In the article, which builds on the European Commission's latest Annual Report on the implementation of Regulation (EU) 2021/821, Ornella highlights that trade compliance programmes should be designed as dynamic, risk-based systems that are continuously updated and tested, rather than treated as a mere box-ticking exercise.

She also examines the increasing enforcement activity across the European Union, particularly following the implementation of Directive (EU) 2024/1226, and discusses the practical implications for companies operating in international markets.

Click here to read the full article

I. Overview and background: a long road to a common framework

On 26 March 2026, the European Parliament formally adopted the European Union’s first comprehensive anti-corruption directive — a landmark piece of criminal legislation that closes one of the most glaring gaps in the EU’s legal architecture (hereinafter, the “Directive”). The text was approved by 581 votes in favour, 21 against, and 42 abstentions, and had been provisionally agreed with the Council in December 2025 (1).

The context underscoring the urgency of this intervention is striking. According to a 2025 Eurobarometer, 69% of Europeans believe corruption to be widespread in their country, and 66% consider efforts against high-level corruption to be insufficient (1). Earlier EPRS studies estimated the total cost of corruption risk in EU public procurement alone at €29.6 billion between 2016 and 2021, with an additional €4.3 billion attributable to contracts involving EU funds. More broadly, Europol has reported that 71% of the most threatening criminal networks active in the EU use corruption to facilitate their activities or obstruct justice (2).

The path to the directive began on 3 May 2023, when the European Commission tabled an anti-corruption legislative package based on Article 83 TFEU — the provision empowering Parliament and the Council to establish minimum rules on criminal offences and sanctions in areas of particularly serious cross-border crime (1). The proposal followed calls by the European Parliament for EU-wide harmonisation of corruption offences and was shaped by the EU Security Union Strategy (2020–2025) and the EU Strategy to Tackle Organised Crime (2021–2025), which had tasked the Commission with assessing whether existing rules were adequate to address evolving criminal practices.

The pre-existing framework was acknowledged as fragmented. It consisted principally of Council Framework Decision 2003/568/JHA on private-sector corruption, a 1997 Convention on corruption involving EU officials, and the PIF Directive (2017/1371) (2). A 2023 external study mandated by the European Commission confirmed that “the lack of a coherent European framework including provisions for all corruption-related crimes identified by international standards” constituted “a source for legislative and operational challenges in tackling cross-border corruption cases” (3). The Commission’s own questionnaires to Member States revealed wide divergence: definitions differed substantially, certain UNCAC-mandated offences were absent from national legislation, and limitation periods varied significantly (3).

Following the Commission proposal, the LIBE Committee of the European Parliament adopted its report in January 2024 with near-unanimous support. The Council agreed its general approach in June 2024, and trilogue negotiations concluded with a provisional agreement in December 2025. The Parliament gave its final endorsement on 26 March 2026 (4).

II. Key provisions and criminal offences

The Directive (5) establishes a catalogue of corruption-related offences that Member States are required to criminalise if committed intentionally. These include (Articles 3 to 11):

1. Public-sector bribery (active and passive): promising, offering, or granting an undue advantage to a public official, or a public official soliciting or accepting such an advantage, to perform or abstain from an act in the exercise of their functions;

2. Private-sector bribery (active and passive): the same conduct involving directors or employees of private entities, acting in breach of their professional duties within the context of economic or commercial activities;

3. Misappropriation: the use by a public official of assets entrusted to their management for a purpose other than that intended, to their benefit or that of a third party, or to the detriment of the relevant public or private entity;

4. Trading in influence: promising or granting an advantage to any person to exercise improper influence on a public official, irrespective of whether the influence was actually exerted or produced the intended result;

5. Unlawful exercise of public functions: intentional serious violations of the law committed by a public official in the exercise of their functions;

6. Obstruction of justice: use of violence, threats, or inducements to interfere with testimony, evidence, or the official functions of judicial or law-enforcement officers in proceedings related to corruption offences;

7. Enrichment from corruption offences: acquisition, possession, or use of assets by a public official in the knowledge that those assets derive from corruption offences committed by another public official;

8. Concealment: intentional disguise or concealment of the nature, origin, or movement of assets derived from the above offences.

9. Incitement, aiding and abetting, and attempt are also covered.

The Directive (Article 2) defines key concepts including “public official” (covering EU and national officials, persons performing public service functions, and officials of international organisations), as well as “high-level official” — a category encompassing heads of government, ministers, members of parliament, constitutional and supreme court judges, prosecutors-general, and members of the European Commission and European Parliament.

Member States retain the right to adopt stricter standards, seeing as the Directive establishes only minimum rules.

