The EU Anti-Corruption Directive: What It Means for Companies – Skadden, Arps, Slate, Meagher & Flom LLP

Jonathan Benson Andrew M. Good Michael Albrecht vom Kolke Margot Sève Jason Williamson Guilhem Le Gars Arndt Noeske
Executive Summary
__________
On April 29, 2026, the European Parliament and the Council of the European Union adopted a new directive (Directive) to harmonise the criminal law frameworks of EU member states that target corruption.
While companies already subject to robust anti-corruption frameworks — such as France’s Sapin 2 law and the UK’s Bribery Act (UKBA) — may find some overlap between those laws and the Directive, the Directive goes further in key aspects and expands anti-corruption law compliance expectations to all companies regardless of size. That will have the effect of implicitly creating new compliance expectations across the EU.
Significant new provisions that will affect companies operating in the EU include:
Here we will focus on its impact on France and Germany-based companies, as well as those subject to the UKBA.
Harmonisation of Corruption Offences
The Directive defines and criminalises a comprehensive set of corruption-related offences, most of which are already recognised in the national laws of member states. These include:
Notably, the Directive creates a new offence of enrichment from corruption, which criminalises the intentional acquisition, possession or use of property by a public official who knows that such property was derived from corruption offences committed by another public official. The Directive also introduces an offence of concealment, targeting the intentional disguising of the true nature, source or ownership of property derived from corruption offence.
Liability of Legal Persons
A critical development for companies in certain member states is the Directive’s corporate liability framework. Legal persons can be held liable for corruption offences committed for their benefit by persons in leading positions — those with power of representation, decision-making authority, or authority to exercise control within the entity.
French domestic law currently provides for criminal liability of legal entities for acts committed by their organs or representatives. We do not currently anticipate any modification to the existing framework on this point. The Directive is different (and arguably narrower in scope) than the UK’s failure to prevent bribery offence, which is triggered where an “associated person” of a company commits active bribery.
Crucially, the Directive goes further by introducing liability where a lack of supervision or control by a person in a “leading position” within the organisation makes possible the commission of a corruption offence for the benefit of the organisation by another person acting under his or her authority (e.g., an agent) . This provision, which has a direct equivalent in Sections 30, 130 German Act on Administrative Offences (Gesetz über Ordnungswidrigkeiten, or OWiG) but no direct equivalent in French law, effectively creates an implicit obligation for companies to implement internal control programs to prevent and detect corruption, including through third parties acting under the authority of the legal person (similar to the failure to prevent bribery offence in the UK, which includes a defence of “adequate procedures”).
This provision could require an adaptation of French law where it does not correspond to the existing framework of complicity already sanctioned under French law. In April 2026, the German Federal Ministry of Justice and Consumer Protection published a draft act separate from the directive that amends Sec. 30 OWiG by substantially increasing the maximum fines that may be imposed on companies in Germany, without linking them to the worldwide turnover.
Companies that have already established compliance programs — whether or not they fall within the scope of the French Sapin 2 law or other anti-corruption laws — will be better positioned to defend against such liability than those that have not.
Penalties for Legal Persons
The Directive requires member states to impose sanctions against legal entities for misconduct within scope of the Directive. For offences of bribery in the public and private sector and misappropriation, the penalty must be at least 5% of the company’s annual worldwide turnover or €40 million. For trading in influence, obstruction of justice and enrichment offences, the penalty must be at least 3% of total worldwide turnover or €24 million. Member states may introduce penalties significantly higher than the floors detailed above.
In addition to fines, legal persons may face a range of additional sanctions, including exclusion from public tenders and grants, temporary or permanent disqualification from business activities, withdrawal of permits and authorisations, judicial supervision and even judicial winding-up.
These penalty levels represent a significant increase compared to the fixed, offence-specific fines currently provided under the French Penal Code or the OWiG (which currently caps corporate fines at €10 million for intentional offences) and will require upward adjustment during transposition into member states’ law.
Aggravating and Mitigating Circumstances
The Directive sets out aggravating circumstances that must or may be taken into account by courts when sentencing, including where the offence was committed within the framework of a criminal organisation, where the offender is a high-level official, or where the offender obtained substantial benefit or caused substantial damage.
Equally important for companies, the Directive formalises mitigating circumstances. Where a legal person has implemented effective internal controls, ethics awareness and compliance programs prior to or after the commission of the offence, this may be regarded as a mitigating factor. Similarly, where a legal person swiftly and voluntarily discloses the offence to competent authorities and takes remedial measures upon discovery, lower penalties may be considered.
These mitigating factors of cooperation and self-disclosure — already informally recognised in some member states, such as through France’s guidelines published by the Parquet National Financier for the judicial public interest agreement (convention judiciaire d’intérêt public, or CJIP) — will, under the Directive, become part of the positive law of all member states.
Limitation Periods
The Directive establishes minimum limitation periods for the investigation, prosecution and adjudication of corruption offences. For offences punishable by a maximum term of imprisonment of at least four years — which includes most of the core corruption offences — the minimum limitation period is eight years from the time the offence was committed. For offences punishable by a maximum term of at least three years, the limitation period is at least five years. For enforcement of sentences following a final conviction, the limitation period is at least 10 years for serious penalties and at least five years for less severe ones.
Given the derogation provided for in paragraphs 3 and 4 of Article 19 (which allow shorter limitation periods if the member state’s law provides for interruption or suspension of the period), French law will not require amendment on this point. In Germany, the current standard limitation period for typical public bribery offences is already five years. This is distinct from the UKBA, which does not contain any limitation period.
Prevention and Compliance
While the Directive does not directly mandate the implementation of compliance programs by companies — a point on which it is less prescriptive than the French Sapin 2 law — the interplay between the new corporate liability for failure of supervision and the recognition of compliance programs as a mitigating factor creates strong incentives for companies to establish robust internal controls. The Directive references “internal controls, ethics awareness, and compliance programs” as elements that may be considered by courts, which may include a risk map, a code of conduct, third-party evaluation, and internal control and audit mechanisms.
On the public sector side, the Directive requires member states to adopt national anti-corruption strategies, establish specialised anti-corruption bodies, conduct risk assessments of sectors most vulnerable to corruption, and implement training programs for public officials and law enforcement.
The Directive will require member states to transpose the Directive into their own laws within 24 months of adoption, with an additional 12 months allowed for provisions relating to risk assessments and national strategies.
For companies that have implemented comprehensive compliance programs to comply with other anti-corruption regimes, such as France’s Sapin 2 law or the UKBA, or existing German administrative frameworks, the Directive should not present insurmountable challenges. However, there are certain key differences compared to other anti-corruption laws and aspects that warrant careful attention:
Companies with operations in the EU should consider reviewing and, where necessary, strengthening their anti-corruption compliance programs now. In particular, they should ensure that their programs include adequate risk assessments, codes of conduct, training, third-party due diligence and internal reporting mechanisms. Where necessary, compliance programs should also take account of the differences between the Directive and other anti-corruption regimes the corporation may be subject to. Companies should also consider monitoring transposition developments in each relevant member state, as the Directive establishes minimum rules and member states remain free to adopt or maintain more stringent standards.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.

source