Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.
posted 3 hours ago
The mandatory reporting of criminal offences in Austria is governed primarily by §78 of the Code of Criminal Procedure (Strafprozessordnung, StPO), which imposes a statutory duty on public authorities and officials to notify the public prosecutor or police whenever they become aware of a suspected offence subject to public prosecution. For in-house counsel, compliance officers, and corporate directors operating in Austria, understanding exactly who is bound by this duty, and where the boundary falls for private entities, has become an increasingly urgent priority. Heightened enforcement activity in financial and anti-corruption crime throughout 2025 and 2026, combined with Austria’s whistleblower protection regime and strict data-protection rules, has complicated the practical decision of when and how to escalate a suspicion externally.
This guide sets out the legal framework, the actors who must (and need not) report, the practical channels available, and the exceptions and penalties that shape compliance strategy in 2026.
Section 78 of the Austrian Strafprozessordnung (StPO) establishes the core reporting obligation in Austrian criminal procedure. In its current consolidated form, §78(1) provides that every public authority and every public official (Behörde and öffentliche Dienststelle) that becomes aware, in the course of its activities, of a suspected offence prosecutable by the state (von Amts wegen zu verfolgende strafbare Handlung) must report it to the criminal police or the public prosecutor. The statute is published in the Rechtsinformationssystem (RIS), the official Austrian legal information system maintained by the Federal Chancellery.
The provision is deliberately broad in its institutional reach: it captures all tiers of government, federal, state (Land), and municipal, together with independent regulatory bodies, courts acting in a non-adjudicative capacity, and entities exercising delegated public authority. The obligation arises the moment a reasonable suspicion of criminal conduct comes to the authority’s attention through its official functions. It does not require certainty of guilt or a completed investigation, only a factual basis sufficient to warrant further inquiry by the prosecuting authorities.
StPO §78 operates within a wider procedural architecture. Once a report is received, the public prosecutor (Staatsanwaltschaft) assumes the lead role in directing any investigation, issuing instructions to the criminal police (Kriminalpolizei) as needed. The Bundeskriminalamt (BKA), Austria’s federal criminal intelligence agency, coordinates specialised investigations, particularly in economic crime, organised crime, and corruption, and maintains reporting offices for complex cases.
The obligation under §78 does not exist in a vacuum. Two further legislative instruments are critical for corporate compliance teams. First, the Verbandsverantwortlichkeitsgesetz (VbVG), enacted in 2006, establishes corporate criminal liability for legal entities where an offence was committed by a decision-maker or where deficient organisational measures allowed an employee to offend. Self-reporting and cooperation with authorities are relevant factors in determining the level of sanctions under the VbVG. Second, the HinweisgeberInnenschutzgesetz (HSchG), Austria’s domestic transposition of EU Directive 2019/1937 on the protection of whistleblowers, requires companies with 50 or more employees to establish internal reporting channels and protects whistleblowers against retaliation.
The HSchG creates a parallel pathway for reporting misconduct that compliance teams must integrate with their understanding of the §78 framework.
The practical question for most corporate readers is not the text of the statute itself but how it applies to their specific role. The duty to report crimes in Austria under StPO §78 attaches to a defined category of actors, while private persons and companies occupy a markedly different legal position. The comparison table below summarises the reporting obligation for each major category.
