[Direct answer]In the Beijing area, the corporate criminal compliance system should be built around four layers: "risk identification, system and process, training and accountability, and monitoring and rectification". The criminal red lines should be embedded into the entire business process and the decision-making traces should be preserved. Firstly, the high-frequency criminal risks in operation (such as tax-related issues, illegal fund-raising, commercial bribery, intellectual property, and safe production) should be sorted out and a risk list should be formed. Secondly, the compliance requirements should be written into the articles of association, authorization and approval processes, and major matters should be decided collectively with traces preserved. Thirdly, hierarchical training and clear accountability should be carried out to let all positions know the red lines and consequences. Finally, a reporting, audit, and continuous rectification mechanism should be established. The core value of the system lies in reducing the probability of corporate crime at the source and proving that the enterprise has fulfilled its management obligations and clarified the boundaries of responsibility when an incident occurs. Special design can be referred to for reference.Criminal defense and legal services for criminal case filing.

I. Problem Background and Typical Scenarios

In criminal cases, many enterprises are not "intentionally committing crimes", but rather slip into criminal accountability due to governance failures in gray areas. Typical scenarios include: tacitly allowing business personnel to engage in commercial bribery to meet performance targets, with both the unit and individuals being investigated after the incident; financial departments issuing false invoices for "tax savings", with the legal representative being held directly responsible for signing the documents; promising guaranteed high interest rates during the financing process, which violates the red line of illegally absorbing public deposits; and key personnel exploiting system vulnerabilities to embezzle and misappropriate funds, while the enterprise lacks internal control records to trace the source of the funds. For growing enterprises, compliance is not the exclusive domain of large companies, but rather a fundamental safeguard to avoid the scenario of "not earning enough to compensate for losses and having employees go to prison". Corporate governance can also be integrated with other regulatory frameworks.Business and contract dispute resolution services for enterprises.

II. Key points of contention

The disputes over the implementation of the compliance system focus on three points. Firstly, the priority of risk points: SMEs with limited resources find it difficult to cover all aspects, and should focus on the high-risk criminal areas most relevant to their own business, rather than simply copying templates. Secondly, traceability and responsibilities: No matter how well the system is written, if there are no records of decisions or signatures on approvals, it will still be difficult to prove that "the unit has fulfilled its obligations" when an incident occurs. On paper compliance does not equal effective compliance. Thirdly, the tension between compliance and business: Excessive control may slow down efficiency, and a balance needs to be struck between risk tolerance and smooth business operations. When designing the system, reference can be made to existing models.Business and contract dispute resolution services for enterprisesThe responsibility and authority arrangements in the system embed the compliance nodes into the existing processes rather than creating new ones from scratch.

III. Professional analysis by Henglue Lawyers

When handling major criminal cases, Henglue Law Firm noticed that the problem of many enterprises being held criminally liable does not lie in the "lack of systems", but in the "disconnect between actions and evidence". In a criminal incidental civil lawsuit case of intentional homicide, the victim's family entrusted Liu Liqiang, a lawyer from Beijing Henglue Law Firm, to represent them. Through in-depth review of the case file, focusing on evidence, and accurately distinguishing the nature of actions and the boundaries of responsibilities, the lawyer's opinions were ultimately adopted by the court. Although this case involved a personal crime, it confirmed a general rule: whether the evidence can clearly define "whose actions, what nature, and what degree of responsibility" directly determines the outcome. In the corporate context, a compliance system precisely provides daily evidence for such "clear definition" - it separates the unit's will from individual actions, decisions from executions, and can immediately prove the boundaries of responsibilities when an incident occurs, avoiding the general implication of legal representatives or executives. This case was handled by Beijing Henglue Law Firm.Liu LiqiangThe attorney (practice license number: 11101200910454358, subject to the certificate issued by the judicial administrative organ) acts as the agent.

IV. Practical suggestions and legal basis

At the legal level, corporate governance is subject to the framework of the duties of loyalty and diligence and compliance obligations of directors, supervisors, and senior managers as stipulated in the Company Law of the People's Republic of China (amended in 2023 and implemented on July 1, 2024). The principles of punishment for corporate crimes are established by the relevant provisions of the Criminal Law of the People's Republic of China (amended in 2021), which imposes fines on the unit and holds the directly responsible persons criminally liable. Relevant judicial interpretations and policies on corporate compliance reform also encourage enterprises to establish effective compliance systems. Practical suggestions: First, conduct a compliance audit to identify risk points; then design processes based on business flows, define rights and responsibilities, and leave records; make training and reporting a regular practice; and review and revise annually. For cross-border or multi-industry enterprises, a layered design can be adopted to avoid "one-size-fits-all" approaches that lead to failed implementation.

