The International Investigations Review: Italy


Corporate misconduct in Italy is punishable under both criminal and administrative law.

The public prosecutors direct preliminary investigations in criminal prosecutions and issue orders to the police, who investigate.

Under the terms of the Constitution, the public prosecutors' offices are independent of all political influence.

The public prosecutors' offices theoretically have no discretion as to which offences must be prosecuted: under the mandatory prosecution principle (Article 112 of the Constitution), the public prosecutor must always issue a request for indictment (a request to submit the defendant to trial) if, at the end of the investigation, they have found sufficient evidence that a crime has been committed. In practice, the rule is disregarded: the high number of reports of criminal offences imposes a de facto selection of the cases to be dealt with by the investigating authorities, depending on the circumstances, in accordance with the principle of priority.

Some kind of jurisdictional control on the decision of the prosecutor as to which cases to dismiss, and which to prosecute, is in any case granted by the judge of the preliminary investigations, who has the final word on any request for dismissal.

When the prosecutor investigates the possible criminal liability of corporate entities, under Italy's principal anti-corruption law, Legislative Decree No. 231 of 8 June 2001 (Decree 231/2001) (see Section III), the mandatory prosecution principle may be bypassed, because in this case there is no jurisdictional control over the prosecutor's dismissal decision; only the prosecutor's hierarchical superior may personally take any further appropriate action.

From an administrative perspective, the independent administrative authorities2 have specific powers relating to their individual remits. If the officials of any of the authorities discover any offences in the course of their duties, these bodies are obliged to report them to the judicial authorities.

Far-reaching powers are granted to the Italian Securities and Exchange Commission (CONSOB) under the Consolidated Law on Finance,3 with reference to insider trading and market-manipulation offences, and in close cooperation with the public prosecutors. Further, the latter is under an obligation to notify the president of CONSOB when a report of a criminal offence of which they have been made aware involves insider trading or market manipulation by listed companies, with a view to obtaining a reasoned technical opinion on the matter from this independent authority. The main powers granted to CONSOB include the right to:

  1. request documents from any party that may have relevant information;
  2. interview individuals in person;
  3. carry out inspections; and
  4. gain direct access to data contained in the Italian Central Credit Register at the Bank of Italy.

At the end of its own investigation, CONSOB may issue severe administrative sanctions for the offences of market abuse (insider trading, market manipulation), which are meant to be added to the criminal punishment (up to 12 years' imprisonment), for the same facts. In a breakthrough decision, the European Court of Human Rights has convicted Italy, considering this doubling of penalties for the same offences as contrary to the ne bis in idem principle, provided for in the European Convention on Human Rights, Section 6.4 Italy will probably have to rethink the entire system of 'double track' persecution of corporate offences, both in criminal courts and before the administrative authorities, which has been very typical up to now (not only for financial crimes but also for tax crimes and many others).

Besides the foregoing, an increasingly important role has been attributed to the National Anti-Corruption Authority (ANAC), which has the general function of preventing corruption in public offices and now also supervises the conclusion and execution of public contracts. ANAC may also issue sanctions (disqualifications, etc.).

As regards the issue of cooperation between the company under investigation (or its employees) and the investigating body, the presumption of innocence and the right to due process of law (both of which are constitutional principles) categorically exclude any legal obligation to cooperate. However, for an appropriate choice to be made regarding cooperation, a case-by-case assessment must be made of:

  1. the nature of the case;
  2. the seriousness of the alleged conduct;
  3. any incriminating evidence;
  4. the identity and investigative approach of the public prosecutor; and
  5. the possible repercussions of failure to cooperate with the investigating bodies (e.g., the risk of being subject to pretrial precautionary measures).

The decision whether or how to cooperate typically remains part of any defence strategy, for both the individual defendant and the corporation. In practice, in cases in which Decree 231/2001 may apply (see Section III), the burden of the interdiction sanctions that the corporation may face undermines the presumption of innocence and makes cooperation almost a default option for the corporation. Also, taking a typical carrot-and-stick approach, Decree 231/2001 provides certain incentives to corporations that cooperate and plea bargain, such as reduction of fines and refraining from imposing bans.

In such cases, prior to the initiation of trial proceedings, companies must:

  1. make good any damage in full;
  2. eliminate the harmful and dangerous consequences of the offence (or otherwise take action to this effect);
  3. adopt and implement organisational models capable of preventing offences of the type that were committed or eliminate the organisational shortcomings that led to the offences; and
  4. hand over any profits earned for confiscation.

Therefore, if a corporation is directly involved in the proceedings, a cooperative strategy must always be carefully considered.


i Self-reporting

As a matter of principle, under Italian law, private individuals and businesses have the right – but not the obligation – to report to the judicial authorities any offences that may come to their attention. With the exception of some specific cases,5 the decision whether to report an offence is exclusively down to each individual's sense of civic duty and there is no provision for any benefit or incentive.

ii Internal investigations

Italian law allows investigations to be carried out by a lawyer appointed as defence counsel by a person or a corporation in criminal proceedings, or before any proceedings are initiated. Any evidence collected in this way may be used in any subsequent criminal proceedings.6

Italian law allows the lawyer to carry out both ordinary and extraordinary inquiries. Information is collected by the lawyer from persons with relevant information; they do not need to be accompanied by lawyers, but they are under an obligation to tell the truth, violation of which is punished by the Criminal Code. The situation is different if the person to be questioned is a suspect in the proceedings, in related proceedings or for a related offence; in these cases, the presence of a lawyer is mandatory. The case is also different if the witness may be called upon to make self-incriminating statements, in turn risking becoming a suspect; in such cases, the questioner must stop the interview immediately.

Some witnesses with specific qualifications also have the right in criminal proceedings not to answer questions when the answer would entail a violation of professional privilege. This right is granted only to professionals expressly mentioned in the Code of Criminal Procedure or under special legislation, such as lawyers.

Lawyers receive absolute protection at all stages and instances of proceedings, with reference both to attorney–client communications and to work product. It should be borne in mind, however, that according to Italian case law, in-house counsel may not be granted the same privileges as external lawyers, and their computers, emails and hard copies of documents may be subject to search by investigating authorities.

