Guide · Compliance, Investigations and ESG
Compliance Management Systems
Compliance management systems are how German companies meet their supervisory duties and limit corporate fines. This guide explains §§ 30 and 130 OWiG and § 91 AktG, the elements of an effective system, antitrust, AML and sanctions modules, the competition register and self-cleaning, and how to test and audit a CMS.
Key takeaways
- Failure to supervise is an administrative offence under § 130 OWiG; companies are fined under § 30 OWiG.
- Corporate fines reach EUR 10 million for intentional crimes, plus disgorgement of profits.
- Listed AGs must maintain an appropriate and effective internal control and risk management system (§ 91(3) AktG).
- Antitrust fines take pre-existing compliance precautions into account (§ 81d GWB).
- Self-cleaning can lead to early deletion from the competition register (§ 8 WRegG).
Compliance management systems under German law
Compliance management systems are the policies, processes, responsibilities and controls a company uses to ensure that it, its managers and its employees comply with the law. German law rarely says in so many words that a company must have a compliance management system (CMS), but several statutes make one necessary in practice. The owner of a business and its managers commit an administrative offence if they fail to take the supervisory measures needed to prevent breaches of duties that apply to the business (§ 130 OWiG), and the company itself can be fined if a manager commits an offence connected with its business (§ 30 OWiG).
Company law reinforces this. The management board of a stock corporation must take suitable measures, in particular set up a monitoring system, so that developments that threaten the company's survival are recognised early, and the management board of a listed company must also set up an internal control system and a risk management system that are appropriate and effective in view of the scope of the business and its risk situation (§ 91(2), (3) AktG).
Managing directors of a GmbH owe comparable organisational duties under their general duty of care, and supervisory boards must monitor whether management has met them. Courts have held board members personally liable for failing to establish an adequate compliance organisation.
A CMS is therefore not a voluntary add-on but the way management discharges its own legal duties. It also has concrete benefits: it can reduce or avoid fines, support self-cleaning in public procurement, satisfy customers and banks, and protect board members against personal liability. This page explains the legal framework, the elements of an effective system, the specific requirements in antitrust, anti-money laundering and other fields, and how to test whether a system works. For the wider context, see our overview of compliance and ESG.
Supervisory duties and corporate fines
Section 130 OWiG is the core of German compliance law. It applies where a breach of a duty that falls on the business, and that is punishable by a criminal penalty or a fine, is committed within the business and would have been prevented or made significantly more difficult by proper supervision. Proper supervision includes the appointment, careful selection and monitoring of supervisory staff. If the underlying breach is a criminal offence, the fine for the supervisory failure can reach EUR 1 million, and the maximum is multiplied by ten where § 30(2) sentence 3 OWiG applies (§ 130(3) OWiG).
Through § 9 OWiG, the duty extends to managing directors and other persons acting for the owner.
Section 30 OWiG then links the individual's offence, including a breach of supervisory duty under § 130, to the company. The fine against the company can reach EUR 10 million for intentional criminal offences and EUR 5 million for negligent ones; for administrative offences, the maximum follows the fine for the offence, multiplied by ten where the statute refers to § 30(2) sentence 3.
In addition, the economic benefit derived from the offence is to be skimmed off, so the total can far exceed these maximums. Specific statutes raise the stakes further: antitrust fines can reach 10% of group turnover, data protection fines 4% of worldwide turnover, and fines for intentional sanctions offences EUR 40 million.
| Provision | Addressee | Consequence |
|---|---|---|
| § 130 OWiG | Owner of the business; managers via § 9 OWiG | Fine up to EUR 1 million where the underlying breach is a crime (tenfold where § 30(2) sentence 3 applies) |
| § 30 OWiG | The company | Fine up to EUR 10 million (intentional crime) or EUR 5 million (negligent crime), plus profit disgorgement |
| § 91(3) AktG | Management board of a listed AG | Duty to set up an appropriate and effective internal control and risk management system |
| § 81d GWB | Undertakings fined for antitrust breaches | Pre-existing and post-infringement compliance measures considered in setting the fine |
| §§ 4–6 GwG | Obliged entities under the Money Laundering Act | Risk management, risk analysis and internal safeguards |
The quality of compliance management systems is legally relevant at several stages. Authorities and courts consider it when deciding whether to prosecute the company, when setting the amount of a fine and when deciding on confiscation. For antitrust fines, the Act against Restraints of Competition expressly lists "appropriate and effective precautions" taken before the infringement and efforts after it to uncover and remedy it as factors in setting the fine (§ 81d(1) GWB), and the Federal Court of Justice has recognised in criminal fine proceedings that an effective compliance system can reduce a corporate fine.
