Provisional text

JUDGMENT OF THE COURT (Fourth Chamber)

29 January 2026 (*)

( Reference for a preliminary ruling – Prevention of the use of the financial system for the purposes of money laundering or terrorist financing – Directive (EU) 2015/849 – Penalties – Article 58 – Liability of legal persons – Article 59 – Attribution to a legal person of an infringement of its obligations committed by natural persons – Conditions – Article 60 )

In Case C‑291/24,

REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesverwaltungsgericht (Federal Administrative Court, Austria), made by decision of 25 April 2024, received at the Court on 25 April 2024, in the proceedings

Steiermärkische Bank und Sparkassen AG,

KL,

Österreichische Finanzmarktaufsichtsbehörde (FMA),

THE COURT (Fourth Chamber),

composed of I. Jarukaitis, President of the Chamber, M. Condinanzi (Rapporteur) and N. Jääskinen, Judges,

Advocate General: T. Ćapeta,

Registrar: I. Illéssy, Administrator,

having regard to the written procedure and further to the hearing on 9 April 2025,

after considering the observations submitted on behalf of:

– Steiermärkische Bank und Sparkassen AG, KL and TR, by S. Ficulovič and B. Fletzberger, Rechtsanwälte,

– Österreichische Finanzmarktaufsichtsbehörde (FMA), by D. Wagner and P. Wanek, acting as Agents,

– the German Government, by J. Möller, acting as Agent,

– the European Commission, by A. Manzaneque Valverde and G. von Rintelen, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 3 July 2025,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 58(1) to (3), Article 59(1) and Article 60(5) and (6) of Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ 2015 L 141, p. 73), as amended by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 (OJ 2018 L 156, p. 43) (‘Directive 2015/849’).

2 The request has been made in the context of a dispute between Steiermärkische Bank und Sparkassen AG, KL and TR, on the one hand, and the Österreichische Finanzmarktaufsichtsbehörde (FMA) (the Financial Market Authority (FMA), Austria), on the other hand, concerning the legality of the decision by which the FMA imposed an administrative criminal penalty on Steiermärkische Bank und Sparkassen.

Legal context

European Union law

Directive 2015/849

3 Recitals 1 and 59 of Directive 2015/849 state:

‘(1) Flows of illicit money can damage the integrity, stability and reputation of the financial sector, and threaten the internal market of the [European] Union as well as international development. Money laundering, terrorism financing and organised crime remain significant problems which should be addressed at Union level. In addition to further developing the criminal law approach at Union level, targeted and proportionate prevention of the use of the financial system for the purposes of money laundering and terrorist financing is indispensable and can produce complementary results.

…

(59) The importance of combating money laundering and terrorist financing should result in Member States laying down effective, proportionate and dissuasive administrative sanctions and measures in national law for failure to respect the national provisions transposing this Directive. …’

4 Article 1(1) and (2) of that directive provides:

‘1. This Directive aims to prevent the use of the Union’s financial system for the purposes of money laundering and terrorist financing.

2. Member States shall ensure that money laundering and terrorist financing are prohibited.’

5 Article 2(1) of that directive provides:

‘This Directive shall apply to the following obliged entities:

(1) credit institutions;

(2) financial institutions;

(3) the following natural or legal persons acting in the exercise of their professional activities:

…’

6 Article 5 of that directive is worded as follows:

‘Member States may adopt or retain in force stricter provisions in the field covered by this Directive to prevent money laundering and terrorist financing, within the limits of Union law.’

7 Chapter VI of Directive 2015/849 entitled ‘Policies, Procedures and Supervision’, contains Section 4, entitled ‘Sanctions’, which includes Articles 58 to 62 of that directive. Article 58 provides, in paragraphs 1 to 3 thereof:

‘1. Member States shall ensure that obliged entities can be held liable for breaches of national provisions transposing this Directive in accordance with this Article and Articles 59 to 61. Any resulting sanction or measure shall be effective, proportionate and dissuasive.

2. Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on administrative sanctions and measures and ensure that their competent authorities may impose such sanctions and measures with respect to breaches of the national provisions transposing this Directive, and shall ensure that they are applied.

Member States may decide not to lay down rules for administrative sanctions or measures for breaches which are subject to criminal sanctions in their national law. In that case, Member States shall communicate to the [European] Commission the relevant criminal law provisions.

Member States shall further ensure that where their competent authorities identify breaches which are subject to criminal sanctions, they inform the law enforcement authorities in a timely manner.

3. Member States shall ensure that where obligations apply to legal persons in the event of a breach of national provisions transposing this Directive, sanctions and measures can be applied to the members of the management body and to other natural persons who under national law are responsible for the breach.’

8 Article 59 of that directive provides:

‘1. Member States shall ensure that this Article applies at least to breaches on the part of obliged entities that are serious, repeated, systematic, or a combination thereof, of the requirements laid down in:

(a) Articles 10 to 24 (customer due diligence);

(b) Articles 33, 34 and 35 (suspicious transaction reporting);

(d) Articles 45 and 46 (internal controls).

2. Member States shall ensure that in the cases referred to in paragraph 1, the administrative sanctions and measures that can be applied include at least the following:

(a) a public statement which identifies the natural or legal person and the nature of the breach;

(b) an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;

(d) a temporary ban against any person discharging managerial responsibilities in an obliged entity, or any other natural person, held responsible for the breach, from exercising managerial functions in obliged entities;

(e) maximum administrative pecuniary sanctions of at least twice the amount of the benefit derived from the breach where that benefit can be determined, or at least EUR 1 000 000.

3. Member States shall ensure that, by way of derogation from paragraph 2(e), where the obliged entity concerned is a credit institution or financial institution, the following sanctions can also be applied:

(a) in the case of a legal person, maximum administrative pecuniary sanctions of at least EUR 5 000 000 or 10% of the total annual turnover according to the latest available accounts approved by the management body …;

(b) in the case of a natural person, maximum administrative pecuniary sanctions of at least EUR 5 000 000, or in the Member States whose currency is not the euro, the corresponding value in the national currency on 25 June 2015.

4. Member States may empower competent authorities to impose additional types of administrative sanctions in addition to those referred to in points (a) to (d) of paragraph 2 or to impose administrative pecuniary sanctions exceeding the amounts referred to in point (e) of paragraph 2 and in paragraph 3.’

9 Article 60(5) and (6) of that directive is worded as follows:

‘5. Member States shall ensure that legal persons can be held liable for the breaches referred to in Article 59(1) committed for their benefit by any person, acting individually or as part of an organ of that legal person, and having a leading position within the legal person based on any of the following:

(a) power to represent the legal person;

(b) authority to take decisions on behalf of the legal person; or

6. Member States shall also ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 5 of this Article has made it possible to commit one of the breaches referred to in Article 59(1) for the benefit of that legal person by a person under its authority.’

Regulation (EU) 2016/679

10 Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), provides, in paragraph 2 thereof:

‘Each supervisory authority shall have all of the following corrective powers:

…

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

…’

11 Article 83(1) to (6) of that regulation provides:

‘1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:

…

3. If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.

4. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to [EUR] 10 000 000, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher:

…

5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to [EUR] 20 000 000, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:

…

6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to [EUR] 20 000 000, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.’

Austrian law

12 Paragraph 34 of the Finanzmarkt-Geldwäschegesetz (Law on financial markets anti-money laundering) of 26 July 2017 (BGBl. I, No 118/2016), in the version of 28 May 2021 (BGBl. I, No 17/2018) (‘the Law on anti-money laundering’) provides:

‘(1) Any person who, as the person responsible [Paragraph 9 of the Verwaltungsstrafgesetz (Law on administrative penalties; “the Law on administrative penalties”)] for an obliged entity, fails to comply with the obligations set out in:

…

2. Paragraphs 5 to 12 (customer due diligence) …;

…

8. Paragraph 23(1) to (3) or (6) (internal organisation);

…

commits an administrative offence and shall be liable to pay a fine imposed by the FMA of up to EUR 150 000.

