Italian corporate criminal liability: the model that defends you
Italian law makes the company itself a defendant for offences committed in its interest by senior figures or by people under their direction. It applies to foreign companies operating here. And the defence is not about the facts: it is about whether an organisational model existed before the offence, addressed that specific risk, and was demonstrably working.
How the liability is built
| Element | Content | Note |
|---|---|---|
| Who committed the offence | Senior figures, or persons under their direction | The burden differs between the two |
| In whose interest | The entity's interest or advantage | Not merely committed at work |
| Listed offences | Only offences the statute lists | The list has grown steadily |
| The defence | An adopted and effectively implemented model | Assessed as at the time of the offence |
| Supervisory body | Autonomous, with real powers and resources | Its inactivity defeats the defence |
| Penalties | Financial sanctions in units, and disqualification | Disqualification can stop the activity |
The distinction in the first row matters more than anything else. Where the offence was committed by a person under the direction of others, the prosecution must show an organisational failure. Where it was committed by a senior figure, the entity has to demonstrate that the model was adopted and was being circumvented fraudulently — a considerably harder position.
Foreign companies
The regime applies to entities operating in Italy regardless of where they are incorporated, and a group compliance programme drafted for another jurisdiction is not a model in the Italian sense. It may be an excellent programme and still fail, because the assessment is against the specific catalogue of offences and the specific risks of the Italian activity.
The recurring failure is exactly that: a global code of conduct, a whistleblowing channel and an annual training module, none of which maps onto the Italian offence list or onto how the Italian operation actually works.
What "effectively implemented" means
This is where models fail in court. A document that exists but is not operating is treated as if it did not exist, and courts look for evidence of life rather than of drafting.
- Risk mapping against the actual activities carried on in Italy, not a generic list.
- Protocols that describe how decisions are really taken, with segregation and traceability.
- A supervisory body that meets, records what it found, and can show it was given information and acted on it.
- Disciplinary system that has actually been applied at least once, because a system never used is not a system.
- Updating after changes in the business and after each extension of the offence list.
- Training that is documented, targeted and attended by the people who take the relevant decisions.
When the offence has already happened
Adopting a model afterwards does not provide the defence, but it is not pointless: adopting an adequate model and returning the profit before the opening of the trial reduces the financial sanction and can prevent disqualification measures, which are usually the greater threat.
The other immediate problem is the seizure of the alleged profit, which arrives during the investigation and can extend by equivalent. The ten-day deadline applies, and the framework is in financial crime investigations in Italy.
The company and the individuals are not on the same side
Their interests diverge quickly. It can suit the entity to show that an individual acted fraudulently and against its interest, and it can suit the individual to show that the practice was the company's. Separate counsel from the outset is not a formality: shared representation becomes untenable at the moment it matters.
For foreign firms instructing on these matters, the framework is in the note for foreign law firms.
Frequently asked questions
Does Italian corporate liability apply to a foreign company?
Yes, to entities operating in Italy regardless of where they are incorporated, and a programme drafted for another jurisdiction is not a model in the Italian sense.
Is having a model enough?
No. It must have been adopted before the offence, address the specific risk, and be shown to be actually operating. A document that is not operating is treated as if it did not exist.
Can we adopt a model now?
It does not provide the defence for a past offence, but adopting an adequate model and returning the profit before trial reduces the sanction and can prevent disqualification.
Can the company and its directors share a lawyer?
It is inadvisable. Their interests diverge quickly, and shared representation becomes untenable at exactly the point where it matters.
If proceedings have opened against a company
The model as it stood at the time of the offence is the defence, and it has to be reconstructed with evidence rather than described. First contact is free and covered by professional privilege.