The EU Anti-Corruption Directive: What It Means for Companies

Executive Summary

• What’s new: The European Parliament and the Council of the European Union have agreed on a new Directive on combating corruption that aims to harmonise the criminal law frameworks of EU member states by establishing minimum rules concerning the definition of criminal offences, penalties and prevention measures.
• Why it matters: The Directive introduces corporate liability for failure of supervision or control, including substantial fines of 3% or 5% (depending on the criminal offence) of global turnover (and potentially higher), but formally recognises compliance programs as a mitigating factor. While there is overlap with some countries’ existing anti-corruption regimes, the Directive expands compliance expectations to all companies operating in the EU regardless of size, creating implicit new compliance imperatives across the EU.
• What to do next: Companies should assess their existing anti-corruption compliance programs to see if the new liability regime, enhanced penalties and extended limitation periods require adjustment. For companies operating across multiple jurisdictions, existing programs designed to promote compliance with other anti-corruption laws may need to be updated.

__________

On April 29, 2026, the European Parliament and the Council of the European Union adopted a new directive (Directive) to harmonise the criminal law frameworks of EU member states that target corruption.

While companies already subject to robust anti-corruption frameworks — such as France’s Sapin 2 law and the UK’s Bribery Act (UKBA) — may find some overlap between those laws and the Directive, the Directive goes further in key aspects and expands anti-corruption law compliance expectations to all companies regardless of size. That will have the effect of implicitly creating new compliance expectations across the EU.

Significant new provisions that will affect companies operating in the EU include:

• Corporate liability for failure of supervision or control.
• Substantial fines of up to 5% of global turnover.
• Formal recognition of compliance programs as a mitigating factor.

Here we will focus on its impact on France and Germany-based companies, as well as those subject to the UKBA.

Key Provisions of the Directive

Harmonisation of Corruption Offences

The Directive defines and criminalises a comprehensive set of corruption-related offences, most of which are already recognised in the national laws of member states. These include:

• Bribery in the public sector (for both payors and recipients).
• Bribery in the private sector.
• Misappropriation.
• Trading in influence.
• Obstruction of justice.
• Unlawful exercise of public functions.

Notably, the Directive creates a new offence of enrichment from corruption, which criminalises the intentional acquisition, possession or use of property by a public official who knows that such property was derived from corruption offences committed by another public official. The Directive also introduces an offence of concealment, targeting the intentional disguising of the true nature, source or ownership of property derived from corruption offence.

Liability of Legal Persons

A critical development for companies in certain member states is the Directive’s corporate liability framework. Legal persons can be held liable for corruption offences committed for their benefit by persons in leading positions — those with power of representation, decision-making authority, or authority to exercise control within the entity.

French domestic law currently provides for criminal liability of legal entities for acts committed by their organs or representatives. We do not currently anticipate any modification to the existing framework on this point. The Directive is different (and arguably narrower in scope) than the UK’s failure to prevent bribery offence, which is triggered where an “associated person” of a company commits active bribery.

Crucially, the Directive goes further by introducing liability where a lack of supervision or control by a person in a “leading position” within the organisation makes possible the commission of a corruption offence for the benefit of the organisation by another person acting under his or her authority (e.g., an agent) . This provision, which has a direct equivalent in Sections 30, 130 German Act on Administrative Offences (Gesetz über Ordnungswidrigkeiten, or OWiG) but no direct equivalent in French law, effectively creates an implicit obligation for companies to implement internal control programs to prevent and detect corruption, including through third parties acting under the authority of the legal person (similar to the failure to prevent bribery offence in the UK, which includes a defence of “adequate procedures”).

This provision could require an adaptation of French law where it does not correspond to the existing framework of complicity already sanctioned under French law. In April 2026, the German Federal Ministry of Justice and Consumer Protection published a draft act separate from the directive that amends Sec. 30 OWiG by substantially increasing the maximum fines that may be imposed on companies in Germany, without linking them to the worldwide turnover.

Companies that have already established compliance programs — whether or not they fall within the scope of the French Sapin 2 law or other anti-corruption laws — will be better positioned to defend against such liability than those that have not.

Penalties for Legal Persons

The Directive requires member states to impose sanctions against legal entities for misconduct within scope of the Directive. For offences of bribery in the public and private sector and misappropriation, the penalty must be at least 5% of the company’s annual worldwide turnover or €40 million. For trading in influence, obstruction of justice and enrichment offences, the penalty must be at least 3% of total worldwide turnover or €24 million. Member states may introduce penalties significantly higher than the floors detailed above.

In addition to fines, legal persons may face a range of additional sanctions, including exclusion from public tenders and grants, temporary or permanent disqualification from business activities, withdrawal of permits and authorisations, judicial supervision and even judicial winding-up.

These penalty levels represent a significant increase compared to the fixed, offence-specific fines currently provided under the French Penal Code or the OWiG (which currently caps corporate fines at €10 million for intentional offences) and will require upward adjustment during transposition into member states’ law.

Aggravating and Mitigating Circumstances

The Directive sets out aggravating circumstances that must or may be taken into account by courts when sentencing, including where the offence was committed within the framework of a criminal organisation, where the offender is a high-level official, or where the offender obtained substantial benefit or caused substantial damage.

