Mandatory Reporting of Criminal Offences in Austria: Stpo §78 Duties (2026 Compliance Guide)

The mandatory reporting of criminal offences in Austria is governed primarily by §78 of the Code of Criminal Procedure (Strafprozessordnung, StPO), which imposes a statutory duty on public authorities and officials to notify the public prosecutor or police whenever they become aware of a suspected offence subject to public prosecution. For in-house counsel, compliance officers, and corporate directors operating in Austria, understanding exactly who is bound by this duty, and where the boundary falls for private entities, has become an increasingly urgent priority. Heightened enforcement activity in financial and anti-corruption crime throughout 2025 and 2026, combined with Austria’s whistleblower protection regime and strict data-protection rules, has complicated the practical decision of when and how to escalate a suspicion externally.

This guide sets out the legal framework, the actors who must (and need not) report, the practical channels available, and the exceptions and penalties that shape compliance strategy in 2026.

Key Takeaways

• StPO §78 binds public authorities and officials. These actors must report suspected offences subject to public prosecution (Offizialdelikte) to the public prosecutor or criminal police without undue delay.
• Private individuals and companies have no general statutory duty to report. They retain the right to file a criminal complaint (Anzeige) but are not obliged to do so under §78.
• Corporate directors face indirect exposure. Although not bound by §78 directly, failure to act on knowledge of criminality within the organisation can trigger corporate criminal liability under the Verbandsverantwortlichkeitsgesetz (VbVG) and personal liability for aiding or abetting.
• Lawyer-client privilege limits reporting. Defence counsel and legal advisors are generally protected by professional secrecy, but this protection does not extend to facilitating ongoing or future criminal conduct.
• Whistleblower protections apply in parallel. Austria’s transposition of the EU Whistleblower Directive (HinweisgeberInnenschutzgesetz, HSchG) requires larger employers to maintain internal reporting channels, which intersect directly with §78 obligations.
• Emergency reporting: Dial 112 (EU-wide emergency number) or 133 (Austrian police) for immediate threats. Non-emergency reports can be filed at any police station or directly with the competent public prosecutor’s office.

Legal Framework: Section 78 StPO Austria and Related Statutes

Text and Scope of StPO §78

Section 78 of the Austrian Strafprozessordnung (StPO) establishes the core reporting obligation in Austrian criminal procedure. In its current consolidated form, §78(1) provides that every public authority and every public official (Behörde and öffentliche Dienststelle) that becomes aware, in the course of its activities, of a suspected offence prosecutable by the state (von Amts wegen zu verfolgende strafbare Handlung) must report it to the criminal police or the public prosecutor. The statute is published in the Rechtsinformationssystem (RIS), the official Austrian legal information system maintained by the Federal Chancellery.

The provision is deliberately broad in its institutional reach: it captures all tiers of government, federal, state (Land), and municipal, together with independent regulatory bodies, courts acting in a non-adjudicative capacity, and entities exercising delegated public authority. The obligation arises the moment a reasonable suspicion of criminal conduct comes to the authority’s attention through its official functions. It does not require certainty of guilt or a completed investigation, only a factual basis sufficient to warrant further inquiry by the prosecuting authorities.

Related Rules and Institutional Actors

StPO §78 operates within a wider procedural architecture. Once a report is received, the public prosecutor (Staatsanwaltschaft) assumes the lead role in directing any investigation, issuing instructions to the criminal police (Kriminalpolizei) as needed. The Bundeskriminalamt (BKA), Austria’s federal criminal intelligence agency, coordinates specialised investigations, particularly in economic crime, organised crime, and corruption, and maintains reporting offices for complex cases.

The obligation under §78 does not exist in a vacuum. Two further legislative instruments are critical for corporate compliance teams. First, the Verbandsverantwortlichkeitsgesetz (VbVG), enacted in 2006, establishes corporate criminal liability for legal entities where an offence was committed by a decision-maker or where deficient organisational measures allowed an employee to offend. Self-reporting and cooperation with authorities are relevant factors in determining the level of sanctions under the VbVG. Second, the HinweisgeberInnenschutzgesetz (HSchG), Austria’s domestic transposition of EU Directive 2019/1937 on the protection of whistleblowers, requires companies with 50 or more employees to establish internal reporting channels and protects whistleblowers against retaliation.

The HSchG creates a parallel pathway for reporting misconduct that compliance teams must integrate with their understanding of the §78 framework.

Who Must Report: Mandatory Reporting of Criminal Offences in Austria by Entity Type

The practical question for most corporate readers is not the text of the statute itself but how it applies to their specific role. The duty to report crimes in Austria under StPO §78 attaches to a defined category of actors, while private persons and companies occupy a markedly different legal position. The comparison table below summarises the reporting obligation for each major category.

It is essential for corporate compliance officers to understand that even though private companies and their directors are not directly bound by §78, the absence of a statutory duty to report is not a shield against liability. The VbVG can attribute criminal conduct to the entity where management knew or should have known about offending and failed to take adequate organisational steps. In practice, many Austrian compliance frameworks therefore include voluntary external reporting protocols, particularly for suspected bribery, fraud, or market manipulation.