Finally, investigations may be done internally by the staff of the establishment or by independent external advisers. In the first case, investigations are typically carried out by the internal audit service with the backing of the legal department. The advantages of this type of investigation are in terms of lower costs and greater knowledge of the company; however, this type of investigation might not be capable of providing a high enough level of expertise and independence. The internal independent investigation is entrusted instead to independent external advisers that support the administrative and supervisory bodies. The external advisers certainly guarantee better expertise and independence.

iii Whistle-blowers

There was no general provision in Italy regarding whistle-blowing until 30 November 2017, with the entry into force of Law No. 179 on the subject.

The legislation regulating whistle-blowing has emerged gradually as part of the debate in recent years between European and international institutions on the need to introduce valid measures to fight corruption.

The first important Italian intervention in this context took place with the approval of Law No. 190 (the Severino Law), which entered into force on 27 November 2012. The scope of the Severino Law was limited to the public administration and it introduced specific provisions concerning the protection of public servants who report abuse. However, this ordinance did not apply in the private sector and certain additions and revisions were required to align it with the simultaneous evolution of public employment regulations.

The revised Severino Law replaced Article 54 bis of Legislative Decree No. 165 of 30 March 2001, providing for the protection of public employees who, in the interests of the public administration, report violations or unlawful conduct of which they become aware through the employment relationship. Employees cannot be subjected to retaliation (including sanctions, dismissal, demotion or transfer to other offices) for making such a report, or be subjected to any other measures that might have a negative effect on their working conditions.

These reports may be sent either to the internal manager of the corporate structure responsible for preventing corruption and transparency, or to the ANAC, or directly to the ordinary or accounting judicial authority depending on the nature of the report.

Among the peculiarities of this legislation is its confirmation of the prohibition against revealing the identity of a whistle-blower, which must be protected:

  1. in the event of a criminal trial, in the manner and timing established by Article 329 of the Criminal Code;
  2. in the event of an accounting process, from the initiation of the prohibition against revealing their identity until the end of the preliminary phase; and
  3. in the event of an administrative process, from the initiation of the prohibition against disclosing the whistle-blower's identity without their consent.

The ANAC is the authority responsible for applying administrative sanctions.

Specifically, the ANAC can impose a penalty of between €5,000 and €30,000 on those responsible for retaliatory measures against a reporting agent. A significantly higher penalty, of between €10,000 and €50,000, is envisaged if the absence of an internal system for reporting violations is ascertained or if it is found that the system manager responsible has not verified or analysed reports received.

Any discrimination or retaliation against the reporter must in any case be justified by the public administration, which bears the burden of proving and justifying that any measures taken have been taken for reasons unrelated to the notification.

If it is proved that an employee has been dismissed for reasons related to an alert, that employee has the right to be reinstated in the workplace, to compensation for damage and payment of the social security contributions due for the period between dismissal and reinstatement.

The risk of a distorted use of the whistle-blowing instrument has been mitigated with the cancellation of any protection if the reporting person is convicted, even at first instance, in criminal proceedings for slander, defamation or other similar crimes committed through the reporting, or is subject to civil liability if fraud or gross negligence is established.

In addition to introducing significant changes regarding the protection of public employees who report an offence, the law provided modifications to Decree 231/2001 with regard to the protection of employees or collaborators who report illegal activities in the private sector (see Section III).

Law No. 179/2017 added three new paragraphs to Article 6 of Decree 231/2001 to require that the model of organisation and governance (MOG) adopted by a company provides for:

  1. adequate information channels that, ensuring the confidentiality of the identity of the reporting agent, allow individuals in senior positions and those subordinated to them to submit detailed reports of illicit conduct or of violations of the MOG;
  2. at least one alternative signal channel that guarantees the privacy of the reporters;
  3. the prohibition of acts of retaliation or discrimination against the reporter for reasons connected, directly or indirectly, to the report; and
  4. adequate sanctions against those who are in breach of the aforementioned measures to protect the whistle-blower and against those who carry out, with malice or gross negligence, reports that prove to be unfounded.

It is also envisaged that the adoption of the aforementioned discriminatory measures against the reporting officer may be reported to the National Labour Inspectorate, as far as it is responsible, not only by the reporting person but also by the trade union organisation.

As a further protection of the whistle-blower, it is also envisaged that dismissal and retaliatory or discriminatory demotion are invalid and that the burden of proving, in procedural law, that negative measures adopted towards the reporter are based on reasons unrelated to the report.

To align their MOGs with the changes introduced in Decree 231/2001, Italian companies started to update them, providing at the same time a specific whistle-blowing procedure for reporting by employees.

The whistle-blowing procedure should determine specific channels that allow the submission of reports, based on precise and concordant factual elements, guaranteeing the confidentiality of the reporters' identities.

For a full and effective operation of the procedure, the following measures are considered appropriate:

  1. the provision of a person able to receive reports, although the law does not specify a particular recipient for alerts;
  2. the identification of a system of management of violation reports that guarantees the anonymity of the whistle-blower;
  3. the specific training of senior managers, as well as those subordinated to them; and
  4. the integration of the disciplinary system set up by the MOG, with the inclusion of sanctions against those who violate the protection measures of the reporting person and against those who carry out, with malice or gross negligence, reports that prove to be unfounded.


i Corporate liability

Decree 231/2001 regulates the criminal responsibility of corporations with regard to offences committed by their representatives or employees. Even though the Decree provides (formally) for administrative sanctions against corporations, the underlying offence is criminal and it is in criminal proceedings that the offence is ascertained and the sanction imposed.

It is a criminal court that tries the case and the corporation will have all the defence rights and guarantees of a defendant in a criminal trial. Moreover, this kind of provision certainly responds to the Engel criteria (specifically, the nature of the offence and severity of the penalty), under which the European Court of Human Rights considers a punishment to be effectively criminal, in regard to the need to respect the provisions of the European Convention on Human Rights.7

For the criminal responsibility of legal persons to apply alongside the criminal responsibility of natural persons (representatives or employees), the offence must have been committed in the interests of or for the benefit of the corporation. The exclusive benefit of the agent (or a third party) excludes corporate liability.

