Legislative Decree No. 231 of June 8, 2001, containing “Regulations on the Administrative Liability of Legal Entities, Companies, and Associations, Including Those Without Legal Personality, Pursuant to Article 11 of Law No. 300 of September 29, 2000,” introduced for the first time into Italian law the criminal liability of legal entities, which is in addition to that of the natural person who actually committed the unlawful act2 .
The expansion of liability aims to involve the assets of legal entities—and, ultimately, the economic interests of their shareholders—in the punishment of certain criminal offenses. Prior to the entry into force of the law in question, shareholders did not suffer any consequences from crimes committed for the benefit of the company by directors and/or employees.
The principle of individual criminal liability, in fact, left them free from any punitive consequences other than potential compensation for damages, if and to the extent that such damages existed. In terms of criminal consequences, in fact, only Articles 196 and 197 of the Criminal Code provided (and still provide) for a civil obligation to pay fines or penalties imposed, but only in the event of the insolvency of the actual perpetrator of the offense. This legislative change is therefore of no small significance, as neither the entity nor the members of the companies or associations can be considered uninvolved in criminal proceedings for offenses committed for the benefit or in the interest of the entity.
This, of course, creates an interest on the part of those individuals (shareholders, members, etc.) who participate in the entity’s financial affairs to ensure the regularity and legality of its operations.
Although the liability outlined by the provision is defined as “administrative,” it exhibits several characteristics typical of criminal liability; in fact, the procedural framework adopted is that provided for criminally relevant conduct.
The report accompanying the decree states: “Since this liability arises from a criminal offense and is linked (by the express intent of the enabling act) to the guarantees of criminal proceedings, it diverges in more than a few respects from the paradigm of administrative offenses now classically derived from Law 689/1981, with the result that it gives rise to a tertium genus that combines the essential features of the criminal and administrative systems in an attempt to balance the need for preventive effectiveness with the even more inescapable need for maximum due process guarantees.” Administrative liability is autonomous but arises as a consequence of the conduct of a natural person, in cases where such conduct constitutes a crime provided for by the decree.
This “third category” of liability has been characterized by the most recent case law as “organizational” in nature, defined by the psychological element of negligence on the part of the entity, which has failed to adequately organize itself internally to prevent the commission of the offenses referred to in Legislative Decree No. 231/2001.
Legislative Decree No. 24 of March 10, 2023, published in the Official Gazette on March 15, 2023, transposed into Italian law EU Directive 2019/1937 concerning “the protection of persons who report breaches of Union law” (the so-called whistleblowing regulations). The objective of the European directive is to establish common minimum standards to ensure a high level of protection for individuals who report violations of Union law, by creating secure communication channels, both within an organization and externally. The Decree provides that the new regulations generally apply as of July 15, 2023 (Art. 24). However, for private-sector entities that, over the past year, have employed an average of up to 249 employees, the obligation to establish an internal reporting channel takes effect as of December 17, 2023; until that date, the previous regulations continue to apply (Art. 6, para. 2-bis of Legislative Decree No. 231 of June 8, 2001, hereinafter also “Decree 231”). As a result of the provisions of the Decree, the following are repealed: Article 54-bis of Legislative Decree No. 165 of March 30, 2001 (TUPI) for public entities; Article 6, paragraphs 2-ter and 2-quater, of Decree 231; and Article 3 of Legislative Decree No. 179/2017. Article 6, paragraph 2-bis, of Decree 231 has also been amended.
Article 7 of Legislative Decree No. 211/2025, which “implements Directive 2024/1226/EU of the European Parliament and of the Council of April 24, 2024, on the definition of criminal offenses and sanctions for violations of Union restrictive measures and amending Directive (EU) 2018/1673,” extended whistleblower protection to individuals who report violations of European Union restrictive measures.
In 2023, ANAC issued Guidelines on Whistleblowing, which provided more detailed guidance—incorporated into this document—regarding the content of Model 231 pertaining to the reporting channel for violations under Legislative Decree 24/2023. Subsequently, through Resolution No. 478 of November 26, 2025, ANAC approved new Guidelines on the subject regarding internal reporting channels.
The relevant regulatory framework also includes the UNI 11961 Guidelines—published in December 2024 – UNI 11961 for the integration of the UNI ISO 37301:2021 compliance management system in support of Organizational Management and Control Models and Supervisory Bodies in accordance with Legislative Decree 231/2001. These guidelines were adopted to assist organizations in developing effective models based on the principles and requirements set forth in the national and international UNI ISO technical standards. These guidelines—together with those of Confindustria—were taken into account in the methodology adopted for the development of the Organizational Model pursuant to Legislative Decree 231/2001.
The offenses for which administrative liability may arise are listed in Section III of Chapter I of Legislative Decree 231/01, which has been amended on several occasions to include new criminal offenses not initially provided for.
With regard to the types of offenses to which the regulations in question apply, the delegated legislator initially adopted a minimalist approach compared to the guidelines contained in the enabling act (Law No. 300/2000). In fact, of the four categories of offenses listed in Law No. 300/2000, the Government considered only those relating to offenses against the public administration, as specified in Articles 24 – Misappropriation of public funds, Fraud to the detriment of the State or another public entity or for the purpose of obtaining public funds, and Computer fraud to the detriment of the State or another public entity and fraud in public procurement, 25 – Extortion and corruption, highlighting, in the report accompanying Legislative Decree No. 231/2001, the foreseeable extension of the regulations in question to other categories of offenses as well. That report proved prophetic, as subsequent legislative measures have expanded the list of offenses to which the provisions of Decree No. 231/2001 apply.
For administrative offenses arising from a criminal offense, a monetary penalty is always imposed, in addition to any disqualification sanctions that may apply. In the cases provided for by law, the monetary penalty is determined as a specific percentage—specified for each offense—of the entity’s total global revenue for the fiscal year preceding the one in which the criminal offense was committed or, if lower, for the fiscal year preceding the imposition of the monetary penalty. When it is not possible to ascertain the entity’s total global revenue, the monetary penalty is applied in the amount determined in relation to each offense.
Listed below are all categories of offenses provided for by Legislative Decree 231/01, as of the date of this document’s preparation.
The predicate offenses referred to include conduct committed with intent to defraud the public administration or the European Union, as well as fraud that harms the financial interests of the European Union. The predicate offenses also include “Interference with the freedom of public auctions” and “Interference with the freedom of the contractor selection process,” both of which violate the principle of sound public administration and its right to the best possible contract terms. The law provides for monetary penalties of up to 600 units, in addition to certain disqualification sanctions.
Article 24-bis of Legislative Decree No. 231/2001 has extended the administrative liability of legal entities and organizations to cover virtually all cybercrimes. Cybercrimes, therefore, encompass unlawful conduct committed by individuals in senior management positions or subordinate roles (employees and/or contractors) who use the company’s IT and telecommunications tools and technologies to carry out their normal work activities.
Through Decree-Law No. 105 of September 21, 2019—converted by Law No. 13 of November 18, 2019— 13, included among the predicate offenses for the administrative liability of entities those involving acts or omissions committed with the specific intent to obstruct or influence proceedings and regulations designed to ensure a high level of security for networks, information systems, and IT services of collective interest through the establishment of the so-called “national cybersecurity perimeter.”
The maximum penalties provided for amount to up to 500 quotas, in addition to all disqualification sanctions.
“Organized crime offenses” are included among the relevant offenses, specifically: the offenses referred to in Articles 416, paragraph 6, 416-bis, 416-ter, and 630 of the Criminal Code, and the offenses referred to in Article 416 of the Criminal Code, excluding paragraph 6, or those referred to in Article 407, paragraph 2, letter a), number 5), of the Code of Criminal Procedure.
The commission of these offenses entails the maximum penalties provided for, both in the form of a fine of up to 1,000 quotas and in the form of disqualification sanctions, including permanent disqualification from carrying out the activity.
Together with Article 24, in its original wording titled “Extortion and Corruption,” this article constitutes the core of the offenses provided for by Legislative Decree No. 231/01 and, like that article, pertains to relations with the Public Administration.
The monetary penalties for committing these offenses can reach up to 800 quotas and entail the application of all disqualification sanctions for a period of no less than one year.
Law No. 409 of November 23, 20013, converting Decree-Law No. 350/2001 containing urgent provisions in preparation for the euro—a few months after the enactment of the first version of Legislative Decree No. 231/01—introduced, in Article 4, the new article of the Decree (Article 25-bis) concerning counterfeiting of currency, public credit instruments, and revenue stamps. Penalties for violations under Article 25-bis are set at a maximum of 800 units, and all disqualification penalties apply for a maximum period of one year.
Offenses against industry and commerce become relevant for the purposes of the administrative liability of legal entities pursuant to Law 99/2009, containing provisions for the development and internationalization of businesses.
The related penalties may amount to up to 800 quotas and entail the application of all disqualification sanctions.
Article 25-ter specifically governs the following offenses: false statements in financial statements, reports, and other corporate communications; false statements in prospectuses; false statements in reports or communications by the independent auditor; obstruction of audits; improper return of capital contributions; illegal distribution of profits and reserves; unlawful transactions involving shares or equity interests of the company or its parent company; transactions prejudicial to creditors; failure to disclose a conflict of interest; fictitious formation of capital; improper distribution of corporate assets by the liquidator; corruption between private individuals; unlawful influence on the shareholders’ meeting; market manipulation; and obstruction of the functions of public supervisory authorities.