Sanctions for natural persons (Article 12) are tiered according to the gravity of the offence: a minimum maximum penalty of five years’ imprisonment for public-sector bribery where the official’s act constitutes a breach of duty; at least four years for misappropriation, enrichment from corruption, and concealment; and at least three years for other offences, including private-sector bribery and trading in influence. Additional penalties may include fines, removal from public office, temporary disqualification from standing for election, exclusion from public procurement, and revocation of licences.

The Directive (Article 19) also harmonises limitation periods, requiring at least eight years from the commission of offences punishable by a maximum of at least four years’ imprisonment, and at least five years for less serious offences, with reduced minimum periods permissible only where interruption or suspension mechanisms exist.

Prevention obligations (Article 20 and following) require Member States to adopt national anti-corruption strategies, establish independent anti-corruption bodies, introduce asset disclosure mechanisms for public officials, regulate conflicts of interest and “revolving doors”, and conduct periodic risk assessments by sector. Whistleblower protection under Directive (EU) 2019/1937 is expressly extended to reports of corruption offences under this Directive (Article 25). Enhanced cooperation between national authorities and EU bodies — including OLAF, Eurojust, Europol, and the EPPO — is also mandated (Article 32).

III. Sanctions for legal persons: the turnover-based fine model and its broader context

One of the most significant innovations of the Directive lies in its approach to the liability and sanctioning of legal persons. Member States must ensure that companies can be held liable for corruption offences committed for their benefit by persons in a leading position, or where inadequate supervision by such persons enabled the commission of the offence (Article 13).

Sanctions must be effective, proportionate, and dissuasive. Beyond fines, they may include exclusion from public procurement, suspension from business activities, judicial winding-up, and publication of the judgment (Article 14).

The headline provision, however, concerns the calibration of pecuniary sanctions. For the most serious offences — public-sector bribery, private-sector bribery, and misappropriation (Articles 3 to 5) — the maximum fine must reach at least 5% of the legal person’s total worldwide annual turnover in the preceding financial year, or alternatively €40 million in absolute terms. For trading in influence, obstruction of justice, and enrichment from corruption (Articles 6, 8, 9), the threshold is set at 3% of global turnover or €24 million.

This turnover-based mechanism represents a structural break from the traditional Italian framework under Legislative Decree 8 June 2001, no. 231 (hereinafter, the “231 Decree”), which determines corporate sanctions through a “quotas” system: the judge fixes the number of units (quote) — between 100 and 1,000 — and the monetary value of each unit — between €258 and €1,549 — resulting in a maximum fine of approximately €1.55 million for corruption offences under Article 25 of the 231 Decree (6). While this system allows for a degree of judicial discretion calibrated to the gravity of the offence and the entity’s degree of responsibility, it was not designed to scale with the actual size or financial capacity of large multinationals.

The turnover-based model, by contrast, ensures that the sanction bears a direct and proportionate relationship to the economic weight of the offending entity — a principle that resonates with the regulatory logic already adopted in other European instruments. Most notably, Legislative Decree 30 December 2025, no. 211 — the Italian Decree implementing Directive (EU) 2024/1226 on criminal penalties for violations of EU restrictive measures — introduced a new Article 25-octies.2 into the 231 Decree, expressly providing for fines calculated as a percentage of the global annual turnover of the offending entity (7). Under that regime, fines range from 1% to 5% of global turnover for the most serious violations (or €3 million to €40 million where turnover cannot be determined), and from 0.5% to 1% for less serious ones (or €1 million to €8 million as an alternative).

The EU anti-corruption Directive now introduces a parallel and closely analogous structure. The alignment between the two instruments is deliberate: both reflect the EU legislator’s evolving preference for sanctions that penalise conduct in proportion to the economic capacity of the offender, thereby addressing the risk that fixed-sum fines may be absorbed as a ‘cost of doing business’ by large corporations. The same philosophy underpins the GDPR (fines up to 4% of global annual turnover), the Digital Markets Act, and various other EU sectoral regulations.

From an Italian implementation standpoint, the transposition of the Directive will require to amend Article 25 of the 231 Decree, which currently governs corporate liability for corruption-related offences. The existing quota-based system will need to be either replaced or supplemented by a turnover-referencing mechanism to achieve compliance with the Directive’s minimum standards. 

From a corporate compliance perspective, the said directives make it critical for companies to promptly recalibrate their trade compliance and anti-bribery and corruption (ABAC) frameworks. The shift to turnover-based corporate fines  substantially increases the (also, financial) exposure attached to corruption risks and makes “static” control systems harder to defend as effective. In practical terms, this calls for an immediate refresh of risk assessments (including sectoral and geographic corruption risks, public-touchpoints, and third-party channels), tighter third‑party due diligence and ongoing monitoring, strengthened controls over gifts/hospitality, sponsorships, facilitation-risk, and conflicts of interest (including revolving-door scenarios), and testing of reporting/escalation mechanisms (also in light of the Directive’s express linkage to the EU whistleblowing framework). 

