July 27, 2026 11:33 
What boards, general counsel, and foreign investors need to understand about how Romanian law treats the company itself as a defendant and why the rules are about to tighten.
Article by Ambrozie | Legal & Strategic Counsel
For most of the twentieth century, Romanian criminal law rested on a principle inherited from continental tradition that a company cannot commit a crime, only the people inside it can (the Roman principle societas delinquere non potest). That changed. Since 2006, and in its current form since the Criminal Code (Law no. 286/2009) entered into force on 1 February 2014, the legal entity is itself a possible defendant in a criminal trial. It can be indicted, convicted, fined, barred from public procurement, and even dissolved by judicial order.
For any business operating in Romania, this changes how an investigation runs from the first day, who needs separate counsel, and what is at stake when a prosecutor opens a file. Directive (EU) 2026/1021 on combatting corruption (the Anti-Corruption Directive) is now in force, and the framework Romanian companies have worked with for a decade will change: higher penalties, broader liability.
This paper describes the system as it stands, sets out what the Anti-Corruption Directive will change, and argues that transposition should go further than the Directive requires: Romania needs a negotiated resolution mechanism, and without one the Directive's central incentive will not function here.
The statutory basis of liability
Corporate criminal liability is set out in Articles 135 to 151 of the Criminal Code. The core rule, in Article 135(1), is short: a legal entity - with the exception of the State and public authorities - is criminally liable for offences committed in carrying out its object of activity, or in its interest, or in its name.
Three features of that sentence matter.
First, Romania adopted a general liability model, not a list-based one. Unlike systems that enumerate the specific offences for which a company can be prosecuted, Romanian law makes the legal entity liable, in principle, for any criminal offence, provided the connecting link to the company is established.
Second, liability does not depend on convicting - or even identifying - the individual who acted. Article 135(3) provides that the criminal liability of the legal entity does not exclude that of the natural person who contributed to the offence, and the two are independent, as the case-law confirms. In practice this operates in both directions: the company can be convicted even where the decision-making chain is too diffuse to pin the act on a named individual; and, conversely, the individual remains personally exposed even though the offence was committed in the company's interest. The Code sets no limit on who the relevant individual may be - director, legal representative, employee, or occasional agent.
Third, the State and genuine public authorities sit outside the regime. Public institutions are only partly excluded: under Article 135(2), they escape liability solely for conduct in the exercise of an activity that cannot be carried out by a private-law entity. Where a public institution acts in a field open to private actors, it is exposed like anyone else.
Dual-track liability and what it means for the defence
The most consequential feature of the Romanian system, for anyone managing exposure, is the parallel prosecution of company and individual. Prosecutors routinely run both tracks at once. There is a practical reason: pursuing the company widens the pool of assets available to satisfy the civil claim, and prosecutors will frequently order precautionary seizures over corporate assets early in the investigation to preserve that recovery. However, for strategic reasons, there are many cases when prosecutors decide to prosecute the legal entity only at a later stage, toward the end of the investigation concerning the natural person.
This creates a conflict that has to be confronted at the outset of any matter, even before the first hearing. Representing the company and the implicated executive through the same lawyer can secure a coherent defence, but only for as long as their interests coincide. The moment either party's best defence becomes the other's guilt, joint representation is no longer tenable and counsel must withdraw. Identifying where those interests will diverge, and arranging independent representation for individuals where conflict is foreseeable, is one of the first decisions that matters in a Romanian corporate investigation.
The penalty regime
For a convicted legal entity, the only main penalty is a fine, calculated on the day-fine system in Article 137. The court sets a number of day-fines between 30 and 600, and a value per day-fine between 100 and 5,000 lei, with the two multiplied to produce the fine. At the outer limit, the general maximum runs to approximately 3,000,000 lei - in the region of 580,000 euro. That is roughly 1.5% of the 40 million euro floor the Anti-Corruption Directive will require.
There is one conspicuous exception. Law no. 319/2024, which brought the Convention of the Organisation for Economic Co-operation and Development on combating bribery of foreign public officials into Romanian law, derogates from Article 137(2) for that offence and raises the value of a day-fine to between 3,000 and 300,000 lei. The resulting ceiling for a legal person sits at roughly 34.5 million euro - already close to the Directive's floor. The instrument for calibrating corporate fines at European scale therefore already exists in Romanian law. It has not been extended beyond foreign bribery to the wider body of offences.