Penalties for the aforementioned offenses can reach up to 600 quotas, which may be increased by one-third in the event of the realization of a “significant profit.” For the offenses of Corruption Among Private Individuals (Art. 2635 of the Civil Code) and Incitement to Corruption Among Private Individuals (Art. 2635-bis of the Civil Code), the disqualification sanctions provided for in Art. 9, paragraph 2, of Legislative Decree 231/2001 also apply.
Article 25-quater of Decree 231 establishes the entity’s liability also in relation to the commission of offenses committed for the purpose of terrorism or subversion of the democratic order. The law also applies (Art. 25-quater, last paragraph) to the commission of offenses, other than those expressly mentioned, “that are in any case covered by the Convention on the Suppression of the Financing of Terrorism adopted in New York on December 9, 1999.”
The penalties provided for include fines of up to 1,000 quotas and the application of all disqualification sanctions, including permanent disqualification from conducting business.
Law No. 7/20064, which prohibits and punishes so-called infibulation practices, has extended the scope of application of Legislative Decree No. 231/2001 to the new offense of female genital mutilation (Art. 583-bis of the Italian Criminal Code).
The fines imposed can reach a maximum of 700 units and may result in the permanent suspension of business operations.
Article 25-quinquies extends the regime of administrative liability of the entity to the commission of offenses against the individual’s person governed by Section I of Chapter III of Title XII of Book II of the Criminal Code, including offenses of child pornography and possession of pornographic material, the solicitation of minors, and, finally, the exploitation of persons through conduct carried out, including through violence and threats.
The monetary penalties imposed may reach a maximum of 1,000 units and may result in the permanent suspension of business operations.
This article and its references to the offenses of insider trading and market manipulation were introduced by the aforementioned Law 62/20055.
The monetary penalty may amount to 1,000 quotas or be increased up to 10 times the profit derived from the offense. No disqualification sanctions are provided for.
Law No. 123 of August 3, 2007, by introducing Art. 25-septies into the regulatory framework of Legislative Decree No. 231/2001, further extended the scope of application of the administrative liability of legal entities to include the offenses of involuntary manslaughter and serious or very serious involuntary bodily injury occurring in connection with the violation of regulations for the prevention of workplace accidents or relating to the protection of occupational health and safety6 .
The penalties provided for include fines of up to 1,000 quotas and the application of all disqualification sanctions for a maximum period of one year.
The legislature has, through a series of measures, implemented EU guidelines regarding the prevention of the use of the financial system for the purpose of laundering the proceeds of criminal activities and financing terrorism
Law No. 186 of December 15, 2014, which introduced Article 648-ter of the Criminal Code, titled “Self-Laundering,” simultaneously incorporated that provision into this article.
Recently, through Legislative Decree No. 195 of November 8, 2021, Italian law transposed European Directive 2018/1673 on the fight against money laundering. Specifically, the Decree amends the Criminal Code in two ways: first, it expands the list of predicate offenses for the various types of money laundering, including negligent crimes and misdemeanor offenses; second, it revises the penalties for the various offenses.
The penalties provided for are fines of up to 1,000 quotas and the application of all disqualification sanctions for a maximum period of two years.
Art. 25-octies.1 sets forth the monetary penalties applicable to the Entity in connection with the commission of offenses under the Criminal Code concerning non-cash payment instruments and the fictitious attribution to others of ownership or control over money, property, or other benefits. The monetary penalty may reach a maximum of 800 units and, in certain cases, may be accompanied by the disqualification sanctions provided for in Article 9, paragraph 2.
On January 9, 2026, the following was published in the Official Gazette: Legislative Decree No. 211 of December 30, 2025, “implementing Directive 2024/1226/EU of the European Parliament and of the Council of April 24, 2024, on the definition of criminal offenses and sanctions for violations of the Union’s restrictive measures and amending Directive (EU) 2018/1673.” The Decree introduced new offenses into the Criminal Code concerning the European Union’s common foreign and security policy: Art. 275-bis of the Criminal Code (“Violation of European Union Restrictive Measures”), Art. 275-ter of the Criminal Code (“Violation of Reporting Obligations Imposed by a European Union Restrictive Measure”), Article 275-quater of the Criminal Code (“Violation of the conditions of authorization to conduct activities”).
With the addition of Article 25-octies.2 to Legislative Decree 231/2001, the amendment also expands the list of predicate offenses to include the aforementioned offenses.
As for the penalties:
(a) for violations of Articles 275-bis, first, second, and fifth paragraphs, and 275-quater, first paragraph, of the Criminal Code, as well as Article 12, paragraph 1-bis, of Legislative Decree No. 286 of July 25, 1998, the monetary penalty is set at a percentage ranging from 1 percent to 5 percent of the entity’s total revenue for the fiscal year preceding the one in which the offense was committed or, if lower, for the fiscal year preceding the imposition of the monetary penalty;
(b) for violations of Article 275-ter, paragraphs 1 and 2, of the Criminal Code, the monetary penalty is set at a percentage ranging from 0.5 percent to 1 percent of the entity’s total revenue for the fiscal year preceding the one in which the offense was committed or, if lower, for the fiscal year preceding the imposition of the monetary penalty.
When it is not possible to determine the entity’s total annual revenue, the entity shall be subject to a fine ranging from 3 million euros to 40 million euros, respectively, for the offenses referred to in Articles 275-bis, first, second, and fifth paragraphs, and 275-quater, first paragraph, of the Criminal Code, and for the offense referred to in Article 12, paragraph 1, aggravated pursuant to paragraph 1-bis, of Legislative Decree No. 286 of July 25, 1998; and a fine ranging from 1 million to 8 million euros in relation to the offenses referred to in Article 275-ter, first and second paragraphs, of the Criminal Code.
The duration of disqualification measures is also longer than that provided for under the general provisions of Legislative Decree No. 231/2001.
Law No. 99 of 2009, containing provisions for the development and internationalization of businesses, as well as provisions regarding energy, and amending Legislative Decree No. 81 of June 8, 2001, 81, in addition to amending Articles 25-bis and 25-bis 1 of Legislative Decree 231/01, introduces a new Article 25-novies titled “Offenses Related to Copyright Infringement.” The penalties provided for include fines of up to 500 quotas and the application of all disqualification sanctions for a maximum period of one year.
Law No. 116 of August 3, 2009 —Ratification and Implementation of the United Nations Convention against Corruption—incorporates into Legislative Decree No. 231/01 a reference to the offense set forth in Art. 377-bis of the Criminal Code, such that inducing a person not to make statements through violence, threats, or the offer or promise of money or other benefits also constitutes a predicate offense for the administrative liability of legal entities.
Penalties for the aforementioned offense include a maximum fine of 500 quotas. No disqualification sanctions are provided for.
The inclusion of environmental offenses among the “predicate offenses” for which corporate liability may arise occurred with the addition of a new article7to the legislative provision containing the specific regulations on the administrative liability of legal entities. The list of offenses introduced is particularly extensive; in fact, it covers numerous offenses—both criminal and misdemeanor—contained in the Penal Code and recently expanded to include new offenses introduced by Law No. 68/2015 (the Law on Environmental Crimes) into the Environmental Code8 , in the provisions protecting endangered animal and plant species9 , in the regulations protecting the ozone layer(10) ,and in the provisions relating to pollution caused by ships11 .
The draft law converting Decree-Law No. 116/2025, “Urgent Provisions to Combat Illegal Activities Related to Waste, for the Remediation of the Area Known as Terra dei Fuochi, and Regarding Assistance to Populations Affected by Natural Disasters,” has been approved with amendments.
The measure directly amends the Criminal Code and the Consolidated Environmental Act, as well as Legislative Decree 231/2001, with an overall tightening of the penalty regime for environmental crimes,
redefining certain criminal offenses and expanding the Catalog of Predicate Offenses to include conduct such as obstruction of inspection (Art. 452-septies of the Penal Code), failure to remediate (Art. 452-terdecies of the Criminal Code), and organized activities for the illicit trafficking of waste (Art. 452-quaterdecies of the Criminal Code).
Of particular note, moreover, is the provision holding legal entities liable for certain negligent offenses, such as the abandonment of non-hazardous waste, unauthorized waste management, and the illegal shipment of waste (as referred to in the new Article 259 of Legislative Decree 152/2006).
In addition to the increase in monetary penalties and the introduction of disqualification sanctions against entities, the application of judicial administration under Article 34 of the Anti-Mafia Code has been extended to companies involved in polluting activities.
Fines may reach a maximum of 1,200 units, and disqualification sanctions, where applicable, may also entail the permanent prohibition from conducting business.
