How to Conduct an Employee Fraud Investigation in Belgium (2026): Privacy, Evidence and When to File a Criminal Complaint

Employee fraud investigation Belgium is now a sharper discipline than it was even a few years ago, because Belgium has been phasing in a reformed Criminal Code that changes how economic and financial crime is defined and how corporate liability is assessed, while the Code of Criminal Procedure continues to govern how evidence is treated once a matter escalates to prosecutors. For HR directors, CFOs, in-house counsel and compliance leads, that shift raises the stakes on every decision made in the first hours after a suspicion surfaces.

This guide sets out a defensible, step-by-step playbook: when to open an internal enquiry, how to preserve evidence, where privacy law limits employee monitoring, and the three tests that determine whether to file a criminal complaint. It is written for practical use, not academic completeness, and it situates each step within Belgium’s statutory and regulatory framework.

Quick summary: what this guide covers and why the reformed Criminal Code matters

Belgium’s reform of its Criminal Code modernises the definitions and procedures that govern economic and financial offences and recalibrates corporate liability. For employers, that means the groundwork you lay during an internal enquiry, how you preserve data, document decisions and respect employee rights, directly affects whether evidence survives scrutiny if the matter reaches a prosecutor. A well-run employee fraud investigation Belgium process protects the organisation on two fronts at once: it supports a sound disciplinary outcome and keeps a credible criminal referral on the table. This article maps the entire lifecycle, from the first red flag to post-investigation remediation, and flags the privacy and admissibility pitfalls that most often undermine otherwise strong cases.

Quick definitions

Employee fraud covers dishonest conduct by a worker that causes loss or unjust enrichment, expense manipulation, false invoicing, kickbacks, misappropriation of assets, and corporate theft. White-collar crime is the broader category of non-violent, financially motivated offences committed in a commercial or professional context, including fraud, embezzlement, bribery and money laundering. Both can give rise to parallel civil, disciplinary and criminal consequences in Belgium.

What the reformed Criminal Code means, practical implications for employers

The reform of the Belgian Criminal Code, published through the Belgian Official Gazette (Moniteur belge / Belgisch Staatsblad) and explained in materials from the Federal Public Service (FPS) Justice, overhauls the general part of criminal law and modernises the treatment of economic and financial offences. For employers, the headline point is procedural: the clearer the definition of an offence and the firmer the framework for corporate liability, the more important it becomes to build an internal record that aligns with how prosecutors and courts will later assess the facts. An employee fraud investigation Belgium conducted without reference to the current framework risks producing material that is disciplinarily useful but criminally weak.

Because the reform is being introduced in phases, employers should confirm which provisions are in force at the relevant time with FPS Justice or qualified counsel.

Criminal, civil and regulatory routes, a short primer

A single episode of employee fraud can trigger several parallel tracks. The criminal route involves the public prosecutor (procureur du Roi / procureur des Konings) and, potentially, an investigating judge (juge d’instruction / onderzoeksrechter), and aims at punishment and deterrence; the standard of proof is high and the state controls the process once a complaint is filed. The civil route lets the employer recover losses, through damages or a civil claim attached to criminal proceedings (constitution de partie civile), and the disciplinary route governs the employment relationship, up to and including dismissal for serious cause. A regulatory dimension may arise where supervised activities or reporting duties are implicated.

These routes are not mutually exclusive, and the sequencing decisions you make early, particularly on evidence and disclosure, affect all of them. Counsel should map the available routes at the outset rather than defaulting to one.

Key statutory changes employers must know

• Modernised offence definitions. The reform recasts the general part of criminal law and refines how economic and financial offences are categorised, which affects how an employer frames conduct in any referral. See the Official Gazette text via e-Justice and the overview materials from FPS Justice.
• Corporate liability framework. The treatment of legal-person liability and the related sanctions regime is a central theme of the reform, making it essential that companies document their own compliance posture during an investigation.
• Evidentiary and procedural emphasis. Because admissibility of evidence remains governed by the Code of Criminal Procedure, Belgian case law and fundamental-rights jurisprudence, the practical value of the reform for employers lies in aligning internal evidence-gathering with those standards from day one.

