Austrian legal reform enhances asset restitution for CEO fraud victims

Understanding CEO fraud

CEO fraud involves perpetrators manipulating employees or decision-makers in companies to transfer large sums of money by pretending the order comes directly from the head of the company. According to the FBI's IC3 Internet Crime Report 2021, CEO fraud was the highest-grossing type of cybercrime in the US, causing about USD 2.4bln in losses to US businesses. The situation is similar worldwide, and with the rise of sophisticated AI, CEO fraud is expected to increase.

Legal framework until 31 December 2024

Under the legal framework in force until 31 December 2024, assets obtained through fraudulent acts could not be restituted to the victims during ongoing proceedings unless:

1. the perpetrators agreed to it; or
2. the assets were no longer needed for evidentiary purposes, and after hearing the perpetrators and other involved parties, no circumstances cast doubt on the victim's rights.

This legal status was unsatisfactory and financially burdensome, especially in CEO fraud cases. The seizure and recovery of assets were often hindered by their transfer to foreign accounts and the unknown identity or whereabouts of the perpetrators. Consequently, victims were left in limbo, unsure if or when the defrauded assets would be restituted.

This situation was aggravated by a landmark Supreme Court ruling on 28 March 2023 (14 OS 137/22m), which clarified that only tangible items (physische Vermögenswerte) could be returned to victims during pending criminal proceedings, even if all other requirements were met.

EU Regulation 2018/1805 – a game-changer?

At the EU level, Regulation (EU) 2018/1805 established a unified framework for the mutual recognition and enforcement of freezing and confiscation orders. Under Article 29, frozen assets are to be "restituted as soon as possible to the victim" if certain requirements are met:

1. the victim's title to the property is not contested;
2. the property is not required as evidence in criminal proceedings in the executing State; and
3. the rights of affected persons are not prejudiced.

Regarding the first requirement, as explicitly stated in Recital 46 of the Regulation, it is sufficient that the victim is recognised as the rightful owner of the property and that no serious claims dispute this. The Regulation also clearly states that a legal person can be a victim (Recital 45) and that property is not reduced to corporeal property but covers all forms (Article 2 (3)).

However, for assets to be restituted to the victim, the competent authority of the Member State in which the assets have been frozen (the executing authority) needs to be provided with a respective decision from the competent authority of the Member State that issued the initial freezing order (the issuing authority). This restitution decision is to be issued "in accordance with its national law" (i.e. that of the issuing state). Unfortunately and frustratingly, Austrian law did not provide for such a law. Therefore, despite the Regulation coming into effect on 19 December 2020 and being directly applicable, it remained ineffective.

Reform of the Austrian Code of Criminal Procedure – finally enabling timely and effective restitution

All this finally changed with a recent reform of the Austrian Code of Criminal Procedure (the "ACCP"). While the new regulation regarding the seizure and examination of mobile data got much of the attention (https://www.schoenherr.eu/content/seizure-and-examination-of-mobile-data-in-austria-new-legal-framework-finally-passed-in-parliament), the lawmaker also quietly reformed provisions covering the restitution of assets (Paras 367 and 368 of the ACCP).

In addition to clarifying that incorporeal assets are also covered by this regime, the new version of Para 367(2) of the ACCP now explicitly allows restitution before a judgment becomes final (vor Rechtskraft des Urteils). 

A key change is the elimination of the requirement for the perpetrators' consent. Instead, perpetrators and other involved parties must be heard only if possible, and this is not required if identifying them would involve disproportionate procedural effort. According to the legislative materials, the provision is explicitly intended for situations where restitution to a victim would fail solely because the perpetrators are unknown – a common scenario in cases of CEO fraud. As a result, restitution should not, and now will not, be indefinitely blocked.

The grounds for excluding restitution are essentially identical to those mentioned already above pursuant to Article 29 of the Regulation.

It should be noted that a procedure according to Para 367 of the ACCP (merely) constitutes an order to whom the property is to be transferred but does not provide for a binding effect on the right to the asset. Neither the convicted person, the private party (if their application for restitution was rejected) nor a third party asserting rights to the property is prevented by the court's decision from pursuing their rights in subsequent civil proceedings.

Conclusion

Better late than never: The reform of Paras 367 and 368 ACCP represents a significant advancement for victims of fraudulent acts, such as CEO fraud. The possibility of restitution during pending criminal proceedings, coupled with the requirement that perpetrators be heard only if possible, eliminates a long-standing blockade of victim funds.

In a recent case handled by Schoenherr, the new regulation was successfully applied, leading to the restitution of defrauded assets. However, since the likelihood of seizing and restituting assets diminishes with every passing minute, it remains crucial to act immediately once fraudulent acts are discovered.

authors: Oliver M. Loksa, Marc Cistota