Article 2 of Legislative Decree No. 109/2012 introduced the new Article “25-duodecies” (Employment of Third-Country Nationals Whose Stay Is Irregular) into Legislative Decree No. 231/01. Article 30 of Law No. 161 of October 17, 2017, added three additional paragraphs to the original Article 25-duodecies of Legislative Decree No. 231/2001, effective as of November 19, 2017, relating to the predicate offense of promoting, management, organization, financing, or carrying out the transport of undocumented immigrants, and to the offense of aiding and abetting the stay of undocumented foreigners. Therefore, if an employer hires foreign workers who lack a residence permit, or whose residence permit has expired and for which renewal has not been requested within the statutory deadlines, or whose residence permit has been revoked or annulled, in addition to the criminal liability of the employer as a natural person, the company will also be held liable under Article 231 if:
Similarly, if the entity derives an interest or benefit from offenses committed by its senior management or subordinates involving the promotion, direction, organization, financing, or transportation of undocumented immigrants, or the facilitation of the stay of undocumented foreigners, in addition to the criminal liability of the individual who committed the offense, the company will also be held liable under Article 231.
The monetary penalty may reach a maximum of one thousand units. For the offenses referred to in paragraphs 1-bis and 1-ter, the disqualification sanction provided for in Article 9, paragraph 2, is also applicable for a duration of not less than one year.
Article 5 of Law No. 167 of November 20, 2017, introduced, effective December 12, 2017, the new Article 25 Terdecies of Legislative Decree No. 231/2001. The predicate offense is the crime of “propaganda, incitement, or instigation based on the glorification of crimes of genocide, crimes against humanity, and war crimes.” The financial penalty imposed on the entity may reach a maximum of eight hundred units. In the case of a permanent establishment whose sole or primary purpose is to enable or facilitate the commission of such crimes, a permanent prohibition on conducting business activities is imposed pursuant to Article 16, paragraph 3, of Legislative Decree No. 231/2001.
Law No. 39 of May 3, 2019, entitled “Ratification and Implementation of the Council of Europe Convention on Sports Manipulation, done at Magglingen on September 18, 2014,” has extended the liability of entities under Legislative Decree No. 231/2001 to include offenses of fraud in sports competitions and the unauthorized operation of gaming or betting activities, by introducing Article 25-quaterdecies into Legislative Decree No. 231/2001.
Article 4 of the same legislative framework, on the other hand, covers various offenses related to the operation, organization, and sale of gaming and betting activities in violation of administrative authorizations or concessions.
Penalties may reach a maximum of 500 quotas and may include disqualification sanctions.
In 2019, the legislature added certain tax offenses to the list of predicate offenses for the “administrative” liability of entities under Legislative Decree No. 231/2001, specifically:
Legislative Decree No. 75 of July 14, 2020, implementing EU Directive 2017/1371 (the so-called PIF Directive), amended Article 25 quinquiesdecies in question by introducing a new paragraph 1-bis, which provides for:
It further stipulates, as conditions for the imposition of penalties, that the conduct must be carried out:
Disqualification sanctions are also provided for.
Legislative Decree No. 75 of July 14, 2020, implementing EU Directive 2017/1371 (the so-called PIF Directive), with the aim of providing the most comprehensive protection possible for the financial interests of the European Union, introduced this new article, which establishes the liability of a legal entity for the commission, in its interest or to its advantage, of the smuggling offenses provided for by Presidential Decree No. 43 of January 23, 1973. Following the establishment of the customs union among EU member states, customs duties constitute an own resource of the European Union, contributing to its budget. With regard to these offenses, a monetary penalty of up to 200 quotas is provided for, or up to 400 quotas if the customs duties owed exceed 100,000 euros. In any case, the entity is subject to the disqualification sanctions provided for in Article 9, paragraph 2, letters c), d), and e).
Law No. 22 of March 9, 2022, containing provisions regarding offenses against cultural heritage, has expanded the scope of application of forfeiture by introducing new categories of offenses and has included certain offenses against cultural heritage among the predicate offenses for the administrative liability of entities under Legislative Decree 231/2001.
Specifically, the law identifies the following offenses:
– theft of cultural property;
– receiving stolen cultural property;
– the use of cultural property derived from a crime;
– the laundering of cultural property;
– self-laundering of cultural property;
– forgery of private documents relating to cultural property;
– violations concerning the disposal of cultural property;
– the unlawful removal or export of cultural property;
– destruction, dispersal, deterioration, defacement, defiling, and unlawful use of cultural or landscape heritage;
– the devastation and looting of cultural and landscape heritage.
The reform has therefore expanded the list of offenses by adding two new articles:
this Article 25-septiesdecies, which provides for fines of up to 1,000 units and disqualification sanctions, and the one set forth below.
This article provides that, in relation to the crimes of money laundering involving cultural property (Art. 518-sexies) and the destruction and looting of cultural and landscape heritage (Art. 518-terdecies), a fine ranging from 500 to 1,000 units shall be imposed on the entity. If the entity, or one of its organizational units, is consistently used for the sole or primary purpose of enabling or facilitating the commission of such crimes, the penalty of permanent disqualification from conducting business shall apply.
Law No. 82/2025, containing “Amendments to the Criminal Code, the Code of Criminal Procedure, and other provisions for the integration and harmonization of regulations concerning crimes against animals,” was published in the Official Gazette No. 137 on June 16. The new regulations, through Art. 25-undevicies, expand the list of offenses relevant under Legislative Decree No. 231/2001. The offenses of killing animals (Article 544-bis of the Criminal Code), animal cruelty (Article 544-ter of the Criminal Code), and shows or events prohibited because they involve torture or torment of animals (Article 544-quater of the Criminal Code), the prohibition of animal fighting (Article 544-quinquies of the Italian Criminal Code), and the killing or harming of another person’s animals (Article 638 of the Italian Criminal Code) are therefore included in the risk assessments for the purposes of developing the Organizational Model.
The amendment took effect on July 1, 2025, and provides for the imposition of a disqualification sanction and a monetary penalty of up to 500 units on the entity.
Law No. 146/2006, ratifying and implementing the Palermo Convention against Transnational Organized Crime of November 15, 2006, established the application of Decree 231 to TRANSNATIONAL ORGANIZED CRIME OFFENSES. The new provisions establish the liability of legal entities for administrative offenses related to the crimes of criminal association, money laundering and the use of money and property of illicit origin, migrant smuggling, and obstruction of justice.
With regard to the legal entities to which this liability applies, the law specifies “entities with legal personality, companies with legal personality, and companies and associations, even those without legal personality” (Art. 1, para. 2).
This description is supplemented by a negative list of entities to which the law does not apply, namely “the State, local public entities, and entities performing functions of constitutional significance” (Art. 1, para. 3).
It should be noted that this new liability arises only when certain types of crimes are committed by individuals connected in various ways to the entity and only in cases where the unlawful conduct was carried out in the interest or for the benefit of the entity.
Thus, liability arises not only when the unlawful conduct has resulted in a benefit—whether financial or otherwise—for the entity, but also in cases where, even in the absence of such a concrete result, the criminal act was motivated by the entity’s interests.
Finally, it should be noted that Article 6 of Legislative Decree 231/2001 nevertheless provides for a form of “exemption” from liability for the entity if, during criminal proceedings for one of the offenses in question, it is demonstrated that the entity has adopted and effectively implemented organizational, management, and control models suitable for preventing the commission of the criminal offenses in question; that it has appointed a body with autonomous powers of initiative and oversight tasked with monitoring the functioning of and compliance with the Model and ensuring its updating; and that the offense was committed by fraudulently circumventing the Model.
It should be emphasized, in this regard, that the entity’s exemption from liability depends on a determination of the adequacy of its internal organizational and control system—a determination that the criminal court is required to make.
Therefore, the drafting of the Models must aim for a positive outcome of this assessment of adequacy.
The system provides for the establishment of an internal control body within the entity tasked with monitoring the actual effectiveness of the model. Finally, the law stipulates that trade associations may draft codes of conduct, on the basis of which individual organizational models must be developed and submitted to the Ministry of Justice, which has thirty days to provide its comments.
It is particularly important to define the scope of application of the regulations in question by identifying the individuals who, by committing a crime, may give rise to liability on the part of the entity to which they belong. Article 5 of the decree identifies two distinct categories of employees and collaborators of the company: senior management and subordinates.
This distinction, however, is not merely formal but is of particular importance for understanding how the Company can prevent and avoid the imposition of sanctions against it. The two categories of individuals who, pursuant to the provisions of Legislative Decree 231/2001, may—due to offenses they commit—give rise to liability on the part of the company are:
Taking an integrated view of all actors involved in the organization’s operations, the Organizational Model’s approach—to facilitate its application—is to distinguish the individuals required to comply with the Organizational Model into:
A) INDIVIDUALS WITHIN THE ORGANIZATION:
B) PARTIES OUTSIDE THE ORGANIZATION:
who are external to the company but linked to the Entity by a contractual and/or agency relationship.
For each of these, the Special Section of the Model will take into account the further distinction between:
B.1) RISKS WITHIN the entity: when the relationship with the supplier itself serves as a vehicle for conduct posing a risk of a 231 offense (e.g., corruption, money laundering, …) and the supplier is one of the perpetrators of the offense. In this case, the Model applies to the internal individual who manages the relationship with the supplier.
