Liability for violations of compliance is a complex and constantly evolving area of law, which is of great importance both in the national and international context. In recent years, the case law in Germany and the EU has identified liability risks for companies and their bodies (e.g. Managing Director, Executive Board members) in connection with compliance violations significantly intensified. Here is a comprehensive explanation of current developments and principles:
1. Liability of companies
Companies can be liable for compliance violations, both civil and criminal. In recent years, case law has strengthened corporate responsibility, in particular by:
(a) Corporate criminal law (association criminal law)
- § 30 OWiG (Infringement of Orders Act): Companies can be charged with fines of up to EUR 10 million or higher (depending on the economic advantage) for compliance violations by their employees or bodies. The case law has made it clear that companies are also liable for violations abroad if they were committed by German employees.
- § 130 OWiG: Companies are liable for the breach of supervisory obligations if they do not take appropriate compliance measures to prevent infringements. The case law emphasises that companies must implement an effective compliance management system (CMS).
(b) EU law and international developments
- EU Whistleblower Directive: Since December 2021, companies in the EU have to establish internal whistleblower reporting channels. The case law has strengthened the obligations of companies to set up such systems.
- Money laundering directive (AMLD): Companies in the financial sector must comply with strict compliance requirements to prevent money laundering. Infringements can lead to high fines.
(c) Civil liability
- Companies may also be liable for compliance violations under civil law, e.g. against business partners, customers or shareholders. The case law has in some cases recognized claims for damages due to breach of due diligence obligations.
2. Liability of managing directors and board members
Managing directors and board members can personally be liable for violations of compliance, especially if they violate their obligations. Case law has developed the following principles:
(a) Organ liability according to § 43 GmbHG or § 93 AktG
- Managing directors and board members must ensure that the company complies with all legal requirements. Violations of compliance requirements can lead to claims for damages.
- The case law emphasises that organs must implement and monitor a functioning compliance system. A breach of this obligation can be considered as a breach of duty.
(b) Criminal liability
- Managing directors and board members can be liable for criminal law, e.g. for corruption, fraud or money laundering. The case-law has clarified that institutions may also be liable for breaches of staff if they have violated their supervisory obligations.
- Example: In case of "Siemens Board members were personally held responsible for corruption violations.
(c) Supervision obligations
- The jurisprudence has exacerbated the supervisory obligations of managing directors and board members. You must ensure that the company has an effective compliance management system and is regularly monitored.
- Example: In case of ‘VW-diesel scandal was discussed to what extent board members are liable for the lack of monitoring of compliance risks.
3. Compliance Management System (CMS) as a liability avoidance
The case law emphasises that an effective compliance management system (CMS) is crucial to minimise liability risks. A CMS shall include the following elements:
- Risk assessment: Identification of compliance risks.
- Directives and procedures: Clear rules for compliance with laws and internal regulations.
- Training: Regular training of employees.
- Reporting systems: setting up whistleblowing systems.
- Monitoring and control: Regular review of compliance measures.
The case law has clarified that a missing or insufficient CMS can be regarded as a breach of duty.
4. Current developments in case law
- Supply Chain Care Obligations Act (LkSG): Since 2023, companies in Germany have been required to ensure that their supply chains are free from human rights violations. The case law is expected to increase liability for violations of the LkSG.
- Climate protection and ESG compliance: Companies must increasingly take into account environmental, social and governance risks (ESG). The case law develops new liability principles here.
- Digitalisation and data protection: Violations of the GDPR can lead to high fines. The case law has strengthened the liability of companies and bodies for data protection violations.
5. International developments
- US Foreign Corrupt Practices Act (FCPA): Companies with business relationships in the US must comply with strict anti-corruption rules. The case law confirmed the international reach of FCPA.
- UK Bribery Act: British laws also have a global reach and can lead to liability risks for German companies.