Elements of effective compliance management systems
There is no single statutory blueprint. German practice draws on the auditing standard IDW PS 980 of the Institute of Public Auditors in Germany and on the international standard ISO 37301, both of which describe similar building blocks. What matters to authorities is that the system reflects the company's real risks and is actually lived, not that it follows a particular template.
- Tone from the top and culture: visible commitment by management, consistent consequences for breaches, and incentive systems that do not reward misconduct.
- Risk analysis: a documented assessment of which laws matter most, by business unit, country, product and sales channel, updated regularly and after incidents.
- Policies and processes: a code of conduct and specific rules for the main risk areas, such as gifts and hospitality, contacts with competitors, third-party due diligence, sanctions screening and data protection.
- Organisation: a compliance function with clear reporting lines, adequate resources and direct access to the board and the supervisory board or audit committee.
- Communication and training: risk-based training, guidance for managers and an easily accessible helpdesk.
- Reporting and response: a whistleblowing channel that meets the HinSchG, a defined process for investigations and remediation, and documentation of decisions.
- Monitoring and improvement: controls, audits, key indicators and regular reporting to management and supervisory bodies.
Write the risk analysis first and let it drive everything else. A CMS built from generic policies without a documented risk analysis is hard to defend: when an incident occurs, the first question from a prosecutor, an auditor or a court will be whether the company had identified the risk and what it did about it. A short, honest and regularly updated risk analysis is worth more than a thick binder of untested rules.
Works council, employees and third parties
Implementing a CMS in Germany usually involves the works council. Rules on employee conduct, such as a code of conduct with reporting obligations or a gifts policy, can be subject to co-determination as questions of order and conduct in the establishment, and the introduction of technical systems capable of monitoring behaviour or performance, such as screening software or e-discovery tools, requires the works council's consent (§ 87(1) nos 1 and 6 BetrVG). A framework works agreement on compliance and investigations saves time when a case arises. Employment contracts and policies should also make clear that compliance breaches can lead to warnings, dismissal and damages claims.
Many compliance risks arise through third parties. Agents, distributors, consultants, joint venture partners and suppliers should be screened according to risk, contractually bound to comply with the law, and monitored. Payments to intermediaries should be justified by documented services and paid to accounts in the country where the services are provided. In M&A, compliance due diligence and post-closing integration of the target into the buyer's system reduce the risk of inheriting ongoing misconduct.
Groups and the Mittelstand
Compliance management systems must be proportionate. A family-owned company with a few hundred employees does not need the same structures as a listed group, but it does need a documented risk analysis, clear responsibilities, basic policies for its main risks, a whistleblowing channel and a way to respond to incidents. In groups, the parent company's management should define minimum standards, ensure that subsidiaries implement them and receive regular reports, without disregarding the separate legal duties of subsidiary management. The supervisory board, or its audit committee, should receive regular compliance reports and question management about significant incidents and the resources of the compliance function.
Specific compliance fields: antitrust, AML, sanctions and data
Most compliance management systems have a general framework and several specialised modules. Antitrust compliance focuses on contacts with competitors, trade association meetings, information exchange, distribution and pricing, and dawn raid preparedness; it is closely linked to our guide on cartel investigations. Anti-corruption compliance covers bribery of public officials and commercial bribery under § 299 of the Criminal Code, gifts, hospitality, donations, sponsoring and the use of agents and consultants.
Anti-money laundering compliance is mandatory for obliged entities under the Money Laundering Act (Geldwäschegesetz, GwG). They must have an effective risk management system appropriate to the nature and scope of their business, consisting of a risk analysis and internal safeguards (§ 4 GwG), identify customers and beneficial owners, and report suspicious transactions to the Financial Intelligence Unit. Obliged entities include not only financial institutions but also, among others, traders in goods, real estate agents, auditors, tax advisers and, for certain transactions, lawyers and notaries. From 10 July 2027, the EU Anti-Money Laundering Regulation (EU) 2024/1624 will replace much of the GwG with directly applicable rules.
Export control and sanctions compliance, data protection under the GDPR, product safety, environmental law, occupational health and safety, and tax compliance (Tax-CMS) complete the picture, depending on the business. Since 2024, many companies have also integrated supply chain due diligence under the LkSG into their CMS, using the same risk analysis, supplier screening and complaints channels. Our pages on export control and sanctions and supply chain due diligence describe these modules.