B.2) RISKS EXTERNAL to the entity: when the conduct posing a risk of a crime occurs within the activities carried out by the supplier on behalf of the entity (e.g., environmental crimes, occupational safety and health violations, crimes against industry and commerce, etc.): in this case, the crime is not committed by the entity itself, but is committed on its behalf.
It is the prerogative of the Special Section of the Organizational Model, once this assessment has been conducted and the existence of an external risk has been ascertained, to indicate the appropriate mitigation protocols, specify the tools for verifying compliance (reporting to the Supervisory Body / the Supervisory Body’s authority to monitor), and contractually bind the external party to the Code of Ethics, the specific mitigation protocols, and safeguard rules.
In light of the purpose of the law—which is to encourage business entities to prevent the commission of crimes—the legislature has provided, in Articles 6 and 7 of the decree, that companies may proactively adopt guidelines designed to reduce or exclude the liability (and consequently the penalties) provided for by Decree 231/01.
In particular, the two articles cited separately set forth the procedures to be followed to avoid liability in the two distinct cases involving offenses committed by senior management or by employees and contractors.
With regard to the first scenario, Article 6 provides that the company shall not be held liable if it proves that:
a) the executive body adopted and effectively implemented, prior to the commission of the offense, organizational and management models suitable for preventing offenses of the type that occurred;
b) the task of overseeing the functioning and compliance with the models, as well as ensuring their updating, has been entrusted to a body within the entity endowed with autonomous powers of initiative and control;
c) the individuals committed the offense by fraudulently circumventing the organizational and management models;
d) there was no failure to supervise or insufficient supervision on the part of the entity referred to in subparagraph b).
Article 7, on the other hand, focusing on offenses committed by individuals subject to the supervision of others, establishes that the company is liable if the commission of the offense was made possible by a failure to comply with management or supervisory obligations, provided that such failure is excluded a priori if the entity, prior to the commission of the offense, has adopted and effectively implemented an Organizational, Management, and Control Model suitable for preventing offenses of the type that occurred.
As is evident, therefore, the two cornerstones around which the system for excluding liability revolves are: the adoption of organizational models suitable for preventing the commission of offenses and the supervision of such models by a dedicated corporate body.
With regard to the implementation of the organizational model, Article 6, paragraph 2, of Legislative Decree No. 231/2001 sets forth the essential characteristics for establishing an organizational, management, and control model.
In particular, subparagraphs (a) and (b) of the aforementioned provision expressly refer—albeit using terminology and phrasing not typically found in business practice—to a typical risk management system 14. Risk assessment is also considered by UNI ISO 11961 to be the most important activity: only a correct, careful, and adequate process of risk analysis and assessment can enable us to identify the key elements that allow the organization or entity to establish a Compliance Management System compliant with ISO standards, or to establish an Organizational, Management, and Control Model pursuant to Legislative Decree No. 231/2001.
In fact, the standard explicitly outlines the two main phases into which such a system must be structured:
However, in order to operate effectively, the system briefly outlined above cannot be reduced to a one-time activity; rather, it must be implemented as a continuous process (or at least carried out at appropriate intervals), to be repeated with particular attention during periods of organizational change (opening of new offices, expansion of operations, acquisitions, reorganizations, etc.). Furthermore, in accordance with UNI ISO 37301 (Compliance Management System), “When the organization determines that changes to the compliance management system are necessary, these must be implemented in a planned manner. The organization must take into account: – the objectives of the changes and their potential consequences; – the design and operational effectiveness of the compliance management system; – the availability of adequate resources; – the allocation or reallocation of responsibilities and authority.”
With regard to the risk of unlawful conduct in the area of occupational health and safety, this system must necessarily take into account current preventive legislation.
This regulatory framework, in fact, itself outlines a “system” of binding principles and mandatory requirements whose implementation—when appropriately integrated or adapted in accordance with the Organizational Model provided for by Legislative Decree No. 231/2001 —may be suitable for reducing to an “acceptable” level, for the purposes of the exemption provided by Legislative Decree No. 231/2001 itself, the possibility of conduct constituting the elements of the crime of manslaughter or serious or very serious negligent injury committed in violation of preventive regulations.
A concept that is absolutely central to the design of a preventive control system is that of “acceptable risk.”
When designing control systems to mitigate business risks, defining acceptable risk is a relatively simple task, at least from a conceptual standpoint. A risk is considered acceptable when the additional controls “cost” more than the asset being protected (for example: ordinary cars are equipped with anti-theft devices but not with an armed security guard).
In the case of Legislative Decree No. 231/2001, however, the economic logic of costs cannot serve as the sole reference point. It is therefore important that, for the purposes of applying the decree’s provisions, an effective threshold be defined to set a limit on the quantity and quality of the preventive measures to be implemented to prevent the commission of the offenses in question.
In the absence of a prior determination of acceptable risk, the quantity and quality of preventive controls that can be established are, in fact, virtually infinite, with obvious consequences for business operations.
Moreover, the general principle—which is also invoked in criminal law—of the practical enforceability of conduct, summarized by the Latin maxim “ad impossibilia nemo tenetur,” represents an indispensable benchmark, even if it is often difficult to identify its concrete limits.
With regard to the preventive control system to be established in relation to the risk of committing the offenses covered by Legislative Decree No. 231/2001, the conceptual threshold of acceptability, in cases of intentional crimes, consistent with the provisions of the Guidelines developed by Confindustria (and approved by the Ministry of Justice), is represented by a prevention system that cannot be circumvented except fraudulently.
This solution is consistent with the concept of “fraudulent circumvention” of the organizational model as a defense provided for in the aforementioned legislative decree for the purpose of excluding the entity’s administrative liability (Art. 6, para. 1, letter c): “the persons committed the offense by fraudulently circumventing the organizational and management models”).
Conversely, in cases of manslaughter and negligent personal injury committed in violation of occupational health and safety regulations, the conceptual threshold of acceptability—for the purposes of the exemption under Legislative Decree No. 231/2001—is represented by the occurrence of conduct (not accompanied by the intent to cause death orpersonal injury) that violates the Organizational Prevention Model (and the underlying mandatory requirements prescribed by prevention regulations), despite the strict compliance with the supervisory obligations set forth in Legislative Decree No. 231/2001 by the designated body. This is because the fraudulent circumvention of organizational models appears incompatible with the subjective element of the crimes of negligent homicide and negligent personal injury, as set forth in Articles 589 and 590 of the Criminal Code.
In order to provide concrete assistance to companies and associations in developing these Models and identifying a supervisory body, Confindustria was the first to draft Guidelines containing a series of recommendations and measures—essentially drawn from corporate practice—deemed, in theory, suitable for meeting the requirements outlined in Legislative Decree No. 231/2001.
The Guidelines therefore aim to provide concrete guidance on how to implement these Models, as it is not feasible to construct case studies taken out of context and applied directly to individual operational realities.
The Guidelines thus play an important role in inspiring the development of the Model and the Supervisory Body, along with their respective duties, by the individual entity. However, in order to better pursue the goal of preventing crimes, the entity may also deviate from them if specific corporate needs so require, without this constituting a failure to meet the necessary requirements for drafting a valid organizational, management, and control model.
The first version of the document was drafted in 2002 by the Working Group on the Administrative Liability of Legal Entities, established within Confindustria’s Tax, Finance, and Corporate Law Unit. Representatives of Confindustria’s regional and sectoral associations, representatives of member companies, as well as academics and professionals with expertise in the field participated in the Group’s work.
The Guidelines were submitted to the Ministry of Justice, which, in a communication sent to Confindustria (December 2003), deemed them “overall adequate for achieving the objective set forth in Article 6, paragraph 3, of Legislative Decree No. 231/2001,” identifying only minor issues on which it requested further clarification and additions.
The Guidelines were therefore updated to incorporate the Ministry’s comments—which were definitively approved in June 2004—but also to introduce adjustments suggested by the practical experience gained by associations and companies during those early years, as well as to align them with the new internal structures of corporations, as outlined by the corporate law reform.
Subsequently, the Working Group established within Confindustria has carried out periodic updates to the Guidelines, the most recent of which took place in June 2021, in light of developments in the relevant regulatory framework, new discussions on integrated compliance, new control systems in the area of tax compliance, updates regarding whistleblowing reports, and other changes that have occurred over the years.
New operational guidelines on whistleblowing were issued by Confindustria in October 2023 following the Italian legislature’s transposition, via Legislative Decree 24/2023, of the European directive on the protection of whistleblowers.
In December 2024, the UNI 11961 Guidelines were also published for the integration of the UNI ISO 37301:2021 compliance management system to support Organizational Management and Control Models and Supervisory Bodies in accordance with Legislative Decree 231/2001. These guidelines establish coordination on specific issues among the provisions of UNI ISO 37301:2021, Legislative Decree 231/2001, and the Confindustria Guidelines, to facilitate the development of organizational models and the oversight activities of Supervisory Bodies.
ANAC has also issued Guidelines on Whistleblowing for the implementation of Legislative Decree 24/2023.
The update to the Company’s Organizational Model was prepared based on the guidelines provided by Confindustria, in the version available as of the date of drafting(15),and on international best practices and standards regarding risk assessment and gap analysis, with the necessary customization to adapt the general rules to a specific operational and corporate context.
