What is a compliance officer?
A compliance officer organizes, on behalf of management, how the company complies with laws and internal rules: they identify compliance risks, set rules, train, monitor and report. Responsibility stays with management. The structure of rules, roles and controls they build is called a compliance management system.
The duty to organize a company so that legal violations are prevented follows from the directors' duty of care. For stock corporations it is set out in § 93(1) AktG, for limited liability companies in § 43(1) GmbHG. It is backed by fines through the supervisory duty under § 130(1) OWiG (Administrative Offences Act); the supervisory measures listed there expressly include appointing, carefully selecting and monitoring supervisory staff.
What are the duties of a compliance officer?
A compliance officer has eight core duties, from risk analysis to reporting. Scope and weight depend on industry, size and risk profile:
| Area | Content |
|---|---|
| Risk analysis | identify and assess compliance risks, such as corruption, antitrust, money laundering, sanctions, data protection, information security, supply chain |
| Rulebook | draft, agree and maintain the code of conduct and policies |
| Advice and training | advise business units and management, train staff by target group |
| Legal monitoring | track legal changes and translate them into obligations for the company |
| Whistleblowing system | depending on the setup, operate or oversee the internal reporting channel under the Hinweisgeberschutzgesetz (Whistleblower Protection Act) |
| Monitoring | plan controls, run samples, test whether measures are effective |
| Investigation | follow up suspicions, establish facts, propose consequences |
| Reporting | report to management and the supervisory body, at set intervals and as needed |
The compliance officer does not decide on business transactions; they advise, check, escalate and document. In the three lines model, the compliance function belongs to the second line, and internal audit, as the third line, also audits its work.
When is a compliance function required by law?
There is no general duty in Germany to appoint a compliance officer. A compliance function is expressly required in regulated industries:
| Area | Legal basis | What is required |
|---|---|---|
| Credit and financial services institutions | § 25a(1) KWG (no. 3(c)), specified in AT 4.4.2 MaRisk | an independent compliance function as part of the internal control system |
| Investment firms | § 80(1) WpHG with Article 22 of Delegated Regulation (EU) 2017/565 | a permanent, effective and independent compliance function; the management body appoints the compliance officer |
| Insurance undertakings | § 29(1) VAG | an internal control system with a function that monitors compliance with requirements |
| Certain obliged entities under the Money Laundering Act | § 7(1) GwG | a money laundering reporting officer at management level and a deputy; a specialist function, not a general compliance officer |
| All other companies | § 130 OWiG, § 93(1) AktG, § 43(1) GmbHG; for listed stock corporations also § 91(3) AktG | no duty to appoint; management's duty to organize remains |
Outside regulated industries, appointing a compliance officer is an organizational decision that is reviewed after a loss. According to the Federal Court of Justice (BGH), whether an effective compliance management system existed counts when a corporate fine under § 30 OWiG is set (judgment of May 9, 2017, 1 StR 265/16).
Is a compliance officer personally liable?
A compliance officer can be criminally liable for failing to prevent offenses committed from within the company. In its judgment of July 17, 2009 (5 StR 394/08), the BGH stated that officers entrusted with corporate compliance "regularly" bear a guarantor duty within the meaning of § 13(1) StGB (German Criminal Code). Anyone who has such a duty and does not intervene can be liable for an offense by omission, in the case decided for aiding and abetting fraud.
Two points limit the judgment. The defendant was not a compliance officer but headed the legal department and internal audit of a public-law institution; the statement on compliance officers therefore did not concern his own role. And what counts is the scope of duties the person actually took on, not the contract or the title alone.
Example: putting the scope of duties in writing
Because the scope of duties actually taken on is what counts, set it down in writing when you appoint the compliance officer and compare it with actual practice once a year.
Fictional example: appointment at a machinery manufacturer without regulated business. The terms are invented for illustration.
| Item | Terms |
|---|---|
| Scope of duties | anti-corruption, antitrust, export control and sanctions; data protection and information security sit with the data protection officer and the ISO |
| Powers | access to all records within the scope, right to information from all staff |
| Expressly not delegated | decisions on business transactions and approval of contracts |
| Reporting line | quarterly to management, annually to the advisory board |
| Escalation | directly to the chair of the advisory board if a member of management is involved |
| Deputy | head of legal |
| Review | annually and on every change to the scope of duties |
In the annual review, check whether the person has taken on tasks not listed, such as approving consultancy contracts. Then either change the written terms or hand the task back, because according to the BGH the guarantor duty can extend to any scope of duties actually taken on.
How do compliance officer, ISO and DPO differ?
Compliance officer, information security officer and data protection officer differ in subject matter and legal basis:
| Criterion | Compliance officer | Information security officer (ISO) | Data protection officer (DPO) |
|---|---|---|---|
| Subject | compliance with laws and internal rules as a whole | confidentiality, integrity and availability of information | protection of personal data under data protection law |
| Duty to appoint | in regulated industries (KWG, WpHG, VAG; GwG for the money laundering reporting officer) | no general legal duty | Article 37 GDPR and § 38 BDSG, for example where "as a rule at least 20 persons" are constantly involved in the automated processing of personal data (our translation) |
| Role | advises, monitors, investigates, reports | builds and runs the ISMS, coordinates risk analyses and measures | monitors and advises, contact point for the supervisory authority and data subjects |
| Special protection against dismissal | no general statutory protection | no general statutory protection | where designation is mandatory, under § 38(2) in conjunction with § 6(4) BDSG |
Combining roles has limits. Under Article 38(6) GDPR, the data protection officer may take on other tasks only if they cause no conflict of interest. That would be the case if they had to monitor processing they decide on themselves. If the ISO is also the compliance officer, they check compliance in their own area; provide for an independent review by internal audit or an external audit in that case. How the ISO role is set up is described in the guide ISMS implementation.
Compliance officer, compliance manager and chief compliance officer
None of the three titles is protected by law. A chief compliance officer heads the compliance function of a larger company or group and reports directly to the management board. The compliance officer runs the function in one company or division, and the compliance manager implements programs and controls operationally. In smaller companies one person can fill all three roles, including part-time or as an external service provider.