I. Introduction – the EPPO’s Jurisdictional Agnosticism

The European Public Prosecutor’s Office (EPPO) is intended to be a unitary body, seamlessly conducting investigations into complex, cross-border fraud, corruption, and money laundering across the twenty-two participating EU Member States. It is to be hoped that this institutional innovation will represent a step change in the currently underwhelming enforcement of economic and financial crime laws in the EU. However, particularly for legal entities operating across multiple jurisdictions in the single market, the EPPO’s very set-up creates a new type of legal uncertainty. This is due to the fact that, unlike investigations carried out by national prosecutors, EPPO investigations are agnostic as to the jurisdictional locus of their ultimate resolution.

EPPO proceedings will be carried out day-to-day by European Delegated Prosecutors (“EDPs”) operating within the jurisdiction of each participating Member State, supervised by the relevant national European Prosecutor (“EP”) based at the EPPO’s central office in Luxembourg. Investigations are monitored by Permanent Chambers made up of several EPs to which cases are allocated on a random basis.¹ For important procedural steps, EDPs and EPs require a decision from the monitoring Permanent Chamber.

The rules on competence as between EDPs are set out in Art. 26 of Regulation 2017/1939 (hereinafter “the EPPO Regulation”),² with paragraph (4) setting out the general rule that proceedings will be:

initiated and handled by a European Delegated Prosecutor from the Member State where the focus of the criminal activity is or, if several connected offences within the competences of the EPPO have been committed, the Member State where the bulk of the offences has been committed.

This general rule can, however, be deviated from. The second sentence of paragraph (4) provides for the possibility that an EDP in another Member State may:

initiate or be instructed by the competent Permanent Chamber to initiate an investigation where a deviation from the rule set out in the previous sentence is duly justified, taking into account the following criteria, in order of priority:

(a) the place of the suspect’s or accused person’s habitual residence;

(b) the nationality of the suspect or accused person;

(c) the place where the main financial damage has occurred.

In addition, paragraph (5) provides that until a decision has been taken “to bring a case to judgment” before a trial court in a particular Member State pursuant to Art. 36, the Permanent Chamber responsible for the investigation may:

in a case concerning the jurisdiction of more than one Member State and after consultation with the European Prosecutors and/or European Delegated Prosecutors concerned, decide to:

(a) reallocate the case to a European Delegated Prosecutor in another Member State;

(b) merge or split cases and, for each case choose the European Delegated Prosecutor handling it,

if such decisions are in the general interest of justice and in accordance with the criteria for the choice of the handling European Delegated Prosecutor in accordance with paragraph 4 of this Article.³

The reallocation, splitting, or merging of a case will lead to changes in the supervising EP(s) and, possibly, the transfer of the monitoring of the case to a different Permanent Chamber.⁴

It is therefore clear that in many circumstances, an investigation initiated and carried out at the behest of the EDP in one Member State may, wholly or in part, be resolved before the courts of another Member State (with evidence obtained by EDPs in yet other Member States⁵).

This potential uncertainty as to the eventual forum for the ultimate resolution of an investigation creates particular difficulties for legal entities. As a starting point, the nature and extent of corporate criminal liability for the offences under the EPPO’s jurisdiction vary significantly across the 22 participating Member States. Further, there is little uniformity in the approach to legal privilege, a matter of great importance to how companies manage their legal exposure. Finally, legal and procedural frameworks encouraging corporate cooperation with criminal investigations are far from uniform or universally established.

Following a closer look at each of these areas, this article will conclude that this level of uncertainty and unpredictability is unnecessarily detrimental not only to the ability of legal entities to manage their enforcement risks, but also to the EPPO’s effectiveness in dealing with complex corporate investigations and proceedings.

II. Divergences in Material Risk

The basis for the EPPO’s material competence is Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union's financial interests by means of criminal law (the “PIF Directive”). The PIF Directive does not impose direct corporate criminal liability for the offences it sets out. Rather, its Art. 6 states that Member States have to ensure that legal entities can be “held liable” for such offences carried out “for their benefit.”⁶

While corporate criminal liability exists in many of the EPPO’s jurisdictions, in some, such as Germany and Italy, it currently does not.⁷ On the fundamental point, therefore, of whether a legal entity can be held criminally liable – or merely civilly or administratively liable – the situation varies across the EPPO’s jurisdictions. ⁸

Whether corporate liability is criminal, civil, or administrative, there is the question of the criteria for that liability to attach. Art. 6(1) of the PIF Directive sets out that legal persons should be liable in respect of the criminal offences set out in the Directive where the offences are:

committed for their benefit by any person, acting either individually or as part of an organ of the legal person, and having a leading position within the legal person, based on:

(a) a power of representation of the legal person;

(b) an authority to take decisions on behalf of the legal person; or

(c) an authority to exercise control within the legal person.

