The International Investigations Review: Portugal


Corporate liability for criminal and regulatory offences has a long tradition in the Portuguese jurisdiction. In the past, Portuguese companies have become more concerned with proper corporate governance and more aware of the importance of effective and fully enforced compliance programmes, a fact that has led to an increasing relevance of internal mechanisms of control and supervision, as well as whistle-blowing channels and internal investigations.

With the recent approval of the new National Anti-Corruption Strategy 2020–2024, compliance programmes will gain even more significance as they are considered one of the key factors in the fight against white-collar crime.

According to Portuguese law, there are basically two types of possible offences: crimes and regulatory offences.

Crimes are investigated and prosecuted by an independent public prosecutor and judged in criminal courts. During the investigation stage, the Public Prosecutor's Office will attempt to discover whether a crime was indeed committed, who were its agents, and to gather conclusive evidence of the existence (or not) of criminal liability. The Public Prosecutor's Office is aided by a police force or, exceptionally, by an administrative authority (e.g., tax authorities for tax crimes, and the Portuguese Securities Market Commission (CMVM) for crimes against the securities market), to collect evidence of a possible criminal offence. However, certain judicial measures and acts must be ordered or authorised by a judge, namely those acts or measures that may affect fundamental rights.

During an investigation, a person against whom a criminal complaint is filed or who is a suspect will be named as the defendant and will have a privilege against self-incrimination; namely, the right to remain silent and also the right to request any measures to further the investigation. However, the public prosecutor is not obliged to pursue any of the measures requested except the defendant's right to be heard.

At the conclusion of the investigation, the public prosecutor decides whether to indict the defendant or to dismiss the case.

In either an indictment or a dismissal, there is an optional stage in the criminal proceeding that is entirely conducted by a pre-trial judge. This optional stage is to decide whether the case should go to trial or not. A decision by the judge confirming the public prosecutor's indictment cannot be appealed, and the trial will proceed.

Therefore, if there is an indictment by the public prosecutor or if a decision from the pre-trial judge finds sufficient evidence that the defendant has committed a crime, the case goes to trial. This is the most important stage in criminal procedure, with full respect for the adversarial principle. At the end of the trial, the defendant will either be convicted or acquitted. It is possible, in certain circumstances, to appeal to a higher court the lower court's decision.

Regulatory offences, on the other hand, are investigated and prosecuted by administrative entities, with varying degrees of independence. These entities or regulators can apply fines that are binding and enforceable unless the decision to apply the fine is contested in court by the defendant. Most regulatory offences, when appealed, are decided in criminal courts. However, regulatory offences can also be decided in administrative courts (e.g., tax offences and offences related to urban planning) or in a specialised court (e.g., competition, energy, and financial offences). Regulatory offences have, in general, more flexible substantive and procedural requirements and some legal frameworks list the fines applicable in relation to a company's turnover, and establish collaboration and leniency programmes. These factors incentivise and reward internal investigations and self-reporting.

A new legal framework for economic regulatory offences was recently approved in Decree-Law No. 9/2021 of 29 January, establishing new common rules and regulatory procedures in several economic areas, such as the sports, consumer, health, pharmaceuticals, copyright, and gambling sectors, and including anti-money laundering offences.


i Self-reporting

Under Portuguese law, there is no general duty to self-report. However, there are certain sectors, subject to supervision, where entities are required to report wrongdoing.

Specifically, the Portuguese Securities Code2 requires financial intermediaries to report any facts that are connected to financial crimes. Pursuant to Decree-Law No. 298/92 of 31 December, the Legal Framework of Credit Institutions and Financial Companies3 establishes a similar duty, requiring the management and supervisory bodies of credit institutions to notify the Bank of Portugal of possible fraud, both internal and external, which may produce adverse effects on the institution's results or capital. Failure to notify the authorities when required to do so is a regulatory offence.

In addition, self-reporting criminal or regulatory offences committed in a corporate context to authorities, as well as cooperating with authorities in general, allows a company to reap certain benefits, depending on the legal framework applicable to the offence in question.

Article 71 of the Portuguese Criminal Code (the Criminal Code)4 establishes that an offender's conduct after the fact is considered when fixing the applicable penalty, especially if that same conduct consists in repairing the consequences of the crime committed. In addition, the offender's conduct after the fact may be used to assess whether the criminal procedure should be suspended under Article 281 of the Portuguese Criminal Procedure Code (one of the possible negotiated solutions under Portuguese criminal law).

The offender's conduct after the fact is also relevant when fixing the applicable fine in various sectors of regulatory offence law, namely, under the Legal Framework of Credit Institutions and Financial Companies, the Anti-Money Laundering Law,5 the general legal framework for environmental regulatory offences and the general framework for regulatory offences in the media sector.

