The introductory note in this series identified three provisions of immediate consequence under the directive - the turnover-based calibration of corporate fines, the aggravator addressed to the regulated financial sector, and the failure-to-supervise basis of corporate liability - each of which has since been taken up in turn.
Each of those notes closed on the same point: that the sanction the directive recalibrates is brought down, where it is brought down at all, through Article 16.
This note takes up Article 16 directly. Its concern is operational - which mitigators the directive recognises, what the "genuine, effective and duly assessed" standard demands, and how the internal investigation produces, or fails to produce, the record on which each mitigator depends.
The provision: text and scope
Article 16 of the directive, headed Mitigating circumstances, requires Member States to take the necessary measures to ensure that, in relation to the offences referred to in Articles 3 to 6 and 8 to 11, one or more of four circumstances can, in accordance with national law, be regarded as a mitigating circumstance. Two features of the obligation are worth marking at the outset. The first is the form of the obligation. Where Article 14 prescribes minimum maxima that bind, Article 16 requires only that the listed circumstances can be regarded as mitigating - leaving Member States latitude as to how the mitigators are given effect, and the judge discretion as to the weight each carries in the individual case. The second is that the list is not uniform across defendants.
The four circumstances are: that the offender provides the competent authorities with information they would not otherwise have been able to obtain, helping them to identify or bring to justice the other offenders [point (a)]; that the offender provides information they would not otherwise have been able to obtain, helping them to find evidence [point (b)]; that a legal person has implemented effective internal controls, ethics awareness and compliance programmes to prevent corruption, prior to or after the commission of the offence, unless this constitutes a ground for exclusion of liability [point (c)]; and that a legal person, once the offence has been discovered, has rapidly and voluntarily disclosed it to the competent authorities and taken remedial measures [point (d)].
The directive states expressly that the mitigators at points (c) and (d) are available only to legal persons. The cooperation mitigators at (a) and (b) are not so confined; they are available to the legal person as well, but they reward a different thing - the provision of information of value to the authorities, rather than the institution's own preventive and remedial conduct.
The standard: "genuine, effective and duly assessed"
The text of point (c) requires that the controls be effective. Recital 29 supplies the qualifier the investigation must satisfy: that the internal controls, ethics and compliance programmes be "genuine, effective and duly assessed". The recital pairs this with its converse - that it remains within the discretion of the court to take into account, where applicable, the fact that the legal person has compliance programmes "only for cosmetic purposes, also called 'window dressing'". The mitigator and its negation are therefore set out along a single axis. The same programme, presented through two different records, sits at either end of it: effective and assessed where its operation can be evidenced; cosmetic where only its existence can.
"Duly assessed" is the operative addition. It indicates that design is not sufficient, and that operation alone is not sufficient to demonstrate: the programme must have been subjected to assessment - tested, reviewed, its functioning examined - and that assessment must itself be capable of demonstration. The standard is documentary before it is substantive.
Implications for internal investigations
Article 16 is the provision toward which the investigations apparatus described across this series is in fact directed. The earlier notes established where the upper boundary of exposure now sits - at a percentage of consolidated group turnover under Article 14, raised for AML-obliged entities by Article 15(2)(f). Article 16 is the provision through which that boundary is brought down. The four mitigators resolve into two distinct lines of investigative work.
The first is cooperation, at points (a) and (b). The mitigator rewards information the authorities would not otherwise have obtained - as to the other offenders, and as to evidence. The investigation must therefore be capable of generating such information, and of evidencing both its value and the voluntariness and timing of its provision. Information surrendered late, or only once the authorities are already in possession of it, does not reach the mitigator. The record of what was provided, when, and against what state of the authorities' own knowledge is what distinguishes qualifying cooperation from compelled production.
The second is the institution's own conduct, at points (c) and (d). Here the investigation performs the demonstrative function the "duly assessed" standard requires. For point (c), it must document the operation of the controls in the matter at hand: the points at which they functioned, the points at which they did not, and the actions taken by the persons responsible on the information available to them - together with the prior assessment record that shows the programme was tested rather than merely promulgated. For point (d), it must fix the discovery-disclosure-remediation sequence in contemporaneous form: when the institution discovered the conduct, what it did upon discovery, and how the disclosure and remediation unfolded. The internal report - raised through the whistleblowing infrastructure that the earlier note addressed under Directive (EU) 2019/1937 - is frequently the discovery event on which point (d) turns.
Two cautions follow. The first concerns the limit on point (c): it operates "unless it constitutes a ground for exclusion of liability". Consistent with the rest of the directive, the compliance programme is not, under Article 16, a defence to liability; it mitigates the sanction once liability is established. This differs from the position under section 7 of the UK Bribery Act, where adequate procedures are a complete statutory defence. The directive does not, however, foreclose that model: Article 16(c) applies "unless it constitutes a ground for exclusion of liability", expressly leaving Member States free to treat an effective programme as excluding liability under national law. The second concerns the failure mode. An investigation that yields conclusions but not the underlying evidence of operation leaves the mitigator's value resting on inference - and it is the record that shows a programme's design without its operation that invites the "window dressing" characterisation the recital contemplates.
