 7 and 8 repeat the leading-person and supervision-failure routes and require fines with possible exclusion from public funding, business disqualification, supervision, winding-up or closure.
Criminal laundering liability differs from administrative liability under the preventive anti-money-laundering framework. An obliged entity may breach due-diligence, monitoring or reporting duties without criminal laundering being proved. Conversely, a legal person may face laundering liability where a leader participates in converting, transferring, concealing, acquiring or using criminal property for its benefit. One investigation can engage both regimes, but their elements and sanctions differ.
That distinction matters after Steiermärkische Bank, C-291/24. Interpreting the preventive framework, the Court held that an administrative penalty on a legal person could not be made conditional on first treating an identified natural person as accused and naming that person as culpable in the penalty decision. The ruling did not concern attribution of the criminal laundering offence.
EU sanctions violations
Directive (EU) 2024/1226 requires criminalisation of specified violations of EU restrictive measures, including making funds available, failing to freeze, prohibited trade or services, circumvention and certain reporting failures. Its transposition deadline was 20 May 2025. Article 6 applies the same two attribution routes.
Article 7 requires criminal or non-criminal fines and allows measures such as exclusion from public funding, disqualification, withdrawal of permits, judicial supervision, winding-up and closure. For leader-route liability, it sets a lower national-maximum tier of at least 1% of worldwide turnover or EUR 8 million for specified reporting-related conduct, and a higher tier of at least 5% or EUR 40 million for the principal violations. These are required ceilings, not inevitable penalties.
Sanctions compliance is especially exposed to distributed responsibility: sales, logistics, banking, beneficial-ownership checks and management approvals may sit in different entities or countries. A group policy alone does not identify the liable legal person. Investigators must ask which entity benefited, which leader held the relevant authority, who was under that person's authority and which failure enabled the offence.
Environmental crime
Directive (EU) 2024/1203 replaced the earlier environmental-crime directives for bound Member States after its 21 May 2026 transposition deadline. It covers an extensive list of intentional and, for specified conduct, seriously negligent environmental offences. Article 6 contains both corporate attribution routes.
Article 7 adds remedies suited to environmental harm: restoration where damage is reversible, compensation where it is irreversible, withdrawal of permits, closure and environmental due-diligence schemes. For leader-route liability, national maximum fines must reach at least 5% of worldwide turnover or EUR 40 million for one offence group, or 3% or EUR 24 million for another. More severe penalties must be available for qualified offences causing catastrophic effects.
Environmental permits and management systems are evidence, not immunity. Contemporaneous risk assessments, escalation records, monitoring and remediation may help dispute attribution, causation or fault under national law.
Compliance and group structures
A defensible programme should map each regulated activity to a responsible legal entity and identify the people with representation, decision or control authority. It should then document risk-based supervision of employees, agents, distributors, suppliers and joint ventures. Useful controls include approval thresholds, segregation of duties, beneficial-ownership and counterparty checks, environmental monitoring, reliable reporting channels, investigation protocols and recorded remediation.
Delegation does not necessarily remove control authority. Nor does using an intermediary necessarily break attribution: the 2026 corruption Directive expressly warns against avoiding responsibility through intermediaries, including related legal persons. At the same time, EU-derived rules do not create automatic parent-company criminal liability for every subsidiary offence. The relevant national law must connect the particular parent or affiliate to the offence, benefit or supervision failure.
After discovery, preserve evidence, stop ongoing harm, protect reporters, investigate independently and assess disclosure obligations. Remediation can affect penalty, while rushed cross-border admissions can prejudice defence rights. Privilege and disclosure strategy require local advice.
Defence rights still apply
Corporate liability cannot be imposed through an irrebuttable assumption that an individual's offence occurred. In Delta Stroy 2003, C-203/21, the Court of Justice held that Charter Article 48 precludes a criminal penalty on a legal person for an offence allegedly committed by its representative where the legal person was not able to dispute the reality of that offence.
A legal person facing a criminal penalty must be able to dispute the reality of the alleged offence. —
That protection makes the evidential chain central: the covered offence, the offender's role, corporate benefit, authority or supervision failure, and the entity charged must each be contestable. Charter Articles 47 and 48, national procedural law and, where applicable, Directive (EU) 2016/343 also govern access to a tribunal, presumption of innocence and defence rights.
Conclusion
EU-derived corporate offence rules converge on a practical question: did a qualifying leader commit a covered offence for the entity's benefit, or did that leader's supervision failure enable a subordinate to do so? The answer must then be translated through the current national implementing law. Compliance systems can prevent offences, rebut alleged failures and mitigate penalties, but they are not a generic immunity. Sound analysis keeps the offence, benefit, responsible leader, supervised person, liable entity, domestic implementation and procedural rights separate.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.