Furthermore, certain laws establish specific regimes for self-reporting.

Under Article 405-A of the Securities Code, if the offender confesses and collaborates with the CMVM on the collection of evidence, the applicable fine is lower and its upper limits are halved.

Also, pursuant to Articles 75 to 82 of the Portuguese Competition Law (the Competition Law), a company that self-reports a cartel or a concerted practice may benefit from leniency, which may result in immunity from fines or the reduction of their amount. An amendment to the Competition Law transposing theEU ECN+ Directive6 was proposed to the government by the Portuguese Competition Authority (AdC) and is currently under discussion.

Articles 40 to 44 of Law No. 9/2013 of 28 January, establishing the legal framework for regulatory offences in the energy sector, also establish a leniency programme like the one set out in the Competition Law.

ii Internal investigations

Internal investigations in a criminal context are not subject to a specific legal regime in the Portuguese jurisdiction.

However, within the Portuguese jurisdiction, internal investigations into the possible commitment of an offence are not common practice, except in some specific areas, such as labour law or competition law, where such investigations are more common.

One of the reasons for the absence of more internal investigations in connection with possible criminal offences is probably the absence of plea bargaining in Portuguese criminal law and the strict limits within which a negotiated solution is allowed (there is no possible negotiated solution if the specific crime committed by the agent is punishable with imprisonment of more than five years). Because there is no plea bargaining, there are significant limits to the effectiveness of internal investigations within the context of criminal liability and, therefore, companies do not feel encouraged to carry out those investigations.

However, when these investigations take place, there are different possible approaches, but these usually focus on analysing documents (paper or digital documents) and on conducting interviews with employees or members of the company.

Any internal investigation must follow the procedural guarantees set out in the Labour Code, otherwise any sanctions applied against an employee may be invalid. Furthermore, under the Personal Data Protection Law,7 the Safety in Cyberspace Law8 and the EU General Data Protection Regulation, all subject entities must implement adequate and appropriate measures to ensure the safety of stored data.

Under the Anti-Money Laundering Law, obliged entities are required to examine and report activities that may be connected to possible money laundering or financing terrorism. Obliged entities must also record all filed complaints, and they must immediately proceed with the implementation of new due diligence measures whenever the complaint gives the obliged entity reasons to doubt the accuracy of the data provided by a client.

Internal investigations will most often start after someone within the structure reports facts or suspicions related to some possible wrongful activity inside the company. Usually, these investigations aim to identify the responsible party for the possible wrongful actions and therefore to protect the company from possible legal consequences, mainly criminal or regulatory. Therefore, the purpose of these investigations is to cooperate with the public authorities responsible for the investigation, providing some evidence or mitigating the company's own liability.

Most legal scholars in Portugal believe that, to use the evidence collected in the internal investigation in the following legal procedure, it is important to assure that the rights foreseen in the legal procedure are also respected in the internal investigation. This means that there is a common concern not to convert internal investigations into pre-criminal or pre-regulatory procedures, benefiting from the absence of legal regulation on the matter. In this context, some of the evidence collected in the internal investigation may not be allowed in the criminal procedure if it has been obtained without complying with the legal requirements, particularly those evidences that in a criminal procedure can only be obtained with a judge's authorisation.

Once the company is named as a defendant, it has a privilege against self-incrimination. Therefore, the company has a right to remain silent, which means that the company's legal representative has a right to refuse to answer questions and, within a criminal procedure, not to provide any evidence that may be used against the company in a criminal case.

However, in regulated activities, entities are bound to comply with a series of rules and duties. These duties may embody collaboration duties with the supervision authorities. These duties imply, essentially, the delivery of documents that certify whether the entity is complying with the rules of the sector. Therefore, within a supervision proceeding, performed by the supervisory authority of the relevant market or economic sector, entities may be obliged to deliver certain documents to those supervisory authorities (namely those documents that the entity is legally bound to prepare and maintain), even though those proceedings may end with an accusation and charges for a regulatory offence.

iii Whistle-blowers

In Portugal, there is no specific legal regime regarding whistle-blowing and the protection of whistle-blowers.

