Under Austrian criminal law, criminal offences are classified as either felonies (Verbrechen) or misdemeanours (Vergehen). The Austrian Criminal Code (Strafgesetzbuch or StGB) defines felonies as intentional offences that are punishable by a term of imprisonment of more than three years (including life sentences). All other offences are classified as misdemeanours (Section 17, StGB).

Elements of an Offence

Austrian criminal law offences consist of external (“objective”) elements and internal (“subjective”) elements. A punishable offence only occurs if all objective and subjective elements are present. The individual elements, both objective and subjective, are expressly defined for each offence.

Objective elements

The objective elements refer to the circumstances of the offence that concern its external appearance. Objective elements include the person of the perpetrator, the act, the object of the act and (in offences requiring completion) the success of the act.

Subjective elements

Subjective elements refer to the perpetrator’s state of mind. A distinction is made between an “intentional act” and “negligence”: a person acts with intent if they purposefully undertake to complete the objective elements of an offence. To prove intent, it is enough to show that the perpetrator is aware of a substantial risk that the offence will be committed and, considering the circumstances, takes the risk (Section 5 paragraph 1, StGB). Increased degrees of intention are defined as “knowledge” (Wissentlichkeit) and “purpose” (Absicht). Where an offence stipulates a certain degree of intention, the offence is committed only if the requisite degree of intent is present (eg, knowingly abusing authority in the offence of breach of trust).

On the other hand, negligence is assumed when a person falls short of the standard required to be exercised under the circumstances – despite having the mental and physical capacity to avoid such failure, and where meeting that standard can be reasonably expected – but fails to realise that an offence is being committed (Section 6 paragraph 1, StGB). Gross negligence is when the actor’s conduct falls exceptionally and substantially short of the requisite standard of diligence, such that an offence is foreseeable as a probable consequence (Section 6 paragraph 3, StGB). According to Austrian criminal law, negligent conduct is only punishable if expressly proscribed.

Once all elements of an offence are present, the offence has been committed. An offence is attempted as soon as the perpetrator has acted upon their decision to commit the offence. For the classification, it is decisive whether the act, taking into account the perpetrator’s intentions, should manifest the offence. Criminal liability for intentional conduct is not limited to completed offences but also extends to attempts to commit an offence and to participation in an attempt (Section 15, StGB).

A criminal offence is committed not only by the immediate perpetrator, but also by any person “directing” or “contributing” to the commission of an offence (Section 12, StGB).

The Austrian penal system is based on the principle in dubio pro reo. Generally, the prosecution bears the burden of proof. The public prosecutor may not bring the charge in case of doubt, but must be of the opinion that a conviction is much more likely than an acquittal. In practice, the public prosecutor will only press charges if there is a conviction probability greater than 50%. In order to issue a sentence, the court must be convinced with the highest level of proof (ie, beyond reasonable doubt).

Under Austrian criminal law, the limitation period for criminal liability depends on the potential punishment (Section 57, StGB). The limitation period commences with the completion of the offence or cessation of the illicit conduct. Certain circumstances extend the time bar (eg, a further offence that is based on the same malicious propensity during the running of the initial limitation period). In this case, the statutory limitation period ends for both offences only when the limitation for the further offence lapses. Moreover, certain events can toll the limitation period, such as particular investigative measures and the termination of proceedings (Section 58, StGB).

For offences punishable by imprisonment for between ten and 20 years or imprisonment for life, and certain other particularly serious offences (eg, genocide, crimes against humanity, war crimes), there is no statute of limitations.

Regarding more frequent offences, such as those punishable by imprisonment for between five and ten years – applicable in the most severe cases of money laundering or severe fraud and embezzlement/breach of trust offences – the statute of limitations is ten years. For the offences of fraud and embezzlement/breach of trust involving damages of less than EUR300,000, the statute of limitations is five years.

In general, Austrian criminal laws have no extraterritorial effect (Section 62, StGB). However, criminal offences committed on an Austrian ship or aircraft are subject to Austrian criminal laws, as are certain offences committed outside of the Austrian jurisdiction and regardless of the criminal law of the location of the offence (eg, criminal offences against an Austrian government official, corruption, economic espionage, terrorism and certain other major crimes) (Section 64, StGB).

Other offences committed abroad are only subject to Austrian criminal law if the offence is also punishable under the law of the location of the offence, if the offender is Austrian or is arrested in Austria and cannot be extradited, and if none of the exceptions in Section 65 paragraph 4 of the StGB apply.

Austrian criminal law does not provide a possibility for Austrian authorities or courts to enforce their authority abroad. Therefore, Austrian authorities and courts rely upon international co-operation for the enforcement of their authority outside the country. In the area of co-operation within the EU, for example, the Federal Law on Judicial Co-operation in Criminal Matters with the Member States of the European Union (EU-JZG) stipulates extensive possibilities for cross-border enforcement and the execution of orders freezing property or securing evidence.

The co-operation between prosecution authorities in Austria and other EU member states is facilitated by three instruments: the European Evidence Warrant, the European Investigation Order (EIO) and Joint Investigation Teams. In addition, the Federal Law on Judicial Co-operation in Criminal Matters with the Member States of the European Union is relevant to intra-EU legal assistance requests. The EIO allows the competent authority of one EU member state (the issuing state), after validation by a court or public prosecutor, to order the execution of several investigative measures, including coercive measures, in another EU member state (the executing state).

