25 Years of the OECD Convention: Strengthening the Path from Anti-Bribery Law to Enforcement in Luxembourg
In this interview, Elifsu Yigit (L4T) and Nicola Bonucci—former OECD Director for Legal Affairs, independent counsel, Legal Advisor to ICCROM, and Chair of the European Space Agency Advisory Board—discuss Luxembourg’s 25-year journey under the OECD Anti-Bribery Convention. This conversation complements the background review of the Convention written by Elifsu Yigit. In the text below, the participants are identified as EY and NB, respectively.
EY: When the OECD Anti‑Bribery Convention was being negotiated in the 1990s, what was Luxembourg’s position?
NB: Honestly, I don’t clearly remember Luxembourg’s specific position. What I do recall is the stance of some key players – particularly France and Germany – and the broader mood among European countries.
Most European states were not enthusiastic. Many of them, I would say, “hid” behind France and Germany, which were the two big countries expressing doubts in the early stages. My presumption is that Luxembourg, like Switzerland, did not see itself as a main target of the convention at that time.
We also need to remember how different the 1990s looked. The focus was on what I would call “traditional” companies: large industrial exporters going abroad to build plants, open factories, and sell big-ticket goods – aircraft, infrastructure, and so on. There was much less focus on sophisticated financial centres or on the role of investors. Concepts like “responsible business conduct” were far less developed.
So I doubt Luxembourg saw foreign bribery as a top priority or a major risk for its own companies and financial sector in that period.
EY: How has Luxembourg’s approach evolved over the 25 years of monitoring under the OECD Working Group on Bribery?
NB: For a long time Luxembourg was, as I would put it, “below the radar” of the Working Group on Bribery. That was roughly true until the late 2000s.
With Phase 3 of monitoring, Luxembourg started to come more into focus, partly because the Working Group itself was becoming more sophisticated in how it examined countries. By Phase 4, which I re‑read recently, you can clearly see that:
- Luxembourg has improved its legal framework;
- But there are still major problems in implementation and enforcement.
So the story is: for many years little attention, then greater scrutiny, and now a fairly clear diagnosis – the law is more or less there, but practice is lagging badly.
EY: Where do you see the biggest remaining gaps or weaknesses in Luxembourg’s implementation of the convention?
NB: I would highlight three main areas.
First, sanctions. The level of sanctions for both natural and legal persons remains unsatisfactory in the view of the Working Group. In civil‑law systems, you usually cannot raise sanctions only for foreign bribery – you have to adjust the whole bribery regime, including domestic bribery. That raises constitutional and political issues, which makes reform more difficult, but it doesn’t remove the problem.
Second, the liability of legal persons – corporate liability. In practice, it is not entirely clear how effectively you can trigger the liability of a company. The 2021 OECD Recommendation, which revises the 2009 Recommendation, is important here. It contains detailed guidance on liability of legal persons and expects that you can investigate and prosecute companies when, for example:
- Senior management authorises or instructs the bribe;
- Senior management effectively condones it – they close their eyes, “play the three monkeys”;
- Or the company’s internal controls and compliance systems are so defective that this amounts to wilful blindness.
Those last two categories are particularly challenging for many continental European jurisdictions, including France and, I would say, Luxembourg.
Third, and most importantly, detection and enforcement. After 25 years, the main problem in Luxembourg is no longer the law “on the books”; it is the very low level of enforcement “in practice”.
Q: What specific enforcement and institutional constraints do small but sophisticated financial centres like Luxembourg face?
NB: Luxembourg is a small country. It is unrealistic to expect a large corps of foreign‑bribery investigators covering every corner of the world.
So rather than just asking, “How many public prosecutors are there?” I think the key question is: How well do all the relevant bodies cooperate and share information? In Luxembourg, that includes:
- The Financial Intelligence Unit (FIU);
- Tax inspectors and the Ministry of Finance;
- Financial market and other regulators;
- The Ministry of Foreign Affairs and, where applicable, embassies or partner embassies.
The real challenge is to ensure:
1. These bodies know how to detect indicators of corruption or foreign bribery;
2. They understand their role in the system;
3. They can share information efficiently with the prosecution authorities.
According to the Phase 4 report, the FIU, for example, does not appear to be a strong detector of possible foreign bribery cases. That raises questions: is it a problem of training and awareness? Or of legal constraints on what information can be shared?