However, in certain sectors there is an obligation to develop internal mechanisms to protect whistle-blowing. For instance, the Securities Code establishes that any person who has any knowledge of facts, information or evidence connected to possible wrongdoing shall report them to the CMVM.9 The CMVM must protect a whistle-blower's identity, unless a court rules otherwise. The Securities Code also establishes that if the report is true and in good faith, it cannot be deemed as possible ground for any disciplinary, criminal, civil or regulatory proceeding against the whistle-blower.10

Another example is Decree-Law No. 298/92,11 establishing the Legal Framework of Credit Institutions and Financial Companies, and which requires credit institutions to develop specific, independent and adequate internal mechanisms to receive, handle and file any report on possible irregularities concerning the management, accounting organisation and internal auditing of the company.12 Those mechanisms must also protect the whistle-blower's identity as well as his or her personal data and the reporting per se cannot be deemed to be possible grounds for any disciplinary, criminal, civil or regulatory proceeding against the whistle-blower.13

The Anti-Money Laundering Law also establishes that the obliged entities must create specific, independent and adequate internal mechanisms to receive, handle and file reporting on possible irregularities concerning anti-money laundering legislation.14 Moreover, the obliged entities shall also protect the confidentiality of the whistle-blowing and the protection of the whistle-blower's personal data.15 The obliged entities shall not retaliate or discriminate against a whistle-blower and whistle-blowing per se cannot be deemed as possible grounds for any disciplinary, civil or criminal proceeding.16

A new version of the Competition Law is currently being discussed and will most likely establish the protection of a whistle-blower who reports to the AdC any practice that may restrict competition.

In recent years, some companies have adopted internal measures to allow its members or employees to report possible offences in the company's structure and to provide the possibility for whistle-blowers to assure their anonymity. The need to legally regulate this matter is a fact. It would be relevant to establish rules concerning the status of whistle-blowers and their protection against possible retaliation within the company's structure.

Whistle-blowers may participate in criminal proceedings as a witness or even as a defendant and each has a different legal status. A witness must answer every question truthfully during examination, while a defendant has a right to remain silent.

Although in the Portuguese jurisdiction there are no incentive programmes for whistle-blowing or specific rewards for whistle-blowers, if the whistle-blower reports some relevant facts or information to the competent public authorities, mainly to the Public Prosecutor's Office, that conduct may help mitigate a penalty if the whistle-blower is a defendant in a criminal case and indicted by the public prosecutor. As mentioned above, Article 71 of the Criminal Code establishes that, when determining a criminal fine, the court must consider the conduct of the defendant after the illegal fact, which may help whistle-blowers to mitigate their possible penalties by cooperating with the public authorities.

Although it is not designed to protect whistle-blowers, Law No. 93/99 of 14 July established certain rules and programmes regarding the protection of witnesses. A witness may receive protection if his or her life, physical or psychological integrity, freedom, or material assets of high value are in danger because of the witness' contribution to the case. This may help protect a whistle-blower's identity and anonymity.

Also of note is the recent EU Whistleblowing Directive,17 which must be transposed into national law by 17 December 2021. Portugal has yet to bring into force the legislation and necessary provisions to comply with the final version of this EU instrument on whistle-blowing, but this is one of the government's priorities, according to the recently approved National Anti-Corruption Strategy 2020–2024.


i Corporate liability

The rule in Portuguese criminal law is that only natural persons (individuals) are subject to criminal liability. However, the law establishes some exceptions (restricted to a range of crimes) that allow the extension of criminal liability to legal persons (companies).

Article 11 of the Criminal Code establishes that companies, except for the state or organisations acting within the purview of a public authority, may be held liable for the crimes listed in Paragraph 2, which include, among others: (1) trading of favours; (2) violation of prohibitions or restrictions; (3) bribery; (4) cronyism; (5) money laundering; (6) unlawful offering of an advantage; (7) corruption; and (8) embezzlement.

However, companies can only be held liable if a crime is committed on behalf of the company and for the company's benefit or interest: (1) by an individual in a leadership position; or (2) by someone acting under the authority of an individual in a leadership position because of his or her lack of surveillance or control duties incumbent upon the latter.

An individual in a leadership position is a member of a governing body or someone who has the power to control the activity of the company.

The main exception to this regime is established for the specific case of tax crimes, where a company is held liable for actions performed on its behalf and for the company's benefit or interest, by governing bodies and any representatives.18

A company can exclude its liability by evidencing that an individual has acted against its concrete orders and instructions. Corporate liability does not exclude individual liability and does not depend on it.

Other crimes can be committed by companies in respect of specific legislation (for instance, Law No. 20/2008 of 21 April regarding corruption in international trade and in the private sector, and Law No. 52/2003 of 22 August regarding counter-terrorism).

Following the new National Anti-Corruption Strategy, the government intends to standardise the different legal frameworks that extend criminally liability to legal persons.

Besides criminal liability, companies can also be held liable for regulatory offences. The legal requirements are similar to the ones mentioned above regarding criminal liability. The main difference is that, although the general legal framework for regulatory offences19 determines that companies should be held liable for the offences committed by their governing bodies,20 most courts have broadly interpreted this principle to include in its scope actions performed by workers, members of the board or any representatives. Once again, if the company is able to demonstrate that an individual's actions are a result of a violation of express orders or instructions, its liability can be excluded.