By contrast, the co-operation between Austrian prosecution authorities and non-EU member states (and Denmark) still follows traditional judicial assistance practice, predicated upon reciprocity, and governed by international treaties. If no treaty is applicable, the Austrian Extradition and Judicial Assistance Law (Auslieferungs- und Rechtshilfegesetz or ARHG) will apply.

The term “blocking statute” is not part of Austria’s legal lexicon.

Extradition is regulated in the ARHG. The main prerequisites for extradition are (i) a criminal offence that can be committed intentionally and is punishable by imprisonment of more than one year, and (ii) mutual criminal liability under the law of the requesting state and under Austrian law (Section 10, ARHG). Accordingly, if a white-collar offence is punishable by imprisonment of more than one year (eg, aggravated fraud and embezzlement), extradition is possible. However, the extradition of Austrian citizens is not permitted (Section 12, ARHG).

Austrian criminal law distinguishes between criminal liability (violations of criminal law) and liability under administrative penal law (for regulatory offences).

Criminal Law

Both individuals and companies can be held criminally liable for the same offence. Pursuant to the Austrian Act on Corporate Criminal Liability (Verbandsverantwortlichkeitsgesetz or VbVG), corporations are liable for the unlawful and culpable actions of their decision makers (ie, higher-ranking individuals with the authority to represent the company) provided that the offence (i) was committed for the benefit of the corporation, or (ii) violated duties incumbent on the corporation (Section 3 paragraph 2, VbVG).

Under more restrictive conditions, corporations are also liable for the actions of employees. An offence committed by an employee that was (i) committed for the benefit of the corporation, or (ii) violated duties incumbent on the corporation, must have been either rendered possible or facilitated by the decision makers’ failure to take essential precautionary measures, particularly of a technical, organisational or personal character (Section 3 paragraph 3, VbVG).

While individuals are subject to the whole set of penalties and other sanctions if found guilty of an offence, corporations are subject to fines, measured in per diem units, and to court directives (eg, to compensate for harm done, to implement a proper compliance system or to fund charities (Sections 4 and 8, VbVG)). As of 1 September 2023, the maximum fine for offences such as severe fraud, embezzlement/breach of trust or corruption has been increased to EUR3.9 million (up from the previous EUR1.3 million). The fine is based on the corporation’s earnings and certain aggravating or mitigating factors.

In the context of a merger or acquisition, a successor entity can be held liable for offences committed by the target entity prior to that merger or acquisition. The same applies to fines imposed prior to the merger or acquisition (Section 10, VbVG).

Administrative Law

In contrast to liability for criminal offences, administrative penal law provides only for indirect joint liability of the corporation for fines imposed for offences committed by the managing director or other “persons in charge” (Section 9, Austrian Administrative Penal Code). However, these offences are considered offences by the individual, not the corporation. Corporations are only directly liable for regulatory (administrative law) offences against tax law (Section 28a, Austrian Penal Tax Code).

Penalties are assessed according to rules stipulated in the StGB. The judge or tribunal competent to decide on the matter is required to consider the individual factors of the particular case and determine the sentence within the applicable sentencing range. The basis for assessing the penalty is the degree of culpability of the offender. The StGB contains a non-exhaustive list of “aggravating and mitigating factors”.

Aggravating factors include:

• previous convictions;
• particularly reprehensible motives;
• committing multiple offences; and
• particularly high damages.

Mitigating factors include:

• contributing to the resolution of the case;
• compensation for harm done;  and
• minor damages.

Deferred prosecution agreements, non-prosecution agreements and plea agreements are not allowed in Austria. However, guilty pleas and showing remorse are mitigating factors provided by law – and the court must consider them in the sentencing.

Besides filing a claim for damages in a civil court, a private party that is the victim of a criminal offence from which it has suffered damages can join the criminal proceedings as an injured party.

A request for a victim’s accession through private joinder can be submitted to the prosecution authority or the police and – after an indictment – to the criminal court.

In the course of the court proceedings, the criminal court may award damages if:

• the perpetrator is found guilty;
• the necessary taking of evidence regarding the private joinder does not substantially delay the proceedings; and
• the amount of the claim can be easily assessed by the court.

In practice, this is a timely and cost-effective way to seek compensation. While a private joinder is pending in criminal proceedings, civil claims will not be time-barred if the civil lawsuit is swiftly (ie, without delay) submitted to the civil court once the criminal proceedings have been terminated or where the court did not award damages.

Class actions or equivalent procedural means are not admitted in Austria for white-collar matters.

According to the Austrian Code on Criminal Procedure (Strafprozessordnung or StPO), criminal offences are investigated by public prosecutors with the assistance of the criminal investigation department of the police. In 2011, the Austrian Central Public Prosecutor’s Office for Combating Economic Crimes and Corruption (Wirtschafts- und Korruptionsstaatsanwaltschaft or WKStA) was established as a specialised prosecution authority. Pursuant to Section 20a of the StPO, the WKStA is in charge of prosecuting severe cases of business crime and corruption. Investigations conducted by the WKStA are supported by the specially created Federal Bureau of Anti-Corruption.

