Directive (EU) 2026/1021 strengthens European harmonisation in the fight against corruption and anticipates new requirements for companies, management bodies and compliance officers.
Directive (EU) 2026/1021 of the European Parliament and of the Council of 29 April 2026, on combating corruption, was published in the Official Journal of the European Union on 11 May 2026. The new European instrument harmonises the definition of corruption offences across Member States, establishes common minimum levels of sanctions and strengthens prevention, investigation and prosecution in both the public and private sectors.
The Directive was adopted by the Council of the European Union on 21 April 2026 and replaces previous European instruments, namely the 2003 Framework Decision on combating corruption in the private sector and the 1997 Convention on the fight against corruption involving officials of the European Union or officials of the Member States.
A new European benchmark in the fight against corruption
The new European regime covers matters such as public and private sector corruption, misappropriation, trading in influence, obstruction of justice, enrichment resulting from corruption offences, concealment and certain serious breaches of the law in the exercise of public functions.
One of the most relevant aspects of the Directive concerns the strengthening of the sanctions framework. According to the Council of the European Union, Member States will be required to provide for prison sentences ranging from three to five years, depending on the offence, and sanctions applicable to legal persons that may range between 3% and 5% of total worldwide turnover or between EUR 24 million and EUR 40 million, also depending on the offence.
The Directive will enter into force 20 days after its publication in the Official Journal of the European Union. Member States will, as a rule, have 24 months to transpose it into national law, with a 36-month deadline applying to certain matters relating to risk assessments and national anti-corruption strategies.
Impact for companies in Portugal
In Portugal, companies are already subject to a corruption prevention framework through the General Regime for the Prevention of Corruption — RGPC — approved by Decree-Law No. 109-E/2021 of 9 December. This regime applies, among other entities, to legal persons with registered office in Portugal that employ 50 or more workers, as well as to branches in Portugal of foreign legal persons that employ 50 or more workers.
The RGPC requires the adoption and implementation of a regulatory compliance programme, which must include, at least, a Corruption and Related Offences Risk Prevention Plan — PPR —, a code of conduct, a training programme and a whistleblowing channel. The entities covered must also appoint a Compliance Officer, with independence, permanence and decision-making autonomy.
The new Directive does not automatically replace the Portuguese regime currently in force, as it must still be transposed into national law. However, it sends a clear signal of increased European scrutiny over corruption prevention, the liability of legal persons and the effectiveness of compliance programmes.
Compliance cannot be merely formal
The main message for companies is clear: compliance programmes can no longer be regarded as mere formal documents or administrative compliance exercises. The PPR, the code of conduct, due diligence procedures, the whistleblowing channel and internal training must operate as genuine tools for prevention, monitoring and risk mitigation.
In this context, companies should consider reviewing their internal mechanisms, particularly in the following areas:
-
Updating the PPR and risk matrix, taking into account relationships with public entities, procurement, commercial intermediation, gifts, hospitality, donations, sponsorships and international operations.
-
Reviewing the code of conduct, ensuring that the rules are clear, applicable and accompanied by appropriate disciplinary and operational consequences.
-
Strengthening prior assessment procedures for third parties, including suppliers, clients, intermediaries, commercial partners and beneficial owners, in line with the duty already provided for in the RGPC for covered private entities.
-
Improving the whistleblowing channel and internal investigation procedures, ensuring confidentiality, traceability, protection of whistleblowers and response capacity.
-
Providing targeted training to management bodies, senior executives and areas most exposed to risk, since the RGPC already requires internal training suited to the exposure of managers and employees to the risks identified.
-
Creating documentary evidence, including minutes, reports, training records, risk decisions, corrective measures and monitoring mechanisms.
The responsibility of management bodies
Corruption prevention is also a corporate governance matter. Under the RGPC, the management body or senior management of the entities covered is responsible for adopting and implementing regulatory compliance programmes.
This responsibility becomes even more relevant in light of the European trend towards stronger sanctions and greater accountability of legal persons. The existence of a merely formal, outdated or ineffective compliance programme may prove insufficient before administrative, judicial or regulatory authorities.
A moment to review, not merely to comply
Directive (EU) 2026/1021 confirms a trend that is already under way: corruption prevention has become a central issue for companies, investors, public entities, commercial partners and financial institutions.
For Portuguese companies, the transposition period should be used as an opportunity to review the robustness of existing regulatory compliance programmes, identify gaps, strengthen internal controls and prepare the organisation for a more demanding European framework.
Effective regulatory compliance is not measured solely by the existence of documents. It is measured by the ability to prevent risks, train people, detect irregularities, respond to incidents and demonstrate, through evidence, that a culture of integrity is effectively applied.
PMCG monitors European and national legislative developments in the areas of compliance, corruption prevention and liability of legal persons, supporting companies in the analysis, review and implementation of their regulatory compliance programmes.
Article prepared by PMCG Advogados, with technical input from ELO Compliance Consultoria, a consultancy specialised in regulatory compliance programmes, RGPC, PPR, codes of conduct, whistleblowing channels, due diligence and compliance training.