Criminal Compliance & Internal Investigations

Criminal Compliance serves to prevent criminal liability of entities and their decision-makers through preventive and repressive measures. The goal is to create a safety distance from criminal behavior through a procedural process and thus minimize risks such as corruption, breach of trust, or money laundering. It pursues a dual approach: the avoidance of offenses in advance (ex-ante) as well as the legally correct response to suspected cases that have already occurred.

There is no general criminal law obligation to introduce a CMS. However, an organizational responsibility and legality control duty for managing directors derives from corporate law (e.g., Section 82 AktG, Section 22 GmbHG). In certain sectors, such as finance and stock exchange, establishing a compliance organization is also explicitly required by law. In criminal law, a corporate fine under the VbVG can be avoided with an effective CMS as a "compliance defense."

Engaging external attorneys secures the so-called "attorney-client privilege." Information and documents created during the investigation are subject to strict professional confidentiality obligations and a statutory prohibition of circumvention. This grants extensive protection against seizure and confiscation by law enforcement authorities, which internal departments such as compliance or internal audit typically cannot claim.

A company can avoid or mitigate liability under the Corporate Liability Act (VbVG) if it demonstrates that it effectively made the commission of offenses by employees more difficult ex-ante through essential technical, organizational, or personnel measures (such as a CMS). The court examines in each individual case whether the entity applied the due diligence required and reasonable under the circumstances to avoid disorganization.

Yes, these laws have extraterritorial effect. The UK Bribery Act (UK-BA) applies to all companies that conduct even parts of their business activities in the United Kingdom. The US Foreign Corrupt Practices Act (FCPA) applies, among other things, when listed on a US stock exchange or when actions with US nexus are taken. Violations can result in massive global fines and exclusion from public contracts.

Criminal liability threatens particularly through omission (Section 2 StGB) when the compliance officer has a guarantor duty. This obligation to prevent criminal offenses usually arises from the contractual assumption of supervisory and protective duties in the employment contract. If an officer intentionally fails to act despite knowledge of misconduct, this can be considered accessory liability through omission.

A whistleblower system provides access to unfiltered information about misconduct and is a central building block for early risk detection. It protects the company from uncontrolled leakage of information to the public and provides employees with a protected framework to report misconduct anonymously and confidentially. In Austria, this protection is reinforced by the Whistleblower Protection Act (HSchG).

Since these attacks are based on psychological manipulation of employees, a CMS focuses on prevention through awareness and training. The goal is a "speak-up culture" where employees actively consult supervisors when in doubt. Supporting technical barriers such as the four-eyes principle for payment approvals and written process guidelines must be implemented.

Under the VbVG, post-offense conduct is an essential criterion for sentencing. The corporate fine is to be assessed lower if the company has taken significant steps to prevent similar offenses in the future (e.g., CMS optimization, training). Additionally, such post-offense conduct can lead to discontinuation of proceedings by the public prosecutor.

Yes. Final convictions for offenses such as fraud, corruption, or money laundering can lead to mandatory exclusion from procurement procedures under the Federal Procurement Act (BVergG). This underscores the economic importance of effective Criminal Compliance for securing the company's market viability.

Certifications according to standards such as ISO 37301 (Compliance Management) or ISO 37001 (Anti-Corruption) increase legal certainty as they facilitate proof of compliance with recognized duties of care. Even without formal certification, these standards serve as valuable guidance for the legally compliant design of internal corporate control measures.