Article 5 of Decree 231/2001 states that the corporation is responsible if the criminal offence has been committed by:

  1. persons holding representative, administrative or managerial positions in the corporation or in any of its organisational units provided with financial and functional autonomy, or persons in charge of managing and overseeing these positions (referred to as senior managers); or
  2. persons placed under the direction or supervision of any person specified above (referred to as employees).

A corporation may attempt to establish its innocence by providing evidence that the internal organisation of the corporation and its policies and procedures complied with the law and were structured in such a way as to be capable of preventing crimes from being committed.

Originally intended to apply only to offences against the public administration (centred on bribery) or against the assets of the public administration (embezzlement of public money), the responsibility of corporations has been extended through additional legislation to include offences regarding, inter alia:

  1. public deeds or revenue stamps;
  2. criminal offences against individuals;
  3. criminal offences involving market abuse;
  4. bodily harm or manslaughter because of violations of health and safety regulations;
  5. receiving stolen goods;
  6. money laundering and the handling of illicit funds and assets;
  7. cybercrime;
  8. organised crime offences;
  9. offences against trade and industry;
  10. criminal offences against intellectual property;
  11. criminal offences against the environment;
  12. fraud against the state or a public body;
  13. corruption;
  14. forgery of money, tax stamps, credit cards and distinguishing marks of industrial products;
  15. corporate crimes;
  16. crimes of terrorism and of subversion of the democratic order;
  17. inducement not to make statements or to make false statements to the authority;
  18. employment of illegal immigrants;
  19. child grooming; and
  20. racism and xenophobia.

One of the most recent developments has been the extension of the scope of the offence of bribery to include not only bribery of public officials, but also bribery of managers of corporations (commercial bribery), and this is now specifically punished. If acting within a corporate organisation, the briber's company may also be punished (not the company of the bribed party, as it has suffered damage from the act).

Additionally, as of 1 January 2015, corporate liability has been extended to self-laundering (defined in Article 648 ter 1 of the Italian Criminal Code). Therefore, corporations may be liable if their employees, having committed or participated in committing an intentional crime, employ, replace or transfer, in financial, entrepreneurial or speculative activities, money, goods or other benefits derived from the commission of that crime, to hinder the identification of the criminal origins. This new provision has had a significant impact on companies, which have promptly had to adjust their compliance programmes, including taking measures to prevent the commission of self-laundering.

With regard to bribery, Law No. 3/2019 was introduced to strengthen the fight against public corruption by increasing the penalties for the acts of corruption by public officials detailed in Article 25 of Decree 231/2001.

Also in 2019, further changes of relevance were made to the legal regime by Article 5 of Law No. 39/2019, entitled 'Offences relating to fraud in sporting competitions, illegal gambling or betting and games of chance exercised by means of prohibited apparatus', amending Article 25 of Decree 231/2001 to establish monetary sanctions and a minimum term for disqualification.

Additionally, as of 25 December 2019, with the application of Directive 2017/1371 (also known as the PIF Directive), corporate liability was extended to certain tax crimes. Law No. 157/2019 amended Decree 231/2001 by introducing Article 25 quinquiesdecies to punish fraudulent declarations made through the use of invoices or other documents for non-existent operations.

A further extension of corporate liability for tax crimes was introduced by Decree 75/2020, which both transposes elements of the PIF Directive and amends Decree 231/2001. The Decree aims to strengthen the fight against value added tax fraud committed in the context of fraudulent cross-border systems and it provides for the liability of corporations in cases where non-existent credits are used as compensation.

Alongside criminal or administrative liability under Decree 231/2001, and in addition to any administrative penalties that CONSOB or other authorities may impose, a company may also incur civil liability if its directors or employees are held responsible under criminal law. Pursuant to Article 2049 of the Italian Civil Code, a company is strictly liable for all damage caused to third parties by its own employees, representatives or directors, even if the damage is the result of a criminal offence.

The same lawyer may defend both a company and any suspected employee, unless there is a conflict of interest between the two. Only then does the Code of Conduct for Italian lawyers require the counsel to refuse to assist at least one party and not to exploit any confidential information received when defending the other. If, for example, the company's defence asserts that the offence was committed by the employee in the latter's own exclusive interest and for their own benefit, then obviously, according to Articles 6 and 39 of Decree 231/2001, the two parties would require different defence counsel. When the company's defence strategy involves the defence of its staff, that defence will generally be joint or closely coordinated.

Legislative Decree No. 75/2020 introduced Article 25 sexiesdecies, which provides a penalty for the entity if a smuggling offence provided for by Presidential Decree No. 43/1973 is committed.

Law No. 238/2021 titled 'Provisions for the fulfilment of obligations arising from Italy's membership of the European Union – European Law 2019–2020' has amended the crimes contained in Article 24 bis of Legislative Decree 231/2001 'Computer crimes and unlawful data processing' (Article 19 L. 238-2021); the crimes contained in Article 25 quinquies of Legislative Decree 231/2001 'Crimes against the individual personality' (Article 20 L. 238-2021); the crimes contained in Article 25 sexies 'Market abuse' (Article 26 L. 238-2021). In addition, on 14 December 2021, the innovations set forth in Legislative Decree 184/2021 implementing Directive (EU) 2019/713 on combating fraud and counterfeiting of non-cash means of payment came into force. Legislative Decree 184/2021 extends the list of criminal offences constituting grounds for the administrative liability of companies and entities, with the introduction of Article 25 octies in Legislative Decree 231/2001 'Crimes relating to non-cash means of payment'. In this regard, the decree made the following changes to the Criminal Code:

  1. Article 493 ter has been modified in the text and in the heading 'Undue use and falsification of non-cash payment instruments';
  2. the new Article 493 quater has been introduced: 'Possession and diffusion of equipment, devices or computer programs aimed at committing offences regarding non-cash payment instruments'; and
  3. the text of Article 640 ter 'Computer fraud' has been modified, not only if committed against the state or other public body or the European Union, as already foreseen by Article 24 of Legislative Decree 231/2001, but also when the fact 'produces a transfer of money, monetary value or virtual currency'.