Equally important for companies, the Directive formalises mitigating circumstances. Where a legal person has implemented effective internal controls, ethics awareness and compliance programs prior to or after the commission of the offence, this may be regarded as a mitigating factor. Similarly, where a legal person swiftly and voluntarily discloses the offence to competent authorities and takes remedial measures upon discovery, lower penalties may be considered.

These mitigating factors of cooperation and self-disclosure — already informally recognised in some member states, such as through France’s guidelines published by the Parquet National Financier for the judicial public interest agreement (convention judiciaire d’intérêt public, or CJIP) — will, under the Directive, become part of the positive law of all member states.

Limitation Periods

The Directive establishes minimum limitation periods for the investigation, prosecution and adjudication of corruption offences. For offences punishable by a maximum term of imprisonment of at least four years — which includes most of the core corruption offences — the minimum limitation period is eight years from the time the offence was committed. For offences punishable by a maximum term of at least three years, the limitation period is at least five years. For enforcement of sentences following a final conviction, the limitation period is at least 10 years for serious penalties and at least five years for less severe ones.

Given the derogation provided for in paragraphs 3 and 4 of Article 19 (which allow shorter limitation periods if the member state’s law provides for interruption or suspension of the period), French law will not require amendment on this point. In Germany, the current standard limitation period for typical public bribery offences is already five years. This is distinct from the UKBA, which does not contain any limitation period.

Prevention and Compliance

While the Directive does not directly mandate the implementation of compliance programs by companies — a point on which it is less prescriptive than the French Sapin 2 law — the interplay between the new corporate liability for failure of supervision and the recognition of compliance programs as a mitigating factor creates strong incentives for companies to establish robust internal controls. The Directive references “internal controls, ethics awareness, and compliance programs” as elements that may be considered by courts, which may include a risk map, a code of conduct, third-party evaluation, and internal control and audit mechanisms.

On the public sector side, the Directive requires member states to adopt national anti-corruption strategies, establish specialised anti-corruption bodies, conduct risk assessments of sectors most vulnerable to corruption, and implement training programs for public officials and law enforcement.

Key Differences and Implications for Companies

The Directive will require member states to transpose the Directive into their own laws within 24 months of adoption, with an additional 12 months allowed for provisions relating to risk assessments and national strategies.

For companies that have implemented comprehensive compliance programs to comply with other anti-corruption regimes, such as France’s Sapin 2 law or the UKBA, or existing German administrative frameworks, the Directive should not present insurmountable challenges. However, there are certain key differences compared to other anti-corruption laws and aspects that warrant careful attention:

• Corporate liability. Under the Directive, corporate liability can arise where someone in a “leading position” commits a bribery offence, or where a leader’s “lack of supervision or control” makes possible for a bribery offence to be committed. This is narrower than the UKBA, where corporate liability can be triggered by the misconduct of the “directing mind and will” (e.g., a senior officer) of the company, an “associated person” (e.g., agent, representative, etc.), and — following recent legislation — a “senior manager.” However, the corporate failure to prevent offence applies only to active bribery by an associated person whereas the Directive’s lack of supervision or control offence extends to active and passive bribery.
• Applicability. Like the failure to prevent offence in the UK or the supervisory duties in Germany, the new corporate liability for failure of supervision or control extends the obligation to implement compliance programs implicitly to all companies, regardless of their size, going beyond the thresholds currently applicable under Sapin 2 in France.
• Compliance programs as a defence. The formal recognition of compliance programs and cooperation as mitigating factors under the Directive provides a tangible incentive for companies to invest in genuine and effective compliance infrastructure. However, companies should note that courts will be able to disregard compliance programs implemented merely for cosmetic purposes — so-called “window dressing” — when assessing penalties. Perhaps most significant is that a compliance program will only be a “mitigating factor” under the Directive, whereas under the UKBA an effective compliance program (i.e., adequate procedures) will be a complete defence to the failure to prevent bribery offence.
• Trading in influence. The Directive makes trading in influence a specific offence, which is inter alia committed where an undue advantage of any kind is given to an intermediary who claims to have influence over a public official (even if no bribe reaches the official). This is broader than current national laws of some member states, such as Germany. In Germany, trading in influence is currently a criminal offence only in situations where the person offering the benefit deals directly with the elected official. The UKBA requires an offer or other advantage to be made, directly or through a third party, to influence a public official in order to obtain or retain business for the company. Compliance programs and due diligence processes specifically focused on the UKBA or the current regulatory framework will need to be reviewed to account for the broader risk posed by relationships with intermediaries in dealings with public officials.
• Penalties. The turnover-based fine structure (i.e., at least 3% or 5% of global worldwide turnover, and potentially higher) — represents a potentially significant financial exposure, particularly for large multinationals. This is distinct from the UKBA, under which fines are calculated by reference to the level of harm and culpability of the defendant without reference to turnover.

Companies with operations in the EU should consider reviewing and, where necessary, strengthening their anti-corruption compliance programs now. In particular, they should ensure that their programs include adequate risk assessments, codes of conduct, training, third-party due diligence and internal reporting mechanisms. Where necessary, compliance programs should also take account of the differences between the Directive and other anti-corruption regimes the corporation may be subject to. Companies should also consider monitoring transposition developments in each relevant member state, as the Directive establishes minimum rules and member states remain free to adopt or maintain more stringent standards.

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.