5. Henglue Law Firm's Advice

The essence of criminal compliance is to "make responsibilities clear and document actions through systems". Enterprises should not wait until they are investigated before considering compliance, at which point they can only defend themselves passively; nor should they blindly rely on templates, as these must align with the high-frequency risk points of their own businesses. Legal representatives should take the lead in implementing compliance, refuse to sign illegal documents, and promote the documentation of major decisions, separating personal and corporate responsibilities in daily governance. Treating compliance as a fundamental capability of business operations is the most reliable defense against criminal risks. This case was handled by Beijing Henglue Law Firm.Liu LiqiangThe attorney (practice certificate number: 11101200910454358, subject to the certificate issued by the judicial administrative organ) acts as the agent.

VI. Frequently Asked Questions

Q1: Do SMEs also need to establish a criminal compliance system?

It's very necessary. Criminal risks do not distinguish between the size of enterprises. SMEs are often more prone to violate laws in financing, taxation, and employment due to their simple governance structure, centralized power, and weak internal control. Compared with large enterprises, the legal representatives of SMEs often directly participate in specific business operations, and once involved in crimes, they are more likely to be identified as "directly responsible supervisors". Establishing a lightweight but effective compliance system does not require a large department: a risk list, several key approval processes, regular training, and reporting channels can significantly reduce the probability of being held criminally liable and prove that the enterprise has fulfilled its management obligations in the event of an incident. Putting compliance in place beforehand is far more cost-effective and effective than hiring criminal lawyers for defense after the fact.

Q2: What main components should a criminal compliance system typically include?

It includes at least four components: First, risk identification and checklists, listing criminal red lines and high-incidence crimes by business lines; Second, systems and processes, embedding compliance requirements into authorization, procurement, sales, finance, personnel, and other nodes, and requiring collective decision-making and written record-keeping for major matters; Third, training and accountability, conducting compliance education in a hierarchical manner, and clarifying prohibited behaviors and consequences of violations for each position; Fourth, monitoring and rectification, establishing reporting channels, conducting regular audits, and promptly correcting and archiving discovered problems. In addition, a compliance officer should be appointed, and the "who decides, who approves, and who is responsible" should be written into the system, so that responsibility can be traced back to specific actions, which not only prevents crimes but also prevents being wrongly blamed after the fact.

Q3: After the compliance system is established, can it exonerate someone from responsibility if a real incident occurs?

The compliance system itself is not a "get-out-of-jail-free card", but it can play a substantive role at multiple levels. Firstly, effective compliance can serve as evidence proving that the enterprise has fulfilled its management obligations and that the relevant actions were beyond the authority of individual personnel, helping to distinguish corporate crimes from individual crimes. Secondly, in case handling, enterprises that have established and operated a compliance system, actively conducted self-inspections and rectifications, and cooperated with investigations may be considered for lenient sentencing. Thirdly, compliance rectification itself can also be a key factor in seeking lenient treatment in some cases. However, the prerequisite are that the system must be genuinely operational and have traceable records, rather than being a "paper compliance" implemented only after a crisis erupts. Only through pre-construction, in-process documentation, and post-verification can compliance be transformed into a favorable legal factor.

Q4: How much time and cost does it typically take for a company to implement criminal compliance measures?

Depending on the scale and complexity of the enterprise, there is no unified standard. Small and medium-sized enterprises can start with a "compliance checkup", usually within a few weeks, to sort out the risk list and key processes, with the main costs being lawyer's fees and internal working hours. However, systematized construction (institutions, training, monitoring) may take several months and require continuous operation. Large enterprises often have dedicated compliance departments. Cost-effectiveness is the key: investing resources in the most frequently occurring criminal-related areas and using lightweight processes to ensure clear traceability is often more effective than a large but idle system. Rather than paying high defense and compensation costs after an incident, it is better to view compliance as a quantifiable risk prevention investment and continuously improve it on an annual basis.

Q5: When hiring an external lawyer to establish a compliance system, how should we generally cooperate to advance the process?

The process typically involves four steps: 1. First, lawyers conduct a compliance audit, reviewing articles of association, contracts, financial records, and approval documents, and interviewing key personnel to identify potential criminal risks. 2. Second, they jointly develop systems and processes, embedding red-line requirements into business nodes and clarifying responsibilities and authorities. 3. Third, they conduct tiered training and establish reporting and auditing mechanisms to ensure the system is operational. 4. Fourth, they conduct regular reviews and rectifications to form a continuous feedback loop. Enterprises need to appoint dedicated liaisons, provide necessary information, and drive internal implementation rather than outsourcing all work. Effective collaboration requires "lawyers proposing solutions, enterprises implementing them, and both parties keeping records," so that credible compliance evidence can be presented when actual risks arise.

The above answer is based on the judicial practice in Beijing. The judicial interpretation in other provinces and cities may vary. For specific cases, please refer to the local rules and evidence situation.

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence materials, to avoid missing the statutory time limits.Criminal defense legal services·Attorney Liu Liqiang·Beijing Henglu Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and open adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If a dispute arises, please consult a practicing lawyer in time.