EU’s Anti-Corruption Package: Insights and Recommendations for Indian Businesses

1. An overview of the Package

The Package aims to update the existing EU anti-corruption framework, address corruption risks in both the public and the private sector and set a substantial threat of sanctions and other adverse consequences to deter corruption.

To date, most anti-corruption laws have not been harmonised across the EU and are regulated by diverging national laws. A notable exception is the 2017 directive on using criminal law to protect the EU’s financial interests.²  This directive already harmonised definitions of a few corruption offences affecting the EU’s financial interests, namely fraud affecting the EU budget,³  active and passive corruption (including corruption committed abroad), and misappropriation of funds by a public official.⁴

The Package is a significant step forward in a harmonised fight against corruption in the EU. It aims at implementing an upgraded EU-wide anti-corruption strategy in order to prevent the high societal costs of corruption cases and ramp up enforcement, including enforcement of corruption offences committed outside the EU. The Package consists of three main elements:

1. The joint communication, which outlines the already existing anti-corruption tools.
2. The proposal for a directive on combatting corruption through criminal law reform (“Directive”).⁵
3. The proposal for a regulation expanding the Common Foreign and Security Policy (“CFSP”) sanctions toolbox.⁶

The joint communication

The joint communication sets out the EU’s commitment to work towards a comprehensive and strategic approach to fight corruption worldwide. It outlines the EC’s idea to bring together law enforcement authorities, practitioners, civil society, and other stakeholders across the EU to map areas with a high risk of corruption. The results of these efforts should guide the future EU anti-corruption strategy.

The Directive

The Directive aims to harmonise definitions of several corruption-related offences and ensure that all EU countries criminalise these offences. The Directive also seeks to address obstacles to effective investigation and prosecution, such as short statutes of limitation, opaque procedures for waiving immunities and privileges, limited availability of resources, training and investigative tools. Specific notable developments introduced by the Directive are covered in Section 3 below.

Importantly for Indian companies, the proposed Directive will cover acts of corruption or bribery, even if they were committed outside the EU. For a court in the EU to have jurisdiction, it will be sufficient that either the offender is a national or has habitual residence in one of the Member States, or if the offences are committed for the benefit of a legal person established in the EU.⁷

The proposed regulation on CFSP sanctions

The text of the regulation on CFSP sanctions has not been made public yet. In principle, the sanctions would be used to target individuals and entities involved in acts of corruption. In the past, a CFSP sanctions regime has been used to target persons and entities undermining democracy and the rule of law in Moldova and Lebanon. The sanctions may consist of travel bans and a freeze of assets, and they may be used against perpetrators, their associates and those facilitating the offending conduct.

2. Key developments introduced by the Package

Extension of the list of EU corruption offences

The Directive will extend the list of corruption-related offences across the EU and harmonise their definitions. Apart from active and passive bribery, the Directive will oblige EU Member States to criminalise misappropriation of public funds, trading in influence, abuse of functions, obstructions of justice, and illicit enrichment related to corruption offences.

Private sector bribery

The Directive will cover bribery in the private sector in addition to bribery in the public sector, in both the active and passive form.⁸  To be captured by the Directive, private bribery has to be committed intentionally and in the course of economic, financial, business or commercial activities. In short, the Directive defines active private bribery as the giving or receiving of "undue advantage" or a promise of undue advantage for the purpose of inducing a person leading or working for a private sector entity to renounce his duties.⁹  Passive private bribery is also included in the directive and effectively means that a person requests or accepts to receive a bribe.¹⁰

Liability of legal persons

Pursuant to the proposed Directive, EU Member States are obliged to make legislative changes in their national laws to ensure that legal persons can be held liable for offences covered by the Directive. A legal person can be held liable in two circumstances. First, if the offence is committed for its benefit by a person in a leading position within the legal person.¹¹  Second, if the commission of the offence for the benefit of the legal person was made possible by a lack of supervision or control by a person in a leading position within a company.¹²  The liability of legal persons does not exclude the concurrent liability of natural persons.

Harmonising sanctions and aggravating and mitigating circumstances

The proposed Directive includes more uniform, stringent penalties and introduces the imposition of sanctions for both natural and legal persons committing corruption-related offences. For legal persons, the Directive prescribes criminal or non-criminal fines of not less than 5% of their total worldwide turnover. However, Member States may set higher maximum penalties. The Directive also harmonises relevant aggravating and mitigating circumstances when determining penalties for corruption-related offences.

