The relationship between Legislative Decree 231 and tax crimes directly concerns how a company organizes billing, tax returns, payments, compensations, and document retention. I will explain why an accounting error does not automatically amount to a crime, but also why certain tax conduct can expose not only the individuals involved, but the entity itself to specific penalties.
The practical doubt is often this: is it enough to rely on an accountant or an administrative department to be protected? And does a Legislative Decree 231 model already adopted truly cover tax areas? I want to clarify which crimes may become relevant, what makes a model genuinely useful, and which controls help prevent opaque decisions, unreliable documents, and untracked cash flows.
Why tax crimes can also involve the entity
Decree 231 liability is distinct from that of the individual. If the prerequisites set forth by Legislative Decree no. 231 of 2001 are met, the company may receive an administrative penalty dependent on a crime, alongside the proceedings concerning directors, managers, employees, or other involved parties. It is therefore incorrect to view a tax offense as the exclusively personal risk of whoever signs a tax return or arranges a payment.
For the entity, the primary consideration is the connection between the conduct and its interest or advantage. Interest concerns the objective pursued by the conduct; advantage concerns the utility that the business actually obtained, also in the form of tax savings, financial availability, or the artificial improvement of results. Not every violation by an individual falls back upon the company, but an organization that derives a benefit from the conduct or makes it easier can be exposed to Decree 231 risk.
The area of tax offenses relevant to the entity's liability includes, in particular, fraudulent tax return conduct, use or issuance of documents regarding nonexistent operations, concealment or destruction of accounting records, and fraudulent evasion of tax payments. The text of the intervention that extended and articulated this area also indicates pecuniary penalties and the application of disqualifying sanctions in certain cases: Article 5 of Legislative Decree no. 156 of 2022.
Penalties do not only concern money. In addition to the penalty calculated in shares, in the provided cases disqualifying measures may apply, meaning limitations capable of hindering the business's activity, such as the prohibition to contract with public administration or exclusion from grants and financing. For this reason, tax safeguarding is not a separate chapter of accounting: it enters into the operational continuity, commercial relationships, and reputation of the company.
Which tax situations require a 231 safeguard
The first risk concerns the quality of documented operations. An invoice is not merely a document to be recorded: it must correspond to a real operation, consistent with the contract, order, delivery, service, and payment. The problem does not stem from a simple formal inaccuracy, but from the distance between what the document represents and what actually occurred.
This applies both to those who receive and those who issue invoices. If the company purchases goods or services, it must be able to prove who provided them, why they were necessary, how they were executed, and under what economic conditions. If it sells or provides services, it must ensure that the active cycle correctly reports the client, the service, the consideration, and the tax. Traceability must follow the operation, rather than being constructed only when a dispute arises.
Compensations, tax credits, and payments
Compensation requires clear rules before submitting the payment form. Using a credit to reduce tax debts can be legitimate, but it requires that the credit exists, is due, is usable at that moment, and is correctly documented. An effective procedure is not limited to requesting final authorization: it distinguishes who reconstructs the credit, who checks the requirements, and who arranges the utilization.
Payments also deserve attention. Postponing a payment, choosing to pay in installments, or managing a liquidity crisis do not, by themselves, equate to fraud. Financial difficulty does not cancel controls: the debt must be recorded, baseless compensations avoided, decisions documented, and an information flow maintained toward the competent corporate bodies. The company must prevent cash urgency from turning a temporary choice into a disorganized and unverifiable management.
Transactions with foreign counterparties
Some offences require a specific cross-border dimension. Inaccurate returns, failure to file returns and unlawful tax offsets under Articles 4, 5 and 10-quater of Legislative Decree no. 74 of 2000 fall within Article 25-quinquiesdecies only when committed to evade VAT through fraudulent schemes connected with at least one other EU Member State, causing or potentially causing total damage of at least ten million euros. These additional conditions do not apply to the offences already listed in the first paragraph, including fraudulent returns and issuing false invoices: Article 25-quinquiesdecies. Lawful foreign business remains entirely possible; checks establish the counterparties, services and payments involved.
What a useful Legislative Decree 231 model must contain on a tax level
An effective model starts from risk activities. It is not enough to include a general paragraph on tax crimes or recall the prohibition to commit unlawful acts. The model must identify where the business forms tax and accounting data, who can impact that data, which steps are exposed to discretion, and which documents allow reconstructing a decision.
In the tax area, functions to consider may include administration, finance, purchasing, sales, warehouse, personnel, management, and controlled or affiliated companies when participating in relevant flows. The risk map follows real processes: a business selling digital services will have different criticalities from a business moving goods, using warehouses, working with subcontractors, or accessing tax credits.
The second element is the protocol, meaning the operational rule establishing who does what, with which documents, and with which controls. For a passive invoice, for example, the protocol may require correspondence between contract, order, service confirmation, recording, and payment. For compensation, it can distinguish credit reconstruction, regulatory control, authorization, and telematic submission. The separation of roles reduces the risk that the same person creates, approves, and records an unverified operation.