Triggers: when to investigate internally versus wait

Not every anomaly justifies a full enquiry, but under-reacting is the more common and more damaging error. Treat the following as red flags warranting at least a triage review: unexplained variances in reconciliations, duplicate or round-sum invoices, a vendor address matching an employee’s, overrides of control limits, reluctance to take leave, lifestyle inconsistent with salary, and whistleblower reports. Run three triage questions before committing resources: is the suspicion specific and evidenced rather than speculative; could the conduct amount to a criminal offence or only a policy breach; and is there a live risk of ongoing loss or evidence destruction?

Classify the matter as low, medium or high risk, and reserve the full internal investigation Belgium workflow for medium and high cases.

Immediate steps on suspicion

Before anyone is confronted, protect the evidence and the organisation. Issue a legal hold to suspend routine deletion of relevant data; restrict the suspect’s access to systems and physical areas where loss could continue, documenting the business rationale; and keep disclosure to the smallest possible circle. Avoid tipping off the subject, and do not begin interviewing or deleting anything. Record each early decision with a timestamp and the reason, because this contemporaneous log later demonstrates that the employee fraud investigation Belgium process was proportionate and lawful. Engage counsel at this stage so that privilege can attach to the right workstreams.

How to run an internal investigation, a 10-step playbook

The following sequence turns a suspicion into a defensible outcome. It is deliberately conservative: every step is designed so that the resulting material stands up in a disciplinary hearing, a civil claim and, if needed, a criminal file.

Step 1, Assemble the team

Build a small, senior team: external counsel to direct the enquiry and preserve privilege, a compliance or internal audit lead, IT or information security for data handling, and, where financial analysis is central, a forensic accountant. Keep HR informed but ringfenced so that employment decisions remain distinct from the fact-finding. Agree reporting lines to an executive sponsor who is not implicated. A clear team charter prevents the common failure of multiple people acting without coordination.

Step 2, Define scope and terms of reference

Write terms of reference that state the allegations, the period under review, the systems and custodians in scope, the legal questions to be answered, and the deliverables. A defined scope protects against both over-collection, which creates privacy risk, and under-collection, which leaves gaps. Revisit and amend the scope in writing if the facts expand; an undocumented scope creep is a frequent source of later challenge.

Step 3, Preservation orders, legal holds and IT measures

Convert the initial hold into a formal, documented preservation programme. Identify custodians and data sources, email, file shares, finance and ERP systems, badge and CCTV logs, mobile devices, and backups, and suspend automatic deletion and overwrite cycles. Record who imposed the hold, when, and over what. Where you take forensic images, do so using write-blocking and hashing so the integrity of the copy can be verified later. Preservation failures, such as logs that roll over because no hold was placed, are among the most damaging errors because they are irreversible. Treat preservation as the single most time-critical task in any employee fraud investigation Belgium matter.

Step 4, Collecting electronic evidence

Collect only data within scope, and document each acquisition: source, date, method, custodian and hash value. Favour forensically sound collection over ad hoc copying, because chain of custody, an unbroken, documented record of who held the evidence and when, is what makes material credible. For remote or personal devices, tread carefully: collection must have a lawful basis and respect proportionality. Where company policy and law permit access to work accounts, keep personal and private content strictly segregated. Over-collection not only breaches data-minimisation principles under the GDPR but can taint the admissibility of the lawful material around it.

Step 5, Conduct interviews

Plan interviews once the documentary picture is clear, moving from witnesses toward the subject. Prepare a question plan grounded in the evidence, keep accurate contemporaneous notes, and have two interviewers present. Respect language rights by conducting the interview in a language the employee understands and offering interpretation where needed. Avoid anything that could be characterised as coercion, threats or improper inducement, since pressure undermines both the reliability of the account and its usability. Explain the purpose, keep a record the employee can review, and never promise outcomes you cannot deliver.

Step 6, Forensic accounting and analysis

Where losses turn on transaction flows, engage a forensic accountant to quantify the loss, reconstruct the scheme and test control failures. Select a vendor on the strength of credentials, documented chain-of-custody procedures, and experience giving evidence. Define the analytical scope tightly so the work maps to the legal questions. Good forensic accounting Belgium work converts raw data into a narrative a prosecutor or judge can follow, which is often decisive.

Step 7, Drafting the investigation report and management briefing

Produce a factual, measured report: findings, the evidence supporting each finding, methodology, limitations, and open questions. Avoid conclusory language about guilt and let the evidence speak. Prepare a concise management briefing separately from the full report, and consider privilege carefully when deciding how widely to circulate either document.