A further nuance affects entities that straddle the public-private divide, state-owned enterprises, utilities exercising regulatory functions, and contractors delivering public services under concession. Where such entities exercise powers delegated by a public authority, their staff may be treated as public officials for the purposes of §78, and the full reporting obligation applies.

What Must Be Reported, and When

Offences Subject to Public Prosecution

The reporting obligation under StPO §78 applies exclusively to offences that are subject to prosecution by the state (Offizialdelikte). These are criminal offences that the public prosecutor is required to investigate once they come to light, regardless of whether the victim files a complaint. The Austrian Criminal Code (Strafgesetzbuch, StGB) classifies the vast majority of serious crimes as Offizialdelikte, including murder, robbery, serious bodily harm, arson, bribery, fraud of significant value, embezzlement by public officials, money laundering, and terrorist financing.

Offences that are only prosecuted upon the victim’s request (Privatanklagedelikte and certain Ermächtigungsdelikte), such as minor insult or certain low-level property offences, fall outside the scope of §78. Public authorities encountering these offences in their work are not obliged to report them, though they may still do so if the victim consents.

Thresholds: Reasonable Suspicion Versus Knowledge

The statutory threshold for triggering the duty is the authority’s awareness of a suspicion, not proof or even high probability. The reporting obligation in Austria arises when the available facts give rise to a reasonable inference that a prosecutable offence may have been committed. Authorities are not expected to conduct a full investigation before reporting; indeed, §78 is designed to ensure that the public prosecutor receives information early enough to decide whether an investigation is warranted.

For corporate teams applying this logic by analogy to voluntary self-reporting, the practical benchmark is similar: once internal information crosses the threshold from rumour or speculation into concrete, articulable facts suggesting criminal conduct, escalation, at minimum to internal legal counsel, and potentially to external authorities, should be considered promptly.

How to Report to the Public Prosecutor in Austria, Channels and Practical Steps

Reporting a suspected criminal offence in Austria can be done through several channels, depending on urgency and the nature of the conduct.

• Emergency situations: Call 112 (EU-wide emergency number, which works throughout Austria) or 133 (Austrian police direct line). These are appropriate where there is an immediate threat to life, safety, or evidence destruction.
• Non-emergency reports: A criminal complaint (Anzeige) may be filed at any police station (Polizeiinspektion) in person. Reports can also be submitted directly to the competent public prosecutor’s office (Staatsanwaltschaft) in writing.
• Bundeskriminalamt (BKA) reporting offices: For complex or specialised cases, particularly economic crime, cybercrime, or corruption, the BKA maintains dedicated reporting offices and can be contacted through the Austrian Federal Ministry of the Interior’s online portal.
• Cross-border reporting: Where the suspected offence involves conduct in another country, Austrian police can coordinate through Interpol or Eurojust. The initial report should still be filed domestically, with cross-border elements noted for the public prosecutor’s assessment.

Six-Step Internal Escalation Checklist for Corporate Compliance Teams

Before making an external report, companies should follow a structured internal process to preserve evidence, manage privilege, and ensure coordinated action.

1. Identify and document the suspicion. Record the factual basis, who reported it, when, and what evidence exists. Preserve all electronic and physical records. Immediately suspend any routine data-deletion schedules that could destroy relevant material.
2. Notify internal legal counsel. Engage the company’s general counsel or compliance officer. If the suspicion involves senior management, escalate directly to the supervisory board or audit committee.
3. Appoint external criminal-law counsel. For any serious suspicion, particularly involving bribery, fraud, or market abuse, instruct experienced Austrian criminal-defence counsel to advise on privilege, reporting obligations, and cooperation strategy.
4. Assess the reporting obligation and timeline. With counsel, determine whether the company or any employee is bound by a specific reporting duty (§78, anti-money-laundering rules, sectoral regulations). Set a clear internal deadline for the reporting decision.
5. Prepare the external report. Draft the criminal complaint in coordination with counsel, ensuring it discloses the required facts without waiving privilege over internal legal analysis. File with the public prosecutor or police as appropriate.
6. Maintain records and cooperate. Log every step taken, including dates, attendees at internal meetings, and documents reviewed. Cooperating transparently with authorities after filing is a recognised mitigating factor under the VbVG.

Exceptions, Privilege, Data Protection, and Whistleblower Protection in Austria

Privilege and Internal Investigations

Lawyer-client privilege (Verschwiegenheitspflicht) is a fundamental right under Austrian procedural law. Communications between a lawyer acting in their professional capacity and their client are protected from seizure and cannot be compelled as evidence. However, privilege does not protect communications that are themselves part of, or further, criminal conduct. When an internal investigation uncovers potential criminality, any findings documented by in-house counsel may not enjoy the same level of protection as those prepared by external, independently instructed defence counsel. Companies conducting internal investigations should therefore engage external counsel at the earliest stage to maximise the scope of privilege.