In addition, on 15 December 2021, the amendments introduced to the Penal Code by Legislative Decree No. 195 of 8 November 2021 came into force concerning the crimes pursuant to Articles 648, 648 bis, 648 ter and 648 ter 1 of the Penal Code, which have repercussions on the regulations pursuant to Legislative Decree 231/2001 due to the extension of the predicate offences.

In particular, in relation to the crime of money laundering, the amendment has deleted the words 'not negligent' from the text of the first paragraph of Article 648 bis of the Criminal Code, extending the prerequisites of the money laundering conduct to negligent crimes, and has introduced a less severe sanctioning discipline for the case in which the presumed crime is a contravention punished with imprisonment for a maximum of one year or a minimum of six months.

A similar provision was introduced by letter e) of Article 1 to Article 648 ter of the Penal Code (Use of money, goods or utilities of illegal origin) – an offence for which the reference to Article 648 in the last paragraph of Article 648 ter is also modified for coordination purposes – and by letter f) of Article 1 to Article 648 ter 1 of the Criminal Code (Self-laundering).

For the latter, introduced into our legal system as early as 2014, the deletion of the words 'non-culpable' following 'crime' has also been made, extending the criminal acts that constitute the predicate crime.

Finally, the Decree has extended the cases of rooting of the Italian jurisdiction by adding to the fourth paragraph of Article 9 (c.f. Article 648 (Receipt of stolen goods)) and 648 ter 1 (Self-laundering) among the crimes committed abroad by an Italian citizen for which (without prejudice to the condition of the presence of the citizen in the territory of the state) for the purposes of prosecution in our system the request of the Minister of Justice is not necessary; for the crimes set forth in Article 648 bis (Money laundering) and 648 ter (Use of money, goods or utilities of illegal origin). This last aspect did not concern the crime of money laundering and use of money of illicit origin, since the Minister's request was not foreseen for the purposes of prosecution in our system due to the edictal penalty.

During the first few months of 2022, further legislative changes were made to amend the provisions of Legislative Decree No. 231/2001, modifying and broadening the scope of some of the offences included in the catalogue of predicate offences. In this context, of particular interest are the provisions of Law No. 238/2021 on provisions for the fulfilment of obligations deriving from Italy's membership of the European Union – European Law 2019–2020 (the European Law 2019–2020), as well as those introduced by Legislative Decree No. 13 of 25 February 2022 on urgent measures to combat fraud and for safety in the workplace in the field of construction, as well as on electricity produced by plants from renewable sources, which, by introducing new provisions on abuses and offences connected with the granting of the 110 per cent 'superbonus', has also had an impact on certain offences underlying the liability of legal persons. Furthermore, on 3 March 2022, the Chamber of Deputies definitively approved the draft Law amending the Criminal Code, increasing the penalties for offences against the landscape and cultural heritage, now also expressly referred to by Legislative Decree 231/2001.

Law No. 238/2021, published in the Official Gazette on 17 January 2021 and entering into force on 1 February 2022, with a view to standardising the provisions of national provisions of national law to the requirements of European law, has made significant changes to certain parts of the Criminal Code, which also fall within the scope of the predicate offences referred to in Legislative Decree No. 231/2001.

More specifically, the lines of action can be identified as follows as follows:

  1. compliance with Directive 2013/40/EU on attacks against information systems against information systems – amendment of Article 615 et seq. of the Criminal Code, amendment of Article 615 et seq. of the Criminal Code, referred to in Article 24 bis of Legislative Decree No. 231/2001;
  2. adaptation to Directive No. 2011/93/EU on combating sexual abuse and sexual exploitation of children and child pornography – amendment of Articles 600 quater and 609 undecies of the Criminal Code, a prerequisite for the liability of entities pursuant to Article 25 quinquies of Legislative Decree No. 231/2001; and
  3. amendments to the cases of market abuse, referred to in Article 25 sexies of Legislative Decree No. 231/2001 in response to an infringement procedure initiated against Italy.

ii Penalties

Decree 231/2001 sets out four types of penalties: monetary penalties, restrictive penalties, seizure of assets and publication of conviction. The monetary penalties are applied on the basis of units, which cannot be fewer than 100 and must not exceed 1,000. The value of each unit ranges from a minimum of €258 to a maximum of €1,549, which is set at the discretion of the judge according to the severity of the crime, the economic condition of the company and the scale of its assets. (For example, in the case of bribing a public official, the law indicates a range of between 100 and 800 units, and the judge may decide to apply a penalty of 200 units. If the company is large, the judge may apply a value of €1,500 for each single unit, and thus the total penalty would be €300,000.) The judge must also consider any activity carried out to cancel or reduce the consequences of the crime.

Apart from monetary penalties, if the facts are expressly established, the judge could also apply restrictive penalties, but only under one of the following two conditions: the entity made a remarkable profit, or the offence was committed by either a senior manager or an employee. In the second case, the penalty could be applied only if the offence was committed because of serious organisational deficiencies. In the event of repeated offences, restrictive penalties can involve either fines or disqualification, such as:

  1. a ban on carrying out business activities;
  2. suspension of licences and concessions;
  3. a ban on dealing with public bodies;
  4. exclusion from or cancellation of public financing or contributions; and
  5. a ban on advertising goods or services.

Law No. 39/2019 extensively amended Paragraph 2, Article 13 of Decree 231/2001 (on restrictive penalties), to state: 'Without prejudice to the provisions of Article 25, Paragraph 5, disqualification sanctions have a duration of not less than three months and not more than two years.'

Publication of the conviction can be in one or more journals and includes bill posting in the municipality where the entity has its main office. During an investigation, if requested by the public prosecutor, it is possible to impose a ban as a precautionary measure when there is a real possibility of further offences of the same nature being committed by the company.

The use of precautionary measures indicates that the entity is liable for an administrative offence and there are well-founded and specific elements suggesting there is a real danger that offences of the same nature as the one being prosecuted will be committed. Decree 231/2001 provides the following in relation to precautionary measures:

  1. the judge determines the duration of the measures, which may not exceed one year;
  2. after sentencing for a first-instance conviction, the precautionary measure may have the same duration as the corresponding sanction applied with the same sentence, and the duration of the precautionary measure may not exceed one year and four months;
  3. the duration of the precautionary measure must begin upon the order notification; and
  4. the duration of the precautionary measure must be taken into account when deciding the duration of the applicable sanctions.

iii Compliance programmes

The keystone of Decree 231/2001 is the partial exemption from corporate liability that comes with the adoption of an effective8 and efficient organisational model, capable of preventing predictable offences, established by the 'gap analysis'.