(2) Where the failure to comply with the obligations referred to in subparagraph 1(2) … are serious, repeated, systematic or a combination thereof, the amount of the fine shall be up to EUR 5 000 000 or up to twice the benefit derived from the failure to comply with obligations, where that benefit can be determined.

(3) Any person who, as the person responsible (Paragraph 9 of the Law on administrative penalties) for an obliged entity,

1. fails repeatedly or systematically to include the required information on the payer or the payee, in breach of Articles 4 to 6 of Regulation (EU) 2015/847 [of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006 (OJ 2015 L 141, p. 1)];

2. does not ensure that records are retained in accordance with Article 16 of Regulation [2015/847], where this constitutes a repeated, systematic and serious failure;

3. fails to implement effective risk-based procedures, in breach of Articles 8 or 12 of Regulation [2015/847], or

4. where the obliged entity is an intermediary payment service provider pursuant to Article 3(5), seriously fails to comply with Article 11 or 12 of Regulation [2015/847],

commits an administrative offence and shall be penalised by a fine imposed by the FMA of up to EUR 5 000 000 or up to twice the benefit derived from the failure to comply with the obligation, where that benefit can be determined.

…’

13 Paragraph 35 of the Law on anti-money laundering provides:

‘(1) The FMA may impose fines on legal persons where a failure to comply with an obligation referred to in Paragraph 34(1) to (3) is committed for their benefit by any person, acting individually or as part of an organ of the legal person concerned, and holding a leading position within the legal person based on any of the following:

1. power to represent the legal person;

2. authority to take decisions on behalf of the legal person; or

3. authority to exercise control within the legal person.

(2) Legal persons may also be held liable for a failure to comply with the obligations referred to in Paragraph 34(1) to (3), where the lack of supervision or control by a person referred to in subparagraph 1 of the present Paragraph has made it possible not to comply with the obligations referred to in Paragraph 34(1) to (3) for the benefit of that legal person by a person acting on its behalf.

…’

14 Paragraph 36 of that law is worded as follows:

‘For the administrative offences set out in the present Federal Law, a time limit of three years shall be applied in place of the limitation period for proceedings (Paragraph 31(1) of the Law on administrative penalties). In such cases, the limitation period for penalties (Paragraph 31(2) of the Law on administrative penalties) shall be five years.’

The dispute in the main proceedings and the question referred for a preliminary ruling

15 By decision of 29 February 2024, pursuant to Paragraph 35(1) and (2) of the Law on anti-money laundering, the FMA imposed a penalty on Steiermärkische Bank und Sparkassen on the ground that it had failed to comply with its due diligence obligations in respect of money laundering.

16 Ruling on an action brought against that decision, the Bundesverwaltungsgericht (Federal Administrative Court, Austria), which is the referring court, classified it as a ‘criminal administrative law’ penalty and stated that the criminal liability of legal persons was foreign to Austrian ‘criminal administrative law’. According to that court, Paragraph 35(1) and (2) of the Law on anti-money laundering which, in essence, transposed into Austrian law the provisions of Article 59 and Article 60(5) and (6) of Directive 2015/849, constitutes one of the first provisions by which the criminal liability of legal persons was introduced into Austrian law.

17 However, Paragraph 35(1) of the Law on anti-money laundering introduced, as an additional condition for penalising a legal person, a ‘failure to comply with the obligations referred to in Paragraph 34(1) to (3)’ by a natural person for the benefit of that legal person.

18 KL and TR are the two natural persons whose acts are attributable to Steiermärkische Bank und Sparkassen. They are also parties to the main proceedings as accused persons.

19 The referring court states that, according to the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court, Austria), for a legal person to be penalised, it is necessary that (i) the natural person whose actions are to be attributed to that legal person has first been a party to the proceedings in question and treated in that context not merely as a witness but as an accused person, with all the rights attached to that status, (ii) the operative part of the decision imposing the penalty on the legal person finds that the duly identified natural person or legal representative of that legal person has committed an unlawful and culpable act constituting an offence, and (iii) in that operative part, that act is attributed to the legal person concerned.

