{"id":7254,"date":"2026-05-05T12:05:21","date_gmt":"2026-05-05T11:05:21","guid":{"rendered":"https:\/\/pragal-rechtsanwaelte.de\/blog\/compliance-blog-9-criminal-due-diligence-in-ma-transactions-are-criminal-law-risks-a-deal-breaker\/"},"modified":"2026-10-22T14:30:55","modified_gmt":"2026-10-22T13:30:55","slug":"compliance-blog-9-criminal-due-diligence-in-ma-transactions-are-criminal-law-risks-a-deal-breaker","status":"publish","type":"post","link":"https:\/\/pragal-rechtsanwaelte.de\/en\/blog\/compliance-blog-9-criminal-due-diligence-in-ma-transactions-are-criminal-law-risks-a-deal-breaker\/","title":{"rendered":"Criminal Due Diligence in M&A Transactions \u2013 Are Criminal\u2011Law Risks a Deal Breaker? (Compliance Blog #9)"},"content":{"rendered":"\n

In M&A transactions<\/strong> \u2014 particularly in the context of an acquisition or merger<\/strong> \u2014 valuation, deal structure and financing typically take centre stage. By contrast, criminal\u2011law<\/strong> risks are often treated as peripheral or overlooked entirely, sometimes with severe consequences.<\/p>\n\n

Anyone acquiring a company assumes not only its opportunities but, as a rule, its risks as well. These include, in particular, legacy criminal\u2011law exposures<\/strong>, which often materialise only after completion of the transaction. <\/p>\n\n

Criminal due diligence<\/a><\/strong> closes this gap. It enables a targeted assessment of criminal\u2011law risks and thus provides an indispensable basis for legally robust and economically sustainable decision\u2011making. Against the backdrop of increasingly stringent supervisory and enforcement trends \u2014 for example in the areas of anti\u2011money\u2011laundering, sanctions, export controls and ESG regulation<\/strong> \u2014 its importance continues to grow. <\/p>\n\n

1. Legal Framework: Duties of Care and Liability Risks<\/h2>\n\n

The obligation to conduct an adequate criminal due diligence arises from the corporate duties of care <\/strong>owed by the management. Under section 93(1) AktG<\/a> and section 43(1) GmbHG<\/a>, decisions must be based on a sound and reliable information basis. <\/p>\n\n

In the context of M&A transactions, this necessarily includes the identification and assessment of criminal\u2011law risks. If such analysis is omitted, the decision may be deemed a breach of duty, potentially giving rise to personal liability<\/strong> for the individuals responsible. Depending on the governance structure, corresponding duties of review and oversight may also extend to supervisory board members or advisory board members, particularly where they hold approval authority over material corporate transactions.\u201d <\/p>\n\n

Within the scope of the Business Judgement Rule<\/a><\/strong>, it is essential not only that risks are identified, but also that they are assessed and documented in a transparent and traceable manner. Deficient M&A compliance<\/strong> may prevent board members from relying on this protection. The same applies where the connection to the existing compliance organisation and the compliance management system (CMS)<\/a> is missing, or where deficiencies in the CMS are not addressed despite an evident risk situation. <\/p>\n\n

Criminal due diligence is therefore not an optional review step but a component of proper corporate management<\/strong>. It is closely linked to the design of the CMS, which not only serves a preventive function but is also relevant in the context of investigations, particularly for the assessment of supervisory and sanctioning measures. <\/p>\n\n

2. Risk Landscape: Legacy Criminal\u2011Law Exposures in Corporate Acquisitions<\/h2>\n\n

Criminal\u2011law risks<\/strong> are rarely apparent on the surface. They are often embedded in business processes, entrenched organisational structures or the prevailing corporate culture<\/strong>, and they additionally require the trained eye of a criminal\u2011law and compliance specialist. For precisely this reason, they are frequently not adequately addressed in the course of a traditional M&A due diligence. <\/p>\n\n

The key risk areas include, in particular:<\/p>\n\n