| Entity Type | Duty to Report Under StPO §78 | Practical Notes for Corporate Teams |
|---|---|---|
| Public authorities and officials (police, tax authorities, regulatory agencies, public administration) | YES, statutory reporting duty applies whenever the authority becomes aware of a suspected Offizialdelikt in the course of its activities. | Must report without undue delay to the public prosecutor or criminal police. Internal procedural protocols typically govern the mechanics of escalation. |
| Prosecutors and judges | YES, institutional duty. Prosecutors direct investigations; judges must refer suspected offences encountered during proceedings. | Prosecutorial discretion applies to the conduct of the investigation, not to whether a report must be made. Judges who become aware of criminal conduct during civil or administrative proceedings must notify the public prosecutor. |
| Private individuals (members of the public) | NO general legal duty to report. Every person has the right to file a criminal complaint (Anzeige), but no statutory obligation compels them to do so. | Victims and witnesses may file at any police station or directly with the public prosecutor. There is no penalty for choosing not to report, with narrow exceptions (see below on failure to prevent certain serious crimes). |
| Company directors and officers | Not automatically bound by §78 unless the company exercises delegated public authority. However, awareness of criminality within the organisation triggers ancillary risks under the VbVG and general criminal law. | Compliance programmes should include internal escalation procedures. Self-reporting and cooperating with authorities may serve as mitigating factors under the VbVG. Industry observers expect prosecutors to scrutinise corporate awareness of criminality more rigorously in 2026. |
| Lawyers and defence counsel | Generally constrained by professional secrecy (Verschwiegenheitspflicht). Reporting obligations do not override privilege except in narrowly defined circumstances (e.g., prevention of serious future harm). | External counsel should be engaged before any reporting decision that could implicate privileged communications. Anti-money-laundering obligations under Austria’s FM-GwG impose separate suspicious-transaction reporting duties on certain legal professionals. |
It is essential for corporate compliance officers to understand that even though private companies and their directors are not directly bound by §78, the absence of a statutory duty to report is not a shield against liability. The VbVG can attribute criminal conduct to the entity where management knew or should have known about offending and failed to take adequate organisational steps. In practice, many Austrian compliance frameworks therefore include voluntary external reporting protocols, particularly for suspected bribery, fraud, or market manipulation.
A further nuance affects entities that straddle the public-private divide, state-owned enterprises, utilities exercising regulatory functions, and contractors delivering public services under concession. Where such entities exercise powers delegated by a public authority, their staff may be treated as public officials for the purposes of §78, and the full reporting obligation applies.
The reporting obligation under StPO §78 applies exclusively to offences that are subject to prosecution by the state (Offizialdelikte). These are criminal offences that the public prosecutor is required to investigate once they come to light, regardless of whether the victim files a complaint. The Austrian Criminal Code (Strafgesetzbuch, StGB) classifies the vast majority of serious crimes as Offizialdelikte, including murder, robbery, serious bodily harm, arson, bribery, fraud of significant value, embezzlement by public officials, money laundering, and terrorist financing.
Offences that are only prosecuted upon the victim’s request (Privatanklagedelikte and certain Ermächtigungsdelikte), such as minor insult or certain low-level property offences, fall outside the scope of §78. Public authorities encountering these offences in their work are not obliged to report them, though they may still do so if the victim consents.
The statutory threshold for triggering the duty is the authority’s awareness of a suspicion, not proof or even high probability. The reporting obligation in Austria arises when the available facts give rise to a reasonable inference that a prosecutable offence may have been committed. Authorities are not expected to conduct a full investigation before reporting; indeed, §78 is designed to ensure that the public prosecutor receives information early enough to decide whether an investigation is warranted.
For corporate teams applying this logic by analogy to voluntary self-reporting, the practical benchmark is similar: once internal information crosses the threshold from rumour or speculation into concrete, articulable facts suggesting criminal conduct, escalation, at minimum to internal legal counsel, and potentially to external authorities, should be considered promptly.
Reporting a suspected criminal offence in Austria can be done through several channels, depending on urgency and the nature of the conduct.
Before making an external report, companies should follow a structured internal process to preserve evidence, manage privilege, and ensure coordinated action.
Lawyer-client privilege (Verschwiegenheitspflicht) is a fundamental right under Austrian procedural law. Communications between a lawyer acting in their professional capacity and their client are protected from seizure and cannot be compelled as evidence. However, privilege does not protect communications that are themselves part of, or further, criminal conduct. When an internal investigation uncovers potential criminality, any findings documented by in-house counsel may not enjoy the same level of protection as those prepared by external, independently instructed defence counsel. Companies conducting internal investigations should therefore engage external counsel at the earliest stage to maximise the scope of privilege.
