I. Introduction

The original OLAF Regulation’s lack of a formal procedure for handling individual complaints by persons concerned had long cast doubt on the sufficiency of existing mechanisms to safeguard fundamental rights and procedural guarantees in all circumstances.¹ After a long legislative journey,² the gaps identified were finally addressed through Regulation (EU, Euratom) 2020/2223,³ which amended Regulation (EU, Euratom) No 883/2013 (the “OLAF Regulation”)⁴ and created the function of the Controller and the complaints mechanism. As this article further elaborates, experience since then has confirmed both the necessity of this function and its added value.

The Controller serves as an independent safeguard for persons concerned, i.e., persons or economic operators suspected of having committed fraud, corruption or any other illegal activity affecting the financial interests of the Union and who are therefore subject to investigation by OLAF.⁵ The Controller was designed to reinforce the legitimacy, integrity, and public trust of OLAF’s investigative activity. Having been appointed as the first Controller on 3 May 2022, I have since exercised my mandate by gradually but steadily adjusting and aligning the principles of effective judicial protection with those of administrative protection.

As Lord Hewart famously stated, “justice should not only be done, but should manifestly and undoubtedly be seen to be done.”.⁶ This principle is particularly relevant to administrative investigations, where the appearance of fairness is inseparable from institutional legitimacy. OLAF’s investigative conduct must therefore be beyond reproach. Full respect for and safeguarding of the procedural guarantees and fundamental rights of persons concerned in its investigations are foundational to the credibility of OLAF’s work.

The Controller handles complaints lodged by persons concerned regarding the Office’s compliance with procedural guarantees, as well as complaints alleging infringements of the rules applicable to investigations by the Office,⁷ in particular infringements of procedural requirements and fundamental rights.⁸ To that end, a complaints mechanism was established.⁹

Since my appointment as Controller, I have dealt with more than 70 complaints and horizontal issues impacting the rights of persons concerned in OLAF investigations. In doing so, I have taken into account fundamental rights stemming from the Charter of Fundamental Rights of the EU (the Charter),¹⁰ alongside the specific procedural guarantees that govern OLAF’s activities, general legal principles, and the case-law of the EU Courts applicable to OLAF investigations. As a former judge of the European Court of Human Rights (ECtHR), I have also drawn on its case-law regarding fundamental rights guaranteed.¹¹

I would also like to emphasise that, in my practice as Controller, I have given special consideration to the right of persons concerned to good administration. The right to good administration enshrined in Art. 41 of the Charter sets forth the right of every person to have his or her affairs handled impartially, fairly, and within a reasonable time by EU institutions, bodies, offices, and agencies (IBOAs). I have thus consistently recalled in my decisions the importance of OLAF staff performing their duties in strict compliance with the core requirements of objectivity, impartiality, professionalism, procedural fairness, and respect for fundamental rights. I firmly believe that ensuring the impartiality and fairness of all OLAF activities not only protects individual rights but also reinforces the legitimacy and credibility of OLAF investigations themselves. This is how justice is not only done, but also seen to be done.

The complaints mechanism is an effective remedy for persons concerned to increase the transparency and accountability of OLAF’s activities. I am convinced that the complaints mechanism has already become an essential safeguard for persons concerned and will further grow into its role in ensuring that OLAF’s activities comply with the relevant procedural guarantees and the rules applicable to investigations.

I welcome the interest shown in other eucrim publications in my function and in developments in the protection of fundamental rights and procedural rights in OLAF investigations.¹² The aim of this article is to shed light on the function of the Controller and the complaints mechanism, reflecting on the work carried out during my almost four-year mandate. I have endeavored to ensure high standards of protection for the fundamental rights and procedural guarantees of persons concerned, while closely working with OLAF to improve the conduct of its investigations in constructive manner. The main achievements of this delicate exercise are presented in this article, where I also share some of the key lessons learnt from handling the complaints mechanism. Finally, I provide an outline of my vision for both the function and the complaints mechanism moving forward.