The complementary penalties, enumerated at Article 136(3) and regulated in detail at Articles 139 to 145, are:
Dissolution of the legal entity (Article 139), reserved for entities created or diverted to commit offences;
Suspension of one or more activities for three months to three years (Article 140);
Closure of one or more of the company's work points for three months to three years (Article 142);
Prohibition from participating in public procurement for one to three years (Article 143);
Placement under judicial supervision (Article 144); and
Display or publication of the conviction (Article 145).
For a company that depends on public contracts, or on a licence to operate a particular line of business, a procurement ban, an activity suspension, or the conviction itself can end the business.
No statutory compliance defence
Romanian law diverges from the assumptions most multinational compliance programmes are built on. There is no statutory compliance defence. Unlike the “adequate procedures” defence available in other jurisdictions, Romanian law offers no provision under which a company that maintained a genuine, well-resourced compliance programme is acquitted because the misconduct occurred despite its controls.
Compliance still matters. A well-run programme, clear anti-bribery, anti-tax-evasion and anti-money-laundering policies, real separation of duties, and documented training support the argument that the offence was committed by the individual on a frolic of their own, rather than in the company's interest, name, or object of activity - which goes directly to liability under Article 135 itself. But none of it operates as a defined defence. A company can demonstrate full compliance with its own rules and still be charged. The effect of that compliance depends on the subjective assessment of the authority handling the case - a point clients consistently underestimate when they assume their global programme will be read the way it would be read in London or New York.
The resolution gap: guilty pleas without deferred prosecution
When a Romanian corporate investigation reaches the point of resolution, the solutions are narrower than counsel trained on United States or French practice expect.
The principal mechanism is the plea agreement (acordul de recunoaștere a vinovăției), governed by Articles 478 to 488 of the Criminal Procedure Code and available to legal entities as to individuals. Once criminal proceedings have been formally initiated, the prosecutor and the defendant may agree, on the defendant's admission of guilt, on the type and amount of the penalty and the manner of its execution. The agreement is confined to offences punishable by a fine or by imprisonment of up to fifteen years; the legal classification of the offence cannot be negotiated, only the sanction. It requires the written prior approval of the hierarchically superior prosecutor, and it must be validated by a court, which can reject it as unlawful or as unjustifiably lenient.
A second, narrower route is renunciation of prosecution (renunțarea la urmărirea penală) under Article 318 of the Criminal Procedure Code, a discretionary decision by the prosecutor not to pursue the case where the public interest does not justify it and the offence is punishable by a fine or by imprisonment of up to seven years (a threshold that excludes many offences to which a company is realistically exposed), subject to confirmation by the preliminary chamber judge.
What Romania does not have is any equivalent of the negotiated, conviction-avoiding settlement that has reshaped corporate enforcement elsewhere: the deferred prosecution agreement and non-prosecution agreement of the United States Department of Justice, the deferred prosecution agreement of the United Kingdom, or the convention judiciaire d'intérêt public introduced in France by the Sapin II law. Each of those allows a company to resolve criminal exposure - typically through a significant financial penalty, disgorgement, remediation, and monitoring - without a criminal conviction, preserving the company's ability to bid for contracts and operate in regulated markets.
The Romanian plea agreement is, in substance, a negotiated conviction. The company admits guilt; the entry on the criminal record follows; the procurement and licensing consequences that flow from a conviction are not avoided but merely managed. For a listed company, a financial institution, or any business in a regulated industry, a guilty plea can mean debarment where a deferred prosecution agreement would not. This is the most significant weakness in Romania's corporate enforcement regime, and the one that most distorts the incentives that should encourage companies to self-report and remediate.
What the Anti-Corruption Directive changes
Directive (EU) 2026/1021 of the European Parliament and of the Council of 29 April 2026 on combatting corruption was published in the Official Journal of the European Union on 11 May 2026 and entered into force on 31 May 2026. Member States, Romania included, must transpose its criminal-law provisions by 1 June 2028, and its provisions on risk assessments and national anti-corruption strategies by 1 June 2029.
Three elements will change Romanian corporate exposure.
Turnover-based fines. The Directive requires Member States to ensure that the maximum fine available against a legal entity is no lower than 5% of total worldwide annual turnover - or, alternatively, a fixed maximum of at least 40 million euro - for bribery and misappropriation, and no lower than 3% or 24 million euro for trading in influence, obstruction of justice and enrichment. That fixed maximum is roughly seventy times the general day-fine ceiling described above. Corporate corruption penalties would then be calculated the way competition-law fines are, as a percentage of turnover.