In a small, sophisticated financial centre, you do not solve the problem just by adding more prosecutors. You solve it by making sure that all the “antennas” – FIU, tax, regulators, etc. – are properly tuned, and that information can flow effectively to law enforcement.
EY: You mentioned information‑sharing within Luxembourg. Is this more important than cross‑border cooperation?
NB: You cannot do effective cross‑border cooperation if you do not have the information in the first place.
So yes, the first priority is intra‑Luxembourg cooperation: how easily, and in practice, can different domestic authorities exchange information with each other?
For example:
- Are tax inspectors trained to recognise red flags of corruption when they audit companies? And if they spot something, can they report it to law enforcement?
- Has Luxembourg implemented the 2010 OECD recommendation that encourages countries to allow tax authorities to share information with other agencies in cases of serious crimes like money laundering and corruption? Is this reflected in Luxembourg’s bilateral tax treaties?
- Can the FIU share certain types of information with prosecutors or regulators? If not, why not?
The Phase 4 report contains some analysis, but I did not see a truly in‑depth examination of how this system works day‑to‑day in practice. For Luxembourg, that is more important than in many other countries, because the prosecutor’s office cannot realistically be proactive worldwide on its own.
EY: How should Luxembourg deal with the tension between confidentiality/banking secrecy and the transparency and cooperation requirements of the convention?
NB: You are right that this is a very real tension for Luxembourg and similar centres, and we’ve seen this in debates, including the European Court of Justice’s decisions on public beneficial ownership registries.
But we need to distinguish between:
- Confidentiality vis‑à‑vis the general public (for example, public company registries), and
- Confidentiality vis‑à‑vis competent authorities inside Luxembourg and abroad.
The convention’s requirements relate primarily to cooperation between authorities. There is no justification, in my view, for preventing information‑sharing:
- Between agencies within Luxembourg;
- Between law enforcement agencies across borders, especially within the EU, which already has its own frameworks for information exchange and mutual assistance.
So confidentiality and banking secrecy cannot be used as a blanket excuse to block cooperation among authorities. It is for Luxembourg to adjust its legislation – including tax‑confidentiality rules and others – to ensure that convention obligations are fully implemented, while still protecting legitimate privacy from the public at large.
EY: The EU is adopting a directive on combating corruption. How important is this for Luxembourg?
NB: I see the EU directive mainly as:
- An important political signal that corruption is now a clear area of EU competence; and
- A new layer of monitoring and scrutiny.
Luxembourg is already evaluated by:
- The OECD Working Group on Bribery, as a party to the Anti‑Bribery Convention;
- The Council of Europe’s GRECO;
- The UN Convention against Corruption.
On top of this, the European Commission will monitor implementation of the EU directive. So enforcement gaps will be seen and discussed in yet another forum.
Substantively, many of the offences in the directive likely already exist in the criminal codes of most EU states, including Luxembourg. So the real change is less about creating new crimes and more about increasing political pressure and oversight on how seriously corruption is addressed.
EY: What concrete priority actions should Luxembourg take now? If you had to name three?
NB: From the perspective of the OECD standards and the Phase 4 report, I would put it this way.
1. Upgrade sanctions
The level of sanctions for bribery – domestic and foreign – still appears too low to be considered effective, proportionate and dissuasive. This is the main remaining legislative gap. As I said, raising sanctions only for foreign bribery would be problematic; you probably need to adjust the whole bribery regime.
2. Massively improve detection and internal coordination
This is more important, in my view, than simply adding resources to the prosecutor’s office.
Luxembourg should:
- Systematically train and raise awareness among tax inspectors, FIU staff, financial regulators, and foreign‑affairs officials on corruption indicators and reporting channels.
- Ensure that legal and procedural frameworks allow information to flow from these bodies to prosecutors and, where relevant, to partners abroad.
- Review whether bilateral tax treaties and domestic rules fully reflect the 2010 OECD recommendation on information‑sharing for serious crimes.
3. Demonstrate proactiveness and political will
The Phase 4 report already tells Luxembourg what its weaknesses are: inadequate sanctions and very weak enforcement. The government should not wait for Phase 5.