II. The Controller’s Mandate

When applying the complaints mechanism, the Controller does not interfere with the conduct of an ongoing investigation, as this would constitute a breach of OLAF’s independence.¹³ The Controller also does not seek to substitute her own assessment for that of the OLAF Director-General on whether to open an investigation, the choice of investigative measures, the assessment of evidence, or the conclusions reached.¹⁴

Instead, the Controller’s role involves providing administrative scrutiny to ensure that administrative discretion is exercised within the boundaries of legality, proportionality, and the principles of good administration. If the Controller finds that no breach of procedural guarantees or of the rules applicable to OLAF investigations has occurred, she provides reassurance to the complainant that OLAF has acted in conformity with the rules set out in its legal framework. Conversely, if the Controller finds a breach, she will invite OLAF to take action to resolve the complaint by making a proposal for a solution. If the Controller does not find the actions taken by OLAF satisfactory, he/she will make a recommendation to OLAF on how to resolve the complaint as a second step.¹⁵

As a rule, lodging a complaint does not have suspensive effects on the conduct of the underlying OLAF investigation.¹⁶ Nevertheless, the Controller always strives to strike an appropriate balance between the need to safeguard the efficiency and continuity of OLAF investigations and the requirement to ensure effective protection of fundamental rights and procedural guarantees. In particularly sensitive cases, the Controller has requested that OLAF temporarily suspend its investigative activities while a complaint was under examination. Likewise, there have been instances in which OLAF suspended investigations on its own initiative upon receiving notification that a complaint had been lodged with the Controller. This has occurred in cases where complaints alleged shortcomings affecting the rights of defence, the legality of investigative measures, alleged conflicts of interest among members of the investigation team, and breaches of fundamental rights.

It is also important to clarify that there are three main oversight actors, each with complaints mechanisms, operating under distinct legal frameworks within the EU system of administrative accountability. Nonetheless, their mandates intersect at certain points:

• The European Ombudsman¹⁷ examines complaints and conducts own-initiative inquiries into maladministration by IBOAs, without providing a substitute for judicial review.

• By contrast, the Controller of procedural guarantees is a specialised function embedded in the OLAF administrative investigations regime who handles complaints alleging breaches of the procedural rights applicable in OLAF investigations. This includes matters pertaining to the right to good administration under Art. 41 of the Charter. As a result, there may be complaints regarding alleged maladministration in the conduct of an OLAF investigation that could potentially be lodged simultaneously or subsequently before both the Controller and the European Ombudsman, while respecting their respective mandate and time limits.

• The European Data Protection Supervisor (EDPS) is an independent supervisory authority responsible for protecting the rights to privacy and to the protection of personal data .¹⁸ Since the EU has created a dedicated body to guarantee the fundamental right to the protection of personal data, it is for the EDPS, rather than the Controller, to deal with complaints concerning alleged breaches of data protection rules.¹⁹ While the Controller does not deal with allegations that purely concern the interpretation and application of the EU data protection rules, she considers aspects relating to privacy and data protection when assessing OLAF’s overall compliance with procedural guarantees.²⁰

III. Achievements of the Complaints Mechanism to Date

From the outset, the Controller has approached the function with the aim of contributing to the continuous improvement of OLAF’s investigative practices. This objective has primarily been pursued through decisions adopted under the complaints mechanism, complemented by regular exchanges with OLAF counterparts.

Over time, the Controller has also developed a steady practice of including obiter dicta in her decisions. While these observations are not strictly necessary for resolving the individual complaint, they are intended to strengthen the overall protection of fundamental rights and procedural guarantees of the persons concerned, as well as to promote compliance with the rules applicable to OLAF investigations. Even in cases where no formal breach has been established, these obiter dicta have played an important corrective and preventive role. They have highlighted practical shortcomings, clarified interpretative uncertainties, and identified areas where adjustments to OLAF’s internal practices (or, where appropriate, to the OLAF Regulation), may be warranted. In this way, the complaints mechanism has served as both a remedial tool and a driver for systemic improvement. Furthermore, in cases where complainants retained the services of specialised lawyers, the quality of the exchanges during the handling of their complaints indicates a deepening interest and understanding in the area of fundamental rights and procedural guarantees in the context of OLAF investigations among the legal community.