For Italian entities subject to the 231 Decree, transposition will likely require a targeted update of the so-called Model 231 (compliance program). Companies that treat the Directive as a “legislative update” rather than a compliance redesign risk finding that their Model 231 is no longer viewed as adequately implemented or effective when scrutinized by prosecutors and courts.

The Directive now awaits formal adoption by the Council of the EU, after which it will enter into force 20 days following publication in the Official Journal of the European Union (1). Member States will have between 24 and 36 months from entry into force (depending on the obligations concerned) to transpose the Directive.

Bibliography

(1) europarl.europa.eu/news/en/press-room/20260323IPR38831/parliament-greenlights-eu-anti-corruption-rules

(2) EPRS_BRI(2024)762406_EN.pdf, P. 2

(3) EPRS_BRI(2024)762406_EN.pdf, P. 5

(4) https://www.europarl.europa.eu/legislative-train/theme-a-new-era-for-european-defence-and-security/file-directive-on-combating-corruption

(5) https://www.europarl.europa.eu/doceo/document/TA-10-2026-0094_EN.html

(6)  https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2001-06-08;231

(7) www.normattiva.it/uri-res/N2Ls=

Raffaella Quintana is a partner and Head of White-Collar Crime, Investigation and Compliance at ADVANT Nctm. More than 35 years ago, when she built the first criminal law team inside a large Italian multi-practice firm, she had to make two arguments simultaneously: the legal one and the cultural one. The legal argument was technical. The cultural argument was harder, persuading partners and clients that business criminal law was not a niche for handling emergencies but a fundamental governance discipline, one that belongs in the room where strategy is made, not called in after the damage is done. That argument is now settled. What she continues to build is the architecture around it.

Read the full interview on Leaders League website

Across the European Union (“EU”), the enforcement of restrictive measures has long been characterized by fragmentation. While sanctions are adopted at Union level, their implementation and enforcement remain the responsibility of Member States — resulting in a patchwork of divergent penalties, investigative approaches and ‘levels’ of enforcement.

Indeed, in some jurisdictions, breaches are treated merely as administrative violations; in others, they are prosecuted as criminal offences, often entailing imprisonment and/or corporate liability. This lack of uniformity has raised persistent concerns in Brussels, primarily because it encourages forum shopping by economic operators attempting to seek jurisdictions with softer enforcement. In this context, many called for deeper harmonisation, advocating for shared investigative standards and stronger cross-border coordination to close enforcement gaps.

Read the full document

Through Draft Legislative Decree No. 317/2025, Italy introduces a new Chapter I-bis in the Criminal Code on “Crimes against the Common Foreign and Security Policy of the European Union” and extends corporate criminal liability under Legislative Decree 231/2001.

The contribution examines the key features of the reform — including new offences, liability extensions, and coordination mechanisms — and highlights the compliance implications for companies, emphasizing the need for robust risk assessment, due diligence, and an integrated trade compliance culture.

Read the full article by Ornella Belfiori.  

We would like to point out that Decree-Law No. 116 of 8 August 2025 (“Decree-Law” or “Decree-Law 116/2025”) containing “Urgent provisions for combating illegal activities relating to waste, for the reclamation of the area known as Terra dei Fuochi, and for assistance to the population affected by natural disasters”, was published in the Official Gazette No. 183 of 8 August 2025.

The measure introduces important changes in the environmental field, amending, inter alia, Legislative Decree No. 152 of 3 April 2006 (the so-called “Consolidated Environmental Act” and, hereinafter, “TUA” - Testo Unico Ambientale -), the Italian Criminal Code and Article 25-undecies (“Environmental Offences”) of Legislative Decree No. 231 of 8 June 2001 (“Legislative Decree 231/2001”). 

As far as is relevant here, the Decree-Law tightens the penalties for environmental offences, modifies certain offences already referred to in Article 25-undecies of Legislative Decree 231/2001[2] and introduces additional offences among the predicate offences provided for by Article 25-undecies.

First, it is necessary to mention the two offences summarised below, as their inclusion in the list of predicate offences under Legislative Decree 231/2001 is of significant systemic importance, putting an end to a regulatory anomaly that has long been criticised in legal doctrine[3]. 