If the supposed offence was committed by senior management, the burden is on the company to prove that the persons committed the offence by fraudulently evading the effective and appropriate organisation model and the controls in place; however, if the offence was committed by a less senior employee, it is for the public prosecutor to demonstrate a failure to comply with the obligations of direction and oversight imposed on the employee.

Reparatory compliance programmes (i.e., those developed after an offence has been committed) may, on the other hand, result in a reduction in the fine, exemption from the application of bans or the suspension or revocation of precautionary prohibitive measures, or the suspension and subsequent conversion of the fines in the event that the reparatory action was carried out late.9

Article 6, Paragraph 2 of Decree 231/2001 establishes the essential characteristics for the organisation, management and control model. The first two activities to be developed are linked to risk assessment. In particular, these are:

  1. identification of potential risks; and
  2. design of the control system: in particular, the guidelines of Confindustria10 establish the most important components to an effective control system as:
    • a code of ethics referencing the offences considered;
    • a sufficiently formalised and clear organisational system, in particular with regard to the attribution of responsibility;
    • allocation of the power of authorisation in accordance with defined managerial and organisational responsibilities;
    • a risk management and control system; and
    • communication and staff training.

The compliance programmes should also include specific rules of conduct for employees. This code of conduct should be done after the risk assessment and the gap analysis and should establish specific procedures to regulate the decision-making process.

Confindustria has also established some guidelines for compliance with Decree 231/2001. In particular, the minimum contents of the compliance programme should establish that:

  1. the essential principle of the entity should be the respect of law in every country where the entity acts;
  2. every operation and transaction has to be correctly registered, authorised, verifiable, legitimated, coherent and appropriated; and
  3. the entity has to establish the basic principles in relation to its commercial partners.

iv Prosecution of individuals

When an investigation or initial criminal action is directed against a natural person who is an employee or senior manager of a company, it is generally the company that arranges an adequate professional defence for its employee and bears the costs, given the common interests of the company and of the natural person in proving that no offence was committed.

The company and the natural person oppose one another only in a limited number of cases; this mainly occurs when the employee has caused damage to the company when committing the offence, or fraudulently evaded company procedures to commit the offence. In these situations, the company will mainly be interested in dismissing or otherwise sanctioning the employee – thereby distancing itself from the employee's conduct – and then in joining the criminal proceedings as a civil claimant to obtain compensation for all damage suffered as a result of the unlawful conduct.


i Extraterritorial jurisdiction

Pursuant to Decree 231/2001, criminal liability also extends to criminal offences committed abroad, but only if the corporation's headquarters are located in Italy (and on the further conditions that no action has been taken by the authorities of the country where the offence was committed and that the requirements for the criminal liability of the natural person that has committed the offence concerned11 are met).

Conversely, if the crime was committed in Italy by a manager or employee of a foreign company, both the perpetrator and the corporation may be pursued under Italian law despite the fact that the main offices of the company are abroad. Pursuant to the Criminal Code, any offence may be deemed to have been committed in Italy (and not abroad) even if a 'fragment' of the action or 'the conception of the offence'12 occurred in Italy. A German corporation was tried for bribery in Italy under Decree 231/2001 and had to enter into a plea bargain, and many foreign corporations are currently on trial or under criminal investigation in Italy (banks involved in the Parmalat bankruptcy case,13 other banks involved in investigations regarding derivatives sold to public entities, etc.).

Specific crimes, notably insider trading and market manipulation regarding securities traded on Italian markets, may be punished even if entirely committed abroad. Both the individuals and (under Decree 231/2001) the foreign corporation for the benefit of which the crime has been committed will be punished in Italy. Two of the three major ratings agencies, and some of their managers, were on trial in the small southern town of Trani for alleged market manipulation of Italian treasury bonds: the crime was supposedly committed entirely abroad.14

With respect to specific types of conduct, in the case of an offence committed by an Italian entity abroad (according to Article 4 of Decree 231/2001), the entity could be accountable under the conditions provided for in Articles 7 to 10 of the Criminal Code. In particular, Article 7 provides that any of the following offences committed abroad are punishable under Italian law:

  1. offences against the state;
  2. offences of counterfeiting the state seal and use of the counterfeited seal;
  3. offences of forging money and public credit cards; and
  4. those committed by public officials with abuse of authority, or violation of the duties inherent in the function or service.

ii International cooperation

As Italy has ratified the relevant international instruments, legislation involving judicial assistance in criminal matters is very similar to those in other European Union Member States. In this context, a judicial authority that intends to carry out investigations in a foreign state may request the competent authorities of that state to implement the investigations on its behalf, by performing the acts requested15 and transmitting their results to the requesting country. Matters of this kind are governed by national legislation and international conventions16 (although bilateral treaties are much more numerous) and by the general provisions of international law, which prevail over ordinary legislation (where applicable).

Extradition involves the surrender of individuals by the state in which they are located to another state that has made an appropriate request to place them on trial or to implement a conviction or other measures involving a restriction of their personal freedom.17 Italian authorities refuse to allow extradition of defendants abroad:

  1. when there are grounds to conclude that they will be subject to persecution or discrimination, or other acts amounting to a violation of their fundamental rights;
  2. for political offences; or
  3. in the event that the conduct in respect of which extradition has been requested is punishable by death in the requesting state.

Within the EU, a European arrest warrant is a simplified form of extradition (implemented in Italy by Law No. 69/2005). This measure equates to a genuine judicial decision according to which the national judicial authority at which it is aimed is required to recognise the request for the surrender of a person made by the issuing judicial authority, subject to a summary control that the relevant prerequisites have been met.

The right granted to the General Prosecutor to also request the enforcing state to hand over assets covered by any seizure or confiscation order is significant for companies. Where requested by the issuing authority, the Court of Appeal may also order the seizure of assets required as evidence, provided that they are sizeable.