FAIRMAT S.r.l. (hereinafter referred to as the “Company”) has chosen—given the specific need to optimize its organizational structure and in response to requests from institutional clients—to implement preventive protocols regarding corporate liability by adopting its own Model 231.
In particular, the process undertaken to implement the “231” project was aimed at:
– identify risk profiles by mapping existing activities and processes within the scope of the Company’s operations, followed by the analysis and monitoring of functional and organizational characteristics, and the identification of areas representing the main potential sources of risk in relation to the offenses listed in section 1.1 above;
– assess the compatibility of existing organizational and control mechanisms with the requirements set forth in the Decree and, in particular, align the organizational tools for managing 231 risks with the Integrated Management System (IMS) adopted by the Company, with the aim of standardizing organizational terminology and avoiding unnecessary duplication;
– identify any shortcomings and define an Improvement Plan to address them;
– implement an Organizational Model compliant with the provisions of the legislation and with Confindustria’s guidelines.
Setting aside the strictly legal and punitive aspects mentioned above, the adoption of a system of rules designed to reinforce the organization’s compliance not only with legal standards but also with ethical values can represent an opportunity.
The adoption of an Organizational Model that makes internal procedures more transparent and increases accountability—in addition to ensuring exemption from administrative liability—in fact constitutes an opportunity for growth and development for the parties involved, improving, on the one hand, their relationship with the company and, consequently, their public image, and, on the other hand, reducing the transaction costs arising from potential legal actions and negotiation processes.
Aware of these advantages, the Company voluntarily decided in 2021 to adopt, for the first time, a Code of Ethics and an Organizational, Management, and Control Model, with the aim of implementing the organizational system through the adoption of behavioral models that have come to play a significant role in market competition and that are often as decisive as sophisticated corporate governance rules in influencing the company’s performance.
In December 2023, the Company then carried out an initial update to the General Section of the Model, taking into account the new predicate offenses introduced in the meantime and the mandatory requirements set forth in Legislative Decree 24/2023 regarding whistleblowing.
The current update takes into account regulatory and jurisprudential developments that have occurred since December 2023, as well as the Company’s new organizational structure, which has revised the organization of its processes and guidelines.
The commitment to upholding ethical values must therefore be viewed as a means to achieve better performance, improve the company’s organizational structure, and project a positive image.
The “moralization” of the organization and the pursuit of its “integrity” thus represent a sure way to enhance its business activities.
The company departments responsible for each relevant area and process actively participated in the entire process.
This update to the Model consists of the following parts:
General Section
This section of the Model outlines the general, regulatory, and corporate context within which the Model was developed; the mechanisms by which the Model operates; the characteristics and duties of the Supervisory Body; the concept of a “violation” of the Model; the whistleblowing reporting system; and the sanctions system;
Special Section – Administrative Offenses and Occupational Health and Safety
This section is dedicated to the prevention of the offenses in question.
Code of Ethics
Whistleblowing Reporting Procedure
The procedures and regulations adopted and referenced within the Model also form an integral part of it; these include the management of identified risks, Company Policies, the Organizational Chart, and job descriptions that define roles and responsibilities.
In developing the Company’s Organizational Model, the Company followed the guidelines provided by current legislation—including in light of the interpretation offered by the most recent case law—as well as the procedural guidelines developed by Confindustria and set forth in the Guidelines, which have already been evaluated and deemed appropriate by the Ministry of Justice.
The Ministry has in fact clarified that “in addition to providing a concise overview of the contents of the legislative decree that introduced administrative liability for companies, the guidelines also provide members with clear and detailed guidance on virtually all aspects listed in the aforementioned Article 6 for the purpose of developing corporate organizational models, proposing various alternatives for each of these aspects, warning of the potential risks or disadvantages arising from the adoption of certain business strategies, and precisely identifying the areas of risk for each type of offense.”
The question that every entity must ask itself when deciding to adopt an Organizational Model for the purpose of excluding liability under Legislative Decree No. 231/2001 is, in fact, whether the Model is suitable for achieving the purpose for which it is adopted—namely, to prevent the commission of offenses and, as a result, to exclude the entity’s liability based on the judge’s subsequent assessment of that Model.
Obviously, this assessment must be conducted ex ante—that is, by basing the analysis on empirical data and adapting the organizational model to the specific circumstances of each individual entity, with specific reference to the structure in question and the actual activities carried out.
The implementation phase of the Organizational Model, therefore, followed the framework used in developing the Guidelines for the design of such models, based—as previously mentioned—on the most widely used risk assessment and risk management processes typically implemented in companies, in accordance with ISO 31000:2018.
It is evident, however, that the actual design of the Organizational Model—in order to ensure sufficient preventive effectiveness—was defined and implemented based on the specific characteristics of the entity to which it applies.
In fact, the risk of criminal offenses is closely tied to the economic sector in which the entity operates, its corporate structure, the specific operational procedures adopted, and the size of the entity.
Consequently, the structure and organization of the Organizational Model, which will be outlined below in the Special Section, have taken all these specific characteristics into account.
As mentioned, Organizational Models must be capable of preventing both intentional and negligent offenses as provided for by Legislative Decree No. 231/2001.
Consequently, the primary objective in developing an Organizational Model is to establish procedures for activities that carry a risk of criminal offense in order to prevent such offenses from being committed.
In this regard, it should be noted that it is evident that the same offenses may still be committed even after the Model has been implemented; however, in such cases, where intentional offenses are involved, they may be committed only if the agent genuinely intends both the conduct and the resulting event.
In this scenario, the Model and its related measures must be designed such that the agent must not only “intend” the criminal event (e.g., bribing a public official), but can carry out their criminal intent only by fraudulently circumventing (e.g., through deception and/or trickery) the entity’s guidelines.
The set of measures that the agent, if intending to commit a crime, will be forced to “circumvent” must be designed in relation to the entity’s specific activities deemed at risk and to the individual offenses hypothetically linked to them. This logic is consistent with established international standards regarding internal control and corporate governance and forms the basis of the best risk self-assessment systems (Control Self-Assessment).
The international standard commonly accepted as the benchmark for governance and internal control is the “CoSO Report,” produced in the U.S. in 1992 by Coopers & Lybrand (now PricewaterhouseCoopers) on behalf of the Committee of Sponsoring Organizations of the Treadway Commission (with the Institute of Internal Auditors and the AICPA among the sponsoring organizations), which adopted it and proposed it as a reference model for corporate control systems. National regulations in all major countries (the United Kingdom, Canada, etc.) have been inspired by it. In defining and implementing its Model for the Prevention of Criminal Risk, the Company has, in fact, taken into account the principles set forth in the most recent version of “Compliance Risk Management: Applying the CoSO ERM Framework,” issued in November 2020. The CoSO Report represents, in Italy as well, the formally recognized best practice for publicly traded companies, in addition to serving as a clear conceptual reference for the Board of Statutory Auditors’ Operational Guide since 2000, as well as for the circulars issued by ISVAP and the Bank of Italy.
Despite the need to tailor the implementation procedures and characteristics of the Model, it is still possible to identify the fundamental characteristics of the correct methodology for establishing a risk management system.
In the case of negligent offenses, however, the agent must have intended them only as conduct and not as an event. In this regard, it is worth noting from the outset that, with reference to the extension of Legislative Decree No. 231/2001 to cover the offenses of negligent homicide and serious or very serious negligent personal injury committed in violation of occupational health and safety regulations, the current legislative framework for the prevention of occupational risks sets forth the essential principles and criteria for managing occupational health and safety within the company; therefore, in this context, the Organizational Model cannot disregard this prerequisite.
More generally, the Model prepared by the Company is the result of the documented methodological application of the guidelines that will now be outlined, taking into account the internal operational context (organizational structure, territorial organization, size, etc.) and external context (economic sector, geographic area), as well as the individual offenses hypothetically linked to the Entity’s processes considered to be at risk.
The specific implementation procedures will be identified in detail later in the Special Sections of this Model.
Here, we will limit ourselves to briefly summarizing the main steps followed, which were:
a) Inventory of the Company’s Areas of Activity
This phase involves, in particular, a comprehensive review of the company’s operations, with the aim of identifying the areas affected by potential criminal scenarios by understanding and mapping the organization and its context.
As part of this process of reviewing at-risk processes and functions, it is necessary to determine the scope of application of the 231 preventive system, identifying the individuals subject to monitoring who, with regard to intentional offenses, may in certain specific and exceptional circumstances also include those linked to the company through mere quasi-subordinate relationships—such as agents—or other collaborative arrangements.
Finally, it should be emphasized that every company and sector has its own specific areas of risk that can be identified only through a detailed internal analysis. However, financial processes play a particularly significant role in the application of Legislative Decree No. 231/2001. The regulation, likely for this very reason, highlights them in a separate provision (Art. 6, para. 2, subpar. c)), although a thorough assessment of the company’s “at-risk” areas should in any case identify the financial area as one of undoubted significance.
b) Analysis of Potential Risks
The analysis of potential risks must consider the possible methods by which offenses could be committed in the various business areas (identified according to the process described in the previous point). In general, the risk assessment process was conducted in accordance with the guidelines of ISO 31000:2018.