• “Obstruction of inspections” (Article 452-septies of the Italian Criminal Code), which punishes anyone who, by denying access, creating obstacles or artificially altering the state of the places, prevents, hinders or evades environmental, occupational health and safety inspections and controls, or compromises their results. 

• “reclamation ” (Article 452-terdecies of the Italian Criminal Code), which punishes anyone who, being obliged by law or by order of the authorities, fails to voluntarily reclaim or restore a site. 

  It should be noted that said offence differs from the contravention referred to in Article 257 of the TUA (“Site reclamation”) – historically assumed to be the responsibility of entities pursuant to Article 25-undecies of Legislative Decree 231/2001 – as a special case, which punishes omissive conduct within a specific and structured administrative procedure. The offence only occurs when the person who caused the pollution (by exceeding the so-called “CTCs”[4] /”RTCs”[5] ) fails to comply with the obligation to reclaim the site in accordance with the operational plan approved by the competent authority, as provided for in the procedure set out in Articles 242 et seq. of the TUA.

  Article 452-terdecies of the Italian Criminal Code, on the other hand, has a broader and subsidiary scope, allowing for a significantly greater punitive claim. The rationale is to penalise failure to comply with an environmental restoration obligation regardless of its specific source[6] ; 

Particular attention should also be paid to the inclusion in the 231 catalogue of the following additional offences regarding waste:

• “abandonment of non-hazardous waste in specific cases” and “abandonment of hazardous waste” (Articles 255-bis and 255-ter of the TUA). Decree Law 116/2025 thoroughly revises the matter, turning the abandonment of waste from an administrative (or minor) offence to a criminal offence, even in the case of non-hazardous waste, where the specific cases referred to in Article 255-bis of the TUA are applicable[7]. If the act is committed by business owners or managers of organisations, the penalties are increased. The connection with the institution of temporary storage (Article 183, paragraph 1(bb) of the TUA) has a crucial operational impact on both provisions.

Indeed, as is well known, exceeding the time and volume limits established for the “temporary storage prior to collection”[8] of waste may constitute one of the above offences, giving now rise also to liability of the entity pursuant to Legislative Decree 231/2001.

• “Illegal combustion of waste” (Article 256-bis of the TUA). This provision, which has also been raised to the level of a criminal offence and falls within the scope of 231 liability, is intended to curb the practice of illegal “thermal management” of waste. This is a type of offence determined by the occurrence of a criminal event (reato a condotta libera) and implying an abstract danger, differing from the common crime of arson (Article 423 of the Italian Criminal Code), which requires the emergence of a danger to public safety. Its inclusion in the catalogue aims to combat conduct which, while not reaching the threshold of environmental disaster (Article 452-quater of the Italian Criminal Code), represents a particularly harmful form of illegal disposal, often aimed at drastically reducing company costs.

Pending the conversion of Decree Law 116/2025 into law (expected by 7 October 2025), it is essential that companies do not underestimate the scope of the changes introduced. As we have seen, the new provisions raise the threshold for criminal liability for conduct, particularly in relation to waste, which previously could amount to minor offences and did not give rise to liability on the part of the Entity.

The impact on Legislative Decree 231/2001 is, on this occasion, direct and immediate, as it provides companies with an important opportunity to assess the preventive adequacy of their internal control systems concerning the environment. Such activity could lead to the need to carry out targeted updates of organisation, management and control models (“Models 231”).

The assessment should focus, first and foremost, on highest-risk processes, such as, for example, waste cycle management. In this regard, it would be particularly useful to verify the “robustness” of the company's regulatory and organisational tools relating to waste management, with particular attention to the implications associated with temporary storage.

The adaptation of Model 231 and the relevant internal protocols is, in fact, the technical prerequisite for aligning the compliance system with the new predicate offences. Such updating, together with the consequent activities for the effective implementation of Model 231 (such as supervision by the Supervisory Body, audits and training), is therefore functional to preserving the requirements of suitability and effective implementation imposed by Legislative Decree 231/2001 for the purposes of potential recognition of the effect  of exempting the entity from  liability in court.

We remain at your disposal to carry out the necessary in-depth analysis to understand the practical impact of the regulations in question on your business.

[1] The content of this article is for informational purposes only and does not constitute professional advice.

[2] The Decree Law deals, in particular, with the following cases, increasing penalties and providing for new aggravating circumstances: (i) “Trafficking and abandonment of highly radioactive material” (Article 452-sexies of the Italian Criminal Code); (ii) “Offences relating to unauthorised waste management activities” (Article 256 of Legislative Decree No. 152/2006); (iii) “Illegal shipment of waste” (Article 259, paragraph 1, Legislative Decree No. 152/2006); (iv) “Organised activities for the illegal trafficking of waste” (Article 452-quaterdecies of the Italian Criminal Code).