Italy allows extradition to a foreign requesting country even if no specific extradition treaty has been signed. The Code of Criminal Procedure provides framework rules for a non-conventional extradition, basically requesting stricter scrutiny on the grounds for the extradition, if there is serious suspicion of guilt and a risk of discrimination, but an Interpol red alert notice, requesting the arrest of an individual in Italy, under an arrest order issued by whatever country in the world, is likely to be executed.

The United Nations Convention against Transnational Organized Crime was ratified by Italy in 2006.

Finally, the Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime (Strasbourg 1990) provides for forms of investigative assistance in, for example:

  1. the collection of evidence;
  2. the transmission of information to another state (even where not requested);
  3. the adoption of common investigative techniques;
  4. the elimination of bank secrecy as well as provisional measures such as the freezing of bank accounts;
  5. the seizure of assets to ensure their retention; and
  6. the confiscation of the proceeds of crime.

In addition, in February and March 2015, Italy signed agreements with Switzerland, Liechtenstein and the principality of Monaco on the exchange of information, with a view to ending bank secrecy and better pursuing Italian nationals who abscond abroad with the proceeds of tax crimes.

iii Local law considerations

Criminal law is based on the principle of territoriality and, therefore, the investigative authorities may carry out any investigations against any person in Italy and use any item found in Italy as evidence, even when multiple jurisdictions are implicated. The only limit is provided for by Legislative Decree No. 29/2016: Law 29 has transposed Framework Decision No. 2009/948/GAI and provided in Italian legislation the international ne bis in idem principle, concerning persons who have been judged by the jurisdiction of another Member State. The investigative power of the public prosecutors in Italy is not limited by the right to confidentiality or the right to banking secrecy, but only by the secrecy granted to specific classes of professional and to official secrets. Consequently, for example, if the public prosecutor were to find emails within an Italian company sent by the employees or senior managers of an associate foreign company, or documentation drawn up by foreign companies that is potentially useful in a case against Italian persons, there would be no limitation on their use.

On the other hand, should it prove necessary for the public prosecutor to obtain evidence abroad, letters rogatory (whereby one state requests another to carry out specific acts such as communications, notifications or the acquisition of evidence) are required instruments.

Year in review

The major bankruptcies that have shaken Italy in recent years (and above all, those of the two major food conglomerates Parmalat and Cirio) have involved criminal offences; the bankruptcies were the result of actions to plunder corporate resources carried out by senior managers and the crises that exposed them were primarily market-related.

Italian capitalism is still mainly based on the control of listed companies by families or small groups of connected individuals (hence the description 'relationship capitalism', as opposed to the model of the public company, which is very rare in Italy). In the Parmalat and Cirio cases,18 both companies were catastrophically in debt and the controlling shareholders used fraudulent accounting to retain control of their respective companies, relying heavily on the issue of bonds that they were not able to honour. In the current trials, prosecutors are also arguing that this was only possible with the complicity of national and international banks.

Other major scandals, such as those that broke in 2005 (the attempted banking takeovers of the Antonveneta bank by Fiorani and the Banca Popolare di Lodi, and of the Banca Nazionale del Lavoro by Consorte and Unipol)19 or the more recent case of market manipulation involving the insurance company Fonsai,20 can be distinguished from Cirio and Parmalat, as there was no subsequent corporate collapse. However, these cases were also characterised by an excess of power in the company leadership, which exploited the companies to their own ends.

All these cases have one common denominator: the failure of the 'gatekeepers', to use a term used by US scholars.21 While in the United States, Enron dragged down Arthur Andersen with it, in Italy, Grant Thornton and Deloitte & Touche – two other major auditing firms – were directly involved in the criminal trials for bankruptcy and insider trading relating to the Parmalat affair.

From a criminal law perspective, the public authorities have emerged relatively unscathed from recent major scandals. It is, however, sufficient to read the reports of the hearings by CONSOB commissioners in the trial for insider trading in Parmalat stock to appreciate how, leaving aside any questions of criminal liability, CONSOB's reputation suffered a heavy blow. Its chair, who was a witness in court, had to admit that the first request for clarifications sent by CONSOB to Parmalat was made on 9 July 2003, following an article in the newspaper La Repubblica raising doubts about the company's actual level of indebtedness;22 had the article not appeared, CONSOB would probably not have initiated any investigation at that point, as it would not have independently ascertained the level of Parmalat's financial difficulties.

The Bank of Italy was hit by the scandal following the attempted takeover of Banca Antonveneta by BPL; the former governor has been convicted for market manipulation in collusion with the then-managing director of BPL.23 As an institution, the Bank of Italy has emerged stronger from this affair, as the trial has highlighted how officials within the bank worked with the utmost honesty and competence, and were capable of withstanding pressure from the governor of the Bank of Italy, who subsequently resigned as a result of the scandal.

In the above-mentioned Fonsai case – regarding market manipulation and false accounting by the former managers and shareholders of an insurance company – the former head of the Italian Insurance Supervisory Authority was charged with bribery.

This simple point goes to the heart of the system: if the gatekeepers fail, if internal and external auditors are not able to guarantee a minimum level of truth in the company accounts, and if the highest national oversight and control authorities are not able (in the best-case scenario) or not willing (in the worst) to exercise effective control, nothing will prevent the worst behaviour by company stakeholders.

Between 2012 and 2018, a significant number of cases of market manipulation came under criminal investigation. Because this crime may be punished even if committed entirely abroad, an Italian public prosecutor could investigate alleged market manipulation by rating agencies24 or international banks that affected securities traded on the Italian market.

A noteworthy recent trend has seen proceedings for financial and bankruptcy law crimes concerning some of the most important banks. The Banca MB,25 Banca Etruria26 and Banca Carife (Cassa di Risparmio di Ferrara)27 cases are just a few of the most important proceedings.

The same can be said of the most recent cases of market manipulation and false accounting that have emerged during the banking and financial crisis of the past few years: the top managers at Banca Popolare di Vicenza were convicted by the Court of Vicenza for the crimes of stock manipulation, issuing false prospectuses and obstruction of the functions of the public supervisory authorities (EBC, CONSOB, Bank of Italy).28 Also top managers at Monte dei Paschi di Siena have been convicted by the Court of Milan for the crimes of market manipulation and false corporate communications.29

Last but not least, there have been recent developments in the proceedings concerning two of Italy's most important companies, Eni and Autostrade per l'Italia (ASPI).