3. Potential impact of the Package on Indian Companies

The Directive will oblige EU Member States to (further) criminalise a number of corruption-related offences, such as trading in influence, misappropriation of public funds, and illicit enrichment. Indian companies should be cautious, not only with regard to bribery and corruption but also with regard to related activities covered under the Directive which may invite criminal liability.

Indian law differs from the Directive mainly in respect of private bribery. Although Indian companies are expected to follow best practices and avoid any unfair conduct including bribery, this has not been mandated by Indian law. The Prevention of Corruption Act, 1988 (“PCA”) which encompasses anti-corruption and anti-bribery laws in India, does not cover bribery in the private sector. The Indian Parliament introduced the Prevention of Bribery in the Private Sector Bill in 2018, including a proposal for the private sector, but this has not yet entered into force. Therefore, the inclusion of private bribery under the Directive will have a significant impact on Indian companies and their subsidiaries in the EU, as they will have to be more conscious when operating in the private sector. These companies operating in the EU will have to develop and implement various safeguards and processes, in order to comply with the new Package.

Furthermore, EU Member States currently have different conditions for the liability of legal persons for corruption and bribery offences. Such conditions will now be harmonised by the Directive. Under the new Directive, liability is applicable when the offence is committed for the benefit of a legal person by any person with leading positions within the company, or by other persons under their control or supervision. The Directive sets out consistent penalty levels, alternatives to imprisonment, and aggravating and mitigating factors for both natural and legal persons.

Indian companies and their subsidiaries operating in the EU cannot shift all liability to their personnel and shield the company completely. Both the company and its personnel can be held liable at the same time. Moreover, the Directive applies to conduct committed even outside the EU, if the offender is a national or has a habitual residence in the EU and/or the offence committed is for the benefit of a legal person established in the EU.

Lastly, the Directive extends the limitation period up to 15 years, depending on the seriousness of the offence. This extension should enable enforcement and prosecuting institutions to effectively investigate, prosecute, trial and adjudicate the criminal offences as set out in the Directive.¹³ It is therefore of utmost importance that companies operating in the EU retain and store their data according to the requirements of EU law.

4. Suggestions

Companies usually manage bribery and corruption risks through a mix of internal processes, certification requirements, and basic practices throughout their operations. Indian companies and their subsidiaries operating in the EU could consider adopting the following measures to avoid corrupt practices and possible enforcement proceedings:

1. Compliance programs: Revisiting their existing compliance program and enhancing it to address the potential liability risk. The enhancement of the compliance program may be initiated by a detailed risk assessment, which looks into the company’s operations, engagement with third parties, as well as into prevailing practices such as gifting, sponsorships, and donations, and sets the appropriate standards to be followed by their employees and third parties operating on their behalf.
2. Protection of whistleblowers: Misconduct is often reported by whistleblowers and adequate protection and immunity serves as an incentive to them. Companies should create safe spaces where incidents can be brought to light without fear of retaliation.
3. Regular training: It is important for companies and its personnel to keep abreast of laws, regulations and policies on anti-bribery and anti-corruption and to provide employees with regular training on ethics and compliance to ensure that similar misconduct over time is properly reported. The training should include the training of senior management, who may trigger liability under the Directive. Moreover, it is important to take strict and serious measures against cases of non-compliance with internal anti-corruption or anti-bribery policies.
4. Third-party due diligence: Conducting due diligence not only on employees but also on third parties, such as suppliers and service providers. Procedures that can be undertaken include recurring background screening to identify any red flags, such as adverse media reports, political links, or appearances on sanctions and watch lists.
5. Monitoring and audit: Establishing suitable systems and controls to monitor their employees and third parties, and audit their operations and the level of compliance with the law and policies.
6. Act and improve: Acting upon any red flags of misconduct, investigate them and take appropriate remedial actions. Learn from those incidents and improve the company’s compliance program on an ongoing basis.

5. Conclusion

The European anti-bribery landscape is changing, and those changes are likely to affect globally operating companies, including Indian companies engaged in Europe. The emerging EU law is different from Indian local law in several aspects highlighted above. Hence, for Indian companies, adhering to the local standards abroad may be revealed as insufficient to address the liability and reputation risks. It is advisable to assess those risks and adjust the applicable compliance programs to address the evolving risks.

Please feel free to reach out in case of any remarks and/or questions.

This publication is a cooperation between Norton Rose Fulbright and Indian law firm Cyril Amarchand Mangaldas. In case of any questions to the CAM team, please reach out to Sara Sundaram (sara.sundaram@cyrilshroff.com), Faraz Alam Sagar (faraz.sagar@cyrilshroff.com) or Gaurav Jain (gaurav.jain@cyrilshroff.com).