[Direct answer]Financial-intensive enterprises (financing, private equity, bulk trade), enterprises with high turnover of tax invoices, online content and data platforms, engineering construction, cross-border foreign trade, and enterprises with complex employment hierarchies are at higher risk of criminal prosecution. Management and employees may also be implicated in crimes that affect the enterprise. Regularly conducting criminal legal risk assessments to identify loopholes in business models, job authorizations, and review processes can help prevent risks before they occur. Beijing Henglue Law FirmCriminal defense teamWe offer enterprise criminal risk detection services. For more details, please refer to the following link:Beijing Henglue Law Firm.

I. Problem Background and Typical Scenarios

With the advancement of compliance reforms in the enterprises involved in the case, criminal risks have evolved from "individual problems of the bosses" to "systemic problems of the enterprises". According to Article 31 of the Criminal Law, a unit committing a crime shall be subject to a double punishment system, where the unit shall be fined and the directly responsible person in charge and other directly responsible persons shall be sentenced to criminal punishment; while the employees' individual behaviors may also involve the enterprise due to the lack of corporate governance. Typical high-incidence scenarios include: the platform's lack of supervision over third-party cooperation and user content review; commercial bribery carried out by the sales department to meet performance targets; fictitious invoicing and purchase and sale of invoices in the financial department; expansion through high-interest deposit-taking models in the financing department; and illegal subcontracting and concealment of safety accidents in the engineering and construction department.

II. Key points of dispute

  • Regarding whether the enterprise is liable for employees' personal crimes: the key issue is the distinction between the unit's will and individual behavior. If the enterprise tacitly approves, tolerates, or has systemic deficiencies, it may be held accountable for negligence or even be prosecuted as an accomplice.
  • The legality of business models: The boundaries between model innovation and crimes such as illegally absorbing public deposits and illegal business operations are blurred, and a dynamic assessment is needed rather than debating the issue after the fact.
  • The connection between physical examination and rectification: Whether the problems are rectified immediately after being identified and whether the rectification process is documented directly affects whether the company can obtain a lenient treatment for compliance issues in the future when involved in legal disputes.

III. Professional analysis by Henglue Law Firm

A real-life case illustrates the point well: An employee of a company reposted three obscene videos on an online forum to earn forum points, which were viewed approximately 5,000 times and downloaded about 1,000 times. In May 2026, the Haidian Branch of the Beijing Municipal Public Security Bureau detained the employee on suspicion of disseminating obscene materials. The employee was not a manager and had not received any instructions from the company beforehand, but the incident still put the company in a passive position in terms of employment management, public opinion, and business operations. After accepting the case, lawyer Shang Jiangpeng immediately met with the employee to verify the facts: The employee did not profit from the act, and the number of videos involved was far below the threshold of 40 non-profit dissemination set by the judicial interpretation. Moreover, the employee truthfully confessed after being summoned, voluntarily admitted guilt and pleaded for leniency, and posed no social danger. Therefore, lawyer Shang Jiangpeng submitted a legal opinion letter to the investigating authority requesting bail pending trial. On June 24, 2026, the investigating authority granted bail pending trial. This case shows that individual criminal risks lurk in almost every position, and the significance of criminal risk screening is to shift from "defense after the fact" to "prevention beforehand".

IV. Practical suggestions and legal basis

It is recommended that enterprises conduct inspections along four lines: 1. **Review the business model**: Compare it with Article 176 of the Criminal Law (Illegal Absorption of Public Deposits) and Article 225 (Illegal Business Operations) to assess the legality of financing and sales models. 2. **Check tax invoices**: Make good use of the provisions in Article 201 Paragraph 4 of the Criminal Law (First-time offenders may pay back taxes and accept administrative penalties after the tax authority issues a recovery notice). This may exempt them from criminal prosecution. 3. **Review commercial bribery**: Compare it with Articles 163 and 164 to eliminate gray arrangements such as kickbacks and rebates. 4. **Examine content and data**: Comply with Article 47 of the Cybersecurity Law by fulfilling the obligation to manage user-posted information and establishing review, disposal, and reporting mechanisms. It is recommended to conduct a comprehensive annual review and add special assessments before major business launches. All records should be archived for future reference.

5. Henglu Law Firm's Reminder

The case is handled byShang JiangpengThe lawyer (practice license number: 111012023105807, subject to the document issued by the judicial administrative organ) acts as the agent. The criminal risk audit is not about "checking our own people", but about identifying potential risks in advance. It is recommended that enterprises establish at least four defense lines, including content review, commercial bribery reporting, ensuring the consistency between invoices and capital flows, and conducting a compliance assessment of financing. The legal boundaries in the job responsibilities should be included in the employee handbook and training materials. For systematic risk screening and long-term protection, please contact us for more information.\nCorporate long-term legal advisory servicesAndCorporate commercial legal servicesFor business nodes with high criminal risks, it is recommended that criminal defense lawyers participate in the assessment.