Other specific legal frameworks, namely in the energy sector, the securities market sector and the banking sector, have adopted the same criteria followed by case law regarding the general legal framework for regulatory offences.

In contrast, a similar provision to the one established in the Criminal Code has been adopted in the competition legal framework.

If there are no incompatible positions between the company and its members or employees, it is not strictly forbidden for both the company and the individuals to be represented by the same counsel. Furthermore, if the company's defence strategy also includes the defence of its employees, joint legal representation or, at least, a closely coordinated defence is advisable. In that case, there is no issue regarding a company paying the legal fees of the individuals connected to the case.

However, if the company argues that the individual's actions were committed against company orders or instructions, the defence must be conducted separately, in which case, a counsel representing both parties would give rise to a professional conflict of interest. In this regard, the Code of Practice of the Portuguese Bar Association21 establishes that a lawyer shall not represent two or more clients in the same matter, or a related matter, if there is a conflict of interest between those clients. If that is the case, it is not advisable for the company to pay the individual's legal fees.

As mentioned in Section I, Decree-Law No. 9/2021, in establishing the new legal framework for economic regulatory offences also expands the model of corporate liability for administrative offences in several economic sectors. Pursuant to this new Decree-Law, legal persons may be held liable for regulatory offences committed on behalf of the legal person and for the legal person's benefit or interest by its governing bodies, representatives and even workers when they act within the scope of their duties.

Companies may also be held civilly liable for the conduct of their employees. According to Article 500 of the Portuguese Civil Code, companies are strictly liable for all damage caused to third parties by an individual acting in the company's name (even if the damage is caused intentionally or against company orders or instructions). Nevertheless, companies have a right of recourse against such individuals unless it is demonstrated that the company itself contributed to the damage.

ii Penalties

Under Portuguese criminal law, there are two kinds of criminal penalty that may be imposed on companies: main penalties and ancillary penalties. Pursuant to Article 90-A of the Criminal Code, companies may be punished by penalties of a fine or with a judicial winding-up order.

The winding-up shall only be ordered if the company was incorporated with the exclusive or predominant intention to commit crimes, or if it is being used, exclusively or predominantly, to commit those crimes by those who have a leadership position.

The concrete application of a criminal fine depends on the decision of the court. Under Article 90-B of the Criminal Code, fines are determined in two steps: (1) establishing the number of days that compose the fine, which may never be less than 10 and that is determined in accordance with the gravity of the offence; and (2) defining the monetary value of each day in accordance with its economic and financial situation as well as any obligations to workers; in each case, the monetary value of each day shall correspond to an amount between €100 and €10,000.

In cases in which the rule of criminal law does not set a day-rate system, but solely a prison sentence, the corresponding penalty for a company will still be a fine, in which a month in prison will be equivalent to 10 days of fine.

If the applicable fine is not higher than 240 days, the court is entitled to discipline companies with a simple admonition, as set out in Article 90-C of the Criminal Code.

Under Article 90-D of the Criminal Code, if the applicable fine is not more than 600 days, the court is entitled to replace it for a good behaviour bail, from €1,000 up to €1 million. This bail will be retained by the court for one to five years. If the company, in that period, commits the same crime, the bail reverts to the state.

Furthermore, the Criminal Code sets out the following ancillary penalties:

  1. adopting necessary procedures to cease the unlawful behaviour;
  2. prohibition of exercising a certain activity, from three months up to five years, if the crime was committed within the scope of the company's activity;
  3. prohibition of engaging in certain agreements;
  4. prohibition of the right to receive public grants or subsidies;
  5. closing down of the business, from three months up to five years, if the crime was committed within the scope of the company's activity; and
  6. publication of the conviction.

In certain areas of criminal law, namely within the scope of the law relating to corruption in international trade and in the private sector22 and the Anti-Money Laundering Law, a company can be punished with a fine pursuant to Article 90-B of the Criminal Code.

As foreseen in criminal law, under Decree-Law No. 433/82 of 27 October, establishing the general legal framework for regulatory offences, there are two kinds of regulatory penalties that may be applied to companies: main penalties and ancillary penalties. The main penalty applicable is also a fine.

Regarding companies' concrete penalties, in some areas of regulatory offences, namely, inter alia, the Anti-Money Laundering Law and the Legal Framework of Credit Institutions and Financial Companies, the maximum limit of the fine is increased to the following amounts: (1) 10 per cent of the annual business turnover of the financial year before the guilty verdict; or (2) two times the amount obtained as a result of the offence.

In addition, the Securities Code23 stipulates that the maximum limits of applicable penalties may be increased by the following amounts: (1) 10 per cent of the annual business turnover according to the latest consolidated accounts approved by the board of directors in the financial year before the guilty verdict; or (2) three times the amount obtained as a result of the offence committed.

