EU Anti-Corruption Directive: what changes for businesses

European radar

As the new judicial year begins, September is an opportune moment to revisit a significant topic from the previous period: the implementation, on 31 May 2026, of Directive (EU) 2026/1021 of the European Parliament and of the Council of 29 April 2026 (the “Directive”), which aims to combat corruption.

Directive (EU) 2026/1021 represents the most comprehensive update to the European anti-corruption framework in two decades. It harmonises a list of criminal offences, strengthens the liability of legal persons — including for failures in supervision or control — and provides for penalties of up to 5% of global turnover or €40,000,000. The Directive was published in the Official Journal of the European Union on 11 May 2026, and Member States have until 1 June 2028 to transpose the new criminal provisions into their domestic legal systems.

Meanwhile, the public consultation on the future ‘EU Strategy to prevent and fight corruption 2027–2030’ closed in July 2026, with the adoption of the EU Anti-Corruption Strategy scheduled for the fourth quarter of that year.

Together, these two European developments make the start of this judicial year an opportune moment for companies to review their prevention, monitoring, and response mechanisms. In Portugal, the effectiveness of compliance programmes directly affects the management of criminal and financial risk; a genuine and demonstrable programme is the primary mitigation tool. A purely formal programme will not offer such protection.

Directive (EU) 2026/1021 replaces the 1997 Convention on combating corruption by officials of the European Communities and Council Framework Decision 2003/568/JHA. It amends Directive (EU) 2017/1371, bringing together a harmonised set of offences, penalties and preventive measures in a single binding instrument.

The reform addresses significant differences between national laws, as well as enforcement gaps and obstacles to judicial cooperation. The aim is to establish a common minimum standard to enable corruption to be investigated, punished and prevented more consistently across the Union.

What is at stake?

Directive (EU) 2026/1021 establishes minimum rules for defining criminal offences and penalties relating to corruption, as well as measures to improve the prevention and combating of corruption throughout the European Union (Article 1).

In practical terms, the new framework comprises five key areas of action:

• A harmonised list of economic criminal offences.
• A strengthened model of liability for legal persons, including for failures in supervision or control.
• Potentially very high penalties, with fines of up to 5% of worldwide turnover.
• Preventive measures and national anti-corruption strategies.
• Minimum limitation periods and appropriate instruments for investigation and judicial cooperation.

This new legislative framework forms part of a broader European agenda.

The Union’s first Anti-Corruption Strategy, entitled ‘EU Strategy to prevent and fight corruption 2027–2030’, aims to complement the Directive with a political and preventive approach.

Meanwhile, the 2026 Rule of Law Report highlighted the entry into force of the Directive as a milestone in the protection of European democracies, economies, and institutions.

What changes in practice?

(a) Catalogue of harmonised offences

Among the main changes is the obligation for Member States to criminalise at least the following conduct:

• Bribery in the public sector: active and passive (Article 3)
• Bribery in the private sector: active and passive (Article 4)
• Misappropriation (Article 5)
• Trading in influence (Article 6)
• Unlawful exercise of public functions (Article 7)
• Obstruction of justice (Article 8)
• Enrichment from corruption offences (Article 9)
• Concealment (Article 10)

The following aspects are particularly noteworthy:

Trading in influence: a long-standing practice in Portugal, further clarified in the Directive

Unlike in most other European jurisdictions, trading in influence is not a new concept in Portuguese law.

Article 335 of the Criminal Code already punishes, in its passive form, anyone who, either directly or through an intermediary, consents to or ratifies the soliciting or acceptance of a pecuniary or non-pecuniary advantage, or the promise thereof, for themselves or a third party, in order to abuse their influence, whether real or supposed, with any public authority, whether national or foreign.

The penalty is imprisonment for between one and five years if the aim is to obtain an unlawful favourable decision, and imprisonment for up to three years or a fine if a lawful decision is at issue. Paragraph 2 also covers the active form, punishing anyone who offers or promises an advantage with the intention of obtaining either an unlawful favourable decision or a lawful one.

Therefore, Article 6 of the Directive does not create a completely new offence in Portugal.

However, it provides a more detailed definition and, in some respects, a broader scope of punishment.

The European definition refers to exerting influence over ‘a public official’, which is a functional concept that may be broader than that of a public body under Portuguese law. It also expressly includes arbitrators and jurors within this definition. The offence covers transactions with ‘any person’, not just public officials.

Finally, Article 6(2) expressly states that it is irrelevant whether the influence was actually exerted or whether it produced the intended result. In other words, it is irrelevant whether the influence was merely supposed.