It would be a strong signal if Luxembourg adopted a concrete action plan: with timelines and responsibilities for strengthening sanctions, training agencies, improving FIU performance on corruption, and testing information‑sharing mechanisms in practice.
If, after these measures, enforcement still remains weak, it becomes harder to argue that the problem is purely technical. But first you have to give the system all the tools; that in itself is a form of demonstrating political will.
EY: What role can civil society and NGOs play in accelerating implementation and monitoring progress in Luxembourg, especially given that it currently lacks strong anti‑corruption NGOs?
NB: It is true that in some countries you have specialised anti‑corruption NGOs – in France, for example, Anticor or Sherpa; in the UK, Spotlight on Corruption. But even there, their main focus is often domestic corruption rather than foreign bribery.
Luxembourg might not have a dedicated anti‑corruption NGO yet, but it does have other kinds of civil‑society organisations, particularly in the human rights and environmental fields. My experience is that these organisations often do not see corruption, even when it is right in front of them.
Take the example of forced labour or environmental destruction: an NGO will focus on the human‑rights or environmental harm, but may not ask whether corruption enabled those abuses.
So Luxembourg could:
- Train and raise awareness among existing NGOs about how corruption interacts with human‑rights and environmental violations.
- Encourage partnerships between Luxembourg‑based NGOs and NGOs in countries where Luxembourg companies operate. Local NGOs often have crucial on‑the‑ground information.
The other key element is to provide clear and accessible reporting channels. For example:
- A dedicated, well‑publicised hotline or online portal at the Ministry of Foreign Affairs or Ministry of Justice, where anyone – including foreign NGOs – can report suspicions of foreign bribery by Luxembourg companies or investors.
Without that, even well‑informed NGOs will struggle to know how to reach the right authority in Luxembourg.
EY: You mentioned the OECD Guidelines for Multinational Enterprises and the National Contact Point (NCP). How can these be used in corruption cases involving Luxembourg?
NB: The OECD Guidelines for Multinational Enterprises are a set of recommendations to companies from OECD governments on responsible business conduct. They cover areas like human rights, labour rights, environment, and, since the Anti‑Bribery Convention, corruption . The corruption chapter was expanded again in the 2023 revision.
Each adhering country must establish a National Contact Point (NCP) to handle “specific instances” – grievances about company behaviour in relation to the Guidelines.
So, for example:
- A civil‑society organisation in Mozambique that has concerns about a Luxembourg‑headquartered company allegedly involved in corruption in Mozambique can file a case with the Luxembourg NCP .
This is not a criminal proceeding; it is a soft‑law mechanism. But the evidentiary threshold is different: you don’t need a “smoking gun” as you would in criminal court. It can still be very useful for:
- Bringing issues to light;
- Facilitating dialogue and remediation;
- Generating information that may, in some circumstances, be relevant for law enforcement.
The key question, again, is whether the Luxembourg NCP is:
- Adequately trained to recognise and analyse possible corruption issues;
- Equipped to deal with them;
- And, where appropriate, able to signal relevant information to the authorities who can investigate.
So the NCP should be part of the broader detection ecosystem, not something isolated.
EY: Looking ahead to Phase 5 of OECD monitoring: what should Luxembourg expect and how should it prepare?
NB: Phase 5 is still under discussion in the Working Group on Bribery, so I do not know exactly what it will look like. Speaking in a personal capacity, I would say this:
- After almost 30 years of the convention, and four rounds of evaluation, we already know quite well where each country stands.
- It would not be very useful to simply repeat the same kind of long, descriptive reports.
If I were designing Phase 5, I would:
- Make it much more focused;
- Concentrate on the most significant weaknesses identified in Phase 4;
- Try to understand why they persist – is it political will, coordination, information, skills, or resources?
- Require countries to adopt concrete action plans to address those weaknesses.
For Luxembourg, we already know the key issues: sanctions and very weak enforcement. The Phase 4 report is clear on that.
Luxembourg’s advantage is that it now knows what the Working Group’s expectations are. It should not wait for a Phase 5 calendar – say, 2031 or 2032 – before taking action. In my view, if Luxembourg was serious, it should have started working on a response within weeks of the Phase 4 report’s publication.
The sooner Luxembourg addresses these weaknesses in a practical, measurable way, the better it will be – both in substance and in how it is seen by its peers.