The legal framework governing the European Public Prosecutor’s Office

The European Public Prosecutor’s Office (EPPO) is the European Union’s independent body for investigating and prosecuting crimes that harm the EU’s financial interests. Its mandate covers conduct such as fraud involving EU funds, corruption, misappropriation, money laundering and certain serious cross-border VAT offences. The office operates across participating Member States through a single institutional structure supported by national prosecutors.

For businesses, EPPO changes the compliance landscape because conduct connected with EU budgets may trigger a supranational criminal investigation as well as proceedings under national law. Companies receiving grants, participating in public procurement, working with intermediaries or handling EU-funded projects therefore need to understand how EU legislation, domestic criminal law and procedural safeguards interact.

The framework is built around Regulation (EU) 2017/1939, the directive on combating fraud affecting the Union’s financial interests by means of criminal law, and wider EU rules on fundamental rights, data protection and cross-border cooperation. Together, these instruments define EPPO’s jurisdiction, investigative powers, institutional independence and relationship with national authorities.

The legal basis and scope of EPPO authority

The legal foundation for EPPO is Article 86 of the Treaty on the Functioning of the European Union. This provision allows participating Member States to establish a European Public Prosecutor’s Office responsible for investigating, prosecuting and bringing to judgment offences affecting the Union’s financial interests. The office was created through Regulation (EU) 2017/1939, which became its central operating statute.

EPPO began handling investigations in June 2021. It is part of the EU institutional system but is legally independent from national governments, the European Commission and other EU bodies. Its independence is intended to protect prosecutorial decisions from political or administrative influence, particularly where investigations involve public officials, contractors or powerful commercial interests.

The office does not have general authority over every form of corruption. Its jurisdiction is tied to offences that damage the EU budget or threaten the collection of EU revenue. A case may fall within its competence when there is a direct financial link to EU funds, customs duties, agricultural payments, structural funds, recovery financing or other Union resources.

The territorial scope is also important. EPPO currently operates in participating Member States, while some EU countries have chosen not to join the enhanced cooperation arrangement. Its jurisdiction can nevertheless extend to conduct connected with participating states, EU institutions or financial interests under the conditions set out in the regulation. Companies operating across Europe must therefore assess both the location of the conduct and the source or destination of the money involved.

Offences affecting the Union’s financial interests

Directive (EU) 2017/1371, commonly called the PIF Directive, harmonises the criminal-law response to fraud affecting the EU’s financial interests. It requires Member States to criminalise certain conduct and provides a common basis for EPPO investigations. The directive covers fraud on both the expenditure and revenue sides of the EU budget.

Relevant conduct can include submitting false statements to obtain EU funding, using grants for unauthorised purposes, concealing information that should be disclosed to a funding authority, and misappropriating assets entrusted under a Union programme. Customs fraud and certain VAT offences can also come within the framework. Cross-border VAT fraud is particularly significant where the total damage reaches the threshold set by EU law and the activity involves at least two Member States.

Corruption is relevant when a public official requests, receives, offers or accepts an undue advantage connected with conduct that affects the Union’s financial interests. The precise offence classification generally depends on the applicable national criminal law, because EPPO prosecutes before national courts using domestic legal procedures. Bribery that has no connection to EU money or EU revenue normally remains outside EPPO’s material jurisdiction.

The framework also addresses related offences, including money laundering, participation in an organised criminal group and obstruction of investigations. A single case may therefore involve multiple legal theories: false grant applications, bribery of a public official, diversion of project funds and subsequent laundering through suppliers or shell companies.

How investigations are organised across Europe

EPPO has a central office in Luxembourg and a decentralised structure in participating countries. The European Chief Prosecutor leads the institution, while the Permanent Chambers supervise investigations and prosecutions. European Prosecutors represent Member States at the central level, and European Delegated Prosecutors conduct investigations locally, usually within their national judicial systems.

This structure combines European coordination with national legal expertise. Delegated European Prosecutors may use investigative measures available under domestic law, subject to the EPPO Regulation and applicable safeguards. Depending on the country, measures may include searches, seizures, questioning, access to records, freezing of assets and covert investigative techniques authorised by a court or prosecutor.

Investigations may begin after a report from an EU institution, national authority, private party or another source. EU bodies and competent national authorities have duties to report suspected criminal conduct affecting the Union’s financial interests to EPPO without undue delay. Businesses are not generally substitutes for public authorities, but regulated entities, grant beneficiaries and contractors may have reporting duties under national law, contract terms or sector-specific rules.

EPPO can also take over cases initially opened by national authorities when the conduct falls within its competence. National prosecutors may be required to refrain from continuing parallel proceedings or to transfer relevant information. This prevents fragmented enforcement, although coordination can be complex where conduct includes both EPPO offences and purely domestic crimes.

Legal instrument or institution	Main function	Practical relevance for companies
Article 86 TFEU	Authorises the creation of EPPO	Establishes the constitutional basis for supranational criminal enforcement
Regulation (EU) 2017/1939	Sets EPPO’s structure, jurisdiction and procedures	Defines investigations, referrals, cooperation and procedural safeguards
PIF Directive (EU) 2017/1371	Harmonises offences and sanctions protecting EU finances	Identifies fraud, corruption, misappropriation and related criminal exposure
National criminal and procedural law	Governs many investigative and trial measures	Determines how searches, interviews, evidence and court proceedings operate
EU Charter of Fundamental Rights	Protects fair trial, privacy, defence and property rights	Limits enforcement powers and supports judicial review
OLAF, Eurojust and Europol	Provide administrative, judicial or law-enforcement cooperation	May share information or support investigations without replacing EPPO

Procedural safeguards and judicial oversight

EPPO’s authority is limited by fundamental rights protected under the EU Charter of Fundamental Rights, the European Convention on Human Rights and national constitutional law. Relevant protections include the presumption of innocence, the right to a fair trial, respect for private and family life, protection of personal data, the right to an effective remedy and the right to legal assistance.