Art. 6(2) adds that legal persons should also be held liable “where the lack of supervision or control by a person [in a leading position] has made possible the commission, by a person under its authority, of [a criminal offence set out in the Directive] for the benefit of that legal person.”

Nevertheless, a quick survey of the various transposing measures shows that great divergence persists. France, for instance, appears to have taken the view that its pre-existing criterion for corporate criminal liability based on acts on behalf of a legal entity by its “organs or representatives”⁹ was adequate. In Italy, however, it appears that legal entities are responsible by virtue of the actions of a wider range of individuals than required by the PIF Directive,¹⁰ whereas Luxembourg’s transposing provisions adopt the exact criteria of the Directive.¹¹

The PIF Directive also leaves open the issue of penalties applicable for legal entities where considerable differences between Member States exist.¹² Its Art. 9 mandates that corporate sanctions should include “criminal or non-criminal fines,” but refrains from setting any reference level for the fines. Art. 9 also leaves it up to the Member States whether non-pecuniary sanctions such as exclusions from public tenders and public support, and judicial supervision or winding-up should be available.¹³

This leaves room for enormous disparity. By way of example, in France, for certain relevant offences, corporate fines are determined by applying a multiplier to any profits derived from the offending conduct (particularly corruption), or to the amounts involved (money laundering). In these latter circumstances, there are no caps. By contrast, Germany, Luxembourg, and Italy are examples of jurisdictions where corporate fines are capped at relatively low levels (€10m¹⁴, €3.75m¹⁵, and €1.549m¹⁶ respectively).¹⁷

Historically, EU reluctance to harmonise the nature and consequences of corporate liability across Member States is rooted in the broader view of sanctions as instruments for ensuring the effective implementation of substantive policies by member states (without dictating the details of how implementation should be achieved).¹⁸ However, in the context of the EPPO’s application of laws transposing the PIF Directive, this instrumental view of corporate liability makes little sense: Given that the EPPO was created as an EU prosecutor specifically tasked with enforcing the criminal law, the availability of specifically criminal sanctions would appear to be the whole point. In this context, harmonising the nature and consequences of corporate liability for legal persons, at least to the same extent as is the case for natural persons, seems relatively uncontroversial. The alternative would be to make it clear that (as in, e.g., Italy) proceedings to hold legal entities liable – be that on a civil or administrative basis – for offences under the PIF Directive fall under the responsibility of the EPPO.

Be that as it may, currently, and as the examples above show, the jurisdiction before which the liability of a legal entity investigated by the EPPO is ultimately to be decided will have an enormous impact on the potential consequences of an adverse finding for that entity. Importantly, the jurisdictional allocation of a case may have little or nothing to do with the status or position of the legal entity, or with its material involvement in the alleged offending.

III. Differing Concepts of Lawyer-Client Confidentiality

Beyond the generally “strengthened protection to exchanges between lawyers and their clients” afforded by Art. 8 of the European Convention on Human Rights (ECHR),¹⁹ there is no conformity within the EU on the scope and extent of the protection of the confidentiality of communications between lawyers and their clients. Consequently, these rules differ across the EU in myriad ways.

At the level of the scope of the protection, and critically for companies, there is no consensus whether lawyer-client confidentiality applies between in-house lawyers and their employer and sole client. For instance, in France it does not,²⁰ whereas in neighbouring Belgium it does.²¹

At the level of the extent of the protection, the readiness of enforcement authorities to seize lawyer-client communications varies widely across the EU, not only as a result of different procedural rules but also (as we know from experience) different traditions in respect of the interaction between defence counsel and enforcement authorities.

When organising the manner in which they obtain legal advice, legal entities can and often do take into account the rules applicable in the relevant jurisdictions. Difficulties arise, however, when communications originally subject to the confidentiality regime of one jurisdiction become potentially relevant to an investigation in another, where their seizure or admissibility will need to be considered. This difficulty is not new, of course; similar challenges existed prior to the advent of the EPPO.²² The EPPO regime does, however, introduce a further layer of complexity in that the determination of the lawfulness of seizure and the ultimate determination of admissibility may well take place in two different jurisdictions.

Legal entities may therefore find themselves in the unenviable situation of having taken confidential advice in one jurisdiction, seeing that advice seized at the behest of the EDP in another, less protective jurisdiction, and having the ultimate admissibility of that advice considered in a third. This is hardly compatible with legal certainty and may deter companies from seeking full and frank legal advice for the benefit of their operations, thereby arguably undermining the rationale for lawyer-client confidentiality, as well as undercutting corporate good governance.

