Bribery & Corruption Investigations in Finland 2026: What Boards and Executives Must Know

Last reviewed: 18 October 2026

Bribery investigations Finland now place governance failures, cross-border exposure and director accountability at the centre of corporate risk, and the shift that gathered pace through 2024–2026 means boards can no longer treat a corruption allegation as a purely legal or reputational matter to be delegated downward. When a credible allegation lands, whether through a whistleblower, a counterparty, an auditor or a foreign regulator, the first hours determine the trajectory of everything that follows, including whether the company controls the narrative or merely reacts to it. This pillar guide is written for Finnish boards, general counsel, chief compliance officers and senior executives who need a directive, jurisdiction-specific playbook rather than generalities.

It sets out the statutory framework, the investigative architecture, a timed response plan, the mechanics of running a defensible internal probe, and the realities of self-reporting and personal liability. Throughout, every legal statement is anchored to primary Finnish and international sources so that decisions taken under pressure rest on verifiable ground.

Who this is for: boards, general counsel, chief compliance officers, chairs and senior executives. Purpose: immediate, practical steps to respond to bribery allegations, limit corporate and director exposure, manage internal probes, and navigate disclosure to Finnish and foreign authorities. This article is explanatory guidance, not legal advice; obtain tailored counsel before acting.

Executive Summary: Immediate 10-Point Action Plan

In the first 24–72 hours after a credible allegation, speed must be matched by discipline. Acting too slowly destroys evidence and credibility; acting too loosely destroys confidentiality and invites regulatory criticism. The following sequence is the board-level checklist to initiate at once.

1. Secure and preserve evidence. Issue a legal hold and suspend routine deletion of emails, messaging apps, accounting records and device data before anyone is interviewed.
2. Appoint qualified external counsel. Instruct criminal counsel experienced in business crime to direct the investigation and establish confidentiality protections from the outset.
3. Convene the board or a special committee. Ring-fence decision-making from any executive who may be implicated.
4. Limit internal communications. Restrict discussion of the matter to a defined, need-to-know group and route sensitive material through counsel.
5. Assess the self-reporting question early. Determine whether voluntary disclosure to the police or prosecutor, or to a regulator, is appropriate, and preserve the option by acting quickly.
6. Identify regulatory triggers. Check obligations to the Financial Supervisory Authority (FIN-FSA) if the company is a regulated entity, and any sector-specific reporting duties.
7. Map cross-border exposure. Identify foreign subsidiaries, counterparties and jurisdictions whose authorities may claim competence.
8. Prepare a holding communications line. Agree who speaks, what is said, and what is embargoed, for internal, media and stakeholder audiences.
9. Consider governance measures. Evaluate whether suspension, delegation changes or interim controls are needed to protect the business and the investigation.
10. Document the decisions. Keep a contemporaneous record of what the board knew and did, this record is often the board’s strongest defence later.

On cost and resourcing (a common first question): legal fees for business-crime work in Finland vary widely with complexity, the volume of electronic evidence and whether forensic accountants are required. Senior criminal and investigations counsel typically work on hourly rates or capped-fee arrangements, with forensic and eDiscovery vendors billed separately. Boards should agree a scope, an initial budget and a reporting cadence at instruction, and should resist under-resourcing the early phase, the first weeks are where cost discipline and legal protection are both won or lost. For selecting the right adviser, see Choose a criminal lawyer in Finland, checklist.

Why 2026 Is Different: Enforcement Trends and What Boards Must Know

The character of bribery investigations Finland has handled over the past three years has changed. The emphasis has moved from isolated individual wrongdoing toward the systemic, how boards govern, how compliance controls actually function, and how companies behave once something goes wrong. For directors, this means the question is no longer only “who paid the bribe?” but “what did the governance system do, or fail to do, to prevent it?”

