The European Union has taken a further step in strengthening the fight against corruption, with a direct impact on how companies and organisations should approach their compliance programmes. The recent adoption of a new European framework in this area confirms a clear trend: integrity is no longer merely a reputational value. It is increasingly becoming a regulatory, operational and strategic requirement.

A more uniform and more demanding European framework

On 21 April 2026, the Council of the European Union adopted new common rules to combat corruption, with the aim of harmonising the treatment of this matter across the European Union. The new framework ensures that the main corruption offences are defined more consistently across Member States, covering matters such as bribery in the public and private sectors, misappropriation, trading in influence, obstruction of justice, enrichment resulting from corruption offences, concealment and certain serious breaches connected with the unlawful exercise of public functions.

This harmonisation is particularly relevant. For many years, one of the weaknesses of the European area lay precisely in the differences between national legal systems, which created asymmetries in the treatment of corrupt conduct and made a more coherent and effective response more difficult. The new Directive seeks to reduce those gaps and strengthen a common European culture of integrity.

A stronger sanctions regime

One of the most significant aspects of this new framework is the clear strengthening of the sanctions regime. Under the new rules, Member States will be required to ensure common minimum levels of sanctions for corruption offences, preventing maximum penalties from being set too low. For individuals, prison sentences ranging from three to five years are envisaged, depending on the offence.

For companies, the consequences may be particularly significant: fines ranging from 3% to 5% of total worldwide turnover or from EUR 24 million to EUR 40 million, also depending on the offence in question.

The political and regulatory message is clear: the fight against corruption no longer rests solely on formal prevention. It is also supported by a stronger sanctions regime, capable of reducing perceptions of impunity and reinforcing the seriousness of integrity programmes.

Alignment with international standards

The new European Directive does not emerge in isolation. Its structure forms part of a broader movement towards alignment with international standards, in particular the principles of the United Nations Convention against Corruption, which is expressly identified by the Council of the European Union as a key reference in this area.

The new European framework also replaces previous instruments, namely the 2003 European legislation on corruption in the private sector and the 1997 Convention on corruption involving officials of the Union and of the Member States.

This means that the fight against corruption is likely to become more coherent not only within the European Union, but also at international level. This is particularly relevant for corporate groups with cross-border activity, international supply chains or exposure to multiple jurisdictions.

And in Portugal?

In Portugal, this subject is not new. Decree-Law No. 109-E/2021 of 9 December created the National Anti-Corruption Mechanism — MENAC — and approved the General Regime for the Prevention of Corruption — RGPC — establishing specific duties for a broad range of public and private entities.

The regime applies, in particular, to legal persons with registered office in Portugal and to branches in Portugal of foreign legal persons that employ 50 or more workers.

Under the RGPC, these entities are required to adopt and implement a regulatory compliance programme that includes, at least, a Corruption and Related Offences Risk Prevention Plan — PPR —, a code of conduct, a training programme and a whistleblowing channel, as well as the appointment of a person responsible for regulatory compliance.

The regime also requires mechanisms to assess the effectiveness of the programme and assigns responsibility for its adoption and implementation to the management body or senior management of the relevant entity.

Therefore, strictly speaking, many companies in Portugal are already formally subject to a demanding preventive model. What the new European Directive does is reinforce the need for that model to stop being treated as a merely documentary formality.

The real impact for organisations

The practical relevance of this development lies less in creating new abstract obligations from scratch and more in raising the level of scrutiny regarding the quality, consistency and effectiveness of compliance programmes.

For organisations, the conclusion is straightforward: it is no longer enough to have internal policies “on paper”. What will increasingly matter is the ability to demonstrate that such policies are real, known, applied, monitored and proportionate to the specific risks of the activity carried out.

This implies, among other aspects:

  • reviewing and updating the PPR in light of the organisation’s actual risks;

  • strengthening due diligence procedures concerning third parties, partners and intermediaries;

  • ensuring functional, secure and credible whistleblowing channels;

  • promoting continuous and differentiated training according to risk exposure;

  • ensuring effective involvement of management and senior leadership;

  • documenting controls, decisions, corrective measures and monitoring mechanisms.

The new Directive also reinforces the importance of specialised prevention bodies and the promotion of a genuine culture of integrity, which, in the Portuguese context, is aligned with the role of MENAC and the increasing regulatory maturity of the national system.

Key dates to consider

In terms of timing, the Directive enters into force 20 days after its publication in the Official Journal of the European Union. Member States will, as a rule, have 24 months to transpose it into national law, with a 36-month deadline applying to provisions relating to risk assessments and national strategies.

This is therefore a period that companies should use to test the robustness of their internal mechanisms and anticipate future requirements, rather than waiting for formal transposition.

Conclusion

The new European Anti-Corruption Directive confirms a structural shift: anti-corruption compliance now sits at the centre of corporate governance, risk management and organisational responsibility.

For companies operating in Portugal — particularly those already covered by the RGPC — this is the right moment to move from a formal compliance logic to a logic of concrete effectiveness. In a more harmonised, more scrutinised and potentially more punitive regulatory environment, integrity is no longer merely a reputational factor. It is increasingly becoming a condition for corporate resilience.

PMCG monitors developments in the European and national regulatory framework in the areas of compliance, corruption prevention and governance, supporting companies in the review, implementation and strengthening of their regulatory compliance programmes.

Article prepared by PMCG Advogados, with technical input from Jeanine Rausch, ELO Compliance Consultoria, a consultancy specialised in regulatory compliance programmes, RGPC, PPR, codes of conduct, whistleblowing channels, due diligence and compliance training.