Fraud prevention lawyer in Belgium: duties of a company director

Since 1 September 2026, the criminal liability of a legal person sits in article 18 of the new Criminal Code (Strafwetboek), previously article 5. The third paragraph provides that the liability of the legal person does not exclude that of the natural person. The Law of 11 July 2018 abolished the rule of non-cumulation with effect from 30 July 2018. Since then the judge no longer chooses between the company and its director.

The Code of Companies and Associations (Wetboek van vennootschappen en verenigingen) adds a second layer. Article 2:56 holds a director liable only for decisions that fall manifestly outside the margin within which normally prudent directors may reasonably differ. Article 2:57 caps that liability according to turnover and balance sheet total. The cap falls away in several cases, among them gross fault and fraudulent intent, and article 2:58 forbids the company to indemnify you in advance. We wrote earlier about the new Book 6 of the Civil Code and the wider scope to address directors directly.

If the company goes bankrupt, the trustee can hold you personally liable for the shortfall where a manifestly gross fault contributed to that bankruptcy. Serious tax fraud counts in any event as a manifestly gross fault (article XX.225 of the Code of Economic Law).

Our extensive experience in fraud cases means that companies, ranging from large financial institutions to SMEs, frequently consult us for preventive guidance. The work therefore starts before there is a case.

Start with the reporting channel. The Wet van 28 november 2022 (Law of 28 November 2022) requires every private-sector legal entity to set up an internal reporting channel. That happens after consultation with the social partners (article 11, § 1), and entities with fewer than fifty employees are exempt.

The procedure has two deadlines. You acknowledge receipt of a report within seven days. You give feedback within at most three months of that acknowledgement, and without an acknowledgement the period runs from day seven. You appoint an independent report manager and you keep a register of every report received. We wrote earlier about the new law on the whistleblowing procedure.

Next, check whether you are an obliged entity. Article 5, § 1, of the Law of 18 September 2017 lists those entities exhaustively, from the National Bank of Belgium to gambling operators. If you are one, article 16 requires an overall risk assessment and article 8 requires policies, procedures and internal control measures. Article 9 requires two appointments: one person responsible at the highest level, and one or more people who report atypical transactions to the CFI.

The duty to file in the UBO register falls on you personally. Article 1:35 of the Code of Companies and Associations obliges the administrative body to send those details electronically within the month. The Royal Decree of 30 July 2018 requires an update at least once a year. If that goes wrong, the Minister of Finance can impose an administrative fine of 250 to 50,000 euro on the directors.

If you want to investigate your own staff, you need written workplace rules. The Wet van 18 mei 2024 tot regeling van de private opsporing (Law regulating private investigation) entered into force on 16 December 2024. Its article 65 permits an investigation into an employee only where the permission and the detailed conditions appear expressly and transparently in those rules. Article 180 gives you two years from that date to comply. Article 101 prescribes article 65 on pain of nullity: without those rules the evidence is void.

From fifty employees. Article 11, § 2, of the Law of 28 November 2022 exempts smaller entities from the duty to set up an internal reporting channel. The threshold is the average number of employees, fixed each year on 1 January across the four quarters of the preceding calendar year. That exemption does not apply to entities covered by the provisions on financial services, products and markets, or by the anti-money laundering provisions.

Yes. Article 18, third paragraph, of the new Criminal Code provides that the liability of the legal person does not exclude that of the natural person. The Law of 11 July 2018 abolished the old rule of non-cumulation with effect from 30 July 2018. The judge therefore no longer chooses between the company and its director. Article 16 adds that nobody is criminally liable except for their own conduct.

Not by itself. A delegation only works where the company did not itself contribute to the offence. It must then show that it transferred its powers to a person with the required competence, authority and means. The Court of Cassation also requires that the legislator permits the transfer, if only implicitly. The burden of proof rests on the party that delegates. For duties the law imposes personally, the liability remains.

Only within the limits of CAO nr. 81 (collective bargaining agreement no. 81). It allows monitoring of electronic online communication data for four purposes, including preventing unlawful or defamatory acts. You define the purpose in advance, clearly and explicitly. You inform the works council and the employees concerned. Article 15 allows direct individualisation for the first three purposes. For the fourth, compliance with your own IT rules, articles 16 and 17 require information, then a meeting. The Data Protection Authority does not accept the employee’s consent as a legal basis.

A reversal of the burden of proof. Article 29 of the Law of 28 November 2022 presumes that detriment suffered after a report is retaliation. The employer must then show that the measure was duly justified. Article 23 bans every form of retaliation and lists fifteen, from dismissal through demotion to blacklisting. Compensation runs between 18 and 26 weeks of pay. An infringement of chapter 3 of that Law also carries a level 4 sanction under the Social Criminal Code.

If the company goes bankrupt, the trustee can hold you personally liable for the shortfall where a manifestly gross fault contributed to that bankruptcy. Serious tax fraud counts in any event as a manifestly gross fault (article XX.225 of the Code of Economic Law).

The duty to file in the UBO register falls on you personally. Article 1:35 of the Code of Companies and Associations obliges the administrative body to send those details electronically within the month. The Royal Decree of 30 July 2018 requires an update at least once a year. If that goes wrong, the Minister of Finance can impose an administrative fine of 250 to 50,000 euro on the directors.