^[3] This exclusion appeared particularly problematic and critical with regard to the offence of “omitted reclamation” (Article 452-terdecies of the Italian Criminal Code), as its omission fuelled intense debate about the consistency of the repressive system. Authoritative doctrine had repeatedly emphasised that such gap undermined the very rationale of Law No. 68 of 22 May 2015, which was to strengthen criminal protection of the environment, including through the involvement of legal persons. C. Ruga Riva, I nuovi delitti contro l’ambiente, in G. L. Gatta (ed.), La riforma dei reati ambientali. Commento alla legge 22 maggio 2015, n. 68, Dike Giuridica, Rome, 2015, pages 115 et seq.. Decree Law 116/2025 finally repaired this systematic fracture, realigning the catalogue of predicate offences with the actual offensiveness of the conduct and the need to punish not only polluting actions but also omissions that perpetuate their harmful effects in the interest of companies.

[4] Contamination Threshold Concentrations

[5] Risk Threshold Concentrations

[6] In this regard, see, among others, G. Gallone, L’individuazione del responsabile della bonifica: giudice amministrativo e giudice penale a confronto, in Urb. e App. 4/2020, pages 449 et seq.

See also Report No. III/04/2015 of the criminal sector of the Office of the Massimario of the Court of Cassation, where, precisely in relation to the case referred to in Article 257 of the TUA, it is specified that “the introduction of the reservation clause “Unless the act constitutes a more serious offence” ensures [..] that it can only apply in cases where the risk thresholds have been exceeded but have not reached (at least) the level of pollution, i.e. where there has been no significant and measurable impairment or deterioration of the assets (water, air, etc.) listed in Article 452-bis”.

^[7] «If the act results in danger to the life or safety of persons or danger of compromise or deterioration:

1) of water or air, or of extensive or significant portions of the soil or subsoil;

2) of an ecosystem, biodiversity, including agricultural biodiversity, flora or fauna;

b) if the act is committed in contaminated or potentially contaminated sites within the meaning of Article 240 or in any case on roads to access the aforementioned sites and related appurtenances» 

^[8] In a nutshell, pursuant to Article 185-bis of the TUA, temporary storage of waste is only permitted if (i) it is done at the production site (or, for farmers, at cooperatives or consortia) and, in specific cases, also at points of sale (for waste with extended producer responsibility or construction/demolition waste); (ii) safety standards for hazardous and pollutant-containing waste (storage, packaging and labelling) are complied with; (iii) waste is collected at least every 3 months or when a total of 30 m³ (of which a maximum of 10 m³ is hazardous) is reached, and in any case within one year; (iv) waste is grouped into homogeneous categories. The Supreme Court case law consistently affirms that exceeding the quantitative or time limits set out therein results in the activity being reclassified as “uncontrolled storage” or “abandonment”.

Her arrival represents a further step in ADVANT Nctm’s growth in the area of corporate criminal law, also following the recent hiring of Luigi Orsi and Alice Baccin, which completes the structure of the current team, integrating synergistically with the firm’s existing expertise in compliance, thanks to the work of lawyers Paolo Gallarati, Raffaele Caldarone and Luca Cavagnaro. At the same time, a department specialising in White Collar Crime, Investigations & Compliance will be established, which will be coordinated by Raffaella.

This move strengthens the firm’s ability to provide clients with a fully integrated and strategic service in connection with the full spectrum of compliance activities and support in managing criminal risks related to their activities. 

With extensive professional experience in corporate criminal law, Raffaella Quintana is top-ranked in leading international directories and deals with white-collar crime issues of all varieties, with a particular focus on cases concerning crimes against the Public Administration, tax crimes, corporate and bankruptcy related criminal offences, as well as environmental and health & safety criminal matters, privileged internal investigations and quasi-criminal corporate liability pursuant to Legislative Decree 231/2001. 

Raffaella Quintana joins the ADVANT Nctm’s Rome office with a team that includes Francesco Lalli and Federico Lucariello (Managing Associates), Ornella Belfiori and Francesca Cannata (Senior Associates) and three Trainees (Matteo Nicolì, Paolo Vespa and Jacopo Nicolaj).

“We are delighted to welcome Raffaella and her team, and we are confident that this collaboration will enable the firm to strengthen and expand its offering, providing clients with increasingly comprehensive and solid legal assistance focused on complex transactions”, commented Paolo Montironi, Senior Partner at ADVANT Nctm. “In an increasingly complex regulatory environment, strengthening our criminal law practice will indeed enable us to better protect our clients, increase our competitiveness and offer high-level multidisciplinary solutions.”