20 The referring court asks whether those additional requirements restrict the scope of Article 60(5) of Directive 2015/849. The concerns raised by that court primarily arise from the fact that the ‘administrative sanctions and measures’ provided for in that directive must be ‘effective, proportionate and dissuasive’ in accordance with recital 59 and Article 58(1) thereof. In addition, while the proceedings concerned are complex and the underlying facts of those proceedings often opaque and therefore not known to the State, those proceedings are subject to a limitation period of five years from the date of the facts in question.

21 Lastly, that court states that the case-law resulting from the judgment of 5 December 2023, Deutsche Wohnen (C‑807/21, EU:C:2023:950) – in which the Court held that Article 58(2) and Article 83(1) to (6) of Regulation 2016/679 must be interpreted as precluding national legislation under which an administrative fine may be imposed on a legal person in its capacity as a controller in respect of an infringement referred to in Article 83(4) to (6) only in so far as that infringement has previously been attributed to an identified natural person – might be relevant for the purposes of resolving the dispute before it.

22 In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Does secondary EU law (in particular Article 60(5) and (6) in conjunction with Article 58(1) to (3) and Article 59(1) of [Directive 2015/849]), in addition to the general legal principles of the European Union (in particular [the principle of effectiveness])[,] preclude the provisions of Paragraph 35(1) to (3) (on the criminal liability of legal persons) and Paragraph 36 (extension of the limitation period) of the [Law on anti-money laundering], which, in conjunction with the interpretation of those provisions by the Austrian Verwaltungsgerichtshof (Supreme Administrative Court), require that, in order to punish a legal person, it is imperative that an official representative or another natural person who has acted for the legal person has previously been given the formal party status of defendant (while strictly safeguarding all party rights) and, in addition, it is imperative that the operative part of the administrative penal order against the legal person determines that the natural person specifically named therein (or the official representative) committed an offence, acted unlawfully and is culpable in order to attribute that conduct to the legal person as a further step, the limitation period for bringing proceedings being within a period of three years of the end of the offence and the limitation period for the punishment of offences within a period of five years?’

Consideration of the question referred

23 By its question, the referring court asks, in essence, whether Article 58(1) to (3), Article 59(1) and Article 60(5) and (6) of Directive 2015/849, read in the light of the principle of effectiveness, must be interpreted as precluding national legislation which:

– requires that, in order to penalise a legal person, a natural person has first been given the formal status of an accused person and that the operative part of the decision imposing a penalty on that legal person refers to that natural person by name and states that that person committed an unlawful and culpable act constituting an offence which is attributable to that legal person, and

– lays down a limitation period of three years for bringing proceedings and of five years for imposing a penalty, from the date that that offence came to an end.

Conditions for the liability of a legal person under Directive 2015/849

24 As regards the first part of the question referred, concerning the conditions for the liability of a legal person, it should be borne in mind, as a preliminary point, that the main aim of Directive 2015/849, as is apparent from its heading and Article 1(1) and (2), is the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. More specifically, the provisions of that directive seek to establish, taking a risk-based approach, a body of preventive and dissuasive measures to combat money laundering and terrorist financing effectively, in order to prevent, as is apparent from recital 1 of that directive, flows of illicit money from being able to damage the integrity, stability and reputation of the financial sector and threaten the internal market of the European Union as well as international development (judgment of 19 June 2025, Lietuvos bankas, C‑671/23, EU:C:2025:457, paragraph 35 and the case-law cited).

25 Pursuant to Article 2(1) of Directive 2015/849, that directive applies to entities referred to as ‘obliged entities’. In accordance with points 1 to 3 of Article 2(1), those entities are, respectively, credit institutions, financial institutions and the natural or legal persons referred to in point 3, acting in the exercise of their professional activities.

26 Thus, the obligations that Directive 2015/849 imposes on obliged entities fall on both legal persons and natural persons, in so far as those persons may be regarded as obliged entities, within the meaning of Article 2(1) of that directive.