Administrative law is enforced by various administrative authorities, often with sector-specific competences. The most notable examples are the Financial Market Authority (Finanzmarktaufsichtsbehörde or FMA), which oversees, inter alia, banks, insurance companies and enterprises listed on the Vienna Stock Exchange, and the Federal Competition Authority, which conducts investigations into possible violations of national and European competition law.

White-collar crime cases brought before the courts are handled by general criminal judges. In larger courts, there are special departments within the court dealing exclusively with white-collar crime cases.

Whether competence with regard to a case lies with the criminal or administrative authorities is based on the material scope of that case. However, situations can arise in which different authorities have parallel competence over the same facts. According to Section 15 of the StPO, criminal courts must autonomously decide preliminary questions pertaining to other areas of law. They may, however, await the decision of a competent court or administrative authority on such preliminary questions – if the decision is expected in the foreseeable future. Administrative authorities, in turn, may suspend their investigations if a predicate question forms the object of another, parallel, proceeding.

There are no strict rules on how investigations are initiated. As soon as an authority becomes aware of a possible criminal offence, an investigation must be carried out. The authority will then investigate whether an “initial suspicion” can be assumed. According to Section 1 paragraph 3 of the StPO, an initial suspicion exists whenever specific indications give reason to suspect that a criminal offence has been committed. The investigation is conducted against unknown perpetrators as long as no specific person is reasonably suspected of having committed the offence. Once the investigations reveal a suspected person, the investigation has to be conducted against that person as the accused.

During the first part of a criminal proceeding, the investigation phase (Ermittlungsverfahren) conducted by the public prosecutor’s office, the proceedings may be terminated either by discontinuation or withdrawal of the prosecution by the prosecution authority, or by a court decision. In cases in which criminal proceedings are not terminated at the investigation phase, the public prosecutor’s office files an indictment with the competent court which, in turn, initiates the main proceeding (Hauptverfahren) – see 2.5 Prosecution.

In Austria, the investigating authorities have a wide range of investigative measures at their disposal. The public prosecutor’s office leads the investigation and decides on the implementation of measures such as seizure and confiscation, information from the bank register, raids, surveillance measures, arrests of persons or documents, and pre-trial detention. Some coercive measures must be approved by the court prior to their implementation. The actions of the public prosecutor can be appealed to the court. Appeals against decisions of the court may be lodged with the higher courts.

Dawn Raids

With the approval of the court, the public prosecutor may order the search of a specific location – for instance, an office building – to collect, temporarily secure or seize evidence, as well as any kind of asset that may serve as evidence, not only for the subsequent phases of the proceedings but also for the sole purpose of securing the civil claims of parties injured by the (alleged) criminal offence (Section 119 paragraph 1, StPO). In cases in which there is a risk that by waiting for a court order, the evidence may become unavailable, the public prosecutor may order the search of a location before seeking court approval (Section 120, StPO). In addition to prior or subsequent court approval, house searches are subject to certain other prerequisites. Most importantly, there must be a founded suspicion (this threshold is higher than the initial suspicion required to open investigations – see 2.2 Initiating an Investigation) and the coercive measure needs to comply with the principle of proportionality.

Persons in possession of documents, data carriers or assets that form the object of a request for temporary securing are under a legal duty to comply, unless they are suspected of the underlying offence, discharged from testifying, or otherwise have a right to refuse to give evidence (Section 111, StPO).

Questioning and Seizure of Documents

Accused individuals or companies have a right to avoid self-incrimination. In the case of a corporation, the managers (persons in charge) as well as the employees suspected of having committed an offence are to be interrogated as accused (Section 17 paragraph 1, VbVG). It is forbidden to use coercive measures (or promises or misleading statements) to induce the accused to make a statement (Section 7 paragraph 2, StPO). According to Section 166 of the StPO, forced testimony is classed as prohibited evidence and is therefore deemed null and void.

Attorney work-product and attorney-client communications are protected in several ways. Attorneys (and a small number of other professionals) have a legal duty of confidentiality and a right to refuse to give evidence (Section 157, StPO). The duty may not be circumvented. This prohibits the seizure of attorney documents and the information contained therein at the attorney’s premises and, since November 2016, also at the premises of clients under suspicion, or accused, in criminal proceedings. Attorney-client confidentiality only extends to (i) the attorney’s work-product, and (ii) attorney-client communications created for the purpose of defending the client; not to previously existing evidence.

Concerning the seizure of attorney documents at the attorney’s premises, any person subject to or present during such action may object to the implementation of the measure. In that case, documents and data carriers must be sealed and presented to a court, which must decide promptly whether the evidence is protected by attorney-client confidentiality (Section 112, StPO).

In principle, companies are under no legal duty to bring misconduct to the attention of enforcement authorities. Doing so, however, can allow a company to benefit from a leniency programme or by gaining “victim status” (as an injured party) rather than being treated as a suspect in the proceedings. Reporting duties can arise from rules on corporate governance and company law, depending on a company’s size and other relevant factors (see, notably, the requirement of a status report pursuant to Sections 243 et seq of the Austrian Commercial Code). Managing directors of public limited companies must report violations, or their suspicions of violations, of significant importance to the company, to the president of the supervisory board, and managing directors of limited liability companies have a corresponding duty to report to the shareholders. Finally, publicly listed companies are subject to the duty to issue ad hoc notifications.

The attitudes of local enforcers can vary. Internal investigations may be regarded as helpful, especially if the results are shared with the prosecution, or as a mere fig leaf that obfuscates rather than assists the criminal investigation. Sharing the results of an internal investigation may be taken into account as a factor leading criminal prosecutors to refrain from prosecution (Section 18, VbVG).

If an attorney is conducting the internal investigation or properly mandates a third party, products such as investigation reports are covered by attorney-client confidentiality (see 2.3 Powers of Investigation). It is recommended that attorney work-product be stored at the attorney’s office only, so data continues to belong to the attorney. In this way, objections and challenges in the case of a house search at a client’s or third party’s premises can be avoided.

Once the facts have been sufficiently investigated, the public prosecutor will decide whether to prosecute. The public prosecutor may not bring the charge if there is doubt, but must be of the opinion that a conviction is much more likely than an acquittal.

Accordingly, there must be no reason for a dismissal, nor may it be possible for the public prosecutor to proceed in a “diversion” (see 2.6 Deferred Prosecution) in order for the public prosecutor to bring an indictment.

Reasons for discontinuing criminal proceedings may include the absence of a criminal offence, a legal reason against prosecuting the accused and factual reasons preventing further prosecution (Section 190, StPO). In addition, the public prosecutor’s office or the court may discontinue proceedings for de minimis conduct (Section 191, StPO). This is applicable if the offence is punishable by a fine or imprisonment of less than three years, if the offence has a small likelihood of disruptive value and if punishment does not appear necessary from a general, or special preventative, point of view.

The defendant may request that the proceedings be terminated at any time after the expiry of minimum (three or six months) time limits (Section 108, StPO). A negative decision may be challenged before the courts. Against a termination of the criminal proceedings, the victim may file a request for continuation (Section 195, StPO) and, subsequently, an appeal to the court.

With regard to corporate criminal liability, Section 18 of the VbVG entitles public prosecutors to close a criminal prosecution of a corporation if punishment seems unnecessary considering a number of factors. Those factors include the conduct of the corporation after the alleged offence (here self-reporting may be of particular importance), the seriousness of the alleged offence, the amount of the fine to be imposed and the detriment already suffered by the corporation owing to the misconduct.

If, on the basis of sufficiently clear facts, a conviction is likely and there are no grounds for discontinuation or withdrawal from prosecution, the public prosecutor’s office files an indictment with the competent court. The filing of the indictment marks the beginning of the main proceedings (Hauptverfahren), which are led by the court. The indictment states the exact circumstances of the alleged act and the resulting criminal offence, and contains all the prosecution’s motions for handling evidence at the main trial (Hauptverhandlung). The defendant is entitled to submit a written counter-statement to the indictment, and to request that evidence be taken at the main trial. After the main trial, the court will decide on acquittal or conviction of the defendant.

Deferred prosecution agreements, non-prosecution agreements or their equivalents are not available in Austria.

For minor criminal offences to which a punishment of less than five years’ imprisonment is attached, there is also the possibility of the so-called diversion, which is like a settlement without a sentence. The basic prerequisites include that the facts are sufficiently clear and that there are no general or special preventative reasons for a conviction.

With regard to corporations, diversion is also available (Section 19, VbVG); this allows the public prosecutor to end the criminal prosecution of a corporation if it does not seem necessary to punish the corporation. A number of factors are considered, including the conduct of the corporation after the alleged offence (here, self-reporting is of particular importance), the gravity of the alleged offence, the amount of the fine to be imposed and the detriment already suffered by the corporation due to the misconduct.

The public prosecutor is, however, required to pursue diversion if certain criteria are met. These criteria include that the facts of the case are sufficiently established (again, self-reporting may be essential), adequate damages have been paid and punishment of the corporation is not necessary for special or general prevention. Aside from receiving only a reduced fine, certain duties may be imposed on the corporation; for example, the requirement to make a charitable contribution or to implement certain measures within the company, such as instituting a monitoring system.

While a termination of proceedings leads to a full acquittal, diversion is positioned between a conviction and an acquittal. In contrast to a conviction, a diversion is not entered in the criminal register for corporations and the related fines are smaller than the fine imposed in the case of a conviction for the same offence.

According to Section 146 of the StGB, a person commits fraud when they have the intention to gain an unlawful, material, benefit for themselves, or for a third person, and, by deceiving another person about material facts, cause or omit, or cause another person to carry out, tolerate or omit, an act that causes a financial or other material loss to the other person or a third person. Fraud is, therefore, a felony where the victim causes, by their own action, toleration or omission, damage to themselves or to a third person. The criminal offence of fraud is punishable by imprisonment of up to six months or the imposition of a monetary fine not exceeding 360 penalty units.

Under certain additional conditions (eg, by using a false or forged legal document, or damages exceeding EUR5,000), the offence of aggravated fraud is committed (Section 147 paragraphs 1 and 2, StGB). The potential punishment for aggravated fraud includes imprisonment for up to three years. In cases in which damages exceed EUR300,000, the potential punishment is imprisonment for up to ten years (Section 147 paragraph 3, StGB).

Furthermore, there are separate legal provisions for fraudulent misuse of data processing (Section 148a, StGB) and insurance fraud (Section 151, StGB). If a person commits a fraud “commercially”, higher penalties are stipulated (commercial fraud, Section 148, StGB). An offence is committed commercially if the person commits it for the purpose of obtaining a long-term income through the repeated commission of the offence, and employs specific skills or means, has detailed plans for the further commission, or has previously committed offences of this kind (Section 70, StGB).

According to the VbVG, every criminal offence can be committed by an individual as well as an entity. In particular, every criminal provision aimed at protecting assets – such as fraud, embezzlement, theft, espionage and extortion – can also be committed by corporations. The substantive criminal law applies for individuals and for legal associations/corporations. The main difference is usually in the punishment: a corporation will never be sentenced to imprisonment, but will be fined instead (see 1.5 Corporate Liability and Personal Liability).

Austrian criminal law covers corruption and bribery offences regarding office bearers and adjudicators (Sections 304–308, StGB). These offences include active and passive bribery, giving and accepting undue advantage, accepting benefits, and giving undue benefits for the purpose of interference and unlawful intervention. The most severe cases (where the value exceeds EUR50,000) are punishable by imprisonment for up to ten years. Active and passive bribery (Sections 304 and 307, StGB) is connected to an unlawful execution or omission of official duties, whereas giving and accepting an undue advantage (Sections 305 and 307a, StGB) arises in connection with a lawful execution or omission of official duties. Accepting benefits, or giving undue benefits for the purpose of interference (Sections 306, 307b and 308, StGB), does not aim at a certain or specified acts or omissions, but rather at “grooming”. Any intervention is unlawful if it is aimed at effecting the unlawful execution or omission of official duties, or if it is associated with the offer, promise or provision of undue advantages.

According to Section 309 of the StGB, bribery in private companies is prohibited: any person being an employee or representative of a company who, in the course of business transactions, demands, accepts, or accepts the promise of an advantage for themselves, or for a third person in return for the execution or omission of a legal act in breach of the person’s duties is guilty of an unlawful acceptance of gifts (Section 309 paragraph 1, StGB). Similarly, any person who offers, promises or provides a benefit to an employee or representative of a company in return for the execution or omission of a legal act in breach of that person’s duties in the course of a business transaction is guilty of bribery of employees and representatives (Section 309 paragraph 2, StGB). The named offences are punishable by imprisonment for up to five years.

Any benefit offered to office holders, and to adjudicators or employees and representatives of private companies, is to be evaluated within the regulations as stated above. As a rule of thumb, gifts are problematic with regard to office bearers and adjudicators. There are only a few exemptions and, in general, only for minor benefits, if they are not granted in the context of any specific mandate or – even without any connection to such a mandate – of an unlawful execution or omission of an official duty. Any acceptable benefit must be of minor value. The easier it can be turned into money, the more critically the benefit will be considered. For benefits that have no temporary value – for example, an invitation to attend a conference, or a Christmas gift – EUR100 should not be exceeded. For certain groups of government officials, like judges, a special code of conduct with zero tolerance applies. Nevertheless, charity donations or invitations to events in which there is an official or factual interest to participate, and similar, specific, exceptions exist. A detailed check of Austrian law and review of the relevant code of conduct, if applicable, is highly recommended.

Austrian law does not impose a specific obligation to prevent bribery. Also, currently, there is no general obligation to maintain a bribe-targeting compliance programme.

However, the lack of a robust compliance programme is one critical element of the criminal liability of a company whose employee has committed a criminal offence (see 1.5 Corporate and Personal Liability). Therefore, legal scholars urgently recommend the implementation of a robust compliance system. Some authors see it as a management duty to implement such systems.

Furthermore, specific statutory regulations provide for the mandatory implementation of compliance systems. For example, the Austrian Banking Act requires credit institutions to set up a permanent, effective and independent compliance function with direct access to management. However, this obligation only applies to credit institutions of significant importance. A “significant importance” can be assumed if the average annual balance sheet exceeds EUR5 billion, or, for example, if the credit institution has been classified as systemically relevant.

According to the Austrian Stock Exchange Act, 2018, the key criminal offences are “insider dealings and disclosure of inside information”, as well as “market manipulation”, both of which are punishable by law.

According to Section 163 of the Austrian Stock Exchange Act, the offence of “insider dealing and disclosure of inside information” requires, as a constituent element, an insider as defined in paragraph 4. That is, a person who has inside information because they:

• are a member of the administrative, management or supervisory body of the emitter;
• have an interest in the capital of the emitter;
• have access to the information in question by reason of the performance of a task or profession; or
• have obtained the information by committing criminal offences.

If the insider who possesses inside information (Article 7 paragraphs 1–4, Regulation (EU) 596/2014) takes advantage of this information for themselves or for a third party through certain acts, the offence is committed and is punishable by imprisonment for up to five years.

Market manipulation is a criminal offence, as unlawful trades or orders for more than EUR1 million send false/misleading signals regarding the supply/price of a financial instrument (Section 164, Austrian Stock Exchange Act). Again, the penalty for such offences is imprisonment for up to five years.

Criminal offences in the context of financial offences are addressed in the Austrian Criminal Finance Act (Finanzstrafgesetz or FinStrG).

Pursuant to Section 39 paragraph 1 of the FinStrG, anyone who commits financial offences – such as tax evasion, smuggling, or tax fraud – using (i) false or falsified documents or data, (ii) fictitious transactions or (iii) influenced books or records, is guilty of tax fraud.

Likewise, tax fraud is committed by anyone who commits the criminal financial offence of tax evasion by asserting VAT amounts that are not the result of deliveries or other services in order to evade a lawful tax (Section 39 paragraph 2, FinStrG).

The offence of tax fraud is punishable by imprisonment for up to five years. In addition to imprisonment, if not exceeding four years, a fine of up to EUR1.5 million may be imposed. Corporations are fined up to EUR5 million (Section 39 paragraph 3 littera a, FinStrG).

If the value of the offence exceeds EUR500,000, tax fraud is punishable by imprisonment for up to ten years. In addition to imprisonment, if not exceeding eight years, a fine of up to EUR2.5 million may be imposed. Corporations are fined up to EUR8 million (Section 39 paragraph 3 littera b, FinStrG).

The requirements for financial record-keeping are governed by various laws, such as the Austrian Companies Act (Unternehmensgesetzbuch), the Austrian Stock Corporation Act (Aktiengesetz), the Austrian Act on Limited Companies (Gesetz über Gesellschaften mit beschränkter Haftung), the Austrian Value Added Tax Act (Umsatzsteuergesetz), the Austrian Act on Federal Real Estate Tax (Grundsteuergesetz) and the Austrian Federal Fiscal Code (Bundesabgabenordnung). In general, accounts, annual reports and similar documents must be kept:

• for seven years after the year of the act;
• after liquidation of a company; or
• in the case of an ongoing proceeding, for as long as they are of relevance to the proceeding.

Documents regarding real estate may be required to be maintained for up to 22 years.

With regard to criminal law, destroying, damaging or hiding financial records designated to be used as potential evidence in court or administrative proceedings is a criminal offence (Section 295, StGB). As a prerequisite, the offence contemplates that the perpetrator acted with the intent of preventing the records from being used in the proceedings.

As a member of the EU, Austria applies European legislative acts. In the context of cartel and competition law infringements, Articles 101 et seq of the Treaty on the Functioning of the European Union are highly relevant and are enforced by both Austrian and European authorities.

In Austria, the Federal Competition Authority (Bundeswettbewerbsbehörde or BWB) was set up to investigate and combat suspected or alleged distortions or restrictions of competition. The BWB applies both Austrian and European law in its investigations. In addition, the BWB supports the investigations of the European Commission and the competition authorities of other member states of the EU.

Austrian law – in accordance with European regulations – prohibits the formation of illegal cartels (ie, all agreements between entrepreneurs, agreements between associations of entrepreneurs and concerted practices having as their object or effect the prevention, restriction or distortion of competition). Furthermore, the abuse of a dominant market position is prohibited.

In the event of an infringement, the Austrian Law against Cartels and other Anti-Competitive Restraints (Bundesgesetz gegen Kartelle und andere Wettbewerbsbeschränkungen or KartG) provides for fines up to a maximum of 10% of the total turnover of the undertaking or association of undertakings in the preceding business year (Section 29, KartG).

Apart from that, Austrian criminal law creates a particular offence for “anti-competitive agreements in procurement procedures” (Section 168b, StGB). This penalises participants in procurement procedures who submit a bid based on an illegal agreement in order to persuade the contracting authority to accept a particular offer. Participation in the tampered procurement procedure is sufficient for criminal liability; actual damage to the contracting authority is not required.

There is no specific consumer-protection or consumer-related criminal law in Austria.

In 2013, the Directive on attacks against information systems (2013/40/EU) was enacted by the European Parliament. Consequently, it was also made part of the Austrian national (criminal) law in 2015. The Directive’s goal is to unify the criminal law in the area of cybercrime and to improve co-operation between competent authorities. Accordingly, a cybercrime competence centre to combat computer crime was set up within the Austrian Federal Criminal Police Office. The cross-border prosecution of computer-related crime in the EU is co-ordinated by the European Cybercrime Centre, located at Europol.

Computer Fraud

With regard to cyberfraud, Austrian law establishes a specific offence for fraudulent misuse of data processing (Section 148a, StGB). A person who causes a financial or other material loss to another by interfering with the result of electronic data processing to gain an unlawful material benefit for themselves or a third person is criminally liable. The offensive action consists of interfering through the design of the program, through manipulation of data, or through interference with the processing of data. Fraudulent misuse of data processing is punishable by imprisonment for up to six months, or the imposition of a fine not exceeding 360 penalty units. If it causes damages exceeding EUR5,000, the offence is punishable by imprisonment for up to three years; when damages exceed EUR300,000, it is punishable by imprisonment for up to ten years.

Apart from that, Austrian criminal law provides for (hardly applicable) criminal offences for damage to electronic data (Section 126a, StGB), the disruption of the operation of a computer system (Section 126b, StGB) and the misuse of computer programs or login data (Section 126c, StGB).

Company Secrets

Trade and business secrets are protected under Austrian criminal law. While the breach of professional privilege relating to a health condition and disclosed information to an appointed expert is prohibited under Section 121 of the StGB, the offence of breach of trade or business secrets is stipulated under Section 122 of the StGB. According to the provision, the offence only extends to those trade and business secrets that the perpetrator is required by law to protect (Section 122 paragraph 3, StGB). Moreover, the provision only covers a trade or business secret that was entrusted or became available in the course of conducting supervision, an assessment, or an inquiry prescribed by law or official order (Section 122 paragraph 1, StGB).

Apart from that, it is a criminal offence to “spy out” trade and business secrets according to Section 123 of the StGB. This offence applies to individuals who, with the intent to exploit or publicly disclose such information, seek to obtain knowledge of trade or business secrets. The offence is punishable by imprisonment for up to two years. If the offence is committed with the intention that a foreign country utilises, exploits, or otherwise uses the secret, it is punishable by imprisonment for up to two years.

With regard to the protection of business and company secrets, competition law also contains the offence of Section 11 of the Law against Unfair Competition (Bundesgesetz gegen den unlauteren Wettbewerb or UWG). Accordingly, it is a criminal offence for an employee of a company to disclose business or trade secrets, that have been entrusted to them, or otherwise made accessible to them on account of their employment, for the purposes of competition, without authorisation. It also includes technical documents or rules of a technical nature disclosed in the course of business that are used or communicated to others without authorisation for the purposes of competition (Section 12, UWG). These offences may be punished by imprisonment for up to one year, or a fine not exceeding 720 penalty units.

The Austrian Sanctions Act (Sanktionengesetz) is in force. It regulates, for example, the domestic implementation of EU sanctions, or those of the United Nations, as well as penal provisions in the case of violation of imposed sanctions. However, Austria itself has not imposed any sanctions against other states.

Parallel to the Austrian provisions, sanctions based on provisions by the EU are directly applicable. As of the time of this writing, the sanctions imposed by the EU on various states – for example, Syria, Iran or Russia – must be considered.

Although the practical application of sanctions in Austria was insignificant for many years, sanctions against Russia and Russian citizens have now resulted in a substantial increase in prosecutions and in-depth investigations under the Sanctions Act.

According to Austrian criminal law, a person who aids the perpetrator of an offence against the property of another, after that offence has taken place, by concealing or utilising anything obtained through that offence commits the offence of “concealment” (Hehlererei, Section 164 paragraph 1, StGB). Any offence against the property of a third party constitutes a predicate offence for concealment (eg, theft, embezzlement, robbery, fraud and concealment (“chain concealment”)).

The perpetrator of concealment may be any person other than the predicate offence’s perpetrator. Hence, a person may not be held liable for both the predicate offence and the concealment.

Concealment is punishable by imprisonment for up to six months or a fine of up to 360 penalty units. In cases of aggravated or commercial (see 3.1 Criminal Company Law and Corporate Fraud) concealment, the offence is punishable by imprisonment for up to five years.

A criminal offence is committed not only by the immediate perpetrator, but also by any person “directing” another or “contributing” in any other way to the commission of an offence (Section 12, StGB). These persons are subject to the same penalties as the immediate perpetrator, or mastermind, according to the offence. This principle is equally applicable to offences resulting in corporate criminal liability.

As a member state of the EU, Austria is a party to all treaties, agreements and legislation signed or issued by the EU to combat money laundering. Furthermore, Austria has signed and ratified the UN Terrorist Financing Convention.

The criminal provisions relating to money laundering are included in the Austrian Criminal Code. Provisions covering certain professional groups – such as bankers, legal counsel, notaries, auditors, gaming companies and certain trustees – also exist in other statutes. For example, Sections 8a to 8f of the Austrian Bar Rules stipulate, in detail, how lawyers are required to proceed if they conduct financial or property transactions on behalf and for the account of a client, or if they plan or are involved in such transactions. Banks are subject to a number of special provisions contained in the Austrian Banking Act. The general rule for these professional groups can be summarised as follows: disclosure obligations deriving from anti-money laundering prohibitions trump the professional duty of confidentiality, even if this duty is otherwise protected by criminal law provisions, such as under banking secrecy or attorney-client confidentiality.

Money laundering is the concealment of the illegal origins of income from certain criminal activities, referred to as prior criminal offences. According to Austrian criminal law, a person commits money laundering when they hide or conceal the origin of assets that are the proceeds of specific felonies or certain offences punishable by imprisonment for more than one year, especially by making false statements in the context of transactions about:

• the origin or true nature of these assets;
• property or other rights attached to them;
• the permission to control them;
• their transfers; or
• their whereabouts (Section 165 paragraph 1, StGB).

Money laundering is also committed by a person who knowingly takes possession of, stores, invests, administers, transforms, utilises or transfers to a third person any assets that are proceeds of one of the offences listed above (Section 165 paragraph 2, StGB) or of any assets over which a criminal organisation or a terrorist association has the power of disposition (Section 165 paragraph 3, StGB).

Assets are considered to be proceeds of a crime if the perpetrator has obtained the assets through an offence or has received them to commit an offence. This also includes assets that have been substituted for the “contaminated” assets that were originally obtained or received (Section 165 paragraph 7, StGB).

The potential punishment for money laundering is imprisonment for up to five years. If it causes damages exceeding EUR50,000 or when the offence is committed by a member of a criminal organisation that has been formed for the purpose of laundering money on a continuing basis, it is punishable by imprisonment for up to ten years.

Compliance Programmes

While the existence of an effective compliance programme constitutes a “defence” in some jurisdictions, under Austrian law, the absence of proper mechanisms hindering the crime (namely, a robust compliance system) is required as a necessary element of a criminal offence committed by a corporation. In theory, the prosecution authority, which carries the burden of proof, would have to show that the lack of proper mechanisms enabled the offence by the employee. In practice, however, the suspected party has to show that all mechanisms to hinder the crime under investigations were in place, leading effectively to an adequate procedures defence as known in other countries, such as the USA or UK. On paper, it is up to the public prosecutor to show the missing precautionary measures, though. Please note that this kind of defence is not available for the company’s decision makers (ie, the top management). The theory behind this distinction between “normal” employees and “decision makers” is one of the guiding compliance principles – the “tone at the top”. If the top management fails, the law automatically assumes that no proper compliance system was in place. Thus, in effect, no adequate procedures defence is available to the company.

However, having a compliance system in place or implementing it right after the criminal act should, nevertheless, improve the final outcome.

Once the company has established a properly working compliance system of common, best practices, it bolsters the company’s argument that the committed offence was merely the act of an individual, breaching a compliance rule. Ideally the company can show that the offence was not a systematic failure tolerated or facilitated by management. For this purpose, it is helpful to obtain a certification of the compliance management system, ideally according to accepted standards, such as the Compliance Standard ONR 192050.

Diversions and Co-operation with the Prosecution

For certain criminal offences, there is the possibility of achieving a diversion, resulting in a reduced punishment for the company before the case goes to trial (or even during trial) without the negative effects of a criminal conviction, including the detrimental entry in the official criminal register. Aside from receiving only a reduced fine, certain duties may be imposed on the company; for example, the requirement to make a charitable contribution or to implement certain measures within the company, like instituting a monitoring system (see 2.6 Deferred Prosecution).

In the best case scenario, strong co-operation with the prosecution authority coupled with compliant behaviour may lead to an outcome comparable to a non-prosecution agreement in other jurisdictions. Under certain circumstances it is up to the prosecution authority to terminate the investigation proceedings without imposing any fines or negative consequences on the corporation (Section 18, VbVG; see 2.5 Prosecution).

In short, from a criminal defence point of view, it is highly recommended to implement a proper compliance programme.

In general, there are no specific de minimis exceptions for white-collar offences in the Austrian criminal law system. In fact, high levels of damages may serve as aggravating circumstances, potentially leading to more severe punishments.

Nevertheless, with regard to criminal proceedings, either the prosecution authority or the criminal court has the right to terminate a proceeding due to its “minor nature”. The suspect’s guilt, the consequences of the offence and the suspect’s behaviour after committing the offence with regard to potential compensation must be evaluated to assess whether the negative impact is of a minor nature. In addition, a penalty must not be needed to deter the suspect or the general public.

As stated above (see 1.6 Sentencing and Penalties) plea agreements or non-prosecution agreements are not available in Austria. However, guilty pleas and showing remorse are mitigating factors provided by law – and the court must consider them in the sentencing.

Under Austrian law, the StPO offers protection of principal witnesses. Section 209a of the StPO stipulates leniency for perpetrators who remorsefully confess to the offence and disclose knowledge or evidence that either contributes to the clarification of the offence beyond their own level of participation or helps to uncover a person participating in the offence. The perpetrator must voluntarily contact the prosecution authorities to avail themselves of these protections.

To take advantage of the leniency programme, it is important, inter alia, to self-report before the criminal prosecution becomes aware of the alleged misconduct. The disclosure should include all companies and persons who are to benefit from the leniency programme. Owing to the complexity of the procedural rules, it is highly recommended to engage a local lawyer to secure the benefits of such a programme.

This provision also expressly applies to corporations.

For violation of the Austrian anti-competition law, a specific leniency programme exists.

With regard to self-disclosure, there is no legal duty for private companies to report misconduct to law enforcement authorities.

Self-reporting may be advisable in circumstances in which the company can take advantage of a leniency programme, such as through the principal witness regulation (see above) or the diversion procedure (see 2.6 Deferred Prosecution), or to gain victim status in the proceedings (as an injured party) rather than facing the risk of accusation.

The WKStA has implemented an efficient system for individuals and corporations to notify the authority anonymously of (suspected) criminal behaviour. It provides a communication platform for whistle-blowers.

It is with absolute assurance that reports can be submitted anonymously without being traced back to the reporter. It is also possible for a whistle-blower to communicate anonymously with the prosecution office after the submission of the first report. This way, even whistle-blowing perpetrators can kick off leniency programmes for their own benefit. Due to the very detailed specifics of the legal provisions, specialised know-how about executing such a plan is highly recommended.

In 2023, Austria, after some deliberative delays, implemented the EU Whistleblower Protection Directive (EU) 2019/1937, which obligates legal entities with at least 50 employees as well as federal states and municipalities (provided they do not have fewer than 10,000 inhabitants or fewer than 50 employees) to set up reporting channels for the internal reporting of certain violations and ensures the protection of whistle-blowers against reprisals. The Austrian Whistleblower Protection Act provides for a number of detailed measures to protect whistle-blowers, and experienced practitioners are adept at helping establish and guide compliant systems.