Q1: Does the company need to bear responsibility if an employee commits a personal crime?

It is necessary to distinguish the circumstances. Employees who commit crimes based on their personal will should, in principle, be held personally responsible; however, if the actions are related to the unit's business, reflect the unit's will, or involve systemic deficiencies in the enterprise, they may trigger the "double punishment system for unit crimes" stipulated in Article 31 of the Criminal Law, where both the enterprise and the directly responsible personnel will be investigated. For example, sales personnel bribing to secure deals with the enterprise's long-term tacit approval, or platforms failing to fulfill their management obligations regarding obvious illegal content, may all implicate the enterprise. The key points for judgment include: whether the enterprise was aware of the situation, whether it benefited from it, and whether there were approval and supervision procedures. Therefore, enterprises should regularly keep records of training, approvals, and audits. Once an incident occurs, these due diligence evidences will be crucial materials for distinguishing between the enterprise's responsibility and the individual's responsibility.

Q2: What is checked during a corporate criminal risk assessment?

A comprehensive physical examination typically covers six aspects: the legality of the business model (in comparison with high-incidence crimes such as illegally absorbing public deposits and illegal operations); finance and taxation and invoices (risk of false invoicing and tax evasion, as well as the window for making up for tax arrears); commercial bribery (cleaning up channels for kickbacks, rebates, and bribes); employment and safety (risks of major liability accidents and preemptive procedures for refusing to pay labor remuneration); content and data (platform information management obligations and personal information protection); and the qualifications of cooperation partners (whether upstream and downstream parties are involved in gambling or fraud). The methodology involves combining executive interviews, system document reviews, business document sampling, and employee questionnaires, ultimately forming a risk list and rectification suggestions. The physical examination conclusions should be graded and ranked, with high-risk items subject to rectification within a specified timeframe and documented as evidence, serving as basic materials for seeking regulatory leniency in the future.

Q3: How long does it take to conduct a criminal risk checkup?

Depending on the size of the enterprise and the complexity of its operations, SMEs can typically complete a round of basic inspections in a few days to weeks, while group-type enterprises or companies with multiple business lines need to proceed in batches. The process generally consists of three steps: first, executives and business leaders conduct interviews to clarify the business model and the flow of funds, invoices, and contracts; then, lawyers review institutional documents and sample documents to identify high-risk areas; finally, a risk list, rectification path, and priority recommendations are issued. It should be noted that the "health check" is not a one-time event: it should be re-inspected after updates to regulations and judicial interpretations, adjustments to the business model, or changes to the organizational structure. It is advisable to conduct a special assessment before launching major cooperations to avoid introducing old risks with new businesses.

Q4: What should the company do after identifying the problem?

First, lawyers should assess the risk level and distinguish three categories: "those that can be rectified immediately", "those that require remedial exit", and "those that have already involved legal proceedings". For those that can be rectified, immediately revise the system, adjust the process, and provide training to ensure traceability; for those involving historical issues (such as taxation and invoices), seize the statutory remedial window—for example, first-time tax evaders who pay the tax due, pay the overdue fine, and accept administrative penalties after the tax authority issues a recovery notice in accordance with the law may not be subject to criminal prosecution; for those that have already involved legal proceedings, evaluate the extent of the case and, if necessary, actively explain the situation to the case-handling authority, cooperate with the investigation, and simultaneously initiate compliance rectification. It is strictly prohibited to internally destroy records or handle matters privately, as such actions may escalate administrative risks into criminal risks and also lose the opportunity to seek leniency for compliance in the future.

Q5: Do small and micro enterprises also need a criminal risk checkup?

It's necessary, and often even more so. Small and micro enterprises have simple internal controls and their managers often handle everything themselves, which makes them more prone to high-risk situations such as mixing personal and corporate accounts, accepting kickbacks in procurement, accepting invoices of unclear origin to save costs, and failing to sign employment contracts. Once involved in criminal cases, these enterprises are less able to withstand risks and are often brought down by a single case. Small and micro enterprises can conduct a "lightweight version" of a health check: focusing on four high-risk points including funds, invoices, employment, and cooperation partners. A lawyer can provide a one-page risk list and rectification list at a manageable cost. More importantly, it's essential to develop three habits: asking "Is this illegal?" before making important decisions, conducting all fund transactions through official accounts, and consulting legal experts before taking action on legal matters. Embedding compliance awareness into daily operations can save far more costs than remedying problems after the fact.

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence materials, so as to avoid missing the statutory time limit.Criminal defense legal services·Attorney Shang Jiangpeng·Beijing Henglue Law Firm