Corporate Criminal Liability in Germany: Why § 30 OWiG Matters for Your Company

Stand: April 2026. Germany does not have corporate criminal liability in the sense known to common law systems. Corporations cannot be prosecuted under German criminal law. But this does not mean companies are safe. Administrative law exposes companies to substantial fines — and the threshold for liability is lower than many assume. Das Thema Corporate Criminal Liability Germany ist dabei von zentraler Bedeutung.

The Core Rule: No Corporate Criminal Liability — But Significant Administrative Exposure: Corporate Criminal Liability Germany

Under German law, criminal prosecution is directed exclusively at individuals. However, the German Act on Administrative Offences (OWiG) — specifically § 30 — enables authorities to impose administrative fines on a corporation where:

• a top-level manager commits a criminal or administrative offence that breaches the corporation’s duties or benefits the corporation; or
• compliance failures at the organisational level result in misconduct by employees below senior management.

This second ground is particularly significant: a company can be fined even if no individual manager committed a crime — if inadequate compliance structures enabled the underlying misconduct.

How High Are the Fines? und Corporate Criminal Liability Germany

Fines under § 30 OWiG can reach €10 million in standard cases, or €50 million depending on the nature of the misconduct. If the proceeds of the offence exceed these thresholds, the unlawful gains may be confiscated instead — without an upper limit.

In sector-specific areas, fines may be even higher. Under competition law, the Banking Act, the Securities Trading Act and the Anti-Money Laundering Act, turnover-based fines apply — in some cases up to 15% of group turnover. EU regulations including competition law and the GDPR provide for penalties of up to 4% of global annual turnover.

Personal Liability for Directors

Directors can also be held personally liable under the OWiG if they breach their supervisory duties — for example, by failing to implement adequate compliance measures that would have prevented misconduct by employees.

An Important Shift: The Deutsche Wohnen CJEU Ruling

The Court of Justice of the EU (CJEU) clarified in the Deutsche Wohnen case that for GDPR fines, it is not necessary to demonstrate culpable conduct by management. Misconduct by any person acting on behalf of the data controller may suffice. The CJEU also confirmed that GDPR fines are calculated on the basis of the entire economic undertaking — including parent and affiliated entities — not just the directly responsible legal entity.

German data protection authorities are now expected to incorporate these principles into their enforcement practice, potentially raising the exposure for corporate groups.

What Mitigates Corporate Fines?

A robust, functioning compliance programme is the most effective tool. Under German law, where a company has established a compliance programme adequate for its business and sectoral risks, this may lead to a full exemption from corporate fines — or at minimum, will be treated as a significant mitigating factor. Voluntary cooperation with authorities is also considered in the determination of fines and may lead to suspension of administrative proceedings.