I. Facts (shortened)

The ruling was based on the following facts:
A limited partnership with a GmbH & Co. KG (limited partnership with a limited liability company as general partner; the claimant), represented by a limited partner, has asserted claims for damages against the managing director of the general partner GmbH (limited liability company; the defendant). The object of the claimant’s business is, in particular, the sale of mineral oil products. The claimant operates service stations and issues fuel cards to its customers, which they can use for cashless refueling at the service stations operated by the claimant. The invoice for all refueling transactions of all fuel cards of the respective customer is issued on a monthly basis, and a credit limit is also set for each customer.
Despite setting the respective credit limits, compliance was not monitored until 2006. As a result of the lack of monitoring, two of the claimant’s customers were able to refuel their vehicles in excess of the respective limit and the fuel cards were not blocked despite non-payment of the invoice. This ultimately led to losses of receivables on the part of the claimant. As a result, training sessions were introduced for the management, in which, among other things, the granting of credit to customers and the dual control principle were addressed.
However, several customers continued to use up or overdraw their card limits, which was noticed by the responsible employee of the claimant, but was concealed by the employee, among other things, by assigning the affected customer cards to other customers. The dual control principle was not observed in the employee’s area of activity. Following the opening of several insolvency proceedings relating to the assets of the customers, the claimant suffered losses of around EUR 860,000 as a result of the loss of receivables. The claimant is asserting this against the defendant.
The Nuremberg Regional Court (judgment of 5 April 2019, 2 HK O 3068/18) ordered the defendant to pay the amount claimed.

II. Ruling of the Nuremberg Higher Regional Court

The defendant’s appeal against this ruling was only successful to a limited extent with regard to individual claims. In the opinion of the Nuremberg Higher Regional Court, the managing director of the company is obliged to compensate for the damage incurred pursuant to § 43 para. 2 German Act on Limited Liability Companies (Gesetz betreffend die Gesellschaften mit beschränkter Haftung – GmbHG) due to failure to exercise the due care of a prudent businessman. It is recognized that the scope of protection of the executive body and employment relationship existing between the managing director and the general partner GmbH also extends to the limited partnership (Kommanditgesellschaft).
In defining the diligence of a prudent businessman, it is first clarified that the activity of the management regularly implies risky and possibly disadvantageous decisions and therefore any damage incurred, even in the case of risky behavior, does not constitute a violation of § 43 para. 1 GmbH, because the managing director is generally entitled to a wide scope of assessment. According to the so-called Business Judgement Rule (§ 93 para. 1 sentence 2 German Stock Corporation Act (Aktiengesetz – AktG)), which applies mutatis mutandis to the GmbH, there is no breach of duty if, when making an entrepreneurial decision, the managing director could reasonably assume that he was acting for the benefit of the company on the basis of appropriate information. However, the broad scope for action granted by case law is exceeded if the high risk of damage is unavoidable and, in addition, there are no reasonable business reasons for the action. The decisive factor in this context is the perspective of a prudent and conscientious businessman.
Applied to the specific case, this means in particular that the managing director must ensure an organizational structure that guarantees the legality and efficiency of the company’s actions. The Higher Regional Court concludes from this:
“From the duty of legality follows the obligation of the managing director to establish a compliance management system, i.e., organizational precautions that prevent the commission of legal violations by the company or its employees.”
In addition to monitoring to ensure that business is conducted properly in the normal course of business, the managing director must intervene immediately if there are sufficient indications of misconduct. The monitoring obligation also includes a duty of control, which may not commence only when misconduct is discovered. The intensity of monitoring depends on the hazardous nature of the work and the importance of the regulation to be observed. If the activity is particularly hazardous, occasional inspections are not sufficient. In addition, checks must be carried out to ensure that irregularities do not occur, even without constant direct supervision. Random, surprise checks regularly fulfill this function. The managing director can delegate the monitoring duty; the managing director’s effective monitoring duty is subsequently limited to “monitoring the supervisors”. It should be noted, however, that overall supervision always remains with the managing director, even in the case of multi-level distribution, and that the core duties, in particular organizational and system responsibility for the company’s internal delegation processes, cannot be transferred.

III. Consequences for the practice

Although the explanations in the specific case refer to a GmbH & Co. KG, many of the points are of a general nature. It can be assumed that the principles laid down regarding the obligation of the management to set up a compliance management system can also be applied to other legal forms. The ruling clearly shows that the establishment of compliance management systems is not only important for managing directors/board members of large companies. Medium-sized companies (the claimant, for example, was a company with only 13 employees) or their managing directors must also implement compliance management systems to an appropriate extent. In day-to-day business operations, business managers of all legal forms should urgently review their existing compliance management systems. The decisive factor here is not only their implementation, but also their actual realization and follow-up.
An external audit and certification, e.g. in accordance with IDW PS 980 of the Institute of Public Auditors in Germany, can be useful in order to uncover possible deficits, but even such certification does not automatically exclude liability. The appropriateness of the implemented and practiced compliance management systems remains a case-by-case decision to be made by the court. Existing D&O insurance policies should be reviewed, as they may not cover the damage.
In transactions, the compliance structures of the target company should be closely examined and deficits “flagged” as part of compliance due diligence. The buyer bears responsibility for this from the time of closing at the latest. Significant deficiencies should be remedied before closing in consultation between the seller and the buyer, and after closing an additional comprehensive risk analysis and further adjustments should be carried out if necessary.
This article is the first part of the two-part compliance series. While this article focused on the liability of the managing director pursuant to § 43 para. 2 GmbHG based on the ruling of the Nuremberg Higher Regional Court, the second part (honert newsletter Q4/2022) will deal in particular with the consequences of non-compliance from the company’s perspective and, in addition, with further civil and criminal law risks for managing directors and board members.