Following years of proceedings, the seventh section of the Court of Milan acquitted all 15 defendants, including the oil companies Eni and Shell, in the trial for international bribery concerning the purchase by the two oil companies of Oil Prospecting Licence 245 in Nigeria.

With regard to ASPI, the investigations into the collapse of the Morandi Bridge have been concluded three years after the event: 69 subjects were investigated plus the companies ASPI and SPEA Engineering,30 which will now have the opportunity to prepare and set up the best defence strategy to protect their position.

Conclusions and outlook

The legal system's reaction to these financial crises has been left in the first instance to criminal law, with trials that have now been ongoing for years. But can criminal law alone cope with this situation and can it prevent further crises from occurring?

However necessary, criminal law is inherently subsidiary. Given the problem, in the case of Italy, of the inherent tendency of major economic players towards opportunistic behaviour to the detriment of the market, the solution can never, by definition, be left to criminal law alone; it must be integrated into the framework of a comprehensive system of rules.

The first point of order must involve either private law or administrative law alongside some pre-legal regulations such as reputational rules, codes of practice and ethical standards.

This is merely a single aspect of a much more complex picture. To prevent opportunistic behaviour by major corporations to the detriment of the market, one possible solution is to put specific gatekeepers on guard. Root-and-branch reforms are necessary, not only in criminal law, but also in civil and administrative law. Under such reforms, the role of the gatekeepers – starting with the statutory auditors, the external auditors and the oversight and control authorities – must be well defined and carried out prior to the initiation of criminal investigations by public prosecutors.

Moreover, their powers of inquiry must be adequately formulated to make it possible for the oversight authorities to hear the alarm bells ringing in a timely fashion.

i Recent scenarios

The Supreme Court recently had the opportunity to rule on a matter subject to various interpretations in past years: the application of the rules set out in Decree 231/2001 to foreign-based entities.31

In its defence, the entity claimed that because its head office was abroad the subsidiary entity should not be called to answer under Decree 231/2001, as no reprimand of the entity could be made on the basis of 'organisational fault' except in the place where the entity had its decision-making centre.

Despite this defence thesis, the Supreme Court has clarified that if an offence has been committed on Italian territory, the offending entity is liable, like any other person, regardless of nationality or the place where its head office or its principal place of business is located.

Moreover, the Supreme Court added that the entity is subject to the obligation to comply with Italian law and, in particular, criminal law, regardless of whether there are rules governing the same matter in the same way in the country to which the entity belongs.

Another important decision concerning the application of Decree 231/2001 was issued by the Supreme Court on 27 January 2020.32

The Supreme Court emphasised the fact that negligent offences also give rise to company administrative responsibility. Therefore, in these cases there also is an obligation for the entrepreneur to consider how conduct may be perceived as serving the entrepreneur's interest or being to its advantage (as indicated by Decree 231/2001, Article 5, Paragraph 1).

In this context, the United Sections of the Supreme Court had previously issued an important precedent in Decision No. 38343/2014, providing the following literal interpretation: the concepts of interest and advantage in culpable offences must be considered with reference to the conduct rather than the anti-judicial outcome. This adjustment of perspective concerns only the object under evaluation (i.e., the different appraisal of the offence no longer captures the event, only the conduct) and therefore has no implications for the constitutional principles of the penal system.

Subsequently, with reference to culpable offences in the field of safety at work, it was reiterated that the concepts of interest and advantage should refer to the conduct and not the anti-judicial outcome:

while, undoubtedly, the death or injury suffered by one of its employees as a result of violations of accident prevention regulations do not correspond to the company's interest, nor provide the company with an advantage, there is no doubt that an advantage for the company can be seen in, for example, the saving of time or costs it would have had to incur to comply with the prevention regulations, the violation of which resulted in an accident at work.33

Concerning negligent offences in the field of safety at work, the interest and the advantage are linked to the savings in expenses that the company would have had to incur to comply with the regulations. Another advantage for the company could be that it saves time by not applying the precautionary regulation.

These principles can therefore also be adapted to culpability for environmental crimes, in which case the interest and the advantage could be identified in both the economic savings for an entity as a result of its failure to implement suitable plants to allow operation without exceeding set limits, and in the elimination of downtime, which the maintenance of such plants would require.

ii The coronavirus emergency

The recent coronavirus emergency will inevitably lead to consequences of various kinds, even in the field of criminal law.

First of all, the need to maintain a lifestyle different from our previous one (marked by social distancing) will allow for experimentation with new ways of conducting hearings. In particular, the concepts considered thus far have paved the way for hearings being conducted in a totally 'computerised' way, through the use of videoconferencing, creating a type of criminal trial previously completely unknown.

From a different point of view, we are already seeing, and expect to see in future, the opening of investigations by the public prosecutors' offices into those areas most affected by the virological phenomenon; for example, to ascertain criminal responsibility in facilities such as nursing homes and hospitals, in relation to the deaths that have occurred in these facilities in the healthcare sector in the course of the pandemic. Any investigations arising will be initiated on the basis of objections raised pursuant to Decree 231/2001, which provides for entities' potential liability for multiple criminal charges such as may arise from the coronavirus emergency situation; in particular, the provisions contained in Article 25 septies of Decree 231/2001 regarding manslaughter or serious injury resulting from health protection violations.


1 Mario Zanchetti is a founding partner at Studio Legale Pulitanò-Zanchetti.

2 The most important of these for companies include the Bank of Italy, the Italian Securities and Exchange Commission (CONSOB), the Italian Insurance Supervisory Authority (the Italian insurance regulator since 1 January 2013, replacing the former authority, ISVAP), the Italian Competition Authority (Antitrust) and the Italian Data Protection Authority.

3 Legislative Decree No. 58 of 24 February 1998.

4 Grande Stevens and Others v. Italy, 4 March 2014.

5 For example, in cases involving the receipt of property resulting from the commission of a criminal offence, the notification of the planting of explosives at the company's location or the theft of weapons or explosives, businesses are obliged to self-report.