Moreover, pursuant to the Competition Law,24 the amount of the fine shall not exceed 10 per cent of the annual business turnover of the financial year before the conviction.

The following are the main ancillary penalties applicable to companies under the general legal framework for regulatory offences:

  1. loss of the benefit obtained as a result of the offence;
  2. prohibition of exercising activities that depend of any authorisation granted by administrative agencies or other administrative authorities or bodies;
  3. prohibition of the right to receive public grants or subsidies;
  4. prohibition of the right to enter into public agreements;
  5. closing down business whose operations depend on an administrative business licence;
  6. the suspension of administrative authorisations and licences; and
  7. publication of the conviction.

These ancillary penalties shall only be applied for a limited period, as set out in each sector-specific legal framework. In general, the legal framework for regulatory offences establishes that the ancillary penalties (except for loss of benefit) shall not be applied for longer than up to two years.25

In some cases, taking into consideration, inter alia, the ne bis in idem principle, companies may be held both criminally and administratively liable. If these offences are in a relation of consumption, the main penalty for the offence should be the one applicable to the crime, together with possible ancillary sanctions established to the regulatory offence. However, it is possible for the authorities to design the indictment such that both offences (criminal and administrative) are considered concurrently, and thereby request the application of the penalties and sanctions foreseen for both offences.

iii Compliance programmes

The existence of a compliance programme may be an important defence tool when a company faces a criminal or regulatory proceeding related to a possible offence.

However, it is mandatory that a company's compliance programme is not only approved, but also fully enforced within the company's structure, with express statements and specific orders or instructions. It is not enough that the compliance programme defines the internal policy of the company, with a description of the company's values and mission. To be effective or legally significant, a compliance programme must establish specific guidelines concerning the company's activities, services and internal proceedings and mechanisms, clearly stating what is forbidden according to company policy. It is not enough simply to have a programme written on paper, or one with only general recommendations.

To establish and define an effective programme, it is important that the company conducts a very careful risk assessment, taking into consideration its activity, business sector and already adopted internal procedures. That risk assessment should also analyse the country's main features and the features of the countries where the company has commercial activities or trade relationships. This due diligence process should also identify people and services that may present a greater risk in terms of disrespecting rules and internal procedures must always be carried out in relation to a counterparty in a business or contract, before initiating a formal relationship with that other company.

When it is defined and approved, the programme should be presented and explained to all members and employees and always accessible to be read and consulted. And it is advisable that the company develops and maintains an internal compliance department, working closely with management and several departments. The compliance department and the compliance officer shall be responsible for establishing rules, improving the internal proceedings and mechanisms, and for the constant updating of the internal programmes and duties. The company may also request an external and independent auditor to analyse its compliance programmes and internal proceedings, therefore granting an additional note of adequacy and sufficiency for those programmes and proceedings.

It is also important to have internal training sessions to explain the programme to all members and workers within the company's structure. Some compliance programmes may also include a disciplinary system for programme violations, as well as a system for protection of whistle-blowers, to assure and protect their anonymity and the confidentiality of the reported information.

The specific regulation and legal relevance of the compliance programmes depend on the sector of activity. Usually, companies operating in the financial and economic sector have been more regulated than the others, facing more legal obligations in this matter.

As explained before, according to the Criminal Code,26 a company may not be held criminally liable if it is able to prove that the individual, who adopted a certain conduct or behaviour, acted against concrete orders or instructions from one who has the authority within the company.

An adequate and fully enforced compliance programme may therefore be used as an argument of defence to exclude the company's criminal liability.

The same rule applies to certain regulatory offences, namely in the context of the energy sector,27 the banking sector28 and also offences regarding anti-money laundering.29 Within the scope of the securities market legal framework, a company may not be held liable if the individual acted against express, specific and individual orders or instructions provided to that individual before the offence was committed.30

Although the compliance programme does not preclude the company from liability, it may help mitigate the penalty. According to Article 71 of the Criminal Code, which establishes the general rules regarding the relevant factors that help determine the penalty, it is mandatory to consider all circumstances that may be against or in favour of the defendant. A compliance programme may help mitigate the severity of the offence or it may be deemed as previous conduct that mitigates the severity of the offence. The new National Anti-Corruption Strategy also aims to enhance the importance of the role of compliance programmes in mitigating possible penalties for legal persons.

The same applies to regulatory offences, as a fully approved and enforced compliance programme may help mitigate the severity of the offence and the company's fault, pursuant to Article 18 of Decree-Law No. 433/82.31

iv Prosecution of individuals

As mentioned before, according to the Criminal Code,32 a company's liability neither precludes an individual's liability nor depends on it.