“Failure to supervise” liability. Under Article 13(1), a legal entity is liable where a corruption offence is committed for its benefit by a person in a leading position - a person with authority to represent the entity, to take decisions on its behalf, or to exercise control within it. Article 13(2) goes further: liability attaches where a lack of supervision or control by such a person made the offence possible. Romanian law does not currently provide for the failure to supervise as a distinct basis of liability; it is presently subsumed within the general formulation of Article 135 of the Criminal Code. Codifying the supervisory standard will therefore change what prosecutors must prove and what companies will need to be able to show, with direct consequences for the scope of internal investigations.
Compliance as a recognised mitigant. Article 16 requires Member States to ensure that one or more of the following circumstances may be treated as mitigating in relation to the liability of a legal person: the existence of a compliance programme implemented before or after the commission of the offence; the prompt and voluntary reporting of the facts to the competent authorities; and the adoption of remedial measures once the violation has been detected. Only genuine and effective programmes count: a programme maintained for appearances may be treated as an aggravating rather than a mitigating factor. This falls short of the full statutory defence available in other jurisdictions, but it would be the first time Romanian law gives genuine compliance a defined and favourable role across the whole body of corruption offences. At present the general criminal law contains no such mitigating circumstance for legal persons. The sole exception is the foreign bribery regime of Law no. 319/2024, into which Law no. 156/2025 has recently introduced compliance as a judicial mitigating circumstance for that one offence alone.
Romania should legislate a negotiated resolution mechanism
Transposition is due by 1 June 2028. It will require Parliament to reopen Articles 135 to 151 of the Criminal Code in order to introduce turnover-based penalties and the supervisory standard in Article 13(2) of the Directive. That legislative moment should be used to close the resolution gap as well.
Article 16, transposed into the current system, would be a dead letter. The Directive requires Member States to ensure that a genuine compliance programme, prompt voluntary reporting and post-detection remediation - or at least one of them - can operate in mitigation of a company's liability, yet the only mechanism through which Romanian law can presently deliver any such mitigation is the plea agreement, and the plea agreement ends in a conviction. A company that discovers wrongdoing, reports it and remediates therefore earns nothing more than a discount on a sanction whose gravest consequence - the conviction itself, and the exclusion that follows from it - remains untouched.
The recitals of the Anti-Corruption Directive itself acknowledge that under the public procurement related Directives, a final conviction for corruption is a ground for exclusion from public procurement and concession award procedures. A conviction triggers exclusion across the internal market. A French company resolving the same conduct through a convention judiciaire d'intérêt public pays a penalty, disgorges its profit, submits to monitoring, and is not convicted - and therefore is not excluded. A Romanian company cannot reach that outcome, because Romanian law does not contain the instrument.
The result is a self-defeating incentive. Romanian counsel cannot always advise a client to self-report, because self-reporting buys a reduced fine attached to a debarment. The rational course in many cases is to contest the case to the end. Article 16 will be transposed into a system that gives companies no way to act on it.
The objection is well-known and serious: negotiated resolutions let companies buy their way out of accountability and weaken the deterrent force of a conviction. Judicial validation of the agreement in open court, mandatory disgorgement of the benefit obtained, higher fines, published reasons, an independent monitor with reporting obligations, and the collapse of the agreement on breach are the safeguards that answer it.
Deterrence argues for the mechanism as well. A system whose only exit is a conviction that triggers exclusion produces fewer disclosures, longer proceedings, more evidence lost to the passage of time, and companies that fight to the last because cooperation offers them nothing.
Practical takeaways
For boards and general counsel operating in Romania, three points matter:
Assume parallel exposure. When a file opens, the company and its decision-makers are likely both in scope. Plan the conflict analysis and separate representation before the first interview, not after.
Treat compliance as evidence. A compliance programme will not acquit the company - not today, and not after transposition, when Article 16 will make compliance a mitigant rather than a defence. Build it, document it, and be ready to deploy it both to contest the Article 135 connecting link and to argue mitigation. Do not assume it works as a defence, as it can in other jurisdictions.
Prepare now for the turnover-based regime. Penalties calibrated to global turnover, and liability for failures of supervision, will not arrive until transposition, but they should already be informing risk provisioning and the design of supervisory controls in Romanian subsidiaries of international groups.
Corporate criminal liability in Romania is now a settled and frequently used instrument of enforcement, and it is about to become more demanding.