Compliance and the competition register
For companies that bid for public contracts, compliance management systems have a direct commercial value. The Federal Cartel Office keeps the competition register (Wettbewerbsregister), in which final convictions and fines for offences such as bribery, fraud and subsidy fraud against public budgets, tax evasion, withholding social security contributions and bid rigging, as well as certain breaches of labour laws, are entered, together with corporate fines based on them (§ 2 WRegG). Public contracting authorities must consult the register before awarding contracts above certain values and decide on exclusion.
Entries are generally deleted after three or five years. A company can apply for early deletion if it proves self-cleaning in accordance with the procurement rules (§ 8 WRegG), which means compensating any damage, actively cooperating in clarifying the facts, and taking concrete technical, organisational and personnel measures to prevent further misconduct. A well-documented CMS improvement programme, including changes to processes, controls and responsible staff, is the core of a self-cleaning application.
Testing and auditing compliance management systems
Boards should regularly verify that their compliance management systems are adequate and effective. Common tools include internal audit reviews, compliance risk assessments with business units, mock dawn raids, testing of screening tools, analysis of whistleblowing reports and investigation outcomes, and surveys on compliance culture. External audits according to IDW PS 980 distinguish between the appropriateness of the system's design, its implementation at a point in time and its effectiveness over a period, and can provide evidence for the supervisory board and for authorities, although they are not a legal requirement and do not guarantee that no breach will occur.
Documentation is essential. The board should record the risk analysis, the decisions on resources and priorities, the reports it receives and the measures taken after incidents. When something goes wrong, this record is what allows directors to show that they acted on an informed basis and in the company's interest, which is the precondition for the business judgment rule in § 93(1) sentence 2 AktG. In groups, the parent should define minimum standards for subsidiaries and monitor their implementation, while respecting local legal requirements.
Effectiveness reviews should also look at how the system performs under pressure: how quickly reports are triaged, whether investigations lead to consistent sanctions, whether root causes are fixed and whether lessons learned are fed back into the risk analysis and training. Key indicators, such as the number and type of reports, training completion, screening hits and open audit findings, help the board see trends rather than isolated events.
Illustration
Illustration: a mid-sized machinery manufacturer with sales agents in several countries carries out a risk analysis and identifies agent commissions in high-risk markets as its main bribery risk and re-exports to sanctioned destinations as its main trade risk. It introduces agent due diligence and commission caps, adds end-use checks and "no Russia" clauses for distributors, trains the sales team, and asks internal audit to test a sample of transactions each year. When a whistleblower later reports an irregular commission, the company can investigate quickly and show the authorities a functioning system.
How TRW & Co helps
We advise management boards, supervisory boards, general counsel and compliance officers on compliance management systems in Germany. We carry out compliance risk analyses, draft codes of conduct and policies, design compliance organisations and reporting lines, and build specific modules for antitrust, anti-corruption, AML, sanctions, data protection and supply chain due diligence. We prepare companies for IDW PS 980 audits, review the effectiveness of existing systems, train boards and staff, and support self-cleaning applications to the competition register. When incidents occur, we connect remediation with investigations and defence. To discuss your compliance programme, please contact us.
Frequently asked questions
Is a compliance management system mandatory in Germany?
There is no general statutory obligation for every company, but §§ 30 and 130 OWiG make supervisory measures necessary in practice, listed stock corporations must maintain an internal control and risk management system under § 91(3) AktG, and sector rules such as the Money Laundering Act prescribe specific risk management. Directors who neglect compliance risk personal liability.
Can a CMS reduce fines?
Yes. Authorities and courts consider the quality of a compliance system when deciding on prosecution and setting fines. For antitrust fines, § 81d GWB expressly lists appropriate and effective precautions taken before the infringement and efforts to uncover and remedy it afterwards as relevant factors.
What is IDW PS 980?
IDW PS 980 is an auditing standard of the Institute of Public Auditors in Germany for the audit of compliance management systems. It describes basic elements such as culture, objectives, risks, programme, organisation, communication and monitoring. An audit is voluntary but provides evidence of a system's design, implementation or effectiveness.
Who is responsible for compliance in a German company?
Overall responsibility lies with the management board or the managing directors, who may delegate tasks to a compliance officer but must monitor the delegation. The supervisory board must oversee whether management has established an adequate compliance organisation. Employees are responsible for following the rules in their area.
How often should the compliance risk analysis be updated?
There is no fixed interval, but most companies review it annually and in addition whenever the business changes significantly, for example after an acquisition, entry into new markets, new products or a compliance incident. The update should be documented and reported to management.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.