In most legal cases investigated and decided in Portugal, companies and some of their individual employees have been simultaneously considered liable or, at least, simultaneously investigated. However, the Portuguese model of corporate liability is not an example of strict personal liability (i.e., not strictly grounded on the wrongdoing of specific individuals that represent the company). Therefore, it is important to identify the individuals or group of individuals who committed the offence (or omitted a required conduct) on behalf of the company and for the company's benefit or interest.

This is also the rule for regulatory offences, namely those in the energy sector,33 the banking sector34 and the securities market sector.35

As mentioned above, if there is no conflict of interest between a company and its members or employees, they can be represented by the same counsel.


i Extraterritorial jurisdiction

Article 4 of the Criminal Code establishes that Portuguese criminal law shall be applied to the offences committed: (1) in the Portuguese territory, regardless of the offender's nationality; and (2) in Portuguese ships or aircraft, unless international treaties and conventions to which Portugal is a party provide otherwise.

However, Article 5 mentions several cases in which Portuguese criminal law is also applicable, even though the offence is committed abroad. These mostly relate to:

  1. certain types of crimes, such as crimes concerning counterfeiting of currency, debt security and sealed values; crimes against national independence and integrity; crimes against the constitutional state; sexual crimes; kidnapping; slavery; female genital mutilation; forced marriage; human trafficking and crimes against nature; as long as the offender is found in Portugal and cannot be extradited; or
  2. the nationality principle, where the offence is committed by or against a Portuguese person and: (1) the offender is found in Portugal; (2) the offence is also punishable under the law of the state where it was commissioned; and (3) it is possible to extradite someone for that crime but extradition is not granted in that case.

As for companies, according to Article 5 of the Criminal Code,36 Portuguese criminal law is applicable when an offence is committed abroad by or against a company that has its registered office in Portugal.

In relation to crimes concerning corruption in international trade and the private sector, the above-mentioned general rule provided by Article 4 is also applicable. Nevertheless, under the terms of Law No. 20/2008 of 21 April, Portuguese law is also applicable in the following cases: (1) active corruption affecting international trade, in connection to offences carried out by Portuguese nationals or foreigners who are found in Portugal, regardless of where the offences were committed; or (2) active or passive corruption in the private sector, regardless of where the offences were committed, when whoever promises, requests or accepts an advantage or promise is a national official or holder of a national political responsibility or, if Portuguese, an employee of an international organisation.

Specifically concerning terrorism, Law No. 52/2003 of 22 August provides that, in addition to the general rule, Portuguese law also applies to offences committed abroad in the following cases: (1) where they constitute a crime of terrorist organisations or terrorism; or (2) where they constitute crime of other terrorist organisations, international terrorism or terrorism financing, provided that the offender is found in Portugal and cannot be extradited or handed over in execution of a European arrest warrant.

Portuguese criminal law is applicable to offences concerning drug trafficking37 committed outside the national territory when they are carried out: (1) by foreigners, provided that the offender is in Portugal and is not extradited; or (2) on board a ship against which Portugal has been authorised to take the measures provided for in Article 17 of the UN Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances of 1988.

In general, the provision for regulatory offences is the same as for criminal offences. However, there are some exceptions to this general rule provided by specific regimes. For instance, in addition to the general rule, within the scope of the Legal Framework of Credit Institutions and Financial Companies, Portuguese law is also applicable to offences committed abroad by credit institutions or financial companies with a registered office in Portugal and operating in the country through branches or by providing services, and by individuals who represent those entities or are their shareholders. Furthermore, Article 2 of the Competition Law establishes that Portuguese law applies to prohibited practices and concentrations of undertakings that take place in the Portuguese territory or whenever these practices have or may have an effect there, provided that international obligations assumed by the Portuguese state are met.

ii International cooperation

Portugal has ratified numerous (bilateral and multilateral) international instruments to simplify cooperation between states.

As a member of the Community of Portuguese Language Countries, Portugal also participates in several conventions that ease cooperation between those countries. These conventions cover specific terms for extradition, mutual assistance in criminal matters, and transfers of sentenced persons.

Moreover, as an EU Member State, Portugal has closer cooperation with other Member States. For instance, Law No. 65/2003 of 23 August, which implemented the European Arrest Warrant, is of utmost importance in EU cooperation in that it eliminates the use of extradition, so proceedings are swifter and with shorter time limits, albeit the rights of defence are respected. Moreover, Law No. 88/2017 of 21 August establishes a regime for the enforcement of a decision rendered by a judicial authority of an EU Member State in another Member State concerning specific investigatory measures, to obtain evidence. The exchange of data and information between EU Member States in the context of an investigation is also eased by Law No. 74/2009 of 12 August. In addition, Law No. 36/2015 of 4 May provides a regime for the recognition and supervision of the enforcement of decisions on constraining measures as an alternative to pretrial detention, as well as the surrender of a person between EU Member States in the event of non-compliance with the measures imposed. Law No. 158/2015 of 17 September is also of maximum importance as it is concerned with the recognition of judgments rendered in the EU context, establishing a legal regime for the transmission and enforcement of decisions in criminal matters imposing prison or other custodial measures for the purposes of enforcing those decisions in the EU. Finally, Law No. 88/2009 of 31 August is also notable as it provides the legal framework for the issuance and transmission by a court competent in criminal matters of decisions on the confiscation of property or other products of crime in the context of criminal proceedings, concerning their recognition and enforcement in another EU Member State.