Recent Enforcement Signals (2024–2026)

Finland is a long-standing party to the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions and to the United Nations Convention against Corruption, and both frameworks continue to shape national enforcement priorities, including scrutiny of foreign bribery by Finnish companies operating abroad. The National Prosecution Authority (Syyttäjälaitos), led by the Prosecutor General, sets prosecutorial policy and evaluates how companies respond to wrongdoing, including the weight given to remedial measures and cooperation. For regulated firms, FIN-FSA has made clear that governance, controls and reporting are supervisory priorities, meaning a corruption issue inside a regulated entity can become both a criminal matter and a supervisory one in parallel.

Implications for Boards and Executives

The practical effect is that boards are judged on preparedness and response. Industry observers expect continued focus on the adequacy of compliance programmes, the independence of internal investigations and the speed of remediation. A company that can demonstrate a functioning anti-bribery system, a prompt and credible internal response, and genuine cooperation is in a materially stronger position than one that cannot, regardless of the underlying conduct. The lesson for 2026 is that governance quality matters both to how conduct is judged and to how remediation is assessed.

On the broader question of how Finland deals with crime: Finland operates a prosecution-led model in which the police investigate, prosecutors direct charging decisions and the courts adjudicate. Serious economic crime, including corruption, is typically handled by specialist investigators within the police, with prosecutors involved in steering complex cases. This structure means a corporate bribery matter can move between investigative, prosecutorial and judicial phases, each with distinct powers and risks for the company and its officers.

The Legal Framework for Bribery in Finland

Finnish bribery law is set out primarily in the Criminal Code (Rikoslaki). The Code criminalises both the giving and the accepting of bribes, distinguishes public-sector from certain private-sector conduct, and reaches foreign bribery committed by Finnish persons and companies. Boards should understand that the Code addresses the conduct of individuals and, through corporate criminal liability, the exposure of the company itself.

Key Offences and Penalties (Domestic and Foreign Bribery)

The Criminal Code separates ordinary offences from aggravated ones, with penalties scaling according to the seriousness of the conduct, the value involved and the breach of trust. Foreign bribery is addressed so that bribing a foreign public official is treated as a criminal offence, reflecting Finland’s OECD Convention obligations. The table below summarises the structure at a high level; the precise statutory text and penalty ranges are set out in the Finlex translation of the Criminal Code and should be consulted directly.

Penalty ranges are indicative; consult the Finlex translation of the Criminal Code for the exact statutory wording and maxima before relying on them.

Corporate Criminal Liability, Tests and Precedents

Corporate bribery in Finland is reachable not only through individual prosecutions but through the company’s own criminal liability. In broad terms, a company can be liable where an offence is committed in its operations and the conduct reflects a failure in the organisation, for example, where management failed to exercise required care and control, or where the company’s structures enabled or tolerated the wrongdoing. This is precisely why the 2026 enforcement emphasis on governance matters so much: the corporate fault inquiry looks at what the organisation did to prevent the offence.

For authoritative interpretation of how corporate fault is established, the case law of the Supreme Court of Finland (Korkein oikeus) should be consulted, and academic commentary from the University of Helsinki Faculty of Law provides useful analysis of the doctrine.

Administrative and Regulatory Enforcement

Criminal exposure is not the whole picture. Regulated entities answer to FIN-FSA, which supervises governance, internal controls and reporting, and can take supervisory action where failings emerge. Public procurement participation can also be affected, as corruption-related conduct may trigger exclusion consequences under procurement law. Boards should therefore treat a bribery allegation as potentially multi-track: criminal, supervisory and commercial consequences can all run at once, each on its own timetable.

Who Investigates and Prosecutes Bribery Investigations in Finland?

Understanding the investigative architecture lets a board anticipate what is coming and respond appropriately. Bribery investigations Finland conducts involve several bodies whose roles differ in powers and timing.