The model must also provide for information flows toward the supervisory body. This does not mean transmitting every invoice, but signaling significant anomalies: counterparties lacking adequate documentation, operations with inconsistent margins, accounting variations without justification, significant use of credits, findings by control bodies, or tax disputes. The supervisory body must receive usable information, not an indistinct mass of documents.
The model is not an automatic protection
Adopting a model does not itself exclude liability. For an offence committed by senior management, Article 6 requires all of the following: a suitable model adopted and effectively implemented before the offence, supervision by a body with autonomous powers, fraudulent circumvention of the model by the offender, and no omitted or insufficient supervision. Subordinates fall under the separate rules in Article 7. A copied document, unknown to staff or unsupported by procedures actually followed, does not demonstrate an organisation capable of preventing offences.
Training is useful if it concerns recognizable decisions. Whoever selects suppliers must know which elements make a service reliable; whoever manages accounting must know the controls before recording; whoever approves payments or compensations must understand the limits of their authorization. Instructions must be understandable and verifiable, otherwise the rule remains far from daily activity.
The disciplinary and whistleblowing system also counts. A procedure prohibiting improper behavior but providing no internal consequences, channels to report anomalies, and periodic controls loses preventive force. The point is not to punish good-faith errors: it is to make rule violations recognizable, intervene on anomalies, and correct processes that have shown a concrete defect.
Implementation documentation is decisive. Resolutions, delegations, performed controls, reports, internal audits, training, and updates must leave a consistent trace. Preserving these elements does not serve to create a retrospective defense, but to demonstrate that organizational rules had a real function prior to any potential dispute.
When to update the tax part of the Legislative Decree 231 Model
The model must be updated when concrete risk changes. Entry into new markets, acquisition of a company, a new management system, use of tax incentives, outsourcing of accounting, or recourse to new intermediaries can modify the points where tax data and relevant documents are formed. Even a finding emerging in an audit or inspection can show that an existing control is insufficient.
The consolidated legislation on tax penalties approved by Legislative Decree no. 173 of 2024 applies from 1 January 2027, under its Article 102. In 2026, tax offences remain governed by Legislative Decree no. 74 of 2000. The update date shown on a legislation page does not necessarily identify when its provisions become applicable: a model must respect the actual commencement date without prematurely replacing references that still apply.
A useful update does not consist in replacing article numbers. It is necessary to verify whether procedures still describe business activities, whether internal thresholds are adequate, whether controls are entrusted to subjects with effective powers, and whether the supervisory body receives information on currently most exposed areas. If only citations change, a targeted adjustment may suffice; if commercial or tax flows change, a broader revision is needed.
A few concrete elements are needed to prepare an initial review. Useful items include the current Legislative Decree 231 Model, tax and accounting protocols, the organizational chart with delegations and powers of attorney, procedures regarding suppliers, invoices, and payments, as well as any internal findings or those from the financial administration. These documents help distinguish a simple formal update from an organizational deficiency affecting daily controls.
Frequently asked questions
Does an already adopted Legislative Decree 231 Model automatically cover tax crimes?
No, not automatically. The model must include an effective analysis of tax risks and protocols consistent with the enterprise's activity. A model adopted prior to the introduction or evolution of tax crime regulations may require updating, especially if it contains outdated regulatory references or fails to regulate invoices, credits, payments, and relations with foreign counterparties.
Does an error in a tax return always entail 231 liability?
No, error does not coincide in itself with a crime. A distinction must be made between inaccuracy, administrative violation, and conduct constituting one of the relevant offenses. For entity liability, a connection between the crime and the company's interest or advantage is also required, alongside other prerequisites set forth by Decree 231 regulations.
Can we delegate everything to the accountant?
The assignment to the professional does not replace corporate controls. The accountant can handle fulfilments and provide technical evaluations, but the enterprise must maintain reliable data, approve relevant documents, and communicate complete information. The Legislative Decree 231 Model must also regulate the relationship with external consultants, clarifying information flows, authorizations, and internal responsibilities.
Who must report a tax anomaly to the supervisory body?
Whoever intercepts the anomaly in their own process reports it. Administration, finance, purchasing, sales, and management can spot inconsistent data or insufficient documents. The model must indicate which events require communication and through what channel. Reporting every operational difficulty is unnecessary, but anomalies that can impact tax returns, invoices, credits, or payments must not remain isolated.
Does a tax audit require redoing the entire Legislative Decree 231 Model?
Not necessarily. An audit may concern a circumscribed point and make a correction of the involved procedure sufficient. However, if it highlights nonexistent controls, confused delegations, lack of traceability, or repeated anomalies across multiple functions, reviewing the tax risk map and the entire protocol section of the model may become necessary.
Prevention means making decisions controllable
Effective tax prevention combines rules and facts. The company must be able to explain why an operation was concluded, who authorized it, which documents support it, and which controls were performed. A Legislative Decree 231 Model well connected to tax processes does not eliminate every risk, but reduces areas of opacity and helps recognize anomalies before they produce more severe consequences.
If you need to understand whether your Legislative Decree 231 Model truly addresses tax crimes or if a concrete situation requires an update, you can contact me.