Alongside international and European instruments, multiple national instruments have been approved to ensure international cooperation. The International Judicial Cooperation Law in Criminal Matters38 is the most relevant instrument, because it establishes a comprehensive regime concerning extradition, transfer of criminal procedures, enforcement of criminal judgments, transfer of sentenced persons, supervision of conditionally sentenced or conditionally released offenders and mutual assistance in criminal matters.

In relation to extradition, Portugal has signed a large number of bilateral treaties. According to those treaties, the principle of reciprocity is the basic principle that provides the possibility of extradition, subject to certain exceptions. Also, as a matter of principle, Portugal does not extradite its own nationals. In addition, for Portugal to grant extradition, it is necessary that the offence at stake is considered a crime both in Portugal and in the requesting state, and that the offence is punishable by a minimum of one year of imprisonment.

Finally, an extradition request shall be refused if: (1) there are grounds admitting that the request is based on any form of discrimination or for political reasons; (2) the offender's procedural guarantees are diminished because of any discriminatory factor; or (3) the offence at stake is punishable by death, irreversible injury or life sentence in the requesting state, unless assurance is given that these penalties will not be applied.

The Cybercrime Law39 establishes some rules regarding international cooperation. Under the terms of the Law, among other rules and measures, the criminal police ensure that a contact point is permanently available for the provision of expert advice to other contact points and to preserve data, collect evidence and locate suspects in cases of urgency.

iii Local law considerations

Regarding bank secrecy, Portuguese authorities may refuse to provide information in the context of an international investigation on the basis of Article 78 of Decree-Law No. 298/92. However, Article 81 of the same Decree-Law provides a comprehensive regime not only concerning cooperation with other EU Member States, but also in relation to non-EU Member States, on a reciprocity basis, within the scope of cooperation agreements, regarding the information required for supervision on an individual or consolidated basis of credit institutions having their registered office in Portugal and of similar institutions having their registered office in those countries.

As regards data privacy, together with the EU General Data Protection Regulation (GDPR),40 the recently approved Law No. 58/2019 of 8 August limits the possibility of exchanging information regarding personal data. In relation to third countries, pursuant to Article 22 of Law No. 58/2019, the transfer of data to non-EU Member States or international organisations, carried out in compliance with legal obligations by public entities in the exercise of authority powers, are deemed to be in the public interest for the purposes of the GDPR.41

Finally, regarding letters rogatory, Article 232 of the Procedural Criminal Code establishes that Portuguese authorities can refuse to comply with those letters if: (1) the judicial authority is not competent to perform the act requested; (2) the request concerns an act prohibited by law or violates the Portuguese public order; (3) the execution of the letters rogatory affect the sovereignty or security of the state; or (4) compliance entails the execution of a foreign court decision that is subject to review and confirmation but has not yet been reviewed and confirmed.

Year in review

In recent years, there have been some high-profile cases in which a company's liability has been analysed.

For instance, in the E-toupeira case, the criminal liability of Benfica SAD (a Portuguese football club) was dropped, because the court found that the individual offender did not occupy a leadership position within the company and that the offence had not been committed on behalf of the company nor was it committed for its benefit or interest. The court also held that the company did not violate any surveillance or control duties, through someone occupying a position of leadership, pursuant to Article 11 of the Criminal Code.

The previously mentioned EU Whistleblowing Directive applies to persons who work for a public or private organisation, or who are in contact with such an organisation in the context of their work-related activities, and who report any breach of Union law possibly harmful to the public interest. This Directive aims to protect whistle-blowers against any possible retaliation by setting up safe internal reporting channels. Portugal shall bring into force the necessary laws, regulations, and administrative provisions to comply with the Whistleblowing Directive by 17 December 2021.

Furthermore, Portugal has been working on new anti-bribery legislation for several years, including the regulation of lobbying activity and alternatives to the criminalisation of unlawful enrichment. A draft law on that matter was dismissed as unconstitutional by the Portuguese Constitutional Court, but the issue is being discussed again by Parliament and a new draft law may be presented in the coming months.

The statute on the regulation of lobbying activity approved by Parliament in July 2019 was vetoed by the President as having some shortcomings, which have yet to be rectified. The discussion on the regulation of lobbying, in particular the rules of transparency applicable to private entities carrying out legitimate representation of interests before public entities, is expected to proceed during the coming months.

