Series
Blogs
A raised floor across the EU: What the new Anti-Corruption Directive means for business compliance
A raised floor across the EU: What the new Anti-Corruption Directive means for business compliance
31 March 2026
Series
Blogs
31 March 2026
Author: Alexia Kaztaridou
On 21 April 2026, following the European Parliament’s endorsement of the provisional agreement reached with the Council, the Council formally adopted the EU Anti-Corruption Directive. As outlined in our previous blog post, this Directive was introduced with the ambition of modernising the EU’s fragmented anti-corruption framework and addressing enforcement gaps. It adopts a multidisciplinary approach, aiming not only to punish corruption offences but also to foster a culture of integrity through robust prevention measures. For businesses operating in the EU, this new regulatory landscape introduces heightened responsibilities and creates a clear incentive to ensure compliance programmes are genuinely effective.
The text of the Directive, which follows extensive negotiations between the Parliament and the Council, introduces important clarifications and changes compared to the earlier positions of the European Parliament and the Council.
To create a level playing field, the Directive establishes common definitions for a broad range of criminal offences that Member States must transpose into their national laws. The offences that must be penalised, if committed intentionally, now include:
Finally, following a significant push from the Parliament, the text addresses illegal political financing. However, this offence is not regulated by the Directive; instead, Member States are encouraged to consider appropriate action and potential criminalisation.
For companies, the stakes are material. Legal persons must be capable of liability for specified offences committed for their benefit by persons in leading positions, or where a lack of supervision or control made the offence possible for their benefit. Maximum fines must reach at least 5% of total worldwide turnover for bribery and misappropriation offences, and at least 3% for trading in influence, obstruction of justice, and enrichment, with alternative fixed maxima of EUR 40 million and EUR 24 million respectively. Beyond fines, sanctions may include exclusion from public funding and tenders, disqualification from business activities, withdrawal of permits, contract annulment or rescission, judicial supervision, winding-up, and closure of establishments.
For individuals, the Directive sets minimum maximum imprisonment terms: at least five years for certain public-sector bribery offences; at least four years for misappropriation, enrichment, and concealment; and at least three years for private-sector bribery, trading in influence, and other specified offences. Additional measures include fines, removal or suspension from public office, disqualifications, tender exclusions, withdrawal of permits, and publication of judicial decisions where there is a public interest.
In addition, the Directive introduces aggravating and mitigating circumstances. Unless it constitutes a ground for exclusion of liability, the existence of a genuinely implemented and effective compliance programme (as opposed to mere “window-dressing”) may be regarded as a mitigating factor. “Rapidly and voluntarily” disclosing the offence to the competent authorities and adopting remedial measures may also constitute a mitigating factor. As regards aggravating circumstances, to the extent that the following circumstances do not already form part of the constituent elements of the criminal offences, Member States are required to treat the commission of an offence within the framework of a criminal organisation as an aggravating circumstance, whilst the obtaining of a substantial benefit or the causing of substantial damage, to the extent that they can be determined, are aggravating circumstances which Member States may implement in national law.
The Directive builds a robust enforcement architecture centred on national anti-corruption bodies or organisational units. Member States shall ensure bodies are in place for prevention, as well as for repression and investigation, and that they are equipped with adequate resources, specialised training, and operate without undue interference. To support investigations, the framework mandates the availability of effective and proportionate tools, including special measures used against organised crime, and specific powers to trace, identify, freeze, and confiscate the instrumentalities and proceeds of corruption offences. At cross-border level, enforcement is strengthened through the use of the SIENA network for information exchange, the collection of statistical data on the criminal offences, and facilitated cooperation between Member States and EU bodies like Eurojust and Europol. These measures are complemented by requirements for Member States to perform sectoral risk assessments, develop national strategies, and implement a range of preventive tools.
For businesses, exposure is amplified by legal-person criminal liability, significant turnover-based fines, and procurement and public-funding consequences including tender exclusions. The broad definition of “public official” means that seemingly routine commercial relationships may carry bribery risk where they did not before. The explicit inclusion of crypto assets in the definition of “property” adds a further dimension for businesses operating in digital asset markets or using crypto in treasury management.
By harmonising offences and penalties, including for private-sector bribery, and pairing them with prevention, reporting and investigation measures, the Directive is designed to reduce cross-border enforcement friction and increase the likelihood of detection and sanction. The result is a raised floor across all 27 Member States.
However, the compliance-as-mitigation framework creates a direct incentive for robust, effective compliance programmes.
The Directive will enter into force 20 days after publication in the Official Journal of the EU. Member States will generally have 24 months to transpose from the date of the adoption of the Directive, with a longer 36-month deadline for obligations tied to risk assessments and national strategies.
For companies, recommended readiness steps include, but are not limited to, the following: