Provisional text

delivered on 3 July 2025 (1)

Case C‑291/24

Steiermärkische Bank und Sparkassen AG,

KL,

TR

Österreichische Finanzmarktaufsichtsbehörde (FMA)

(Request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Austria))

( Reference for a preliminary ruling – Prevention of the use of the financial system for the purposes of money laundering or terrorist financing – Directive (EU) 2015/849 – Articles 58, 59 and 60 – Imposition of sanctions on a legal person – National legislation establishing a link between the liability of a legal person and the liability of an identified natural person – Limitation periods – Principle of effectiveness )

I.Introduction

1.The present case arises from a request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Austria) concerning the interpretation of the provisions of Directive (EU) 2015/849 (2) on anti-money laundering.

2.The key issue is whether the imposition of sanctions on a legal person for infringing anti-money laundering obligations can be conditioned by the establishment of the liability of an identified natural person.

II.The main proceedings, the question referred and the procedure before the Court

3.Steiermärkische Bank und Sparkassen AG (‘Steiermärkische Bank’) is an Austrian bank.

4.By order of 29 February 2024, the Österreichische Finanzmarktaufsichtsbehörde (Financial Market Authority, Austria; ‘the FMA’) imposed a sanction on Steiermärkische Bank as a legal person for a breach of due diligence obligations under the Finanzmarkt-Geldwäschegesetz (Law on financial markets anti-money laundering; ‘the FM-GwG’) from 15 September 2017 to 11 October 2019.

5.Steiermärkische Bank, along with two natural persons, KL and TR, brought an appeal against that order before the Bundesverwaltungsgericht (Federal Administrative Court), which is the referring court in the present case.

6.The referring court explains that the possibility of sanctioning legal persons was extraneous to Austrian law. The FM-GwG, transposing Directive 2015/849, introduced the possibility to sanction legal persons. However, under Paragraph 35(1) and (2) of the FM-GwG, read in conjunction with the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court, Austria),(3) a legal person can be sanctioned only if the breach committed by the natural person, who must be named specifically, has been established beforehand and subsequently attributed to that legal person.

7.In that respect, according to the referring court, it is necessary that, first, the natural person whose actions are to be attributed to the legal person has previously been involved in the proceedings and treated as a defendant, that is, as a party with all rights and not merely as a witness; second, the offending, unlawful and culpable act by the identified natural person is established against the legal person in the operative part of the order imposing the sanction; and, third, such act is also attributed to the legal person in the operative part of that order. (4)

8.The referring court has doubts whether the requirements under Paragraph 35(1) and (2) of the FM-GwG that link the liability of a legal person to the liability of an identified natural person run counter to Directive 2015/849. That court points out that that provision implemented Article 60(5) and (6) of Directive 2015/849 into Austrian law almost verbatim, but with one significant addition through reference to Paragraph 34(1) to (3) of the FM-GwG. Read together with the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court), this results in the requirement for establishing the fault of the identified natural person. This requirement, according to the referring court, does not exist in Article 60(5) and (6) of Directive 2015/849.

9.Furthermore, that court is unsure whether the limitation periods set out in Paragraph 36 of the FM-GwG, according to which the proceedings for the imposition of administrative sanctions have to be initiated within three years from the commission of the punishable act and concluded within five years, are consistent with EU law.

10.The referring court indicates that the consequence of those requirements is that errors in the proceedings against the natural person who acted on behalf of the legal person – such as, for example, the fact that the relevant person was questioned only as a witness and not as a party – lead to the proceedings against the legal person being discontinued or the case being closed. The same applies by operation of law where the proceedings have not been brought by the FMA within the limitation period of three years and if the appeal proceedings, which are often very complex, are not concluded before the administrative court within the limitation period of five years of the offence being committed.

11.In the referring court’s view, the Austrian rules at issue are not merely a procedural arrangement, but in fact establish additional requirements for the liability of legal persons, which restrict substantive EU law, undermine uniformity within the European Union and infringe the principle of effectiveness. The referring court wonders whether the judgment in Deutsche Wohnen, (5) in which the Court of Justice found that a similar concept of the liability of legal persons in German law was precluded by the provisions of the GDPR, (6) may be transferable to the present case.

12.In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Does secondary EU law (in particular Article 60(5) and (6) in conjunction with Article 58(1) to (3) and Article 59(1) of [Directive 2015/849]), in addition to the general legal principles of the European Union (in particular effet utile)

preclude the provisions of Paragraph 35(1) to (3) (on the criminal liability of legal persons) and Paragraph 36 (extension of the limitation period) of [the FM-GwG],

which, in conjunction with the interpretation of those provisions by the Austrian Verwaltungsgerichtshof (Supreme Administrative Court), require that, in order to punish a legal person, it is imperative that an official representative or another natural person who has acted for the legal person has previously been given the formal party status of defendant (while strictly safeguarding all party rights) and, in addition, it is imperative that the operative part of the administrative penal order against the legal person determines that the natural person specifically named therein (or the official representative) committed an offence, acted unlawfully and is culpable in order to attribute that conduct to the legal person as a further step, the limitation period for bringing proceedings being within a period of three years of the end of the offence and the limitation period for the punishment of offences within a period of five years?’

13.Written observations were submitted to the Court of Justice by Steiermärkische Bank, KL and TR, along with the FMA and the European Commission.

14.A hearing was held on 9 April 2025, at which those interested parties and the German Government presented oral argument.

III.Analysis

15.The question submitted by the referring court covers two distinct issues. The first issue concerns the link which Austrian law establishes between the liability of a legal person and an identified natural person. The referring court asks the Court, in substance, whether Article 60(5) and (6) of Directive 2015/849, read in conjunction with Article 58(1) to (3) and Article 59(1) thereof, preclude such Austrian law. The second issue concerns the compatibility with EU law of the limitation periods for sanctioning a legal person for breaches of the national law transposing Directive 2015/849. My analysis will address each of those issues in turn.

A.The liability of legal persons under Directive 2015/849

16.Directive 2015/849 is the fourth anti-money laundering directive adopted by the EU legislature over the years. (7) As with the previous three, the aim of that directive is the protection of the financial system by means of prevention, detection and investigation of money laundering and terrorist financing. (8) To achieve this purpose, it has, inter alia, set out a number of obligations that Member States have to impose on certain persons, referred to as obliged entities, among which are credit and financial institutions. (9) Those obligations include customer due diligence, reporting of suspicious transactions, record keeping and the introduction of internal controls. (10)

17.Under Article 58(1) of Directive 2015/849, Member States must ensure that obliged entities can be held liable for breaches of provisions that transpose those obligations into national law, and provide, as a consequence, the imposition of administrative sanctions. Directive 2015/849 does not require the imposition of criminal sanctions, but allows Member States to provide for them. (11)

18.Prior to the adoption of Directive 2015/849, the choice of administrative sanctions was left to the Member States. (12) That directive harmonises those sanctions to a certain extent, (13) while allowing Member States to impose additional and stricter sanctions. (14)

19.The obliged entities which are subject to administrative sanctions may be natural or legal persons.

20.In relation to legal persons, Member States must ensure that such persons can be held liable for breaches of national law transposing the obligations imposed under Directive 2015/849.

21.In that respect, Article 60(5) and (6) provides the following:

‘5. Member States shall ensure that legal persons can be held liable for the breaches referred to in Article 59(1) committed for their benefit by any person, acting individually or as part of an organ of that legal person, and having a leading position within the legal person based on any of the following:

(a) power to represent the legal person;

(b) authority to take decisions on behalf of the legal person; or

(c) authority to exercise control within the legal person.

6. Member States shall also ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 5 of this Article has made it possible to commit one of the breaches referred to in Article 59(1) for the benefit of that legal person by a person under its authority.’ (15)

22.As is apparent from the order for reference and the submissions of the interested parties before the Court, the question referred in the present case arises from the particular approach developed in Austrian law in relation to the imposition of administrative sanctions on legal persons.

23.On the basis of the order for reference, it is my understanding that the Austrian legislation which transposed Directive 2015/849, as interpreted in the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court), essentially provides that sanctions may be imposed on a legal person only through the intermediary of a natural person. In the proceedings brought against the legal person, the following requirements must be satisfied:

(1)the natural person whose act is to be attributed to the legal person is identified and treated in the proceedings against a legal person as a party, and not simply as a witness;

(2)the act of the natural person who is specifically identified must be established in the operative part of the administrative order imposing the sanction; and

(3)that same act must also be attributed to the legal person in the operative part of that order.

24.The referring court seems to consider that linking the liability of a legal person to an identified natural person responsible for the legal person adds conditions to those provided by Article 60(5) and (6) of Directive 2015/849 and may therefore be contrary to that directive.

25.Steiermärkische Bank, KL and TR submit that the Austrian rules at issue are not precluded by Directive 2015/849. In their view, the wording, scheme, purpose and history of that directive demonstrate that, in order to impose a sanction on a legal person, it is necessary to identify specific leading persons and their wrongful conduct.

26.In contrast, the FMA submits that the Austrian rules at issue are precluded by Directive 2015/849. In its view, by requiring the identification of the natural person who is responsible for the breach, those rules impose additional substantive conditions on the establishment of the liability of legal persons, which undermine the effectiveness and dissuasive effect of sanctions. Difficulties with identifying the specific natural person responsible must not prevent the attribution of the breach to the legal person.

27.As with Steiermärkische Bank, KL and TR, the Commission also submits that the Austrian rules at issue are not precluded by Directive 2015/849, even if they require the finding of culpability of a natural person. In its view, that is not contrary to Article 60(5) and (6) of that directive. As that provision states that a legal person can be held liable for breaches committed by leading persons, it is necessary to establish not only the objective fact of the breach committed by the leading person, but also that person’s fault in order to hold the legal person liable for the breach.

28.The German Government adds that the approach regarding the liability of legal persons based on acts committed by leading persons set out in Article 60(5) and (6) of Directive 2015/849 is found in other areas of EU law, particularly in EU legislation harmonising criminal law where the liability of a legal person is linked to the wrongful conduct of a leading person.

29.To start with, it is clear from the wording and the structure of Directive 2015/849 that it seeks to impose obligations not only on natural persons, but also on legal persons, and that administrative sanctions for breach of such obligations must be capable of being imposed on legal persons as such.

30.When an obligation pertains to a legal person, such as a bank, Directive 2015/849 makes a clear distinction between the liability of the legal person itself and the natural persons within that legal person. Thus, for instance, Article 58(3) thereof provides that, where obligations apply to legal persons, Member States must additionally ensure that sanctions can be applied to the members of the management body and to other natural persons who under national law are responsible for the breach. (16)

31.Likewise, where the obliged entity concerned is a credit or financial institution, the rules set out in Directive 2015/849 on the amount of sanctions distinguish between a legal person and a natural person. (17)

32.Nonetheless, even if it distinguishes between the liability of natural and legal persons, Directive 2015/849 provides that Member States impose administrative sanctions on a legal person through the intermediary of a leading natural person within that legal person.

33.In that respect, under Article 60(5), a legal person is liable if the breach is committed by a natural person, acting individually or as part of an organ of the legal person, who is in a leading position because he or she has a power to represent that legal person, to take decisions in its name, or to exercise control within that legal person.

34.Furthermore, by virtue of Article 60(6), any of those leading natural persons can bring about the liability of a legal person if somebody else within the legal person committed a breach of an obligation, but the leading person made it possible due to lack of supervision or control.

35.What is, therefore, important is that the legal person can be sanctioned for any breach of its obligations that comes from within that legal person. That means that, for example, even if an employee is the one in practice responsible for the breach of a concrete obligation, this has to result in the liability of the legal person, even though such liability does not arise through that employee, but through a leading natural person.

36.Going one step further, Article 60(5) and (6) of Directive 2015/849 does not require, in my view, that the culpability of a leading natural person is established. However, it does not prevent national law from imposing requirements relating to fault.

37.For instance, in the scenario mentioned in point 35 of this Opinion, if, acting negligently, a leading natural person did not properly control the employee who committed the breach, the liability of the legal person can be established.

39.At the hearing, Steiermärkische Bank, KL and TR indicated that, in Austrian law, there is a presumption of negligence on the part of the leading natural person in case of inaction. The FMA agreed, but contended that that presumption applies up to the amount of EUR 60 000.

40.It must be borne in mind that it is not for the Court to interpret national law in the preliminary ruling procedure.

41.Nevertheless, to my mind, Article 60(5) and (6) of Directive 2015/849 does not prevent Member States from providing for a certain level of culpability of a leading natural person provided that, in all situations in which a breach arising under that directive was committed by anyone under the authority of the legal person, the liability of that legal person can be established.

42.In the light of the above, it does not seem to me that the Austrian law at issue, which links the liability of a legal person to the establishment of the liability of a specifically identified natural person responsible for an obliged entity, contradicts the requirements of Directive 2015/849.

43.The requirement that the natural person whose act is to be attributed to the legal person must be treated as a party in the administrative proceedings against that legal person, including all the procedural guarantees that flow from such a status, and not merely as a witness, does not seem to pose a problem. By relying on his or her rights of defence, the natural person at issue also defends the interests of the legal person in such proceedings.

44.Equally, the formal requirements of naming that natural person and describing the breach of the obligation, as well as attributing that breach to the legal person, in the operative part of the administrative order does not seem to run counter to Directive 2015/849, which requires that administrative sanctions must be possible against a legal person through the intermediary of a leading natural person.

45.It is, however, for the national court to decide whether certain aspects of the Austrian law, whether on the books or as implemented in practice, pose an obstacle to the possibility of imposing sanctions on legal persons.

46.In any case, an erroneous application of the Austrian law in certain situations, such as treating a natural person involved as a witness and not as a party in a particular case, cannot lead to the conclusion that that law itself is contrary to EU law.

47.Furthermore, I do not consider that the judgment in Deutsche Wohnen, mentioned by the referring court and discussed by the interested parties, invalidates my assessment.

48.In that judgment, which arose out of the context of the GDPR, the Court held that that regulation precludes German legislation under which an administrative fine may be imposed on a legal person only if the breach was previously attributed to an identified natural person. (18)

49.The Court considered, in particular, that fines must be capable of being imposed directly on legal persons as controllers (19) and that no provision of the GDPR permits the inference that the imposition of a fine on a legal person as a controller is subject to a previous finding that the infringement was committed by an identified natural person. (20)

50.Contrary to the GDPR, Directive 2015/849, as explained, provides that sanctions are imposed on a legal person through the intermediary of a leading natural person.

51.The formula of Article 60(5) and (6) of that directive (‘the Article 60 formula’) is used in a number of EU acts which require Member States to ensure that legal persons may be sanctioned. (21)

52.The choice of that formula might be explained by the differences in the approaches of Member States towards the liability of legal persons.

53.Those differences reflect and combine theoretical models, which the literature (22) describes as including:

–the vicarious liability model (also referred to, for example, as respondeat superior), which denotes that a legal person is liable for breaches committed by persons under its authority, such as employees;

–the identification model (also referred to, for example, as alter ego), which means that a legal person is liable only for breaches committed by persons sufficiently high up in the hierarchy of the legal person, such as managers and employees endowed with certain responsibilities;

–the aggregation model, which aims at identifying a collective responsibility of individuals within the legal person, rather than identifying an individual perpetrator;

–the organisational model (also referred to, for example, as the self-identity doctrine or corporate culture), which is based on the assumption that a legal person has a mechanism for expressing its self-identity and thus can be held liable without being linked to the behaviour of any individual person.

Some of those acts were adopted under the legal basis for harmonisation in the area of criminal law (Article 83 TFEU). See, for instance, Article 7 of Directive (EU) 2018/1673 of the European Parliament and of the Council of 23 October 2018 on combating money laundering by criminal law (OJ 2018 L 284, p. 22); Article 6 of Directive (EU) 2024/1203 of the European Parliament and of the Council of 11 April 2024 on the protection of the environment through criminal law and replacing Directives 2008/99/EC and 2009/123/EC (OJ L, 2024/1203); Article 6 of Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673 (OJ L, 2024/1226). Other acts were adopted in areas such as fisheries policy (Article 43 TFEU) or immigration (Article 79 TFEU). In that respect, see, for example, Article 47 of Council Regulation (EC) No 1005/2008 of 29 September 2008 establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing, amending Regulations (EEC) No 2847/93, (EC) No 1936/2001 and (EC) No 601/2004 and repealing Regulations (EC) No 1093/94 and (EC) No 1447/1999 (OJ 2008 L 286, p. 1); or Article 11 of Directive 2009/52/EC of the European Parliament and of the Council of 18 June 2009 providing for minimum standards on sanctions and measures against employers of illegally staying third-country nationals (OJ 2009 L 168, p. 24).

—

22For a brief selection, see, for example, Pieth, M. and Ivory, R., ‘Chapter 1 Emergence and convergence: Corporate criminal liability principles in overview’, in Pieth, M. and Ivory, R. (eds), Corporate criminal liability: emergence, convergence, and risk, IUS Gentium, Vol. 9(3), 2011, point 1.4; Vermeulen, G., De Bondt, W. and Ryckman, C., Liability of legal persons for offences in the EU, Maklu, Antwerp, 2012; Pikamäe, P. and Kärner, M., ‘The effect of European Union law on the criminal and quasi-criminal liability of legal persons in Estonia’, Juridica International, Vol. 33, 2024, pp. 89-101, in particular p. 92.

—

23See, in that respect, Franssen, V., ‘The EU’s fight against corporate financial crime: State of affairs and future potential’, German Law Journal, Vol. 19(5), 2018, pp. 1221-1249, in particular pp. 1237-1242.

—

24For a brief selection, see, inter alia, Article 70 of Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ 2014 L 173, p. 349), as last amended by Directive (EU) 2024/790 of the European Parliament and of the Council of 28 February 2024 (OJ L, 2024/790) (MiFID II); Article 38 of Regulation (EU) 2017/1129 of the European Parliament and of the Council of 14 June 2017 on the prospectus to be published when securities are offered to the public or admitted to trading on a regulated market, and repealing Directive 2003/71/EC (OJ 2017 L 168, p. 12) (Prospectus Regulation); Article 111 of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ 2023 L 150, p. 40) (Markets in Crypto-assets Regulation or MiCA); Articles 65 and 66 of Directive (EU) 2024/1619 of the European Parliament and of the Council of 31 May 2024 amending Directive 2013/36/EU as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance risks (OJ L, 2024/1619) (Capital Requirements Directive or CRD VI).

—

25See, for example, judgments of 16 December 1976, Rewe-Zentralfinanz and Rewe-Zentral (33/76, EU:C:1976:188, paragraph 5); of 16 December 1976, Comet (45/76, EU:C:1976:191, paragraph 13); of 12 February 2008, Kempter (C‑2/06, EU:C:2008:78, paragraph 57); and of 30 April 2024, M.N. (EncroChat) (C‑670/22, EU:C:2024:372, paragraph 129).

—

26See, for example, judgments of 8 July 2010, Bulicke (C‑246/09, EU:C:2010:418, paragraph 36), and of 5 September 2023, Udlændinge- og Integrationsministeriet (Loss of Danish nationality) (C‑689/21, EU:C:2023:626, paragraph 42).

—

27See, for example, judgments of 2 December 1997, Fantask and Others (C‑188/95, EU:C:1997:580, paragraph 48), and of 7 April 2022, IFAP (C‑447/20 and C‑448/20, EU:C:2022:265, paragraph 55).

—

28See, for example, judgments of 8 September 2011, Q-Beef and Bosschaert (C‑89/10 and C‑96/10, EU:C:2011:555, paragraphs 36 and 37), and of 20 December 2017, Caterpillar Financial Services (C‑500/16, EU:C:2017:996, paragraphs 42 and 43).