The transposition should therefore assess whether Article 335 fully covers these provisions. If necessary, formal adjustments should be introduced without presenting the Directive as an entirely new concept within the Portuguese legal system.

Enrichment from corruption offences

Article 9 establishes a distinct offence involving the intentional acquisition, possession, or use of property by a public official who knows that the property in question derives from corruption offences committed by another public official.

This offence is distinct from illicit enrichment in the strict sense, focusing instead on the exploitation of another person’s corrupt proceeds.

Concealment and digital assets

Article 10 criminalises the concealment or disguising of the true nature, origin, location, disposition, movement, rights or ownership of property derived from corruption offences. Given the Directive’s broad definition of property, this provision may cover digital assets, including crypto-assets, if the other elements of the offence are met. This represents a significant update compared with previous legislation.

b) Liability of legal persons

Model of attribution: lack of supervision or control

Article 13 sets out two ways in which a legal person may be held liable for infringements under Articles 3 to 6 and 8 to 11 of the Directive:

• First basis: the offence is committed for the benefit of the legal person by a person in a managerial position by virtue of their power of representation, decision-making authority or control authority, whether acting individually or as a member of a body.
• Second basis: a lack of supervision or control by a person in a managerial position enables a person under their authority to commit an infringement for the benefit of the legal person.

The second route, based on the ‘failure to prevent’ principle, is particularly relevant. A company is liable not only for an unlawful act committed by a body or representative. It may also be held liable if failings in its supervision, internal control and compliance systems allow subordinates to commit offences for its benefit.

A legal person’s liability does not preclude criminal proceedings against the individuals involved, and it can be combined with the perpetrators' civil liability.

Compliance as a mitigating factor

Unlike the UK model set out in the UK Bribery Act 2010 regarding ‘failure to prevent bribery’, the Directive does not treat the existence of a compliance programme as a complete defence against the liability of a legal person.

However, its significance lies elsewhere and is decisive. Under Article 16(1)(c), the adoption and effective implementation of internal controls, ethical awareness measures and compliance programmes designed to prevent corruption, either before or after the offence, may be considered a mitigating circumstance when determining the applicable sanction. The same may apply to voluntary reporting by the organisation concerned, cooperation with the authorities, and the adoption of corrective measures.

In Portugal, compliance will no longer be a mere formality. Programmes that lack adequate resources, autonomy, training, monitoring or evidence of implementation, and which are merely for show (or 'tick-the-box' programmes, as they are commonly known), will not be regarded as mitigating factors. Instead, they may be viewed negatively as mere window-dressing exercises.

On the contrary, a genuine, effective and tailored risk mitigation programme that has been tested and documented will be the primary tool for dealing with penalty thresholds that may reach 5% of worldwide turnover or €40,000,000. This conclusion is not altered by the scope for Member States to adopt more favourable or stricter solutions when transposing the legislation.

Penalties for legal persons

Article 14 requires Member States to provide effective, proportionate and dissuasive penalties for legal persons, including criminal or non-criminal fines with the following minimum thresholds:

• For infringements relating to public or private bribery and misappropriation (Articles 3 to 5): the maximum penalty must not be less than 5% of the total worldwide turnover in the preceding financial year, or €40,000,000.
• For infringements relating to trading in influence, obstruction of justice, or enrichment arising from corruption offences (Articles 6, 8 and 9): the maximum penalty must not be less than 3% of the total worldwide turnover in the preceding financial year, or €24,000,000.

Additional penalties may also be imposed. These include: (i) exclusion from public benefits or aid; (ii) exclusion from public funding, tenders, grants, concessions and licences; (iii) suspension or prohibition of activities; (iv) withdrawal of licences; (v) judicial supervision; and (vi) judicial dissolution in the most serious cases.

And In Portugal?

Portugal already has a robust anti-corruption framework. This is primarily based on the legislative package introduced in 2021, comprising Law 94/2021 of 21 December and Decree-Law 109-E/2021 of 9 December. The latter established the National Anti-Corruption Authority (MENAC) and the General Corruption Prevention Framework (Regime Geral de Prevenção da Corrupção – RGPC).

More recently, Decree-Law 70/2025 has strengthened the structure, governance and operational capacity of MENAC.