Since the establishment of the complaints mechanism in 2022, the Controller has handled 76 complaints. In four cases, proposals for a solution were addressed to the OLAF Director-General, all of which were accepted and implemented.²¹ Beyond the resolution of individual complaints, the decisions adopted by the Controller have progressively shaped OLAF’s investigative practices by clarifying the scope and practical application of procedural guarantees. In several instances, the legal reasoning developed in complaints decisions has directly informed amendments to the Guidelines on Investigation Procedures for OLAF Staff (the GIPs),²² thereby extending the impact of individual cases beyond their immediate factual context.²³

1. Admissibility of complaints

The admissibility of complaints serves as an important gatekeeping element in the complaints mechanism. The one-month time limit for lodging complaints in respect of closed investigations, pursuant to Art. 9b(2) of the OLAF Regulation²⁴, reflects a legislative choice aimed at preserving the effectiveness of subsequent judicial or administrative follow-up proceedings at national or EU level. However, the combination of this strict admissibility condition and the absence of a general obligation on OLAF to inform persons concerned of the closure of cases involving findings against them may result in instances where access to the complaints mechanism is de facto denied.²⁵

Addressing this issue has been a key part of the Controller’s casework. In one of the complaints lodged in 2025, she considered that the automatic application of Art. 9b(2), first subparagraph, second sentence, of the OLAF Regulation would, in the exceptional circumstances of the case, undermine the principles of fairness and good administration, as guaranteed by Art. 41 of the Charter. In the case at issue, OLAF had informed the complainant of the possibility of lodging a complaint with the Controller only after the one-month period had already elapsed. In this context, the Controller concluded that the only interpretation that would ensure the effectiveness of Art. 9b(2) of the OLAF Regulation was that OLAF intended for the notification of that communication to serve as the dies a quo of the limitation period. This interpretation ensured that the complainant was not, in practice, deprived of access to the complaints mechanism.

2. Fundamental rights

The first three years of the Controller’s tenure have proved particularly fruitful, yielding tangible improvements in the handling of the fundamental rights and procedural guarantees in OLAF’s investigations. During this time, the Controller has observed a gradual but steady improvement in OLAF’s practices. This suggests that the guidance provided through her decisions on the content and practical operation of the rights of persons concerned in OLAF investigations has played a meaningful role in encouraging OLAF to strengthen its safeguards for these rights. The examples set out below illustrate some of the most significant ways in which the Controller has contributed to clarifying and reinforcing these safeguards to date. They refer to the right to be informed, the requirement to give reasons under the right to good administration, the right to be heard in the framework of the opportunity to comment on the facts established by OLAF, and the right to be assisted by a person of choice during internal investigations.

During the first year of her activities, the Controller found a breach of a complainant’s right to be informed of the closure of an OLAF investigation with no findings against them. According to Art. 11(7) of the OLAF Regulation and Art. 80(1) of the GIPs, OLAF is clearly obliged to inform the person concerned within 10 working days of the decision to close an investigation in which no evidence has been found against them. Upon completion of the investigation, OLAF found no evidence against the complainant and sent a notification, but did not verify whether the complainant had effectively received it (e.g., by requesting an acknowledgement of receipt). More than a year after the closure of the OLAF investigation and only after having requested access to the final report under Art. 10(3b) of the OLAF Regulation, the complainant finally received notification that no evidence had been found against them. In this case, the Controller did not make a proposal for a solution, as the complainant had obtained access to the final report while the complaint was being processed and had therefore become aware that no evidence had been found against them. Nevertheless, the Controller reminded OLAF that this was a serious breach and invited the Office to pay careful attention to similar cases in the future. In line with the Controller’s obiter dicta, OLAF amended its internal procedures for notifying persons concerned and clarified this issue in the newly adopted GIPs.²⁶

Regarding communications with persons concerned, in a different case the Controller acknowledged that the OLAF Regulation does not specify the means of communication OLAF should use in correspondence with persons concerned. However, she underscored that OLAF must ensure that the means of communication used enable persons concerned effectively to become aware of the information sent to them by OLAF. Furthermore, it is for OLAF to demonstrate that it has complied with its obligations and communicated the information in a way that could reach the person concerned. OLAF has a margin of discretion as to the means it chooses to send notifications to persons concerned. Thus, the Controller held that is for the investigative team to choose the means they deem most effective, as long as their purpose is attained. If the chosen means turns out to be ineffective, it is within the discretion of the investigative unit to make use of any other available tool in order to effectively inform the person concerned of a certain communication. In the case at hand, the Controller found that OLAF had acted diligently and in line with the applicable rules, and that no breach had occurred.

