CMS Expert Guide To Mandatory Reporting Of Criminal Offences For Companies And Their Responsible Persons in Germany

Under German law, private individuals and companies are generally not obliged to report criminal offenses. An exception to this principle applies in the case of particularly serious crimes, such as murder, manslaughter, and robbery (see Section 138 of the German Criminal Code (StGB)). However, the offense is only relevant if someone credibly learns of such an intention at a time when its execution or success can still be prevented and fails to report it to the authorities or the threatened party in time.

Irrespective of this, however, there may be a civil or corporate law obligation to investigate indications of illegal or criminally relevant behavior by employees. This applies in particular if the continuation of the employee's behavior could damage the company or the company's assets.

In some cases, special laws regulate the obligation to report criminal offenses or suspected criminal conduct. For example,

• credit institutions, financial services institutions and other entities subject to money laundering provisions are required to notify the German Financial Intelligence Unit, if they discover facts indicating that an asset related to a business relationship or transaction originates from a criminal act that could constitute a predicate offence of money laundering or a business transaction related to terrorist financing (Section 43 German Money Laundering Act).
• Courts and authorities of the federal government, state governments, and local public administration bodies must report any facts that come to their attention in the course of their duties and that give rise to suspicion of subsidy fraud to the law enforcement authorities (Section 6 of the Subsidy Act).

Unlike private individuals and companies, criminal judges, public prosecutors, and police officers are generally obliged to report criminal offenses if they become aware of them in the course of their official duties. Otherwise, they risk being prosecuted for obstruction of justice (Section 258 German Criminal Code).

As there generally is no reporting obligation for private individuals or legal entities, there is also no rule stating who in the company should report an offence.

According to corporate law principles, members of the board are responsible for ensuring legal compliance. If they become aware of a criminal offence committed within the company, they must consider whether reporting the offence would benefit the company. In each case, the pros and cons of filing a criminal complaint must be carefully weighed up.

As mentioned above, the risk of non-reporting primarily affects public officials and serious criminal offences, since there is no general reporting obligation for private individuals or companies.

Risk of Retaliation and Workplace Reprisal

Whistleblowers or employees who disclose or report criminal offences or suspicions may face retaliation, such as harassment, demotion or dismissal. The Hinweisgeberschutzgesetz (HinSchG), which came into effect in July 2023 to implement the EU Whistleblower Directive, offers protection against such retaliation.

According to Section 36 HinSchG, retaliation against a whistleblower is prohibited. As a prerequisite for whistleblower protection, Section 33 (1) No. 2 HinSchG requires that the whistleblower had sufficient reason to believe that the information reported was true at the time of the report.

Legal Risks from False or Malicious Reporting

To avoid potential criminal risks arising from false or malicious reporting, it is essential that any criminal complaint or accusation is made in good faith and based on reasonable grounds.

According to Section 164 of the German Criminal Code (falsche Verdächtigung), anyone who, despite knowing better, intentionally accuses another of having committed an unlawful act or a breach of an official duty before an authority or a public official competent to receive criminal reports, is liable to prosecution.

According to sections 186 (üble Nachrede) and 187 (Verleumdung) of the German Criminal Code, defamation or insult through unfounded allegations, for example by knowingly submitting a false report, can also trigger criminal liability.

Confidentiality and Professional Secrecy

Certain professions in Germany, such as doctors, lawyers, tax advisors and auditors, are bound by confidentiality obligations. Violating these obligations without a legal basis can lead to criminal liability under section 203 of the German Criminal Code or professional disciplinary action. Reporting criminal offences that involve professional secrets must therefore navigate these rules carefully.

Personal Safety and Privacy Concerns

Individuals or companies reporting serious crimes, such as organised crime or abuse, may fear personal reprisals or threats. Although Germany has mechanisms for protecting the identities of whistleblowers and ensuring their safety, as set out in the Hinweisgeberschutzgesetz (HSchG) and supported by law enforcement agencies, practical risks remain.

One way to prevent or reduce such risks is to file anonymous criminal complaints. However, anonymous criminal complaints are often not taken as seriously by the investigating authorities, who consider them to be less credible.

From a purely formal perspective, criminal proceedings in Germany are always directed against an individual and not a legal entity because no formal corporate criminal law exists. However, in Germany, untechnically speaking, there is a de facto corporate criminal law that plays a significant role in practice and, due to which, companies can become the subject of criminal proceedings. As a rule, under German law, financial sanctions or regulatory fines in the context of a criminal proceedings can be imposed on a legal entity only if individuals acting on behalf of the entity committed a criminal or regulatory offense. In highly simplified terms, two potential sanctions against legal entities are relevant in this context: a regulatory fine (according to sec. 30 and 130 of the Code on Regulatory Offenses ("OWiG") and asset recovery (in accordance with Sections 73 et seq. of the German Criminal Code).

1. Regulatory fine

A legal entity may be subject to regulatory fines if an individual acting as their legal representative (or in a comparable position) commits a criminal or regulatory offense. This offense must result in either the infringement of duties incumbent on the legal entity or the enrichment of the legal entity (so-called "Verbandsgeldbuße," Section 30 OWiG). Section 30 OWiG is broadly worded and covers all persons responsible for a legal entity, e.g., management board members, directors, and shareholders with the right to representation. If a person with managerial responsibility in a company intentionally commits a crime, fines of up to  EUR10,000,000 can be imposed on the company.

b. Asset recovery

The German asset recovery regulations (sections 73 et seq. of the German Criminal Code and section 29a OWiG) aim to recover assets derived from criminal or regulatory offenses. These assets may be recovered not only from the alleged offenders, but also from the legal entities on whose behalf the alleged offenders were acting. In simplified terms, the regulations are based on the legal principle that criminal offenses should not be economically worthwhile and aim to discourage potential offenders.

An asset recovery/confiscation order can be issued against a legal entity when a representative of that entity commits a criminal offense, resulting in financial benefit to the entity (confiscation of proceeds of crime according to sections 73 et seq. of the German Criminal Code (also known as "Einziehung"). Such an order can also be imposed in regulatory fine proceedings (confiscation of the value of the proceeds of an offense according to Section 29a OWiG, or "Einziehung"). For example, if contracts are obtained through bribery, the authorities may confiscate the entire turnover generated from these contracts, not just the profit.