Nevertheless, transposing the Directive will require significant adjustments in several areas:

• The Criminal Code and special provisions: the transposition must ensure full coverage of the harmonised catalogue. In the case of trading in influence, the starting point is Article 335 of the Criminal Code, which is already applicable in Portugal. The analysis should focus on the necessary adjustments regarding the functional concept of a public official, the irrelevance of the actual exercise of influence and the express inclusion of arbitrators and jurors. The wording relating to enrichment arising from corruption, concealment, obstruction of justice, and serious breaches in the exercise of public functions will also need to be assessed.
• Criminal liability of legal persons: the Portuguese legal framework already provides for such liability in the Criminal Code and in specific legislation. However, it will be necessary to assess its compatibility with the second part of Article 13, which is based on a lack of supervision or control by a person in a managerial position. It will also be necessary to consider the importance attached by the Directive to effective compliance programmes.
• Penalty framework: the European standard now requires maximum penalties indexed to worldwide turnover of 5% or 3%, depending on the offence. Alternatively, penalties of €40,000,000 or €24,000,000 may be imposed. The thresholds set out in Portuguese law will need to be compared with these European minimums.
• Coordination with the RGPC: the RGPC currently applies to organisations with 50 or more employees and is designed to serve as a preventive measure and address administrative offences. However, criminal liability arising from the Directive is not dependent on this threshold. This reinforces the need to coordinate the RGPC with the new criminal dimension and, in practice, to broaden the range of organisations interested in effective compliance programmes.
• The role of MENAC: MENAC could play an even more significant role in prevention by issuing guidelines, identifying high-risk sectors, and monitoring the effectiveness of regulatory compliance programmes. The Directive also requires national anti-corruption strategies and regular reviews of the sectors most at risk. MENAC is well-placed to contribute to these areas.

A comparison with the European context highlights the urgent need for transposition. In France, for example, the Sapin II model already imposes preventive obligations on certain companies. In Italy, Legislative Decree 231/2001 recognises the mitigating effect of organisational models. Spain has recognised the criminal liability of legal persons since 2010 under Article 31 bis of the Criminal Code. The Directive raises the common standard and puts pressure on the Portuguese legislature to ensure full compliance with the new European minimum standards.

Entry into force

Directive (EU) 2026/1021 came into force on 31 May 2026. Member States must:

• By 1 June 2028: transpose the criminal law provisions, including the list of offences, the liability of legal persons, and the ranges of penalties.
• By 1 June 2029: implement the specific preventive measures, including sector-specific risk assessments and national anti-corruption strategies.

The European Commission will support Member States during the transposition period. The adoption of the ‘EU Strategy to prevent and fight corruption 2027–2030’, for which the public consultation ended in July 2026, is scheduled for the fourth quarter of 2026.

What should you do now?

Regardless of the formal transposition deadlines, companies operating in the European Union should immediately begin reviewing and strengthening their anti-corruption programmes.

The objective is not to anticipate the formal implementation of the Directive, but rather to ensure that, once the new criteria have been transposed, companies can demonstrate the effectiveness of their controls.

It is this capacity for prevention, supervision, detection and response that could be crucial when assessing liability and sanctions.

The immediate priorities should be selective and focused on demonstrating effectiveness.

• Risk assessment: mapping the organisation’s exposure to the offences covered by the Directive. Particular attention should be paid to trading in influence, concealment, relations with public decision-makers, and operations in high-risk jurisdictions.
• Review of the compliance programme: verify that the code of conduct, training, internal reporting channels, approval procedures and incident response are understood and utilised, rather than merely formally approved.
• Third-party due diligence: re-evaluating partners, suppliers, consultants and agents, especially those acting on behalf of the company or maintaining relationships with public bodies.
• Supervision and audit: ensuring that management receives sufficient information, monitors risks and rectifies deficiencies, thereby reducing exposure to liability arising from a lack of supervision or control.
• Documentation of effectiveness: maintaining evidence of assessments, training, controls, decisions, reports of concerns, internal investigations and corrective measures. Without demonstrable evidence, a programme is unlikely to be considered a mitigating factor.
• Legislative monitoring: monitoring transposition in Portugal and other relevant Member States, as well as guidelines issued by MENAC and the European Commission.

In summary

Directive (EU) 2026/1021 raises the European standard for preventing and combating corruption. Steps are being taken towards the harmonisation of offences at European level, the strengthening of legal persons’ liability, the introduction of potentially very severe penalties, and the attribution of concrete importance to the effectiveness of compliance programmes.

For businesses, the message is clear: in Portugal, compliance is here to stay. A genuine, up-to-date, monitored and demonstrable compliance programme is the first line of defence against risk and can act as a mitigating factor in the event of fines which, for certain offences, can reach 5% of worldwide turnover or €40,000,000. A purely formal programme does not offer the same protection and may even be viewed negatively.

The time to test the programme is before it becomes necessary to invoke it.