Step 8, Decide on disciplinary measures and civil remedies

With findings in hand, assess disciplinary action and recovery. Dismissal for serious cause in Belgium carries a high evidentiary and procedural bar and strict timing once the facts are known, so coordinate the employment decision with the evidentiary record. In parallel, evaluate civil recovery, damages, restitution, or a civil claim joined to criminal proceedings, and secure assets where recovery risk is high.

Step 9, Decide whether to file a criminal complaint

Apply the three-test framework set out below: evidence sufficiency, corporate interest, and criminality threshold. This decision should be made deliberately by the executive sponsor on counsel’s advice, not reflexively, because filing transfers much of the control of the process to the public prosecutor.

Step 10, Post-investigation remediation and controls

Close the loop by fixing the control weaknesses the fraud exploited: segregation of duties, approval limits, vendor onboarding, and monitoring. Document remediation, because a demonstrable response strengthens the organisation’s position on corporate liability and reduces the risk of recurrence.

Employee monitoring, GDPR and admissibility of evidence in Belgium

Privacy law is where many employee fraud investigation Belgium efforts succeed or fail. Monitoring and data collection must comply with the GDPR and with the guidance of the Belgian Data Protection Authority, and evidence obtained through disproportionate or opaque monitoring can be excluded or weakened in later proceedings. European Court of Human Rights jurisprudence on Article 8 privacy and Article 6 fair-trial rights also informs how Belgian courts weigh evidence, so proportionality and transparency are not optional niceties.

Lawful bases and proportionality tests under GDPR

Processing employee data during an investigation needs a lawful basis under the GDPR, most often the employer’s legitimate interests, balanced against the employee’s rights, rather than consent, which is rarely freely given in an employment context. Each monitoring measure must satisfy proportionality: is it suitable to detect the suspected wrongdoing, is it the least intrusive option available, and is the intrusion justified by the seriousness of the suspicion? Transparency obligations generally require that employees are informed in advance about the monitoring that may occur. Document the balancing exercise contemporaneously; it is the record that later shows the measure was necessary and proportionate.

Using IT logs and CCTV: what’s admissible?

IT access logs, email metadata and, in some circumstances, email content can be lawful sources, provided employees were given adequate prior notice through a clear acceptable-use or monitoring policy and the access is proportionate to the suspicion. Monitoring of electronic communications in the workplace is further framed by collective labour agreements adopted within the National Labour Council. CCTV is more sensitive: covert surveillance is difficult to justify and is tightly constrained, and camera surveillance is itself regulated. Admissibility in Belgian proceedings turns on the legality of the collection, the integrity of the chain of custody, and respect for fundamental rights.

The Court of Cassation’s case law on unlawfully obtained evidence is the touchstone here, Belgian courts weigh several factors rather than applying automatic exclusion, which is why lawful collection and documentation matter as much as the content of what you find.

Consent issues and collective bargaining agreements

Consent is a fragile basis in the employment relationship because of the power imbalance, so do not build a monitoring programme on it. Instead, rely on properly documented policies, legitimate-interest assessments, and compliance with any applicable collective bargaining arrangements and information or consultation obligations toward employee representatives. Where those procedures are skipped, monitoring may be challenged regardless of the gravity of the underlying fraud.

Internal versus criminal investigation: objectives, powers and standards

Understanding the difference between what you can do internally and what the state can do once you file is essential to timing and strategy. The table below contrasts the two.

When to escalate: filing a criminal complaint in Belgium

Deciding whether to file a criminal complaint Belgium is a judgement call best made against three tests. First, evidence sufficiency: is there credible, lawfully obtained evidence that an offence occurred, with a reliable chain of custody? Second, corporate interest: weigh deterrence, recovery prospects and the organisation’s regulatory and reputational position against the loss of control and publicity that criminal proceedings bring. Third, criminality threshold: does the conduct plausibly meet the elements of a criminal offence rather than a mere policy breach? If all three are satisfied, a referral is usually appropriate; if evidence is weak or tainted, strengthen the file before filing.

Preparing the file for police or prosecutor

Present a clear, organised file: a factual narrative, a chronology, the key documents indexed and paginated, the forensic accounting analysis quantifying the loss, and a chain-of-custody record for each exhibit. Explain how evidence was collected and why that collection was lawful, since prosecutors will assess admissibility early. A disciplined report format, findings, supporting evidence, methodology and limitations, makes it far easier for authorities to act. You can address the complaint to the police or directly to the public prosecutor, and a victim can also consider a constitution de partie civile before an investigating judge; counsel will advise on the appropriate channel given the facts.