This analysis, which is a prerequisite for the proper design of preventive measures, must result in a comprehensive overview of how criminal offenses can be committed within the internal and external operational context in which the company operates.
c) Assessment/Development/Adaptation of the System of Preventive Controls
The activities described above in points a) and b) are complemented by an assessment of any existing system of preventive controls and its adaptation where necessary, with a view to an integrated approach between existing procedures and control systems to ensure overall corporate compliance.
The system of preventive controls must be such as to ensure that the risks of committing offenses—as identified and documented in the previous phase—are reduced to an “acceptable level,” as defined above.
Essentially, this involves designing what Legislative Decree No. 231/2001 defines as “specific protocols aimed at planning the formulation and implementation of the entity’s decisions regarding the offenses to be prevented.”
The components of an internal (preventive) control system—for which well-established methodological guidelines exist—are numerous and must be integrated into a cohesive system, in which not all components need to coexist, and where a potential weakness in one component can be offset by strengthening one or more of the other components.
The foregoing applies above all in light of the size of the organization,
However, it is important to reiterate that, for all entities—whether large, medium, or small—the preventive control system must be designed such that, in the case of intentional crimes, it cannot be circumvented except through deliberate action.
Finally, it should be emphasized that every company or sector has its own specific areas of risk that can be identified only through a detailed internal analysis. Financial processes, however, play a particularly significant role in the application of Legislative Decree No. 231/2001. The regulation, likely for this very reason, highlights them in a separate provision (Art. 6, para. 2, subpar. c)), although a thorough assessment of the company’s “at-risk” areas should in any case identify the financial area as one of undoubted significance.
In analyzing potential risks, consideration must be given to the possible methods by which offenses could be committed in the various corporate areas (identified according to the process described in the previous point).
This analysis, which is preparatory to the proper design of preventive measures, must result in a comprehensive description of how criminal offenses can be committed within the internal and external operational context in which the company operates.
The system of preventive controls must be such as to ensure that the risks of committing offenses—in accordance with the methods identified and documented in the previous phase—are reduced to an “acceptable level,” as defined above.
Essentially, this involves designing what Legislative Decree No. 231/2001 defines as “specific protocols aimed at planning the formulation and implementation of the entity’s decisions regarding the offenses to be prevented.”
The components of a (preventive) internal control system—for which well-established methodological guidelines exist—are numerous and must be integrated into a cohesive system, in which not all components need to coexist, and where the potential weakness of one component can be offset by strengthening one or more of the other components.
The above applies above all in light of the company’s size, since it is clear that, for smaller companies, it is unrealistic to require the use of the entire complex array of control tools available to large organizations.
Consequently, in such smaller entities, only certain control components may reasonably be used, while others may be excluded (perhaps because they are implicit in the business model) or implemented in an extremely simplified form.
However, it is important to reiterate that, for all entities—whether large, medium, or small—the system of preventive controls must be such that:
The procedures described above for implementing the Organizational Model are aimed at establishing a system of appropriate preventive controls.
However, these control mechanisms must necessarily be organically integrated into a system architecture that complies with a set of control principles.
The principles underlying the organizational and management model adopted by the Company are as follows:
“Every operation, transaction, and action must be: verifiable, documented, consistent, and appropriate.”
For each operation, there must be adequate supporting documentation that allows for checks to be performed at any time to verify the characteristics and rationale of the operation and to identify who authorized, carried out, recorded, and verified the operation.
“No one may manage an entire process independently.”
The system must ensure the application of the principle of separation of duties, whereby the authorization to carry out an operation must be the responsibility of a person other than the one who accounts for, executes, or controls the operation. Furthermore, it is necessary that:
“Documentation of Controls.”
The control system must document (possibly through the preparation of minutes) the performance of controls, including supervisory controls. In particular, for the purposes of occupational health and safety, the principles of control (i.e., regulated management) can be summarized in the general outline provided below.
Following its update, the Model is submitted for approval to the Company’s Board of Directors, which, at the same time, identifies and appoints the Supervisory Body, as further specified below.
The Company, considering the full dissemination and communication of the Model to all stakeholders—whether internal or external—to be essential, undertakes to ensure that its contents, and in particular the Code of Ethics and the Whistleblowing System, are the subject of specific information and training activities, including those related to whistleblowing reports, using all available tools and methods. For operational procedures, please refer to the specific procedures included in the Special Section.
Finally, monitoring initiatives aimed at raising awareness and fostering understanding of the Model is among the duties assigned to the Supervisory Body, as further detailed below.
In accordance with the requirements of the Confindustria Guidelines and based on the guidance provided by leading case law on the subject, the organizational model adopted by FAIRMAT S.r.l. has been conceived and designed in relation to the specific characteristics of the company, from which the risk profiles and the most appropriate structuring of internal controls and protocols aimed at preventing relevant offenses inevitably derive.
With its team of software engineers and quantitative analysts, Fairmat was founded in 2008 as a reg-tech company providing solutions aimed at simplifying and automating the management of regulatory processes. It offers innovative solutions in the areas of pricing, risk management, and regulatory compliance.
Fairmat is currently the leading company in Italy for supporting the generation and maintenance of Key Information Documents (KIDs) containing key information on packaged investment and insurance products (PRIIPs) intended for retail investors.
Its solutions are currently used to simplify and automate regulatory documentation, reporting, and quantitative analysis.
Its expertise in specialized and specific areas, combined with the use of cutting-edge technology, enables it to offer high-value-added solutions to its clients.
Internal Management and Control System
The management and control system adopted is of the traditional type, with a Board of Directors consisting of two members: the Chairman (who represents the company and has powers extending beyond ordinary management) and the Managing Director, as well as the Vice Chairman and Chief Executive Officer.
A proxy is appointed to perform various functions, including acting as the employer’s delegate pursuant to Legislative Decree 81/2008, with the exception of those functions and obligations that cannot be delegated pursuant to Article 17, paragraph 1, letters A) and B) of Legislative Decree 81/2008. The powers of attorney are recorded in the Chamber of Commerce registry, and there are no additional ones.
The share capital, amounting to €50,000.00 and fully paid in, is held by:
The organizational chart illustrates the various company functions, depicting both the roles relevant to the application of internal procedures and those related to workplace accident prevention; it is available on company bulletin boards and websites.
The organizational chart shown represents the new organizational structure that the company has adopted. With the aim of streamlining processes and creating closer communication channels between department heads and customers, the company has transitioned to an end-to-end process system with vertical teams organized by project or product. The company has also expanded the number of operational delegations. This organizational change aims to increase efficiency by involving various departments and bridging the gap between development teams and those responsible for gathering customer needs and providing support.
Workplace Safety and Environmental Protection
With regard to key aspects of workplace health and safety, the Company’s organization is supported by the implementation of dedicated management software and the engagement of external consultants, in addition to the establishment of an organizational chart identifying the relevant roles.
Given the nature of the activities carried out, their impact on the environment is assessed as marginal and of little significance. The Company is committed to continuously monitoring any changes to this structure.
Given that the Supervisory Body is responsible for monitoring and proposing updates to the Model and the Code of Ethics, it should be noted that the Company ensures that its members possess specialized expertise in matters relevant to the Decree and meet the integrity requirements set forth in Article 109 of Legislative Decree 85/93. The Company further stipulates that the Supervisory Body be endowed with autonomous powers to act within its areas of competence, involving internal staff and/or external consultants for this purpose to ensure the continuous monitoring of the adequacy and suitability of the Model.
The composition of the Supervisory Body is established by a specific resolution of the Company’s Board of Directors, and its term of office is three years, renewable.
In light of its internal structure and organization, as well as the risk profiles assessed in this Model, the Company intends to establish a single-member Supervisory Body, which must possess extensive knowledge of matters pertaining to the administrative liability of legal entities, the Company, and its processes, as well as expertise in controls and audits, and must have the necessary autonomy to access all areas of the Company.
The specific qualifications required are determined based on the criminal risks that this Model aims to prevent, and the resolution appointing the Supervisory Body will specify the reasons for such requirements.
For the audits and actions required of the Supervisory Body regarding specific issues, the Supervisory Body may engage professionals of its choosing, provided it informs the Board of Directors in advance. Financial coverage will be provided by the budget allocated to it upon appointment, with the sole obligation to report on expenditures.
The requirements that characterize the Supervisory Body and ensure its effectiveness are:
Upon appointment of the Supervisory Body, the Company shall establish its compensation, which shall adequately reflect the expertise and professionalism demonstrated, as well as the frequency and nature of the verification activities provided for in the Model.
In order to provide the Supervisory Body with the necessary capacity to obtain information and thus to act effectively with respect to the Company’s organization, this Model also establishes the procedures governing the flow of information to and from the Supervisory Body.
The Supervisory Body, in accordance with the provisions of the Decree, is required to perform the following functions:
Therefore, as part of the activities described above, the Supervisory Body shall carry out the following duties:
In order to adequately and effectively carry out the functions, duties, and obligations listed above, the Supervisory Body is granted the authority to:
Furthermore, to enable the Supervisory Body to properly exercise the duties and powers assigned to it, within the limits and under the conditions required by law, it is established that:
In order to enable the Supervisory Body to monitor the adequacy and effectiveness of the Model, the relevant corporate functions are required to promptly inform the Supervisory Body regarding:
In implementation of Directive (EU) 2019/1937, Legislative Decree No. 24 of March 10, 2023, was enacted. Effective as of July 15, 2023, it concerns “the protection of persons who report violations of Union law and sets forth provisions regarding the protection of persons who report violations of national regulatory provisions.”