27 As regards, more specifically, the penalties laid down in Article 59 of Directive 2015/849, which apply, under Article 59(1), at least to breaches on the part of obliged entities that are serious, repeated, systematic or a combination thereof, it should be noted that Article 58(1) of that directive requires Member States to ensure that the obliged entities can be held liable for breaches of national provisions transposing that directive.

28 There is nothing in Article 58(1) to indicate that the liability of an obliged entity under that directive, where that entity is a legal person, may depend on the liability of a natural person under national law.

29 Where the obliged entity is a legal person, since such a person may act only through the intermediary of natural persons whose acts are attributable to that legal person, Directive 2015/849 merely introduces rules to clarify the conditions under which (i) breaches which entail the liability of a legal person must also be attributable to the natural persons who are responsible for them under national law and (ii) acts of certain natural persons can result in the liability of a legal person.

30 Accordingly, first, under Article 58(3) of that directive, Member States are to ensure that where obligations apply to legal persons in the event of a breach of national provisions transposing that directive, sanctions and measures can be applied to the members of the management body and to other natural persons who under national law are responsible for that breach. It does not follow from that provision that the imposition of a penalty on a legal person as an obliged entity is subject to a previous finding that that breach in question was committed by a natural person. On the contrary, the liability of natural persons under national law, is only ancillary and additional to the liability of the legal person concerned under Directive 2015/849.

31 Second, under Article 60(5) and (6) of Directive 2015/849, Member States are to ensure that a legal person can be held liable both for the breaches committed for their benefit by any person, acting individually or as part of an organ of that legal person, and having a leading position within that legal person, and where the lack of supervision or control by such a person has made it possible to commit breaches for the benefit of that legal person by a person under its authority.

32 Article 60(5) and (6) merely refers, as the FMA and the Commission point out, to the natural persons whose acts or omissions, for the benefit of a legal person, may result in the liability of that legal person. However, it does not follow that the liability of those natural persons under national law must be incurred first and that those persons be identified in the operative part of the decision imposing a penalty on that legal person and identified as liable for the breach in question.

33 An interpretation of Articles 58 to 60 of Directive 2015/849 according to which the Member States may make the liability of a legal person subject to the prior finding that the breach was committed by a natural person would also be contrary to the requirement laid down in Article 58(1) of that directive that any sanction or measure resulting from the liability of obliged entities for breaches of national provisions transposing that directive are to be effective, proportionate and dissuasive. Such a requirement would risk weakening the effectiveness and the deterrent effect of penalties directly imposed by Directive 2015/849 on legal persons as obliged entities (see, by analogy, judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 51).

34 It must also be noted, first, that while that directive carries out only a minimum harmonisation (judgment of 18 April 2024, Citadeles nekustamie īpašumi, C‑22/23, EU:C:2024:327, paragraph 48 and the case-law cited), the Member States cannot, however, limit the scope of the liability that Article 58(1) of that directive imposes on those obliged entities, including legal persons.

35 In addition, as the Court has found, while Article 59 of Directive 2015/849 leaves to the Member States the choice to lay down penalties and measures other than those listed in Article 59(1), the fact remains that those Member States must at least apply penalties in respect of the infringements referred to in that provision, committed by obliged entities, by laying down at the very least the penalties and administrative measures set out in Article 59(2) and (3) (see, to that effect, judgment of 19 June 2025, Lietuvos bankas, C‑671/23, EU:C:2025:457, paragraph 37).

36 Second, since, as noted in paragraph 19 above, the referring court states that the conditions for the liability of legal persons under national rules transposing Directive 2015/849 result from the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court), it is important also to bear in mind that, according to the Court’s settled case-law, when national courts apply their domestic law they are bound to interpret it, so far as possible, in the light of the wording and purpose of the directive concerned in order to achieve the result sought by the directive and consequently comply with the third paragraph of Article 288 TFEU. This obligation to interpret national law in conformity with European Union law is inherent in the system of the Treaty on the Functioning of the European Union, since it permits national courts, for the matters within their jurisdiction, to ensure the full effectiveness of European Union law when they determine the disputes before them (judgment of 26 June 2025, Makeleio and Zougla, C‑555/23 and C‑556/23, EU:C:2025:484, paragraph 85 and the case-law cited).

