§ 30 OWiG
A fine on the company of up to ten million euros if a person in a management position intentionally commits a criminal offence.
Criminal compliance
Criminal law compliance for companies in AachenCompliance is meant to prevent criminal offences from being committed within the company, and to protect management and staff from suspicion. Karolin Hagemann de Grzymala, LL.M., looks at your company through the eyes of a criminal defence lawyer: where would a public prosecutor start?
Good rules workbefore anyone investigates.
Compliance is also a question of criminal law.
As a criminal compliance lawyer in Aachen, Karolin Hagemann de Grzymala, LL.M., advises large companies and medium-sized businesses. Compliance here means rules and processes that prevent criminal offences in the company and, if something does go wrong, show that management took its duties seriously. Good compliance is short, easy to understand and applied in everyday work.
Why compliance is a question of criminal law
If someone in management commits a criminal offence, the company itself can be held to account. And anyone who runs a company must make sure, through supervision, that no criminal offences are committed in the business. The risks at a glance:
§ 130 OWiG
A fine for breach of supervisory duty (Aufsichtspflichtverletzung): up to one million euros for the person responsible, and up to ten million euros for the company.
§§ 73b, 76a StGB
Confiscation (Einziehung) from the company of whatever was obtained, in some cases even without any particular person being convicted.
Damages claims by the company against managers who neglect their organisational duties.
Good to know
An effective compliance system reduces these risks. In 2017, the Federal Court of Justice (Bundesgerichtshof) ruled that, when a corporate fine is set, it can be relevant whether the company has put in place an efficient compliance management system (BGH, judgment of 9 May 2017, 1 StR 265/16).
What management must do itself
Compliance tasks can be delegated, but responsibility stays with management. Anyone who hands tasks to a compliance officer or to heads of department must select and supervise those people carefully (§ 130 Abs. 1 OWiG). If something goes wrong, three points matter most:
Management follows the rules itself and responds to violations, including within its own ranks.
Responsibilities are set out in writing. The people responsible have time, a budget and direct access to management.
Measures are documented. Anything that has not been recorded is hard to prove in a criminal investigation.
A compliance system in four steps
Compliance does not start with a handbook. It starts with the question of where the real risks in your company lie. The process follows from that:
- 01
Risk analysis
We look at where the criminal law risks lie: in sales, in purchasing, with subcontractors, in accounting, in dealings with public authorities. The result is an overview of the risks, weighted by likelihood and consequences.
- 02
Policies and processes
Clear rules are drawn up for the most important risks, for example on gifts and hospitality, the four-eyes principle for payments or the use of external staff. As short as possible, as precise as necessary.
- 03
Training
Rules only work if employees know and understand them. We train management and staff using typical situations from their working day.
- 04
Whistleblowing system and monitoring
A reporting channel receives reports of violations. Regular reviews show whether the rules are being followed and where adjustments are needed.
Good to know
A compliance system is never finished. When business areas, markets or laws change, the risk analysis and the rules are updated.
Typical criminal law risks in a company
§ 299 StGB
Bribery in commercial practice and bribery of public officials
§ 298 StGB
Bid rigging in tenders
§ 266a StGB
Withholding social security contributions
For example, in cases of bogus self-employment (Scheinselbstständigkeit).
§§ 263, 264 StGB
Fraud against customers, insurers or funding bodies
§ 266 StGB
Breach of trust (Untreue) by people in management positions
§ 261 StGB
Money laundering
Businesses covered by the Money Laundering Act (Geldwäschegesetz), such as dealers in goods and estate agents, also have their own due diligence obligations.
§ 370 AO
Tax evasion
Good to know
Which of these matter for you depends on your sector, size and business model. A construction company has different risks from a care service or an online retailer. You can read more about the individual allegations under Business and white-collar crime.
Call directly
+49 163 8461632You speak to the lawyer in person. Professional confidentiality applies from the first call.