Moreover, in the past year, Law No. 52/2019 of 31 July introduced an exclusivity obligation into the conduct of public office, and an obligation to present, in a single document accessible online, all the income and asset declarations made by holders of political positions and high public offices. These declarations must also include every act and activity that could lead to incompatibilities and impediments for holders of political position or high public office. In addition, Organic Law No. 4/2019 of 13 September created the Transparency Authority, the body responsible for monitoring and assessing the truthfulness of the income and asset declarations made by holders of political positions and high public offices.

Conclusions and outlook

Significant developments in major criminal and regulatory cases in Portugal are expected in the near future. In particular, a court recently issued a pretrial decision in the Operation Marquis inquiry, in which a former prime minister was accused of, among other things, the crime of corruption by a political office holder.

The court found that the limitation period for the corruption crimes had already elapsed when the defendants were charged by the Public Prosecutor's Office. Therefore, the former prime minister was only brought to criminal trial on charges of money laundering and document forgery. However, the Public Prosecutor's Office will most likely appeal to the Lisbon Court of Appeal asking that the former prime minister and other defendants be brought to trial on the former corruption charges, and for other crimes, namely money laundering, tax fraud and document forgery.

Furthermore, significant decisions are also expected regarding criminal and regulatory investigations into the resolution of BES, one of the biggest banks in the Portuguese financial system. This occurred in 2014 and the Public Prosecutor's Office has already arraigned several defendants on criminal charges. The criminal case is currently awaiting commencement of the pretrial stage.

From a different perspective, it is expected that the Prosecutor General's Office and the financial system regulatory authorities will continue to tighten their supervision of operations that may reveal evidence of money laundering – a trend that started in 2017 with the new law on the prevention and prohibition of money laundering and a possible increase of money laundering cases.

Finally, since the indicators on the public perception of transparency and illicit practices within the state administration are still not favourable in Portugal, the discussion about new measures to tackle corruption is likely to continue and new forms of leniency practices and agreements will be implemented.


1 João Matos Viana is a partner, João Lima Cluny is a managing associate and Tiago Coelho Magalhães is an associate at Morais Leitão, Galvão Teles, Soares da Silva & Associados.

2 Decree-Law No. 486/99, of 13 November.

3 Decree-Law No. 298/92, of 31 December.

4 Article 71, number 2, subparagraph (e) of the Portuguese Criminal Code.

5 Law No. 83/2017, of 18 August.

6 Directive (EU) 2019/1 of the European Parliament and of the Council of 11 December 2018 to empower the competition authorities of the Member States to be more effective enforcers and to ensure the proper functioning of the internal market.

7 Law No. 58/2019, of 8 August.

8 Law No. 46/2018, of 13 August.

9 Article 368-A et seq.

10 Article 368-A, number 6.

11 Decree-Law No. 298/92, of 31 December.

12 Article 116-AA.

13 Article 116-AA, number 2 and number 6.

14 Article 20.

15 Article 20, number 2.

16 Article 20, number 6.

17 Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

18 Article 7 of Law No. 15/2001, of 5 July.

19 Decree-Law No. 433/82, of 27 October, establishing the general legal framework for regulatory offences.

20 Article 7 of Decree-Law No. 433/82, of 27 October.

21 Article 99, number 3, of Law No. 145/2015, of 9 September.

22 Law No. 20/2008, of 21 April.

23 Article 388, number 2.

24 Article 68, numbers 3 and 4 of the Portuguese Competition Law.

25 Article 21, number 2 of Decree-Law No. 433/82 (see footnote 19).

26 Article 11, number 6 of the Criminal Code.

27 Article 37, number 3 of Law No. 9/2013, 28 January.

28 Article 203, number 2 of Decree-Law No. 298/92, of 31 December.

29 Article 162, number 2 of Law No. 83/2017, of 18 August.

30 Article 401, number 3 of Decree-Law No. 486/99, of 13 November.

31 Article 18, number 1 of Decree-Law No. 433/82, of 27 October.

32 Article 11, number 7 of the Criminal Code.

33 Article 37, number 5 of Law No. 9/2013, of 28 January.

34 Article 204, number 1 of Decree-Law No. 298/92, of 31 December.

35 Article 401, number 5 of Decree-Law No. 486/99, of 13 November.

36 Article 5, number 1, subparagraph (g) of the Criminal Code.

37 Decree-Law No. 15/93, of 22 January.

38 Law No. 144/99, of 31 August.

39 Law No. 109/2009, of 15 September.

40 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

41 Article 49, number 4 of Regulation (EU) 2016/679.

Get unlimited access to all The Law Reviews content