The example of EU competition law shows that it is possible to have a distinct privilege regime for substantive areas of EU law;²³ even lawyers from the common law tradition have learned to operate with the non-availability of legal privilege for in-house advice. It is therefore to be hoped that the EPPO in the short to medium term seek to provide as much operational clarity as possible in relation to its approach to the confidentiality of lawyer-client communications. In the long term, the EPPO will hopefully provide an impetus for EU co-ordination or harmonisation of the applicable conflict rules.

IV. Approach to Corporate Cooperation with Criminal Investigations and the Availability of Out-of-Court Resolutions

Corporate criminal enforcement is an atypical branch of fraud enforcement. This is due to factors such as the dispersal of knowledge within organisations, complex decision-making structures, and a variety of fiduciary obligations. When a prosecutor targets a corporate entity, in most instances those responsible for representing the entity vis-à-vis the prosecutor will have little or no knowledge of the specific conduct under investigation. What is more, company management will be concerned to know as early as possible the potential impact of the investigation and any subsequent proceedings on the company. This is in order to reduce the uncertainties inherent in the investigation and to limit associated negative impacts on the company’s operations. At the same time, investigations into complex economic offending often begin with the discovery of potential wrongdoing by a company employee or official, in the course of its internal processes.

These factors have, in some jurisdictions, led to the adoption of procedures whereby legal entities are incentivised to “self-report” suspected, potentially criminal wrongdoing that is discovered within their organisations, leading to an important source of intelligence for law enforcement. Part of the incentive is often the prospect of some form of out-of-court resolution for criminal acts which the legal entity does not contest. One notable advantage to avoiding a formal conviction is that the company is spared automatic debarment from participation in public tenders, a consideration that will almost inevitably be critical for companies targeted by the EPPO.²⁴ The French Convention judiciaire d‘intérêt publique²⁵ is the best-known example of this kind of procedure within the EPPO’s jurisdiction.

Although these derogatory procedures for companies are controversial, there is little doubt that they save scarce public resources and time, and often give prosecutors access to information otherwise inaccessible to them, or accessible only with great difficulty. It is therefore hardly surprising that there is a growing movement towards formalising procedures which incentivise companies to cooperate with enforcement authorities.²⁶ We also know from practice that the ability to co-ordinate the settlement of cross-border investigations into corporate misconduct is largely dependent on the availability of such procedures, which provide the necessary procedural predictability for all parties involved.

All of these considerations are clearly highly relevant to the EPPO, and Art. 40 of the EPPO Regulation does indeed provide for investigations to be closed by means of out-of- court resolutions if the law applicable to the handling EDP provides for it. The EDPs operating in jurisdictions with such resolutions for legal entities will therefore be able to use them.

The critical question for legal entities and their advisers is what guarantees they would have that their active engagement with, and assistance to, the EPPO will benefit them. In a recent interview, the Dutch EP Daniëlle Goudriaan suggested that companies should treat the EPPO as they would national prosecutors.²⁷ However, this does not take into account the potentially drastic consequences for legal entities of the EPPO’s power to decide on the final jurisdiction for the resolution of any given investigation of which they are a target. Companies that consider engaging with the EPPO on the assumption that the handling EDP will be able to offer them a non-conviction resolution as well as credit for co-operation will have legitimate concerns that these benefits from co-operating are at risk of being lost with the transfer of the case to an EDP in a jurisdiction where such benefits are not available. In such circumstances, we may well find that companies prove reluctant to engage actively with the EPPO. For the reasons set out above, this would be detrimental to the EPPO’s effectiveness.

V. Conclusion

Until recently, companies operating in the single market had the certainty that engaging with the prosecutor in one jurisdiction would engage the procedures applicable in that jurisdiction. As we have seen above, that certainty does not exist for a company faced with a potential EPPO investigation into suspected cross-border criminality. Given the potentially far-reaching implications for the scope and consequences of their legal exposure, companies may well be concerned about “internal forum shopping” by the EPPO. A company that finds itself the target of an investigation by the EPPO and potentially a “victim” of a transfer of the matter to a jurisdiction where its legal risks are materially worse may argue against the transfer: it will be possible to submit written arguments to the EDP as well as the monitoring Permanent Chamber. The EPPO Decision on the Permanent Chambers even contemplates the possibility of “any other person” being invited to attend meetings of the Permanent Chambers,²⁸ a provision which would presumably cover the representatives of a company under investigation making their case viva voce. A company that considers itself unreasonably penalised by a jurisdictional decision by the EPPO could seek judicial review of that decision, ultimately before the Court of Justice of the EU.²⁹

Even so, this level of legal uncertainty, due solely to the ultimate choice of jurisdiction for the resolution of the investigation and unrelated to the seriousness of the suspected misconduct, is clearly undesirable. It is to be hoped that the EPPO eventually provides clear guidance on its approach to jurisdictional selection in relation to legal entities under investigation. Such clarity would enable the EPPO to maximise the potential for corporate cooperation with its investigations. It would also be in the interests of justice.