Finnish Investigative Agencies and Typical Process Timeline

The police, including specialist economic-crime units and the National Bureau of Investigation (Keskusrikospoliisi), carry out the criminal investigation, gathering evidence, conducting searches and interviewing suspects and witnesses. Prosecutors, within the National Prosecution Authority, direct and ultimately decide on charges and resolution. For cross-border movement of goods and funds, Finnish Customs may be engaged, and for regulated firms FIN-FSA may run a parallel supervisory process. Timelines vary considerably: a focused matter may conclude in months, while a complex, multi-party or cross-border corporate investigation can run for a year or more, driven by the volume of electronic evidence, the need for international cooperation and the number of individuals involved.

When Foreign Authorities Get Involved

Where conduct touches other jurisdictions, foreign subsidiaries, foreign public officials or cross-border payments, foreign authorities may assert competence and seek evidence through mutual legal assistance. Finland’s participation in the OECD and UNCAC frameworks supports international cooperation, and a Finnish company can find itself responding to Finnish and foreign investigators simultaneously. Early identification of this risk is essential, because statements or disclosures made in one jurisdiction can have consequences in another.

First 72 Hours: A Practical Playbook for Boards and Executives

The opening phase is where most lasting damage, and most lasting protection, is created. The playbook below allocates responsibility and sequences action so that evidence, confidentiality and governance are protected simultaneously.

Secure Documents and Data

Before any interview or informal inquiry, issue a written legal hold suspending deletion and auto-archiving across relevant systems, and preserve devices, messaging applications, accounting entries and access logs. The general counsel, working with IT and external forensic specialists, should document the preservation steps taken and when. Failure to preserve not only destroys evidence but can itself be read as an indicator of poor governance or, worse, concealment.

Messaging and Communications

Designate a single spokesperson and agree, with counsel, the holding line for internal staff, media and key stakeholders. Internal communications about the matter should be minimised and, where necessary, channelled through counsel to protect confidentiality. Loose internal emails speculating about culpability are among the most damaging documents an investigator can find.

Appoint Internal and External Counsel

Instruct experienced external criminal and investigations counsel to lead, and clarify the division between counsel advising the company and any counsel individuals may need in their personal capacity, conflicts between the company and implicated executives can arise early. The Finnish Bar Association’s rules of professional conduct govern an advocate’s duties and the handling of conflicts, and boards should ensure the engagement is structured to maintain independence and protect confidentiality. For guidance on selecting and briefing counsel, consult the criminal lawyer selection checklist.

Consider Suspension or Internal Governance Steps

Where a senior individual may be implicated, the board must weigh interim measures, suspension from duties, removal from decision-making over the investigation, or enhanced controls, balancing the protection of the business and the integrity of the probe against employment and fairness obligations. These decisions should be taken by a ring-fenced body and documented.

Cost and procurement note: fix scope, budget and reporting discipline at the outset. Expect senior counsel to bill hourly or under a capped arrangement, with forensic accountants and eDiscovery vendors as separate line items whose cost is driven by data volume. Agreeing a staged budget, triage, investigation, resolution, gives the board cost control without starving the critical early phase.

Running an Effective Internal Anti-Corruption Investigation

A well-run internal investigation is the board’s most powerful tool. It establishes the facts, enables informed decisions about self-reporting and remediation, and demonstrates good governance to prosecutors and regulators. A poorly run one compounds the problem, undermines confidentiality and can look like an attempt to manage rather than resolve.

Investigation Scope and Mandate

Begin with written terms of reference defining the scope, the questions to be answered, the reporting line (to the board or special committee, not to implicated management), the resources authorised and the timetable. A disciplined mandate keeps the investigation focused and defensible, and prevents scope creep that inflates cost and delay.

Evidence Preservation and ESI Collections

Electronically stored information, email, messaging, accounting systems, calendars and device data, is usually the core of a corruption investigation. Collection should follow a forensically sound, documented process that maintains chain of custody, because evidence gathered improperly can be challenged and its probative value diminished. Coordinate collection with the legal hold already in place to ensure nothing material is lost between preservation and collection.

Witness Interviews and Confidentiality

Interviews should be planned, conducted by counsel or under counsel’s direction, and recorded consistently. Interviewees should understand, where appropriate, that counsel acts for the company and not for them personally. On confidentiality, boards should be realistic: the protection attaching to internal investigation materials in Finland is limited, and material may be accessible to, or usable by, criminal authorities depending on the circumstances. Counsel bound by the Finnish Bar Association’s rules can advise on how to structure the work to maximise available protection, but no board should assume that labelling a document “confidential” guarantees it will stay out of a prosecutor’s hands.

Using Forensic Accountants and External Investigators

Complex payment flows, intermediary arrangements and off-book transactions often require forensic accounting expertise. Engaging these specialists through counsel helps align their work with the legal strategy and supports confidentiality. Conduct due diligence on any external investigator, and ensure data handling complies with privacy and data-transfer rules, particularly where information crosses borders.

Internal Investigation vs. State Criminal Investigation

Self-Reporting and Cooperation With Authorities: Risks and Benefits

Whether to self-report is among the most consequential decisions a board will make, and in many bribery investigations Finland sees, the quality and timing of cooperation can shape the outcome. Self-reporting is not automatically the right course, but it must be considered deliberately and early, because the option narrows as external discovery becomes likely.

How Authorities Evaluate Cooperation and Remedial Measures

Prosecutors and the courts can take into account a company’s conduct after wrongdoing is discovered, including the credibility of its internal investigation, the completeness of its disclosure and the seriousness of its remediation; such factors can bear on the assessment of corporate fault and the corporate fine. Genuine, proactive cooperation and effective remedial steps may count in mitigation; superficial or defensive engagement tends to have the opposite effect. Boards should treat remediation, fixing the control failures, disciplining those responsible and strengthening governance, as integral to any cooperation strategy, not an afterthought.

Timing and Content of Voluntary Disclosures

A disclosure made before authorities act independently generally carries more weight than one made under pressure. The content must be accurate and supported by the internal investigation’s findings; an incomplete or misleading disclosure is worse than none. Counsel should prepare the disclosure carefully, anticipating how it will be read by prosecutors and, where relevant, by foreign authorities.

Potential Obligations to Notify Foreign Authorities

Where foreign bribery or cross-border conduct is involved, disclosure to Finnish authorities may interact with obligations or expectations in other jurisdictions. A disclosure strategy must therefore be coordinated across all relevant jurisdictions to avoid inconsistent accounts and unintended waivers of protection.

Director and Board Liability: What to Expect

Directors face exposure on several fronts, and in the current environment board liability for bribery is a live risk that cannot be assumed away by reference to the company’s separate legal personality.

Criminal Exposure

Individual directors and officers can face criminal liability where they participated in, directed or culpably permitted the offence. The 2026 focus on governance failures means that inadequate oversight, not only active involvement, can be scrutinised where it amounts to the fault required by the Criminal Code. The precise intent and participation tests are matters of statutory interpretation and case law, and the Supreme Court of Finland’s judgments are the authoritative reference for how these are applied.

Civil Claims and Regulatory Sanctions

Beyond criminal exposure, directors may face civil claims for breach of their duty of care under the Companies Act (Osakeyhtiölaki), and, in regulated firms, supervisory consequences from FIN-FSA. These civil and regulatory tracks can proceed alongside or after any criminal process, extending the period of personal risk well beyond the criminal verdict.

Indemnity and Insurance: Pitfalls

Boards frequently over-rely on indemnification and directors’ and officers’ insurance. Both have limits: indemnity may be unavailable for deliberate wrongdoing, and D&O policies commonly exclude fraud and dishonesty, and may contain conduct exclusions and reporting conditions that are easily breached in a crisis. Directors should understand the terms of their cover before a crisis arises, confirm notification deadlines are met, and not assume that insurance will absorb personal exposure for serious corruption conduct.

Cross-Border Issues: Foreign Bribery and Multijurisdictional Investigations

For Finnish companies with international operations, foreign bribery is where the most serious exposure often lies. Multijurisdictional matters multiply the authorities involved, the legal regimes in play and the opportunities for inconsistent action.

Practical Steps When a Foreign Authority Contacts You

Treat contact from a foreign authority as a board-level event. Do not respond substantively before instructing counsel who can coordinate across jurisdictions. Mutual legal assistance arrangements allow authorities to seek and share evidence, so what is produced in one jurisdiction may travel to another. A coordinated response, consistent facts, controlled disclosure and aligned confidentiality positions, is essential to avoid creating problems in one forum while solving them in another. The OECD Anti-Bribery Convention and UNCAC frameworks underpin much of this cooperation and provide useful context for anticipating how authorities will act.

Data Transfer and Privacy Constraints

Moving evidence across borders implicates data protection and privacy rules, including the EU General Data Protection Regulation. Transferring employee and third-party personal data to foreign authorities or investigators must be handled lawfully, and getting this wrong can create a second compliance failure on top of the first. Build data-transfer analysis into the investigation plan from the start rather than confronting it when a production deadline looms.

Practical Templates and Checklists

Boards should have ready-to-deploy resources so that the first hours are executed, not improvised. The following assets support a disciplined response and are developed in detail in the supporting articles of this Finland anti-corruption cluster, including the planned guide How to Run an Internal Anti-Corruption Investigation in Finland and the planned Voluntary Disclosure & Cooperation with Authorities in Finland resource.

• 24–72 hour board action checklist. The 10-point plan converted into an operational sequence with owners.
• Evidence preservation notice. A template legal hold suspending deletion across relevant systems and custodians.
• Witness interview memo. A structured template capturing scope, the counsel-for-the-company caution and a consistent record.
• Self-reporting memo. A framework for assessing and documenting the decision to disclose, and for preparing the disclosure content.
• Cross-border coordination log. A record of jurisdictions, authorities, requests and disclosures to keep positions consistent.

Using Technology: eDiscovery, AI and ChatGPT in Investigations

Technology accelerates investigations but carries distinct risks. eDiscovery platforms and analytics help triage large volumes of electronic evidence efficiently, and AI tools can assist with early document review and summarisation. On the frequent question of whether ChatGPT or similar tools can act as a lawyer: they cannot. General-purpose AI can support triage and drafting, but it does not provide legal advice, is not bound by professional duties, and cannot assume responsibility for legal judgments. Feeding confidential material into consumer AI tools can also waive confidentiality and create data-protection exposure. Any technology used in an investigation should be deployed under counsel’s direction, with vendor due diligence, data-handling controls and confidentiality protections in place.

Conclusion: Prioritised Next Steps for Boards

Handling bribery investigations Finland now demands at board level comes down to preparedness, speed and discipline. The five actions to prioritise are: preserve evidence and impose a legal hold immediately; instruct experienced external criminal counsel to lead and protect confidentiality; convene a ring-fenced board committee to control decisions; assess the self-reporting and regulatory-notification questions at once while the option remains open; and map cross-border exposure before responding to any authority. Boards that treat corruption risk as a governance responsibility, resourcing the response, documenting their decisions and demonstrating genuine remediation, are far better placed to limit corporate and personal liability than those that react late.

Given the 2026 enforcement focus on governance quality, the strongest protection a board can build is the ability to show it did the right things, promptly and properly, when it mattered.

Sources

1. Finlex, English translation of the Criminal Code (Rikoslaki)
2. National Prosecution Authority (Syyttäjälaitos)
3. Finnish Police (Poliisi)
4. Finnish Bar Association (Suomen Asianajajaliitto)
5. Finanssivalvonta (Finnish Financial Supervisory Authority, FIN-FSA)
6. Supreme Court of Finland (Korkein oikeus)
7. OECD, Anti-Bribery Convention resources
8. United Nations Office on Drugs and Crime, UNCAC
9. University of Helsinki, Faculty of Law