Any reporting of suspected criminal conduct necessarily involves the processing of personal data, names of suspects, victims, and witnesses, along with potentially sensitive financial and communications data. Austria’s Federal Data Protection Act (Datenschutzgesetz, DSG), which supplements the EU General Data Protection Regulation (GDPR), applies to this processing. The lawful basis for processing personal data in the context of a criminal report will generally be either compliance with a legal obligation (Article 6(1)(c) GDPR, where a reporting duty exists) or the legitimate interests of the controller (Article 6(1)(f) GDPR, for voluntary reports). Companies should ensure that data processing is proportionate, limited to what is strictly necessary for the report, and that access to the data is restricted.
A formal data-protection impact assessment may be advisable in complex cases.
Austria’s HinweisgeberInnenschutzgesetz (HSchG) requires companies with 50 or more employees to establish secure internal reporting channels through which employees can report suspected breaches of certain EU and national laws, including criminal offences. Whistleblowers who use these channels, or, where internal reporting is ineffective, external channels such as the public prosecutor’s office, are protected against retaliation, including dismissal, demotion, and harassment. The HSchG does not create a duty to report for the individual whistleblower but establishes a protective framework that encourages reporting. For compliance teams, this means that the internal escalation process must be designed to interface with both the HSchG’s requirements and any voluntary or mandatory external reporting to the public prosecutor.
Readers should verify the current text of the HSchG, as amendments may refine employer obligations.
The failure to report offence penalty in Austria operates differently for public officials and private actors. A public official who deliberately suppresses a §78 report may face disciplinary proceedings and, depending on the circumstances, criminal charges for aiding and abetting (Beitragstäterschaft) or abuse of official authority (Amtsmissbrauch, §302 StGB). For private companies, the risk is indirect but no less significant: where management awareness of criminality is established and no action was taken, the VbVG exposes the entity to fines calibrated to the seriousness of the underlying offence and the entity’s revenue.
Industry observers expect the enforcement environment in 2026 to remain intensely focused on economic crime and corruption. The European Commission’s Rule of Law Report for Austria has consistently noted the importance of robust enforcement of anti-corruption measures, and the OECD’s evaluation of Austria’s anti-bribery framework has emphasised the role of corporate compliance programmes and self-reporting in determining sanctions. The Austrian Wirtschafts- und Korruptionsstaatsanwaltschaft (WKStA), the specialised anti-corruption prosecutor’s office, has expanded its capacity and caseload in recent years, making proactive corporate cooperation increasingly valuable in practical terms.
The reporting obligation under StPO §78 is narrow in its direct application, binding public authorities and officials, not private companies or individuals, but its practical implications radiate far beyond that statutory perimeter. In 2026, the intersection of corporate criminal liability under the VbVG, whistleblower protections under the HSchG, and intensified enforcement by the WKStA means that every Austrian-based company should treat the question of when to escalate and report suspected criminality as a core compliance priority. Organisations should review their internal escalation procedures, ensure alignment with both whistleblower-channel obligations and data-protection requirements, and establish a standing relationship with experienced Austrian criminal-law counsel who can advise rapidly when suspicion arises.
The cost of a well-designed reporting framework is modest; the cost of getting caught without one is not. For guidance on criminal compliance matters in Austria, qualified specialists can provide tailored advice specific to your organisation’s structure and risk profile.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Nikolaus Sauerschnig at Gheneff – Rami – Sommer – Sauerschnig Rechtsanwälte GmbH & Co KG, a member of the Global Law Experts network.
Find the right Legal Expert for your business
Sign up for the latest advisor briefings and news within Global Advisory Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.
Naturally you can unsubscribe at any time.
Global Advisory Experts is dedicated to providing exceptional advisory services to clients around the world. With a vast network of highly skilled and experienced advisors, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.