The regulation requires investigative measures to be necessary and proportionate. Some measures require prior judicial authorisation under national law. The precise allocation between prosecutors and courts differs by Member State, which means that businesses may encounter different procedures when an investigation concerns offices, data, employees or assets in several jurisdictions.

Judicial review is generally carried out by national courts because EPPO prosecutes before national judicial authorities. A person affected by an investigative measure may challenge it under the relevant domestic procedure. National courts can also refer questions of EU law to the Court of Justice of the European Union. The Court of Justice has a role in interpreting the EPPO Regulation and resolving certain disputes involving competence or institutional responsibilities.

Defence rights apply to legal and natural persons investigated by EPPO. Companies may need prompt access to criminal defence counsel, specialist forensic accountants and data-protection advisers. Internal investigations should be carefully designed so that evidence is preserved without compromising privilege, employee rights or the integrity of the official investigation.

Corporate exposure and compliance duties

A company may become involved in an EPPO matter as a suspect, a beneficiary of EU funds, a contracting party, a victim or a source of evidence. Corporate exposure often arises through inaccurate grant applications, inflated invoices, undisclosed conflicts of interest, manipulated procurement procedures, kickbacks paid through intermediaries or the diversion of project assets.

The PIF Directive requires Member States to provide effective, proportionate and dissuasive penalties for relevant offences. The available sanctions may include imprisonment for individuals, fines, exclusion from public benefits or tenders, disqualification from commercial activities, dissolution, closure of establishments and confiscation. The precise rules on corporate criminal liability and penalties remain largely dependent on national law.

A compliance programme should therefore extend beyond ordinary anti-bribery controls. It should address EU grant conditions, procurement integrity, beneficial ownership, subcontractor screening, books and records, conflicts of interest and the use of public money. Controls should be proportionate to the risk and supported by documentation showing how decisions were made.

Businesses managing EU-funded projects should retain contracts, invoices, timesheets, delivery records, tender documents, approval trails and communications with public authorities. Records should be sufficiently organised to demonstrate that expenditure was genuine, eligible and properly authorised. Weak documentation can create suspicion even where the underlying work was performed.

The contact team can help organisations locate further anti-corruption and compliance resources when they are developing risk assessments or reviewing controls connected with public funding.

Cooperation with other enforcement bodies

EPPO does not operate in isolation. The European Anti-Fraud Office (OLAF) conducts administrative investigations into irregularities and fraud affecting the EU budget. Once EPPO has opened a criminal investigation, OLAF generally avoids duplicating the same criminal inquiry, but it may continue complementary administrative work or provide information and analytical support.

Eurojust supports judicial cooperation between national authorities, while Europol assists with intelligence, operational analysis and law-enforcement coordination. National police, customs administrations, tax authorities, audit bodies and managing authorities for EU programmes may all contribute information. The division of responsibilities depends on the facts, the stage of the matter and the legal nature of the conduct.

Cooperation rules also affect evidence and information sharing. Cross-border investigations may involve the European Investigation Order, mutual legal assistance arrangements, asset-freezing mechanisms and national rules on electronic evidence. Data transfers must comply with applicable privacy requirements, including the EU General Data Protection Regulation where personal data is processed in a commercial setting.

The boundary between administrative irregularity and criminal conduct can be important. A mistake in a funding application may be corrected through financial recovery or an administrative penalty, while intentional deception, bribery or concealment may lead to criminal prosecution. Companies should not assume that repayment of funds automatically resolves possible criminal liability.

Practical compliance priorities for businesses

An effective response to EPPO-related risk begins with mapping where EU money enters the business and who controls it. The review should cover direct grants, consortium arrangements, public procurement, distributors, consultants, subcontractors and agents. Particular attention is warranted where several jurisdictions, complex ownership structures or politically exposed persons are involved.

Policies should explain how employees report suspected fraud, conflicts of interest and improper payments. Training should cover the difference between legitimate facilitation of a project and conduct that could amount to bribery or misappropriation. Whistleblowing channels should be accessible, confidential and protected against retaliation.

Useful priorities include:

• Verify the eligibility, purpose and supporting evidence for EU-funded expenditure.
• Conduct risk-based due diligence on intermediaries, consortium partners and subcontractors.
• Separate approval, payment and verification responsibilities for grant-related transactions.
• Preserve financial records, communications and procurement documents in an auditable format.
• Establish a response protocol for dawn raids, information requests and contact with investigators.

When an investigation begins, employees should be instructed not to destroy, alter or conceal records. Legal counsel should coordinate document preservation, interviews and communications with authorities. A company must also avoid obstructing access to evidence or attempting to influence witnesses, since obstruction can create additional legal exposure.

Businesses should consult the legal disclaimer when using external compliance materials and should obtain advice tailored to the Member States, funding arrangements and facts involved. General information cannot replace advice from qualified counsel familiar with criminal procedure and EU financial rules.

EPPO’s framework makes financial integrity a board-level issue for organisations connected with EU programmes. Companies that integrate anti-fraud controls into procurement, accounting, third-party management and project governance are better positioned to detect problems early and respond lawfully when concerns arise. Review the relevant EU and national requirements, document your controls and use trusted anti-corruption resources to strengthen compliance before an investigation tests them.