In various decisions, the Controller has held that persons concerned do not enjoy an autonomous right to be interviewed; the choice of investigative measures remains within OLAF’s margin of discretion. However, in one case, the complainant challenged OLAF’s refusal to hear additional witnesses whom they considered essential to the investigation. While recognising OLAF’s discretion to determine the most appropriate investigative measures, the Controller emphasised that, pursuant to Art. 41 of the Charter, OLAF must provide clear and specific reasons when it decides not to conduct an interview requested by a person concerned.

In another case, the Controller examined OLAF’s refusal to grant access to documents referred to in the summary of facts. The refusal was based solely on the absence of a general right of access to the investigation file. The Controller found that such reasoning was insufficient. OLAF must assess, in light of the right to be heard, whether the person concerned was effectively able to submit observations without access to the requested documents or knowledge of their content. Nevertheless, the Controller’s decisions have consistently reiterated that no provision confers a general right of access to all documents requested by the person concerned.

Several complaints have raised allegations regarding the conduct of inspections of premises during internal investigations in connection with the right to be assisted by a person of one’s choice. Unlike external investigations, where economic operators are afforded the right to be assisted by a person of choice and the privilege against self-incrimination during on-the-spot checks under Art. 3(8), the OLAF Regulation does not expressly recognize those rights for persons concerned in internal investigations. However, the Controller has taken the view that, as a matter of good administrative practice, OLAF investigators should inform persons concerned in internal investigations that they are free to seek legal advice during inspections. Furthermore, while the applicable legal framework does not prescribe a specific form for communicating the procedural rights of the person concerned in either internal or external investigations, the fundamental importance of those rights justifies consistently providing information about them in writing. The Controller has called for legislative action to further consolidate these best practices within the OLAF Regulation.²⁷

3. Procedural guarantees

A recurring issue raised by complainants has been the definition of the scope of investigations and whether OLAF has acted beyond that scope. The Controller has consistently maintained that an overly broad definition of scope would risk undermining the principles of legality and proportionality that must be observed by OLAF at the selection phase.²⁸ This particularly concerns the assessment of whether there is sufficient suspicion²⁹ to open an investigation. OLAF took the Controller’s considerations into account when amending the GIPs,³⁰ which now require the scope of an investigation to be clearly defined in the opening decision.

Another question raised before the Controller was whether OLAF could continue a complementary investigation³¹ after the European Public Prosecutor’s Office (EPPO) had closed a criminal investigation on the same facts due to insufficient evidence, or whether such continuation would infringe the non bis in idem principle. The complainant argued that the overlap between the two proceedings required OLAF to discontinue its investigation following the EPPO’s decision. The Controller recalled that Art. 12f(1) of the OLAF Regulation expressly allows OLAF to conduct complementary investigations in parallel with EPPO proceedings and that the two proceedings inherently differ in nature and purpose: OLAF conducts administrative investigations which may lead to financial, judicial, disciplinary, or administrative recommendations, whereas the EPPO carries out criminal investigations that may result in criminal convictions. In line with the case-law of the EU Courts, the Controller held that the dismissal of the criminal investigation does not constitute a final determination of liability for the purposes of the non bis in idem principle and does not preclude administrative action, such as a complementary investigation by OLAF.

The Controller has also examined OLAF’s practice of distinguishing between the naming of a person concerned in the decision opening a case and the subsequent registration of that information in the OLAF case management system (OCM), to which the Controller has privileged access.³² It was found that this practice does not promote legal certainty, as it is not provided for in the applicable legislation,³³ and may breach the procedural rights of persons concerned in certain circumstances. This issue has been partially addressed in the revised GIPs, where the clarification of the status of the person concerned constitutes one of most significant amendments.³⁴

Finally, the Controller addressed OLAF’s handling of comments submitted by persons concerned on the summary of facts.³⁵ She held that a generic statement in the final report (according to which the comments provided by the person concerned did not alter the facts or OLAF’s assessment thereof) is insufficient, taken in isolation, to demonstrate that those comments had been genuinely considered. OLAF has taken these considerations seriously and, in line with the Controller’s suggestions, has implemented them into the new GIPs.³⁶

IV. Changes and Challenges ahead

In the context of the evaluation of the OLAF Regulation, and drawing on her extensive experience in handling the complaints mechanism, the Controller has issued an opinion on the application and impact of the provisions of the OLAF Regulation related to her mandate. This opinion identifies areas in which the protection of fundamental rights and procedural guarantees in OLAF investigations could be further strengthened. It will be annexed to the Commission’s submission to the co-legislators as part of the evaluation process under Art. 19(1) of the OLAF Regulation and has been published on the Controller’s website.³⁷