6 There is no obligation of disclosure; therefore, the investigating lawyer may well decide not to submit to authorities any evidence collected.

7 Engel and others v. the Netherlands, 1976, and subsequent cases, including Grande Stevens and others v. Italy, 2014.

8 The mere adoption of the model does not appear to be sufficient to preclude the corporation's responsibility. As the Court of Milan stated: 'the model must have some important characteristics: a deep analysis of the corporation; the ability to find the risky areas for the different types of crimes; and ways to hinder illegal acts, keeping in mind the history [re judiciary] of the company and the characteristics of the other companies that operate in the same sector. The model has to determine what moments in the company are exposed to the risk of crime, study specific procedures to use in those moments that allow for effective control, and use preventive controls and specific protocols to plan the company's decision-making. . . . It must follow the corporation's changes, updating the model as soon as the risk structure evolves.' (Court of Milan, Office of the Judge for Preliminary Investigation (GIP), 20 September 2004, IVRIholding-COGEFI). In another decision, the Court of Milan stated that: 'Effectiveness, specificity and dynamism are structural characteristics of compliance programmes.' (Court of Milan, Sec. XI, Reexamination Judge, Pres. Mannocci, ord. 28 October 2004, Siemens AG).

9 The Italian government established a commission to review the efficiency and preventive aims of Decree No. 231/2001.

10 Confindustria is an association representing manufacturing and service companies in Italy. Membership is voluntary.

11 Specified under Articles 7 to 10 of the Italian Criminal Code.

12 Court of Cassation No. 11442/2016.

13 See Section V.

14 On 30 March 2017, the court acquitted the ratings agency Standard & Poor's and five of its former and current managers of market manipulation charges relating to previous downgrades of the country's sovereign debt.

15 For example, the hearing of witnesses and accused persons, precautionary seizures and the provision of evidence or documents and other items relating to the offence.

16 For example, multilateral conventions such as the European Convention on Mutual Assistance in Criminal Matters (Strasbourg 1959), the Additional Protocol to the European Convention on Mutual Assistance in Criminal Matters (Strasbourg 1978) and the Second Additional Protocol to the European Convention on Mutual Assistance in Criminal Matters (Strasbourg 2001).

17 Extradition (and other jurisdictional relations with foreign authorities) is governed by the European Convention on Mutual Assistance in Criminal Matters signed in Strasbourg on 20 April 1959, and by 'other provisions of international treaties in force in respect of the state and the provisions of general international law' (Article 696 of the Italian Code of Criminal Procedure). Only if there is no international law – either treaty law or customary law – or where these are incomplete or contain gaps will the provisions laid down by the Italian Code of Criminal Procedure apply.

18 The Parmalat case has been split into several different proceedings; the main one has recently been judged by the Court of Cassation (March 2014), a judgment that resulted in complete confirmation of the accusations. The Cirio case was judged by the Court of Rome; the Court of Appeal confirmed the decision in April 2015. The Court of Cassation intervened on 30 January 2018 and annulled it, with reference to another territorial court, with regard to one of the heads of indictment; however, it did not definitively close the judicial case because the verdict of 10 April 2015 was prima facie confirmed by the Court of Appeal of Rome.

19 Both of which were heard by the Court of Cassation in 2012.

20 The Milan Court of Appeal confirmed the acquittal of Gioacchino Paolo Ligresti, accused of false accounting and stock manipulation, in relation to the past management of Fondiaria-Sai, of which he was an adviser. The Milan Public Prosecutor's Office, CONSOB and the consumer association of 900 former shareholders of the insurance group had challenged the acquittal, but at the end of the hearing, the Deputy Attorney General Celestina Gravina requested the acquittal. Giulia Ligresti was acquitted by the Court of Appeal of Milan, which accepted the petition for revision of the first-instance judgment and revoked the first-instance plea agreement of two years and eight months in prison. This was necessitated by Paolo Ligresti's acquittal becoming final, making the two verdicts 'irreconcilable'. The indictment of Jonella Ligresti and other Fonsai managers has been annulled. The trial will begin again in Milan. On 12 March 2019, the first section of the Court of Appeal of Turin accepted the defence that raised doubts about the territorial jurisdiction of the Turin Court, which on 11 October 2016 had sentenced Jonella Ligresti to five years and eight months in prison.

21 JC Coffee, 'Gatekeeper Failure and Reform: the Challenge of Fashioning Relevant Reforms', Columbia Law School, The Center for Law and Economic Studies, Working Paper No. 237, 2003.

22 Milan District Court, criminal proceedings 12473/04, hearing of 31 May 2006, p. 162 of the transcript.

23 The judgment became final in the Court of Cassation in 2012.

24 As mentioned above, on 30 March 2017, the Court of Trani acquitted the ratings agency Standard & Poor's and five of its former and current managers of market manipulation charges relating to previous downgrades of the country's sovereign debt.

25 Ten former executives of the bank are on trial before the Court of Milan. However, the limitation period for the offence of obstruction of the supervisory authority has elapsed and of the 18 charges, four cases of bankruptcy remain.

26 This trial is currently under way.

27 The Bologna Court of Appeal confirmed the first instance judgment, which had produced only two convictions among the 11 defendants, and it also reduced the sentence because the statute of limitations for some crimes had expired.

28 According to the judges of the Court of Vicenza, the managers of Banca Popolare di Vicenza were responsible for both the loss in value of the shares and concealing the real financial situation of the bank, and they had undertaken to promote a reckless self-financing campaign for the shares.

29 At the centre of the story lay the open-balance accounting criterion underlying the 'Alexandria' and 'Santorini' derivative transactions, which were inherited by the bank's new governance team from the previous management and which closed in the three-year period 2012–2015.

30 Sixty per cent of the share capital of SPEA Engineering SpA is held by Atlantia SpA, with the remaining stake divided equally between ASPI and Aeroporti di Roma SpA, both of which are controlled by the holding company Atlantia.

31 Court of Cassation No. 11626/2020.

32 Sentence No. 3157.

33 Court of Cassation No. 24697/2016.

The Law Reviews content