Data Protection Considerations

Any reporting of suspected criminal conduct necessarily involves the processing of personal data, names of suspects, victims, and witnesses, along with potentially sensitive financial and communications data. Austria’s Federal Data Protection Act (Datenschutzgesetz, DSG), which supplements the EU General Data Protection Regulation (GDPR), applies to this processing. The lawful basis for processing personal data in the context of a criminal report will generally be either compliance with a legal obligation (Article 6(1)(c) GDPR, where a reporting duty exists) or the legitimate interests of the controller (Article 6(1)(f) GDPR, for voluntary reports). Companies should ensure that data processing is proportionate, limited to what is strictly necessary for the report, and that access to the data is restricted.

A formal data-protection impact assessment may be advisable in complex cases.

Whistleblower Protection

Austria’s HinweisgeberInnenschutzgesetz (HSchG) requires companies with 50 or more employees to establish secure internal reporting channels through which employees can report suspected breaches of certain EU and national laws, including criminal offences. Whistleblowers who use these channels, or, where internal reporting is ineffective, external channels such as the public prosecutor’s office, are protected against retaliation, including dismissal, demotion, and harassment. The HSchG does not create a duty to report for the individual whistleblower but establishes a protective framework that encourages reporting. For compliance teams, this means that the internal escalation process must be designed to interface with both the HSchG’s requirements and any voluntary or mandatory external reporting to the public prosecutor.

Readers should verify the current text of the HSchG, as amendments may refine employer obligations.

Penalties for Failure to Report, Enforcement Trends, and Corporate Risk Scenarios

The failure to report offence penalty in Austria operates differently for public officials and private actors. A public official who deliberately suppresses a §78 report may face disciplinary proceedings and, depending on the circumstances, criminal charges for aiding and abetting (Beitragstäterschaft) or abuse of official authority (Amtsmissbrauch, §302 StGB). For private companies, the risk is indirect but no less significant: where management awareness of criminality is established and no action was taken, the VbVG exposes the entity to fines calibrated to the seriousness of the underlying offence and the entity’s revenue.

Industry observers expect the enforcement environment in 2026 to remain intensely focused on economic crime and corruption. The European Commission’s Rule of Law Report for Austria has consistently noted the importance of robust enforcement of anti-corruption measures, and the OECD’s evaluation of Austria’s anti-bribery framework has emphasised the role of corporate compliance programmes and self-reporting in determining sanctions. The Austrian Wirtschafts- und Korruptionsstaatsanwaltschaft (WKStA), the specialised anti-corruption prosecutor’s office, has expanded its capacity and caseload in recent years, making proactive corporate cooperation increasingly valuable in practical terms.

Three Hypothetical Corporate Scenarios

• Scenario A, Public authority discovers bribery. A municipal building authority identifies irregularities in permit approvals suggesting payments to an official. Obligation: The authority must report under §78 without delay. The affected company should immediately engage external counsel, preserve all communications with the relevant official, and prepare for potential dawn-raid measures.
• Scenario B, Internal audit finds large-scale embezzlement. A company’s internal audit function uncovers systematic embezzlement by a senior finance manager. Obligation: No §78 duty applies to the private company. However, failing to act risks VbVG liability if prosecutors later establish that management knew and did nothing. Best practice: instruct external counsel, consider a voluntary self-report to the public prosecutor, and suspend the suspected employee pending investigation.
• Scenario C, Whistleblower alleges procurement fraud. An employee uses the company’s HSchG-compliant internal channel to report suspected bid-rigging. Obligation: The company must investigate the report through its internal channel, protect the whistleblower from retaliation, and, if the allegations are substantiated, consider external reporting. External counsel should assess whether competition-law leniency applications or criminal self-reports are advisable in parallel.

Conclusion, Practical Next Steps for Mandatory Reporting of Criminal Offences in Austria

The reporting obligation under StPO §78 is narrow in its direct application, binding public authorities and officials, not private companies or individuals, but its practical implications radiate far beyond that statutory perimeter. In 2026, the intersection of corporate criminal liability under the VbVG, whistleblower protections under the HSchG, and intensified enforcement by the WKStA means that every Austrian-based company should treat the question of when to escalate and report suspected criminality as a core compliance priority. Organisations should review their internal escalation procedures, ensure alignment with both whistleblower-channel obligations and data-protection requirements, and establish a standing relationship with experienced Austrian criminal-law counsel who can advise rapidly when suspicion arises.

The cost of a well-designed reporting framework is modest; the cost of getting caught without one is not. For guidance on criminal compliance matters in Austria, qualified specialists can provide tailored advice specific to your organisation’s structure and risk profile.

Sources

1. Bundeskriminalamt (BKA), Reporting Offices
2. Österreich.gv, Criminal Record Certificate (Strafregisterbescheinigung)
3. Austrian Federal Ministry of Justice (BMJ)
4. European Commission, Rule of Law Report: Country Chapter Austria (2025)
5. ICLG, Business Crime Laws and Regulations: Austria
6. CMS Expert Guide, Mandatory Reporting of Criminal Offences: Austria
7. Global Investigations Review
8. Austrian Federal Ministry of Finance, Data Protection