In this opinion, the Controller emphasises the importance of ensuring greater clarity and effectiveness in the complaints mechanisms designed to safeguard fundamental rights and procedural guarantees during the investigative process. She also addresses the mandate and administrative status of the Controller, including considerations related to the functional independence of the role. In addition, she examines the complaints mechanism with a view to identifying potential avenues for improving accessibility, transparency, and procedural certainty for complainants. Finally, the opinion considers the institutional and operational relationships between the Controller and other key actors within the OLAF framework, including interactions with the OLAF Director-General, the Supervisory Committee, and other relevant stakeholders.

Most of the proposals set out in the opinion concern areas already discussed in this article. However, particular attention should be given below to those proposals with potentially more far-reaching impacts on the protection of the fundamental rights of persons concerned, the functioning of the complaints mechanism, and the function of the Controller, including relations with the OLAF Director-General.

The current OLAF Regulation distinguishes between the rights of persons concerned in internal and external investigations, resulting in differing levels of protection. In the Controller’s view, however, the nature of an OLAF investigation (internal or external) should not, in principle, determine the scope or intensity of the fundamental rights and procedural guarantees afforded to persons concerned. Therefore, as a general rule, the level of protection afforded to persons concerned should be aligned and equalised to the greatest extent possible across both types of investigations.³⁸

As regards the rights of defence, particularly the right to be heard, the Controller also calls on the EU legislators to consider introducing clearer and more balanced rules in the OLAF Regulation regarding the information to be provided to persons concerned at the stage of the summary of facts. For the Controller, it is of the utmost importance that persons concerned are in a position to exercise their right to comment on the facts concerning them in a meaningful manner.³⁹ The Controller further proposes that the EU legislators consider extending the right to be heard so that persons concerned can submit observations not only on the facts established, but also on the provisional legal classification of those facts and on the preliminary conclusions drawn by OLAF.⁴⁰

Another key proposal is to extend the personal scope of the complaints mechanism to include not only persons concerned but also witnesses, whistleblowers within the meaning of the Whistleblowing Directive,⁴¹ informants under Art. 22a of the Staff Regulations,⁴² other sources of information and victims of misconduct within OLAF’s investigative remit.⁴³ In addition, the fundamental rights and procedural guarantees arising from such status should be provided for in the OLAF Regulation.⁴⁴ The opinion argues that the Controller was precisely established as an independent body entrusted with safeguarding procedural guarantees in the context of OLAF investigations, and thus should be given exclusive competence to examine all complaints relating to fundamental rights and procedural guarantees, irrespective of the complainant’s status.

Regarding the function of the Controller in relation to the OLAF Director-General, the Controller proposes that the OLAF Regulation be amended to empower the Controller to issue opinions, addressed to the OLAF Director-General, on his or her own initiative, on any matter relating to fundamental rights, procedural guarantees, or the rules applicable to OLAF investigations that fall within the Controller’s remit.⁴⁵

V. Final Remarks

The first years of the function of OLAF’s Controller of procedural guarantees have demonstrated that fundamental rights and procedural guarantees can be strengthened without compromising the effectiveness of OLAF investigations. As mentioned previously, my decisions have not only resolved individual complaints but also progressively shaped OLAF’s investigative practice. This has been achieved by clarifying the scope and practical application of procedural guarantees and encouraging OLAF to better safeguard the rights of defence of persons concerned. As the complaints mechanism continues to evolve – in the words of the ECtHR: as a “living instrument” – its value will depend on sustained dialogue, transparency, and, where necessary, legislative refinement. It remains to be seen whether, and to what extent, the EU legislators will consider the recommendations issued by the Controller as part of the evaluation process of the OLAF Regulation (see above IV.). Regardless of the outcome of such legislative action, ensuring that fundamental rights and procedural guarantees remain operational, rather than merely declaratory, must remain a shared responsibility within the EU’s anti-fraud architecture.

It is essential to raise greater awareness of the Controller’s role and of the complaints mechanism available to those involved in OLAF investigations, in order to effectively protect their fundamental rights and procedural guarantees.⁴⁶ I hope that this article will draw the much-needed attention of legal practitioners and the wider legal community to the complaints mechanism and to the legal developments surrounding the function of the Controller.