On 29 January 2026, the ECJ delivered its judgment in Case C-291/24, Steiermärkische Bank und Sparkassen and Others. In the first place, the Court clarified the conditions under which legal persons may be held liable for breaches of the anti-money laundering obligations laid down in Directive (EU) 2015/849 (the 4th Anti-Money Laundering (AML) Directive). The Court held that the Directive precludes national rules under which a legal person may be penalised only if a named natural person has first been formally treated as an accused person and found to have committed an unlawful and culpable offence attributable to that legal person. In the second place, the Court held that the Directive does not preclude national limitation periods of three years for bringing proceedings and five years for imposing a penalty, provided that the principles of equivalence and effectiveness are respected.

Background of the case and questions referred

The request for a preliminary ruling arose from proceedings before the Bundesverwaltungsgericht (Federal Administrative Court, Austria) concerning an administrative criminal penalty imposed on Steiermärkische Bank und Sparkassen AG by the Austrian Financial Market Authority for breaches of its anti-money laundering due diligence obligations.

The penalty was based on § 35(1) and (2) of the Austrian Finanzmarkt-Geldwäschegesetz (FM-GwG), under which a legal person may be held liable where a breach is committed for its benefit by a person holding a leading position within it or where that person’s lack of supervision or control enables a subordinate to commit such a breach.

Two features of the Austrian legal framework gave rise to the reference. Firstly, the case law of the Verwaltungsgerichtshof (Supreme Administrative Court, Austria) introduced additional requirements for holding a legal person liable for an administrative fine. Accordingly, a legal person may only be penalised if: (1) the natural person whose conduct is attributed to it has been made a party to the proceedings and treated as an accused person, with all the rights attached to that status; (2) the operative part of the penalty decision identifies that person by name, establishes that he/she committed an unlawful and culpable offence; and (3), in that operative part, this offence is attributed to the legal person concerned.

Secondly, § 36 FM-GwG lays down a three-year limitation period for bringing proceedings and a five-year period for imposing a penalty, both calculated from the date on which the offence ended. Given the complexity of such proceedings and the often opaque nature of the underlying facts, the referring court questioned whether these time limits were compatible with the principle of effectiveness.

Accordingly, the referring court asked, in essence, whether Arts. 58–60 of Directive 2015/849, read in the light of the principle of effectiveness:

• Preclude the additional requirements imposed by Austrian case law for penalising legal persons;
• Preclude the limitation periods laid down in § 36 FM-GwG?

The ECJ’s reasoning on the conditions for the liability of legal persons

At first, the ECJ referred to Art. 58(1) of Directive 2015/849, which requires Member States to ensure that obliged entities can be held liable for breaches of the national provisions transposing the Directive. Given that Art. 2(1) of the Directive expressly includes both natural and legal persons within the definition of obliged entities, the Court inferred that legal persons must be capable of incurring liability in their own right.

It further emphasised that nothing in Art. 58 indicates that the liability of a legal person is dependent on a prior determination, in the same proceedings, that an identified natural person is personally responsible for the infringement. In support of this interpretation, it relied on two arguments derived from the overall scheme of the 4th AML Directive:

• Art. 58(3), which requires sanctions and measures to be applied against members of the management body and other natural persons responsible for the breach, submits that their liability is merely “ancillary and additional” to that of the legal person; therefore, this liability of natural persons complements, rather than conditions, the liability of the legal person.
• Art. 60(5) and (6), which define the circumstances in which the conduct of natural persons may be attributed to a legal person, presuppose that the legal person itself is capable of incurring liability. Accordingly, the legal person’s responsibility depends on whether the conditions for attribution are satisfied, rather than on a prior determination that the natural person concerned is personally culpable for the infringement.

Next to this contextual interpretation, the same conclusion can be drawn from a teleological interpretation of Art. 58(1) of the Directive, which requires sanctions for breaches of anti-money laundering obligations to be effective, proportionate and dissuasive. In this context, requiring a specific natural person to be formally accused as well as found to have acted unlawfully and culpably would risk undermining the effectiveness and deterrent effect of sanctions imposed directly on legal persons in their capacity as obliged entities with independent liability.

Lastly, the minimum-harmonisation character of Directive 2015/849 does not justify the Austrian approach either. Although Member States remain free to adopt stricter preventive measures and provide for additional penalties, they cannot introduce conditions that restrict the liability of legal persons required by Art. 58(1). Minimum harmonisation permits national law to exceed the level of protection prescribed by the Directive, but not to fall below it. Otherwise, national law could define the conditions for penalising legal persons so narrowly that the liability expressly required by Art. 58(1) would rarely, if ever, arise.

It is for the referring court, in accordance with the principle of consistent interpretation, to interpret the relevant national provisions, so far as possible, in the light of the wording and purpose of the Directive.

The ECJ’s reasoning on the limitation periods

Regarding the limitation periods, the ECJ observed that Directive 2015/849 does not harmonise the national rules governing the time limits for bringing proceedings and imposing penalties for breaches of anti-money laundering obligations. Member States therefore retain procedural autonomy, provided that the principles of equivalence and effectiveness are respected. Accordingly, national rules must not be less favourable than those applicable to comparable domestic proceedings, nor must they render the enforcement of rights and obligations arising under EU law practically impossible or excessively difficult.

Applying these principles, the Court recalled that reasonable limitation periods are compatible with EU law, as they serve the interests of legal certainty and the stability in legal relations. It therefore held that limitation periods of three years for initiating proceedings and five years for imposing a penalty are, in principle, consistent with EU law, observing that nothing in the material before it indicated otherwise.

Put in focus

The judgment draws a clear distinction between the attribution of conduct to a legal person and the personal liability of the natural person concerned. Although the liability of a legal person remains dependent on the attribution criteria laid down in Art. 60(5) and (6), it does not require the prior prosecution or conviction of an identified individual in the same proceedings. Corporate liability under Directive 2015/849 is therefore autonomous, but not detached from the acts or supervisory failures of natural persons. In this respect, the ECJ continues the approach developed in Deutsche Wohnen (→ eucrim 4/2023, 329–330), confirming that national procedural requirements must not undermine the effective and dissuasive penalisation of legal persons acting as obliged entities. At the same time, the judgment preserves Member States’ procedural autonomy by accepting reasonable national limitation periods.