The Romanian framework
Romanian criminal law sanctions legal persons through the day-fine system at Article 137 of the Criminal Code, and gives effect to mitigating circumstances through the general regime at Articles 75 and 76: under Article 147(1), where a cause of mitigation is established in respect of a legal person, the fine regime provided by law for the natural person applies, and a mitigating circumstance reduces the special limits of the penalty by one third. That general regime recognises no corporate-specific mitigator. The legal mitigating circumstances at Article 75(1) are addressed to the natural person, and the one that rewards repair - full reparation of the material damage caused, at Article 75(1)(d) - is expressly disapplied for corruption offences and offences against the Union's financial interests. What remains for a corporate defendant charged with a corruption offence is the discretionary judicial mitigation at Article 75(2) - the offender's efforts to remove or diminish the consequences of the offence, and circumstances bearing on the reduced gravity of the act or the reduced dangerousness of the offender - which names neither the effectiveness of a compliance programme nor rapid voluntary self-disclosure accompanied by remedial measures.
What Romanian anti-corruption law does already contain is the cooperation limb. Article 19 of Government Emergency Ordinance 43/2002 - the instrument governing the National Anticorruption Directorate - halves the statutory penalty limits for a person who, during the criminal investigation, denounces and facilitates the identification and bringing to justice of other persons who have committed offences within the Directorate's competence; it is the domestic counterpart to Article 16(a) of the directive. The Criminal Code reinforces the same logic in the bribery setting, and through a cause of non-punishment rather than mere mitigation: under Article 290(3), the bribe-giver is not punished where the offence is denounced before the prosecuting authority is seized of it. Both reward the reporting of an offence and the incrimination of others; neither rewards the effectiveness of the institution's own controls or its own post-discovery remediation. The directive does not compel Romania to close that gap - Article 16 requires only that one or more of its four circumstances can be regarded as mitigating, and the cooperation limb at points (a) and (b) is already satisfied, indeed exceeded, by Article 19 of Ordinance 43/2002. The practical risk for institutions operating in Romania therefore runs the other way from the headline: not that a demanding new mitigation regime is coming, but that the corporate-specific mitigators at points (c) and (d) - the effectiveness of controls, and self-disclosure with remediation - may not be enacted at all unless the legislator chooses to introduce them. The compliance-programme evidence and the disclosure-and-remediation record built today are worth building regardless, since they serve the Article 16 analysis in every Member State that does transpose those points; but their value in Romania will turn on a transposition choice that is not foreordained.
That choice should not be made by doing the minimum. A transposition resting on the cooperation limb alone - points (a) and (b) already satisfied by Article 19 of Ordinance 43/2002 and Article 290(3) of the Criminal Code - would meet the letter of Article 16 while missing its purpose. The preamble is explicit about that purpose: recital 29 singles out, by name, the genuine and effective compliance programme and the rapid post-discovery disclosure accompanied by remedial measures as circumstances that should mitigate the sanction of a legal person, and recital 5 builds the whole instrument on the premise that the prevention of corruption "mitigates the need for criminal repression". Points (a) and (b) reward a company for informing on others; only points (c) and (d) reward it for preventing the offence and for cleaning up once it is found.
In our view, the two corporate-specific mitigators are not alternatives but complements, and should be transposed together. The effective-controls mitigator at point (c) is what produces the internal detection of misconduct; the self-disclosure-and-remediation mitigator at point (d) is what acts on that detection by carrying it to the authorities. Each is the weaker without the other - a programme that detects but earns no credit for the disclosure it makes possible, and a disclosure mitigator with no programme to generate the knowledge to disclose, each leave half the incentive unused.
For Romania, the recommendation is therefore not to choose between them but to codify both, giving the institution a reason to build controls that work and to come forward on what those controls find. That, and not the minimum compatible with Article 16's "one or more," is the transposition that answers the directive - and the wider OECD, United States and United Kingdom enforcement practice it draws on.
Closing observation
Article 16 completes the sequence the earlier notes set out. Article 13 determines whether corporate liability attaches; Article 14 sets the upper end of the consequence; Article 15(2)(f), where transposed, raises that upper end for AML-obliged entities; Article 16 brings it down where the institution can evidence the mitigators. The first three are, from the institution's standpoint, largely given - they describe an exposure. Article 16 is the one the institution can act upon, and it can be acted upon only through the record an investigation produces. With Directive (EU) 2026/1021 published in the Official Journal on 11 May 2026 and the criminal-law transposition deadline set at 1 June 2028, the interval before the national texts are written is the design window in which the assessment practices, the compliance-programme evidence, and the disclosure-and-remediation sequences that Article 16 will reward must be put in place.
This article is part of the EU Anti-Corruption Directive Romania Corporate Exposure Hub.