Privilege considerations and cooperating with prosecutors

Before sharing the investigation file, map what is protected by legal professional privilege and what is not, because voluntary disclosure can waive protection over related material. Decide deliberately which work product to hand over and which to withhold. Cooperation with prosecutors can benefit the organisation’s standing on corporate liability, but it should be managed so that cooperation does not inadvertently expose the company’s own legal analysis. Professional conduct rules of the Belgian Bars govern how lawyers handle privilege and internal investigations, and those rules should frame the disclosure strategy.

Dismissal for serious cause in Belgium: evidence threshold and procedural safeguards

Dismissal for serious cause in Belgium, termination for a serious shortcoming (motif grave / dringende reden) that makes continued professional collaboration immediately and definitively impossible, demands a high standard of proof and strict adherence to timing and procedure once the employer has sufficient knowledge of the relevant facts. Belgian employment law imposes tight statutory deadlines for invoking a serious cause and for notifying the grounds; confirm the current deadlines and formalities with counsel, as they are strictly applied by the labour courts. The evidence underpinning the dismissal must be solid and lawfully obtained; a dismissal built on tainted monitoring invites a successful challenge. Document the decision and its grounds and act within the applicable deadlines.

The principal risks are a finding that the cause was insufficiently serious or that procedure and timing were not respected, exposing the employer to indemnities. Coordinating the employment decision with counsel and with the investigation record is the best protection.

Checklists, evidence-preservation template and vendor selection

Practical tools keep an employee fraud investigation Belgium process disciplined under pressure. Use the following as starting points.

Evidence-preservation checklist:

1. Issue a written legal hold and suspend automatic deletion across relevant systems.
2. Identify custodians and data sources, including backups, logs and devices.
3. Take forensically sound images with write-blocking and record hash values.
4. Document source, date, method and custodian for each acquisition.
5. Store evidence securely with access logged and chain of custody maintained.

Interview checklist:

• Prepare a question plan grounded in the documentary evidence.
• Use two interviewers and keep accurate contemporaneous notes.
• Respect language rights and offer interpretation where needed.
• Avoid coercion, threats or improper inducements.
• Give the employee a record of the interview to review.

Vendor selection criteria for forensic accountants and investigators: relevant professional qualifications and references; documented chain-of-custody and data-handling procedures; GDPR-compliant processing arrangements; experience providing evidence in Belgian proceedings; and clear, defined scope and fee terms.

Short case examples and what went wrong

The following illustrative scenarios are composites used for teaching purposes rather than references to specific decided cases.

Scenario one, improper monitoring. A finance manager was suspected of false invoicing. The employer deployed covert, continuous email surveillance of the whole team without any policy or notice. The scheme was real, but the monitoring was disproportionate and opaque; the tainted collection weakened the evidence and exposed the company to a privacy challenge. The corrective lesson: run a proportionality assessment and rely on documented policies before monitoring.

Scenario two, destroyed logs. Suspecting procurement fraud, management confronted the employee before placing a legal hold. Access logs rolled over and backups were overwritten within days, erasing the clearest proof of unauthorised approvals. The irreversible loss forced reliance on weaker circumstantial evidence. The lesson: preserve first, confront later.

Key takeaways and immediate next steps for HR and in-house counsel

A successful employee fraud investigation Belgium process is built on speed in preservation, discipline in evidence handling, and strict respect for privacy and proportionality, all framed by the reformed Criminal Code and its sharper focus on corporate liability. Preserve evidence before you confront anyone, ground every monitoring step in a documented lawful basis, keep the investigation report factual, and apply the three-test framework deliberately before filing a criminal complaint. This guide is general information, not legal advice; given the stakes and the evolving law, have a Belgian-qualified lawyer review your approach before acting.

Sources

1. Belgian Federal Public Service Justice (FPS Justice)
2. Belgian e-Justice / Official Gazette (Moniteur belge / Belgisch Staatsblad)
3. Belgian Data Protection Authority (GBA / APD)
4. EUR-Lex, GDPR (Regulation (EU) 2016/679)
5. Belgian courts and jurisprudence (official portals)
6. European Court of Human Rights (ECHR)
7. OECD Anti-Corruption and Corporate Liability resources