37 The principle that national law must be interpreted in conformity with European Union law requires national courts to do whatever lies within their jurisdiction, taking the whole body of domestic law into consideration and applying the interpretative methods recognised by domestic law, with a view to ensuring that the directive in question is fully effective and achieving an outcome consistent with the objective pursued by it (judgment of 26 June 2025, Makeleio and Zougla, C‑555/23 and C‑556/23, EU:C:2025:484, paragraph 86 and the case-law cited).

38 In the present case, it is therefore for the referring court to interpret the relevant provisions of the Law on anti-money laundering in a manner consistent with Directive 2015/849.

Limitation periods

39 As regards the second part of the question referred, concerning the limitation periods set by national law, it must be borne in mind that, in the absence of rules of EU law, the Member States retain the right to apply the procedural rules provided for under their national legal system, in particular concerning limitation periods, subject to observance of the principles of equivalence and effectiveness (see, to that effect, judgment of 20 December 2017, Caterpillar Financial Services, C‑500/16, EU:C:2017:996, paragraph 37 and the case-law cited).

40 In order to determine whether the principle of equivalence has been complied with, it is therefore necessary to examine whether there exists, in addition to a limitation rule applicable to actions intended to ensure that the rights derived by individuals from EU law are safeguarded under domestic law, a limitation rule applicable to domestic actions and whether, having regard to their purpose and essential characteristics, the two limitation rules may be considered similar (judgment of 20 December 2017, Caterpillar Financial Services, C‑500/16, EU:C:2017:996, paragraph 38 and the case-law cited).

41 As regards the principle of effectiveness, it should be noted that the Member States are responsible for ensuring that the rights conferred by EU law are effectively protected in each case and that that principle requires, in particular, that the authorities of the Member States do not render practically impossible or excessively difficult the exercise of rights conferred by EU law (see, to that effect, judgment of 20 December 2017, Caterpillar Financial Services, C‑500/16, EU:C:2017:996, paragraph 41 and the case-law cited).

42 The Court has stated that it is compatible with EU law to lay down reasonable time limits for bringing proceedings in the interests of legal certainty. By way of example, limitation periods of three years and two years have been held to be compatible with the principle of effectiveness (see, to that effect, judgment of 20 December 2017, Caterpillar Financial Services, C‑500/16, EU:C:2017:996, paragraph 42 and the case-law cited).

43 Consequently, a limitation period of three years from the date that the alleged offence ended for the competent authorities to bring proceedings and a limitation period of five years from that date for the purposes of imposing a penalty, such as those at issue in the main proceedings, must, in principle, be regarded as compatible with EU law (see, to that effect, judgment of 13 July 2023, Napfény-Toll, C‑615/21, EU:C:2023:573, paragraph 37).

44 However, the file before the Court does not contain any information indicating that the limitation periods of three years and five years laid down in Paragraph 36 of the Law on anti-money laundering might not be compatible with the principle of equivalence and effectiveness.

45 In the light of the foregoing, the answer to the question referred is that Article 58(1) to (3), Article 59(1) and Article 60(5) and (6) of Directive 2015/849, read in the light of the principle of effectiveness, must be interpreted as:

– precluding national legislation which requires that, in order to penalise a legal person, a natural person has first been given the formal status of an accused person and that the operative part of the decision imposing a penalty on that legal person refers to that natural person by name and states that that person committed an unlawful and culpable act constituting an offence which is attributable to that legal person; and

– not precluding that legislation from laying down a limitation period of three years for bringing proceedings and of five years for imposing a penalty, from the date that the offence in question came to an end.

Costs

46 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Fourth Chamber) hereby rules:

Article 58(1) to (3), Article 59(1) and Article 60(5) and (6) of Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC, as amended by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018, read in the light of the principle of effectiveness,

must be interpreted as:

[Signatures]

* Language of the case: German.