Whistleblowing system under the Whistleblower Protection Act
Since 17 December 2023, all employers with, as a rule, at least 50 employees must set up and operate an internal reporting channel (interne Meldestelle) under the Whistleblower Protection Act (Hinweisgeberschutzgesetz, § 12 HinSchG). For banks, investment firms and some other companies, the obligation applies regardless of size. The reporting channel must:
§ 17 HinSchG
Confirm receipt of a report within seven days at the latest
§ 17 HinSchG
Give feedback on follow-up action within three months
§ 8 HinSchG
Keep the whistleblower’s identity confidential
§ 36 HinSchG
Protect whistleblowers from reprisals. If someone is put at a disadvantage after making a report, it is presumed to be a reprisal.
Good to know
An employer that does not set up a reporting channel risks a fine of up to 20,000 euros (§ 40 HinSchG). The task can also be handed to an appointed third party (§ 14 HinSchG). Whistleblowers may also go straight to an external reporting channel, for example at the Federal Office of Justice (Bundesamt für Justiz). An internal channel that staff trust is therefore in the company’s own interest: a report that arrives internally can be examined before it reaches an authority.
If a suspicion arises anyway
Even good compliance does not prevent every violation. What counts then is that the company is prepared:
An emergency plan for searches: who at reception calls whom, who accompanies the officers, and what employees have to say and what they do not.
Clear responsibilities for an internal investigation, so that evidence is secured and deadlines are met.
§ 146 StPO
A clear separation of roles: if the public prosecutor is investigating, the firm represents either the company or an accused person. A defence lawyer may not defend several people accused of the same offence.
§ 68b StPO
Separate witness counsel (Zeugenbeistand) for employees who are to be questioned. That lawyer acts only for the witness.
Who compliance advice is for
For large companies and medium-sized businesses alike. Companies without their own legal department in particular need a lean solution that fits their size. A first consultation clarifies where you stand. Send an enquiry
How we support companies during a search is explained under Companies.
Compliance for companies in Aachen
We advise companies in the region on site, at our office or by video.
Aachen
For companies in the Aachen city region (Städteregion Aachen) and the Euregio, including those with sites in Belgium or the Netherlands.
Criminal defence lawyer in AachenOther practice areas
Defence for individuals and companies, from a penalty order to extradition proceedings.
Frequently asked questions
Answers to questions that management teams often ask before setting up a compliance system.
ObligationIs compliance required by law?
There is no general compliance law. However, management must make sure, through supervision, that no criminal offences are committed in the company. Anyone who fails to take the necessary supervisory measures commits a regulatory offence (§ 130 OWiG). Specific duties exist in certain areas, such as the internal reporting channel under the Whistleblower Protection Act or due diligence obligations under the Money Laundering Act.
Reporting channelWhen does a company need an internal reporting channel?
As a rule, from 50 employees (§ 12 HinSchG). For certain companies, such as banks and investment firms, the obligation applies regardless of the number of employees. Companies with 50 to 249 employees may run a shared reporting channel with other companies.
FineDoes a compliance system protect against a corporate fine?
There is no guarantee. If the necessary supervisory measures were in place, a fine for breach of supervisory duty is ruled out. If a person in a management position commits an offence themselves, the company can still be fined. An effective compliance system can, however, be taken into account when the amount is set.
Smaller companiesIs compliance worthwhile for smaller companies too?
Yes, if it fits their size. A medium-sized business does not need a hundred-page handbook, but a few clear rules for the areas where the real risks lie. The risk analysis shows where that is.
TrainingHow often should employees be trained?
That depends on the risk. New employees should know the most important rules from the start. In higher-risk areas such as purchasing and sales, regular refresher sessions make sense, and also whenever rules or laws change.
Talk to us before you talk to anyone else.
A first consultation clarifies where you stand and what to do next. The language of the consultation is agreed when you first get in touch, and a sworn interpreter can take part if needed.
+49 163 8461632