Article 7 of Legislative Decree No. 211/2025, which “implements Directive 2024/1226/EU of the European Parliament and of the Council of April 24, 2024, on the definition of criminal offenses and sanctions for violations of Union restrictive measures and amending Directive (EU) 2018/1673,” has extended whistleblower protection to individuals who report violations of European Union restrictive measures.
The main changes contained in the new regulations are:
– the clarification of the scope of application with regard to public-law entities and private-law entities, and the expansion of the list of the latter;
– the expansion of the category of individuals who may be protected for reports, complaints, or public disclosures;
– the expansion of the objective scope—that is, what is considered a relevant violation for the purposes of protection—which, in the specific case of The Company (a company with more than 50 employees and equipped with Model 231), consists of:
a) offenses under Legislative Decree 231/2001 and violations of the 231 Organizational Model;
b) violations of EU law;
c) violations of European Union restrictive measures referred to in Chapter I-bis, Title I, Book II of the Criminal Code, as well as Article 12, paragraph 1-bis, of Legislative Decree No. 286 of July 25, 1998;
d) violations, non-compliance, and retaliation related to whistleblowing.
– the distinction between what is protected and what is not;
– the regulations governing the three reporting channels and the conditions for accessing them: internal (in entities with a dedicated person or office, or through an external entity with specific expertise), external (managed by ANAC), and the public disclosure channel;
– an outline of the various methods for submitting reports, whether in writing or orally;
– detailed regulations on confidentiality obligations and the processing of personal data received, managed, and disclosed by or to third parties;
– Clarifications on what constitutes retaliation and an expansion of the relevant cases;
– regulations on the protection of whistleblowers or those who report retaliatory measures, provided by both ANAC and the judicial authorities, along with further guidance on the whistleblower’s liability and grounds for exemption;
– the introduction of specific support measures for whistleblowers and, to this end, the involvement of third-sector organizations that possess the appropriate expertise and provide their services pro bono;
– a revision of the rules governing sanctions imposed by ANAC and the introduction by private entities of sanctions within the disciplinary system adopted pursuant to Legislative Decree No. 231/2001.
The decree applies, among others, to private-sector entities that adopt organizational and management models pursuant to Legislative Decree No. 231/2001, which must include internal reporting channels within the organizational model.
After formally notifying the most representative labor unions in the area, the Company has taken the necessary steps by implementing a written and oral internal reporting channel, designating the Ethics Committee—composed of the Supervisory Body (ODV) and the Company’s Legal Department—as the body responsible for handling reports, and adopting the two Whistleblowing Reporting Procedures, which are attached and form an integral part of this document. In addition, a dedicated link on the FAIRMAT s.r.l. website provides access to the encrypted online platform for whistleblowing reports (https://whistleblowersoftware.com/secure/Fairmat), where the procedures and privacy notices regarding the processing of personal data are also available. The Company has brought its whistleblowing compliance in line with the new provisions and clarifications set forth in Resolution No. 478 of November 26, 2025, by which ANAC approved new Guidelines on internal reporting channels.
In accordance with the provisions of Legislative Decree 24/2023, any conduct, act, or omission—including any attempt or threat thereof—carried out as a result of a report, a complaint filed with judicial or accounting authorities, or public disclosure, and which causes or may cause the whistleblower or the person who filed the complaint, directly or indirectly, unjust harm, is prohibited.
In any proceeding concerning the investigation of prohibited conduct, acts, or omissions directed against whistleblowers, it is presumed that such conduct, acts, or omissions were carried out as a result of the report. The burden of proving that such conduct or acts is motivated by reasons unrelated to the report, public disclosure, or complaint rests with the person who carried them out.
In the event of a claim for compensation filed with a judicial authority by whistleblowers, if such persons demonstrate that they have, pursuant to this decree, filed a report, made a public disclosure, or filed a complaint with a judicial or accounting authority and have suffered harm, it is presumed—unless proven otherwise—that the harm is a consequence of such report, public disclosure, or complaint filed with a judicial or accounting authority.
The following are examples of acts that constitute retaliation:
a) dismissal, suspension, or equivalent measures;
b) demotion or denial of promotion;
c) a change in duties, a change in workplace, a reduction in salary, or a change in work schedule;
d) suspension of training or any restriction on access to training;
e) negative performance evaluations or negative references;
f) the imposition of disciplinary measures or other sanctions, including financial penalties;
g) coercion, intimidation, harassment, or ostracism;
h) discrimination or otherwise unfavorable treatment;
i) the failure to convert a fixed-term employment contract into a permanent employment contract, where the employee had a legitimate expectation of such conversion;
l) the failure to renew or the early termination of a fixed-term employment contract;
m) damages, including damage to a person’s reputation—particularly on social media—or economic or financial harm, including the loss of economic opportunities and loss of income; n) inclusion on improper lists based on a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find employment in that sector or industry in the future;
o) the early termination or cancellation of a contract for the supply of goods or services;
p) the revocation of a license or permit;
q) a request to undergo psychiatric or medical examinations.
The implementation of the whistleblowing policy and related procedures is aligned with the new regulations introduced by the European General Data Protection Regulation (GDPR) No. 679/2016 and by Legislative Decree No. 196/2003 (the Italian Privacy Code), as amended by Legislative Decree No. 101/2018. To this end, the specific processing of personal data is classified and managed through technical and organizational measures implemented to ensure that the Company’s processing of personal data complies with the provisions of the GDPR and the Italian Privacy Code, with particular attention to:
To this end, the Company also complies with the specific guidelines contained in Legislative Decree No. 24/2023.
The primary safeguard established by the legislature in favor of the whistleblower is the obligation to ensure the confidentiality of their identity and of any other information—including any attached documentation—from which the whistleblower’s identity could be directly or indirectly deduced. The same guarantee applies to individuals involved in and/or mentioned in the report, as well as to facilitators, in light of the risk of retaliation.
The following parties are subject to this obligation:
Confidentiality must be guaranteed for all reporting methods, including, therefore, when reports are made orally.
The Model provides for four types of periodic audits:
Given the integration of the Organizational Model into the Quality Management System, with reference to the protocols set forth in Special Part 1—Administrative Offenses, the Supervisory Body plans these audits while also taking into account the audit plan included in the aforementioned System.
As already stated in the preceding paragraphs, the Supervisory Body prepares a report for each audit and retains any supporting documentation in its custody.
As previously mentioned regarding the functions assigned to it, the Supervisory Body reports to the Administrative Body at least annually, or promptly as needed, on the implementation of the Model’s policies, with reference to:
The Supervisory Body prepares a report for each audit conducted and retains any supporting documentation in a location of its choosing.
The Board of Directors may request that the Supervisory Body be convened at any time. Similarly, the Supervisory Body may, if necessary, request that the Board of Directors be convened to report on any violations or serious misconduct identified. The Supervisory Body shall prepare specific minutes for each meeting between the two bodies.
The general duty of oversight entrusted to the Supervisory Body plays an absolutely central role in the effectiveness of the Model, to the extent that failure to comply with this duty would render the Company ineligible for the exemption from liability. Consequently, should the Company commit offenses attributable to the Supervisory Body’s failure to exercise its supervisory authority over the implementation and operation of the Model, the Supervisory Body itself could face criminal liability.
Some might trace the source of this liability to Article 40, paragraph 2, of the Criminal Code, which establishes the principle that “failing to prevent an event that one has a legal obligation to prevent is equivalent to causing it.” Therefore, according to this argument, the Supervisory Body could be held liable for complicity by omission in the offenses committed by the Company.
In this regard, however, it must be noted that the duty to supervise does not imply an obligation to prevent the offense; therefore, it is reasonable to conclude that the liability referred to in the aforementioned Article 40, paragraph 2, of the Criminal Code applies only if the party subject to the duty to supervise is also the guarantor of the protected legal interest. In the present case, the Supervisory Body does not appear to be entrusted with the obligation to monitor the commission of offenses but rather with overseeing the functioning and compliance with the Model, ensuring its updating and any necessary adjustments, since it is, in essence, the advisory body to the Company’s administrative body, which alone bears the responsibility for amending the Model in accordance with the Supervisory Body’s recommendations and proposals.
This position is further supported by the fact—although not entirely legally equivalent—that public officials or public service employees, upon discovering a crime, are obligated to report it to the judicial authorities but are not explicitly required to prevent the commission of the crime.
This principle also appears to apply to cases of negligent offenses committed in violation of regulations concerning occupational health and safety and environmental protection. In such cases as well, the Supervisory Body has no obligation to monitor the activity itself, but rather a duty to verify the suitability and adequacy of the Model in preventing such offenses.
A particularly important aspect in the development of the Model is the provision of an adequate penalty system for violations of the Code of Ethics, as well as of the procedures set forth in the Model.
More specifically, for the purposes of applying the sanctions system, “violation” means:
1. all violations described in paragraph 4.5 above:
a) offenses under Legislative Decree 231/2001 and violations of the 231 Organizational Model;
b) violations of EU law;
2. violations, non-compliance, and retaliation related to whistleblowing.
Such violations undermine the relationship of trust established with the entity, in accordance with Articles 2104 and 2105 of the Civil Code, which establish obligations regarding an employee’s diligence and loyalty toward their employer, and may, consequently, result in disciplinary action, regardless of whether criminal proceedings are initiated in cases where the conduct constitutes a criminal offense.
As for the types of sanctions that may be imposed, it should first be noted that, in the case of an employment relationship, any disciplinary measure must comply with the procedures set forth in Article 7 of Law No. 300/70 (the so-called Workers’ Statute) and/or special regulations, where applicable, characterized not only by the principle of specificity of violations but also by the principle of specificity of sanctions.
Due to their disciplinary nature, the Code of Ethics and the procedures adopted within the framework of the Organization, Management, and Control Model pursuant to Legislative Decree No. 231/2001—failure to comply with which constitutes a disciplinary offense—are formally declared binding on all employees upon notification of the Model’s adoption.
The disciplinary sanctions that may be imposed are set forth below.
The following sanctions may be imposed on employees:
The determination of any violations may result in the employee being suspended from work as a precautionary measure.
These sanctions will be imposed based on the significance of the individual cases in question and will be proportionate to their severity.
In order to clarify in advance the criteria linking employee violations to the disciplinary measures adopted, it is specified that:
– An employee is subject to conservative disciplinary measures if:
a) violates internal procedures or engages in conduct that does not comply with the provisions of the Code of Ethics and the rules of conduct contained in this Model (e.g., fails to follow prescribed procedures, fails to report required information to the Supervisory Body, fails to perform checks, etc.), as such conduct constitutes a failure to carry out orders issued by the Company;
b) commits violations of the Model pursuant to Legislative Decree 231/2001 as referred to in paragraph 4.5 above, excluding those unambiguously aimed at committing a crime punishable under Legislative Decree 231/2001;
– An employee is subject to disciplinary measures resulting in termination if:
a) who, in the performance of activities in areas deemed high-risk by the Company, engages in conduct that does not comply with the provisions contained in the Model and the Code of Ethics, and that is unequivocally aimed at committing an offense punishable under Legislative Decree 231/2001, since such conduct constitutes a breach of work discipline and diligence so serious as to undermine the Company’s trust in the employee;
b) who, in the performance of activities related to high-risk areas, engages in conduct that is clearly contrary to the provisions contained in the Model and the Code of Ethics, such that it results in the actual application against the Company of the measures provided for by Legislative Decree 231/2001, since such conduct must be regarded as an act causing the Company serious moral and material harm that precludes the continuation of the employment relationship, even on a temporary basis;
The Company may not take any disciplinary action against an employee without first notifying the employee of the allegation and hearing the employee’s defense. Except in the case of a verbal reprimand, the notification of the allegation must be made in writing, and disciplinary measures may not be imposed until five days have elapsed, during which time the employee may present their defense.
If the disciplinary action is not imposed within ten days of the submission of such justifications, the justifications shall be deemed accepted. The employee may also present their justifications verbally.
The imposition of a disciplinary measure must be justified and communicated in writing.
Disciplinary measures may be challenged by the employee through the union, in accordance with the applicable contractual provisions. Dismissal may be challenged in accordance with the procedures set forth in Article 7 of Law No. 604 of July 15, 1966, as confirmed by Article 18 of Law No. 300 of May 20, 1970.
Disciplinary measures shall no longer be taken into account for any purpose two years after they were imposed.
The principles of proportionality and commensurability between the violation committed and the sanction imposed are ensured by compliance with the following criteria:
Disciplinary sanctions (as provided for in Article 7 of Law 300/70) and the Code of Ethics are made known to employees by posting them in a location accessible to all.
In general, the following sanctions may be imposed on managerial staff:
A manager is subject to disciplinary measures in the following cases:
a) they violate internal procedures or engage in conduct that does not comply with the provisions of the Code of Ethics and the rules of conduct contained in this Model (e.g., failing to follow prescribed procedures, failing to report required information to the Supervisory Body, failing to perform checks, etc.) or, when carrying out activities in high-risk areas, engages in conduct that does not comply with the provisions contained in this Model, such conduct being deemed a failure to carry out the orders issued by the Company;
b) commits violations of the Model pursuant to Legislative Decree 231/2001, excluding those unambiguously aimed at committing a crime punishable under Legislative Decree 231/2001;
c) fails to exercise adequate oversight;
d) fails to promptly provide the required information to the Supervisory Body;
In such cases, depending on the severity of the conduct, managers may be subject to precautionary suspension from work—without prejudice to the manager’s right to compensation—as well as, on a provisional and precautionary basis for a period not exceeding three months, reassignment to different duties in accordance with Article 2103 of the Civil Code.
A manager is subject to disciplinary measures resulting in termination in the following cases:
a) in the performance of activities in areas deemed at risk by the Company, engages in conduct that does not comply with the provisions contained in the Model and the Code of Ethics, clearly intended to commit an offense punishable under Legislative Decree 231/2001, where such conduct constitutes a breach of work discipline and diligence so serious as to undermine the company’s trust in the employee;
b) engages, in the performance of activities related to high-risk areas, in conduct that is clearly contrary to the provisions contained in the Model and the Code of Ethics, such that it results in the actual application against the Company of the measures provided for by Legislative Decree 231/2001, since such conduct must be regarded as an act that causes the Company serious moral and material harm, making it impossible to continue the employment relationship, even on a temporary basis;
In such cases, the Company, in light of the seriousness of the conduct, may proceed with the early termination of the employment contract in accordance with applicable law and the National Collective Bargaining Agreement.
The Supervisory Body shall promptly inform the Board of Directors as a whole so that it may take or initiate the most appropriate and adequate measures, in relation to the severity of the violation detected and in accordance with the powers provided for by current legislation and the Articles of Association.
A director is subject to provisional disciplinary measures in the following cases:
In such cases, the Administrative Body may directly impose the disciplinary measure of a formal written reprimand or revocation of the powers of attorney granted, depending on the severity of the offense.
A director is subject to disciplinary measures resulting in removal from office in the following cases:
In this case, disciplinary measures (such as, by way of example, temporary suspension from office and, in the most serious cases, removal from office) will be adopted by the Shareholders’ Meeting.
Violations of the Code as specified above by parties with contractual, commercial, or partnership agreements with the Company may result, in accordance with the provisions of the Special Section of this Code and, where applicable, as governed by the specific contractual relationship, the termination of the relevant contract or the right to withdraw from it, without prejudice to the right to seek compensation for damages incurred as a result of such conduct, including damages caused by a judge’s application of the measures provided for in Legislative Decree 231/2001.
In particular, once an assessment has been conducted and the existence of a risk—including one external to the Company’s immediate organizational structure—has been established, the external party may be contractually bound by the Code of Ethics, the specific risk mitigation protocols, and the safeguards specifically identified in the Special Section of the Model, with the corresponding obligation to report to the Supervisory Body (ODV) and the Supervisory Body’s authority to exercise oversight.
If the individual is a foreign national or operates abroad, they may also be bound to comply with international and local regulations aimed at preventing risks that could give rise to liability on the part of the Company resulting from the commission of crimes.
A. CONSERVATIVE Disciplinary Sanctions Against employees, executives, or directors who are found to have:
a) have breached confidentiality obligations regarding the whistleblower’s identity;
b) have violated the prohibition against acts of retaliation or discrimination against the whistleblower;
c) have obstructed or attempted to obstruct a report;
d) have failed to establish, despite being tasked to do so, the reporting channels or procedures for making and managing reports, or have adopted procedures that do not comply with those set forth in Articles 4 and 5 of Legislative Decree 24/2023;
Terminating disciplinary sanctions against employees, executives, or directors when it is established that:
e) even by a first-instance judgment, the whistleblower’s criminal liability for the offenses of defamation or slander, or in the event that such offenses are committed through a report to judicial or accounting authorities;
f) civil liability on the same grounds due to willful misconduct or gross negligence.
B. With respect to parties with contractual or commercial relationships and “quasi-subordinate” individuals, the violations referred to in the preceding subparagraphs may result, in accordance with the provisions of the Special Section of this Model and as may be specifically governed by the relevant contractual relationship, termination of the relevant contract or the right to withdraw from it, without prejudice to the right to seek compensation for damages incurred as a result of such conduct, including damages caused by a judge’s application of the measures provided for in Legislative Decree 231/2001.
C. In cases of violations committed by shareholders, the Board of Directors reserves the right to take the most appropriate measures.
The Board of Directors is responsible for conducting the necessary investigations, initiating disciplinary proceedings, and imposing sanctions following any violation of the Model. The Company also maintains adequate documentation to support any sanctions imposed.
The Supervisory Body, given its role in monitoring the effective implementation and compliance with the Model and all its components, shall be responsible for reporting any potential violations it identifies or becomes aware of in the course of its activities, and for verifying, in the event that a violation is confirmed, that the Company has effectively imposed a proportionate sanction.